SIST ETS 300 920 E3:2003
(Main)Digital cellular telecommunications system (Phase 2+) (GSM); Security aspects (GSM 02.09 version 5.2.1 Release 1996)
- Abstract
Bearer and Teleservices, as respectively defined in GSM 02.02 and GSM 02.03, are the objects which the GSM PLMN operators offer to their cus tomers. Besides these basic telecommunications services, features whic h aim at up grading these basic services need also to be offered. Due to the use of radiocommunications in a PLMN, which are of a special na ture compared to classical distribution transmission techniques used i n the fixed networks, such a category of features is related to securi ty aspects. In a GSM PLMN, both the users and the network operator have to be prot ected against undesirable intrusion of third parties. However, measure s should be provided for in order to insure maximum protection of the rights of the individuals concerns. As a consequence, a security featu re is either a supplementary service to Tele or Bearer services, which can be selected by the subscriber, or a network function involved in the provision of one or several telecommunication services. The purpose of this European Telecommunication Standard (ETS) is to de fine the security features which are to be available in a GSM PLMN, to gether with the associated levels of protection. This ETS is only conc erned with those security features which aim at the up grading of the security in a GSM PLMN. In particular, end to end security is outside the scope of this ETS. The implementation aspects of security features are described in GSM 0 3.20.
- Status
- Published
- Publication Date
- 30-Nov-2003
- Current Stage
- 6060 - National Implementation/Publication (Adopted Project)
- Start Date
- 01-Dec-2003
- Due Date
- 01-Dec-2003
- Completion Date
- 01-Dec-2003
SIST ETS 300 920 E3:2003 is the Slovenian standard identical to ETS 300 920 Edition 3 from ETSI. It specifies the security features for a GSM PLMN, with focus on subscriber identity protection, authentication, user data confidentiality, and signalling confidentiality for network operators, equipment makers, and implementers.
What does SIST ETS 300 920 E3:2003 specify?
SIST ETS 300 920 E3:2003 defines the security features that shall be available in a GSM PLMN and the associated levels of protection. The document is limited to security features that upgrade GSM services and excludes end-to-end security.
The standard is organized into a short front section and three main clauses:
- Clause 1 - Scope, normative references, and abbreviations
- Clause 2 - General security background and protection levels
- Clause 3 - Security features provided in a GSM PLMN
- Annex A - Change history
The scope links these security features to Bearer and Teleservices, which means the standard is about security added to ordinary GSM services rather than about the services themselves. It also points implementers to GSM 03.20 for implementation aspects.
What are the key requirements of SIST ETS 300 920 E3:2003?
SIST ETS 300 920 E3:2003 makes five security features mandatory in both the fixed infrastructure and the MS. In practice, every GSM PLMN and every MS shall be able to support them, even if the operator decides whether to use them for its own subscribers on the HPLMN.
Subscriber identity confidentiality
Clause 3.1 requires confidentiality of the IMSI. The standard uses the TMSI on the radio path and expects measures that stop the IMSI being inferred from signalling details such as addresses. This matters because it reduces the risk of location tracing and identity disclosure over the air interface.
Subscriber identity authentication
Clause 3.2 requires the network to verify that the claimed subscriber identity is genuine. The document links authentication to service access, subscriber data changes, first access after MSC/VLR restart, and cipher key sequence number mismatch. If authentication fails for reasons other than network malfunction, access shall be denied.
The same clause also gives network-failure behavior. A previously registered and authenticated MS may continue calls, including handover, if reauthentication fails because of network malfunction, but a new registration that cannot be authenticated because of network malfunction shall not be allowed.
User data confidentiality on physical connections
Clause 3.3 covers voice and non-voice traffic channels. Encryption is normally applied to all such communications, and the MS signals which of up to seven ciphering algorithms it supports. The serving network selects one it can support, using its own priority order.
The ME also checks whether ciphering is active. If ciphering is not active, or stops during handover, the user is to be informed through a ciphering indicator. This is important for handset behavior and for user-visible warnings.
Connectionless user data confidentiality
Clause 3.4 covers connectionless packet mode on signalling channels, such as short messages. A note states that this protection is not applicable to SMS Cell Broadcast. For implementers, this means the feature targets selected messaging traffic rather than every broadcast service.
Signalling information element confidentiality
Clause 3.5 protects selected signalling fields exchanged between MSs and base stations after connection establishment. The message elements used to set up the connection are not protected, but later user-related signalling can be protected.
