IIR-tutorial-2

Description

Information and Communication Networks3GPP Security architectureBart VinckSiemens AteaInformation and communication networksCommunications on [e-mail] Fraud and Security Conference,London, March 9, 2000Contents Introduction Network access security Authentication and key agreement User identity confidentiality Confidentiality and integrity Connection establishment Mobile equipment identity security Network domain security SummaryIRR Fraud and Security Conference,2London, March 9, 2000Siemens Atea Page 1USECAUSECAInformation and Communication NetworksIntroductionTechnical specificationsPrinciples, objectives and requirements TS 33.120 Security principles and objectives TS 21.133 Security threats and requirementsArchitecture, mechanisms and algorithms TS 33.102 Security architecture TS 33.103 Integration guidelines TS 33.105 Cryptographic algorithm requirementsLawful interception TS 33.106 Lawful interception requirements TS 33.107 Lawful interception architecture and functionsIRR Fraud and Security Conference,3London, March 9, 2000IntroductionTechnical reportsTechnical reports TR 33.900 Guidelines for 3G security TR 33.901 Criteria for cryptographic algorithm design TR 33.902 Formal analysis of authenticationIRR Fraud and Security Conference,4London, March 9, 2000Siemens Atea Page 2USECA USECAInformation and Communication NetworksIntroductionSecurity architecture ...

Informations

• Publié par: Zoed
• Nombre de lectures: 21
• Langue: English

Extrait

Siemens Atea

2

3GPP Security architecture

Bart Vinck Siemens Atea Information and communication networks Communications on Air [e-mail]

IRR Fraud and Security Conference, London, March 9, 2000

Contents

 Introduction  Network access security Authentication and key agreement User identity confidentiality Confidentiality and integrity Connection establishment Mobile equipment identity security  Network domain security  Summary

IRR Fraud and Security Conference, London, March 9, 2000

Page 1

Information and Communication Networks

Siemens Atea

3

4

Introduction Technical specifications Principles, objectives and requirements  principles and objectives SecurityTS 33.120  threats and requirements SecurityTS 21.133 Architecture, mechanisms and algorithms TS 33.102 Security architecture TS 33.103 Integration guidelines TS 33.105 Cryptographic algorithm requirements Lawful interception  LawfulTS 33.106 interception requirements  LawfulTS 33.107 interception architecture and functions

IRR Fraud and Security Conference, London, March 9, 2000

Introduction Technical reports Technical reports  for 3G security GuidelinesTR 33.900 TR 33.901 Criteria for cryptographic algorithm design TR 33.902 Formal analysis of authentication

IRR Fraud and Security Conference, London, March 9, 2000

Page 2

Information and Communication Networks

Siemens Atea

5

6

Information and Communication Networks

Introduction Security architecture overview Application IV. stratum User Application Provider Application

III. I I. Home . stratum/ TE USIM HE  Serving I I. II. Stratum . SN Transport I. Network access security MT I.AN stratum I I I I . I   . P U r s o e vi r d d e o r m d a o i m n a s i e n c s u e ri c ty urity IV. Application security

IRR Fraud and Security Conference, London, March 9, 2000

Authentication and key agreement Contents Introduction Authentication using sequence numbers Message flow for successful authentication Message flow for re-synchronisation Sequence numbers - fine details An authenticated signalling channel HE→USIM GSM-UMTS interoperation World-wide cross standard roaming Summary

IRR Fraud and Security Conference, London, March 9, 2000

Page 3

Siemens Atea

7

8

Information and Communication Networks

Authentication and key agreement Introduction - New security services GSM AKA security services User-to-network authentication SRES = A3 Ki (RAND)  KcEstablishment of a 64 bit cipher key = A8 Ki (RAND) Additional UMTS AKA security services  = f3 CKEstablishment of longer cipher key K (RAND)  IK = f4Establishment of integrity key K (RAND) User assurance of key freshness (To some extent) network-to-user authentication Authenticated signalling channel HE→USIM

IRR Fraud and Security Conference, London, March 9, 2000

Authentication and key agreement Assurance of key freshness to the user  What is freshness assurance ? The user is assured at AKA that the cipher/integrity keys are fresh (i.e., have not been used before) Not provided by GSM AKAnetwork (or intruder) can re-use triplets (and for re-use of “insecure” cipher key)  Why have key freshness assurance ? To limit the damage when a triplet is exposed or a cipher key is broken  How to achieve key freshness assurance? Option 1: mutual challenge/response Option 2: authenticated challenge/response(preferred)

IRR Fraud and Security Conference, London, March 9, 2000

Page 4

Siemens Atea

9

10

Authentication and key agreement Sequence numbers - basics USIM AuC K RAND, SQN, MAC K SQN MS SQN HE User (USIM) Home network (AuC) StoresStores SQN MS  SQN= last accepted SQN HE = last generated SQN Receives (RAND, SQN, MAC)Selects next SQN > SQN HE ComputesComputes XMAC = f K (RAND, SQN) MAC = f1 K (RAND, SQN) Verifies that XMAC = MAC andSends the user SQN > SQN MS (RAND, SQN, MAC) Updates SQN MS Updates SQN HE IRR Fraud and Security Conference, London, March 9, 2000

