Base Station 5G/4G LTE Test Blank SIM Cards with Authentication Parameter Writing Support — Complete Technical by HKCARD Electronics Co., Limited

For engineers and developers working on 5G and 4G LTE base station testing, one of the most critical — and often misunderstood — requirements is the proper configuration of blank test SIM cards (Test White Cards) with the correct authentication parameters. Without precisely programmed authentication credentials, a blank SIM card simply cannot complete the mutual authentication process required by modern mobile core networks, rendering it useless for meaningful base station testing.

HKCARD Electronics Co., Limited is a professional manufacturer and globally trusted supplier of writable programmable blank SIM and USIM cards specifically designed for 5G and 4G LTE base station testing. Our cards support full authentication parameter writing — IMSI, Ki, OPc, ICCID, PLMN, and ACC — and are compatible with all leading SIM card programming tools used in private network and laboratory testing environments.

This comprehensive technical guide covers everything engineers need to know about selecting, programming, and troubleshooting blank test SIM cards for 5G/4G LTE base station and core network testing — from the essential authentication parameters that must be written to the card, through programming tool options, authentication principles, common troubleshooting scenarios, and critical security considerations.

 Essential Authentication Parameters — What Must Be Written to a Blank Test SIM Card

Understanding the Core Credential Set Required for 5G/4G LTE Network Authentication

A blank SIM card fresh from the factory contains only its hardware identifier — it is a clean slate waiting to be configured. Before it can successfully register on a 5G or 4G LTE test network and complete the mutual authentication handshake with a core network (such as Open5GS, free5GC, srsEPC, or commercial EPC/5GC platforms), several critical authentication parameters must be written to the card using a compatible programming tool.

Understanding each parameter — what it is, why it matters, and how it relates to the others — is essential for engineers who need reliable, repeatable authentication in their test environments.

🔐 Parameter 1: IMSI — International Mobile Subscriber Identity

What it is:
The IMSI is the fundamental unique identifier of a mobile subscriber — the primary key that the network uses to look up subscriber credentials and service profiles in the HSS (Home Subscriber Server) for 4G or UDM (Unified Data Management) for 5G.

Format:
IMSI follows the structure: MCC + MNC + MSIN

• MCC (Mobile Country Code) — 3 digits identifying the subscriber’s home country
• MNC (Mobile Network Code) — 2 or 3 digits identifying the home network operator
• MSIN (Mobile Subscriber Identification Number) — Up to 10 digits uniquely identifying the subscriber within the network

Example: 001 + 01 + 0123456789 = 001010123456789

Critical requirement:
The IMSI written to the SIM card must exactly match the subscription record configured in the core network’s HSS/UDM. Even a single digit mismatch will cause the core network to be unable to locate the subscriber profile, resulting in immediate registration failure.

For private 5G/4G test networks:
When building private test networks with open-source platforms like Open5GS or free5GC, engineers have full freedom to choose any IMSI structure — but must ensure that the same IMSI is registered in the core network subscriber database before attempting network registration with the card.

🔐 Parameter 2: Ki — Authentication Key

What it is:
The Ki (Authentication Key) is a 128-bit secret cryptographic key that forms the absolute foundation of SIM card security. It is the “master secret” from which all session-specific security material is derived during the authentication process.

Where it lives:
Ki exists in exactly two places:

1. Stored securely inside the SIM card’s protected memory — inaccessible to external reading after programming
2. Stored in the core network’s HSS (4G) or UDM (5G) subscriber database

How it works:
During authentication, neither the SIM card nor the network ever transmits Ki over the air. Instead, both sides independently use Ki as an input to authentication algorithms (Milenage or TUAK) to compute expected values — and then compare results. This design ensures that Ki never leaves the secure environments where it is stored.

⚠️ Critical Security Warning:
Ki is the highest-sensitivity credential in the SIM card ecosystem. Ki must never be transmitted in plaintext, stored in unencrypted files, or shared through insecure channels. If Ki is compromised, an attacker can clone the SIM card, impersonate the subscriber, and intercept communications. In production environments, Ki distribution must use secure key management infrastructure with hardware security modules (HSMs).

🔐 Parameter 3: OPc — Operator Variant Algorithm Configuration Field

What it is:
OPc is a 128-bit operator-specific configuration value used in the Milenage authentication algorithm alongside Ki. OPc is derived from the operator’s secret OP (Operator Key) and the subscriber’s Ki through a one-way transformation — meaning OPc can be computed from OP and Ki, but OP cannot be recovered from OPc alone.

