Intermediate: Security in Mobile Cellular Networks

1. Security in Mobile Cellular Networks @3g4gUK

2. 3GPP Security Architecture ©3G4G • 3GPP TS 33.102: 3G Security; Security architecture • 3GPP TS 33.401: 3GPP System Architecture Evolution (SAE); Security architecture Five security feature groups are defined. Each of these feature groups meets certain threats and accomplishes certain security objectives: o Network access security (I): the set of security features that provide users with secure access to services, and which in particular protect against attacks on the (radio) access link. o Network domain security (II): the set of security features that enable nodes to securely exchange signalling data, user data (between AN and SN and within AN), and protect against attacks on the wireline network. o User domain security (III): the set of security features that secure access to mobile stations. o Application domain security (IV): the set of security features that enable applications in the user and in the provider domain to securely exchange messages. o Visibility and configurability of security (V): the set of features that enables the user to inform himself whether a security feature is in operation or not and whether the use and provision of services should depend on the security feature.

3. Evolution of 3GPP Security (I) ©3G4G Source: 3GPP - Bengt Sahlin

4. Evolution of 3GPP Security (II) ©3G4G Source: 3GPP - Bengt Sahlin

5. Evolution of 3GPP Security in 5G ©3G4G Source: Huawei 5G Security Architecture White Paper

6. Scope of this Presentation ©3G4G • User Identity Confidentiality • Authentication • Ciphering (Confidentiality) • Integrity Protection • Signalling examples • Sample messages (where available) • Simple examples of hacking of the mobile network

7. Identities ©3G4G • Each Mobile device contain IMEI (International Mobile Equipment Identity) • The SIM card contains IMSI (International Mobile Subscriber Identity) • During the operation, IMSI has to be hidden with help of temporary identities in order to provide: • user identity confidentiality • user location confidentiality • user untraceability

8. Temporary Identities ©3G4G • In 2G/3G: • TMSI (Temporary Mobile Subscriber Identity) • P-TMSI (Packet TMSI) • In 4G/LTE: • GUTI (Globally Unique Temporary UE Identity) GUMMEI - Globally Unique MME Identifier MMEGI - MME Group ID MMEC - MME Code S-TMSI = SAE Temporary Mobile Subscriber Identity M-TMSI = MME Temporary Mobile Subscriber Identity More details: 3GPP TS 23.003

9. What is Authentication? ©3G4G • Authentication is to verify everyone is who they claim to be Hello, I am James Bond Hello, I am the Queen • Authentication is performed via AKA or Authentication and Key Agreement Procedure • In 2G, we only had Handset Authentication whereas in 3G & 4G, we perform Mutual Authentication to verify the handset as well as the base station.

10. 2G, 3G, 4G Simple Network Architecture ©3G4G BSC BTS MSC Voice (PSTN) Network SGSN Data (IP) Network RNC Node BeNodeB MME GGSN Access Network Core Network Air Interface MSUEUE BSSRNS S-GW P-GW 2G 2.5G 3G 4G EPC

11. HLR, HSS & AuC ©3G4G • HLR – Home Location Register • HSS – Home Subscriber Server • AuC – Authentication Center 4G PS Core Network 2G/3G PS Core Network 2G/3G CS Core Network HLR/HSS/AuC DATA Logic Further Reading: 3G4G Blog

12. UICC & SIM ©3G4G 2G SIM UMTS SIM (USIM) IMSI MSISDN SMS Data Address Book IMSI MSISDN MSISDN MSISDN Authentication Data and Keys Multimedia Messaging Config Data IMS SIM (ISIM) Security Keys Home Network Domain Name (URI) Private User Identity y Public User Identity Administrative Data Access Rule Reference Address of P-CSCF Ki

13. The Attach Procedure Signalling ©3G4G UE AN CS CN PS CN Access Network (AN) Core Network (CN) PS CN broadcast information CS CN broadcast information System information messages Hello, I am UE 1 Hello UE1, please use this channel <…> Thanks, I am all setup. Hello, I am UE 1. Want to Attach and let you know that I am now active Hello UE 1, please authenticate yourself against this vector <…> No problems, here is my authentication response <…>

14. The Attach Procedure Signalling ©3G4G UE AN CS CN PS CN I trust UE1, please establish security with it Establish Security using <…> Thanks, all done. Security Established Access Network (AN) Core Network (CN) UE1 is now connected to us Attach Accept. Please use this new temporary identity for now Attach Complete.

