3GPP TS31103 Introdution

1. TS31.103 ISIM
INTRODUCTION
Kimmy Yang

2. Outline
• Introduction
• ISIM Structure
• ISIM Initialisation
• ISIM Security Mechanism
• IMS AKA security
• GBA_U security
• HTTP Digest security
• Other : No ISIM Provide

3. Introduction
• ISIM is the new module in UICC.
• ISIM stores IMS-specific subscriber data mainly provisioned
by an IMS operator.
• The store data can be divide into six groups:
Security keys
Private user
identity
Public user
identity
Home network
domain name
P-CSCF
address
Administrative
data

4. ISIM Structure (1/7)

5. ISIM Structure (2/7)
• Security Keys
• EF-GBABP : GBA Bootstrapping Parameter
• Store B-TID and RAND
• EF-GBANL : GBA NAF List
• NAF-ID and B-TID pair
• EF-NAFKCA
• NAF key address

6. ISIM Structure (3/7)
• Private User Identity
• EF-IMPI
• The ID using for Register, Authorisation, Administration,
Charging to IMS
• Store in HSS and provide from operator
• NAI format
Ex. username@operator.com
• Public User Identity
• EF-IMPU
• Use by request communication to other user.
• Contain one or more record in ISIM, but will store at least
one IMPU for emergency registration.
• SIP/TEL URI format
• Ex. sip:kimmy@fih.com or tel:77654321

7. ISIM Structure (4/7)
• Home Network Domain Name
• EF-DOMAIN
• This used to find the home network during the
registration procedure.
• They can only be one home network domain name URI
stored in ISIM.
• Ex.
• Public user identify : username@operator.com
• Home domain name : operator.com

8. ISIM Structure (5/7)
• P-CSCF Address
• EF-P-CSCF
• This EF contains one or more Proxy Call Session Control
Function addresses .
• The first record in the EF shall be considered to be of the
highest priority. The last record in the EF shall be
considered to be the lowest priority.

9. ISIM Structure (6/7)
• ISIM Service Table
• EF-IST
• This EF indicates which optional services are available.
• Mandatory :Services n°1 to n°8

10. ISIM Structure (7/7)
• EF-AD (Administrative Data)
• EF-ARR (Access Rule Reference)
• EF-SMS
• EF-UICCIARI

11. ISIM Initialisation
SELECT EF-PL from
other application or
using Default
Verify PIN Code
SELECT EF-AD
Request
IMPU/IMPI/SIP
Domain/Service
Table/P-CSCF
address
ISIM
application
closure
Using STATUS cmd
to terminate session
Idle Mode
presence detection
using STATUS cmd

12. ISIM Security Mechanism (1/2)
• The function can be used in several different
contexts:
• IMS AKA security : SIP-based services
• GBA_U security : HTTP application
• HTTP Digest security

13. ISIM Security Mechanism (2/2)

14. IMS AKA security (1/4)
• IMS AKA security context during the procedure for
authenticating the ISIM to its.
• The function shall be used whenever an IMS context shall
be established, i.e. when the terminal receives a
challenge from the IMS.
• UE will first send REGISTER command with null
authentication value.

15. IMS AKA security (2/4)
• Using AKA Algorithm from HSS.
• AuC which locate in HSS will generate SQN and RAND.
• HSS will using shared secret key K which also stored in
UICC.
• AK = f5K (RAND)
• MAC = f1K (SQN || RAND || AMF)
• XRES = f2K (RAND)
• CK = f3K (RAND)
• IK = f4K (RAND)
• AUTN = SQN xor AK || AMF || XMAC
• AV = RAND || XRES || CK || IK || AUTN

16. IMS AKA security (3/4)
• IMS server will send 401 UNAUTHORIZED to UE, which
bring RAND and AUTN for UE to use AKA algorithm
reproduce other key value :
• RADN  AK
• AK  SQN
• SQN, RAND, AMF  XMAC
• Calculate ATUN and compare the answer with network
• Check current SQN is bigger than old SQN, if SQN is
invalid, UE will send RESGISTER command again.
• If SQN is valid, and reproduce IK and CK, and UE will
store IK and CK for data encrypt.
• Final, UE will reverser RES and send REGISTER again.

17. IMS AKA security (4/4)
• Compare RES and XRES which store in S-CSCF
• If compare success, and send 200 OK to UE.
• If compare fail, and send 403 FORBIDDEN to UE
Challenge

18. GBA_U security (1/2)
• ISIM operations in GBA security context are supported if service n°2
is "available”.
• Using AKA algorithm to verify RES
• Using Ks to reproduce Ks_ext_NAF and Ks_int_NAF use between
UE and NAF for authorized data.
Ks_ext_NAF = KDF(Ks, "gba-me", RAND, IMPI, NAF_Id)
Ks_int_NAF = KDF(Ks, "gba-u, RAND, IMPI, NAF_Id)
Ks=CK || IK

19. GBA_U security (2/2)

20. HTTP Digest security
• ISIM operations in HTTP-Digest security context are
supported if service n°3 is "available"
• Digest access authentication is one of the agreed-upon
methods a web server can use to negotiate credentials,
such as username or password, with a user's web
browser.

21. Other : No ISIM Provide
• If no ISIM application, we can derived IMPI/IMPU/Domain name based on IMSI
Example :IMSI=234150999999999, MNC=15, MCC=234
IMPI :
<IMSI>@ims.mnc<MNC>.mcc<MCC>.3gppnetwork.org
234150999999999@ims.mnc015.mcc234.3gppnetwork.org
IMPU :
sip: <IMSI>@ims.mnc<MNC>.mcc<MCC>.3gppnetwork.org
sip:234150999999999@ims.mnc015.mcc234.3gppnetwork.org
Domain name :
mnc<MNC>.mcc<MCC>.3gppnetwork.org
ims.mnc015.mcc234.3gppnetwork.org

22. Q & A