Why OPc matters:
In 5G-AKA and EPS-AKA authentication, OPc and Ki work together as inputs to the Milenage algorithm to generate:

• RAND (Random Challenge) processing
• RES/XRES (Response values for mutual authentication)
• CK and IK (Cipher Key and Integrity Key for session security)
• AUTN (Authentication Token for network verification by the SIM)

OPc vs. OP:
Network operators typically configure SIM cards with OPc rather than OP directly — because storing OPc on the card means the original OP secret never needs to be present on the card, providing an additional layer of protection for the operator’s master secret.

For test environments:
In private test networks, engineers can freely choose OP values and compute the corresponding OPc for each subscriber’s Ki. Open-source tools like pySim include utilities for computing OPc from OP and Ki.

🔐 Parameter 4: ICCID — Integrated Circuit Card Identifier

What it is:
The ICCID is the SIM card’s physical serial number — a unique identifier of up to 22 digits that identifies the specific physical card (as opposed to the subscriber). The ICCID is typically printed on the card and encoded in EF_ICCID on the card file system.

Why it matters for testing:
While ICCID is not directly involved in the authentication algorithm computation, it serves important functions in real and test network environments:

• Some network policy systems filter or bind access based on ICCID
• ICCID is used for card management and inventory tracking
• Certain network management platforms use ICCID to correlate subscriber sessions with physical cards
• Test automation systems may use ICCID to identify and track specific test cards

Format:
ICCID follows the ITU-T E.118 numbering plan: 89 [MCC] [MNC] [subscriber number] [check digit]

🔐 Parameter 5: PLMN — Public Land Mobile Network

What it is:
PLMN configuration on the SIM card consists of the MCC and MNC values that determine which network(s) the card considers as its home network and which networks it is allowed to register on.

Key PLMN-related files:

• EF_IMSI — Encodes the home PLMN via the MCC/MNC embedded in the IMSI
• EF_PLMNsel / EF_PLMNwAcT — Preferred PLMN list with access technology preferences
• EF_FPLMN — Forbidden PLMN list (networks the card is prohibited from registering on)
• EF_HPLMN — Home PLMN configuration affecting network search behavior

Why PLMN configuration is critical for base station testing:
The PLMN broadcast by the test base station (in SIB1 for 4G, or equivalent for 5G) must match the home PLMN configured in the SIM card. If these don’t match, the device will either ignore the base station (treating it as an unknown network) or classify it as a roaming network (triggering different registration behavior). Correct PLMN alignment is essential for proper network registration in test environments.

🔐 Parameter 6: ACC — Access Control Class

What it is:
ACC (Access Control Class) is an optional parameter that assigns the subscriber to one or more of 16 access control classes (0-15). Network operators use ACC to manage network access during congestion or emergencies by selectively barring certain subscriber classes.

For test network applications:
In private test networks and laboratory environments, ACC configuration is typically set to permissive values (Class 0-9 are standard subscriber classes) to ensure test devices are not unexpectedly barred from network access during testing. However, engineers testing access barring features specifically will need to configure ACC values that match their test scenarios.

 SIM Card Programming Tools — Graphical and Command-Line Options for Writing Authentication Parameters

Complete Guide to GRSIMWrite, pySim, and Professional Programming Workflows

Once you understand the authentication parameters that must be written to your HKCARD blank test SIM card, the next step is selecting and using the right programming tool for your environment and workflow. Two primary categories of tools are used in professional 5G/4G test environments:

🖥️ Category A: Graphical Interface Tools — Recommended for Rapid Deployment

GRSIMWrite — The Professional’s Choice for Private Network SIM Programming

GRSIMWrite is a dedicated graphical SIM card programming application specifically designed for private network deployment scenarios. It is widely used in open-source 5G/4G lab environments for its intuitive interface and automated parameter calculation capabilities.

Key capabilities:

• Automatic derivation of related parameters from core inputs
• Real-time data consistency validation
• Visual feedback on write operation success/failure
• Support for standard SIM file system operations

Step-by-step programming workflow with GRSIMWrite:

Advantages of GRSIMWrite:

• Intuitive graphical interface reduces learning curve for new users
• Automatic parameter calculation minimizes manual computation errors
• Built-in data consistency checking catches common configuration mistakes
• Fast workflow enables rapid card configuration for multiple test scenarios

💻 Category B: Command-Line and Script Tools — For Automation and Advanced Development

pySim — Open-Source Python Library for Flexible SIM Programming

pySim is an open-source Python library for SIM card programming, widely used in Linux-based development and test environments. It provides granular control over SIM file system operations through PC/SC reader interfaces and supports automation through scripting.

