Open Mobile API: Accessing the UICC on Android Devices

TL;DR

This paper reviews the integration of the Open Mobile API for secure element access on Android devices, analyzes current device support, and details reverse engineering efforts on a Samsung Galaxy S3 to facilitate custom firmware integration.

Contribution

It provides a comprehensive overview of the Open Mobile API architecture, analyzes device support, and demonstrates reverse engineering techniques for UICC communication on Android.

Findings

Open Mobile API is supported on some Android devices.

Reverse engineering reveals how to access UICC via APDU commands.

Guidelines for integrating Open Mobile API into custom Android firmware.

Abstract

This report gives an overview of secure element integration into Android devices. It focuses on the Open Mobile API as an open interface to access secure elements from Android applications. The overall architecture of the Open Mobile API is described and current Android devices are analyzed with regard to the availability of this API. Moreover, this report summarizes our efforts of reverse engineering the stock ROM of a Samsung Galaxy S3 in order to analyze the integration of the Open Mobile API and the interface that is used to perform APDU-based communication with the UICC (Universal Integrated Circuit Card). It further provides a detailed explanation on how to integrate this functionality into CyanogenMod (an after-market firmware for Android devices).