Table of Contents   1. Introduction 2. NAS Security 3. AS Security 4. Security Context 5. Closing and References

 

 

2. NAS Security

 

A detailed description of the NAS security previously mentioned in LTE Security I[1] will be given below. A NAS security setup procedure consists of NAS signaling, between a UE and an MME, by a Security Mode Command message that the MME sends to the UE and a Security Mode Command message that the UE sends to the MME. Descriptions of the NAS security setup procedure by NAS messages and how NAS messages are delivered thereafter will be provided in Sections 2.1 and 2.2, respectively.

 

2.1 NAS Security Setup

 

(1) Delivering a Security Mode Command message

 

Figure 2 shows how a Security Mode Command message is delivered during the NAS security setup procedure. The MME, by sending a Security Mode Command message to the UE, informs the UE that it is authenticated by the network and the NAS security setup procedure for secure message delivery between them is initiated. The Security Mode Command message is integrity protected and then sent to the UE, which then derives NAS security keys (a ciphering key and an integrity key) and verifies the integrity of the message using the integrity key.

 

A simplified LTE authentication procedure that precedes the NAS security setup procedure is shown as  and  in Figure 2[1]. The same K_ASME is shared by the UE and the MME as a result of the LTE authentication. We will explain the NAS security setup procedure presuming the MME allocates a KSI_ASME to identify K_ASME as 1 ("001"). 

Figure 2. NAS security setup: Delivery of a Security Mode Command message

 

 [MME] Selecting security algorithms

The MME selects ciphering and integrity algorithm to be applied to NAS messages based on UE Network Capability information included in the received Attach Request message from the UE. Figure 2 shows an example of selecting EEA1 for an encryption algorithm and EIA1 for an integrity algorithm, i.e., SNOW 3G algorithm (see LTE Security I [1]).

 

 [MME] Deriving NAS security keys

The MME derives K_NASint and K_NASenc from K_ASME using the algorithm IDs and algorithm distinguishers of the selected security algorithms. Table 1 lists algorithm IDs and algorithm distinguishers [2].

• K_NASint = KDF(K_ASME, NAS-int-alg, Alg-ID)

• K_NASenc = KDF(K_ASME, NAS-enc-alg, Alg-ID)

 

Table 1. Security algorithm IDs and algorithm distinguishers [2]

*  It is applied when using relay nodes. As relay is out of the scope of this document, user plane integrity algorithms are not discussed herein. 

 

 [MME] Generating NAS-MAC for integrity protection

The MME forms a Security Mode Command message to send to the UE and calculates NAS-MAC (Message Authentication Code for NAS for Integrity) using the selected EIA algorithm (EIA1) with input parameters such as the Security Mode Command message and K_NASint derived in . Figure 3 shows how NAS-MAC is calculated using the following EIA algorithm input parameters[2]: 

• Count: 32-bit downlink NAS count 
• Message: NAS message, i.e., Security Mode Command message herein
• Direction: 1-bit direction of the transmission, 0 for uplink and 1 for downlink (set to 1 herein)
• Bearer²: 5-bit bearer ID, constant value (set to 0)
• K_NASint: 128-bit NAS integrity key

 

Figure 3. Calculation of NAS-MAC [2]

 

 [UE ← MME] Sending a Security Mode Command message

The MME attaches the NAS-MAC calculated in  to the Security Mode Command message and sends it to the UE. Here the message is integrity protected but not ciphered. Message parameters used are as follows:

• KSI_ASME: 3-bit value associated with a K_ASME, used to identify the K_ASME (KSI_ASME=1 herein)
• Replayed UE Security Capability: UE Security Capability included in the UE Network Capability in the Attach Request message sent by UE, indicates which security algorithms are supported by the UE
• NAS Ciphering Algorithm: NAS ciphering algorithm selected by the MME, EEA1 herein
• NAS Integrity Protection Algorithm: NAS integrity protection algorithm selected by the MME, EIA1 herein

 

 [UE] Setting K_ASME identifier (KSI_ASME)

When the UE receives a Security Mode Command message from the MME, it sets KSI_ASME in the message as its KSI_ASME and uses it as an identifier of the current K_ASME.

 

 [UE] Deriving NAS security keys

The UE, recognizing the NAS security algorithm that the MME selected, derives K_NASint and K_NASenc from K_ASME using the algorithm IDs and the algorithm distinguishers(see Table 1).

 

 [UE] Verifying the integrity of the Security Mode Command message

The UE checks the integrity of the received Security Mode Command message by verifying the NAS-MAC included in the message. It recognizes the NAS integrity algorithm selected by the MME is EIA1 and calculates XNAS-MAC, a message authentication code, by using the selected EIA1 algorithm with the Security Mode Command message and K_NASint derived in . Figure 4 shows how XNAS-MAC is calculated using the same EIA input parameters as in [2]. The UE verifies the integrity of the message by examining whether the XNAS-MAC calculated by itself matches the NAS-MAC calculated by the MME. If they match, it is guaranteed that the Security Mode Command message has not been manipulated (e.g., inserted or replaced) on the way.

