SIST ETS 300 506 E3:2003
(Main)Digital cellular telecommunications system (Phase 2); Security aspects (GSM 02.09 version 4.5.1)
- Abstract
The purpose of this European Telecommunication Standard (ETS) is to de fine the security features which are to be available in a GSM PLMN, to gether with the associated levels of protection. This ETS is only conc erned with those security features which aim at the up-grading of the security in a GSM PLMN. In particular, end-to-end security is outside the scope of this ETS.
- Status
- Published
- Publication Date
- 30-Nov-2003
- Current Stage
- 6060 - National Implementation/Publication (Adopted Project)
- Start Date
- 01-Dec-2003
- Due Date
- 01-Dec-2003
- Completion Date
- 01-Dec-2003
SIST ETS 300 506 E3:2003 is the Slovenian version of ETS 300 506 Edition 3, an ETSI European Telecommunication Standard for Digital cellular telecommunications system (Phase 2) security aspects. It specifies the security features that should be available in a GSM PLMN, together with their associated protection levels, for operators, network suppliers, and mobile station implementers.
What does SIST ETS 300 506 E3:2003 specify?
SIST ETS 300 506 E3:2003 specifies security features for a GSM PLMN and the level of protection each feature is meant to provide. It focuses on features that upgrade security in the GSM radio environment, not on end-to-end security.
The document is organized into:
- Clause 1 - Scope, normative references, and abbreviations
- Clause 2 - General security principles
- Clause 3 - The security features themselves
- Annex A - Informative change history
The scope links security to the special risks of radiocommunications in a PLMN, such as unauthorized access and eavesdropping. It also points readers to GSM 03.20 for implementation aspects.
What are the key requirements of SIST ETS 300 506 E3:2003?
The standard says that the listed security features shall be supported by both the fixed infrastructure side and the MS side. In practice, that means every GSM PLMN and every MS must be able to support the full set of features, even if an operator chooses when to use them for its own subscribers.
Subscriber identity protection and authentication
IMSI confidentiality requires the International Mobile Subscriber Identity (IMSI) to be protected on the radio path. The standard uses the Temporary Mobile Subscriber Identity (TMSI) for radio-path identification and allows open identification only in specific failure cases, such as location register failure or absence of a TMSI.
IMSI authentication lets the network verify that the claimed subscriber identity is genuine. The network may trigger authentication during subscriber data changes, service access, first access after MSC/VLR restart, or when cipher key sequence numbers do not match.
If authentication fails and the failure is not caused by network malfunction, access shall be denied. If a registered and already authenticated MS cannot be reauthenticated because of network malfunction, calls may continue; but a new registration that cannot be authenticated is not allowed.
User data confidentiality
User data confidentiality on physical connections covers voice and non-voice traffic channels. Encryption is normally applied, the MS can indicate support for up to seven ciphering algorithms, and the serving network selects one from those supported, according to its own priority.
The MS shall also detect whether ciphering is actually on and indicate to the user when it is not or when it stops, such as during handover. This matters in practice because it gives an end user or device interface a way to notice when traffic is no longer protected.
Connectionless and signalling confidentiality
Connectionless user data confidentiality applies to connectionless packet mode over signalling channels, such as short messages, but not to SMS Cell Broadcast.
Signalling information element confidentiality protects selected signalling fields after connection establishment. The standard explicitly leaves some connection-establishment elements unprotected, while protecting user-related items such as IMEI, IMSI, and calling or called subscriber directory numbers when they are used after connection setup.
The IMEI shall remain fixed after final production and resist tampering. The Software Version Number (SVN) is kept separate from the IMEI and may be updated with software changes.
What terms does SIST ETS 300 506 E3:2003 define?
- Public Land Mobile Network (PLMN) - the mobile network environment to which these security features apply.
- Global System for Mobile communications (GSM) - the cellular system named throughout the standard.
- Mobile Station (MS) - the subscriber-side mobile equipment and related functions that must support the security features.
- Mobile Equipment (ME) - the equipment part of the mobile station, including the ciphering indicator behavior.
- Subscriber Identity Module (SIM) - the module that can disable the ciphering indicator and securely stores the IMSI.
- International Mobile Subscriber Identity (IMSI) - the subscriber identity that the standard protects and authenticates.
- Temporary Mobile Subscriber Identity (TMSI) - the local radio-path identifier used instead of the IMSI when confidentiality is applied.
Who uses SIST ETS 300 506 E3:2003?
GSM PLMN operators use this standard to define which security features their networks should support and when those features are mandatory for roaming subscribers. Network and infrastructure engineers use it when designing identity protection, authentication, and ciphering behavior.
Mobile station, mobile equipment, and SIM developers use it to implement the required interface behavior, ciphering support, and user indications. Quality, compliance, and procurement teams use it to check whether a product supports the security functions expected in GSM Phase 2 networks.
What changed in SIST ETS 300 506 E3:2003 from the previous edition?
