Management Summary of research for the Dutch government on "Flexibel Gebruik van MNC's". Research executed by Logica Business Consulting

1. M2M switching problems Management Summary “Onderzoek flexibel gebruik MNC’s” Rudolf van der Berg Jan Lindoff 2010

2. Machine to Machine (M2M) communications will connect millions of devices. Many of them using GSM-family technology Switching GSM-operators requires large scale M2M end users to switch the SIM-cards in all devices, which is expensive or impossible Ministry of Economic Affairs wanted to know what it could do to lower switching barriers for M2M end users Logica researched possibilities for and impact of regulatory and technical solutions that might lower switching costs. Conclusion: Ministry should open access to Mobile Network Codes. This allows M2M users to use own SIM-cards. Other solutions fail. No. 2 Summary Management Summary “Onderzoek flexibel gebruik MNC’s”

4. Cause: Market model, technology and regulation

5. Solution: Regulation, pool and technology

6. Appendix: Private GSMNo. 3 Contents Management Summary “Onderzoek flexibel gebruik MNC’s”

7. Machine-to-Machine communications will let millions of devices communicate with each other and with people 8.1 million vehicles in NL 8 million smart meters in NL TomTom alone sold 10 million Personal Navigation Devices last year A digital picture frame company became a KPN customer recently eReaders are equipped with wireless connectivity Many of these devices will use communications technology from the GSM-family, because it is ubiquitous, standardized and flexible GSM-family is GSM/GPRS/UMTS/LTE also known as 2G/3G/4G GSM-family works on all continents, in almost all nations GSM-family offers coverage almost anywhere, indoor and outdoor Other networking technologies like wifi, powerline, ethernet, cable and DSL broadband have less coverage and often require configuration by user No. 4 M2M to create an Internet of Things Management Summary “Onderzoek flexibel gebruik MNC’s”

8. M2M user is here defined as the party who pays for the connectivity to the M2M devices. Company that supplies eReaders, smart meters, pay as you drive device If they want to switch mobile network operators, they will have to change the SIM-card in each of the devices, which is expensive Switching 10,000 SIM-cards estimated at 1 million euro Logistics is hard. Devices often mobile or in remote or hard to reach places Consumer electronics companies don’t even know where end-user is M2M has very long life, up to 30 years Some users forced to switch operators because of results of European Procurement procedures. Problem acknowledged by GSM/UMTS/LTE standardization organisation 3GPP and previous research by Stratix for Ministry No. 5 M2M users faced with switching costs Management Summary “Onderzoek flexibel gebruik MNC’s”

9. What causes this problem? M2M users can’t access the wholesale market SIM-cards are locked to one operator. The IMSI number can’t be changed Regulations don’t allow M2M users direct access to wholesale market What are possible solutions? Opening access to Mobile Network Codes, so that end-users can use their own IMSI number Introducing a pool of IMSI’s for M2M end-users Technical solutions that allow changing of IMSI’s over the air Interviews with 18 stakeholders: networks, end-users, suppliers and standardization organisations No. 6 Research into switching problems Management Summary “Onderzoek flexibel gebruik MNC’s”

10. Cause Market model, technology and regulation

11. Large scale end-users often have access to the wholesale market. Example: Electricity. Greenhouses, chemical plants, aluminium smelters buy and sell wholesale In the wireless market there is always an intermediary between the end-user and the wholesale network There are only two end-users in the Netherlands that have access to the wholesale market: Pro-Rail for GSM-R (GSM for Railroad safety) Ministry of Defence: use DECT-Guardband for mobile network Lack of access to wholesale market results in dependency on one market party. First time right, because changing is often impossible No. 8 End-users can’t access wholesale market Management Summary “Onderzoek flexibel gebruik MNC’s”

12. No. 9 Market structure Management Summary “Onderzoek flexibel gebruik MNC’s”

13. Spectrum license holder: has bought or received right to use radio spectrum for mobile wireless network Wholesale network builds physical network (antennas, fiber etc.) and leases access to this network to service providers Service providers sell access to the wholesale network(s) to various customer groups, some specialize in M2M end-users If a company is spectrum license holder, wholesale network and service provider it is a Mobile Network Operator (MNO) or operator If a company is a service provider without a wholesale network and spectrum license it is a Mobile Virtual Network Operator (MVNO) No. 10 Market players (1/2) Management Summary “Onderzoek flexibel gebruik MNC’s”

14. Mobile Network Enablers do not have a contract with a wholesale network directly, but they facilitate access to wholesale networks Have all necessary equipment, billing, CRM etc. to enable an MVNO Resellers don’t have a contract with the wholesale network. They resell the offer of a service provider to a specific market M2M application providers are a type of reseller aimed at enabling specific M2M applications. An MVNO is not equal to the service provider of an MNO. For instance it can’t become a member of the GSMA No access to Inter Operator Tariffs of the GSMA for roaming agreements An MVNO uses its own SIM-cards, a reseller uses the SIM-cards of the MNO or MVNO whose network it uses No. 11 Market Players (2/2) Management Summary “Onderzoek flexibel gebruik MNC’s”

