4 Access link security

33.1033G security3GPPIntegration guidelinesTS

4.1 Functional network architecture

Figure 1 shows the functional security architecture of UMTS.

Figure 1: UMTS functional security architecture

The vertical bars represent the network elements:

In the user domain:

USIM (User Service Identity Module): an access module issued by a HE to a user;

UE (User Equipment);

In the serving network (SN) domain:

RNC (Radio Network Controller);

VLR (Visited Location Register), also the SGSN;

In the home environment (HE) domain:

HLR/AuC;

UIDN.

The horizontal lines represent the security mechanisms:

EUIC: mechanism for enhanced user identity confidentiality (optional, between user and HE);

UIC: conventional mechanism for user identity confidentiality (between user and serving network);

AKA: the mechanism for authentication and key agreement, including the functionality to trigger a re-authentication by the user, i.e., to control the access key pair lifetime;

DC: the mechanism for data confidentiality of user and signalling data;

DI: the mechanism for data integrity of signalling data;

DEC: the mechanism for network-wide data confidentiality.

In the remaining section of this specification we describe what data elements and functions need to be implemented in each of the above network elements for each of the above mechanisms and functions.

4.2 User services identity module

4.2.1 Void

4.2.2 Authentication and key agreement (AKA_USIM)

The USIM shall support the UMTS mechanism for authentication and key agreement described in 6.3 of 3G TS 33.102.

The following data elements need to be stored on the USIM:

a) K: a permanent secret key;

b) SQN_MS: a counter that is equal to the highest sequence number SQN in an AUTN parameter accepted by the user;

c) RAND_MS: the random challenge which was received together with the last AUTN parameter accepted by the user. It is used to calculate the re-synchronisation message together with the highest accepted sequence number (SQN_MS);

d) KSI: key set identifier;

e) THRESHOLD: a threshold defined by the HE to trigger re-authentication and to control the cipher key lifetime;

f) CK The access link cipher key established as part of authentication;

g) IK The access link integrity key established as part of authentication;

h) HFN_MS: Stored Hyper Frame Number provides the Initialisation value for most significant part of COUNT-C and COUNT-I. The least significant part is obtained from the RRC sequence number;

i) AMF: A 16-bit field used Authentication Management. The use and format are unspecified in the architecture but examples are given in an informative annex;

j) The GSM authentication parameter and GSM cipher key derived from the UMTS to GSM conversion functions.

Table 3 provides an overview of the data elements stored on the USIM to support authentication and key agreement.

Table 3: USIM – Authentication and key agreement – Data elements

Symbol	Description	Multiplicity	Lifetime	Length	Mandatory / Optional
K	Permanent secret key	1 (note 1)	Permanent	128 bits	Mandatory
SQNMS	Highest previously accepted sequence number counter	1	Updated when AKA protocol is executed	48 bits	Mandatory
SQNMS[ ] array	array of last accepted sequence number	1	Updated when AKA protocol is executed	at least 32 entries	Optional
RANDMS	Random challenge received by the user.	1	Updated when AKA protocol is executed	128 bits	Mandatory
KSI	Key set identifier	2 (note 2)	Updated when AKA protocol is executed	3 bits	Mandatory
THRESHOLD	Threshold value for cipher key	1	Permanent	24 bits	Mandatory
CK	Cipher key	2 (note 2)	Updated when AKA protocol is executed	128 bits	Mandatory
IK	Integrity key	2 (note 2)	Updated when AKA protocol is executed	128 bits	Mandatory
HFNMS:	Initialisation value for most significant part for COUNT-C and for COUNT-I	1	Updated when connection is released	25 bits	Mandatory
AMF	Authentication Management Field (indicates the algorithm and key in use)	1	Updated when AKA protocol is executed	16 bits	Mandatory
Kc	GSM cipher Key	2 (note 2)	Updated when GSM AKA or UMTS AKA protocol is executed	As for GSM	Optional

NOTE 1: HE policy may dictate more than one, the active key signalled using the AMF function.

NOTE 2: one for circuit-switched domain, one for packet-switched domain.

