R-UIM Tools Home Page

Our Articles

Simple and powerfull GSM + LTE Authentication Calculator: TUAK, Milenage, COMP128-1, 2, 3, Xor Visualyze and Analyze all APDUs between handset and RUIM, (U)SIM All you need to work with SIM, USIM, R-UIM card: build card tree, read, write, export GSM 03.48 compliant solutions for Over-The-Air campaign DES, 3DES, AES, MD5, and other encryptions and hashes Parse an ISO 7816-3 ATR online A collection of Java Card projects in source A simple tool to convert CAP files into IJC format

What is USSD

Source: TruTeq University

    USSD (Unstructured Supplementary Service Data) is a unique service for mobile networks comprised of two-directional session-based exchange of unstructured data in GSM mobile networks. USSD technology is defined in GSM standard 02.90 (USSD Stage 1) and 03.90 (USSD Stage 2). The USSD service supports high-speed real-time information exchange between subscriber and service application. Originally, Supplementary Services Data was designed for use where supplementary services such as call forwarding or multiparty calls were needed. For instance, a call-forwarding option is needed for all incoming calls. Such service can be activated by this command: **21*#. There is a whole set of preset commands for call-forwarding and for other purposes that work on all GSM telephones. Combinations that have not been reserved can be used for other services.

    The USSD bearer is accessed by calling a number that starts with an asterisk (star) or gate (hash) characters ("*" or "#") and then a combination of numerals, asterisks and finally a gate or hash character "#". A handset recognizes such numbers and use the USSD bearer instead of a voice call. Instead of calling another subscriber or a service, the handset communicates with the USSD infrastructure. The subscriber does not have to get special software for the handset or special SIM cards to be able to use USSD.

    Unstructured Supplementary Service Data is a capability of all GSM phones. It is generally associated with real-time phone services. There is no store-and-forward functionality typical of 'normal' short messages (in other words, an SMSC is not used in processing). Response times for interactive USSD based services are generally quicker than those used for SMS. After entering a USSD code on your GSM handset, reply from an GSM operator is displayed within a few seconds. USSD Phase 1 only supports mobile initiated operation (pull operation). USSD Phase 2 specified supports network initiated operation (pull and push operations). Therefore, Phase 2 provides for interactive dialogues.

    GSM handsets supported USSD from the first days of GSM. Phase 2 has been supported for years and over 99% of handsets currently in use can use USSD sessions. Our technical support department agrees that almost all telephones support USSD. There are, however, exceptions: for instance, old Siemens phones display USSD-messages as a moving line that severely limits interaction with the USSD menu (and if the subscriber does not know she will not understand what to do).

    Most handsets also support NI USSD (network initiated USSD), also called "USSD Push". With NI USSD, the network can push information to the subscriber's handset. Where is USSD push used? USSD push does not manifest itself (the phone will not ring, make sounds or vibrate) so that in order to get a message a user has to look at the display at the very moment USSD push has come. Therefore, USSD push is used in mixed services: a user sends an SMS or makes a call and in return gets a USSD menu.

    Another important fact about USSD is that messages from handsets to the numbers 100-149 always route to the home network. This means that if you are roaming in another network, dialing a USSD number from 100 to 149 on your phone will always route to the application on your home network. If you are used to accessing a particular service in your home network, then you will also be able to access it from another country. USSD codes other than within 100 and 150 are routed at discretion of a guest network.

USSD compared to SMS

    USSD differs from the other short message bearer, SMS, in a number of significant ways.

    It is not a store-and-forward bearer like SMS, but a transparent session-based bearer ideal for transacting. Information is delivered and responses obtained in real-time. Simply put, USSD is similar to speaking to someone on a phone as SMS is sending a letter.

    USSD is also not a point-to-point bearer such as SMS. One subscriber cannot send another text using USSD unless there is a special network application offering such an application.

    One can send 182 characters using USSD, but SMS only allows for 140 x 8-bit, or 160 x 7-bit characters.

    Like SMS, USSD uses the GSM control channels for data transfer. SMS and USSD both use the SDCCH (stand-alone dedicated control channel) when the handset is not in a call. When the handset is busy with a call, USSD will use the FACCH (fast associated control channel) with a significant improvement in transfer speed (1000 bits/second).

