【文章內(nèi)容簡(jiǎn)介】 ue, NONCEmme, NASMAC)NAS ( IMEISV, NASMAC )Start . (de)CipheringStart UL deCipheringStart DLCipheringStart .Nonce? IftheMMEdoesnothavethecontextindicatedbytheUEintheTAUrequest,ortheTAUrequestwasreceivedunprotected,theMMEshallcreateanewmappedsecuritycontext(thatshallbeethecurrentsecuritycontext).Inthiscase,theMMEshallgeneratea32bitNONCEmmeandusethereceivedNONCEuewiththeNONCEmmetogenerateafreshmappedK39。ASMEfromCKandIK,whereCK,IKwereidentifiedbytheKSIandPTMSIintheTAURequest.SeeAnnexformoreinformationonhowtoderivethefreshK39。ASME.? TheMMEinitiatesaNASSecuritymodemandprocedurewiththeUEincludingtheKSISGSN,NONCEUE,andNONCEMMEintheNASSecuritymodemand.– TheuplinkanddownlinkNASCOUNTformappedsecuritycontextshallbesettostartvalue(.,0)whennewmappedsecuritycontextiscreatedinUEandMME.? NonceUE– Whencreatingamappedcontextforthecasedescribedinclause,theUEshallensurethereceivedNONCEUEisthesameastheNONCEUEsentintheTAURequestandalsocalculateK39。ASMEfromCK,IKandthetwononces(seeAnnex).AS? TheASsecuritymodemandmessagefromeNBtoUEshallcontaintheselectedASalgorithms.ThismessageshallbeintegrityprotectedwithRRCintegritykeybasedonthecurrentKASME.? TheASsecuritymodepletemessagefromUEtoeNBshallbeintegrityprotectedwiththeselectedRRCalgorithmindicatedintheASsecuritymodemandmessageandRRCintegritykeybasedonthecurrentKASME.? RRCandUPdownlinkciphering(encryption)attheeNBshallstartaftersendingtheASsecuritymodemandmessage.RRCandUPuplinkdeciphering(decryption)attheeNBshallstartafterreceivingandsuccessfulverificationoftheASsecuritymodepletemessage.? RRCandUPuplinkciphering(encryption)attheUEshallstartaftersendingtheASsecuritymodepletemessage.RRCandUPdownlinkdeciphering(decryption)attheUEshallstartafterreceivingandsuccessfulverificationoftheASsecuritymodemandmessageASSMC過程38ASSMC與 NASSMC的同步? NASSMC正在進(jìn)行– 1:MME不應(yīng)當(dāng)發(fā)起觸發(fā) ASSMC的 S1AP過程– 6： MME只有完成了 NASSMC后才繼續(xù) InterMMEHO。? InterENBHO正在進(jìn)行– 5： 源 ENBreject觸發(fā) ASSMC的 S1AP過程– 5：源 ENB當(dāng) ASRefresh/Rekey結(jié)束后，才可以進(jìn)行 HO? HO過程中– 3： MME發(fā)起 NASSMC，但在 HORequest/PathSwitchRequestAcknowledge中使用 OldAS.– 4： UE收到 NASSMC，但在 HO過程中繼續(xù)使用 OldAS.? 觸發(fā) ASSMC的 SAAP正在進(jìn)行中– 2： MME不應(yīng)當(dāng)發(fā)起 NASSMC.– 7： MME當(dāng) S1AP結(jié)束后，才可以進(jìn)行 InterMMEHO? NASSMC完成，但 S1AP未進(jìn)行– 8,9：有 InterMMEHO，新舊 MME則繼續(xù)使用 OldAS，同時(shí)在 S10接口上傳輸兩套 .