Annex A records two changes: section 3.5.3 was modified to enhance IMEI security, and the publication was updated from version 4.5.0 to 4.5.1. The document history also shows it as the third edition.
Which standards are used with SIST ETS 300 506 E3:2003?
- GSM 01.04 - provides the abbreviations and acronyms used in the standard.
- GSM 02.02 - defines the bearer services supported by a GSM PLMN.
- GSM 02.03 - defines the teleservices supported by a GSM PLMN.
- GSM 03.20 - gives security-related network functions and the implementation aspects of security features.
- GSM 11.11 - defines the SIM - ME interface, including the SIM behavior referred to by the ciphering indicator.
- GSM 02.07 - supplies the ciphering algorithms referenced in the user data confidentiality requirements.
What does the SIST ETS 300 506 E3:2003 document contain?
The document gives a structured description of five security features: IMSI confidentiality, IMSI authentication, user data confidentiality on physical connections, connectionless user data confidentiality, and signalling information element confidentiality. For each one, it states the definition, purpose, and functional requirements.
It also explains how the network should behave during authentication failures and network malfunctions, and how ciphering algorithm selection works between the MS and the serving network. Annex A provides the change history, which helps readers track what was updated in the version they are reading.
Get Certified
Connect with accredited certification bodies for this standard
ANCE
Mexican certification and testing association.
Intertek Slovenia
Intertek testing, inspection, and certification services in Slovenia.
LNE (Laboratoire National de Métrologie et d'Essais)
French national laboratory for metrology and testing.
Sponsored listings
Frequently Asked Questions
SIST ETS 300 506 E3:2003 is a standard published by the Slovenian Institute for Standardization (SIST). Its full title is "Digital cellular telecommunications system (Phase 2); Security aspects (GSM 02.09 version 4.5.1)". This standard covers: The purpose of this European Telecommunication Standard (ETS) is to de fine the security features which are to be available in a GSM PLMN, to gether with the associated levels of protection. This ETS is only conc erned with those security features which aim at the up-grading of the security in a GSM PLMN. In particular, end-to-end security is outside the scope of this ETS.
The purpose of this European Telecommunication Standard (ETS) is to de fine the security features which are to be available in a GSM PLMN, to gether with the associated levels of protection. This ETS is only conc erned with those security features which aim at the up-grading of the security in a GSM PLMN. In particular, end-to-end security is outside the scope of this ETS.
SIST ETS 300 506 E3:2003 is classified under the following ICS (International Classification for Standards) categories: 33.070.50 - Global System for Mobile Communication (GSM). The ICS classification helps identify the subject area and facilitates finding related standards.
SIST ETS 300 506 E3:2003 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
01-december-2003
'LJLWDOQLFHOLþQLWHOHNRPXQLNDFLMVNLVLVWHP ID]D ±9DUQRVWQLYLGLNL *60
UD]OLþLFD
Digital cellular telecommunications system (Phase 2); Security aspects (GSM 02.09
version 4.5.1)
Ta slovenski standard je istoveten z: ETS 300 506 Edition 3
ICS:
33.070.50 Globalni sistem za mobilno Global System for Mobile
telekomunikacijo (GSM) Communication (GSM)
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN ETS 300 506
TELECOMMUNICATION August 2000
STANDARD Third Edition
Source: SMG Reference: RE/SMG-010209PR2
ICS: 33.020
Key words: Digital cellular telecommunications system, Global System for Mobile communications (GSM)
R
GLOBAL SYSTEM FOR
MOBILE COMMUNICATIONS
Digital cellular telecommunications system (Phase 2);
Security aspects
(GSM 02.09 version 4.5.1)
ETSI
European Telecommunications Standards Institute
ETSI Secretariat
Postal address: F-06921 Sophia Antipolis CEDEX - FRANCE
Office address: 650 Route des Lucioles - Sophia Antipolis - Valbonne - FRANCE
Internet: secretariat@etsi.fr - http://www.etsi.org
Tel.:+334 92944200- Fax:+334 93 654716
Copyright Notification: No part may be reproduced except as authorized by written permission. The copyright and the
foregoing restriction extend to reproduction in all media.
© European Telecommunications Standards Institute 2000. All rights reserved.
Page 2
ETS 300 506 (GSM 02.09 version 4.5.1): August 2000
Whilst every care has been taken in the preparation and publication of this document, errors in content,
typographical or otherwise, may occur. If you have comments concerning its accuracy, please write to
"ETSI Standards Making Support Dept." at the address shown on the title page.
