IMS Subscriber Identity Module

Description

The IMS Subscriber Identity Module (ISIM) is a specialized software application residing on a Universal Integrated Circuit Card (UICC), commonly known as a SIM card. It is distinct from the classic SIM application used for cellular network access (CS domain) and the USIM application for 3G/4G packet access (PS domain). The ISIM application is dedicated exclusively to the IP Multimedia Subsystem (IMS), which provides multimedia services like Voice over LTE (VoLTE), video calls, and instant messaging over the mobile packet core.

Architecturally, the ISIM contains a set of securely stored files and parameters essential for IMS registration and service invocation. The most critical data is the IMS Private User Identity (IMPI), a unique global identifier for the subscriber in the IMS realm (often formatted like a NAI, e.g., user@domain.com). It also stores the corresponding IMS Public User Identity (IMPU), which is the address used for communication (e.g., a SIP URI). Furthermore, the ISIM holds long-term authentication credentials: a shared secret key and the associated authentication algorithm parameters. These credentials are used in the IMS Authentication and Key Agreement (IMS AKA) procedure.

When a user wishes to access IMS services, the mobile device's IMS client reads the necessary identities from the ISIM. During registration, the device and the network perform the IMS AKA protocol. The device uses the secret key from the ISIM to compute a response to a challenge from the network. This process authenticates the subscriber to the IMS network and establishes secure session keys for protecting SIP signaling. The ISIM thus acts as the root-of-trust for IMS access, analogous to how USIM authenticates the user to the packet core network.

The ISIM application interoperates with other applications on the same UICC. A device may use the USIM for accessing the LTE/5G network (for bearer connectivity) and the ISIM simultaneously for accessing IMS services over that bearer. This separation allows for independent management of credentials and services. The ISIM's role is foundational for IMS security and service portability, as the subscriber's IMS identity and credentials are physically stored on a portable, tamper-resistant card.

Purpose & Motivation

The ISIM was created to provide a secure, portable, and standardized identity module specifically for the IMS, which is a service architecture separate from the traditional cellular access networks. Before ISIM, early IMS implementations often used soft credentials (username/password stored in the device) or attempted to derive IMS identities from cellular identities (like IMSI). These approaches had security weaknesses (soft credentials are vulnerable) or limitations in flexibility (tight coupling to cellular subscription).

A dedicated module was necessary because IMS authentication (IMS AKA) is different from the cellular network authentication (used by SIM/USIM). IMS uses SIP-based protocols and requires identities formatted as URIs or NAIs, not MSISDN or IMSI. The ISIM provides a secure hardware container for these new identity formats and the associated cryptographic keys, ensuring a high level of security equivalent to that of cellular access. It also enables service portability; a user can move their UICC to a new device and immediately have their IMS identity and services available.

Its introduction in Release 5 coincided with the initial standardization of IMS. It solved the problem of how to securely and manageably provision IMS subscriptions to end-users. By leveraging the existing UICC platform, it allowed operators to offer IMS services using a familiar, secure distribution mechanism (the SIM card). The ISIM established a clear separation of credentials, allowing a user to have independent subscriptions for cellular access and IMS services, even if provided by the same operator.