17. To enable access to and switching of wholesale networks all that is required is access to MCC+MNC for end-users Regulations dictate that access to MNC is limited to public networks Not all M2M end-users can make a public offer, but what is a public offer is a vague sliding scale. Rijkswaterstaat using thousands of cameras to monitor roads is not A security company using cameras to monitor businesses probably is An exemption is now made for non-public use of MNC’s, like it was done for the Ministry of Defence Parties who offer Private GSM can request an MNC for their services. (for explanation of Private GSM see appendix) No. 14 Regulations ties end-user to M(V)NO Management Summary “Onderzoek flexibel gebruik MNC’s”

18. Solutions Regulation, pool and technological

19. Opening access to MNC’s will solve switching problems of end-users, without leading to problems elsewhere, it will: not lead to a depletion of the IMSI-numbering plan not negatively impact other policy goals not conflict with international agreements be technically feasible be possibly positive for international mobile roaming possibly lead to economic advantages There shouldn’t be any restrictions on what end-users can apply for MNC’s, except those already present in number policy: the use is in line with regulations it is realistic that the numbers will be used the amount of numbers requested is necessary. No. 16 Solution 1: Opening access to MNC’s is best Management Summary “Onderzoek flexibel gebruik MNC’s”

21. End-user would contract one or more wholesale networks. Multiple networks could enable national and/or international roaming

22. An MNO, MVNO or MNE can provide the technology to ease access to wholesale networks and decrease time to market

23. The end-user contracts a SIM-card producer directly or via M(V)NO/MNE. Receives SIM-cards and crypto keys for each IMSI with own MNC

24. End-user contracts intermediairies to get full international roaming if so desired (still theoretical)No. 17 Mangement Summary “Onderzoek flexibel gebruik MNC’s”

25. Supply is at least a few thousand for the Netherlands alone. 515 are available in the current range and more ranges can be requested via the ITU The ITU can issue between 100,000 and 1 million MCC+MNC’s Demand for M2M applications is likely between a few hundred and a few thousand in The Netherlands Demand for Private GSM purposes probably less than a hundred Economic conditions will limit use of MNC’s. M(V)NO’s may offer better terms and use of MNC’s requires maintenance Numbers like 088-company and internet Autonomous System numbers show good but limited interest from private networks No. 18 No depletion of IMSI-numbers foreseen Management Summary “Onderzoek flexibel gebruik MNC’s”

26. Interconnection and Access Rules on interconnection might need changing as only public networks can demand interconnection Access to mobile networks is a market without parties that are deemed to have Significant Market Power. The competitive market should provide enough possibilities for M2M end users to enter the market Access to numbers Currently limited to public networks. Party with an MNC should be able to request other numbers like E.164 and Transit Signalling Point Codes Lawful intercept: Intercept can happen at the wholesale network, the suppliers of the private network and at the private network. Tariff transparency Mobile termination access rate follows that of host network. No. 19 No negative impact on other policy goals Management Summary “Onderzoek flexibel gebruik MNC’s”

27. ITU has defined the structure and use of IMSI numbers in recommendation E.212 E.212 speaks of public networks, but this is not a legal term. It is the Member States who need to define this When asked ITU Study Group 2 wasn’t negative about the proposed use by private networks In response to a Dutch contribution on this subject, ITU SG2 sent a letter to 3GPP, cc GSMA, that it should be expected that individual countries will issue 3-digit MNC’s soon No. 20 No conflict with international agreements Management Summary “Onderzoek flexibel gebruik MNC’s”

28. In Europe MNC’s are only 2 digits, in the Caribbean and the Americas this can be 3 digits. Network may not be able to distinguish between MNC 291 and 293 because it just sees 29. Doesn’t know which HLR to contact Networks expect no or little difficulty with customers with 3 digit MNC’s. Maybe some support systems that assume 5 digit MCC+MNC Roaming customers from the Americas also use 6 digit MCC+MNC combinations and are handled well by the network Some networks use 6th digit to point to a specific HLR in the network No. 21 No technical difficulties expected Management Summary “Onderzoek flexibel gebruik MNC’s”

29. Roaming is making use of someone else’s network. Can be national or international: Tele2 NL roams on T-Mobile NL, 3UK on Orange UK Some M2M users require national roaming because it increases coverage. Often a spot is covered by at least one network Some networks offer a foreign SIM to accomplish this. Foreign networks often have roaming agreements with all networks. International roaming should be the same. Networks giving access based on MCC+MNC combination, but is much harder Seems only MNO’s with GSMA membership have easy access to roaming M2M users may need to load IMSI of MNO on their SIM too. If M2M users had access to international roaming, they could negotiate better rates by going with just one network Maybe possible on bilateral basis, but what happens when it fails in one country? No. 22 Benefits to (inter)national mobile roaming Management Summary “Onderzoek flexibel gebruik MNC’s”

