Tech-invite  3GPPspace  IETFspace
◀  ▶  21  22  23  24  25  26  27  28  29  31  32  33  34  35  36  37  38  4‑5x
back to TS 33.102

Table of Contents for  TS 33.102  Word version:  19.1.0

1Scope  p. 8
2References  p. 8
3Definitions, symbols abbreviations and conventions  p. 10
3.1Definitions  p. 10
3.2Symbols  p. 11
3.3Abbreviations  p. 11
3.4Conventions  p. 12
4Overview of the security architecture  p. 13
5Security features  p. 14
5.1Network access security  p. 14
5.1.1User identity confidentiality  p. 14
5.1.2Entity authentication  p. 15
5.1.3Confidentiality  p. 15
5.1.4Data integrity  p. 15
5.1.5Mobile equipment identification  p. 16
5.2Network domain security  p. 16
5.2.1Void  p. …
5.2.2Void  p. …
5.2.3Void  p. …
5.2.4Fraud information gathering system  p. 16
5.3User domain security  p. 16
5.3.1User-to-USIM authentication  p. 16
5.3.2USIM-Terminal Link  p. 16
5.4Application security  p. 17
5.4.1Secure messaging between the USIM and the network  p. 17
5.4.2Void  p. …
5.4.3Void  p. …
5.4.4Void  p. …
5.5Security visibility and configurability  p. 17
5.5.1Visibility  p. 17
5.5.2Configurability  p. 17
6Network access security mechanisms  p. 18
6.1Identification by temporary identities  p. 18
6.1.1General  p. 18
6.1.2TMSI reallocation procedure  p. 18
6.1.3Unacknowledged allocation of a temporary identity  p. 18
6.1.4Location update  p. 19
6.2Identification by a permanent identity  p. 19
6.3Authentication and key agreement  p. 19
6.3.1General  p. 19
6.3.2Distribution of authentication data from HE to SN  p. 21
6.3.3Authentication and key agreement  p. 23
6.3.4Distribution of IMSI and temporary authentication data within one serving network domain  p. 26
6.3.5Re-synchronisation procedure  p. 27
6.3.6Reporting authentication failures from the SGSN/VLR to the HLR  p. 28
6.3.6.1Authentication re-attempt |R6|  p. 28
6.3.7Length of authentication parameters  p. 29
6.4Local authentication and connection establishment  p. 29
6.4.1Cipher key and integrity key setting  p. 29
6.4.2Ciphering and integrity mode negotiation  p. 29
6.4.3Cipher key and integrity key lifetime  p. 30
6.4.4Cipher key and integrity key identification  p. 30
6.4.5Security mode set-up procedure  p. 31
6.4.6Signalling procedures in the case of an unsuccessful integrity check  p. 34
6.4.7Signalling procedure for periodic local authentication  p. 34
6.4.8Initialisation of synchronisation for ciphering and integrity protection  p. 34
6.4.9Emergency call handling  p. 35
6.4.9.1Security procedures applied  p. 35
6.4.9.2Security procedures not applied  p. 35
6.5Access link data integrity  p. 36
6.5.1General  p. 36
6.5.2Layer of integrity protection  p. 36
6.5.3Data integrity protection method  p. 36
6.5.4Input parameters to the integrity algorithm  p. 37
6.5.4.1COUNT-I  p. 37
6.5.4.2IK  p. 37
6.5.4.3FRESH  p. 37
6.5.4.4DIRECTION  p. 38
6.5.4.5MESSAGE  p. 38
6.5.5Integrity key selection  p. 38
6.5.6 UIA identification  p. 38
6.6Access link data confidentiality  p. 39
6.6.1General  p. 39
6.6.2Layer of ciphering  p. 39
6.6.3Ciphering method  p. 39
6.6.4Input parameters to the cipher algorithm  p. 40
6.6.4.1COUNT-C  p. 40
6.6.4.2CK  p. 40
6.6.4.3BEARER  p. 41
6.6.4.4DIRECTION  p. 41
6.6.4.5LENGTH  p. 41
6.6.5Cipher key selection  p. 41
6.6.6UEA identification  p. 42
6.7Void  p. …
6.8Interoperation and handover between UMTS and GSM  p. 42
6.8.1Authentication and key agreement of UMTS subscribers  p. 42
6.8.1.1General  p. 42
6.8.1.2R99+ HLR/AuC  p. 43
6.8.1.3R99+ VLR/SGSN  p. 44
6.8.1.4R99+ ME  p. 45
6.8.1.5USIM  p. 45
6.8.2Authentication and key agreement for GSM subscribers  p. 46
6.8.2.1General  p. 46
6.8.2.2R99+ HLR/AuC  p. 47
6.8.2.3VLR/SGSN  p. 47
6.8.2.4R99+ ME  p. 48
