Content for TR 33.868 Word version: 12.1.0
4 Overview of Security Architecture
5 Description of envisioned security aspects of Machine-Type and other Mobile Data Applications Communications Enhancements
6 General Security Requirement
7 Conclusions
A Key Issues and Solutions deferred from Rel-12
$ Change History
4 Overview of Security Architecture p. 13
5 Description of envisioned security aspects of Machine-Type and other Mobile Data Applications Communications Enhancements p. 15
5.1 Device Triggering Enhancements p. 15
5.1.1 Issue Details p. 15
5.1.2 Threats p. 15
5.1.3 Security Requirements p. 16
5.1.3.0 General p. 16
5.1.3.1 SMS based triggering p. 16
5.1.3.2 NAS Signalling based triggering p. 17
5.1.3.3 User Plane based triggering p. 17
5.1.4 Solutions p. 17
5.1.4.0 General p. 17
5.1.4.1 For offline Device Triggering: p. 17
5.1.4.2 For online Device Triggering p. 18
5.1.4.2.1 General description p. 18
5.1.4.2.2 Solution 1: Triggering via NAS signalling p. 18
5.1.4.2.3 Solution 2: Solution for fake SMS triggering from normal UE in the same network as UE used only for MTC p. 19
5.1.4.2.4 Solution 3: Solutions protecting SMS triggering p. 20
5.1.4.2.5 Solution 4: Triggering via User plane p. 21
5.1.4.2.6 Solution 5: Using GBA Push to secure Device triggering procedure over Tsp and T4 p. 21
5.1.4.2.7 Solution 6: Secure Trigger Delivery with Security Association between MTC-IWF and UE p. 24
5.1.4.2.8 Solution 7: Using regular GBA and GPL to secure Device triggering procedure over Tsp and T4 p. 24
5.1.4.2.9 Solution 8: Using GBA Push to secure Device triggering procedure over Tsms p. 26
5.1.4.2.10 Impacts on existing nodes or functionality p. 28
5.1.5 Evaluation p. 29
5.2 Secure Connection p. 32
5.2.1 Issue Details p. 32
5.2.2 Threats p. 32
5.2.3 Security Requirements p. 32
5.2.4 Solutions p. 32
5.2.4.1 GBA based solution p. 32
5.2.4.1.1 UE initiated Secure Connection based on GBA p. 32
5.2.4.1.2 Network initiated Secure Connection based on GBApush p. 34
5.2.4.2 EAP based solution p. 36
5.2.5 Evaluation p. 38
5.3 External Interface Security p. 40
5.3.1 Issue Details p. 40
5.3.2 Threats p. 40
5.3.3 Security requirements p. 41
5.3.4 Solutions p. 42
5.3.4.0 General p. 42
5.3.4.1 Tsp interface security for MTC Server outside the operator domain p. 42
5.3.4.2 MTC Server inside the operator domain p. 43
5.3.5 Evaluation p. 43
5.4 Restricting the USIM to specific UEs p. 43
5.4.1 Issues Details p. 43
5.4.2 Threats p. 44
5.4.3 Security Requirements p. 44
5.4.4 Solutions p. 44
5.4.4.0 General p. 44
5.4.4.1 User Equipment-based pairings p. 44
5.4.4.1.0 General p. 44
5.4.4.1.1 Secure Channel pairing p. 44
5.4.4.1.2 USAT application pairing p. 45
5.4.4.1.3 PIN presentation pairing p. 46
5.4.4.2 Network based pairings p. 46
5.4.5 Evaluation p. 62
5.5 Privacy concern p. 67
5.5.1 Issue Details p. 67
5.5.2 Threats p. 68
5.5.3 Security Requirements p. 68
5.5.4 Solutions p. 68
5.5.5 Evaluation p. 70
5.6 UE Power Consumption Optimizations p. 70
5.6.1 Issue Details p. 70
5.6.2 Threats p. 70
5.6.3 Security Requirements p. 70
5.6.4 Solutions p. 70
5.7 Security of Small Data Transmission p. 71
5.7.1 Issue Details p. 71
5.7.2 Threats p. 71
5.7.2.1 Small data encapsulation in the NAS p. 71
5.7.2.2 Small data fast path in the user plane p. 72
5.7.3 Security requirements p. 74
5.7.4 Solutions p. 75
5.7.4.1 Small data transfer in NAS PDU p. 75
5.7.4.1.1 General description p. 75