The following cryptographic functions need to be implemented on the USIM:

– f1: a message authentication function for network authentication;

– f1*: a message authentication function for support to re-synchronisation;

– f2: a message authentication function for user authentication;

– f3: a key generating function to derive the cipher key;

– f4: a key generating function to derive the integrity key;

– f5: a key generating function to derive the anonymity key for normal operation;

– f5*: a key generating function to derive the anonymity key for re-synchronisation;

– c2: Conversion function for interoperation with GSM from XRES (UMTS) to SRES (GSM);

– c3: Conversion function for interoperation with GSM from Ck and IK (UMTS) to Kc (GSM).

Figure 2 provides an overview of the data integrity, data origin authentication and verification of the freshness by the USIM of the RAND and AUTN parameters received from the VLR/SGSN, and the derivation of the response RES, the cipher key CK and the integrity key IK. Note that the anonymity Key (AK) is optional.

Figure 2: User authentication function in the USIM

Figure 3 provides an overview of the generation in the USIM of a token for re-synchronisation AUTS.

a) The USIM computes MAC-S = f1*_K(SQN_MS || RAND || AMF*), whereby AMF* is a default value for AMF used in re-synchronisation.

b) If SQN_MS is to be concealed with an anonymity key AK, the USIM computes AK = f5_K(RAND), and the concealed counter value is then computed as SQN_MS  AK.

c) The re-synchronisation token is constructed as AUTS = SQN_MS [ AK] || MAC-S.

Figure 3: Generation of a token for re-synchronisation AUTS (note 1)

NOTE 1: The lengths of AUTS and MAC-S are specified in table 20.

Table 4 provides a summary of the cryptographic functions implemented on the USIM to support authentication and key agreement.

Table 4: USIM – Authentication and key agreement – Cryptographic functions

Symbol	Description	Multiplicity	Lifetime	Standardised / Proprietary	Mandatory / Optional
f1	Network authentication function	1	Permanent	Proprietary	Mandatory
f1*	Message authentication function for synchronisation	1	Permanent	Proprietary	Mandatory
f2	User authentication function	1	Permanent	Proprietary	Mandatory
f3	Cipher key generating function	1	Permanent	Proprietary	Mandatory
f4	Integrity key generating function	1	Permanent	Proprietary	Mandatory
f5	Anonymity key generating function (for normal operation)	1	Permanent	Proprietary	Optional
f5*	Anonymity key generating function (for re-synchronisation)	1	Permanent	Proprietary	Optional
c2 and c3	Conversion functions for interoperation with GSM	1 of each	Permanent	Standard	Optional

4.3 User equipment

4.3.1 User identity confidentiality (UIC_UE)

The UE shall support the UMTS conventional mechanism for user identity confidentiality described in 6.1 of 3G TS 33.102.

The UE shall store the following data elements:

– TMUI-CS: a temporary identity allocated by the CS core network;

– LAI: a location area identifier;

– the TMUI-PS: a temporary identity allocated by the PS core network;

– the RAI: a routing area identifier

Table 5: UE – User Identity Confidentiality – Data elements

Symbol	Description	Multiplicity	Lifetime	Length	Mandatory / Optional
TMUI-CS	Temporary user identity	1 per user	Updated when TMUI allocation protocol is executed by CS core network	As per GSM TMSI	Mandatory
LAI	Location area identity	1 per user	Updated when TMUI allocation protocol is executed by CS core network		Mandatory
TMUI-PS	Temporary user identity	1 per user	Updated when TMUI allocation protocol is executed by PS core network		Mandatory
RAI	Routing area identity	1 per user	Updated when TMUI allocation protocol is executed by PS core network		Mandatory

4.3.2 Data confidentiality (DC_UE)

The UE shall support the UMTS mechanism for confidentiality of user and signalling data described in 6.6 of 3G TS 33.102.

The UE shall store the following data elements:

a) UEA-MS: the ciphering capabilities of the UE;

b) CK: the cipher key;

c) UEA: the selected ciphering function;

In addition, when in dedicated mode:

d) COUNT-C_UP: a time varying parameter for synchronisation of ciphering for the uplink;

e) COUNT-C_DOWN: a time varying parameter for synchronisation of ciphering for the downlink;

f) BEARER: a radio bearer identifier;

g) DIRECTION: An indication of the direction of transmission uplink or downlink to ensure a different cipher is applied.