15. What is Ciphering? ©3G4G • Ciphering is the process of Encryption & Decryption • Its got nothing to do with compression / decompression • Example of 2G Ciphering

16. Actual Security Procedure in GSM ©3G4G UE BSC MSC/VLR Authentication Request (CKSN, RAND) Authentication Response (SRES) BTS Authentication Request (CKSN, RAND) Authentication Request (CKSN, RAND) Authentication Response (SRES) Authentication Response (SRES) Cipher Mode Command (Kc, A5x) Cipher Mode Complete Cipher Mode Complete Cipher Mode Complete Cipher Mode Command (Kc, A5x) Cipher Mode Command (A5x) CKSN – Cipher Key Sequence Number RAND – Random Number (128 bits) SRES – Signed Response (32 bits) XRES – Expected Response (32 bits) Kc – Ciphering Key (64 bit) A5 – Encryption Algorithm (A5/0 to A5/7) Access Network (AN) Core Network (CN)

17. Actual Security Procedure in GPRS ©3G4G UE BSC SGSN Authentication and Ciphering Request (RAND) Authentication and Ciphering Response (SRES) BTS Authentication and Ciphering Request (RAND) Authentication and Ciphering Request (RAND) Authentication and Ciphering Response (SRES) Authentication and Ciphering Response (SRES) CKSN – Cipher Key Sequence Number RAND – Random Number (128 bits) SRES – Signed Response (32 bits) XRES – Expected Response (32 bits) Kc – Ciphering Key (64 bit) A5 – Encryption Algorithm (A5/0 to A5/7) Access Network (AN) Core Network (CN)

18. Security Architecture Evolution ©3G4G Core Network MS / UE BTS / NodeB BSC / RNC / eNodeB MSC/SGSN/EPC GSM Handset Authentication Ciphering (AN CP, UP) GPRS Handset Authentication + Ciphering (AN CP, UP) AN – Access Network AS – Access Stratum RRC – Radio Resource Control NAS – Non-Access Stratum CP – Control Plane UP – User Plane

19. Fake Cell Towers on Planes to Gather Data From Phones ©3G4G Source: MacRumors

20. What is Integrity Protection? ©3G4G • A 32 bit (4 octet) number is added to certain signalling messages in 3G & 4G to authenticate individual messages • In 3G, Integrity protection is done at RRC layer • In 4G, a Integrity protection happens at PDCP and in NAS.

21. Example of MAC-I in 3G / UMTS ©3G4G • Message Authentication Code MAC-I

22. Example of MAC-I in 4G / LTE ©3G4G

23. UMTS Security Overview ©3G4G Further Reading & References: UMTS Security: A Primer

24. UMTS Security Overview ©3G4G UE RNC VLR / SGSNNodeB Access Network (AN) Core Network (CN) RRC Connection Setup Procedure (Start Value, HFNs and the Security Capability is stored in RNC ) Initial L3 Message (user identity, KSI, etc) Authentication & Key Agreement (AKA) Procedure UIA, UEA decision Security Mode Command (UIAs, IK, UEAs, CK, etc) Select UIA, UEA Generate FRESH Start Integrity

25. UMTS Security Overview ©3G4G UE RNC VLR / SGSNNodeB Access Network (AN) Core Network (CN) Security Mode Complete Verify received message Security Mode Command (CN domain, UIA, UEA, FRESH, Security Capability, etc) Start Integrity Security Mode Complete (selected UIA, UEA)

26. Key things to remember in UMTS Security ©3G4G • Integrity protection is mandatory and Ciphering optional • The user plane (UP) for each domain is protected by its own Ciphering Key while the control plane (CP) is protected by Ciphering & Integrity Keys from the last domain • Ciphering for CS domain happens in MAC as RLC is in transparent mode (TM) • Ciphering for PS domain happens in RLC for acknowledged mode (AM) or unacknowledged mode (UM) • For the first domain • Authentication messages are not Integrity Protected or Ciphered • Security Mode Command is the first Integrity protected message

27. Key things to remember in UMTS Security ©3G4G • For the second domain • Authentication messages are Integrity Protected and optionally ciphered with the first domain keys • Security Mode Command requests modification of Integrity protection and Ciphering for the CP • The new integrity protection and ciphering takes place after the Security Procedure is complete • It is possible that ciphering is enabled for one domain and disabled for another

28. Actual Security Procedure in UMTS – PS ©3G4G UE RNC SGSN Authentication and Ciphering Request Authentication and Ciphering Response (SRES) Node B Authentication and Ciphering Request Authentication and Ciphering Request Authentication and Ciphering Response (SRES) Authentication and Ciphering Response (SRES) Security Mode Command Security Mode Complete Security Mode Complete Security Mode Complete Security Mode Command Security Mode Command Access Network (AN) Core Network (CN)

