Source:	T-Mobil, Deutsche Telekom T-Nova
Subject:	Report from N2B in Eton on MAP security and EUIC progress 
Purpose:	For Information

Background
From 19-21st of October a meeting of the ad-hoc signaling group of 3GPP TSG-CN WG2 (CAMEL, MAP) was held in Eton, UK. There was also a session on security issues scheduled for this meeting. Roland Schmitz of Deutsche Telekom T-Nova attended this session in order to give a presentation on MAP security and also to present the proposed CR on "Enhanced User Identity Confidentiality (EUIC, cf. Tdoc S3-99361). The goal was to promote the conversion of the MAP security mechanism introduced in 33.102 into MAP specifications and to clarify the concept of EUIC to N2.

Results of the Meeting (Security Session)

MAP Security 
Roland Schmitz presented the MAP security mechanism, including the latest changes agreed at SA3#6, together with the LS from S3 to N2 (cf. Tdoc S3-99347), also agreed at SA3#6. During the presentation some misconceptions could be removed, e.g. there was some belief that a separate key is assigned to each single network node, which would make signaling virtually impossible. The discussion afterwards focussed on the question of interoperability with 2G networks, that might not have implemented the scheme. Even if all messages to those networks are sent in protection mode 0 (no protection), the question was raised how such networks could interpret the security header included in the modified MAP messages. 
Another concern was the increased length of the modified MAP messages. Although some MAP messages that exceed the maximum length of a MAP message can be split, this is not the case for all MAP messages. In connection with this point, it was asked how long the security header could be in the worst case.
Finally Ian Park, chairman of N2, doubted the feasibility of the MAP security feature for R'99. A LS from N2 to S3 will be produced stating the concerns of N2 described above. However, there were also supporting views in the N2 group, stating that MAP security is a valuable feature and should be possible to implement in reasonable time. There were some links established between the author and the signaling experts of N2 and it is hoped that these links will lead to an increased collaboration in the future.

EUIC
The proposed CR on EUIC was presented, with special focus on the Annex explaining the mechanism for routing an encrypted IMSI to the correct HLR by including an HLR-id in plaintext. Thereby most concerns of N2 in connection with EUIC could be removed. There was also a CR presented by Siemens ( cf. ftp://ftp.3gpp.org/TSG_CN/ WG2_camel/ TSGN2_10/Docs/N2-99E92.zip) dealing with authentication enhancements of MAP messages that already takes encrypted IMSIs into account. The author gained the impression that the EUIC feature is well under way in N2.

Conclusion
Since it was possible to answer many questions of the signaling group personally, e.g with respect to EUIC and secure handover between 2G and 3G and the ability to present the views of the security group, attendance of a SA3 representative at N2 was useful for both sides, since it could speed up conversion of security requirements into signaling specifications.