Table 6 provides an overview of the data elements stored on the UE to support the mechanism for data confidentiality:

Table 6: UE – Data Confidentiality – Data elements

Symbol	Description	Multiplicity	Lifetime	Length	Mandatory / Optional
UEA-MS	Ciphering capabilities of the UE	1 per UE	Permanent	16 bits	Mandatory
CK	Cipher key	1 per mode	Updated at execution of AKA protocol	128 bits	Mandatory
UEA	Selected ciphering capability	1 per UE	Updated at connection establishment	4 bits	Mandatory
COUNT-CUP	Time varying parameter for synchronisation of ciphering	1 per radio bearer	Lifetime of a radio bearer	32 bits	Mandatory
COUNT-CDOWN	Time varying parameter for synchronisation of ciphering	1 per radio bearer	Lifetime of a radio bearer	32 bits	Mandatory
BEARER	Radio bearer identifier	1 per radio bearer	Lifetime of a radio bearer	5 bits	Mandatory
DIRECTION	An indication of the direction of transmission uplink or downlink	1 per radio bearer	Lifetime of a radio bearer	1 bit	Mandatory

The following cryptographic functions shall be implemented on the UE:

– f8: access link encryption function (note 1).

– c4: Conversion function for interoperation with GSM from Kc (GSM) to CK (UMTS).

NOTE 1: The security architecture TS 33.102 refers to UEA , f8 is a specific implementation of UEA as defined in Cryptographic algorithm requirements TS 33.105.

Table 7 provides an overview of the cryptographic functions implemented on the UE to support the mechanism for data confidentiality.

Table 7: UE – Data Confidentiality – Cryptographic functions

Symbol	Description	Multiplicity	Lifetime	Standardised / Proprietary	Mandatory / Optional
f8	Access link encryption function	1-16	Permanent	Standardised	One at least is mandatory
c4	Conversion function for interoperation with GSM	1	Permanent	Standardised	Optional

4.3.3 Data integrity (DI_UE)

The UE shall support the UMTS mechanism for integrity of signalling data described in 6.4 of 3G TS 33.102.

The UE shall store the following data elements:

a) UIA-MS: the integrity capabilities of the UE.

In addition, when in dedicated mode:

b) UIA: the selected UMTS integrity algorithm;

c) IK: an integrity key;

d) COUNT-I_UP: a time varying parameter for synchronisation of data integrity in the uplink direction;

e) COUNT-I_DOWN: a time varying parameter for synchronisation of data integrity in the downlink direction;

f) DIRECTION An indication of the direction of transmission uplink or downlink to ensure a different cipher is applied;

g) FRESH: a network challenge;

Table 8 provides an overview of the data elements stored on the UE to support the mechanism for data confidentiality:

Table 8: UE – Data Integrity – Data elements

Symbol	Description	Multiplicity	Lifetime	Length	Mandatory / Optional
UIA-MS	Ciphering capabilities of the UE	1 per UE	Permanent	16 bits	Mandatory
UIA	Selected ciphering capability	1 per UE	Updated at connection establishment	4 bits	Mandatory
IK	Integrity key	1 per mode	Updated by the execution of the AKA protocol	128 bits	Mandatory
DIRECTION	An indication of the direction of transmission uplink or downlink	1 per radio bearer	Lifetime of a radio bearer	1 bit	Mandatory
COUNT-IUP	Synchronisation value	1	Lifetime of a connection	32 bits	Mandatory
COUNT-IDOWN	Synchronisation value	1	Lifetime of a connection	32 bits	Mandatory
FRESH	Network challenge	1	Lifetime of a connection	32 bits	Mandatory
MAC-I XMAC-I	Message authentication code	1	Updated by the execution of the AKA protocol	32 bits	Mandatory

The following cryptographic functions shall be implemented on the UE:

– f9: access link integrity function (note 1).

– c5: Conversion function for interoperation with GSM Kc (GSM) > IK (UMTS)

NOTE 1: The security architecture TS 33.102 refers to UIA, f9 is a specific implementation of UIA as defined in Cryptographic algorithm requirements TS 33.105.