29. UMTS Security for PS Domain - Authentication ©3G4G DL-DCCH-Message -----> downlinkDirectTransfer DL-DCCH-Message = message = downlinkDirectTransfer = r3 = downlinkDirectTransfer-r3 = rrc-TransactionIdentifier = 0 cn-DomainIdentity = ps-domain nas-Message = 0812013021D5770C6D363E30C364A4078F1BF8ED3A8028106E323B36C46C5555D5760E6E323B6391 Authentication and Ciphering Request -----> Authentication and Ciphering Request PDU: Transaction Identifier or Skip Indicator [4 bits] = 0x0 [ 0 ] Protocol Discriminator [4 bits] = 0x8 - GPRS Mobility Management [ 8 ] Message Type [8 bits] = 0x12 - Authentication and Ciphering Request [ 18 ] IMEISV Request Spare Bits [1 bit] = 0x0 [ 0 ] value [3 bits] = 0x0 - IMEISV Not Requested [ 0 ] Ciphering Algorithm Spare Bits [1 bit] = 0x0 [ 0 ] Type of Algorithm [3 bits] = 0x1 [ 1 ] A & C Reference Number value [4 bits] = 0x3 [ 3 ] Force Standby Spare Bits [1 bit] = 0x0 [ 0 ] value [3 bits] = 0x0 - Force to Standby Not Indicated [ 0 ] Authentication Parameter Rand IE Identifier [8 bits] = 0x21 [ 33 ] Authentication Parameter Rand = 0xD5770C6D363E30C364A4078F1BF8ED3A Ciphering Key Sequence Number IE Identifier [4 bits] = 0x8 [ 8 ] Spare Bits [1 bit] = 0x0 [ 0 ] Key Sequence [3 bits] = 0x0 - Ciphering Key Sequence Number [ 0 ] Authentication Parameter AUTN IE Identifier [8 bits] = 0x28 [ 40 ] IE Length [8 bits] = 0x10 [ 16 ] value = 0x6E323B36C46C5555D5760E6E323B6391 UL-DCCH-Message <----- uplinkDirectTransfer UL-DCCH-Message = message = uplinkDirectTransfer = cn-DomainIdentity = ps-domain nas-Message = 08130322D5760E6E290C323B36C46CAD0D8417F5E335 Authentication and Ciphering Response <----- Authentication and Ciphering Response PDU: Transaction Identifier or Skip Indicator [4 bits] = 0x0 [ 0 ] Protocol Discriminator [4 bits] = 0x8 - GPRS Mobility Management [ 8 ] Message Type [8 bits] = 0x13 - Authentication and Ciphering Response [ 19 ] Spare Half Octet [4 bits] = 0x0 [ 0 ] A & C Reference Number value [4 bits] = 0x3 [ 3 ] Authentication Response Signature IE Identifier [8 bits] = 0x22 [ 34 ] Value = 0xD5760E6E [ 3581283950 ] Authentication Response Parameter IE Identifier [8 bits] = 0x29 [ 41 ] IE Length [8 bits] = 0xC [ 12 ] value = 0x323B36C46CAD0D8417F5E335 Source: 3GPP Conformance Test 8.1.7.1c

30. UMTS Security for PS Domain - Security ©3G4G DL-DCCH-Message -----> securityModeCommand DL-DCCH-Message = integrityCheckInfo = messageAuthenticationCode = 01000111111001000001111101101001 rrc-MessageSequenceNumber = 0 message = securityModeCommand = r3 = securityModeCommand-r3 = rrc-TransactionIdentifier = 0 securityCapability = cipheringAlgorithmCap = 0000000000000011 integrityProtectionAlgorithmCap = 0000000000000010 cipheringModeInfo = cipheringModeCommand = startRestart = uea1 rb-DL-CiphActivationTimeInfo = SEQUENCE OF RB-ActivationTimeInfo RB-ActivationTimeInfo(1) = rb-Identity = 1 rlc-SequenceNumber = 0 RB-ActivationTimeInfo(2) = rb-Identity = 2 rlc-SequenceNumber = 2 RB-ActivationTimeInfo(3) = rb-Identity = 3 rlc-SequenceNumber = 3 RB-ActivationTimeInfo(4) = rb-Identity = 4 rlc-SequenceNumber = 0 integrityProtectionModeInfo = integrityProtectionModeCommand = startIntegrityProtection = integrityProtInitNumber = 00000000000000000000000000000000 integrityProtectionAlgorithm = uia1 cn-DomainIdentity = ps-domain ue-SystemSpecificSecurityCap = SEQUENCE OF InterRAT-UE-SecurityCapability InterRAT-UE-SecurityCapability(1) = gsm = gsmSecurityCapability = 0000011 UL-DCCH-Message <----- securityModeComplete UL-DCCH-Message = integrityCheckInfo = messageAuthenticationCode = 10000000110110110111011001011001 rrc-MessageSequenceNumber = 1 message = securityModeComplete = rrc-TransactionIdentifier = 0 ul-IntegProtActivationInfo = rrc-MessageSequenceNumberList = SEQUENCE OF RRC-MessageSequenceNumber RRC-MessageSequenceNumber(1) = 0 RRC-MessageSequenceNumber(2) = 0 RRC-MessageSequenceNumber(3) = 0 RRC-MessageSequenceNumber(4) = 0 RRC-MessageSequenceNumber(5) = 0 rb-UL-CiphActivationTimeInfo = SEQUENCE OF RB-ActivationTimeInfo RB-ActivationTimeInfo(1) = rb-Identity = 1 rlc-SequenceNumber = 0 RB-ActivationTimeInfo(2) = rb-Identity = 2 rlc-SequenceNumber = 8 RB-ActivationTimeInfo(3) = rb-Identity = 3 rlc-SequenceNumber = 5 RB-ActivationTimeInfo(4) = rb-Identity = 4 rlc-SequenceNumber = 0 Source: 3GPP Conformance Test 8.1.7.1c

