33.1033G security3GPPIntegration guidelinesTS

4.1 Functional network architecture

Figure 1 shows the functional security architecture of UMTS.

Figure 1: UMTS functional security architecture

The vertical bars represent the network elements:

In the user domain:

USIM (User Service Identity Module): an access module issued by a HE to a user;

UE (User Equipment);

In the serving network (SN) domain:

RNC (Radio Network Controller);

VLR (Visited Location Register), also the SGSN;

In the home environment (HE) domain:

HLR/AuC;

UIDN.

The horizontal lines represent the security mechanisms:

EUIC: mechanism for enhanced user identity confidentiality (optional, between user and HE);

UIC: conventional mechanism for user identity confidentiality (between user and serving network);

AKA: the mechanism for authentication and key agreement, including the functionality to trigger a re-authentication by the user, i.e., to control the access key pair lifetime;

DC: the mechanism for data confidentiality of user and signalling data;

DI: the mechanism for data integrity of signalling data;

DEC: the mechanism for network-wide data confidentiality.

In the remaining section of this specification we describe what data elements and functions need to be implemented in each of the above network elements for each of the above mechanisms and functions.

4.2 User services identity module

4.2.1 Void

4.2.2 Authentication and key agreement (AKA_USIM)

The USIM shall support the UMTS mechanism for authentication and key agreement described in 6.3 of 3G TS 33.102.

The following data elements need to be stored on the USIM:

a) K: a permanent secret key;

b) SQN_MS: a counter that is equal to the highest sequence number SQN in an AUTN parameter accepted by the user;

c) RAND_MS: the random challenge which was received together with the last AUTN parameter accepted by the user. It is used to calculate the re-synchronisation message together with the highest accepted sequence number (SQN_MS);

d) KSI: key set identifier;

e) THRESHOLD: a threshold defined by the HE to trigger re-authentication and to control the cipher key lifetime;

f) CK The access link cipher key established as part of authentication;

g) IK The access link integrity key established as part of authentication;

h) HFN_MS: Stored Hyper Frame Number provides the Initialisation value for most significant part of COUNT-C and COUNT-I. The least significant part is obtained from the RRC sequence number;

i) AMF: A 16-bit field used Authentication Management. The use and format are unspecified in the architecture but examples are given in an informative annex;

j) The GSM authentication parameter and GSM cipher key derived from the UMTS to GSM conversion functions.

Table 3 provides an overview of the data elements stored on the USIM to support authentication and key agreement.

Table 3: USIM – Authentication and key agreement – Data elements

NOTE 1: HE policy may dictate more than one, the active key signalled using the AMF function.

NOTE 2: one for circuit-switched domain, one for packet-switched domain.

The following cryptographic functions need to be implemented on the USIM:

– f1: a message authentication function for network authentication;

– f1*: a message authentication function for support to re-synchronisation;

– f2: a message authentication function for user authentication;

– f3: a key generating function to derive the cipher key;

– f4: a key generating function to derive the integrity key;

– f5: a key generating function to derive the anonymity key for normal operation;

– f5*: a key generating function to derive the anonymity key for re-synchronisation;

– c2: Conversion function for interoperation with GSM from XRES (UMTS) to SRES (GSM);

– c3: Conversion function for interoperation with GSM from Ck and IK (UMTS) to Kc (GSM).

Figure 2 provides an overview of the data integrity, data origin authentication and verification of the freshness by the USIM of the RAND and AUTN parameters received from the VLR/SGSN, and the derivation of the response RES, the cipher key CK and the integrity key IK. Note that the anonymity Key (AK) is optional.

Figure 2: User authentication function in the USIM

Figure 3 provides an overview of the generation in the USIM of a token for re-synchronisation AUTS.

a) The USIM computes MAC-S = f1*_K(SQN_MS || RAND || AMF*), whereby AMF* is a default value for AMF used in re-synchronisation.

b) If SQN_MS is to be concealed with an anonymity key AK, the USIM computes AK = f5_K(RAND), and the concealed counter value is then computed as SQN_MS  AK.

c) The re-synchronisation token is constructed as AUTS = SQN_MS [ AK] || MAC-S.

Figure 3: Generation of a token for re-synchronisation AUTS (note 1)

NOTE 1: The lengths of AUTS and MAC-S are specified in table 20.

Table 4 provides a summary of the cryptographic functions implemented on the USIM to support authentication and key agreement.