Table 9 provides an overview of the cryptographic functions implemented in the UE:

Table 9: UE – Data Integrity – Cryptographic functions

Symbol	Description	Multiplicity	Lifetime	Standardised / Proprietary	Mandatory / Optional
f9	Access link data integrity function	1-16	Permanent	Standardised	One at least is mandatory
c5	Conversion function for interoperation with GSM	1	Permanent	Standardised	Optional

4.3.4 Void

4.4 Radio network controller

4.4.1 Data confidentiality (DC_rnc)

The RNC shall support the UMTS mechanism for data confidentiality of user and signalling data described in 6.6 of 3G TS 33.102.

The RNC shall store the following data elements:

a) UEA-RNC: the ciphering capabilities of the RNC;

In addition, when in dedicated mode:

b) UEA: the selected ciphering function;

c) CK: the cipher key;

d) COUNT-C_UP: a time varying parameter for synchronisation of ciphering for the uplink;

e) COUNT-C_DOWN: a time varying parameter for synchronisation of ciphering for the downlink;

f) DIRECTION: An indication of the direction of transmission uplink or downlink to ensure a different cipher is applied

g) BEARER: a radio bearer identifier.

Table 10 provides an overview of the data elements stored in the RNC to support the mechanism for data confidentiality:

Table 10: RNC – Data Confidentiality – Data elements

Symbol	Description	Multiplicity	Lifetime	Length	Mandatory / Optional
UEA-RNC	Ciphering capabilities of the RNC	1	Permanent	16 bits	Mandatory
UEA	Selected ciphering capability	1 per user and per mode	Updated at connection establishment	4 bits	Mandatory
CK	Cipher key	1 per user and per mode	Updated at connection establishment	128 bits	Mandatory
COUNT-CUP	Time varying parameter for synchronisation of ciphering	1 per radio bearer	Lifetime of a radio bearer	32 bits	Mandatory
COUNT-CDOWN	Time varying parameter for synchronisation of ciphering	1 per radio bearer	Lifetime of a radio bearer	32 bits	Mandatory
BEARER	Radio bearer identifier	1 per radio bearer	Lifetime of a radio bearer	5 bits	Mandatory
DIRECTION	An indication of the direction of transmission uplink or downlink	1 per radio bearer	Lifetime of a radio bearer	1 bit	Mandatory

The following cryptographic functions shall be implemented in the RNC:

– f8: access link encryption function.

Table 11 provides an overview of the cryptographic functions implemented in the RNC to support the mechanism for data confidentiality:

Table11: RNC – Data confidentiality – Cryptographic functions

Symbol	Description	Multiplicity	Lifetime	Standardised / Proprietary	Mandatory / Optional
f8	Access link encryption function	1-16	Permanent	Standardised	One at least is mandatory

4.4.2 Data integrity (DI_rnc)

The RNC shall support the UMTS mechanism for data integrity of signalling data described in 6.4 of 3G TS 33.102.

The RNC shall store the following data elements:

a) UIA-RNC: the integrity capabilities of the RNC;

In addition, when in dedicated mode:

b) UIA: the selected UMTS integrity algorithm;

c) IK: an integrity key;

d) COUNT-I_UP: a time varying parameter for synchronisation of data integrity in the uplink direction;

e) COUNT-I_DOWN: a time varying parameter for synchronisation of data integrity in the downlink direction;

f) DIRECTION An indication of the direction of transmission uplink or downlink to ensure a different cipher is applied;

g) FRESH: an MS challenge.

Table 12 provides an overview of the data elements stored on the RNC to support the mechanism for data confidentiality:

Table12: RNC – Data Integrity – Data elements

Symbol	Description	Multiplicity	Lifetime	Length	Mandatory / Optional
UIA-RNC	Data integrity capabilities of the RNC	1	Permanent	16 bits	Mandatory
UIA	Selected data integrity capability	1 per user	Lifetime of a connection	4 bits	Mandatory
IK	Integrity key	1 per user	Lifetime of a connection	128 bits	Mandatory
DIRECTION	An indication of the direction of transmission uplink or downlink	1 per radio bearer	Lifetime of a radio bearer	1 bit	Mandatory
COUNT-IUP	Synchronisation value	1 per radio bearer	Lifetime of a connection	32 bits	Mandatory
COUNT-IDOWN	Synchronisation value	1 per radio bearer	Lifetime of a connection	32 bits	Mandatory
FRESH	MS challenge	1 per user	Lifetime of a connection	32 bits	Mandatory
MAC-I XMAC-I	Message authentication code	1 per user	Updated by the execution of the f9 function	32 bits	Mandatory

The following cryptographic functions shall be implemented on the RNC:

– f9: access link integrity function.