31. Actual Security Procedure in UMTS - CS ©3G4G UE RNC MSC/VLR Authentication Request Authentication Response (SRES) Node B Authentication Request Authentication Request Authentication Response (SRES) Authentication Response (SRES) Security Mode Command Security Mode Complete Security Mode Complete Security Mode Complete Security Mode Command Security Mode Command Access Network (AN) Core Network (CN)

32. UMTS Security for CS Domain on top of PS domain - Authentication ©3G4G DL-DCCH-Message -----> downlinkDirectTransfer DL-DCCH-Message = integrityCheckInfo = messageAuthenticationCode = 10001011101111001101101110110000 rrc-MessageSequenceNumber = 1 message = downlinkDirectTransfer = r3 = downlinkDirectTransfer-r3 = rrc-TransactionIdentifier = 0 cn-DomainIdentity = cs-domain nas-Message = 051200D5770C6D363E30C364A4078F1BF8ED3A20106E323B36C46C5555D5760E6E323B6391 Authentication Request -----> Authentication Request PDU: Transaction Identifier or Skip Indicator [4 bits] = 0x0 [ 0 ] Protocol Discriminator [4 bits] = 0x5 - Mobility Management [ 5 ] Message Type [8 bits] = 0x12 - Authentication Request [ 18 ] Spare Half Octet [4 bits] = 0x0 [ 0 ] Ciphering Key Sequence Number Spare Bits [1 bit] = 0x0 [ 0 ] Key Sequence [3 bits] = 0x0 - Ciphering Key Sequence Number [ 0 ] Authentication Parameter Rand = 0xD5770C6D363E30C364A4078F1BF8ED3A Authentication Parameter AUTN IE Identifier [8 bits] = 0x20 [ 32 ] IE Length [8 bits] = 0x10 [ 16 ] value = 0x6E323B36C46C5555D5760E6E323B6391 UL-DCCH-Message <----- uplinkDirectTransfer UL-DCCH-Message = integrityCheckInfo = messageAuthenticationCode = 00101110010111100100100101111011 rrc-MessageSequenceNumber = 3 message = uplinkDirectTransfer = cn-DomainIdentity = cs-domain nas-Message = 0514D5760E6E210C323B36C46CAD0D8417F5E335 Authentication Response <----- Authentication Response PDU: Transaction Identifier or Skip Indicator [4 bits] = 0x0 [ 0 ] Protocol Discriminator [4 bits] = 0x5 - Mobility Management [ 5 ] Message Type [8 bits] = 0x14 - Authentication Response [ 20 ] Authentication Response Signature Value = 0xD5760E6E [ 3581283950 ] Authentication Response Parameter IE Identifier [8 bits] = 0x21 [ 33 ] IE Length [8 bits] = 0xC [ 12 ] value = 0x323B36C46CAD0D8417F5E335 Source: 3GPP Conformance Test 8.1.7.1c

