TSG-SA WG3 (Security) meeting #6	S3-99309
Sophia Antipolis, 29th September – 1st October 1999	

Agenda Item:	

Source:	Ericsson		

Title:	Intended R2 contriution. Inclusion of message parameters for Integrity 
	Protection

Document for:	For discussion and endorsement.

TSG-RAN Working Group 2 (Radio layer 2 and Radio layer 3) 	TSGR2#7(99)C23
Malmö, September 20th to 24th 1999	

Agenda Item:	17.6			

Source: 	Ericsson	

Title: 	Inclusion of message parameters for Integrity Protection

Document for:	Discussion and decision

___________________________________________________________________________

1	Introduction
The integrity protection has been agreed to be an RRC function. This contribution proposes necessary information elements for the integrity protection mechanism. 
2	Discussion
2.1	Integrity protection algorithm
The integrity protection algorithm (UMTS Integrity Algorithm, UIA) calculates a MAC-I (Message Authentication Code for data Integrity) based on the input parameters Integrity Key (IK), COUNT, FRESH and the message itself according to MAC-I = f9(IK,COUNT,FRESH,MESSAGE).
2.2	Start of integrity protection, an overview

It is proposed that the most significant bits of COUNT, here named LIPC (Local Integrity Protection Counter) are transferred from the UE to UTRAN during the RRC Connection Establishment procedure. That way integrity protection for downlink messages can be started immediately when the SECURITY MODE COMMAND is sent to the UE.
UTRAN generates FRESH and the least significant bits of COUNT, here named RRC Sequence Numbers (RRC SN), and then calculates the MACI-I. 
When the UE receives the SECURITY MODE CONTROL COMMAND message, it uses the algorithm as indicated by the UIA parameter to calculate MAC-I using the received RRC SN and FRESH. The integrity protection for the downlink starts if the calculated MAC-I equals the received MAC-I.
The UE selects RRC SN for the uplink, and it uses the algorithm as indicated by the UIA parameter to calculate MAC-I. MAC-I and RRC SN are included in the SECURITY MODE CONTROL COMPLETE message.
When UTRAN receives SECURITY MODE CONTROL COMPLETE message, it calculates MAC-I using the received RRC SN. The integrity protection for the uplink starts if the calculated MAC-I equals the received MAC-I.
2.3	Integrity protection parameters
The IK is generated in the UE and in the network during the authentication procedure and is stored in the USIM until it is updated in the next authentication.
The FRESH parameter is generated by the UTRAN and shall be transmitted to the UE in the Security Mode Control procedure. FRESH has the length 32 bits (see [3])
Here it is proposed that the COUNT parameter (32 bits) is divided into two parts, a long counter and a short counter. It is suggested that the long counter is called Local Integrity Protection Counter (LIPC) and the short counter is called RRC Sequence Number (RRC SN). The LIPC shall be stepped for every cycle of RRC SN. The RRC SN shall be stepped for each message and shall be appended to every message in order to keep synchronisation if a message is lost. There is one LIPC for uplink signalling and another for downlink signalling. The initial values of the LIPCs shall be set in the UE in the RRC connection establishment procedure. The UE shall store the last used values and increment them by one at each new RRC connection in order not to reuse the LIPC. The initial values of the RRC SNs shall be set in the Security Mode Control procedure. The number of bits for RRC SN is FFS. It is proposed to add LIPC in the message RRC CONNECTION SETUP COMPLETE. The RRC CONNECTION REQUEST message is not used for this purpose since it shall be kept short.
The calculated value MAC-I shall be appended to all messages that needs integrity protection. When a message is received and integrity protection has been started, the receiving side calculates MAC-I using the received RRC SN. If the calculated MAC-I equals the received MAC-I, the message is considered to be the correct message, otherwise the message shall be ignored. MAC-I has the length 24 bits (see [3]).
Before integrity protection has started, MAC-I and RRC SN can be set to any value and shall be discarded at reception. 
The algorithm to use (UIA Number) shall be transmitted to the UE in the Security Mode Control procedure. UIA Number is specified in [2]
The UE classmark may be sent in the Security Mode Control Procedure so that the UE can verify that the correct unprotected classmark information in the initial L3 information reached the network. But this is FFS.
2.4	Messages subject to integrity protection
The purpose of integrity protection is to prevent fraud base station from modifying data and sending commands to UEs and real base stations. 
In [2], it is stated that the following must be protected:
UL:
•	MS capabilities ( Direct Transfer, UE Capability Information)
•	Security mode accept/reject message (Security Control Response)
•	Called party number in a UE originating call (Direct Transfer)
•	Periodic message authentication messages 
•	Various location updates (for example: cell update, URA)
DL:
•	The security mode command  (security Control Command)
•	Periodic message authentication messages
Furthermore location updates includes handover procedures and reconfiguration procedures should also be protected since these can be used to hijack connections as well. This means that a majority of messages must be integrity protected and we propose to use integrity for those messages where it is possible.
Hence all messages except the following shall be integrity protected:
•	Notification
•	Paging Type1 
•	RRC Connection Request/RRC Connection Setup/RRC Connection Setup Complete/RRC Connection Reject
•	System Information
3	Proposed changes in TS 25.331 [1]
It is proposed that:
•	The information elements “Local integrity protection counter”, “Integrity protection activation info”, “Integrity check info” are included as described below.
•	The messages RRC CONNECTION SETUP COMPLETE, SECURITY MODE CONTROL COMMAND and SECURITY MODE CONTROL COMPLETE are updated with new information elements as described below.
•	The information element “Integrity check info” is included in all RRC messages (similar as done for SECURITY MODE CONTROL COMPLETE below), except for 
•	NOTIFICATION, 
•	PAGING TYPE 1, 
•	RRC CONNECTION REQUEST, 
•	RRC CONNECTION SETUP, 
•	RRC CONNECTION REJECT, 
•	RRC CONNECTION SETUP COMPLETE and 
•	all SYSTEM INFORMATION messages.
10.1.4.8 RRC CONNECTION SETUP COMPLETE