Table 13 provides an overview of the cryptographic functions implemented in the RNC:

Table 13: RNC – Data Integrity – Cryptographic functions

Symbol	Description	Multiplicity	Lifetime	Standardised / Proprietary	Mandatory / Optional
f9	Access link data integrity function	1-16	Permanent	Standardised	One at least is mandatory

4.5 SN (or MSC/VLR or SGSN)

4.5.1 User identity confidentiality (UIC_SN)

The VLR (equivalently the SGSN) shall support the UMTS conventional mechanism for user identity confidentiality described in 6.1 of 3G TS 33.102.

The VLR shall store the following data elements:

– TMUI-CS: a temporary identity allocated by the CS core network;

– LAI: a location area identifier;

Table 14: VLR – User Identity Confidentiality – Data elements

Symbol	Description	Multiplicity	Lifetime	Length	Mandatory / Optional
TMUI-CS	Temporary user identity	2 per user	Updated when TMUI allocation protocol is executed by CS core network		Mandatory
LAI	Location area identity	2 per user	Updated when TMUI allocation protocol is executed by CS core network		Mandatory

Equivalently, the SGSN shall store the following data elements:

– TMUI-PS: a temporary identity allocated by the PS core network;

– RAI: a routing area identifier.

Table 15: SGSN – User Identity Confidentiality – Data elements

Symbol	Description	Multiplicity	Lifetime	Length	Mandatory / Optional
TMUI-PS	Temporary user identity	1 per user	Updated when TMUI allocation protocol is executed by PS core network		Mandatory
RAI	Routing area identity	1 per user	Updated when TMUI allocation protocol is executed by PS core network		Mandatory

4.5.2 Void

4.5.3 Authentication and key agreement ( AKA_SN)

The VLR (equivalently the SGSN) shall support the UMTS mechanism for authentication and key agreement described in 6.3 of 3G TS 33.102.

The following data elements need to be stored in the VLR (and SGSN):

a) AV: Authentication vectors;

Table 16 provides an overview of the composition of an authentication vector

Table 16: Composition of an authentication vector

Symbol	Description	Multiplicity	Length
RAND	Network challenge	1	128
XRES	Expected response	1	32-128
CK	Cipher key	1	128
IK	Integrity key	1	128
AUTN	Authentication token	1 that consists of:	128
SQN or SQN  AK	Sequence number or Concealed sequence number	1 per AUTN	48
AMF	Authentication Management Field	1 per AUTN	16
MAC-A	Message authentication code for network authentication	1 per AUTN	64

b) KSI: Key set identifier;

c) CK: Cipher key;

d) IK: Integrity key;

e) GSM AV: Authentication vectors for GSM.

Table 17 provides an overview of the data elements stored in the VLR/SGSN to support authentication and key agreement.

Table 17: VLR/SGSN – Authentication and key agreement – Data elements

Symbol	Description	Multiplicity	Lifetime	Length	Mandatory / Optional
UMTS AV	UMTS Authentication vectors	several per user, SN dependent	Depends on many things	528-640	Mandatory
KSI	Key set identifier	1 per user	Updated when AKA protocol is executed	3 bits	Mandatory
CK	Cipher key	1 per user	Updated when AKA protocol is executed	128 bits	Mandatory
IK	Integrity key	1 per user	Updated when AKA protocol is executed	128 bits	Mandatory
GSM AV	GSM Authentication vectors	As for GSM	As for GSM	As for GSM	Optional

The following cryptographic functions shall be implemented in the VLR/SGSN:

– c4: Conversion function for interoperation with GSM from Kc (GSM) to CK (UMTS);

– c5: Conversion function for interoperation with GSM from Kc (GSM) to IK (UMTS).

