1、H 3404583 0077963 735 Released: July 1, 1993 GSM 02.09 Version: 4.2.1 Date: 7 June, 1993 Work Item No: Key words: European digital cellular telecommunication system (phase 2); SECURITY ASPECTS ETS I European Telecommunications Standards Institute ETSI Secretarlat: Route des Lucioles, F-O6921 Sophia
2、Antipolis Cedex . France Tp. + 33 92 94 42 O0 TF. + 33 93 65 47 16 Tx. 47 00 40 F This is an unpublished work the copyright in which vests in the European Telecommunications Standards Institute. All rights reserved. The information contained herein is the property of ETSI and no part may be reproduc
3、ed or used except as authorised by contract or other written permission. The copyright and the foregoing restriction on reproduction and use extend to all media in which the information may be embodied. 3404583 0077964 671 W Page 3 GSM 02.09 . verilon 4.2.1 : June 1993 CONTENTS 1 . SCOPE . 5 2 . GEN
4、ERAL . 5 3.3. 3.4. 3.5. 3 . SECURITY FEATURES PROVIDED IN A GSM PLMN 5 3.1. Subscriber Identity Confidentiality . 6 3.1.1. Definition . 6 3.1.2. Purpose . 6 3.1.3. Functional requirements . 6 Subscriber Identity Authentication . 6 3.2.1. Definition . 6 3.2.2. Purpose . 6 3.2.3. Functional requiremen
5、ts . 6 3.2.4. Authentication during a malfunction of the network . 7 User Data Confidentiality On Physical Connections (Voice and Non-voice) . 7 3.3.1. Definition . 7 3.3.2. Purpose . 7 3.3.3. Functional requirements . 7 Connectionless User Data Confidentiality 8 3.4.1. Definition . 8 3.4.2. Purpose
6、 . 8 3.4.3. Functional requirements . 8 Signalling Information Element Confidentiality . 8 3.5.1. Definition . 8 3.5.2. Purpose . 8 3.5.3. Functional requirements . 8 3.2. Previous page is blank 3404583 0077b5 508 Page 5 GSM 02.09 - version 4.2.1 : June 1993 1. SCOPE Bearer and Teleservices, as resp
7、ectively defined in GSM TS 02.02 and 02.03, are the objects which the GSM PLMN operators offer to their customers. Besides these basic telecommunications services, features which aim at up-grading these basic cervices need also to be offered. Due to the use of radiocommunications in a PLMN, which ar
8、e of a special nature compared to classical distribution transmission techniques used in the fixed networks, such a category of features is related to security aspects. In a GSM PLMN, both the users and the network operator have to be protected against undesirable intrusion of third parties. However
9、, measures should be provided for in order to insure maximum protection of the rights of the individuals concerns. As a consequence, a security feature is either a supplementary service to Tele or Bearer services, which can be selected by the subscriber, or a network function involved in the provisi
10、on of one or several telecommunication services. The purpose of this Specification is to define the security features which are to be available in a GSM PLMN, together with the associated levels of protection. This Specification is only concerned with those security features which aim at the up-grad
11、ing of the security in a GSM PLMN. In particular, end-to-end security is outside the scope of this Specification. The implementation aspects of security features are described in GSM TS 03.20. 2. GENERAL The use of radiocommunications for transmission to the mobile subscribers makes PLMNs particular
12、y sensitive to: - misuse of their resources by unauthorized persons using manipulated Mobile Stations, who try to impersonate authorized Subscribers; and - eavesdropping of the various informations which are exchanged on the radiopath. It can be seen that PLMNs intrinsically do not provide the same
13、level of protection to their operators and subscribers as the traditional telecommunication networks provide. This fact leads to the need to implement security features in a GSM PLMN in order to protect: i) the access to the mobile services; ii) any relevant item from being disclosed at the radiopat
14、h, mainly in order to ensure the privacy of user- related information. Two levels of protection are therefore assumed : - where security features are provided, as defined in Section 3, the level of protection at the radiopath of the corresponding items is as good as the level of protection provided
15、in the f xed networks: - where no special provision is made , the level of protection at the radiopath is null. All items which are not dealt with in Section 3 are therefore considered to need no protection. 3. SECURITY FEATURES PROVIDED IN A GSM PLMN The following security features are considered :
16、 - subscriber identity (IMSI) confidentiality; - subscriber identity (IMSI) authentication; - user data confidentiality on physical connections; Previous page is blank 3Y04583 007bb 444 Page 6 GSM 02.09 - version 4.2.1 : June 1993 I - connectionless user data confidentiality; - signalling informatio
17、n element confidentiality. The implementation of these five security features is mandatory on both the fixed infrastructure side and the MS side. This means that all GSM PLMNs and all MSs shall be able to support every security feature. Use of these five security features is at the discretion of the
18、 operator for its own subscribers while on the HPLMN. For roaming subscribers, use of these five security features is mandatory unless otherwise agreed by all the affected PLMN operators. (See also 3.3.3). 3.1. Subscriber identity Confldentiallty 3.1.1. Definition The subscriber identity confidentia
19、lity feature is the property that the IMSI is not made available or disclosed to unauthorized individuals, entities or processes. 3.1.2. Purpose This feature provides for the privacy of the identities of the subscribers who are using GSM PLMN resources (e.g. a traffic channel or any signalling means
20、). It allows for the improvement of all other security features (e.g. user data confidentiality) and provides for the protection against tracing the location of a mobile subscriber by listening to the signalling exchanges on the radio path. 3.1.3. Functional requirements This feature necessitates th
21、e confidentiality of the subscriber identity (IMSI) when it is transferred in signalling messages (see Section 3.5) together with specific measures to preclude the possibility to derive it indirectly from listening to specific informations, such as addresses, at the radiopath. The means used to iden