Table 4: USIM – Authentication and key agreement – Cryptographic functions

4.3 User equipment

4.3.1 User identity confidentiality (UIC_UE)

The UE shall support the UMTS conventional mechanism for user identity confidentiality described in 6.1 of 3G TS 33.102.

The UE shall store the following data elements:

– TMUI-CS: a temporary identity allocated by the CS core network;

– LAI: a location area identifier;

– the TMUI-PS: a temporary identity allocated by the PS core network;

– the RAI: a routing area identifier

Table 5: UE – User Identity Confidentiality – Data elements

4.3.2 Data confidentiality (DC_UE)

The UE shall support the UMTS mechanism for confidentiality of user and signalling data described in 6.6 of 3G TS 33.102.

The UE shall store the following data elements:

a) UEA-MS: the ciphering capabilities of the UE;

b) CK: the cipher key;

c) UEA: the selected ciphering function;

In addition, when in dedicated mode:

d) COUNT-C_UP: a time varying parameter for synchronisation of ciphering for the uplink;

e) COUNT-C_DOWN: a time varying parameter for synchronisation of ciphering for the downlink;

f) BEARER: a radio bearer identifier;

g) DIRECTION: An indication of the direction of transmission uplink or downlink to ensure a different cipher is applied.

Table 6 provides an overview of the data elements stored on the UE to support the mechanism for data confidentiality:

Table 6: UE – Data Confidentiality – Data elements

The following cryptographic functions shall be implemented on the UE:

– f8: access link encryption function (note 1).

– c4: Conversion function for interoperation with GSM from Kc (GSM) to CK (UMTS).

NOTE 1: The security architecture TS 33.102 refers to UEA , f8 is a specific implementation of UEA as defined in Cryptographic algorithm requirements TS 33.105.

Table 7 provides an overview of the cryptographic functions implemented on the UE to support the mechanism for data confidentiality.

Table 7: UE – Data Confidentiality – Cryptographic functions

4.3.3 Data integrity (DI_UE)

The UE shall support the UMTS mechanism for integrity of signalling data described in 6.4 of 3G TS 33.102.

The UE shall store the following data elements:

a) UIA-MS: the integrity capabilities of the UE.

In addition, when in dedicated mode:

b) UIA: the selected UMTS integrity algorithm;

c) IK: an integrity key;

d) COUNT-I_UP: a time varying parameter for synchronisation of data integrity in the uplink direction;

e) COUNT-I_DOWN: a time varying parameter for synchronisation of data integrity in the downlink direction;

f) DIRECTION An indication of the direction of transmission uplink or downlink to ensure a different cipher is applied;

g) FRESH: a network challenge;

Table 8 provides an overview of the data elements stored on the UE to support the mechanism for data confidentiality:

Table 8: UE – Data Integrity – Data elements

The following cryptographic functions shall be implemented on the UE:

– f9: access link integrity function (note 1).

– c5: Conversion function for interoperation with GSM Kc (GSM) > IK (UMTS)

NOTE 1: The security architecture TS 33.102 refers to UIA, f9 is a specific implementation of UIA as defined in Cryptographic algorithm requirements TS 33.105.

Table 9 provides an overview of the cryptographic functions implemented in the UE:

Table 9: UE – Data Integrity – Cryptographic functions

4.3.4 Void

4.4 Radio network controller

4.4.1 Data confidentiality (DC_rnc)

The RNC shall support the UMTS mechanism for data confidentiality of user and signalling data described in 6.6 of 3G TS 33.102.

The RNC shall store the following data elements:

a) UEA-RNC: the ciphering capabilities of the RNC;

In addition, when in dedicated mode:

b) UEA: the selected ciphering function;

c) CK: the cipher key;

d) COUNT-C_UP: a time varying parameter for synchronisation of ciphering for the uplink;

e) COUNT-C_DOWN: a time varying parameter for synchronisation of ciphering for the downlink;

f) DIRECTION: An indication of the direction of transmission uplink or downlink to ensure a different cipher is applied

g) BEARER: a radio bearer identifier.

Table 10 provides an overview of the data elements stored in the RNC to support the mechanism for data confidentiality:

Table 10: RNC – Data Confidentiality – Data elements

The following cryptographic functions shall be implemented in the RNC:

– f8: access link encryption function.

Table 11 provides an overview of the cryptographic functions implemented in the RNC to support the mechanism for data confidentiality:

Table11: RNC – Data confidentiality – Cryptographic functions

4.4.2 Data integrity (DI_rnc)

The RNC shall support the UMTS mechanism for data integrity of signalling data described in 6.4 of 3G TS 33.102.