The clause specifically highlights IMEI, IMSI, calling subscriber directory number, and called subscriber directory number as protected when used after connection establishment. It also states that the IMSI is stored securely within the SIM, that the SVN security policy is separate from the IMEI, and that the IMEI shall not change after final production and shall resist tampering.
What terms does SIST ETS 300 920 E3:2003 define?
- IMSI - International Mobile Subscriber Identity, the subscriber identity protected on the radio path and during authentication.
- TMSI - Temporary Mobile Subscriber Identity, the local number used instead of IMSI on the radio path when confidentiality is applied.
- MS - Mobile Station, the user equipment that must support the security features.
- ME - Mobile Equipment, the part of the MS that checks ciphering status and handles the ciphering indicator.
- PLMN - Public Land Mobile Network, the mobile network infrastructure serving the users.
- VLR - Visitor Location Register, the network database involved in subscriber-related information changes and authentication triggers.
- HLR - Home Location Register, the subscriber register used during authentication and profile handling.
- IMEI - International Mobile Equipment Identity, the equipment identity protected against change and tampering.
Who uses SIST ETS 300 920 E3:2003?
SIST ETS 300 920 E3:2003 is used by GSM network operators, radio and core network vendors, handset and MS manufacturers, and SIM implementers. It is also relevant to conformity, quality, and procurement teams that need to verify support for identity confidentiality, authentication, ciphering, and signalling protection. In practice, it guides design choices for network behavior, roaming support, ciphering algorithm handling, and equipment identity protection.
What changed in SIST ETS 300 920 E3:2003 from the previous edition?
Annex A records a modification of section 3.5.3 to enhance IMEI security, followed by a version update to 5.2.1 for publication.
Which standards are used with SIST ETS 300 920 E3:2003?
The standard names these related documents:
- GSM 01.04 - provides abbreviations and acronyms used in the document.
- GSM 02.02 - defines GSM Bearer Services, which are part of the service context for this standard.
- GSM 02.03 - defines GSM Teleservices, also part of the service context.
- GSM 03.20 - gives the implementation aspects of security-related network functions.
- GSM 11.11 - covers the SIM-ME interface, relevant to SIM control of the ciphering indicator.
- GSM 02.07 - is referenced for the ciphering algorithms that the network and MS support.
What does the SIST ETS 300 920 E3:2003 document contain?
SIST ETS 300 920 E3:2003 contains the scope, reference list, abbreviation guidance, general security background, and detailed descriptions of five GSM security features. Clause 3 gives definitions, purposes, and functional requirements for each feature, including the handling of IMSI, TMSI, authentication, encryption selection, ciphering indication, and protected signalling fields.
The document also includes practical behavior for failure cases such as network malfunction and registration problems. Annex A provides the change history, which is useful for tracking edits between versions and understanding the publication trail.
Get Certified
Connect with accredited certification bodies for this standard
ANCE
Mexican certification and testing association.
Intertek Slovenia
Intertek testing, inspection, and certification services in Slovenia.
LNE (Laboratoire National de Métrologie et d'Essais)
French national laboratory for metrology and testing.
Sponsored listings
Frequently Asked Questions
SIST ETS 300 920 E3:2003 is a standard published by the Slovenian Institute for Standardization (SIST). Its full title is "Digital cellular telecommunications system (Phase 2+) (GSM); Security aspects (GSM 02.09 version 5.2.1 Release 1996)". This standard covers: Bearer and Teleservices, as respectively defined in GSM 02.02 and GSM 02.03, are the objects which the GSM PLMN operators offer to their cus tomers. Besides these basic telecommunications services, features whic h aim at up grading these basic services need also to be offered. Due to the use of radiocommunications in a PLMN, which are of a special na ture compared to classical distribution transmission techniques used i n the fixed networks, such a category of features is related to securi ty aspects. In a GSM PLMN, both the users and the network operator have to be prot ected against undesirable intrusion of third parties. However, measure s should be provided for in order to insure maximum protection of the rights of the individuals concerns. As a consequence, a security featu re is either a supplementary service to Tele or Bearer services, which can be selected by the subscriber, or a network function involved in the provision of one or several telecommunication services. The purpose of this European Telecommunication Standard (ETS) is to de fine the security features which are to be available in a GSM PLMN, to gether with the associated levels of protection. This ETS is only conc erned with those security features which aim at the up grading of the security in a GSM PLMN. In particular, end to end security is outside the scope of this ETS. The implementation aspects of security features are described in GSM 0 3.20.
