Unsteered Multi-Network IoT SIM Card

KeySecure Services Guaranteed Public IPv4 Source Address provides organisations with a dedicated, static outbound IPv4 address that is exclusively assigned to their deployment. Every outbound connection established by the organisation's KeySIM IoT SIM cards is presented to external services using the same guaranteed public IPv4 address, regardless of which mobile network the device is connected to or where it is deployed.

Unlike standard mobile broadband services, where outbound Network Address Translation (NAT) addresses are dynamically allocated from a shared carrier pool and may change without notice, KeySIM allocates a dedicated public IPv4 address that is reserved exclusively for a single customer. KeySIM guarantees that no other customer or SIM card will ever present this source IP address, providing complete separation between organisations.

This enables administrators to implement simple yet highly effective IP-based access control. Rather than maintaining extensive firewall rules or continually updating changing carrier IP ranges, organisations need only create a single firewall or Access Control List (ACL) entry permitting connections from their dedicated KeySIM public IPv4 address. Any connection originating from an alternative source IP can be automatically rejected.

The service is particularly valuable for organisations operating APIs, application servers, cloud infrastructure, industrial control systems, SCADA platforms, telemetry servers, payment gateways, databases and other business-critical systems that require trusted inbound connectivity from remote IoT devices. By restricting access to a single known source IP address, organisations can significantly reduce their external attack surface while simplifying firewall administration.

The guaranteed public IPv4 address is allocated at the KeySIM mobile core and is completely independent of the underlying Radio Access Network (RAN). Whether devices are attached to Vodafone, O2, EE or Three within the United Kingdom, or operating internationally under roaming agreements, outbound connections continue to present the same dedicated public IPv4 address. Changes in serving cell site, radio technology or mobile operator have no impact on the source IP address presented to external services.

For large-scale deployments, this architecture provides predictable networking behaviour across thousands of devices. Firewall policies remain unchanged as SIMs are added, replaced or moved between networks, eliminating the operational complexity associated with dynamic carrier NAT pools and frequently changing IP address allocations.

Guaranteed Public IPv4 Source Address is frequently deployed alongside enterprise firewall policies, IP allowlisting, API authentication, cloud security controls, Zero Trust network architectures and intrusion prevention systems, providing an additional layer of network identity that complements application-level authentication.

KeySecure Services Website & Domain Access Filtering enables organisations to control exactly which Internet services their IoT deployments can access. Rather than restricting connectivity to a predefined list of permitted destinations, this service allows specific websites, domains, IP addresses and online services to be selectively blocked while permitting access to all other Internet resources.

Security policies are enforced centrally within the KeySIM mobile core, meaning devices remain protected regardless of whether they are connected via Vodafone, O2, EE or Three, or operating anywhere in the world under international roaming agreements. Filtering is completely independent of the serving Radio Access Network (RAN), ensuring a consistent security policy across every deployment.

The service supports the blocking of individual IPv4 addresses, Fully Qualified Domain Names (FQDNs), website categories and application endpoints, allowing organisations to create highly granular Internet access policies without deploying additional on-site security appliances or firewall infrastructure.

A common enterprise use case is the deployment of business-critical connectivity for payment terminals, CCTV systems, digital signage, telemetry equipment and remote management devices. While these devices often require Internet connectivity for normal operation, organisations may wish to prevent users from consuming unnecessary bandwidth or accessing non-business services.

By selectively blocking these destinations while permitting access to all other required Internet services, organisations can maintain operational flexibility without unnecessarily restricting legitimate business traffic. Critical cloud platforms, payment gateways, remote management portals, software update services and application servers continue to operate normally while bandwidth-intensive or non-essential services remain inaccessible.

Unlike blanket Internet restrictions, selective domain filtering allows security policies to be aligned with business requirements. Devices retain Internet access where required, but connections to known non-productive or high-bandwidth destinations are denied before they are established. This helps optimise mobile data usage, reduce unnecessary operating costs and improve the overall efficiency of large-scale IoT deployments.

Filtering policies can be updated as operational requirements evolve, allowing new domains or IP addresses to be added or removed without changing SIM cards, device firmware or field configurations. Centralised policy management enables rapid deployment of security changes across thousands of connected devices from a single point of administration.

KeySecure Website & Domain Access Filtering is particularly suited to enterprise IoT, retail, financial services, transport, utilities, digital signage, surveillance, smart infrastructure and managed service providers seeking to balance Internet accessibility with network governance, cybersecurity and bandwidth optimisation.

KeySecure Services enables secure private connectivity between the KeySIM mobile core network and customer infrastructure using standards-based IPsec L2TP Virtual Private Network (VPN) technology. The service establishes an authenticated, encrypted Layer 3 tunnel between the KeySIM private ISP and the customer's firewall, router or VPN concentrator, creating a secure extension of the customer's enterprise network.

Unlike conventional mobile broadband services where traffic is broken out directly onto the public Internet, all subscriber traffic remains within the KeySIM private IP infrastructure before being securely encapsulated and forwarded through the IPsec tunnel. This creates a private routed environment for IoT devices, industrial control systems, telemetry equipment, SCADA infrastructure, PLCs, RTUs, CCTV systems, edge gateways and enterprise networking applications.

Every KeySIM Private Fixed IP SIM is allocated a permanently routable private IPv4 address, enabling deterministic addressing and direct host-to-host communication without requiring Dynamic DNS, inbound NAT, public IP addressing or application-layer relay services. Devices remain reachable across the VPN regardless of their serving mobile network.

The IPsec tunnel terminates at the KeySIM mobile core and is completely independent of the Radio Access Network (RAN). Whether the SIM is registered on Vodafone, O2, EE or Three, the encrypted tunnel architecture remains identical. Likewise, the VPN operates consistently whether devices are deployed within the United Kingdom or internationally, providing a uniform networking architecture across global IoT deployments. Cellular network selection, roaming agreements and serving base stations have no impact on the operation of the IPsec tunnel once traffic reaches the KeySIM core.

Customers maintain complete administrative control over traffic once it reaches their network perimeter. Internet breakout, static routing, firewall policies, VLAN segmentation, DNS resolution, proxy services, web filtering, IDS/IPS inspection, SIEM integration and Zero Trust security policies can all be managed entirely within the customer's own infrastructure. This allows enterprise security standards to be applied consistently across both fixed and mobile assets.

The architecture provides secure bidirectional communications, allowing authorised systems within the customer's network to initiate connections directly to remote devices using their assigned Private Fixed IP addresses. This enables secure remote management, firmware updates, telemetry collection, industrial automation, remote diagnostics, configuration management and machine-to-machine (M2M) communications without exposing field devices to the public Internet.

KeySecure Services has been designed for enterprise IoT, Industry 4.0, utilities, transportation, security, telemetry and mission-critical infrastructure where predictable routing, network isolation, private addressing and secure remote access are fundamental operational requirements.