22、tify a mobile subscriber on the radiopath consists of a local number called TMSI (Temporary Mobile Subscriber identity), described in GSM TS 03.20. When used, the subscriber identity confidentiality feature shall apply for all signalling sequences on the radiopath. 1 However, in the case of location
23、 register failure, or in case the MS has no TMSI available, open identification is allowed on the radiopath. 3.2. Subscriber Identity Authentication 3.2.1. Definition Subscriber identity (IMSI) authentication is the corroboration by the land-based part of the system that the subscriber identity (IMS
24、I or TMSI), transferred by the mobile subscriber within the identification procedure at the radiopath,is the one claimed. 3.2.2. Purpose The purpose of this authentication security feature is to protect the network against unauthorized use. It enables also the protection of the GSM PLMN subscribers
25、by denying the possibility for intruders to impersonate authorized users. 3.2.3. Functional requirements The authentication of the GSM PLMN subscriber identity may be triggered by the network when the subscriber applies for: - a change of subscriber-related information element in the VLR or HLR (inc
26、luding some or all of: location up-dating involving change of VLR. registration or erasure of a 3404583 0077967 380 Page 7 GSM 02.09 - verslon 4.2.1 : June 1993 supplementary service), or - an access to a service (including some or all of: Set-up of mobile originating or terminated calls, activation
27、 or deactivation of a supplementary service), or - first network access after restart of MSCNLR, or in the event of cipher key sequence number mismatch. Physical security means must be provided to preclude the possibility to obtain sufficient information to impersonate or duplicate a subscriber in a
28、 GSM PLMN, in particular by deriving sensitive information from the mobile station equipment. If, on an access request to the GSM PLMN, the subscriber identity authentication procedure fails and this failure is not due to network malfunction, then the access to the GSM PLMN shall be denied to the re
29、questing party. 3.2.4. Authentlcatlon durlng a malfunction of the network If an MS is registered and has been succesfully authenticated, whether active or not active on a call, calls are permitted (including continuation and handover). If an MS has already been registered (and therefore been already
30、 authenticated) and can not be successfully reauthenticated due to the network malfunction (e.g. the HPLMN was not able to provide authentication pairs RAND, SRES), calls are permitted. If an MS attempts to register and can not be successfully authenticated due to the network malfunction, calls are
31、not permitted. If the MS is not registered, or ceases to be registered, a new registration need to be performed, and the preceding cases apply. 3.3. User Data Confidentiality On Physical Connections (Voice and Non-voice) 3.3.1. Definltlon The user data confidentiality feature on physical connections
32、 is the property that the user information exchanged on traffic channels is not made available or disclosed to unauthorized individuals, entities or processes. 3.3.2. Purpose The purpose of this feature is to ensure the privacy of the user information on traffic channels. 3.3.3. Functionat requireme
33、nts Encryption will normally be applied to all voice and non-voice communications. Although a standard algorithm will normally be employed, it is permissible for the mobile station and/or PLMN infrastructure to support more than one algorithm. In this case, the infrastructure is responsible for deci
34、ding which algorithm to use (including the possibility not to use encryption, in which case confidentiality is not applied). When necessary, the MS shall signal to the network indicating which of up to seven encryption, plus one transparent. algorithms it supports. (Note: The effect of the “transpar
35、ent algorithm“ being selected is the same as not being encrypted.) The serving network then selects one of these that it can support (based on an order of priority preset in the network), and signals this to the MS. The selected algorithm is then used by the MS and network. m 3404583 0077b8 217 m I
36、* Page 8 GSM 02.09 - version 4.2.1 : June 1993 3.4. Connectionless User Data Confidentlality 3.4.1. Definition The connectionless user data confidentiality feature is the property that the user information which is transferred in a connectionless packet mode over a signalling channel is not made ava
37、ilable or disclosed to unauthorized individuals, entities or processes. 3.4.2. Purpose The purpose of this feature is to ensure the privacy of the user information on signalling channels (e.g. short messages). 3.4.3. Functlonal requirements Note1 : Protection of connectionless user data is not appli
38、cable to SMS Cell Broadcast. 3.5. Slgnalllng Information Element Confidentiality 3.5.1. Deflnltion The signalling information element confidentiality feature is the property that a given piece of signalling information which is exchanged between mobile stations and base stations is not made availabl
39、e or disclosed to unauthorized individuals, entities or processes. 3.5.2. Purpose The purpose of this feature is to ensure the privacy of users related signalling elements. 3.5.3. Functional requirements When used, this feature applies on selected fields of signalling messages which are exchanged be
40、tween mobile stations an? tase stations. The signalling information eements included in the message used to establish the connection (protocol discriminator, connection reference, message type and mobile station identity (IMSI, TMSI or IMEI according to the circumstance) are not protected. The follo
41、wing signalling information elements related to the user are protected whenver used after connection establishment: - - - - International Mobile Equipment Identity (IMEI) International Mobile Subscriber Identity (IMSI); Calling subscriber directory number (mobile terminating calls) ; Called subscriber directory number (mobile originated calls). 1 The IMEI requires physical protection against being removed, replaced or its contents being changed by unauthoriced individuals. The IMSI is stored securely within the SIM.
