GSM 03.48

This article may be too technical for most readers to understand. Please help improve it to make it understandable to non-experts, without removing the technical details. (August 2019) (Learn how and when to remove this message)

GSM 03.48 is a protocol used to exchange secured packets between an entity in a GSM PLMN and an entity in the SIM card. Secured packets contain application messages to which certain mechanisms according to GSM 03.48 have been applied. Application messages are commands or data exchanged between an application resident in or behind the GSM PLMN and on the Wapor MMS. ^{[1] [2] [3]} It is evolved to 3GPP TS 23.048^[4] in 3G. From Release 5, TS 23.048 is split into the generic part and the bearers specific application. The generic part on packet structure has been transferred to SCP (ETSI TS 102 225^[5]). The bearers specific part is 3GPP TS 31.115.^[6]

This section does not cite any sources. Please help improve this section by adding citations to reliable sources. Unsourced material may be challenged and removed. (September 2023) (Learn how and when to remove this message)

The sending application prepares an application message and forwards it to the sending entity, with an indication of the security to be applied to the message.

The sending entity prepends a security header (the command header) to the application message. It then applies the requested security to part of the command header and all of the application message, including any padding octets. The resulting structure is referred to as the (secured) command packet.

Under normal circumstances the receiving entity receives the command packet and unpacks it according to the security parameters indicated in the command header. The receiving entity subsequently forwards the application message to the receiving application indicating to the receiving application the security that was applied. The interface between the sending application and sending entity and the interface between the receiving entity and receiving application are proprietary.

If so indicated in the command header, the receiving entity shall create a (secured) response packet. The response packet consists of a security header (the response header) and optionally, application specific data supplied by the receiving application. Both the response header and the application specific data are secured using the security mechanisms indicated in the received command packet. The response packet will be returned to the sending entity, subject to constraints in the transport layer, e.g. timing.