30. Number pools often used to give access to scarce numbers There is a number pool for E.164 numbers for M2M use Internet uses number pool 192.168 for internal networks MNC’s are not fit for number pools. It is used to find HLR and give access. This model breaks, because every network uses that MNC Wouldn’t make switching easier, what if end-users of different networks used the same IMSI’s and then want to switch networks For Private GSM a pool of MNC’s would be beneficial. It would facilitate experimentation and smaller networks Recommendation to open one or two MNC’s for Private GSM use No. 23 Solution 2: A pool of MNC’s is too complex Management Summary “Onderzoek flexibel gebruik MNC’s”

32. MNO/MVNO provides SIM-card with IMSI from pool, enables it’s own cryptographic keys on the SIM-card and HLR

33. When end-user wants to change operator, MNO/MVNO provides IMSI’s and cryptographic keys to new operator

34. New operator verifies that IMSI’s aren’t in use yet on his network and enables cryptographic keys on his HLR

35. Problem: Collissions: what if IMSI’s are already in use in the network of the ‘new’ M(V)NO?

36. Problem: Authentication not on MCC+MNC, but on IMSI+correct cryptographic settings. This is different from current situationNo. 24 Mangement Summary “Onderzoek flexibel gebruik MNC’s”

37. 3GPP looked at M2M users switching networks in Study Groups 1 and 3, with results published in TR 22.868 en TR 33.812 3GPP identified 4 problem areas for M2M How to prevent stealing of subscriber identity from SIM-card How to initially provide the SIM-card with right information either in factory or upon activation in the field How to change subscriptions How to update the SIM-card to new security levels during a 30 year lifespan 3GPP looked at theoretical possibility of 3 solutions, of which two are feasible. GSMA has told 3GPP the two solutions are unacceptable Suppliers do see technical solutions and have them available, but these haven’t been standardized industry wide No. 25 Solution 3: No technical solution available Management Summary “Onderzoek flexibel gebruik MNC’s”

38. Alternative 1: Trusted Environment based solution with remote subscription provisioning and change is theoretically feasible Trusted environments can be created through hardware and software Alternative 2: SIM based solution with no remote subscription provisioning or changing. This is the current situation with SIM-changing Alternative 3: SIM based solution with remote subscription change is feasible in two different ways None of these solutions have been worked out in technical detail, just on the functional level. Standardization may take years. M2M end-users may want technical solutions as well, because who knows what changes in companies in 30 years (i.e. mergers, sales) No. 26 2 theoretically feasible solutions Management Summary “Onderzoek flexibel gebruik MNC’s”

40. M(V) NO provides end-user with special SIM-cards or definition of trusted environment in accordance with industry-wide standard

41. IMSI’s and crypto of M(V)NO are used, but can be remotely changed

42. When an end-user wants to change operators, it notifies the current M(V)NO of the change to new operator

43. In accordance with industry-wide standard, the new and old operator cooperate in changing and enabling new IMSI’s and keys

44. Problem: How to enable global cooperation between M(V)NOs? Customers may change from German to Dutch M(V)NONo. 27 Mangement Summary “Onderzoek flexibel gebruik MNC’s”

45. Appendix A of 3GPP TR 33.812 V9.2.0 lists the opinion of the GSMA […]Furthermore, one of the major concerns of MNOs is the potential weakening of the well-established and trusted SIM-based GSM/3G security architecture. Extended OTA (any kind and via any bearer of over the air data download to the USIM)capability to facilitate download of new subscriber keys and possibly authentication algorithms represents such a potential weakening of security.[...] not allowing MNOs to fulfil their obligations towards regulatory and other governmental authorities to guarantee secure authentication and billing. […]The only proposal in the TR that was acceptable to GSMA SG representatives was the Alternative 2 where operator change was performed by physical replacement of the UICC in the device.[…] (UICC = SIM-card) No. 28 GSMA opposes technical solutions Management Summary “Onderzoek flexibel gebruik MNC’s”

46. Conclusions

47. Only by giving M2M end-users access to MNC’s can their switching costs be decreased Other solutions are either not workable (option 2), or theoretically feasible (option 3), but not practically available short term Recommend to open up MNC’s and other necessary numbers for M2M end-users and create a pool of MNC’s for Private GSM Recommend to contact Commission and BEREC to communicate these changes, harmonize rules in Europe and address roaming issues Recommend to request Commission to contact 3GPP and ETSI to work on technical solutions No. 30 Conclusions and recommendations Management Summary “Onderzoek flexibel gebruik MNC’s”

48. Private GSM uses the DECT Guardband to offer unlicensed, private, low power, GSM services in The Netherlands The DECT Guardband was a buffer between the DECT-spectrum and GSM-spectrum, that isn’t necessary anymore. Conveniently standard GSM’s can work in this band Any organisation can use the DECT Guardband to for instance create better indoor coverage. In order to be able to use this technology an organisation needs access to SIM-cards If there was a free to use pool of MNC’s for this purpose, organisations and individuals could experiment easier No. 31 Appendix: Private GSM explained Management Summary “Onderzoek flexibel gebruik MNC’s”