Content for TS 33.320 Word version: 17.0.0

1 Scope p. 6

The present document specifies the security architecture for the H(e)NB subsystem. This includes security requirements on Home Node Bs, Home eNode Bs, and other H(e)NB-associated network nodes (e.g. SeGW and H(e)MS), as well as the procedures and features which are provided to meet those requirements.

2 References p. 6

The following documents contain provisions which, through reference in this text, constitute provisions of the present document.

References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific.
For a specific reference, subsequent revisions do not apply.
For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document.

[1]

TR 21.905: "Vocabulary for 3GPP Specifications".

[2]

TS 32.583: "Telecommunications management; Home Node B (HNB) Operations, Administration, Maintenance and Provisioning (OAM&P); Procedure flows for Type 1 interface HNB to HNB Management System (HMS)".

[3]

RFC 4187: "Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AKA) ".

[4] Void.

[5] Void.

[6]

RFC 4739: "Multiple Authentication Exchanges in the Internet Key Exchange (IKEv2 Protocol, Nov 2006".

[7]

TS 33.310: "Network Domain Security (NDS); Authentication Framework (AF) ".

[8]

TS 23.003: "Numbering, addressing and identification".

[9]

TS 33.210: "3G security; Network Domain Security (NDS); IP network layer security".

[10]

TS 33.234: "3G security; Wireless Local Area Network (WLAN) interworking security".

[11]

TS 32.593: "Telecommunication management; Procedure flows for Type 1 interface H(e)NB to H(e)NB Management System (H(e)MS) ".

[12]

TS 25.467: "UTRAN architecture for 3G Home Node B (HNB); Stage 2".

[13] Void.

[14] Void.

[15]

The Broadband Forum TR-069: "CPE WAN Management Protocol v1.1", Issue 1 Amendment 2, December 2007.

[16] Void.

[17] Void.

[18]

ETSI ES 282 004 (V1.1.1): "Telecommunications and Internet Converged Services and Protocols for Advanced Networking (TISPAN); NGN functional architecture; Network Attachment Sub-System (NASS) ", 2006.

[19]

ETSI ES 283 035 (V1.1.1): "Telecommunications and Internet Converged Services and Protocols for Advanced Networking (TISPAN); Network Attachment Sub-System (NASS); e2 interface based on the DIAMETER protocol", 2006.

[20]

TS 33.102: "3G security; Security architecture".

[21]

TS 33.401: "3GPP System Architecture Evolution (SAE): Security architecture".

[22]

RFC 2560: "X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP"

[23]

Open Mobile Alliance OMA-WAP-OCSP V1.0: "Online Certificate Status Protocol Mobile Profile". URL: http://www.openmobilealliance.org/

[24]

RFC 4806: "Online Certificate Status Protocol (OCSP) Extensions to IKEv2".

[25] Void.

[26]

RFC 5280: "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile".

[27]

TS 36.300: "Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal Terrestrial Radio Access Network (E-UTRAN); Overall description; Stage 2".

[28]

TS 25.367: "Mobility procedures for Home Node B (HNB); Overall description; Stage 2".

[29]

TS 23.060: "General Packet Radio Service (GPRS); Service description; Stage 2".

[30]

TS 23.401: "General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) access".

[31]

TS 22.220: "Technical Specification Group Services and System Aspects; Service requirements for Home Node B (HNB) and Home eNode B (HeNB)".

3 Definitions and abbreviations p. 7

3.1 Definitions p. 7

For the purposes of the present document, the terms and definitions given in TR 21.905 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if any, in TR 21.905.

CSG:

A closed subscriber group identifies subscribers of an operator who are permitted to access one or more cells of the PLMN of but having restricted access ("CSG cells")

Hosting party:

The party hosting the H(e)NB and having a contract with the PLMN operator.

Security Gateway:

Element at the edge of an operator's security domain terminating security association(s) for the backhaul link between H(e)NB and network.

3.2 Abbreviations p. 7

For the purposes of the present document, the abbreviations given in TR 21.905 and the following apply. An abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in TR 21.905.

AAA

Authentication, Authorization, and Accounting

ACL

Access Control List

ACS

Auto-Configuration Server

AKA

Authentication and Key Agreement

Certification Authority

CPE

Customer Premises Equipment

CRL

Certificate Revocation List

CSG

Closed Subscriber Group

DNS

Domain Name System

DPD

Dead Peer Detection

eNB

Evolved Node-B

EAP

Extensible Authentication Protocol

ESP

Encapsulating Security Payload

E-UTRAN

Evolved UTRAN

FQDN

Fully Qualified Domain Name

GNSS

Global Navigation Satellite System

H(e)NB

Home NodeB or Home eNodeB

H(e)NB-GW

Home (e)NodeB Gateway

H(e)MS

Home NodeB Management or Home eNodeB Management System

HeMS

Home eNodeB Management System

HeNB

Home eNodeB

HMS

Home NodeB Management System

HNB

Home NodeB

Hosting Party

HPM

HP Module

Hardware

IKE

Internet Key Exchange

IMSI

International Mobile Subscriber Identity

L-GW

Local Gateway

LIPA

Local IP Access

LTE

Long Term Evolution

MME

Mobility Management Entity

MSK

Master Session Key

NAPT

Network Address Port Translation

NAT

Network Address Translation

NAT-T

NAT-Traversal

OCSP

Online Certificate Status Protocol

PKI

Public Key Infrastructure

Security Association

SeGW

Security Gateway

SGSN

Serving GPRS Support Node

S-GW

Serving Gateway

TLS

Transport Layer Security

TrE

Trusted Environment

UDP

User Datagram Protocol

UICC

Universal Integrated Circuit Card

URI

Uniform Resource Identifier

URL

Uniform Resource Locator

USIM

Universal Subscriber Identity Module

UMTS

Universal Mobile Telecommunications System

UTRAN

Universal Terrestrial Radio Access Network

WAP

Wireless Application Protocol