Table of Contents
In LTE Security I, Part I of the LTE Security technical document, we have discussed LTE authentication based on EPS AKA procedure and learned a UE and an MME get to share the KASME when authenticated.
In this document, we will explain NAS and AS security setup procedures to be performed based on KASME, and how data are transmitted in user and control planes after the security setup procedures.
Chapter 2 herein will explain NAS security setup procedure and how NAS messages are sent and received after the procedure.
Chapter 3 will cover AS security setup procedure and how RRC messages and IP packets are transmitted thereafter.
Chapter 4 will provide a description of EPS security contexts and security data to be set in EPS entities (UE, eNB, MME and HSS).
Finally, Chapter 5 will summarize all the security keys covered in the LTE Security technical document (LTE Security I and II).
Before we move on to security setup procedures, we will look in the protocol stacks where NAS and AS security are actually applied to. Figure 1 shows the protocol stacks related to NAS and AS security setup.
Figure 1. Protocol stacks for security setup
NAS Security: The purpose of NAS security is to securely deliver NAS signaling messages between a UE and an MME in the control plane using NAS security keys. The NAS security keys are derived from KASME and new keys are generated every time EPS AKA is performed (every time a new KASME is generated). After the NAS security setup is completed, the UE and the MME get to share a NAS encryption key (KNASenc) and a NAS integrity key (KNASint), which are used in encryption and integrity protection, respectively, of NAS messages before transmitting.
AS Security: The purpose of AS security is to securely deliver RRC messages between a UE and an eNB in the control plane and IP packets in the user plane using AS security keys. The AS security keys are derived from KeNB and new keys are generated every time a new radio link is established (that is, when RRC state moves from idle to connected)1. After the AS security setup is completed, the UE and the eNB get to share an RRC integrity key (KRRCint), RRC encryption key (KRRCenc) and user plane encryption key (KUPenc). Encryption and integrity protection using these keys are performed at the PDCP layer. KRRCint and KRRCenc are used to securely deliver RRC messages in the control plane through an SRB (Signaling Radio Bearer) over radio links. The RRC messages are integrity protected using KRRCint and encrypted using KRRCenc at the PDCP layer before being sent. KUPenc is used to securely deliver IP packets in the user plane through a DRB (Data Radio Bearer) over radio links. The IP packets are encrypted using KUPenc at the PDCP layer before being sent.
I have two questions:
1. SQN, how to get this paremeters in UE side? Is it sent by MME?
2. "When RRC messages are being sent, they are encrypted first and then integrity protected before being sent."—— Can you confirm again? From 36.323, you can find the encrypted should be do first.
1) As gecuili said (thank you for the answer, gecuili!), SQN is concealed in AUTN in the form of (SQN)XOR(AK) (Please see TR, LTE Security I). When UE receives Authentication Request (RAND, AUTN, KSI_ASME) messages from MME, it computes AK and then derives SQN by performing bitwise XOR between AUTN and AK. (Please refer to the Figure 7 and 9 in 3GPP TS 33.102.)
SQNs are generated by HSS/AuC, and delivered to UE via MME.
2) Figure 12 is an error. When RRC messages are being sent, they are integrity protected first and then encrypted before being sent. We have corrected the error and updated this web post and pdf files. We are sorry for the error, and thank you for noticing us about that.
1.SQN is concealed in AUTN according to section 6.3.3 in 33.102. Also Figure 9 illustrates this well.
AUTN is having sqn of 6 bytes. Nas count is of 3 byte (MSb being 0) only of which sqn is 1 byte. Also, with authentication, 33.401 says to reset the count.
I have 1 more question. which all part of nas msg is ciphered, does it include pd , security header and sqn of security protected msg ?
"Plain NAS message" is ciphered. Then the ciphered NAS message and the NAS sequence number are integrity protected. Please refer to 220.127.116.11 and figure 9.1.2 in 3GPP TS 24.301.
(and/or you can see the the figure in 2.2. After NAS Security Setup on this post),
"When both ciphering and integrity protection are activated, the NAS message is first encrypted and then the encrypted NAS message and the NAS sequence number are integrity protected by calculating the MAC."
- Figure 9.1.2 (added some terms in blue by Netmanias)
Quick & great explanation.
What about the SN & AUTN part:
"AUTN is having sqn of 6 bytes. Nas count is of 3 byte (MSb being 0) only of which sqn is 1 byte. Also, with authentication, 33.401 says to reset the count."
I mean, the quote i made from 33.401, indicate that nas sn is not the one from AUTN, right ?
Thanks for sharing such a nice info on LTE authentication and Security procedures. I have one doubt.
In NAS security, while handling Security mode command, Integrity is not known to UE, then does it try hit and trial method and genertate the IK and then X NAS MAC? in above example, UE striaghtly using ALGO-2 for integrity what if multiple Integrity algo supported by UE?
[MME] Selecting security algorithms
The MME selects ciphering and integrity algorithm to be applied to NAS messages based on UE Network Capability information included in the received Attach Request message from the UE. Figure 2 shows an example of selecting EEA1 for an encryption algorithm and EIA1 for an integrity algorithm, i.e., SNOW 3G algorithm (see LTE Security I ).
This will guarante the integrity algorithm which MME selected is exist in UE. If UE supports multiple algo, they may select the most priority one.
Very nice write-up. Some questions:
1) Does all this occur using SRB1?
2) Is all this preceded by an "Authentication Complete" message from the UE?
3) Does all this occur before S1 bearers are set up and before an "Attach Complete" is sent to the UE?
4) How does UE distinguish between AS and NAS versions of the Security Mode command? Are they different message types in RRC?
Good document, have a observation to share as below:-
In the figure Figure 2. NAS security setup: Delivery of a Security Mode Command message, isn't there a printing mistake for the step 3 and 7 for the alogorithm chosen at the MME and UE side for the generation for the Key ?
Have aquery here,
Figure 5. NAS security setup: Delivery of a Security Mode Complete message, if the message itself has been encrypted already then how the UE comes to know that this is the security mode complete message cause the message is an important parameter for the generation of the MAC vlaue in the uplink direction.
Hello, Well explained. But I have a query. Why is SMC complete message in NAS security procedure is both integrity protected and ciphered while SMC complete message in AS security procedure is only integrity protected and not ciphered. Thanks.
Hello, A really good tutorial. May I ask,
Thank you very much,
NAS: The Security Mode Complete message is ciphered and integrity protected for transmission
AS: the Security Mode Complete message is delivered as integrity protected
Why the AS Security Mode Complete message is not ciphered as the NAS?
i have been confusing on this a long time.
thanks a lot,
Any one please please tell me why authentication is delayed in case of connected mode TAU only...Why not in idle mode TAU??
From UE perspective, NAS message is first ciphered & then integrity protected.
& in AS, message is first integrity protected & then ciphered.
Why there is such difference between AS & NAS? Please explain as I am not able to get the required information from other sources.
THE PAPER IS TOO GOOD...
IS THERE ANY IMPLEMANTATION CODE THAT YOU CAN PROVIDE SO THAT WE CAN PRACTICE PRACTICALLY???