Content for TR 33.868 Word version: 12.1.0
1 Scope p. 8
The present document studies the security aspects of System Improvements for Machine Type Communication. In particular, the goals of the present document are:
- To identify and analyze the threats to the MTC system within the scope of the service requirements, functionality and use cases as specified in TS 22.368.
- To identify possible security and privacy impacts induced by the system architecture improvement for machine type communications based on TR 23.887 and TS 23.682.
- To determine possible security requirements based on the analysis above and describe the possible solutions to meet those requirements.
2 References p. 8
The following documents contain provisions which, through reference in this text, constitute provisions of the present document.
- References are either specific (identified by date of publication, edition number, version number, etc.) or non-specific.
- For a specific reference, subsequent revisions do not apply.
- For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document.
[1]
TR 21.905: "Vocabulary for 3GPP Specifications".
[2]
TS 33.210: "3G security; Network Domain Security (NDS); IP network layer security".
[3]
TS 23.060: (V10.2.0): "General Packet Radio Service (GPRS); Service description; Stage 2".
[4]
TS 23.401: (V10.2.1): "General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) access".
[5]
TS 24.368: (V1.0.1): "Non-Access Stratum (NAS) configuration Management Object (MO)".
[6]
TS 33.310: "Network Domain Security (NDS); Authentication Framework (AF)".
[7]
Open Mobile Alliance OMA-TS-DM_Protocol V1.3: " OMA Device Management Protocol". http://www.openmobilealliance.org/
[8]
Open Mobile Alliance OMA-TS-DM_Security V1.3: " Device Management Security ". URL: http://www.openmobilealliance.org/
[9]
TS 22.368: "Service requirements for Machine-Type Communications (MTC); Stage 1".
[10]
TR 23.888: "System improvements for Machine-Type Communications (MTC)".
[11]
TS 43.020: "Security related network functions".
[12]
TS 33.102: "3G security; Security architecture".
[13]
TS 33.401: "3GPP System Architecture Evolution (SAE); Security architecture".
[14]
TS 33.234: "3G security; Wireless Local Area Network (WLAN) interworking security".
[15]
TS 33.402: "3GPP System Architecture Evolution (SAE); Security aspects of non-3GPP accesses".
[16]
TS 33.203: "3G security; Access security for IP-based services".
[17]
ETSI TS 102 225: "Smart Cards; Secured packet structure for UICC based applications (Release 9)
[18]
ETSI TS 102 226: "Smart cards; Remote APDU structure for UICC based applications (Release 6)"
[19]
TS 31.115: " Secured packet structure for (Universal) Subscriber Identity Module (U)SIM Toolkit applications ".
[20]
TS 31.116: " Remote APDU Structure for (U)SIM Toolkit applications ".
[21]
TS 33.220: "Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture (GBA)".
[22]
TS 33.223: "Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture (GBA) Push function".
[23]
TS 23.682: "Architecture Enhancements to facilitate communications with Packet Data Networks and Applications".
[24]
TS 23.012: "Location management procedures".
[25]
TS 33.224: "Generic Bootstrapping Architecture (GBA) Push Layer".
[26]
TR 23.887: "Machine-Type and other Mobile Data Applications Communications Enhancements"
[27]
ETSI TS 102 690: "Machine-to-Machine communications (M2M); Functional architecture"
[28]
RFC 4186: "Extensible Authentication Protocol Method for Global System for Mobile Communications (GSM) Subscriber Identity Modules (EAP-SIM)".
[29]
RFC 4187: "Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AKA)".
[30]
RFC 5448: "Improved Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AKA')".
[31]
RFC 5191: "Protocol for carrying Authentication for Network Access (PANA)".
[32]
TS 33.320: "Security of Home Node B (HNB) / Home evolved Node B (HeNB)".
[33]
TS 33.328: "IP Multimedia Subsystem (IMS) media plane security".
[34]
TS 24.008: "Mobile radio interface Layer 3 specification; Core network protocols; Stage 3".
[35]
TS 24.301: "Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3".
[36]
ETSI TS 102 484: " Smart Cards; Secure channel between a UICC and an end-point terminal".
[37]
TS 29.109: "Generic Authentication Architecture (GAA); Zh and Zn Interfaces based on the Diameter protocol; Stage 3".
[38]
TS 23.048: "Security mechanisms for the (U)SIM application toolkit; Stage 2".
[39]
TS 23.840: "Study into routeing of MT-SMs via the HPLMN".
[40]
TS 33.187: "Machine-Type (MTC) and other Mobile Data Applications Communications Enhancements".
[41]
FIPS-186-3: "Digital Signature Standard (DSS)".
[42]
ANSI X9.31.American National Standards Institute, ANSI X9.31-1998: "Public Key Cryptography Using Reversible Algorithms for the Financial Services Industry (rDSA)", 1998.
[43]
TS 23.040: "Technical realization of the Short Message Service (SMS)".
[44]
TS 36.323: "Evolved Universal Terrestrial Radio Access (E-UTRA); Packet Data Convergence Protocol (PDCP) specification".
3 Definitions and abbreviations p. 10
3.1 Definitions p. 10
For the purposes of the present document, the terms and definitions given in TR 21.905 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if any, in TR 21.905.
MTC UE authentication:
this is authentication of a MTC Device using GSM AKA, UMTS AKA, EPS AKA, EAP-AKA, or EAP-AKA' as defined in TSs 43.020 [11], 33.102 [12], 33.401[13], 33.234 [14], or 33.402 [15].
MTC IMS authentication:
this is authentication of the MTC Device as an IMS UE by the IMS core as defined in TS 33.203. The need for such a form of authentication in the context of MTC is yet to be determined.
MTC ME authentication:
this is authentication of the platform in the sense of device authentication as used in TS 33.320. The need for such a form of authentication in the context of MTC is yet to be determined, and, if needed, the appropriate mechanism would still have to be selected.
MTC application authentication:
this is authentication between the MTC application on the MTC Device and the corresponding application on the MTC server.
MTC 3GPP access confidentiality / integrity:
this is the feature provided by the confidentiality / integrity mechanisms defined for interfaces between the UE and the 3GPP network in TSs 43.020 [11], 33.102 [12], 33.401 [13], 33.234 [14], or 33.402 [15] including any possible enhancements for MTC purposes.
MTC IMS access confidentiality / integrity:
this is the feature provided by the confidentiality / integrity mechanisms defined for interfaces between the UE and the IMS core in TS 33.203 including any possible enhancements for MTC purposes.
MTC IMS media plane confidentiality / integrity:
this is the feature provided by the confidentiality / integrity mechanisms in TS 33.328 including any possible enhancements for MTC purposes.
MTC application confidentiality / integrity:
this is a feature provided by confidentiality / integrity mechanisms used at the MTC application layer.
MTC Security GW:
Function entity in the operator's security domain, terminating security association(s) for the external interface link between the network and the MTC server.
3.2 Abbreviations p. 11