Information and Communication Networks

Authentication and key agreement 0/4: Prerequisites USIM VLR or SGSN AuC SQN MS K SQN HE K K = Subscriber authentication key SQN MS = Sequence number counter in the MS SQN HE = Sequence number counter in the HE USIM = UMTS Subscriber Identity Module VLR = Visitor Location Register SGSN = Serving GPRS Support Node AuC = Authentication Centre MS = Mobile Station HE = Home Environment AuC and USIM share secret key K AuC maintains SQN HE = largest sequence number generated by the AuC (for the subscriber)(will be enhanced further on) USIM maintains SQN MS = largest sequence number received and accepted by the USIM(will be enhanced further on) IRR Fraud and Security Conference, London, March 9, 2000

Page 5

Siemens Atea

Information and Communication Networks

Authentication and key agreement 1/4: User-to-network authentication USIM VLR or SGSN  AuC RAND SQN MS K RAND SQN HE K RES = f2 K DNARSERX ( =  R S     D R ) E A D N Xf2 RAN K (RAND) RES   XRES = RES ?RAND = Network challenge RES = User response XRES = Expected response AuC generates RAND and computes XRES RAND is sent to the USIM; XRES is sent to the VLR/SGSN USIM re-computes RES and sends RES to the VLR/SGSN The VLR/SGSN verifies “RES = XRES?” 11 IRR Fraud and Security Conference, London, March 9, 2000

Authentication and key agreement 2/4: Cipher/integrity key establishment USIM VLR or SGSN  AuC SQN MS K R X A R N ES D SQN HE   K RAND RANDCK, IK RES = f2 K (RAND) R X A RE N S D = f2 K (RAND) CK = f3 K A = ND) (R IK = f4 K   KC3f   D f N  = ) IK (  4 AR K   K ) NAR( D) NDRA( RES XRES = RES ? C K=  =K  y I ker heip C  yek ytirgetnI  

AuC computes CK and IK from RAND and K RAND is sent to USIM, CK and IK are sent to VLR or SGSN USIM re-computes CK and IK from RAND and K 12 IRR Fraud and Security Conference, London, March 9, 2000

Page 6

Siemens Atea

Information and Communication Networks

Authentication and key agreement 3/4: Network-to-user authentication USIM VLR or SGSN  AuC RAND SQN MS K XRES SQN HE K RANDSQN R A A UT N N D C A K U , T I N K RANDSQN RES = f2 K (RAND) I C K  K =     = f   4 f K 3 K AND) (RADN) R(  AUTN = SQN | MAC I ERX  K =   4 S f 3CK f = K = K (   ( f2 R R K A   )ADN D)A N N( D R ) XMAC = f1 K ( RAND | SQN) RES XMAC MAC ? AU M TN A   C =   A = u f th 1 e K   n ( ti R ca A ti N on D t | o   k S en QN) = SQN > SQN MS XRES = RES ? ed umbece nquen= SeQS N con ioaticntheuta egasseM = CAM r AuC generates fresh SQN > SQN HE , protects the integrity by means of MAC and sends AUTN = SQN | MAC to the USIM USIM verifies the data origin of SQN by “XMAC = MAC ?” USIM verifies the freshness of SQN by “SQN > SQN MS ” data origin verification = entity authenticationFreshness + 13 IRR Fraud and Security Conference, London, March 9, 2000

Authentication and key agreement 4/4: An authenticated signalling channel USIM VLR or SGSN Quintet AuC RAND SQN MS K AUTN RANDSQN RAND XRES RAND S SQ Q N N HE A K MF = f2 R X X E M M S A A = C C       = f = 2   K f M  ( 1 K A ( R   C R A   N ? D | SQN |  D) NAAMF) AUTN CK, IK  XRES K   K (   N | | SQ D)AN(R DNARAMF) AUTN= SQN |AMF| MAC MAC= f1 C S K Q   N =    f > 3  S K N A Q (R  MS f4 RES  CK =f )   DN  K =I K 3 K AN(RD) ( ARDN)   IK = f4 K  = RES ? (RAND) XRES AMF = Authentication Management Field Q = Quintet AuC determines AMF AMF is input to f1 and MAC, AMF is part of AUTN USIM receives AMF as part of AUTN verifies authenticity of AMF via “MAC = XMAC ?"USIM 14 IRR Fraud and Security Conference, London, March 9, 2000

Page 7

Siemens Atea

Authentication and key agreement Composition of the quintet Quintet  bits 128 challengeRAND Network XRES Expected 32-128 response bits  keyCK Cipher bits 128  bitsIK Integrity key 128  128 bitsAUTN Authentication token – SQN Sequence number 48 bits – AMF Authentication management field 16 bits – MAC(-A) Message authentication code 64 bits Note The standard allows the possibility to conceal SQN with an anonymity key AK to ensure user identity confidentiality

