5 Security requirements

21.1113GPPRelease 17TSUSIM and IC card requirements

The USIM shall be used to provide security features. If the UICC is removed from the 3G terminal, the service shall be terminated immediately. The functions of the USIM include authenticating itself to the network and vice versa, authenticating the user and providing additional security functions as defined in 3GPP TS 33.102 [7].

The USIM shall be unambiguously identified.

Means shall be provided to prevent fraudulent use of stolen UICCs.

It shall not be possible to access data intended for USIM internal use, e.g. authentication keys.

Further details of the following requirements are given in 3GPP TS 33.102 [7].

5.1 File access conditions

Actions, such as READ, UPDATE on UICC data shall be controlled by access conditions. These shall be satisfied prior to the action being performed.

Since a UICC may contain multiple (3G and non-3G) applications, a flexible method of controlling file access shall be provided.

5.2 User authentication

The USIM shall support means to authenticate the user, to provide, for example, protection against the use of stolen cards. For the USIM, authentication shall be performed by the verification of a numeric PIN of four (4) to eight (8) decimal digits.

A function to disable user authentication may exist which may be inhibited by the application provider, in which case the user shall always use the PIN. Otherwise, the user may decide whether or not to make use of the user authentication function. If disabled, the user authentication function remains disabled until the user specifically re-enables it.

Following correct PIN presentation, the ME may perform functions and actions on USIM data, which are protected by the relevant access condition.

If an incorrect PIN is entered, an indication shall be given to the user. After three (3) consecutive incorrect entries the relevant PIN is blocked, i.e. functions and actions on data protected by the access condition shall no longer be possible, even if between attempts the UICC has been removed, the USIM has been deselected or the ME has been switched off. Once a PIN is blocked, further PIN verifications shall be denied.

The USIM shall support a mechanism for unblocking a blocked PIN. Unblocking of a PIN is performed by using the relevant PIN Unblocking Key.

PINs, but not Unblock PINs, shall be changeable by the user following correct entry of either the current PIN or Unblock PIN.

The Unblock PIN shall consist of eight (8) decimal digits and shall not be changeable by the user. If an incorrect Unblock PIN is presented, an indication shall be given to the user. After ten (10) consecutive incorrect entries, the Unblock PIN shall be blocked, even if between attempts the UICC has been removed, the USIM has been deselected or the ME has been switched off. Unblocking of a blocked PIN shall not be possible.

It shall not be possible to read PINs or Unblock PINs.

5.3 User data stored in ME

Subject to the exception below, all user related information transferred into the ME during network operations shall be deleted from the ME after removal of the UICC, deselection of the USIM, deactivation of the ME, or following an electrical reset of the UICC. This includes any data that was transferred to the ME by USIM Application Toolkit commands.

User related security codes such as PIN and Unblock PIN may only be stored by the ME during the procedures involving such a code and shall be discarded by the ME immediately after completion of the procedure.

Optionally, an ME may retain some less security-sensitive data at UICC removal, USIM deselection or ME switch-off. Such data are e.g. SMS, ADN/SSC, FDN/SSC, LND. These data, when stored in the ME, shall only be readable/retrievable if the same USIM is reactivated (as determined by the IMSI). If the IMSI is retained in the ME for this purpose, it shall be stored securely and shall not be able to be read out.

5.4 Authentication

A means shall be specified to mutually authenticate the USIM and the network by showing knowledge of a secret key K which is shared between and available only to the USIM and in the user’s Home Environment. The method is composed of a challenge/response and key establishment protocol combined with a sequence number-based one-pass protocol for network authentication.

5.5 Data integrity of signalling elements

Some signalling information elements are considered sensitive and must be integrity protected. An integrity function shall be applied on certain signalling information elements transmitted between the ME and the network.

The 3GPP Integrity Algorithm (UIA) is used with an Integrity Key (IK) to compute a message authentication code for a given message. The setting of IK is triggered by the authentication procedure. IK shall be stored on the USIM.

5.6 User identity confidentiality

A mechanism shall be specified to provide user identity confidentiality by means of a temporary identity.

5.7 Length of security parameters

In order to allow for enhancements of the security level in 3G, the following requirements shall be covered:

– all security-related parameters for 3G shall be accompanied by a length indicator;

– the USIM shall support variable-length security parameters.

If the USIM supports the GSM security mechanisms in addition to 3G security, fixed length security parameters according to 3GPP TS 51.011 [8] shall be supported in addition.