    This use of the SDCCH channel leads to the one drawback with USSD. Because the SDCCH channel is also used by GSM for call-setup, many open USSD sessions may limit new call-setups in congested networks. In practise, this doesn't happen often and GSM Network Operatorss can upgrade the radio resources in highly congested cells to prevent this from happening.

    Unlike SMS, the subscriber does not have to create a message. The USSD call string can even be stored in the phone book under a name. Some applications will also allow menu shortcuts where the subscriber can add the menu item selection after an "*" seperation character. In our earlier example, the user might create a phonebook entry call "Pretoria Weather" with the number *150*1234*12*3#. The additional "*3" denotes menu selection 3.

    On a GSM network level, the USSD Gateway is defined as a gsmSCF (GSM Service Control Function), whereas an SMSC is defined as another HLR (Home Location Register).

Routing and Rating

    Historically, USSD Gateways have extremely limited routing and billing functionality and are limited to signalling. "Routing and Rating" platforms need to be added to the USSD Gateway to deconcentrate the connectivity to hundreds of application and content providers.

    When subscribers dial the published USSD strings, the Routing and Rating platform routes the sessions to the correct application via an interface such as XML over HTP, SMPP3.4, or SSMI.

    The application must accept the session and serve the appropriate menu to the subscriber. The Routing and Rating platform maintains the session and will generate billing tickets for the billing system for post-paid subscribers and reserve funds and debit prepaid accounts. Depending on the sophistication of the Routing and Rating platform, the subscriber can be billed based on a once-off cost, the number of menu transactions, or the time spent browsing the menus.

    Due to the fact that an open USSD session takes up network resources, the time-based model is usually deployed and subscribers are encouraged to browse the menus quickly. For roaming subscribers, the service code is always sent back to the home network.


    The menus are served by applications. This may not be at the GSM network operator, but at a content provider connected to the USSD infrastructure. Applications or content can therefore be served from:

  • Standard supplementary services
  • GSM Network Operators value-added services
  • Third party content and application providers

  • Standard supplementary services

    The supplementary services are the standard offerings as described by the ETSI standards. These services are accessed by the handset without the need for the subscriber to know the codes. When the subscriber selects an action on the handset's internal menu, the handset will communicate with the GSM.

    Even though the handset hides the complexities in accessing the supplementary services, it is still possible to access them directly using USSD.

    One example of such a service is call forwarding. The service codes associated with call forwarding service, are 004, 21, 61, 62 and 67:

    Service All Calls If No Reply If Unavailable If Busy All Conditional Diverts
    Forwarding **21*[dest number]# **61*[dest number]# **62*[dest number]# **67*[dest number]# **004*[dest number]#
    Activate *21# *61# *62# *67# *004#
    Deactivate #21# #61# #62# #67# #004#
    Delete ##21# ##61# ##62# ##67# ##004#
    Check Status *#21# *#61# *#62# *#67# *#004#

    These service codes are fixed and all GSM handsets will be able to use them to provision the relevant supplementary services.

    GSM Network Operator services

    These services include value-adding services such as airtime top-up, airtime transfer, call-back services and prepaid roaming. The Network Operator service codes depend on the routing inside the GSM Network Operators and may be anything in the range 1XY, where X = 1,2,3,4 and Y=1,2,3,4,5,6,7,8,9

    As an example, a call-back service to alert subscriber 0855551234 that another subscriber want to be called, might be *120*0855551234#

    The menu items could also be embedded in the dial string, so that an airtime transfer string might look like: *123*1234*2*0855551234# where "1234" is the pin number, "2" is the menu item for airtime transfer, and "0855551234" is the target number.

    Third Party Content and Services - application examples

    By connecting to the routing and rating platform on a USSD Gateway, third parties can offer services to all the subscribers on a GSM network.

    Some examples of USSD applications include:
  • Information services such as weather forecasts, traffic, news, geo-location services, directory services etc.
  • Entertainment services such as games, sports etc.
  • Lifestyle services such as dating, horoscopes etc.
  • Financial services such as airtime top-up, banking etc.