33. UMTS Security for CS Domain on top of PS domain - Security ©3G4G DL-DCCH-Message -----> securityModeCommand DL-DCCH-Message = integrityCheckInfo = messageAuthenticationCode = 11000100010100111100000101111100 rrc-MessageSequenceNumber = 3 message = securityModeCommand = r3 = securityModeCommand-r3 = rrc-TransactionIdentifier = 0 securityCapability = cipheringAlgorithmCap = 0000000000000011 integrityProtectionAlgorithmCap = 0000000000000010 cipheringModeInfo = cipheringModeCommand = startRestart = uea1 rb-DL-CiphActivationTimeInfo = SEQUENCE OF RB-ActivationTimeInfo RB-ActivationTimeInfo(1) = rb-Identity = 1 rlc-SequenceNumber = 0 RB-ActivationTimeInfo(2) = rb-Identity = 2 rlc-SequenceNumber = 11 RB-ActivationTimeInfo(3) = rb-Identity = 3 rlc-SequenceNumber = 8 RB-ActivationTimeInfo(4) = rb-Identity = 4 rlc-SequenceNumber = 0 integrityProtectionModeInfo = integrityProtectionModeCommand = modify = dl-IntegrityProtActivationInfo = rrc-MessageSequenceNumberList = SEQUENCE OF RRC-MessageSequenceNumber RRC-MessageSequenceNumber(1) = 0 RRC-MessageSequenceNumber(2) = 0 RRC-MessageSequenceNumber(3) = 3 RRC-MessageSequenceNumber(4) = 2 RRC-MessageSequenceNumber(5) = 0 integrityProtectionAlgorithm = uia1 cn-DomainIdentity = cs-domain ue-SystemSpecificSecurityCap = SEQUENCE OF InterRAT-UE-SecurityCapability InterRAT-UE-SecurityCapability(1) = gsm = gsmSecurityCapability = 0000011 UL-DCCH-Message <----- securityModeComplete UL-DCCH-Message = integrityCheckInfo = messageAuthenticationCode = 01011001010010101011010110101100 rrc-MessageSequenceNumber = 3 message = securityModeComplete = rrc-TransactionIdentifier = 0 ul-IntegProtActivationInfo = rrc-MessageSequenceNumberList = SEQUENCE OF RRC-MessageSequenceNumber RRC-MessageSequenceNumber(1) = 5 RRC-MessageSequenceNumber(2) = 1 RRC-MessageSequenceNumber(3) = 3 RRC-MessageSequenceNumber(4) = 4 RRC-MessageSequenceNumber(5) = 1 rb-UL-CiphActivationTimeInfo = SEQUENCE OF RB-ActivationTimeInfo RB-ActivationTimeInfo(1) = rb-Identity = 1 rlc-SequenceNumber = 0 RB-ActivationTimeInfo(2) = rb-Identity = 2 rlc-SequenceNumber = 11 RB-ActivationTimeInfo(3) = rb-Identity = 3 rlc-SequenceNumber = 11 RB-ActivationTimeInfo(4) = rb-Identity = 4 rlc-SequenceNumber = 0 Source: 3GPP Conformance Test 8.1.7.1c

34. UMTS Security for CS Domain on top of PS domain – Voice Radio Bearers Setup ©3G4G DL-DCCH-Message -----> radioBearerSetup DL-DCCH-Message = integrityCheckInfo = messageAuthenticationCode = 10100011001100001001101011010110 rrc-MessageSequenceNumber = 4 message = radioBearerSetup = r3 = radioBearerSetup-r3 = rrc-TransactionIdentifier = 0 activationTime = 184 rrc-StateIndicator = cell-DCH rab-InformationSetupList = SEQUENCE OF RAB-InformationSetup RAB-InformationSetup(1) = rab-Info = rab-Identity = gsm-MAP-RAB-Identity = 00000001 cn-DomainIdentity = cs-domain re-EstablishmentTimer = useT314 rb-InformationSetupList = SEQUENCE OF RB-InformationSetup RB-InformationSetup(1) = rb-Identity = 10 rlc-InfoChoice = rlc-Info = ul-RLC-Mode = ul-TM-RLC-Mode = segmentationIndication = FALSE dl-RLC-Mode = dl-TM-RLC-Mode = segmentationIndication = FALSE rb-MappingInfo = SEQUENCE OF RB-MappingOption RB-MappingOption(1) = ul-LogicalChannelMappings = oneLogicalChannel = ul-TransportChannelType = dch = 1 rlc-SizeList = configured = NULL mac-LogicalChannelPriority = 6 dl-LogicalChannelMappingList = SEQUENCE OF DL-LogicalChannelMapping DL-LogicalChannelMapping(1) = dl-TransportChannelType = dch = 6 RB-InformationSetup(2) = rb-Identity = 11 … UL-DCCH-Message <----- radioBearerSetupComplete UL-DCCH-Message = integrityCheckInfo = messageAuthenticationCode = 10101010000100111100011111001010 rrc-MessageSequenceNumber = 4 message = radioBearerSetupComplete = rrc-TransactionIdentifier = 0 start-Value = 00000000000000000010 count-C-ActivationTime = 168 Source: 3GPP Conformance Test 8.1.7.1c

35. Security Architecture Evolution ©3G4G Core Network MS / UE BTS / NodeB BSC / RNC / eNodeB MSC/SGSN/EPC GSM Handset Authentication Ciphering (AN CP, UP) GPRS Handset Authentication + Ciphering (AN CP, UP) UMTS Mutual Authentication Ciphering (RRC / AN CP, UP) + Signalling Integrity (RRC) AN – Access Network AS – Access Stratum RRC – Radio Resource Control NAS – Non-Access Stratum CP – Control Plane UP – User Plane IPSec (Optional)

