SIST EN 300 920 V6.1.1:2003
(Main)Digital cellular telecommunications system (Phase 2+) (GSM); Security aspects (GSM 02.09 version 6.1.1 Release 1997)
- Abstract
CR SMG#31
- Status
- Published
- Publication Date
- 30-Nov-2003
- Current Stage
- 6060 - National Implementation/Publication (Adopted Project)
- Start Date
- 01-Dec-2003
- Due Date
- 01-Dec-2003
- Completion Date
- 01-Dec-2003
SIST EN 300 920 V6.1.1:2003 is the Slovenian standard identical to EN 300 920 Version 6.1.1 from ETSI. It specifies the security aspects of Digital cellular telecommunications system (Phase 2+) (GSM) for a GSM PLMN, including the security features and protection levels that matter to operators, subscribers, and equipment makers.
What does SIST EN 300 920 V6.1.1:2003 specify?
SIST EN 300 920 V6.1.1:2003 defines the security features that should be available in a GSM PLMN and the level of protection each feature provides. The standard focuses on security that upgrades GSM bearer and teleservices on the radio path, while end-to-end security is outside its scope.
The document is organized into:
- Clause 1 - Scope, references, and abbreviations
- Clause 2 - General security principles
- Clause 3 - Security features provided in a GSM PLMN
- 3.1 Subscriber identity confidentiality
- 3.2 Subscriber identity authentication
- 3.3 User data confidentiality on physical connections
- 3.4 Connectionless user data confidentiality
- 3.5 Signalling information element confidentiality
- Annex A - Informative change history
Clause 1 points to GSM 03.20 for implementation aspects. That matters in practice because this standard tells you what security features are expected, while the implementation details are handled elsewhere.
What are the key requirements of SIST EN 300 920 V6.1.1:2003?
SIST EN 300 920 V6.1.1:2003 sets out five security features for GSM PLMNs, and both the fixed infrastructure side and the MS side shall support them all. For an operator or vendor, that means the network and the terminal must be able to handle every feature even if a particular operator chooses not to use all of them for its own subscribers.
The document’s security model
Clause 2 says GSM PLMNs are exposed to misuse by unauthorized users and to eavesdropping on the radio path. Where a security feature from Clause 3 is used, the radio-path protection for that item is treated as comparable to fixed-network protection; where no special provision is made, no protection is assumed. In practice, anything not covered by Clause 3 is not given a radio-path security mechanism by this standard.
Subscriber identity confidentiality
Clause 3.1 defines subscriber identity confidentiality for the IMSI. The radio path uses the TMSI when possible, and the IMSI shall not be disclosed to unauthorized parties during signalling. This matters because it reduces the risk of tracing a subscriber’s location from signalling exchanges.
Subscriber identity authentication
Clause 3.2 requires the network to authenticate the subscriber identity when the subscriber changes certain subscriber-related data, accesses services, first accesses the network after an MSC/VLR restart, or when there is a cipher key sequence number mismatch. If authentication fails and the cause is not network malfunction, access is denied. During a network malfunction, the standard distinguishes between already registered subscribers, who may continue to be served, and new registrations, which shall not be accepted if authentication cannot be completed.
User data confidentiality on physical connections
Clause 3.3 says voice and non-voice communications are normally ciphered, and the network selects the ciphering algorithm from those supported by the MS. The MS indicates support for up to seven ciphering algorithms, and the serving network chooses one according to its priority order. The ME also checks whether ciphering is active and informs the user if ciphering is lost or switched off, including during handover. This gives operators a clear negotiation model and gives users an indication when traffic is not protected.
Connectionless user data confidentiality
Clause 3.4 covers user information transferred in connectionless packet mode over a signalling channel. The note states that this protection does not apply to SMS Cell Broadcast. In practical terms, this feature is aimed at short-message-type traffic that uses signalling channels rather than traffic channels.
Signalling information element confidentiality
Clause 3.5 protects selected signalling information elements exchanged between MSs and base stations after connection establishment. It specifically leaves some connection-establishment fields unprotected, then protects user-related items such as the IMEI, IMSI, and calling or called subscriber directory number when they are used later. The clause also requires the IMEI to be fixed after final production and resistant to tampering, and it separates the security policy for the SVN from the IMEI. That is important for handset design, manufacturing control, and anti-tamper measures.
What terms does SIST EN 300 920 V6.1.1:2003 define?
- IMSI (International Mobile Subscriber Identity) - the subscriber identity that the network protects from disclosure and uses in authentication.
- TMSI (Temporary Mobile Subscriber Identity) - a local identity used on the radio path instead of the IMSI when subscriber identity confidentiality is applied.
- MS (Mobile Station) - the subscriber-side radio equipment that must support the security features and participate in authentication and ciphering.