Page 3
ETS 300 506 (GSM 02.09 version 4.5.1): August 2000
Contents
Foreword.5
1 Scope .7
1.1 Normative references .7
1.2 Abbreviations .7
2 General.8
3 Security features provided in a GSM PLMN .8
3.1 Subscriber identity confidentiality .8
3.1.1 Definition.8
3.1.2 Purpose .8
3.1.3 Functional requirements.9
3.2 Subscriber identity authentication.9
3.2.1 Definition.9
3.2.2 Purpose .9
3.2.3 Functional requirements.9
3.2.4 Authentication during a malfunction of the network .10
3.3 User data confidentiality on physical connections (Voice and Non-voice) .10
3.3.1 Definition.10
3.3.2 Purpose .10
3.3.3 Functional requirements.10
3.4 Connectionless user data confidentiality .11
3.4.1 Definition.11
3.4.2 Purpose .11
3.4.3 Functional requirements.11
3.5 Signalling information element confidentiality.11
3.5.1 Definition.11
3.5.2 Purpose .11
3.5.3 Functional requirements.11
Annex A (informative): Change History.12
History.13
Page 4
ETS 300 506 (GSM 02.09 version 4.5.1): August 2000
Blank page
Page 5
ETS 300 506 (GSM 02.09 version 4.5.1): August 2000
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The
information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-
members, and can be found in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or
potentially Essential, IPRs notified to ETSI in respect of ETSI standards", which is available from the ETSI
Secretariat. Latest updates are available on the ETSI Web server (http://www.etsi.org/ipr).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI.
No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the
updates on the ETSI Web server) which are, or may be, or may become, essential to the present
document.
Foreword
This European Telecommunication Standard (ETS) has been produced by the Special Mobile Group
(SMG) Technical Committee of the European Telecommunications Standards Institute (ETSI).
This ETS defines security features within the digital cellular telecommunications system.
The specification from which this ETS has been derived was originally based on CEPT documentation,
hence the presentation of this ETS may not be entirely in accordance with the ETSI/PNE Rules.
Proposed transposition dates
Date of adoption of this ETS: 14 July 2000
Date of latest announcement of this ETS (doa): 31 October 2000
Date of latest publication of new National Standard
or endorsement of this ETS (dop/e): 30 April 2001
Date of withdrawal of any conflicting National Standard (dow): 30 April 2001
Page 6
ETS 300 506 (GSM 02.09 version 4.5.1): August 2000
Blank page
Page 7
ETS 300 506 (GSM 02.09 version 4.5.1): August 2000
1 Scope
Bearer and Teleservices, as respectively defined in GSM 02.02 and GSM 02.03, are the objects which
the GSM PLMN operators offer to their customers. Besides these basic telecommunications services,
features which aim at up-grading these basic services need also to be offered. Due to the use of
radiocommunications in a PLMN, which are of a special nature compared to classical distribution
transmission techniques used in the fixed networks, such a category of features is related to security
aspects.
In a GSM PLMN, both the users and the network operator have to be protected against undesirable
intrusion of third parties. However, measures should be provided for in order to insure maximum
protection of the rights of the individuals concerns. As a consequence, a security feature is either a
supplementary service to Tele or Bearer services, which can be selected by the subscriber, or a network
function involved in the provision of one or several telecommunication services.
The purpose of this European Telecommunication Standard (ETS) is to define the security features which
are to be available in a GSM PLMN, together with the associated levels of protection. This ETS is only
concerned with those security features which aim at the up-grading of the security in a GSM PLMN. In
particular, end-to-end security is outside the scope of this ETS.
The implementation aspects of security features are described in GSM 03.20.
1.1 Normative references
This ETS incorporates by dated and undated reference, provisions from other publications. These
normative references are cited at the appropriate places in the text and the publications are listed
hereafter. For dated references, subsequent amendments to or revisions of any of these publications
apply to this ETS only when incorporated in it by amendment or revision. For undated references, the
latest edition of the publication referred to applies.
[1] GSM 01.04 (ETR 100): "Digital cellular telecommunications system (Phase 2);
Abbreviations and acronyms".
[2] GSM 02.02 (ETS 300 501): "Digital cellular telecommunications system
(Phase 2); Bearer Services (BS) supported by a GSM Public Land Mobile
Network (PLMN)".
[3] GSM 02.03 (ETS 300 502): "Digital cellular telecommunications system
(Phase 2); Teleservices supported by a GSM Public Land Mobile Network
(PLMN)".
[4] GSM 03.20 (ETS 300 534): "Digital cellular telecommunications system
(Phase 2); Security related network functions".
[5] GSM 11.11 (ETS 300 608): "Digital cellular telecommunications system
(Phase 2); Specification of the Subscriber Identity Module - Mobile Equipment
(SIM - ME) interface".
1.2 Abbreviations
Abbreviations used in this ETS are listed in GSM 01.04.
Page 8
ETS 300 506 (GSM 02.09 version 4.5.1): August 2000
2 General
The use of radiocommunications for transmission to the mobile subscribers makes PLMNs particularly
sensitive to:
- misuse of their resources by unauthorised persons using manipulated Mobile Stations, who try to
impersonate authorized subscribers; and
- eavesdropping of the various information which are exchanged on the radio path.
It can be seen that PLMNs intrinsically do not provide the same level of protection to their operators and
subscri
...