36. Hacking The Femtocells - UMTS ©3G4G More Info: Femto Hacking in UMTS and LTE

38. Key Hierarchy in LTE / E-UTRAN ©3G4G Picture Source: RedYoda 3GPP Spec Reference: TS 33.401 K - Master key CK - Cipher Key IK - Integrity Key KASME - Key-Access Security Management Entity KNASenc - Key-NAS encryption KNASint - Key-NAS integrity KeNB - Key-eNodeB NH - Next Hop KUPint - Key-User Plane integrity KUPenc - Key-User Plane encryption KRRCint - Key-Radio Resource Control integrity KRRCenc - Key-Radio Resource Control encryption

39. EPS Authentication and Key Agreement (EPS-AKA) procedure ©3G4G Picture Source: RedYoda 3GPP Spec Reference: TS 33.401 AUTN - Authentication Token RAND - A 128 bit random number SQN - 48 bit sequence number RES - Response XRES - Expected Response KDF - Key Derivation Function KSI - Key Set Identifier SN Id - Serving Network Id K - Master key CK - Cipher Key IK - Integrity Key KASME - Key-Access Security Management Entity

40. Actual Security Procedure in LTE ©3G4G UE eNodeB MME Authentication Request Authentication Response (SRES) Authentication Request Authentication Response (SRES) Security Mode Command NAS: Security Mode Complete Security Mode Complete NAS: Security Mode Command Access Network (AN) Core Network (CN) RRC: Security Mode Complete RRC: Security Mode Command

41. LTE Security Signaling - Authentication ©3G4G Authentication Request PDU Security header type [4 bits] = 0x0 [ 0 ] Protocol Discriminator [4 bits] = 0x7 [ 7 ] Message Type [8 bits] = 0x52 - Authentication Request [ 82 ] Spare Half Octet [4 bits] = 0x0 [ 0 ] NAS key set identifierASME Type of security context flag [1 bit] = 0x0 [ 0 ] ksi [3 bits] = 0x0 [ 0 ] Authentication Parameter Rand Authentication Parameter Rand = 0xA3DE0C6D363E30C364A4078F1BF8D577 Authentication Parameter AUTN IE Length [8 bits] = 0x10 [ 16 ] value = 0x6E323B36C46C5555A3DF0E6E323B6391 075200A3DE0C6D363E30C364A4078F1BF8D577106E323B36C46C5555A3DF0E6E323B6391 DL-DCCH-Message dlInformationTransfer DL-DCCH-Message = message = c1 = dlInformationTransfer = rrc-TransactionIdentifier = 0 criticalExtensions = c1 = dlInformationTransfer-r8 = dedicatedInfoType = dedicatedInfoNAS = 075200A3DE0C6D363E30C364A4078F1BF8D577106E323B36C46C5555A3DF0E6E323B6391 0801203A90051EF06369B1F1861B25203C78DFC6ABB8837191D9B62362AAAD1EF8737191DB1C88 UL-DCCH-Message ulInformationTransfer UL-DCCH-Message = message = c1 = ulInformationTransfer = criticalExtensions = c1 = ulInformationTransfer-r8 = dedicatedInformationType = dedicatedInfoNAS = 075308A3DF0E6E323B36C4 480160EA61147BE1CDC64766D880 Authentication Response Authentication Response PDU Security header type [4 bits] = 0x0 [ 0 ] Protocol Discriminator [4 bits] = 0x7 [ 7 ] Message Type [8 bits] = 0x53 - Authentication Response [ 83 ] Authentication response parameter IE Length [8 bits] = 0x8 [ 8 ] Authentication response parameter information = 0xA3DF0E6E323B36C4 075308A3DF0E6E323B36C4 Source: 3GPP Conformance Test 8.1.2.1

42. LTE Security Signaling – NAS Security 1 ©3G4G Security Mode Command Security Mode Command PDU Security Mode Command PDU [1]Security header type [4 bits] = 0x0 [ 0 ] Protocol Discriminator [4 bits] = 0x7 [ 7 ] Message Type [8 bits] = 0x5D - Security Mode Command [ 93 ] Selected NAS security algorithms Spare Bits [1 bit] = 0x0 [ 0 ] Type of ciphering algorithm [3 bits] = 0x0 [ 0 ] Spare Padding [1 bit] = 0x0 [ 0 ] Type of integrity protection algorithm [3 bits] = 0x1 [ 1 ] Spare Half Octet [4 bits] = 0x0 [ 0 ] NAS key set identifierASME Type of security context flag [1 bit] = 0x0 [ 0 ] ksi [3 bits] = 0x0 [ 0 ] Replayed UE security capabilities IE Length [8 bits] = 0x2 [ 2 ] eea0_128 [1 bit] = 0x1 [ 1 ] eea1_128 [1 bit] = 0x1 [ 1 ] eea2_128 [1 bit] = 0x0 [ 0 ] eea3 [1 bit] = 0x0 [ 0 ] eea4 [1 bit] = 0x0 [ 0 ] eea5 [1 bit] = 0x0 [ 0 ] eea6 [1 bit] = 0x0 [ 0 ] eea7 [1 bit] = 0x0 [ 0 ] Spare Bits [1 bit] = 0x1 [ 1 ] eia1_128 [1 bit] = 0x1 [ 1 ] eia2_128 [1 bit] = 0x0 [ 0 ] eia3 [1 bit] = 0x0 [ 0 ] eia4 [1 bit] = 0x0 [ 0 ] eia5 [1 bit] = 0x0 [ 0 ] eia6 [1 bit] = 0x0 [ 0 ] eia7 [1 bit] = 0x0 [ 0 ] 075D010002C0C0 Continued… Security Protected NAS Message Security Protected NAS Message PDU Security header type [4 bits] = 0x3 [ 3 ] Protocol Discriminator [4 bits] = 0x7 [ 7 ] MAC = 0x0B4DAFA8 [ 189640616 ] Sequence Number = 0x00 [ 0 ] NAS message = 0x075D010002C0C0 370B4DAFA800075D010002C0C0 DL-DCCH-Message dlInformationTransfer DL-DCCH-Message = message = c1 = dlInformationTransfer = rrc-TransactionIdentifier = 0 criticalExtensions = c1 = dlInformationTransfer-r8 = dedicatedInfoType = dedicatedInfoNAS = 370B4DAFA800075D010002C0C0 080069B85A6D7D40003AE80800160600 Source: 3GPP Conformance Test 8.1.2.1