- ME (Mobile Equipment) - the equipment part that checks ciphering status and is subject to the IMEI and SVN security rules.
- SIM (Subscriber Identity Module) - the module that securely stores the IMSI and can disable the ciphering indicator feature.
- HPLMN (Home PLMN) - the subscriber’s home network, where use of the security features is left to the operator’s discretion for its own subscribers.
- IMEI (International Mobile Equipment Identity) - the equipment identity that shall be protected against change after final production.
- SVN (Software Version Number) - a software-related identifier whose security is separate from the IMEI and which can be updated with software changes.
Who uses SIST EN 300 920 V6.1.1:2003?
SIST EN 300 920 V6.1.1:2003 is used by GSM PLMN operators, mobile station and ME manufacturers, SIM designers, and engineers responsible for GSM security functions. It is also relevant to suppliers who need to implement authentication, ciphering negotiation, identity protection, and tamper-resistant equipment identity handling. For buyers and quality teams, it is a reference for checking whether a GSM product or network supports the expected security features.
What changed in SIST EN 300 920 V6.1.1:2003 from the previous edition?
Annex A records the change history leading to version 6.1.1. The listed update for 6.1.1 is a version update for publication, following the 6.1.0 change that modified Clause 3.5.3 to enhance IMEI security.
Which standards are used with SIST EN 300 920 V6.1.1:2003?
The standard cites these related documents:
- GSM 01.04 - provides the abbreviations and acronyms used in the document.
- GSM 02.02 - defines bearer services supported by a GSM PLMN.
- GSM 02.03 - defines teleservices supported by a GSM PLMN.
- GSM 03.20 - covers security-related network functions and the implementation aspects of the security features.
- GSM 11.11 - specifies the SIM-ME interface, which is relevant to the ciphering indicator and SIM-related security behavior.
What does the SIST EN 300 920 V6.1.1:2003 document contain?
The document contains clause-by-clause definitions of the five GSM security features, each with a definition, purpose, and functional requirements. It also includes detailed rules for authentication triggers, ciphering algorithm negotiation, user notification when ciphering is absent, and the treatment of signalling fields after connection establishment. Annex A provides an informative change history, which is useful when tracking how IMEI security and other parts of the specification evolved over the release history.
Get Certified
Connect with accredited certification bodies for this standard
ANCE
Mexican certification and testing association.
Intertek Slovenia
Intertek testing, inspection, and certification services in Slovenia.
LNE (Laboratoire National de Métrologie et d'Essais)
French national laboratory for metrology and testing.
Sponsored listings
Frequently Asked Questions
SIST EN 300 920 V6.1.1:2003 is a standard published by the Slovenian Institute for Standardization (SIST). Its full title is "Digital cellular telecommunications system (Phase 2+) (GSM); Security aspects (GSM 02.09 version 6.1.1 Release 1997)". This standard covers: CR SMG#31
CR SMG#31
SIST EN 300 920 V6.1.1:2003 is classified under the following ICS (International Classification for Standards) categories: 33.070.50 - Global System for Mobile Communication (GSM). The ICS classification helps identify the subject area and facilitates finding related standards.
SIST EN 300 920 V6.1.1:2003 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
01-december-2003
'LJLWDOQLFHOLþQLWHOHNRPXQLNDFLMVNLVLVWHP ID]D ±9DUQRVWQLYLGLNL *60
UD]OLþLFDL]GDMD
Digital cellular telecommunications system (Phase 2+) (GSM); Security aspects (GSM
02.09 version 6.1.1 Release 1997)
Ta slovenski standard je istoveten z: EN 300 920 Version 6.1.1
ICS:
33.070.50 Globalni sistem za mobilno Global System for Mobile
telekomunikacijo (GSM) Communication (GSM)
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
European Standard (Telecommunications series)
Digital cellular telecommunications system (Phase 2+);
Security aspects
(GSM 02.09 version 6.1.1 Release 1997)
R
GLOBAL SYSTEM FOR
MOBILE COMMUNICATIONS
2 ETSI EN 300 920 V6.1.1 (2000-08)
(GSM 02.09 version 6.1.1 Release 1997)
Reference
REN/SMG-010209Q6R1
Keywords
Digital cellular telecommunications system,
Global System for Mobile communications (GSM)
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.:+33492944200 Fax:+33 493654716
Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88
Important notice
Individual copies of the present document can be downloaded from:
http://www.etsi.org
The present document may be made available in more than one electronic version or in print. In any case of existing or
perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF).
In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive
within ETSI Secretariat.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at http://www.etsi.org/tb/status/
If you find errors in the present document, send your comment to:
editor@etsi.fr
Copyright Notification
No part may be reproduced except as authorized by written permission.
The copyright and the foregoing restriction extend to reproduction in all media.