Table 18 provides an overview of the cryptographic functions implemented on the UE to support the mechanism for data confidentiality.

Table 18: VLR/SGSN Authentication and Key Agreement – Cryptographic functions

Symbol	Description	Multiplicity	Lifetime	Standardised / Proprietary	Mandatory / Optional
c4	Conversion function for interoperation with GSM	1	Permanent	Standardised	Optional
c5	Conversion function for interoperation with GSM	1	Permanent	Standardised	Optional

4.6 Home location register / Authentication centre

4.6.1 Authentication and key agreement (AKA_he)

The HLR/AuC shall support the UMTS mechanism for authentication and key agreement described in 6.3 of 3G TS 33.102.

The following data elements need to be stored in the HLR/AuC:

a) K: a permanent secret key;

b) SQN_HE: a counter used to generate SQN from;

c) AV: authentication vectors computed in advance;

Table 19 provides an overview of the data elements stored on the HLR/AuC to support authentication and key agreement.

Table 19: HLR/AuC – Authentication and key agreement – Data elements

Symbol	Description	Multiplicity	Lifetime	Length	Mandatory / Optional
K	Permanent secret key	1	Permanent	128 bits	Mandatory
SQNHE	Sequence number counter	1	Updated when AVs are generated	48 bits	Mandatory
UMTS AV	UMTS Authentication vectors	HE option	Updated when AVs are generated	544-640 bits	Optional
GSM AV	GSM Authentication vectors	HE option that consists of:	Updated when AVs are generated	As GSM	Optional
RAND	GSM Random challenge			128 bits	Optional
SRES	GSM Expected response			32 bits	Optional
Kc	GSM cipher key			64 bits	Optional

Table 20 shows how the construction of authentication token for synchronisation failure messages used to support authentication and key agreement.

Table 20: Composition of an authentication token for synchronisation failure messages

Symbol	Description	Multiplicity	Length
AUTS	Synchronisation Failure authentication token	that consists of:	112
SQN	Sequence number	1 per AUTS	48
MAC-S	Message authentication code for Synchronisation Failure messages	1 per AUTS	64

Figure 4 provides an overview of how authentication vectors are generated in the HLR/AuC.

Figure 4: Generation of an authentication vector

The following cryptographic functions need to be implemented in the HLR/AuC:

– f1: a message authentication function for network authentication;

– f1*: a message authentication function for support to re-synchronisation;

– f2: a message authentication function for user authentication;

– f3: a key generating function to derive the cipher key;

– f4: a key generating function to derive the integrity key;

– f5: a key generating function to derive the anonymity key for normal operation;

– f5*: a key generating function to derive the anonymity key for re-synchronisation;

– c1: Conversion function for interoperation with GSM from RAND (UMTS) > RAND (GSM);

– c2: Conversion function for interoperation with GSM from XRES (UMTS) to SRES (GSM);

– c3: Conversion function for interoperation with GSM from CK and IK (UMTS) to Kc (GSM).

Table 21 provides a summary of the cryptographic functions implemented on the USIM to support authentication and key agreement.

Table 21: HLR/AuC – Authentication and key agreement – Cryptographic functions

Symbol	Description	Multiplicity	Lifetime	Standardised / Proprietary	Mandatory / Optional
f1	Network authentication function	1	Permanent	Proprietary	Mandatory
f1*	Message authentication function for synchronisation	1	Permanent	Proprietary	Mandatory
f2	User authentication function	1	Permanent	Proprietary	Mandatory
f3	Cipher key generating function	1	Permanent	Proprietary	Mandatory
f4	Integrity key generating function	1	Permanent	Proprietary	Mandatory
f5	Anonymity key generating function (for normal operation)	1	Permanent	Proprietary	Optional
f5*	Anonymity key generating function (for re-synchronisation)	1	Permanent	Proprietary	Optional
A3/A8	GSM user authentication functions	1	Permanent	Proprietary	Optional
c1, c2 and c3	Functions for converting UMTS AV’s to GSM AV’s	1 for each	Permanent	Standard	Optional

4.7 Void