15 IRR Fraud and Security Conference,  Source: TS 33.102, Clause 6.3 London, March 9, 2000

Authentication and key agreement Message flow for successful AKA USIM VLR or SGSN  AuC Distribution of auth. data request quintets from Generate HLR/AuC Quintets quintets to VLR/SGSN Q = (RAND, XRES, CK, IK, AUTN ) RAND, AUTN Over-the-air Verify MAC, SQN Derive CK, IK, RES oi a ncitaehtnatu knd RES  ey agreement XRES = RES ? Start using CK, IK Start using CK, IK

16  TS 33.102, Clause 6.3 IRR Fraud and Security Conference,  Source: London, March 9, 2000

Page 8

Information and Communication Networks

Siemens Atea

Authentication and key agreement Failure cases  USIM determines that XMAC-A≠MAC-A(new!) USIM: sends indication of integrity failure to VLR VLR: request for identification or try other quintet or request new quintets from HLR/AuC  USIM determines that “SQN≤SQN MS ”(new!) USIM: sends indication of synchronisation failure to VLR, computation of re-synchronisation token VLR: request new quintets from HLR/AuC with indication of synchronisation failure and re-synchronisation token  VLR determines that XRES≠RES VLR: reject the user that attempts to access the system Note: same procedures apply for CS and PS, for VLR and SGSN 17  Source: TS 33.102, Clause 6.3 IRR Fraud and Security Conference, London, March 9, 2000

Information and Communication Networks

Authentication and key agreement Re-synchronisation mechanism USIM VLR or SGSN Quintet AuC SQN MS  SQN K RAND HE K RANDSQN AUTS  R A A UT N S D RANDSQN SQN≤SQN MS XRES = f2 K (RAND)   MAC-S = f1* K (RAND | SQN MS  = f1* ) XMAC-S K (RAND | SQN MS ) “ AUTS = SQN MS | AMF* | MAC-S IFSQN MS > SQN HE ”   AND MAC-S = XMAC-S    SET SQN HE = SQN AUTS = Re-synchronisation token   MAC-S = MAC for re-synchronisation USIM determines that “SQN≤SQN MS ” and computes MAC-S USIM sends AUTS to VLR, VLR adds RAND AuC verifies integrity and whether “SQN MS > c” and updates SQN MS is necessary 18 IRR Fraud and Security Conference, London, March 9, 2000

Page 9

Siemens Atea

Information and Communication Networks

AKA: Re-synchronisation mechanism USIM VLR or SGSN  AuC SQN≤SQN MS Compute AUTS Ind. of Sync. Failure AUTS D H i L st R ri / b A u u ti C o  t n o     of V   L qu R i / n S te G ts S  f N r   o w m it   h AR ,STUADN uADatath. uest Req Verify AUTS [Modify SQN-HE] f i a n i d l i u c r a e tion of synchronisation Quintets [Generate quintets] RAND, AUTN SQN now acceptable (Continue as in successful AKA)

19 IRR Fraud and Security Conference,  Source: TS 33.102, Clause 6.3 London, March 9, 2000

Authentication and key agreement Causes of synchronisation failures  Re-use VLR/SGSN (or intruder) attempts to re-use quintets VLR/SGSN must not attempt to re-use quintets !! SQN HE need not be modified  Out-of-order use VLR/SGSN attempts to use quintets, while newer quintets have been used already SQN management shall allow out-of-order use (to a certain extent) !!one issue for enhanced SQN management SQN HE need not be modified  Corruption of the counter in the AuC SQN HE need be modified 20 IRR Fraud and Security Conference,  Source: TS 33.102, Clause 6.3 London, March 9, 2000

Page 10

Siemens Atea

Information and Communication Networks

Authentication and key agreement Enhanced sequence number management  SQN management shall ... … allow out-of-order useof a quintet when it is among the50 most recently generated quintets Different mechanisms are available; the USIM keeps track of history information on successful passed authentication events … prevent lock-outof a USIM due to SQN MS reaching SQN max SQN management shall limit the increment of SQN MS to a maximum valueΔsuch that SQN max /Δis sufficiently large … not compromise user anonymity an anonymity key AK, or maySQN can either be concealed with be (partially) clock-based (then no concealment is required) … be able to recover from corruption of the AuC database SQN management shall support re-synchronisation procedure as defined before 21  TS 33.102, Clause 6.3 IRR Fraud and Security Conference,  Source: London, March 9, 2000

Authentication and key agreement Suggested SQN generation at the AuC SEQ QN Storage in the AuC SEQ 1 SEQ 2 INDEX SEQ HE   = SEQ1 HE || SEQ2 HE Composition of SQN  G  en U e s r u a a t l i   o ca n s   e of new SQN SEQ1: individual part, # SQN2 SEQ1 = SEQ1 HE  c S y E cl Q e 2 sations : ti  + #ers-nyhcorin LC s  desab-emG ,trap  SEQ2 = GLC the eneration  at GLC wraps around IND   E S Xrentiffes SQ g i Q a N te:Nd  instead: SEQ1 = SEQ1 HE + 1 generated at the same GLC >1 batch per time unit Note instead: SEQ2 = SEQ2 HE +1 GLC: Global Time C unter several quintets in one batch o assign INDEX = 0, 1, 2, ...

22 IRR Fraud and Security Conference,  Source: TS 33.102, Annex C London, March 9, 2000

Page 11