Bearer and Teleservices, as respectively defined in GSM 02.02 and GSM 02.03, are the objects which the GSM PLMN operators offer to their cus tomers. Besides these basic telecommunications services, features whic h aim at up grading these basic services need also to be offered. Due to the use of radiocommunications in a PLMN, which are of a special na ture compared to classical distribution transmission techniques used i n the fixed networks, such a category of features is related to securi ty aspects. In a GSM PLMN, both the users and the network operator have to be prot ected against undesirable intrusion of third parties. However, measure s should be provided for in order to insure maximum protection of the rights of the individuals concerns. As a consequence, a security featu re is either a supplementary service to Tele or Bearer services, which can be selected by the subscriber, or a network function involved in the provision of one or several telecommunication services. The purpose of this European Telecommunication Standard (ETS) is to de fine the security features which are to be available in a GSM PLMN, to gether with the associated levels of protection. This ETS is only conc erned with those security features which aim at the up grading of the security in a GSM PLMN. In particular, end to end security is outside the scope of this ETS. The implementation aspects of security features are described in GSM 0 3.20.
SIST ETS 300 920 E3:2003 is classified under the following ICS (International Classification for Standards) categories: 33.070.50 - Global System for Mobile Communication (GSM). The ICS classification helps identify the subject area and facilitates finding related standards.
SIST ETS 300 920 E3:2003 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
01-december-2003
'LJLWDOQLFHOLþQLWHOHNRPXQLNDFLMVNLVLVWHP ID]D ±9DUQRVWQLYLGLNL *60
UD]OLþLFDL]GDMD
Digital cellular telecommunications system (Phase 2+) (GSM); Security aspects (GSM
02.09 version 5.2.1 Release 1996)
Ta slovenski standard je istoveten z: ETS 300 920 Edition 3
ICS:
33.070.50 Globalni sistem za mobilno Global System for Mobile
telekomunikacijo (GSM) Communication (GSM)
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN ETS 300 920
TELECOMMUNICATION August 2000
STANDARD Third Edition
Source: SMG Reference: RE/SMG-010209QR2
ICS: 33.020
Key words: Digital cellular telecommunications system, Global System for Mobile communications (GSM)
R
GLOBAL SYSTEM FOR
MOBILE COMMUNICATIONS
Digital cellular telecommunications system (Phase 2+);
Security aspects
(GSM 02.09 version 5.2.1 Release 1996)
ETSI
European Telecommunications Standards Institute
ETSI Secretariat
Postal address: F-06921 Sophia Antipolis CEDEX - FRANCE
Office address: 650 Route des Lucioles - Sophia Antipolis - Valbonne - FRANCE
Internet: secretariat@etsi.fr - http://www.etsi.org
Tel.:+334 92944200- Fax:+334 93 654716
Copyright Notification: No part may be reproduced except as authorized by written permission. The copyright and the
foregoing restriction extend to reproduction in all media.
© European Telecommunications Standards Institute 2000. All rights reserved.
Page 2
ETS 300 920 (GSM 02.09 version 5.2.1 Release 1996): August 2000
Whilst every care has been taken in the preparation and publication of this document, errors in content,
typographical or otherwise, may occur. If you have comments concerning its accuracy, please write to
"ETSI Standards Making Support Dept." at the address shown on the title page.
Page 3
ETS 300 920 (GSM 02.09 version 5.2.1 Release 1996): August 2000
Contents
Foreword .5
1 Scope .7
1.1 Normative references .7
1.2 Abbreviations .7
2 General.8
3 Security features provided in a GSM PLMN .8
3.1 Subscriber identity confidentiality .8
3.1.1 Definition .8
3.1.2 Purpose .8
3.1.3 Functional requirements.9
3.2 Subscriber identity authentication.9
3.2.1 Definition .9
3.2.2 Purpose .9
3.2.3 Functional requirements.9
3.2.4 Authentication during a malfunction of the network .10
3.3 User data confidentiality on physical connections (Voice and Non-voice) .10
3.3.1 Definition .10
3.3.2 Purpose .10
3.3.3 Functional requirements.10
3.4 Connectionless user data confidentiality .11
3.4.1 Definition .11
3.4.2 Purpose .11
3.4.3 Functional requirements.11
3.5 Signalling information element confidentiality.11
3.5.1 Definition .11
3.5.2 Purpose .11
3.5.3 Functional requirements.11
Annex A (informative): Change History.12
History.13
Page 4
ETS 300 920 (GSM 02.09 version 5.2.1 Release 1996): August 2000
Blank page
Page 5
ETS 300 920 (GSM 02.09 version 5.2.1 Release 1996): August 2000
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The
information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-
members, and can be found in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or
potentially Essential, IPRs notified to ETSI in respect of ETSI standards", which is available from the ETSI
Secretariat. Latest updates are available on the ETSI Web server (http://www.etsi.org/ipr).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI.
