短信SMS觸發SIMOTA流程STKBIP協議分析案例(日本Docomo)

admin 2年前 (2022-02-02) caiji 204 0

免費的無紡布手提袋在線報價，輸入規格參數，全程10秒鐘出價格，方便快捷，歡迎使用！

版本歷史ReversionDateAuthorDescription of change0.12018-03-26Vicent GAOInitial目錄1. 寫在前面 31.1. 什么是BIP 31.2. BIP 無紡布廠家15838056980能做些什么？ 31.3. BIP功能的普及性如何？ 32. BIP流程的觸發 42.1. 模塊收到SIM Data download類型的新短信 42.2. 模塊向電話卡發送ENVELOP命令（SMS-PP Download） 73. OPEN CHANNEL（可以理解為：PDP激活） 93.1. 模塊向電話卡發送FETCH命令（OPEN CHANNEL） 93.2. 模塊向電話卡發送TERMINAL RESPONSE命令（OPEN CHANNEL） 94. SEND DATA（發送數據到Internet服務器） 114.1. 模塊向電話卡發送FETCH命令（SEND DATA） 114.2. 模塊向電話卡發送TERMINAL RESPONSE命令（SEND DATA） 115. RECEIVE DATA（從Internet服務器接收數據） 135.1. 模塊向電話卡發送ENVELOP命令（Data available） 135.2. 模塊向電話卡發送FETCH命令（RECEIVE DATA） 135.3. 模塊向電話卡發送TERMINAL RESPONSE命令（RECEIVE DATA） 146. CLOSE CHANNEL（可以理解為：去激活PDP） 166.1. 模塊向電話卡發送FETCH命令（CLOSE CHANNEL） 166.2. 模塊向電話卡發送TERMINAL RESPONSE命令（CLOSE CHANNEL） 161. 寫在前面1.1 什么是BIPBIP（Bearer Independent Protocol），屬于電話卡STK功能的子功能，電話卡通過使用STK BIP，可以使用模塊的數據功能，與遠程的Internet服務器進行數據交互，實現一些功能，如常見的OTA功能。1.2 BIP能做些什么？電話卡可以通過BIP功能來更新電話卡內的文件系統、固件版本等。設想中的更高級的可以實現的功能是：卡A初始是中國移動的卡，通過BIP下載并更新了中國無紡布廠家15838056980聯通的文件系統，卡A搖身一變就是中國聯通的卡了。1.3 BIP功能的普及性如何？普及性比較小，在中國都找不到支持BIP功能的電話卡，只有在國外零星會用到一點。但是在做國外的運營商認證的時候，BIP都是必測項。2. BIP流程的觸發2.1 模塊收到SIM Data download類型的新短信2018 Mar 20 06:21:27.248 [3F] 0x713A UMTS UE OTA -- SMS_CP_DATAMessage Direction = To UEchan_type = 0 (0x0)prot_disc_check = 9 (0x9)trans_id_or_skip_ind = 0 (0x0)prot_disc = 9 (0x9) (GSM_SMS_MESSAGES)msg_type = 1 (0x1)protsms_protsms_cp_datasms_cp_user_datalength = 105 (0x69)rp_messagemti = 1 (0x1)message_reference = 24 (0x18)sms_rp_message_bodyrp_data_to_ueorig_addrlength = 7 (0x7)ext = 1 (0x1)type = 1 (0x1)num_plan_id = 1 (0x1)number[0] = 4 (0x4)number[1] = 2 (0x2)number[2] = 3 (0x3)number[3] = 7 (0x7)number[4] = 9 (0x9)number[5] = 0 (0x0)number[6] = 1 (0x1)number[7] = 0 (0x0)number[8] = 5 (0x5)number[9] = 5 (0x5)number[10] = 0 (0x0)number[11] = 15 (0xf)dest_addrlength = 0 (0x0)user_datalength = 93 (0x5d)sms_tpdu_protmti = 0 (0x0)sm_tl_sms_deliverreply_path = 0 (0x0)udh_indicator = 1 (0x1)stat_rep_indicator = 0 (0x0)more_messages = 1 (0x1)orig_addresslength = 6 (0x6)type_of_number = 0 (0x0)number_plan_id = 9 (0x9)addr_value[0] = 9 (0x9)addr_value[1] = 0 (0x0)addr_value[2] = 0 (0x0)addr_value[3] = 0 (0x0)addr_value[4] = 3 (0x3)addr_value[5] = 0 (0x0)prot_id = 127 (0x7f) ((U)SIM Data download)data_coding_scheme = 246 (0xf6) (0xf6 data coding=1, class=2)serv_cent_time_stamp_date =(0x) (03/20/18)serv_cent_time_stamp_time =(0x) (06:21:25)serv_cent_time_stamp_tz = 0 (0x0) (0x00 +00:00)tp_user_datauser_data_len = 77 (0x4d)sm_tp_user_data_ascii_8udhl = 2 (0x2)num_ies = 1 (0x1)info_elements[0]iei = 112 (0x70) (USIM_TOOLKIT_SEC_HDRS_0)usim_toolkit_sec_hdrsuser_data_8_bit[0] = 0 (0x0) (00)user_data_8_bit[1] = 72 (0x48) (0110)user_data_8_bit[2] = 21 (0x15) (025)user_data_8_bit[3] = 22 (0x16) (026)user_data_8_bit[4] = 1 (0x1) (01)user_data_8_bit[5] = 18 (0x12) (022)user_data_8_bit[6] = 18 (0x12) (022)user_data_8_bit[7] = 0 (0x0) (00)user_data_8_bit[8] = 0 (0x0) (00)user_data_8_bit[9] = 0 (0x0) (00)user_data_8_bit[10] = 55 (0x37) (067)user_data_8_bit[11] = 198 (0xc6) (0306)user_data_8_bit[12] = 76 (0x4c) (0114)user_data_8_bit[13] = 40 (0x28) (050)user_data_8_bit[14] = 241 (0xf1) (0361)user_data_8_bit[15] = 194 (0xc2) (0302)user_data_8_bit[16] = 240 (0xf0) (0360)user_data_8_bit[17] = 65 (0x41) (0101)user_data_8_bit[18] = 64 (0x40) (0100)user_data_8_bit[19] = 218 (0xda) (0332)user_data_8_bit[20] = 20 (0x14) (024)user_data_8_bit[21] = 148 (0x94) (0224)user_data_8_bit[22] = 62 (0x3e) (076)user_data_8_bit[23] = 116 (0x74) (0164)user_data_8_bit[24] = 66 (0x42) (0102)user_data_8_bit[25] = 14 (0xe) (016)user_data_8_bit[26] = 133 (0x85) (0205)user_data_8_bit[27] = 179 (0xb3) (0263)user_data_8_bit[28] = 126 (0x7e) (0176)user_data_8_bit[29] = 20 (0x14) (024)user_data_8_bit[30] = 110 (0x6e) (0156)user_data_8_bit[31] = 108 (0x6c) (0154)user_data_8_bit[32] = 13 (0xd) (015)user_data_8_bit[33] = 200 (0xc8) (0310)user_data_8_bit[34] = 79 (0x4f) (0117)user_data_8_bit[35] = 12 (0xc) (014)user_data_8_bit[36] = 174 (0xae) (0256)user_data_8_bit[37] = 197 (0xc5) (0305)user_data_8_bit[38] = 9 (0x9) (011)user_data_8_bit[39] = 172 (0xac) (0254)user_data_8_bit[40] = 27 (0x1b) (033)user_data_8_bit[41] = 93 (0x5d) (0135)user_data_8_bit[42] = 85 (0x55) (0125)user_data_8_bit[43] = 170 (0xaa) (0252)user_data_8_bit[44] = 45 (0x2d) (055)user_data_8_bit[45] = 226 (0xe2) (0342)user_data_8_bit[46] = 176 (0xb0) (0260)user_data_8_bit[47] = 144 (0x90) (0220)user_data_8_bit[48] = 117 (0x75) (0165)user_data_8_bit[49] = 221 (0xdd) (0335)user_data_8_bit[50] = 14 (0xe) (016)user_data_8_bit[51] = 148 (0x94) (0224)user_data_8_bit[52] = 242 (0xf2) (0362)user_data_8_bit[53] = 48 (0x30) (060)user_data_8_bit[54] = 41 (0x29) (051)user_data_8_bit[55] = 135 (0x87) (0207)user_data_8_bit[56] = 19 (0x13) (023)user_data_8_bit[57] = 180 (0xb4) (0264)user_data_8_bit[58] = 50 (0x32) (062)user_data_8_bit[59] = 41 (0x29) (051)user_data_8_bit[60] = 134 (0x86) (0206)user_data_8_bit[61] = 50 (0x32) (062)user_data_8_bit[62] = 31 (0x1f) (037)user_data_8_bit[63] = 200 (0xc8) (0310)user_data_8_bit[64] = 42 (0x2a) (052)user_data_8_bit[65] = 104 (0x68) (0150)user_data_8_bit[66] = 223 (0xdf) (0337)user_data_8_bit[67] = 1 (0x1) (01)user_data_8_bit[68] = 163 (0xa3) (0243)user_data_8_bit[69] = 84 (0x54) (0124)user_data_8_bit[70] = 35 (0x23) (043)user_data_8_bit[71] = 15 (0xf) (017)user_data_8_bit[72] = 231 (0xe7) (0347)user_data_8_bit[73] = 85 (0x55) (0125)user_data_8_bit[74] = 0 (0x0) (00)2.2 模塊向電話卡發送ENVELOP命令（SMS-PP Download）模塊 -> 電話卡：80 C2 00 00 6E電話卡 -> 模塊：C2模塊 -> 電話卡：D1 6C 02 02 83 81 06 07 91 24 73 09 01 55 F0 0B 5D 44 06 89 09 00 03 7F F6 81 30 02 60 12 52 00 4D 02 70 00 00 48 15 16 01 12 12 00 00 00 37 C6 4C 28 F1 C2 F0 41 40 DA 14 94 3E 74 42 0E 85 B3 7E 14 6E 6C 0D C8 4F 0C AE C5 09 AC 1B 5D 55 AA 2D E2 B0 90 75 DD 0E 94 F2 30 29 87 13 B4 32 29 86 32 1F C8 2A 68 DF 01 A3 54 23 0F E7 55電話卡 -> 模塊：61 13模塊 -> 電話卡：00 C0 00 00 13電話卡 -> 模塊：C0 02 71 00 00 0E 0A 00 00 00 00 00 00 00 11 00 00 02 90 00 91 0B//QCAT APDU解析內容：slot value:1ENVELOPELogical Channel: 0UICC instruction classCLA - No SM used between terminal and cardSMS-PP Download -- Command Data:Device IDSource ID : networkDestination ID : SIMAddressType of Number : International NumberNumbering Plan ID : ISDN/telephonyDialing Number : SMS TPDU TLV : 0x0B 0x5D 0x44 ...SMS-PP Download -- Response Data:UICC Acknowledgement : 0x02 0x71 0x00 0x00 0x0E 0x0A 0x00 0x00 0x00 0x00: 0x00 0x00 0x00 0x11 0x00 0x00 0x02 0x90 0x00Status Words - 0x91 0x0B - Normal ending of command, Extra info from proactive SIM Data available3. OPEN CHANNEL（可以理解為：PDP激活）3.1 模塊向電話卡發送FETCH命令（OPEN CHANNEL）模塊 -> 電話卡：80 12 00 00 29電話卡 -> 模塊：12 D0 27 81 03 01 40 03 82 02 81 82 05 00 35 07 02 00 00 03 00 00 02 39 02 02 00 47 01 00 3C 03 02 10 14 3E 05 21 34 1C 80 C8 90 00//QCAT APDU解析內容：slot value:1FETCHLogical Channel: 0UICC instruction classCLA - No SM used between terminal and cardProactive command data:Command DetailsCommand Number : 1Command Type : OPEN CHANNELCommand Qualifier : immediate link establishment: auto reconnection: no background modeDevice IDSource ID : SIMDestination ID : terminalBuffer Size : 512 bytesNetwork Access Name :Data Destination Addr : IPv4 address: 52.28.128.200Status Words - 0x90 0x00 - Normal ending of the command3.2 模塊向電話卡發送TERMINAL RESPONSE命令（OPEN CHANNEL）模塊 -> 電話卡：80 14 00 00 1D電話卡 -> 模塊：14模塊 -> 電話卡：81 03 01 40 03 02 02 82 81 03 01 00 38 02 81 00 35 07 02 00 00 03 00 00 02 39 02 02 00電話卡 -> 模塊：91 4E//QCAT APDU解析內容：slot value:1TERMINAL RESPONSELogical Channel: 0UICC instruction classCLA - No SM used between terminal and cardResponse DataCommand DetailsCommand Number : 1Command Type : OPEN CHANNELCommand Qualifier : immediate link establishment: auto