The RNC shall store the following data elements:

a) UIA-RNC: the integrity capabilities of the RNC;

In addition, when in dedicated mode:

b) UIA: the selected UMTS integrity algorithm;

c) IK: an integrity key;

d) COUNT-I_UP: a time varying parameter for synchronisation of data integrity in the uplink direction;

e) COUNT-I_DOWN: a time varying parameter for synchronisation of data integrity in the downlink direction;

f) DIRECTION An indication of the direction of transmission uplink or downlink to ensure a different cipher is applied;

g) FRESH: an MS challenge.

Table 12 provides an overview of the data elements stored on the RNC to support the mechanism for data confidentiality:

Table12: RNC – Data Integrity – Data elements

The following cryptographic functions shall be implemented on the RNC:

– f9: access link integrity function.

Table 13 provides an overview of the cryptographic functions implemented in the RNC:

Table 13: RNC – Data Integrity – Cryptographic functions

4.5 SN (or MSC/VLR or SGSN)

4.5.1 User identity confidentiality (UIC_SN)

The VLR (equivalently the SGSN) shall support the UMTS conventional mechanism for user identity confidentiality described in 6.1 of 3G TS 33.102.

The VLR shall store the following data elements:

– TMUI-CS: a temporary identity allocated by the CS core network;

– LAI: a location area identifier;

Table 14: VLR – User Identity Confidentiality – Data elements

Equivalently, the SGSN shall store the following data elements:

– TMUI-PS: a temporary identity allocated by the PS core network;

– RAI: a routing area identifier.

Table 15: SGSN – User Identity Confidentiality – Data elements

4.5.2 Void

4.5.3 Authentication and key agreement ( AKA_SN)

The VLR (equivalently the SGSN) shall support the UMTS mechanism for authentication and key agreement described in 6.3 of 3G TS 33.102.

The following data elements need to be stored in the VLR (and SGSN):

a) AV: Authentication vectors;

Table 16 provides an overview of the composition of an authentication vector

Table 16: Composition of an authentication vector

b) KSI: Key set identifier;

c) CK: Cipher key;

d) IK: Integrity key;

e) GSM AV: Authentication vectors for GSM.

Table 17 provides an overview of the data elements stored in the VLR/SGSN to support authentication and key agreement.

Table 17: VLR/SGSN – Authentication and key agreement – Data elements

The following cryptographic functions shall be implemented in the VLR/SGSN:

– c4: Conversion function for interoperation with GSM from Kc (GSM) to CK (UMTS);

– c5: Conversion function for interoperation with GSM from Kc (GSM) to IK (UMTS).

Table 18 provides an overview of the cryptographic functions implemented on the UE to support the mechanism for data confidentiality.

Table 18: VLR/SGSN Authentication and Key Agreement – Cryptographic functions

4.6 Home location register / Authentication centre

4.6.1 Authentication and key agreement (AKA_he)

The HLR/AuC shall support the UMTS mechanism for authentication and key agreement described in 6.3 of 3G TS 33.102.

The following data elements need to be stored in the HLR/AuC:

a) K: a permanent secret key;

b) SQN_HE: a counter used to generate SQN from;

c) AV: authentication vectors computed in advance;

Table 19 provides an overview of the data elements stored on the HLR/AuC to support authentication and key agreement.

Table 19: HLR/AuC – Authentication and key agreement – Data elements

Table 20 shows how the construction of authentication token for synchronisation failure messages used to support authentication and key agreement.

Table 20: Composition of an authentication token for synchronisation failure messages

Figure 4 provides an overview of how authentication vectors are generated in the HLR/AuC.

Figure 4: Generation of an authentication vector

The following cryptographic functions need to be implemented in the HLR/AuC:

– f1: a message authentication function for network authentication;

– f1*: a message authentication function for support to re-synchronisation;

– f2: a message authentication function for user authentication;

– f3: a key generating function to derive the cipher key;

– f4: a key generating function to derive the integrity key;

– f5: a key generating function to derive the anonymity key for normal operation;

– f5*: a key generating function to derive the anonymity key for re-synchronisation;

– c1: Conversion function for interoperation with GSM from RAND (UMTS) > RAND (GSM);

– c2: Conversion function for interoperation with GSM from XRES (UMTS) to SRES (GSM);

– c3: Conversion function for interoperation with GSM from CK and IK (UMTS) to Kc (GSM).

Table 21 provides a summary of the cryptographic functions implemented on the USIM to support authentication and key agreement.

Table 21: HLR/AuC – Authentication and key agreement – Cryptographic functions

4.7 Void