No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the
updates on the ETSI Web server) which are, or may be, or may become, essential to the present
document.
Foreword
This European Telecommunication Standard (ETS) has been produced by the Special Mobile Group
(SMG) Technical Committee of the European Telecommunications Standards Institute (ETSI).
This ETS defines security features within the digital cellular telecommunications system.
The specification from which this ETS has been derived was originally based on CEPT documentation,
hence the presentation of this ETS may not be entirely in accordance with the ETSI/PNE Rules.
The contents of the present document may be subject to continuing work within SMG and may change
following formal SMG approval. Should SMG modify the contents of the present document it will then be
re-submitted for formal approval procedures by ETSI with an identifying change of release date and an
increase in version number as follows:
Version 5.x.y
where:
5 GSM Phase 2+ Release 1996.
x the second digit is incremented for changes of substance, i.e. technical enhancements,
corrections, updates, etc.;
y the third digit is incremented when editorial only changes have been incorporated in the
specification.
Proposed transposition dates
Date of adoption of this ETS: 14 July 2000
Date of latest announcement of this ETS (doa): 31 October 2000
Date of latest publication of new National Standard
or endorsement of this ETS (dop/e): 30 April 2001
Date of withdrawal of any conflicting National Standard (dow): 30 April 2001
Page 6
ETS 300 920 (GSM 02.09 version 5.2.1 Release 1996): August 2000
Blank page
Page 7
ETS 300 920 (GSM 02.09 version 5.2.1 Release 1996): August 2000
1 Scope
Bearer and Teleservices, as respectively defined in GSM 02.02 and GSM 02.03, are the objects which
the GSM PLMN operators offer to their customers. Besides these basic telecommunications services,
features which aim at up-grading these basic services need also to be offered. Due to the use of
radiocommunications in a PLMN, which are of a special nature compared to classical distribution
transmission techniques used in the fixed networks, such a category of features is related to security
aspects.
In a GSM PLMN, both the users and the network operator have to be protected against undesirable
intrusion of third parties. However, measures should be provided for in order to insure maximum
protection of the rights of the individuals concerns. As a consequence, a security feature is either a
supplementary service to Tele or Bearer services, which can be selected by the subscriber, or a network
function involved in the provision of one or several telecommunication services.
The purpose of this European Telecommunication Standard (ETS) is to define the security features which
are to be available in a GSM PLMN, together with the associated levels of protection. This ETS is only
concerned with those security features which aim at the up-grading of the security in a GSM PLMN. In
particular, end-to-end security is outside the scope of this ETS.
The implementation aspects of security features are described in GSM 03.20.
1.1 Normative references
This ETS incorporates by dated and undated reference, provisions from other publications. These
normative references are cited at the appropriate places in the text and the publications are listed
hereafter. For dated references, subsequent amendments to or revisions of any of these publications
apply to this ETS only when incorporated in it by amendment or revision. For undated references, the
latest edition of the publication referred to applies.
[1] GSM 01.04 (ETR 350): "Digital cellular telecommunications system (Phase 2+);
Abbreviations and acronyms".
[2] GSM 02.02 (ETS 300 904): "Digital cellular telecommunications system
(Phase 2+); Bearer Services (BS) supported by a GSM Public Land Mobile
Network (PLMN)".
[3] GSM 02.03 (ETS 300 905): "Digital cellular telecommunications system
(Phase 2+); Teleservices supported by a GSM Public Land Mobile Network
(PLMN)".
[4] GSM 03.20 (ETS 300 929): "Digital cellular telecommunications system
(Phase 2+); Security related network functions".
[5] GSM 11.11 (ETS 300 977): "Digital cellular telecommunications system
(Phase 2+); Specification of the Subscriber Identity Module - Mobile Equipment
(SIM - ME) interface".
1.2 Abbreviations
Abbreviations used in this ETS are listed in GSM 01.04.
Page 8
ETS 300 920 (GSM 02.09 version 5.2.1 Release 1996): August 2000
2 General
The use of radiocommunications for transmission to the mobile subscribers m
...