43. LTE Security Signaling – NAS Security 2 ©3G4G UL-DCCH-Message ulInformationTransfer UL-DCCH-Message = message = c1 = ulInformationTransfer = criticalExtensions = c1 = ulInformationTransfer-r8 = dedicatedInformationType = dedicatedInfoNAS = 4794E585C000075E 480108F29CB0B80000EBC0 Security Protected NAS Message Security Protected NAS Message PDU Security header type [4 bits] = 0x4 [ 4 ] Protocol Discriminator [4 bits] = 0x7 [ 7 ] MAC = 0x94E585C0 [ 2498069952 ] Sequence Number = 0x00 [ 0 ] NAS message = 0x075E [ 1886 ] 4794E585C000075E Security Mode Complete Security Mode Complete PDU Security header type [4 bits] = 0x0 [ 0 ] Protocol Discriminator [4 bits] = 0x7 [ 7 ] Message Type [8 bits] = 0x5E - Security Mode Complete [ 94 ] 075E Security header type (octet 1) 8 7 6 5 0 0 0 0 Plain NAS message, not security protected Security protected NAS message: 0 0 0 1 Integrity protected 0 0 1 0 Integrity protected and ciphered 0 0 1 1 Integrity protected with new EPS security context (NOTE 1) 0 1 0 0 Integrity protected and ciphered with new EPS security context (NOTE 2) Non-standard L3 message: 1 1 0 0 Security header for the SERVICE REQUEST message 1 1 0 1 These values are not used in this version of the protocol. to If received they shall be interpreted as '1100'. (NOTE 3) 1 1 1 1 All other values are reserved. NOTE 1: This codepoint may be used only for a SECURITY MODE COMMAND message. NOTE 2: This codepoint may be used only for a SECURITY MODE COMPLETE message. NOTE 3: When bits 7 and 8 are set to '11', bits 5 and 6 can be used for future extensions of the SERVICE REQUEST message. Table 9.3.1: Security header type 3GPP TS 24.301 V10.10.0 (2013-03) Source: 3GPP Conformance Test 8.1.2.1

44. LTE Security Signaling – RRC Security ©3G4G DL-DCCH-Message securityModeCommand DL-DCCH-Message = message = c1 = securityModeCommand = rrc-TransactionIdentifier = 0 criticalExtensions = c1 = securityModeCommand-r8 = securityConfigSMC = securityAlgorithmConfig = cipheringAlgorithm = eea0 integrityProtAlgorithm = eia1 300010 PDCPDataReqPDU PLANE = 1 (Control) SeqNum = 3 Data Packet = 30 00 10 65 3E 8C... 03300010653E8C00 PDCPDataIndPDU PLANE = 1 (Control) SeqNum = 4 Data Packet = 28 00 CC E1 31 D1 042800CCE131D1 UL-DCCH-Message securityModeComplete UL-DCCH-Message = message = c1 = securityModeComplete = rrc-TransactionIdentifier = 0 criticalExtensions = securityModeComplete-r8 = 2800 Source: 3GPP Conformance Test 8.1.2.1

45. Mapped Security (Applicable for PS Only) ©3G4G 1. No need for Authentication 2. Map security keys from previous Authentication LTE2G/3G HLR/HSS/AuC DATA Logic 1. Performs Authentication 2. Performs security Handover or Cell Re-selection ‘Native’ UTRAN to ‘Mapped’ E-UTRAN