6.8.3Distribution and use of authentication data between VLRs/SGSNs  p. 48
6.8.4Intersystem handover for CS Services - from UTRAN to GSM BSS  p. 49
6.8.4.1UMTS security context  p. 49
6.8.4.2GSM security context  p. 50
6.8.5Intersystem handover for CS Services - from GSM BSS to UTRAN  p. 50
6.8.5.1UMTS security context  p. 50
6.8.5.2GSM security context  p. 51
6.8.6Intersystem change for PS Services - from UTRAN to GSM BSS  p. 51
6.8.6.1UMTS security context  p. 51
6.8.6.2GSM security context  p. 52
6.8.7Intersystem change for PS services - from GSM BSS to UTRAN  p. 52
6.8.7.1UMTS security context  p. 52
6.8.7.2GSM security context  p. 52
6.8.8PS handover from Iu to Gb mode |R6|  p. 53
6.8.8.1UMTS security context |R7|  p. 53
6.8.8.2GSM security context  p. 53
6.8.9PS handover from Gb to Iu mode |R6|  p. 54
6.8.9.1UMTS security context  p. 54
6.8.9.2GSM security context  p. 54
6.8.10SRVCC - between HSPA and UTRAN/GERAN |R8|  p. 54
6.8.10.1SRVCC from HSPA to circuit switched UTRAN/GERAN |R11|  p. 54
6.8.10.2SRVCC from circuit switched GERAN to HSPA |R11|  p. 56
6.8.11Handling of the START value in intersystem mobility cases |R11|  p. 58
7Void  p. …
8Application security mechanisms  p. 59
8.1Void  p. …
8.2Void  p. …
8.3Mobile IP security  p. 59
AVoid  p. …
B(Normative)  Key derivation function |R8|  p. 61
B.1General  p. 61
B.2FC value allocations |R9|  p. 61
B.3Derivation of CK'CS|| IK'CS from CKPS||IKPS  p. 61
B.4Derivation of Kc' from Kc for HSPA to UTRAN/GERAN SRVCC handover  p. 61
B.5Derivation of Kc128 |R9|  p. 61
B.6Derivation of CK'PS || IK'PS from CKCS || IKCS |R11|  p. 62
B.7Derivation of Kc' from Kc for UTRAN/GERAN to HSPA SRVCC handover |R11|  p. 62
CManagement of sequence numbers  p. 63
C.1Generation of sequence numbers in the Authentication Centre  p. 63
C.1.1Sequence number generation schemes  p. 63
C.1.1.1General scheme  p. 63
C.1.1.2Generation of sequence numbers which are not time-based  p. 64
C.1.1.3Time-based sequence number generation  p. 64
C.1.2Support for the array mechanism  p. 64
C.2Handling of sequence numbers in the USIM  p. 64
C.2.1Protection against wrap around of counter in the USIM  p. 65
C.2.2Verification of sequence number freshness in the USIM  p. 65
C.2.3Notes  p. 65
C.3Sequence number management profiles  p. 66
C.3.1Profile 1: management of sequence numbers which are partly time-based  p. 66
C.3.2Profile 2: management of sequence numbers which are not time-based  p. 67
C.3.3Profile 3: management of sequence numbers which are entirely time-based  p. 67
C.3.4Guidelines for the allocation of the index values in the array scheme  p. 68
C.4Guidelines for interoperability in a multi-vendor environment  p. 68
DVoid  p. …
EVoid  p. …
FExample uses of the proprietary part of the AMF  p. 71
F.1Support multiple authentication algorithms and keys  p. 71
F.2Changing sequence number verification parameters  p. 71
F.3Setting threshold values to restrict the lifetime of cipher and integrity keys  p. 71
G(Normative)  Support of algorithm change features |R7|  p. 72
H(Normative)  Usage of the AMF |R8|  p. 73
I(Normative)  Security requirements for RNCs in exposed locations |R11|  p. 73
I.1General  p. 73
I.2Requirements for RNCs in exposed locations  p. 73
I.2.1Requirements for setup and configuration  p. 73
I.2.2Requirements for key management inside RNCs in exposed locations  p. 74
I.2.3Requirements for handling user plane data  p. 74
I.2.4Requirements for handling control plane data  p. 74
I.2.5Requirements for secure environment  p. 74
I.3Security mechanisms for interfaces with RNCs in exposed locations  p. 75
JModified AKA to avoid keystream re-use during re-synchronisations |R17|  p. 76
J.1f5** function  p. 76
$Change history  p. 77