Security in UMTS

UMTS being such a massive cellular network and that too wireless, security in UMTS becomes an important aspect. There can be some kind of attack by intruders which may bring down the entire network. One can jam channels which may result deny access for legitimate users. An unwanted and unauthorized user access the network and use services for free. An attacker may eavesdrop and intercept confidential calls results into leaking of confidential information and he may change the contents of data.

Security in UMTS is mainly consists of the below four components:

1. User Identity Confidentiality

2. Authentication

3. Integrity Protection

4. Ciphering

1. User Identity Confidentiality
The UMTS network does not disclose the identity of the subscriber and for the same network allocates temporary identifier TMSI or P-TMSI to UEs. TMSI (Temporary Mobile Subscriber Identity) applies to CS domain and P-TMSI to PS domain.
TMSI is unique within location area (LA) and hence to make the identifier unique globally, TMSI is used in combination with LAI. Similary, P-TMSI is unique within routing area (RA) and hence to make it unique globally P-TMSI is used in combination with RAI.

2. Authentication
In UMTS, authentication is bi-directional i.e. here UE authenticates network and network authenticates UE.
It is based on secret key known to both network and UE.
The home network on the request generates security information known as Authentication Vectors (AVs) and supplies to the serving network. Next, the serving network select one of the AV and sends two of the elements of the selected AV, RAND (a random number) and AUTN (authentication token) to the UE. UE checks that AUTN is valid and a counter within the AUTN is in the correct range and this way authenticates the network. UE then computes a RES (response) using an algorithm within the USIM. UE sends this RES to the CN and CN compared this with the XRES (expected response) received from home network. If both same, UE is successfully authenticated.

3. Integrity Protection
Integrity protection is applied to access stratum messages to detect whether the messages have been corrupted or not. With this procedure the integrity of the message is maintained. In this, with the help of certain inputs and an algorithm, MAC-I is calculated and attached with the message. The receiver calculate the expected MAC-I and compare both MAC-I. If the received MAC-I is same as calculated MAC-I, received message  is not modified.
All RRC message are integrity protected except few which are listed below:
RRC CONNECTION REQUEST
RRC CONNECTION SETUP
RRC CONNECTION COMPLETE
RRC CONNECTION REJECT
RRC CONNECTION RELEASE
PAGING TYPE1
PUSCH CAPACITY REQUEST
HANDOVER TO UTRAN COMPLETE
PHYSICAL SHARED CHANNEL ALLOCATION
SYSTEM INFORMATION
SYSTEM INFORMATION CHANGE INDICATION

IK = Integrity key(128 bits)
COUNT-I = RRC HFN(28 bits) + RRC Sequence Number(4 bits)
FRESH = A 32 bits network generated random value
DIRECTION = the direction of the message either uplink or downlink
MESSAGE = message to be integrity protected

4. Ciphering
Ciphering used to provide data confidentiality so that an attacker (man in the middle) could not read the message. Ciphering is done either at RLC or MAC. For TM RLC, it is done at MAC and for the rest, it is done at RLC.

CK = Ciphering key(128 bits)
COUNT-C = 32 bits counter. It can take any of one of the three based on RLC mode.
                       For TM: COUNT-C = MAC-D HFN(25 bits) + CFN(7 bits)
                       For UM: COUNT-C = RLC HFN(25 bits) + SN(7 bits)
                       For AM: COUNT-C = RLC HFN(20bits) + SN(12 bits)
BEARER = RB identifier(4 bits)
LENGTH = length of the required key-stream (16 bits)
DIRECTION = whether its uplink or downlink for the message to be ciphered (1 bit - 0 for uplink and 1 for            downlink)


>>The 20 MSB of both counter is initialized to a value called START. START values defined individually both for CS and PS domain and these are stored in USIM. UE first share this to network in the RRC CONNECTION SETUP COMPLETE message.
>>For the SRBs, the START value of latest configured CN domain is applicable.

System Information Block (SIB)

SIB's are system information that is transmitted from UTRAN to UE.

>>The set of channels used in transmitting SIBs:
BCCH (logical channel) --> BCH (transport channel) --> PCCPCH (physical channel)
and
BCCH (logical channel) --> FACH (transport channel) --> SCCPCH (physical chaanel)

>>System Information is the first set of information UE needs to decode and read information received from UTRAN to know about the system and hence the PCCPCH is transmitted with constant data rate and TF so that UE can easily decode the System informations.

>>For BCH, TTI is fixed as 20ms and fixed transport block size of 246 bits.

>>The radio interface are based on the 10 ms radio frames and each frames are counted by SFN from 0 to 4095 i.e total length of 4096. This SFN is the basis of scheduling of different SIBs. And, hence the complete System information is divided into 20 ms BCH transport blocks. Then, this 20 ms second BCH transport block is transmitted in two radio frames i.e in two SFN.

>>SIB contains one MIB (Master Information Block), two SB (Scheduling blocks) and many SIBs (System Information Blocks).

>> In general, SIBs are too large and the BCH transport blocks are of  fixed size hence Segmentation and Concatenation of the SIBs is required. This is done at RRC layer.

>> The different types of Segments are:
1. First Segment -  Indicates that this is the first segment of segmented SIBs.
2. Subsequent Segment - Indicates that this is the subsequent segment of segmented SIBs.
3. Last Segment - Indicates that this is the last segment of segmented SIBs.
4. Complete - Indicates that this is the complete SIBs i.e no segmentation.

>>SISs are of different types and that too large in size, SIB scheduling becomes a very important aspect. Below are the parameters used in SIBs scheduling:
SEG_COUNT : Defines the number of segments (1,...,16)
SIB_REP : Defines the SIB repetition period (after how many radio frames it will be repeated (4,8,16,...,4096))
SIB_POS : Defines the SIB position within SFN (multiple of 2)
SIB_OFF : Defines the offset for the next segment of segmented SIBs (multiple of 2)

>> For the MIB, some of the parameters are fixed. SIB_REP=8 frames, SIB_POS=0.

>>Different types of SIBs are:
SIB1 : The system information block type 1 contains NAS system information as well as UE timers and counters to be used in idle mode and in connected mode.
SIB2 : The system information block type 2 contains the URA identity.
SIB3 : The system information block type 3 contains parameters for cell selection and re-selection.
SIB4 : The system information block type 4 contains parameters for cell selection and re-selection to be used in connected mode.
SIB5 : The system information block type 5 contains parameters for the configuration of the common physical channels in the cell.
SIB6 : The system information block type 6 contains parameters for the configuration of the common and shared physical channels to be used in connected mode.
SIB7 : The system information block type 7 contains the fast changing parameters UL interference and Dynamic persistence level.            
SIB8 : The system information block type 8 contains static CPCH information to be used in the cell.
SIB9 : The system information block type 9 contains CPCH information to be used in the cell.
SIB10 : The system information block type 10 contains information to be used by UEs having their DCH controlled by a DRAC procedure.
SIB11 : The system information block type 11 contains measurement control information to be used in the cell.
SIB12 : The system information block type 12 contains measurement control information to be used in connected mode.
SIB13 : The system information block type 13 contains ANSI-41 system information.
SIB14 : Only for TDD
SIB15 : The system information block type 15 contains information useful for UE-based or UE-assisted positioning methods.
SIB16 : The system information block type 16 contains radio bearer, transport channel and physical channel parameters to be stored by UE in idle and connected mode for use during handover to UTRAN.
SIB17 : Only for TDD
SIB18 : The System Information Block type 18 contains PLMN identities of neighbouring cells to be considered in idle mode as well as in connected mode.