© European Telecommunications Standards Institute 2000.
All rights reserved.
ETSI
3 ETSI EN 300 920 V6.1.1 (2000-08)
(GSM 02.09 version 6.1.1 Release 1997)
Contents
Intellectual Property Rights.4
Foreword.4
1 Scope .5
1.1 References .5
1.2 Abbreviations .5
2 General .6
3 Security features provided in a GSM PLMN .6
3.1 Subscriber identity confidentiality .6
3.1.1 Definition.6
3.1.2 Purpose .6
3.1.3 Functional requirements .7
3.2 Subscriber identity authentication .7
3.2.1 Definition.7
3.2.2 Purpose .7
3.2.3 Functional requirements .7
3.2.4 Authentication during a malfunction of the network .7
3.3 User data confidentiality on physical connections (Voice and Non-voice).8
3.3.1 Definition.8
3.3.2 Purpose .8
3.3.3 Functional requirements .8
3.4 Connectionless user data confidentiality .8
3.4.1 Definition.8
3.4.2 Purpose .8
3.4.3 Functional requirements .9
3.5 Signalling information element confidentiality .9
3.5.1 Definition.9
3.5.2 Purpose .9
3.5.3 Functional requirements .9
Annex A (informative): Change history .10
History .11
ETSI
4 ETSI EN 300 920 V6.1.1 (2000-08)
(GSM 02.09 version 6.1.1 Release 1997)
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web
server (http://www.etsi.org/ipr).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web
server) which are, or may be, or may become, essential to the present document.
Foreword
This European Standard (Telecommunications series) has been produced by ETSI Technical Committee Special Mobile
Group (SMG).
The present document defines security features within the digital cellular telecommunications system.
The contents of this standard may be subject to continuing work within SMG and may change following formal SMG
approval. Should SMG modify the contents of this standard it will then be re-submitted for formal approval procedures
by ETSI with an identifying change of release date and an increase in version number as follows:
Version 6.x.y
where:
6 GSM Phase 2+ Release 1997;
x the second digit is incremented for changes of substance, i.e. technical enhancements, corrections, updates,
etc.;
y the third digit is incremented when editorial only changes have been incorporated in the specification.
National transposition dates
Date of adoption of this EN: 14 July 2000
Date of latest announcement of this EN (doa): 31 October 2000
Date of latest publication of new National Standard
or endorsement of this EN (dop/e): 30 April 2001
Date of withdrawal of any conflicting National Standard (dow): 30 April 2001
ETSI
5 ETSI EN 300 920 V6.1.1 (2000-08)
(GSM 02.09 version 6.1.1 Release 1997)
1 Scope
Bearer and Teleservices, as respectively defined in GSM 02.02 and GSM 02.03, are the objects which the GSM PLMN
operators offer to their customers. Besides these basic telecommunications services, features which aim at up-grading
these basic services need also to be offered. Due to the use of radiocommunications in a PLMN, which are of a special
nature compared to classical distribution transmission techniques used in the fixed networks, such a category of features
is related to security aspects.
In a GSM PLMN, both the users and the network operator have to be protected against undesirable intrusion of third
parties. However, measures should be provided for in order to insure maximum protection of the rights of the
individuals concerns. As a consequence, a security feature is either a supplementary service to Tele or Bearer services,
which can be selected by the subscriber, or a network function involved in the provision of one or several
telecommunication services.
The purpose of this EN is to define the security features which are to be available in a GSM PLMN, together with the
associated levels of protection. This EN is only concerned with those security features which aim at the up-grading of
the security in a GSM PLMN. In particular, end-to-end security is outside the scope of this EN.
The implementation aspects of security features are described in GSM 03.20.
1.1 References
The following documents contain provisions which, through reference in this text, constitute provisions of the present
document.
• References are either specific (identified by date of publication, edition number, version number, etc.) or
non-specific.
• For a specific reference, subsequent revisions do not apply.
• For a non-specific reference, the latest version applies.
• A non-specific reference to an ETS shall also be taken to refer to later versions published as an EN with the same
number.
• For this Release 1997 document, references to GSM documents are for Release 1997 versions (version 6.x.y).
[1] GSM 01.04: "Digital cellular telecommunications system (Phase 2+); Abbreviations and
acronyms".
[2] GSM 02.02: "Digital cellular telecommunications system (Phase 2+); Bearer Services (BS)
supported by a GSM Public Land Mobile Network (PLMN)".
[3] GSM 02.03: "Digital cellular telecommunications system (Phase 2+); Teleservices supported by a
GSM Public Land Mobile Network (PLMN)".
[4] GSM 03.20: "Digital cellular telecommunications system (Phase 2+); Security related network
functions".
[5] GSM 11.11: "Digital cellular telecommunications system (Phase 2+); Specification of the
Subscri
...