主要內(nèi)容? EPS 安全綜述? EPS AKA與 ? EPS MM程與 HO過程中的安全? EPS KDF? EPS EEA1/2/3與 EIA/1/2/3算法EPS MM程與 HO過程中的安全? LTE內(nèi)的狀態(tài)遷移時(shí)的安全上下文的處理? LTE內(nèi) TAU過程。? UTMS與 LTE之間的 RAU， TAU過程? LTE內(nèi)的 X2,S1Handover過程? LTE與 UMTS之間的切換過程TransitionToEMMDEREGISTERED? IfUEandMMEhaveafullnoncurrentnativeEPSsecurity contextandacurrentmappedEPSsecurity context,thentheyshallmakethenoncurrentnativeEPSsecurity contextthecurrentone.? UEandMMEshalldeleteanymappedorpartialEPSsecurity contextstheyhold.NCFNCPCMCFEMMDEREGISTEREDEMMREGISTEREDCFEUSIM MEUSIM MECFToEMMDEREGISTERED的其它場(chǎng)景AVNCPCFAVCFAVNCPCFUEinitiatedDetachwithPoweroff?UEint Detach without Power off?MMEint Detach Explicitly with reattach?MMEint Detach ImplicitlyHSSinitiatedDetachwithSubscriptionwithdrawnToEMMDEREG.withTAURejectNCPCFNCPCFME EUSIMNCPME (E)USIM MEMENCPCFME USIM MENCPCFAwayFromEMMDEREGISTEREDNCPCFEUSIM MEUSIM MENCPCF(E)USIM MECF AttachRequestwith.andMMEsetsnewCF.If there is no . in MME, AKA is runned.CF AttachRequestwith.andMMEsetsnewCF.If there is no . in MME, AKA is runned.AttachRequestwithout.MMERunsEPSAKAFromECMIDLEtoECMCONNECTED初始化的 NAS消息不能加密NCPCFEUSIM MEMENCPCFCFCFKnasint 對(duì)初始化的 NAS消息進(jìn)行 Knasint 對(duì)初始化的 NAS消息進(jìn)行 進(jìn)入 ECMConnected時(shí)， MME將 EUSIM中的 CF標(biāo)識(shí)為無效！以保證 ME中的 CF是有效的。USIMFromECMIDLEtoECMCONNECTEDKnasenc= f(Kasme,0x15|0x01|0x0001|EEA1/2|0x0001)Knasint= f(Kasme,0x15|0x02|0x0001|EIA1/2|0x0001)Kenb = f(Kasme,0x11|UL NAS Count|0x0004 )NH0 = f(Kasme,0x12|Kenb|len(Kenb)=0x0020=32 )NH* = f(Kasme,0x12|NH |len(NH) )NCP/FCF/MEUSIM MECFKnasint對(duì)初始化的 NAS消息進(jìn)行 .KnasencInitialUEContextSetup(UE,Kenb)Kenb?f(Kasme)NCC?0NH?f(Kasme,Kenb)NCC?1EPSAKAUL/DLNASCount?0當(dāng) MME改變且 PLMNID發(fā)生改變時(shí)，必須要執(zhí)行，否則根據(jù) MME的 Policy來決定NAS.AS(EncAlg,IpAlg),僅僅用于 (extended) Service Request消息或 TAU With Active Flag消息FromECM?CONNECTEDtoECMIDLENCP/FCF/xEUSIM MEMECF/MNCP/F NCP/FCF/M?UE?對(duì)于 FullNativeKnasint,Knasenc不存貯USIM?UE?對(duì)于 FullNativeKnasint,Knasenc不存貯MME傳遞 Kenb給 ENBMMETargeteNBInitialContextSetup(UE,Kenb)UEContextModification(UE,Kenb)eNB:0?NCC,afterreceivingS1APInitialContextSetupRequestmessage.49IntraLTETAU? K’asme=f(CK||IK,0x19|NONCEue|0x0004|NONCEmme|0x0004)UE MMEo MMEnUE注冊(cè)到 MMEo中 TAU Requestwith.(nativeGUTI,eKSI,LVTAI)ContextRequest(GUTI,CompleteTAUmessage)ContextResponse(IMSI,MMContext(CK,IK,KSI),UE,EPSBearers,EPSAVs)TAUResponse(GUTI,TAIList)NAS(eKSI,SelectedNAS,UE)NAS()FromEUTRANtoUTRANRAU? NASToken=f(Kasme,0x17|ULNASCOUNT|0x0004)? CK’|IK’1