An iSIM, or integrated SIM, is a SIM function implemented inside a certified secure enclave of a device’s main system-on-chip, rather than on a separate card or a separate soldered chip. In telecommunications, it is the newest step in the evolution from removable SIM cards to the soldered eSIM, and it belongs to the SIM & eSIM family of technologies that let a device prove its identity to a mobile network.
Like an eSIM, an iSIM stores one or more operator profiles containing the subscriber identity and secret keys, and it receives those profiles over the air through remote SIM provisioning. The difference is physical: there is no dedicated SIM component on the circuit board, because the secure hardware lives inside the same silicon as the application processor or the cellular modem.
How an iSIM is built into the chip
An iSIM relies on a tamper-resistant secure subsystem that is isolated from the rest of the processor. This subsystem has its own CPU core, cryptographic accelerator, protected memory and random number generator, and it communicates with the main processor only through narrow, controlled interfaces. Ordinary software running on the device, including the operating system, cannot read the keys stored inside.
A practical challenge is non-volatile storage. Modern processors are manufactured on advanced process nodes that do not integrate flash memory well, so many iSIM designs store encrypted profile data in external memory and keep only the keys and the integrity anchor inside the enclave. The secure subsystem decrypts and verifies the data whenever it is loaded.
The table summarizes the main building blocks of a typical iSIM design.
| Component | Function | Security role |
|---|---|---|
| Secure processor core | Runs the SIM operating system and applets | Isolated from application software |
| Cryptographic engine | Performs network authentication algorithms | Keys never leave the enclave |
| Protected RAM and ROM | Holds runtime state and boot code | Resists probing and fault attacks |
| Encrypted external storage | Keeps profile data persistently | Integrity checked on every load |
| eUICC functions | Manages profile download and switching | Same model as an embedded SIM |
iSIM compared with SIM card and eSIM
The three forms of SIM share the same logical purpose and largely the same network procedures; they differ in form factor, provisioning model and hardware cost. From the network’s point of view, an authenticated iSIM looks the same as any other SIM, because it presents an IMSI and runs the same authentication algorithms.
| Property | Removable SIM card | eSIM (eUICC chip) | iSIM |
|---|---|---|---|
| Physical form | Plastic card such as Nano-SIM | Soldered chip about 5 by 6 mm | Enclave inside the main processor |
| Profile delivery | Fixed at manufacturing | Remote SIM provisioning | Remote SIM provisioning |
| Operator switching | Swap the card | Download a new profile | Download a new profile |
| Board space | Card tray and connector | Small dedicated component | No dedicated component |
| Supply chain | Separate card logistics | Separate secure chip | Delivered with the chipset |
A useful way to think about it is that iSIM is a hardware variant of eUICC, not a new subscription model. The profile management, the SM-DP+ server that prepares profiles, and the user experience of adding a plan are essentially the same as with an embedded SIM.
Standards and security certification
Because the SIM holds credentials that protect both the subscriber and the operator, an iSIM must meet the same security assurance level as a discrete SIM chip. This is demanding, since the enclave shares a die, power supply and clock with a large, complex processor that could be used to mount side-channel or fault attacks.
The relevant framework combines GSMA remote provisioning specifications with hardware security certification. The table outlines the main elements.
| Layer | What it covers | Practical meaning |
|---|---|---|
| Remote SIM provisioning | GSMA consumer and IoT architectures | Profiles are downloaded and managed remotely |
| Integrated secure element requirements | GSMA rules for on-chip SIM hardware | Defines isolation and key protection |
| Smart Secure Platform | ETSI framework for integrated secure platforms | Common interface for on-chip secure elements |
| Common Criteria evaluation | Independent attack testing of the enclave | Typically at a high assurance level such as EAL4+ |
Certification is the main cost and time factor in bringing an iSIM-capable chipset to market. Each new processor generation usually requires the secure subsystem to be evaluated again, which favors large chipset vendors with long product cycles.
Where iSIM is used and why
iSIM brings the largest benefit where size, power and bill-of-materials cost dominate. The decision table below shows typical device categories and how strongly they benefit.
| Device category | Benefit of iSIM | Reason |
|---|---|---|
| IoT sensors and trackers | High | Smallest footprint and lowest component count |
| Smartwatches and wearables | High | Every square millimeter matters |
| Smartphones | Moderate | Frees board space already saved by eSIM |
| Cellular laptops and tablets | Moderate | Simplifies variants for different markets |
| Industrial modules | Variable | Long lifetimes demand proven certification |
For manufacturers, a further advantage is one hardware build for every market. The SIM identity is added after production through provisioning, so the same device can ship worldwide and receive a local operator profile when it is first switched on.
Limitations and open questions
iSIM is a mature concept but a young deployment, and several practical limitations remain.
- Operator and platform support varies, so not every network or device platform accepts iSIM-based profiles yet.
- The SIM cannot be moved to another device, which complicates repairs; a replacement board needs a newly downloaded profile.
- Certification cycles are long and must be repeated for new chip designs.
- Security depends on enclave isolation; a flaw in the shared silicon is harder to patch than a separate secure chip.
- IoT provisioning models still differ between consumer and machine-to-machine deployments, which affects device onboarding.
A non-technical view
A traditional SIM is a small card you slide into a phone. An eSIM moved that card onto a tiny chip soldered inside the device. An iSIM goes one step further and builds the SIM into the main processor, in a locked compartment that nothing else can open.
You still choose and change your mobile plan the same way, usually by scanning a code or using an app. What changes is that no separate SIM part exists at all, which saves space and lets very small gadgets connect to mobile networks.
A concrete example
A logistics company equips shipping containers with battery-powered trackers that report location and temperature every few hours over an LTE-M network. The previous tracker design used a soldered eSIM chip, a separate cellular module and a large battery.
The redesigned tracker uses a cellular chipset with an integrated SIM. Removing the separate SIM component shrinks the circuit board and reduces the number of parts that can fail in vibration and cold. Each tracker leaves the factory with no operator profile; when it is first powered on in the destination region, it downloads a local profile through remote provisioning. The result is a single hardware design for all regions and a smaller, cheaper device.