46. Mapped Security (Applicable for PS Only) ©3G4G ‘Native’ E-UTRAN to ‘Mapped’ UTRAN 1. No need for Authentication 2. Map security keys from previous Authentication LTE2G/3G HLR/HSS/AuC DATA Logic 1. Performs Authentication 2. Performs security Handover or Cell Re-selection More details

47. Security Architecture Evolution ©3G4G Core Network MS / UE BTS / NodeB BSC / RNC / eNodeB MSC/SGSN/EPC GSM Handset Authentication Ciphering (AN CP, UP) GPRS Handset Authentication + Ciphering (AN CP, UP) UMTS Mutual Authentication Ciphering (RRC / AN CP, UP) + Signalling Integrity (RRC) LTE Mutual Authentication Ciphering (RRC / AN CP, UP) + Signalling Integrity (RRC) IPSec (Optional) Ciphering (NAS) + Signalling Integrity (NAS) AN – Access Network AS – Access Stratum RRC – Radio Resource Control NAS – Non-Access Stratum CP – Control Plane UP – User Plane IPSec (Optional)

48. Summary of Algorithms for 2G, 3G & 4G ©3G4G GSM GPRS UMTS LTE Authentication Algorithms GSM Milenage GSM Milenage Milenage TUAK Milenage TUAK Integrity Algorithms UIA0 – NULL UIA1 – Kasumi UIA2 – Snow3G EIA0 – NULL EIA1 – Snow3G EIA2 – AES EIA3 – ZUC Ciphering Algorithms A5/1 A5/2 A5/3 A5/4 GEA3 GEA4 UEA0 - NULL UEA1 – Kasumi UEA2 – Snow3G EEA0 – NULL EEA1 – Snow3G EEA2 – AES EEA3 – ZUC GSM Milenage - 3GPP TS 55.205, Milenage - 3GPP TS 35.206, TUAK - 3GPP TS 35.231, A5/3 & GEA3 - 3GPP TS 55.216, A5/4 & GE4 - 3GPP TS 55.226 For other specifications see GSMA Security Algorithms

49. Further Reading Material ©3G4G • 3GPP: Confidentiality Algorithms • GSMA: Security Algorithms • Netmanias • LTE Security I: Concept and Authentication • LTE Security II: NAS and AS Security • 3G4G Website • GSM, GPRS and EDGE • 3G/UMTS Tutorials • 3GPP LTE/SAE • Security in Mobile Cellular Systems • EventHelix: • GSM, LTE, UMTS and IMS Call Flows • LTE Security: Encryption and Integrity Protection Call Flows

50. Hacking: Papers, Talks, Materials ©3G4G • The SS7 flaws that allows hackers to snoop on your calls and SMS • Video: LTE & IMSI Catcher Myths - by Ravishankar Borgaonkar & Altaf Shaik & N. Asokan & Valtteri Niemi & Jean-Pierre Seifert • Video: Understanding IMSI Privacy - By Ravishankar Borgaonkar and Swapnil Udar • Video: Femtocells: A Poisonous Needle in the Operator's Hay Stack - Ravishankar Borgaonkar, Kevin Redon and Nico Golde • Breaking Band - reverse engineering and exploiting the shannon baseband • Huawei: Security Advisory - UE Measurement Leak Vulnerability in Huawei P8 Phones • LTE protocol exploits – IMSI catchers, blocking devices and location leaks - Roger Piqueras Jover • WiFi-Based IMSI Catcher • ‘Small Cells’ and the City • Long Term Exploitation: “Baseband security? 4Get about it.”

51. 3GPP Specifications ©3G4G • 3GPP TS 33.102: 3G Security; Security architecture • 3GPP TS 33.401: 3GPP System Architecture Evolution (SAE); Security architecture • 3GPP TS 23.401: General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) access • 3GPP TS 36.323: E-UTRA; Packet Data Convergence Protocol (PDCP) specification • 3GPP TS 25.331: UTRA RRC Protocol Specification • 3GPP TS 36.331:E-UTRA RRC Protocol specification • 3GPP TS 24.008: Mobile Radio Interface Layer 3 specification; Core Network Protocols; Stage 3 • 3GPP TS 24.301: Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3

52. Thank You To learn more, visit: 3G4G Website – http://www.3g4g.co.uk/ 3G4G Blog – http://blog.3g4g.co.uk/ 3G4G Small Cells Blog – http://smallcells.3g4g.co.uk/ Operator Watch - http://operatorwatch.3g4g.co.uk/ Follow us on Twitter: https://twitter.com/3g4gUK Follow us on Facebook: https://www.facebook.com/3g4gUK/ Follow us on Linkedin: https://www.linkedin.com/company/3g4g Follow us on Slideshare: https://www.slideshare.net/3G4GLtd Follow us on Youtube: https://www.youtube.com/3G4G5G Follow us on Storify: https://storify.com/3g4gUK ©3G4G