![](https://csdnimg.cn/release/download_crawler_static/10418322/bga.jpg)
UICC Configuration v1.0 10/46
The Issuer Security Domain may support Secure Channel Protocol ‘02’ (SCP02) option i = '55'.
The absence or presence of additional SCPs in Security Domains on the UICC is beyond the scope of this
document.
When the Issuer Security Domain is the selected Application, all commands besides those required to
setup a Secure Channel shall be processed within a Secure Channel session except the GET DATA
command, which may be processed outside of a Secure Channel session. Usage of the GET DATA
command shall comply with the guidelines provided in the GP CS v2.2 Mapping Guidelines [4].
The level of security of the commands following the setup of the Secure Channel Session in SCP02 mode
is defined in section 2.2 of the GP CS v2.2 Mapping Guidelines [4].
4.3. Supplementary Security Domains present on a UICC
Supplementary Security Domains are installed with Secure Channel Protocol ‘80’ option i = '00' and/or
Secure Channel Protocol ‘02’ option i = '55'. As with the Issuer Security Domain, the absence or presence
of additional SCPs in Security Domains on the UICC is beyond the scope of this document.
Any Supplementary Security Domain has the option to reject or accept Applications being extradited to it
as defined by the GP CS v2.2 Mapping Guidelines [4] and in accordance with the configuration given
below in
section 4.3.2.
4.3.1. Security Domain hierarchies
Security Domains are organized in hierarchies according to GP CS v2.2 [3]:
• The root of a new hierarchy is defined by extraditing a SD to itself (as described in [3])
• Within such a hierarchy, the following rules are enforced by OPEN:
o If a SD has the AM privilege, then none of its ancestor SDs (following the path to the root of
the hierarchy) has the AM privilege. Conversely, if a SD has the AM privilege, no personalized
SD found in its descendants (no SD found below it) has the AM privilege
o A SD with the AM privilege can perform Card Content Management only on itself and for its
own descendents except for extradition and deletion as defined in
section 4.3.2
• The ISD is a special case, being the only SD able
o To create a SD with AM privilege
o To extradite a Security Domain with Authorized Management privilege
Applying these rules, the two following examples of hierarchies can be created:
Hierarchy Example 1
The root of this hierarchy is a Security Domain supporting Secure Channel Protocol ‘80’ (SCP80). It does
not support Card Content Management.
The APSD 1 has Authorized Management. It uses its SCP02 over the SCP80 when accessed by the Link
Platform Operator (LPO).
The APSD 2 has Authorized Management. It uses its SCP80 and keys when accessed Over The Air.
Copyright © 2008 GlobalPlatform Inc. All Rights Reserved.
The technology provided or described herein is subject to updates, revisions, and extensions by GlobalPlatform. Use of this
information is governed by the GlobalPlatform license agreement and any use inconsistent with that agreement is strictly
prohibited.