SIM卡与JCRE混淆

Question

As far as I know, the SIM card is a Java Card and it shall implement the ETSI/3GPP specifications and the UICC configurations.

1. If the SIM is a Java Card - does it contains a JCRE from the Suns JCRE specification?
2. If the SIM card has a JCRE - is it actually the OS of the card or there is another layer? If there is, where can I read about it? Is there an option to interact with the JCRE with APDU and a card reader?
3. Are the JCRE and the card manager the same entity or the card manager is a native applet? If those are different, when an OTA update via SMS received, does the JCRE handle it first and then forward it to the applet or the card manager is the receives it directly?

Answer 1

1. If the SIM is a Java Card - does it contains a JCRE from the Suns JCRE specification?

Yes, a JCRE compliant to "Suns" JCRE specification anyway (Sun doesn't exist anymore, it's all Oracle now).

2a. If the SIM card has a JCRE - is it actually the OS of the card or there is another layer?

There could be multiple layers. Usually you'd also have native crypto libraries and a HAL - Hardware Abstraction (or Adaptation) Layer. If there is also another / native OS depends on the card (but I don't see any reason for it for SIM cards).

2b. If there is, where can I read about it? Is there an option to interact with the JCRE with APDU and a card reader?

You'd have to consult the manufacturer of the operating system / chip for that. And, if those are not available, your contact from the reseller.

3. Are the JCRE and the card manager the same entity or the card manager is a native applet?

The card manager is part of the Global Platform specs. Most Java Card comply with those. The card can be native, byte code or a combination. Again, that's up to the manufacturer.

If those are different, when an OTA update via SMS received, does the JCRE handle it first and then forward it to the applet or the card manager is the receives it directly?

They are usually rather intertwined. I presume that the HAL (see above) handles the direct communication and the APDU buffer, but as long as the card complies to the respective standards, anything goes.

As long as it is well described of course, if not then the manufacturer probably gets some stern talking to by a FIPS or Common Criteria certification body. But design documents are usually not published by the manufacturers.