5.7.4.1.2 Solution 1: Partly ciphering p. 75
5.7.4.1.3 Analysis of NAS signalling key management in LTE p. 77
5.7.4.2 Small Data Fast Path in User Plane p. 78
5.7.4.2.0 General p. 78
5.7.4.2.1 Termination point of security for small data in the network p. 78
5.7.4.2.2 General description of proposed solution p. 79
5.7.4.2.3 Small data transfer security context p. 79
5.7.4.2.3A Small data transfer security protocol p. 81
5.7.4.2.4 Small data transfer security context establishment at Attach procedure p. 82
5.7.4.2.5 UE initiated uplink (UL) small data p. 84
5.7.4.2.6 Network initiated downlink (DL) small data p. 85
5.7.4.2.7 S-GW relocation p. 86
5.7.4.2.8 Switching between small data fast path and regular UP p. 87
5.7.4.3 Connectionless Data Transmission solution p. 87
5.7.4.3.0 General p. 87
5.7.4.3.1 UE Initial Access and Token Allocation p. 87
5.7.4.3.2 Use of a Token for Subsequent Network Access p. 89
5.7.4.3.3 Cached Context Invalidation and Deletion p. 91
5.7.4.3.4 Token Lifetime Management. p. 91
5.7.4.3.5 Threat scenarios p. 92
5.7.4.4 MTC-IWF based Secure Solution for Small data transmission p. 93
5.7.4.4.1 Background and requirements p. 93
5.7.4.4.2 Potential solutions p. 93
5.7.4.4.3 Solution overview p. 93
5.7.4.4.4 Detailed Solution p. 94
5.7.4.5 Connectionless Data Transmission Solution Using Separate Security Context p. 100
5.7.6 Evaluation p. 104
5.7.6.1 General p. 104
5.7.6.2 Connectionless Data Transmission Solution p. 104
5.7.6.3 MTC-IWF based Secure Solution for Small data transmission p. 104
5.7.6.3.0 General p. 104
5.7.6.3.1 Benefits p. 104
5.7.6.3.2 Impacts to existing system p. 106
5.7.6.3.3 Open issues p. 106
5.7.6.4 Security Solutions of Small Data Transfer in NAS PDU p. 106
5.7.6.5 Security Solution of Small Data Fast Path in User Plane p. 106
5.7.6.6 Security Evaluation on Different Solutions of Small Data Optimization p. 107
5.7.6.7 Overall Evaluation p. 108
6 General Security Requirement p. 109
7 Conclusions p. 109
7.1 Rel-11 Conclusions p. 109
7.2 Rel-12 Conclusions p. 109
A Key Issues and Solutions deferred from Rel-12 p. 110
A.1 Time controlled p. 110
A.1.1 Issue Details p. 110
A.1.2 Threats p. 110
A.1.3 Security requirements p. 110
A.1.4 Solutions p. 110
A.1.5 Evaluation p. 111
A.2 Low Mobility p. 111
A.2.1 Issue Details p. 111
A.2.2 Threats p. 111
A.3 Security of UE Configuration p. 111
A.3.1 Issues Details p. 111
A.3.2 Threats p. 111
A.3.3 Security Requirements p. 111
A.3.4 Solutions p. 112
A.3.4.1 ME Configuration p. 112
A.3.4.2 UICC Configuration p. 112
A.3.5 Evaluation p. 113
A.4 Reject message without integrity protection p. 113
A.5 Congestion Control p. 113
A.5.1 Issue Details p. 113
A.5.2 Threats p. 113
A.5.3 Security requirements p. 113
A.5.4 Solutions p. 114
A.5.5 Evaluation p. 114
A.6 Group Based Feature p. 114
A.6.1 Issue Details p. 114
A.6.2 Threats p. 115
A.6.3 Security Requirements p. 115
A.6.4 Solutions p. 115
A.6.4.1 Solution 1: Application layer based protection p. 115
A.6.4.2 Solution 2: Network based protection for cell broadcast p. 115
A.6.4.3 Solution 3: MBMS based method p. 116
A.6.4.4 Solution 4: Authentication of UEs of a group p. 117
A.6.5 Evaluation p. 117
A.7 Monitoring p. 117
A.7.1 Issue Details p. 117
A.7.2 Threats p. 117
A.7.3 Security Requirements p. 117
A.7.4 Solutions p. 118
A.7.4.1 Location Management p. 118
A.7.5 Evaluation p. 118
$ Change History p. 119
