Definition
Air Interface Encryption refers to the confidentiality protection of RRC signaling and user plane data messages over the wireless link between the terminal and the base station, preventing eavesdropping by co-channel receiving devices. 3GPP defines multiple families of encryption algorithms (such as the EEA series for LTE and NEA for 5G), with the specific type enabled being negotiated between the network and the terminal during authentication and security mode command procedures. IoT SIM cards (UICC/eUICC) store long-term keys and operator credentials, participate in AKA authentication, and derive session keys used for encryption and integrity. Without a legitimate card and the corresponding operator network, an attacker cannot decrypt air interface traffic. However, it should be noted that this only protects the 'terminal-to-base station' segment; the core network and internet path beyond the base station still require TLS, IPsec, or private network isolation.
Integrity Protection is used to detect whether wireless signaling and some user data have been tampered with, corresponding to the EIA (LTE) or NIA (5G) algorithm families. Integrity protection is crucial for preventing attacks such as fake handover commands or malicious configurations issued by fake base stations. IoT terminals, due to long firmware update cycles, may become batch risk points if they run weak algorithms or are misconfigured over a long period.
"IoT SIM cards integrity protection" in some documents also refers to anti-tampering mechanisms for card applications and file systems (such as the STK secure domain). This article focuses on the context of cellular air interface security to avoid confusion with platform-side device trust.
Technical key points
The security mode command is issued by the network, and the terminal responds according to its own and the card's supported algorithm priority. Older IoT modules that only support outdated algorithms may be unable to connect after the operator tightens policies, manifesting as attach failures or repeated RRC reconfigurations. eUICC can update the card's security domain policies via remote management, but support for air interface algorithms still depends on the modem chip.
5G SA introduces a more complete air interface security framework, supporting 256-bit algorithm options and more flexible key hierarchies. IoT RedCap devices should check whether the mandatory security features are fully implemented. For private network deployments using private bands and small core networks, compliance with national cryptography management and the requirements of radio regulatory authorities for commercial cryptography applications is still required; integrity protection must not be disabled "to speed up".
User-plane encryption can be optionally enabled in some IoT scenarios, but signaling integrity is usually mandatory. Misunderstanding that "user-plane has TLS, so air interface encryption can be disabled" can lead to compliance risks, and TLS only operates over TCP, which cannot cover all service types.
IoT SIM cards and platform configuration
When procuring IoT SIM cards, the algorithm support list and authentication types (e.g., Milenage, TUAK) should be requested and cross-verified with the target operator's actual network policies. The platform cannot directly "switch" air interface encryption remotely, but can indirectly manage it by prohibiting outdated modules from connecting and forcing baseband upgrades via OTA. For high-security clients, attach failure code analysis can be added during inventory detection to identify algorithm negotiation mismatches.
When using VPDN or a private network, end-to-end security should be designed in layers: air interface + core network + tunnel + application TLS. Card vendors can provide device-card binding and certificate issuance services, combined with application-layer identities to form defense in depth. When an eUICC changes Profile, pay attention to whether the new operator requires a different version of the authentication vector.
The connection management platform can record summary events such as authentication failures and security mode rejections (if the interface allows), helping to detect attempts of fake base stations or cloned cards.
Operation and Troubleshooting
A sudden inability to register in bulk may be related to operator-wide algorithm upgrades, requiring firmware upgrades for modules or replacement of card batches. For individual device failures, first check whether uncertified modules or grey-market cards are used. If integrity check failure logs are concentrated in a specific cell, be alert to packet corruption caused by fake base stations or strong interference.
In security incident emergency response, it should be possible to remotely locate the affected ICCID list and the last successful authentication time, and, if necessary, replace cards in bulk or revoke certificates. Avoid exposing Ki, OPc, or other card key materials in public scenarios; all logistics and storage processes should comply with commercial secret carrier management requirements.
Regular penetration tests should include air interface man-in-the-middle scenarios to verify whether the application layer refuses to continue operations under a fake base station environment.
Compliance and Security
Domestic key industries must comply with the Cryptography Law and multi-level protection requirements for the confidentiality and integrity of transmission; both air interface and application layer requirements must be met. Export devices may face algorithm compliance differences in the target country and should use locally permitted configurations. Even if personal and sensitive industrial data have air interface encryption, they must still be stored and access-controlled according to classification and level on the platform side.
Supply chain security requirements can trace card factories, chip batch numbers, and programming records to prevent hardware backdoors. Contracts should stipulate obligations for algorithm upgrade notifications and compatibility windows.
Use Cases
Devices holding IoT SIM cards, such as smart meters, in-vehicle terminals, industrial gateways, and medical wearables, operate on public cellular spectrum, where air interface encryption and integrity protection are baseline security. High-value asset tracking and payment terminals should additionally use SE/eSE and application certificates. Government and energy private networks often require designated algorithm suites and mutual authentication, which differs from public consumer device policies.
SimtoLink provides support in describing IoT SIM card security capabilities, onboarding test checklists, and platform alert integration, helping customers implement 3GPP security mechanisms into auditable processes.