Environment requirements:

• Linux operating system (Ubuntu, Debian, or similar recommended)
• Python 3.x with pySim library installed
• PC/SC-compatible smart card reader with proper drivers
• pyscard Python library for PC/SC interface access

Core programming logic (conceptual workflow):

# Conceptual pySim programming workflow
# Install: pip install pySim

from pySim.transport.pcsc import PcscSimLink
from pySim.cards import SimCard

# Step 1: Establish connection to card reader
link = PcscSimLink(0)  # Use first available reader
link.wait_for_card()

# Step 2: Initialize card object
card = SimCard(link)

# Step 3: Navigate to Master File
card.select_path(['3f00'])

# Step 4: Write IMSI to EF_IMSI (Elementary File)
# EF_IMSI located at path 3F00/7F20/6F07
imsi = '001010123456789'
card.update_imsi(imsi)

# Step 5: Write authentication key Ki to EF_Ki
# Note: EF_Ki access requires ADM (Administrative) key authentication
ki = '000102030405060708090A0B0C0D0E0F'
card.update_ki(ki)

# Step 6: Write OPc to EF_OPc
opc = 'C9E8763286AC8D0A7E3E7997B8E7E869'
card.update_opc(opc)

# Step 7: Write ICCID to EF_ICCID
iccid = '8900100100000000001'
card.update_iccid(iccid)

# Step 8: Verify written values
print("Programming complete - verifying written parameters...")

⚠️ Important technical note:
All SIM card programming operations must strictly conform to the APDU (Application Protocol Data Unit) command set defined in 3GPP TS 11.11 (for 2G SIM), 3GPP TS 31.101 (for UICC), and 3GPP TS 31.102 (for USIM) standards. Non-standard APDU sequences may produce unpredictable results or permanently damage card file system structures.

pySim advantages for developers:

• Full scriptability for automated test card programming workflows
• Integration with CI/CD pipelines for development environments
• Granular access to individual SIM Elementary Files
• Open-source codebase allows customization for specific requirements
• Active community development with regular updates for new standards

Additional Programming Tools Used in Professional 5G/4G Test Environments:

 5G/4G Mutual Authentication Principles — How SIM Card Credentials Protect Network Security

Understanding the Technical Authentication Flow That Your Programmed SIM Card Participates In

Understanding the authentication mechanism that your programmed HKCARD blank test SIM card participates in is not just academically interesting — it is practically essential for troubleshooting authentication failures and correctly configuring both the card and the core network.

The Mutual Authentication Architecture — Why 5G/4G Authentication Is Bidirectional:

Unlike legacy 2G GSM authentication — where only the network authenticated the subscriber (one-way authentication) — 5G and 4G implement full mutual authentication: both the network authenticates the subscriber AND the subscriber authenticates the network. This bidirectional verification is a fundamental security improvement that prevents rogue base station attacks.

The Complete Authentication Flow:

Phase 1 — Network Authenticates the Subscriber:

[UE/Device with Test SIM] ←→ [Base Station (eNodeB/gNodeB)] ←→ [Core Network (MME/AMF)]
                                                                        ↕
                                                               [HSS (4G) / UDM (5G)]

1. Attach Request — The UE (device with test SIM) sends an Attach/Registration Request including the IMSI (or SUCI in 5G for privacy protection)

2. Authentication Data Request — The MME (4G) or AMF (5G) queries the HSS/UDM for authentication vectors for this subscriber

3. Authentication Vector Generation — The HSS/UDM uses the stored Ki and OPc to compute an Authentication Vector (AV) containing:

   • RAND — A random 128-bit challenge number
   • AUTN — Authentication Token proving network legitimacy
   • XRES — Expected Response (what the SIM should compute)
   • KASME/KSEAF — Session key material

4. Authentication Request — The network sends RAND and AUTN to the UE

Phase 2 — Subscriber Authenticates the Network:

5. AUTN Verification — The SIM card uses its stored Ki and OPc to:

   • Verify the MAC (Message Authentication Code) in AUTN
   • Verify the SQN (Sequence Number) is within acceptable range
   • If verification fails → The SIM card rejects the network (protecting against fake base stations)
   • If verification succeeds → The SIM card confirms the network is legitimate

6. RES Computation — The SIM card computes RES (Response) using Ki, OPc, and RAND

7. Authentication Response — The UE sends RES back to the network

Phase 3 — Session Key Establishment:

8. RES Verification — The network compares received RES with its computed XRES

   • If they match → Authentication succeeds
   • If they don’t match → Authentication Reject is sent

9. Key Derivation — Both sides independently derive session keys:

   • 4G: KASME → NAS keys (KNASenc, KNASint) + AS keys (KeNB)
   • 5G: KSEAF → KAMF → NAS keys + RAN keys

10. Secure Communication Established — All subsequent signaling and data is protected using the derived session keys

Why This Matters for Test Card Configuration:

This authentication flow explains exactly why every parameter in the SIM card must be precisely correct:

• Ki mismatch → RES ≠ XRES → Authentication Reject
• OPc mismatch → AUTN verification fails → Network rejection by SIM
• IMSI mismatch → HSS/UDM cannot find subscriber record → Registration failure
• PLMN mismatch → UE ignores or treats base station as unknown network
• SQN desynchronization → AUTN verification fails with SYNC_FAILURE → Resynchronization procedure triggered

 Troubleshooting Common Issues in 5G/4G Test SIM Card Deployments

Systematic Diagnosis and Resolution of Authentication and Registration Failures

Even with carefully programmed HKCARD blank test SIM cards, issues can arise from configuration mismatches, software problems, or hardware conflicts. This section provides systematic troubleshooting guidance for the most common issues encountered in 5G/4G test environments.

❌ Issue 1: Authentication Reject (Cause Code #21)

Symptoms:

• Device sends Attach Request / Registration Request successfully
• Core network responds with Authentication Request (RAND + AUTN sent to device)
• Device returns Authentication Failure or Authentication Reject
• No session is established

Root Cause Analysis:
Authentication Reject at the device side indicates that the SIM card’s verification of AUTN has failed — meaning the SIM card does not trust the network. This happens when:

Resolution Steps:

Step 1: Export parameters from HSS/UDM subscriber record
Step 2: Re-read current card parameters using programming tool
Step 3: Compare values character by character (case-sensitive hex comparison)
Step 4: Verify algorithm configuration matches on both card and network
Step 5: If SQN issue suspected, delete and re-add subscriber in HSS/UDM
         to reset sequence numbers, then re-register
Step 6: Reprogram card with verified correct values
Step 7: Retry registration

Prevention:

• Always copy-paste hex values rather than manually retyping
• Verify hex string lengths: Ki = 32 hex chars (128 bits), OPc = 32 hex chars
• Use programming tool’s built-in verification function after writing

❌ Issue 2: Not Registered — Network Registration Failure

Symptoms:

• Device powers on and searches for network
• No network registration achieved (device shows “No Service” or “Emergency Only”)
• No Attach Request visible in core network logs

Root Cause Analysis:

Resolution Steps:

Step 1: Capture base station broadcast using network scanner or 
         protocol analyzer — confirm exact MCC+MNC being broadcast
Step 2: Verify card's IMSI MCC+MNC matches the broadcast PLMN exactly
Step 3: Check card's EF_PLMNwAcT for LTE access technology flag
Step 4: Check card's EF_FPLMN — ensure test PLMN is not listed as forbidden
Step 5: Verify subscriber IMSI is registered in HSS/UDM with correct format
Step 6: Check device settings — ensure LTE is enabled and device is 
         not locked to specific network

IMSI format verification:

Correct format example: 001010123456789 (15 digits)
- MCC: 001 (3 digits)
- MNC: 01 (2 digits)  
- MSIN: 0123456789 (10 digits)
Total: 15 digits ✓

Common errors:
- Leading zeros dropped: 10123456789 ✗
- MNC as 3 digits when network uses 2: 001010123456789 vs 0010010123456789 ✗

❌ Issue 3: PC/SC Driver and Card Reader Problems

Symptoms:

• Programming software cannot detect the card
• Card reader not recognized by operating system
• Intermittent connection during programming
• Write operation fails partway through

Root Cause Analysis and Resolution:

Linux PC/SC setup verification:

# Install PC/SC tools
sudo apt-get install pcscd pcsc-tools

# Start PC/SC daemon
sudo systemctl start pcscd
sudo systemctl enable pcscd

# Test card reader detection
pcsc_scan

# Expected output: Reader name and ATR (Answer To Reset) of inserted card

❌ Issue 4: SQN (Sequence Number) Desynchronization

Symptoms:

• Authentication worked previously but now fails with SYNC_FAILURE
• Core network logs show “Synchronization Failure” response from UE
• Card was used in a different network before and SQN counter advanced

Resolution:

Option 1 — Reset subscriber in HSS/UDM:
  Delete subscriber record → Re-add with same IMSI/Ki/OPc
  This resets the network-side SQN counter

Option 2 — Use SQN resynchronization procedure:
  Modern 4G/5G networks support automatic SQN resynchronization
  The UE sends AUTS (Resynchronization Token) in Authentication Failure
  HSS/UDM uses AUTS to resynchronize SQN counters
  Retry registration after resynchronization completes

Option 3 — Reprogram card:
  If automated resynchronization fails, reprogram the card
  (This resets the card-side SQN to initial values)

 Security Best Practices and Compliance Guidelines for Test SIM Card Deployments

Protecting Authentication Credentials and Ensuring Responsible Use of Blank Test Cards

🔒 Critical Security Considerations:

🛡️ Ki Protection — The Highest Priority Security Requirement

The Ki authentication key is the most sensitive credential in the entire SIM card security architecture. Its protection must be treated as a paramount security requirement in any organization using programmable test SIM cards:

Why Ki protection is non-negotiable:
If an attacker obtains a subscriber’s Ki value, they can:

• Clone the SIM card, creating an exact duplicate
• Impersonate the subscriber on the network
• Intercept and decrypt communications
• Cause fraudulent charges on the subscriber’s account

In production SIM card manufacturing, Ki values are injected into cards using Hardware Security Modules (HSMs) and encrypted distribution channels — the Ki never appears in plaintext at any point in the process.

🛡️ OPc and OP Security:

The OP (Operator Key) is a network-wide secret that must be protected at the operator level. The OPc derived from OP and individual Ki values should also be handled with care:

• Never store OP in plaintext on any networked system
• Use OPc rather than OP on cards wherever possible
• Treat OPc with the same security care as Ki
• Rotate OP periodically in production environments

🛡️ Compliance and Authorized Use:

HKCARD Electronics emphasizes that blank programmable test SIM cards are intended exclusively for authorized purposes:

✅ Authorized uses:

• Internal R&D and product development testing
• Laboratory base station and core network validation
• Private network (campus, enterprise, industrial) deployment testing
• Authorized spectrum testing and regulatory compliance testing
• Academic research in controlled laboratory environments
• MVNO service development and testing

❌ Prohibited uses:

• Accessing public carrier networks without authorization
• Circumventing carrier authentication or billing systems
• SIM cloning or subscriber identity fraud
• Any application violating local telecommunications regulations

Users are responsible for ensuring compliance with all applicable telecommunications regulations, spectrum licensing requirements, and network access rules in their jurisdiction.

Why Choose HKCARD Electronics for Your 5G/4G Test Blank SIM Cards

Manufacturing Excellence Backed by Deep Technical Expertise

HKCARD Electronics Co., Limited delivers programmable blank test SIM cards that meet the exacting requirements of professional 5G and 4G LTE base station testing:

✅ Full Authentication Parameter Support
IMSI, Ki, OPc, ICCID, PLMN, and ACC — all writable by authorized users with supported programming tools

✅ Compatible with GRSIMWrite, pySim, and Professional Tools
Verified compatibility with the programming tools most widely used in 5G/4G private network and laboratory environments

✅ Genuine CPU Card Architecture
Dedicated microprocessor with hardware cryptographic acceleration for fast, reliable Milenage and TUAK algorithm execution

✅ 100,000 Write Cycle Endurance
Reprogram as many times as your test program requires — the same cards serve your entire test lifecycle

✅ Tri-Format SIM Support
Mini-SIM (2FF), Micro-SIM (3FF), and Nano-SIM (4FF) — compatible with all 5G/4G devices and test equipment

✅ Carrier-Free — No Operator Lock
Complete freedom to program any PLMN, any IMSI, any authentication parameters for any test environment

✅ 64K and 128K Memory Options
Right-sized memory capacity for your specific test application complexity

✅ Expert Technical Support
Engineering-level guidance on authentication parameter configuration, programming tool compatibility, and troubleshooting

📬 Contact HKCARD Electronics Co., Limited

Ready to order programmable blank SIM cards for your 5G/4G base station testing program? Contact the HKCARD team today for technical guidance and competitive pricing:

HKCARD Electronics Co., Limited — Professional Programmable Blank SIM and USIM Cards for 5G/4G LTE Base Station Testing. Authentication Parameter Writing Supported. Globally Supplied.

#5GTestBlankSIMCard #4GLTEAuthenticationCard 

#ProgrammableSIMCard #BaseStationTestUSIM #HKCARDElectronics