This message confirms the establishment of the RRC Connection by the UE.
RLC-SAP: t.b.d. 
Logical channel: DCCH
Direction: UE  UTRAN 
Information Element	Presence	Range	IE type and reference	Semantics description	
Message Type	M				
UE information elements					
Local integrity protection counter	M				
Phy CH information elements					
SSDT indicator	O			FFS	

					

					

10.1.7.4 SECURITY MODE CONTROL COMMAND
RLC-SAP: t.b.d. 
Logical channel: DCCH
Direction: UTRAN to UE

Information Element	Presence	Range	IE type and reference	Semantics description	
Message Type	M				
UE information elements					
Integrity check info	M				
CN Information elements					
CN domain identity	M			Indicates which cipher and integrity keys  are 
Applicable	
RB Information elements					
Radio bearer identity		0 to <maxReconRBs>		Radio bearer identity 0 indicates the signalling link and is always present. Only present if ciphering shall be controlled.	
UE information elements					
Integrity protection activation info	O			Only present when integrity protection shall be controlled.	
Activation Time	O			Start of the new ciphering configuration in uplink for all the radio bearers. Only present if ciphering shall be started.	

Range Bound	Explanation	
MaxReconRBs	For each radio bearer that is reconfigured	

10.1.7.5 SECURITY MODE CONTROL COMPLETE 
RLC-SAP: t.b.d. 
Logical channel: DCCH
Direction: UE to UTRAN

Information Element	Presence	Range	IE type and reference	Semantics description	
Message Type	M				
UE information elements					
Integrity check info	M				
RB Information elements					
Radio bearer identity		0 to <maxReconRBs>		Radio bearer identity 0 indicates the signalling link and is always present.
Only present if ciphering shall be started.	
Activation Time	O			Start of the new ciphering configuration in uplink for all the radio bearers. Only present if ciphering shall be started.	

Range Bound	Explanation	
MaxReconRBs	For each radio bearer that is reconfigured	

10.2.3 UE Information elements 
10.2.3.x Local integrity protection counter
The local integrity protection counter (LIPC) is concatenated with the sequence number in the IE Integrity check info to form the parameter COUNT in the integrity protection algorithm. LIPC is the most significant bits of COUNT.
Information Element/Group name	Presence	Range	IE type and reference	Semantics description	
Uplink LIPC	M		Integer (range FFS)		
Downlink LIPC	M		Integer (range FFS)	 	

10.2.3.x Integrity check info
The Integrity check info is used as input to the integrity protection algorithm for uplink and downlink messages. 

Information Element/Group name	Presence	Range	IE type and reference	Semantics description	
Message authentication code	M		Integer (0..224-1)	Corresponds to the parameter MAC-I in the integrity protection algorithm.	
Message sequence number	M		Integer
(range FFS)	The message sequence number is concatenated with the Local integrity protection counter to form the parameter COUNT in the integrity protection algorithm.	

10.2.3.x Integrity protection activation info
This information element contains input to the activation of the integrity protection.

Information Element/Group name	Presence	Range	IE type and reference	Semantics description	
Integrity protection algorithm 	O		TS 33.102, UIA Numbering	Which algorithm to use for integrity protection	
Initialisation number	O		Integer (0..232–1)	Corresponds to the parameter FRESH in TS 33.102	

4	References
[1]	25.331 RRC Protocol Specification, V1.1.0. 
[2]	3G TS 33.102, Security Architecture, V3.1.0 
[3]	3G TS 33.105, Cryptographic Algorithm Requirements, V3.0.0