Technical Specification Group Services and System Aspects	S3-99344
Meeting #6, 	

TSG SA WG3 #6, Sophia Antipolis, 29 September – 1 October,  1999	
3G CHANGE REQUEST	Please see embedded help file at the bottom of this
page for instructions on how to fill in this form correctly.	
	
	TS 33.102	CR	16	Current Version:	V3.1.0		
					
3G specification number 		 CR number as allocated by 3G support team	
	
For submission to TSG	SA#5	for approval	x	(only one box should	
list TSG meeting no. here 	for information		be marked with an X)	
	
Form: 3G CR cover sheet, version 1.0        The latest version of this form is available from: ftp://ftp.3gpp.org/Information/3GCRF-xx.rtf	
	
Proposed change affects:	USIM	X	ME	X	UTRAN	X	Core Network	X	
(at least one should be marked with an X)	
	
Source:	S3	Date: 	99-10-09	
	
Subject:	Network-wide confidentiality	
	
3G Work item:	Security	
	
Category: 	F	Correction					
	A	Corresponds to a correction in a 2G specification					
(only one category 	B	Addition of feature					
shall be marked	C	Functional modification of feature	x				
with an X)	D	Editorial modification					
	
Reason for 
change:
	Refinement of network-wide confidentiality specification.	
	
Clauses affected:	8.2	
	
Other specs	Other 3G core specifications		  List of CRs:		
affected:	Other 2G core specifications		  List of CRs:		
	MS test specifications		  List of CRs:		
	BSS test specifications		  List of CRs:		
	O&M specifications		  List of CRs:		
	
Other 
comments:	The abbreviations ECK and ECKC should be listed in section 3.3. TS33.107 should be added to the list of references in section 2.	

