Sign in Subscribe

SAS-UP SAS for UICC production

Last updated on 


SAS-UP, which stands for "Secure Application Sandbox for UICC Production," is a security framework designed to ensure the secure development and production of Universal Integrated Circuit Cards (UICCs). UICCs are smart cards commonly used in mobile devices to store subscriber identity information, authenticate users, and securely execute various applications.

SAS-UP is a set of guidelines and procedures established by the GlobalPlatform organization, a consortium of companies operating in the smart card industry. The goal of SAS-UP is to provide a standardized approach for secure UICC development and production, enabling interoperability and trust among different stakeholders, including UICC manufacturers, mobile network operators, and service providers.

The key components and concepts involved in SAS-UP are as follows:

  1. Secure Application Sandbox: SAS-UP defines a secure environment called the "sandbox" where applications can run securely and independently from each other. The sandbox ensures that one application cannot interfere with or access the data of another application running on the UICC. This isolation is essential to prevent unauthorized access and maintain data confidentiality.
  2. Secure Development Process: SAS-UP emphasizes the need for a secure development process throughout the lifecycle of a UICC. This includes secure coding practices, vulnerability assessments, and adherence to industry-standard security guidelines. The development process should consider aspects such as secure storage, secure communication protocols, and secure application loading.
  3. Secure Loading and Personalization: SAS-UP defines procedures for securely loading and personalizing applications onto the UICC. This involves cryptographic protection of the application data during transit and storage. The personalization process ensures that the UICC is personalized with unique keys, certificates, and other credentials required for secure operation.
  4. Secure Communication Interfaces: SAS-UP specifies the requirements for secure communication interfaces between the UICC and external entities, such as mobile devices and backend systems. It ensures that data transmitted between these entities is encrypted, authenticated, and protected from unauthorized access or tampering.
  5. Secure Management and Update: SAS-UP addresses the secure management and update of UICC applications. This includes mechanisms for securely provisioning and managing applications on the UICC, as well as securely updating the applications and associated data during the UICC's lifecycle.
  6. Compliance and Certification: SAS-UP provides a framework for compliance testing and certification of UICC products. Compliance ensures that UICC products meet the specified security requirements and interoperability standards. Certification provides confidence to stakeholders that the UICC has undergone rigorous testing and evaluation by authorized testing laboratories.

By adhering to SAS-UP guidelines, UICC manufacturers can ensure the security and integrity of UICC products. This, in turn, helps mobile network operators and service providers to deploy and offer secure mobile services to their customers, including mobile payments, digital identity solutions, and secure access to network resources.