3GPP TSG-S3	Document	S3-99383	
The Hague, Netherlands
26 - 27 October 1999			

3G CHANGE REQUEST	Please see embedded help file at the bottom of this
page for instructions on how to fill in this form correctly.	
	
	33.103	CR	002	Current Version:	3.0.0		
					
3G specification number 		 CR number as allocated by 3G support team	
	
For submision to TSG		for approval	X	(only one box should	
list TSG meeting no. here 	for information		be marked with an X)	
	
Form: 3G CR cover sheet, version 1.0        The latest version of this form is available from: ftp://ftp.3gpp.org/Information/3GCRF-xx.rtf	
	
Proposed change affects:	USIM	X	ME	X	UTRAN	X	Core Network	X	
(at least one should be marked with an X)	
	
Source:	DERA	Date: 	21/10/99	
	
Subject:	Corrections to Figure 1 (UMTS functional security architecture)	
	
3G Work item:		
	
Category: 	F	Correction					
	A	Corresponds to a correction in a 2G specification					
(only one category 	B	Addition of feature					
shall be marked	C	Functional modification of feature					
with an X)	D	Editorial modification	X				
	
Reason for 
change:
	To correct DIUE and clarify VLR as distinct from SN.	
	
Clauses affected:		
	
Other specs	Other 3G core specifications		  List of CRs:		
Affected:	Other 2G core specifications		  List of CRs:		
	MS test specifications		  List of CRs:		
	BSS test specifications		  List of CRs:		
	O&M specifications		  List of CRs:		
	
Other 
comments:		

  <--------- double-click here for help and instructions on how to create a CR.

4.1	Functional network architecture
Figure 1 shows the functional security architecture of UMTS. 

Figure 1: UMTS functional security architecture
The vertical bars represent the network elements: 
In the user domain:
•	USIM (User Service Identity Module): an access module issued by a HE to a user;
•	UE (User Equipment);
In the serving network (SN) domain:
•	RNC (Radio Network Controller);
•	VLR (Visited Location Register), also the SGSN;
In the home environment (HE) domain:
•	HLR/AuC. 
The horizontal lines represent the security mechanisms: 
•	EUIC: mechanism for enhanced user identity confidentiality (optional, between user and HE);
•	UIC: conventional mechanism for user identity confidentiality (between user and serving network);
•	AKA: the mechanism for authentication and key agreement, including the functionality to trigger a re-authentication by the user, i.e., to control the access key pair lifetime; 
•	DC: the mechanism for data confidentiality of user and signalling data; 
•	DI: the mechanism for data integrity of signalling data.
•	DEC: the mechanism for network-wide data confidentiality

In the remaining section of this specification we describe what data elements and functions need to be implemented in each of the above network elements for each of the above mechanisms and functions.