5 Security requirements

22.0483GPPSecurity mechanisms for the (U)SIM application toolkitStage 1TS

The Application Message is transferred from the Sending Application to the Receiving Application in one or more Secured Packets via a Sending Entity and a Receiving Entity, or group of Receiving Entities. The Receiving Entity is then responsible for reconstructing the Application Message from the received Secured Packets for presentation to the target Receiving Application. It is possible that there are several Receiving Entities and Applications.

The Sending Application shall indicate to the Sending Entity the security mechanisms to be applied to the Application Message. This shall be indicated in the Secured Packet. The Receiving Entity shall indicate to the Receiving Application the security mechanisms applied to the Secured Packet, in a secure manner. The interface between the Sending Application and the Sending Entity, and the interface between the Receiving Entity and Receiving Application are not defined.

The security requirements to satisfy when transferring Application Messages from the Sending Entity to the Receiving Entity that have been considered are:

– authentication;

– message integrity;

– replay detection and sequence integrity;

– proof of receipt and proof of execution;

– message confidentiality;

– indication of the security mechanisms used.

Mechanisms to satisfy the above requirements will be governed by the following assumptions:

– in general, security is provided for each Secured Packet transmitted (an Application Message may be broken into several Secured Packets, each of which shall have identical security mechanisms applied to it;

– there should be the ability to turn mechanisms on and off on a per Application Message basis, with an indication of the status transmitted with the message;

– security related information used should be independent of that used with existing 3G or GSM network keys;

– third party applications may have access to the Sending Entity, however this is considered to be an internal network security issue and therefore outside of the scope of the present document.

5.1 Authentication

5.1.1 Definition

Authentication is the verification of an entity’s claimed identity by another entity. A first level of authentication is "unilateral authentication" which provides the receiver with proof of the sender’s identity. A higher level is "mutual authentication", where both entities are provided with proof of each other’s identity.

For mutual authentication purposes the Sending and/or Receiving Entities have to generate and exchange dedicated authentication messages. Due to the unidirectional nature of current transport mechanisms mutual authentication is not considered in the present document.

5.1.2 Purpose

The purpose of authentication is to protect Sending and Receiving Entities and Applications against unauthorised use. Authentication assures that only authorised parties can perform actions at the UICC, and it prevents unauthorised parties from having access to entities on the network side (or even behind it) via a (U)SIM Application Toolkit feature.

5.1.3 Functional requirements

For the purposes of Sender Identification and unilateral authentication the Sending Entity shall be uniquely defined and addressed, as an example a GSM SIM already satisfies this requirement.

Unilateral authentication can be achieved by the use of a Cryptographic Checksum or Digital Signature attached to the message. The distinguishing identifications of the Receiving and Sending Entities should be linked to them for the entire life time of these entities. (If for some reason, the identity of any of the entities is changed, then all other entities involved in the authentication procedure shall be informed of the new identity.)

5.2 Message integrity

5.2.1 Definition

Message Integrity ensures that no corruption, accidental or intentional, of the content of the message has occurred.

5.2.2 Purpose

The purpose of this mechanism is to detect any corruption of the Application Message or the whole Secured Packet.

5.2.3 Functional requirements

The integrity of the Application Message or whole Secured Packet may be achieved as follows:

– by adding a Redundancy Check in the Security Header to protect against accidental corruption (The Redundancy Check mechanism on it’s own only protects against accidental corruption. In conjunction with encryption it can be used to provide message integrity);

– by adding a Cryptographic Checksum in the Security Header. In certain circumstances the authentication of the Sending Entity is achieved implicitly by the verification of the Cryptographic Checksum;

– by calculating and verifying a Digital Signature on the Application Message to be transferred. In this case the authentication of the Sending Entity is achieved implicitly by the verification of the Digital Signature.

5.3 Replay detection and sequence integrity

5.3.1 Definition

Replay detection is a mechanism which provides the Receiving Entity with a means of recognising that it has received the same Secured Packet(s) previously.

Sequence integrity is a mechanism which ensures that no changes, accidental or intentional, have occurred to the intended sequence of Secured Packets.

5.3.2 Purpose

Replay detection protects the Receiving Entity against replay attack and Secured Packet duplication.

Sequence integrity protects the Receiving Entity against message suppression and loss of Secured Packets.

5.3.3 Functional requirements

The implementation of these mechanisms shall be achieved by including a counter in the Security Header. The protection of the counter shall be achieved by including it in the calculation of the checksum (Cryptographic Checksum or encrypted Redundancy Check) or Digital Signature when used.

The Sending Entity and the Receiving Entity shall maintain synchronisation for their counters.

5.4 Proof of receipt and proof of execution

5.4.1 Definition

Proof of receipt proves to the Sending Entity that the Receiving Entity has correctly received a Secured Packet, has performed the necessary security checks and forwarded the contents to the Receiving Application.

Proof of execution proves to the Sending Application that the Receiving Application has performed an action that the Sending Application initiated. Proof of execution is not applicable at the Transport Layer.

5.4.2 Purpose

The purpose of proof of receipt is to prove delivery of a Secured Packet to the Receiving Entity in an unambiguous way. This allows detection of non-delivery due to network error, message corruption, validation failure etc. to be indicated to the Sending Entity using a Status Code in the proof of receipt response.

5.4.3 Functional requirements

Proof of receipt must be requested by the Sending Entity. Proof of receipt is returned from the Receiving Entity in an acknowledgement to a Secured Packet transmitted by the Sending Entity. The acknowledgement shall take the form of a Status Code in a response message, which may be secured by either a Cryptographic Checksum or Digital Signature.

The Sending Entity shall send an indication of proof of receipt to the Sending Application upon successful delivery of the Application Message, or indicate the reason for failure upon unsuccessful delivery of the Application Message. The behaviour at the Receiving Entity is elaborated in the stage 2 document [2].

The Sending and Receiving Entity shall be uniquely defined and addressed.

In the case of SMS transport, proof of receipt could be carried in the short message acknowledgement as defined in TS 31.111 [3] (SMS data download mechanism).

The case of other transport mechanisms is for further study.

5.5 Message confidentiality

5.5.1 Definition

Message confidentiality ensures that the messages exchanged are not made available or disclosed to unauthorised individuals, entities, or processes.

5.5.2 Purpose

This security function prevents any external party from extracting any useable information from Secured Packets.

5.5.3 Functional requirements

Message confidentiality is achieved by encrypting the message. In order for the recipient to use the content of the message it has to be decrypted.

Some of the security parameters that make up the Security Header (Digital Signatures, Counters and other security parameters) may be encrypted.

NOTE: There may be legal constraints for the implementation of message confidentiality mechanisms entirely resident on the UICC, see ETSI Technical Report (ETR) 330 [4]

5.6 Security management

The security mechanism applied to the Secured Packet shall be indicated in the Security Header, and this indication may be integrity protected to prevent it from malicious alteration.

Security parameters (e.g. counters, keys) at the Receiving and Sending Entity shall be stored in a secure manner such that no unauthorised parties or applications can read, modify or use these parameters.

Procedures for key management (e. g. key update) should be foreseen for transport level.