8.2 	Network-wide user traffic confidentiality
8.2.1	Introduction
Subclause 6.6 specifies how signalling information, user identity and user traffic information may be confidentiality protected by providing a protected mode of transmission on dedicated channels between the UE and the RNC. Network-wide confidentiality is an extension of this security feature which provides a protected mode of transmission on user traffic channels across the entire network. This gives users assurance that their traffic is protected against eavesdropping on every link within the network, i.e. not just the particularly vulnerable radio links in the access network, but also on the fixed links within the core network.
If network-wide confidentiality of user traffic is provided then access link confidentiality of user traffic between UE and RNC shall be replaced with the network-wide service. Access link confidentiality of signalling information and user identity between UE and RNC shall be applied regardless of whether or not the network-wide user traffic confidentiality service is applied. 
Note: 	The exact architectural placement of the network-wide encryption function is for further study. This may have an impact on whether network-wide encryption replaces or supplements access link encryption.
A lawful interception interface may be implemented according to TS33.107 regardless of whether or not network-wide confidentiality is applied by the network. It shall be possible to remove any network-wide confidentiality protection within the core network to provide access to plaintext user traffic at the lawful interception interface.
Network-wide confidentiality shall be provided by protecting transmissions on user traffic channels using a synchronous stream cipher. This involves the specification of a standard method for ciphering user traffic on a network-wide basis (clause 8.2.2) and a standard method for managing the ciphering key required at the end points of the protected channel (clause 8.2.3). 
8.2.2	Ciphering method
The network-wide encryption algorithm shall be a synchronous stream cipher. It shall be possible to use the same algorithm UEA for access link encryption and network-wide encryption. 
The network-wide synchronous stream cipher shall contain a key stream generator which shall have two inputs: the network-wide cipher key (ECK) and an initialisation value (IV). The plaintext shall be encrypted using the key stream by applying an exclusive-or operation to the plaintext on a bit per bit basis to generate the ciphertext. The decryption operation shall involve applying the same key stream to the ciphertext to recover the plaintext.
Synchronisation of the key stream shall be achieved using the initialisation value. Synchronisation information shall be available at both end points of the communication and shall be used to maintain alignment of the key stream. Protection against replay of user traffic shall be achieved through the use of a time variable initialisation vector combined with a time variable cipher key. 
Note:	The stream cipher does not protect against bit toggling so other mechanisms must be used if this type of integrity protection is required on user traffic.
For encryption of voice traffic then Transcoder Free Operation (TFO) shall be used between the two end points such that the structure and ordering of the transmitted data shall be maintained with the same boundary conditions at each end of the link. 
Note: 	In the initial phases of 3GPP, transcoder free operation may only be possible for user traffic channels which terminate within the same serving network. Furthermore, TFO may only be possible if the entire communication path is within the same serving network. Thus, in non optimal routing cases where the tromboning effect occurs, TFO may not be available, even if the traffic channel terminates within the same serving network.
For encryption of data traffic a transparent data service shall be used between the two end points such that the structure and ordering of transmitted data shall be maintained with the same boundary conditions at each end of the link. 
To satisfy lawful interception requirements it must be possible to decrypt network-wide encrypted traffic within the core network to provide access to plaintext user traffic. Thus decryption facilities (and the network-wide cipher key) shall be available in the core network for lawful interception reasons. If transcoder free operation is used on voice traffic channels, transcoders shall be available in the core network for lawful interception reasons whether or not network-wide encryption is provided.
For further study:
-	Specification of encryption synchronisation mechanism;
-	Adaptation of TFO voice traffic channels for network-wide confidentiality;
-	Adaptation of data traffic channels for network-wide confidentiality;
-	The ability to terminate network-wide encryption at network gateways for inter-network user traffic channels;
-	The ability to handle multiparty calls, explicit call transfer and other supplementary services;
-	Network-wide encryption control – algorithm selection, mode selection, user control
8.2.3	Key management
Signalling links within the network shall be protected on a link-by-link basis. In particular, the UE to RNC signalling links shall be protected using access link keys (see clause 6) and core network signalling links shall be protected using network security domain keys (see clause 7). If network-wide encryption is provided across serving network boundaries (which requires that inter-network TFO is available) then the signalling links requiring protection will cross network boundaries. 
Note: 	If network-wide encryption is provided across serving network boundaries then the two serving networks may not be roaming partners yet they still must be able to protect inter-network signalling by establishing appropriate keys.
The key management scheme for network-wide encryption involves establishing a network-wide cipher key between the end points of the traffic channel. It should not be possible to obtain this key by eavesdropping on any transmission links within the network. 
Note:	However, it is be possible to obtain the network-wide key by compromising certain nodes within the network (e.g. nodes where link encryption terminates).
To satisfy lawful interception requirements it shall be possible to decrypt network-wide encrypted traffic within the core network to provide access to plaintext user traffic. Thus, the network-wide cipher key (and decryption facilities) shall be available in the core network for lawful interception reasons. 
The key management scheme is illustrated in the diagram below.

Figure 15: Key management scheme for network-wide encryption
In addition to the access link cipher and integrity keys, the USIM and the MSC/VLR shall also establish a network-wide cipher key component ECKC as part of the authentication and key agreement procedure (clause 6.3). This key component will be used to generate the network-wide cipher key ECK.
As part of establishing a network-wide encrypted connection, MSC/VLRa and MSC/VLRb shall exchange network-wide cipher keys components for UEa and UEb. MSC/VLRa passes ECKCb to UEa, while MSC/VLRb passes ECKCa to UEb. At each end the access link key is transmitted to the UE over signalling channels which are protected using the access link cipher keys CK. When each UE has received the other party’s network-wide cipher key component, the network-wide cipher key ECK shall be calculated as a function of ECKCa and ECKCb. 
The key management scheme satisfies the lawful interception requirement since ECK can be generated by MSC/VLRa or MSC/VLRb and then used by decryption facilities in the core network to provide plaintext user traffic at the lawful interception interface. 
For further study:
-	Specification of mechanism to exchange network-wide cipher key components.
-	The ability to terminate network-wide cipher key management at network gateways for inter-network user traffic channels.