reconnection: no background modeDevice IDSource ID : terminalDestination ID : SIMResultGeneral Result : Cmd performed successfullyChannel Status : Channel Identifier 1For CS, PDP, local & Default bearer: Link established or PDP context activatedFor UICC Server Mode : TCP in ESTABLISHED stateFor Term. Server Mode & TCP: TCP in ESTABLISHED stateUnknown TLV : 0x00 0x02 0x39 ...Status Words - 0x91 0x4E - Normal ending of command, Extra info from proactive SIM Data available4. SEND DATA（發送數據到Internet服務器）4.1 模塊向電話卡發送FETCH命令（SEND DATA）模塊 -> 電話卡：80 12 00 00 4E電話卡 -> 模塊：12 D0 4C 81 03 01 43 01 82 02 81 21 36 41 16 03 03 00 3C 01 00 00 38 03 03 37 00 C0 4F CB 0F 39 C8 D8 6C A5 FE CF 98 1E 9D 0C C3 C6 77 21 AF 02 58 9E 7C 84 F8 5F 53 1E B8 00 00 0A 00 AE 00 8C 00 8B 00 B0 00 2C 01 00 00 05 00 01 00 01 01 90 00//QCAT APDU解析內容：slot value:1FETCHLogical Channel: 0UICC instruction classCLA - No SM used between terminal and cardProactive command data:Command DetailsCommand Number : 1Command Type : SEND DATACommand Qualifier : send data immediatelyDevice IDSource ID : SIMDestination ID : Channel 1channel data : 0x22 0x3 0x3 0x0 0x60 0x1 0x0 0x0 0x56 0x3 0x3 0x55 0x0 0x192 0x79 0x203 0x15 0x57 0x200 0x216 0x108 0x165 0x254 0x207 0x152 0x30 0x157 0x12 0x195 0x198 0x119 0x33 0x175 0x2 0x88 0x158 0x124 0x132 0x248 0x95 0x83 0x30 0x184 0x0 0x0 0x10 0x0 0x174 0x0 0x140 0x0 0x139 0x0 0x176 0x0 0x44 0x1 0x0 0x0 0x5 0x0 0x1 0x0 0x1 0x1Status Words - 0x90 0x00 - Normal ending of the command4.2 模塊向電話卡發送TERMINAL RESPONSE命令（SEND DATA）模塊 -> 電話卡：80 14 00 00 0F電話卡 -> 模塊：14模塊 -> 電話卡：81 03 01 43 01 02 02 82 81 03 01 00 37 01 FF電話卡 -> 模塊：91 13//QCAT APDU解析內容：slot value:1TERMINAL RESPONSELogical Channel: 0UICC instruction classCLA - No SM used between terminal and cardResponse DataCommand DetailsCommand Number : 1Command Type : SEND DATACommand Qualifier : send data immediatelyDevice IDSource ID : terminalDestination ID : SIMResultGeneral Result : Cmd performed successfullyChannel Data Length : More than 255 bytes availableStatus Words - 0x91 0x13 - Normal ending of command, Extra info from proactive SIM Data available5. RECEIVE DATA（從Internet服務器接收數據）5.1 模塊向電話卡發送ENVELOP命令（Data available）模塊 -> 電話卡：80 C2 00 00 10電話卡 -> 模塊：C2模塊 -> 電話卡：D6 0E 19 01 09 02 02 82 81 38 02 81 00 37 01 36電話卡 -> 模塊：91 0E//QCAT APDU解析內容：slot value:1ENVELOPELogical Channel: 0UICC instruction classCLA - No SM used between terminal and cardEvent Download -- Command Data:Event List : Data availableDevice IDSource ID : terminalDestination ID : SIMChannel Status : Channel Identifier 1For CS, PDP, local & Default bearer: Link established or PDP context activatedFor UICC Server Mode : TCP in ESTABLISHED stateFor Term. Server Mode & TCP: TCP in ESTABLISHED stateChannel Data Length : 54Status Words - 0x91 0x0E - Normal ending of command, Extra info from proactive SIM Data available5.2 模塊向電話卡發送FETCH命令（RECEIVE DATA）模塊 -> 電話卡：80 12 00 00 0E電話卡 -> 模塊：12 D0 0C 81 03 01 42 00 82 02 81 21 37 01 36 90 00//QCAT APDU解析內容：slot value:1FETCHLogical Channel: 0UICC instruction classCLA - No SM used between terminal and cardProactive command data:Command DetailsCommand Number : 1Command Type : RECEIVE DATADevice IDSource ID : SIMDestination ID : Channel 1Channel Data Length : 54Status Words - 0x90 0x00 - Normal ending of the command5.3 模塊向電話卡發送TERMINAL RESPONSE命令（RECEIVE DATA）模塊 -> 電話卡：80 14 00 00 47電話卡 -> 模塊：14模塊 -> 電話卡：81 03 01 42 00 02 02 82 81 03 01 00 36 36 16 03 03 00 31 02 00 00 2D 03 03 4D C9 C5 AC 09 53 88 FF F5 FB 19 32 51 01 D7 D8 A1 16 A6 FC E6 D5 EC 9F 4B 2C 2C 38 5C 89 15 A8 00 00 8C 00 00 05 00 01 00 01 01 37 01 00電話卡 -> 模塊：90 00//QCAT APDU解析內容：slot value:1TERMINAL RESPONSELogical Channel: 0UICC instruction classCLA - No SM used between terminal and cardResponse DataCommand DetailsCommand Number : 1Command Type : RECEIVE DATADevice IDSource ID : terminalDestination ID : SIMResultGeneral Result : Cmd performed successfullychannel data : 0x22 0x3 0x3 0x0 0x49 0x2 0x0 0x0 0x45 0x3 0x3 0x77 0x201 0x197 0x172 0x9 0x83 0x136 0x255 0x245 0x251 0x25 0x50 0x81 0x1 0x215 0x216 0x161 0x22 0x166 0x252 0x230 0x213 0x236 0x159 0x75 0x44 0x44 0x56 0x92 0x137 0x21 0x168 0x0 0x0 0x140 0x0 0x0 0x5 0x0 0x1 0x0 0x1 0x1 0x55 0x1 0x0Status Words - 0x90 0x00 - Normal ending of the command6. CLOSE CHANNEL（可以理解為：去激活PDP）6.1 模塊向電話卡發送FETCH命令（CLOSE CHANNEL）模塊 -> 電話卡：80 12 00 00 0B電話卡 -> 模塊：12 D0 09 81 03 01 41 00 82 02 81 21 90 00slot value:1FETCHLogical Channel: 0UICC instruction classCLA - No SM used between terminal and cardProactive command data:Command DetailsCommand Number : 1Command Type : CLOSE CHANNELDevice IDSource ID : SIMDestination ID : Channel 1Status Words - 0x90 0x00 - Normal ending of the command6.2 模塊向電話卡發送TERMINAL RESPONSE命令（CLOSE CHANNEL）模塊 -> 電話卡：80 14 00 00 0C電話卡 -> 模塊：14模塊 -> 電話卡：81 03 01 41 00 02 02 82 81 03 01 00電話卡 -> 模塊：90 00//QCAT APDU解析內容：slot value:1TERMINAL RESPONSELogical Channel: 0UICC instruction classCLA - No SM used between terminal and cardResponse DataCommand DetailsCommand Number : 1Command Type : CLOSE CHANNELDevice IDSource ID : terminalDestination ID : SIMResultGeneral Result : Cmd performed successfullyStatus Words - 0x90 0x00 - Normal ending of the command