Protection of sensitive SIM card data

SIM cards contain sensitive information such as PIN and PUK codes and cryptographic keys used to authenticate subscribers on the mobile network. If this data is exposed to the wrong person, it can be used to clone a SIM card or gain unauthorized access to services.

PortaBilling now protects this data in two ways:

• Restricting who can access the sensitive SIM card fields via the web interface and API
• Encrypting it in the database

By default, only an admin with the Root role can view sensitive SIM card data via the web interface and API; other users need explicit permission. Even with this permission, an admin must manually reveal each field, which remains visible for only a few seconds. This helps prevent accidental exposure of sensitive data (e.g., during screen sharing).

Database encryption of sensitive SIM card data is disabled by default. You can enable it so that this data remains protected even when applications, such as a custom tool used to generate sales reports, have general read-only database access. This prevents anyone who can access the database through such applications from reading sensitive SIM card data, which is otherwise restricted in the web interface and API. Once encryption is enabled, PortaBilling starts encrypting existing SIM card data in the background while automatically encrypting data for all new SIM cards.

• Sensitive SIM card data fields are: PIN, PUK1, PUK2, Authentication key, OPc key, AMF, and Activation code.
• When access to sensitive SIM card fields is restricted, the API does not return those fields. If you’re updating your system to MR131 or later and use custom integrations that require these SIM card parameters to be included in the API, make sure to explicitly enable access to these fields in the relevant roles.
• You can grant permission to view sensitive SIM card data to custom roles of the Admin, Reseller, or Customer self-care type. Granting this permission to a Customer self-care role affects the API access only.
• When encryption is enabled, new SIM cards (uploaded or added manually) are encrypted immediately. Existing SIM cards are processed by a background task that runs once per hour, so encrypting a large SIM card base may take some time.
• Disabling database encryption runs the same background task in reverse, decrypting the sensitive data back to plain text.

1. Open a custom role (Admin, Reseller, or Customer self-care type) for which you want to control access and locate the SIM card Secret fields permission.
2. Change the permission from Restrict to Read/Modify to allow users with this role to view these fields.

   

1. Log in to the Configuration server web interface and set the Security.EncryptSIMCardKeyMaterial option to Yes.

   

2. Optionally, you can adjust how the background encryption task runs:
   • Security.SIM_Card_Key_Material_Encryption_Chunk_Size – the number of SIM cards processed per batch (default: 10000)
   • Security.SIM_Card_Key_Material_Encryption_Chunk_Pause – the pause, in seconds, between batches (default: 1)

   A smaller chunk size or longer pause reduces database load, while a larger chunk size or shorter pause completes encryption faster.