 

Figure 4. Calculation of XNAS-MAC [2]

 

 

(2) Delivering Security Mode Complete message

 

Figure 5 illustrates how a Security Mode Complete message is delivered during the NAS security setup procedure. The UE, by sending a Security Mode Complete message to the MME, informs the MME that the same NAS security keys as MME's are derived in the UE and that the integrity of the Security Mode Command message is verified. The Security Mode Complete message is ciphered and integrity protected for transmission.

 

Figure 5. NAS security setup: Delivery of a Security Mode Complete message

 

 [UE] Encrypting the message using the selected encryption algorithm (EEA1)

The UE forms and encrypts the Security Mode Complete message to be sent to the MME. The ciphered Security Mode Complete message (Cipher Text Block) is derived by performing bitwise XOR between the Security Mode Complete message (Plane Text Block) and the encryption key stream (Key Stream Block) generated using EEA1 algorithm with NAS encryption key (K_NASenc). Figure 6 shows how NAS messages are encrypted [2]. EEA algorithm input parameters used to generate the key stream block are as follows:

• Count: 32-bit uplink NAS count  
• Bearer: 5-bit bearer ID, constant value (set to 0)
• Direction: 1-bit direction of the transmission, 0 for uplink and 1 for downlink (set to 0 herein)
• Length: the length of the key stream to be generated by the encryption algorithm
• K_NASenc: 128-bit NAS ciphering key

 

Figure 6. Encryption of NAS message by the sender (UE) [2]

 

 [UE] Generating NAS-MAC for integrity protection

The UE calculates NAS-MAC using EIA algorithm (EIA1) with the ciphered Security Mode Complete message and K_NASint. Figure 3a shows how NAS-MAC is calculated using the following EIA algorithm input parameters:

• Count: 32-bit uplink NAS count
• Message: NAS message, Security Mode Complete message herein
• Direction: 1-bit direction of the transmission, 0 for uplink and 1 for downlink (set to 0 herein)
• Bearer: 5-bit bearer ID, constant value (set to 0)
• K_NASint: 128-bit NAS integrity key

 

Figure 3a. Calculation of NAS-MAC for the Ciphered Security Mode Complete message

 

 [UE → MME] Sending the Security Mode Complete message

The UE attaches the NAS-MAC calculated in  to the Security Mode Complete message and sends it to the MME. Here the message is integrity protected and ciphered, and all the NAS messages that the UE sends to the MME hereafter are securely delivered.

 

 [MME] Verifying the Integrity of the Security Mode Complete message

The MME checks the integrity of the received Security Mode Complete message by verifying NAS-MAC included in the message. MME calculates XNAS-MAC, a message authentication code, by using the selected EIA1 algorithm with the Security Mode Complete message and K_NASint. Figure 4a shows how XNAS-MAC is calculated using the same EIA input parameters as in . The MME verifies the integrity of the message by examining whether the XNAS-MAC calculated by itself matches the NAS-MAC calculated by the UE. If they match, it is guaranteed that the Security Mode Complete message has not been manipulated on the way.

 

Figure 4a. Calculation of XNAS-MAC for the Ciphered Security Mode Complete message

 

 [MME] Decrypting of the Security Mode Complete message

After successful verification of the Security Mode Complete message, the MME decrypts the message using EEA algorithm (EEA1). Then the Security Mode Complete message, the original message generated by the UE, is derived through XOR between the ciphered Security Command Complete message and the key stream block. Figure 7 illustrates how the message is decrypted using the same EEA algorithm input parameters as in .

 

Figure 7. Decryption of the NAS message by the receiver (MME) [2]

 

 

2.2 After NAS Security Setup

 

Once the NAS security setup is completed as in Section 2.1, all the NAS messages between the UE and the MME thereafter are encrypted and integrity protected before being sent. Figure 8 shows how NAS messages are delivered between the UE and the MME after the NAS security setup.

 

Figure 8. Ciphering and integrity protection of the NAS Messages after the NAS security setup

 

When NAS messages are being sent, they are encrypted first and then integrity protected before being sent. The original NAS messages are first encrypted using an encryption key (K_NASenc) and then integrity protected by including NAS-MAC calculated using an integrity key (K_NASint) so that the messages are delivered as encrypted and integrity protected.

 

 

When received, however, the NAS messages are integrity verified first and then decrypted, which is in the opposite order of what has been done when they were sent. That is, the integrity of the NAS messages is verified first by comparing the XNAS-MAC calculated using the integrity key (K_NASint) and the received NAS-MAC, and then the messages are decrypted to get the original NAS messages.