SIST EN 300 920 V7.1.1:2003

• Abstract:

  CR SMG#31

• Status: Published
• Publication Date: 30-Nov-2003
• ICS: 33.070.50 - Global System for Mobile Communication (GSM)
• Technical Committee: SS EIT - Technical Board for the electrotechnical, information technology and telecommunications fields
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 01-Dec-2003
• Due Date: 01-Dec-2003
• Completion Date: 01-Dec-2003
• Ref Project: ETSI EN 300 920 V7.1.1 (2000-08) - Digital cellular telecommunications system (Phase 2+) (GSM); Security aspects (GSM 02.09 version 7.1.1 Release 1998)

Overview

SIST EN 300 920 V7.1.1:2003 defines security aspects for the digital cellular telecommunications system (GSM), focusing on Phase 2+ functionalities as per GSM 02.09 version 7.1.1 (Release 1998). Developed by the Slovenski inštitut za standardizacijo (SIST) and aligned with the European telecommunications standard EN 300 920, this document specifies essential security features necessary to protect both operators and subscribers in GSM public land mobile networks (PLMN). The standard addresses challenges that arise due to the unique nature of radio-based mobile communications, which differ significantly from conventional fixed networks, requiring dedicated measures for confidentiality, authentication, and data integrity.

Key Topics

• Subscriber Identity Confidentiality
  Ensures that the International Mobile Subscriber Identity (IMSI) is not exposed or accessible to unauthorized entities, safeguarding subscriber privacy and preventing tracking of mobile users via the radio interface.

• Subscriber Identity Authentication
  Provides mechanisms for the network to verify the legitimacy of the subscriber's identity, protecting against unauthorized network access and impersonation. Strong authentication is enforced during critical events such as registration, location updates, and service requests.

• User Data Confidentiality (Voice and Non-Voice)
  Encrypts user data exchanged over traffic channels, ensuring that both voice calls and data transactions remain private. The standard supports several ciphering algorithms, and both the infrastructure and mobile equipment must be compatible with these for optimal security.

• Connectionless User Data Confidentiality
  Protects user data sent in connectionless packet modes, such as SMS, from interception or unauthorized disclosure over signaling channels.

• Signalling Information Element Confidentiality
  Secures critical signaling information exchanged between mobiles and the network, especially after call setup. Protected elements include subscriber and equipment identities, as well as directory numbers in call events.

Applications

SIST EN 300 920 V7.1.1:2003 is crucial for:

• Mobile network operators - Implementing and maintaining robust security measures to ensure subscriber identity protection, service authentication, and data privacy across GSM networks.
• Mobile device manufacturers - Ensuring mobile equipment meets mandatory security feature requirements for use in GSM networks, including secure storage of identities and support for specified encryption algorithms.
• Telecommunications service providers - Aligning operational processes with security policies to prevent misuse, eavesdropping, and unauthorized access, especially for services such as voice calls, SMS, and data sessions.
• Regulatory compliance - Providing a standardized security framework for jurisdictions mandating GSM security at both network and device levels.

By adopting these security features, stakeholders in the mobile ecosystem can provide service assurance, customer trust, and compliance with European and international security benchmarks.

Related Standards

• GSM 01.04: Abbreviations and acronyms for digital cellular telecommunications.
• GSM 02.02: Specifications for bearer services supported by GSM PLMN.
• GSM 02.03: Specifications for teleservices within GSM PLMN.
• GSM 03.20: Details on security-related network functions in GSM.
• GSM 11.11: Specification of the Subscriber Identity Module (SIM) and Mobile Equipment (ME) interface.

These standards collectively support the implementation and integration of security features outlined in SIST EN 300 920 V7.1.1, ensuring a unified approach to GSM network security across Europe and beyond.

For telecommunications engineers, network planners, and security professionals involved in GSM deployment, understanding and applying SIST EN 300 920 provides a vital foundation for protecting users and infrastructure in a rapidly evolving mobile communications landscape.

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Digital cellular telecommunications system (Phase 2+) (GSM); Security aspects (GSM 02.09 version 7.1.1 Release 1998)33.070.50Globalni sistem za mobilno telekomunikacijo (GSM)Global System for Mobile Communication (GSM)ICS:Ta slovenski standard je istoveten z:EN 300 920 Version 7.1.1SIST EN 300 920 V7.1.1:2003en01-december-2003SIST EN 300 920 V7.1.1:2003SLOVENSKI
STANDARD
ETSIEN300920V7.1.1(2000-08)EuropeanStandard(Telecommunicationsseries)Digitalcellulartelecommunicationssystem(Phase2+);Securityaspects(GSM02.09version7.1.1Release1998)GLOBALSYSTEMFORMOBILECOMMUNICATIONSRSIST EN 300 920 V7.1.1:2003

ETSIETSIEN300920V7.1.1(2000-08)2(GSM02.09version7.1.1Release1998)ReferenceREN/SMG-010209Q7R1KeywordsDigitalcellulartelecommunicationssystem,GlobalSystemforMobilecommunications(GSM)ETSI650RoutedesLuciolesF-06921SophiaAntipolisCedex-FRANCETel.:[phone]Fax:[phone]SiretN°34862356200017-NAF742CAssociationàbutnonlucratifenregistréeàlaSous-PréfecturedeGrasse(06)N°7803/88ImportantnoticeIndividualcopiesofthepresentdocumentcanbedownloadedfrom:http://www.etsi.orgThepresentdocumentmaybemadeavailableinmorethanoneelectronicversionorinprint.Inanycaseofexistingorperceiveddifferenceincontentsbetweensuchversions,thereferenceversionisthePortableDocumentFormat(PDF).Incaseofdispute,thereferenceshallbetheprintingonETSIprintersofthePDFversionkeptonaspecificnetworkdrivewithinETSISecretariat.Usersofthepresentdocumentshouldbeawarethatthedocumentmaybesubjecttorevisionorchangeofstatus.InformationonthecurrentstatusofthisandotherETSIdocumentsisavailableathttp://www.etsi.org/tb/status/Ifyoufinderrorsinthepresentdocument,sendyourcommentto:[e-mail]opartmaybereproducedexceptasauthorizedbywrittenpermission.Thecopyrightandtheforegoingrestrictionextendtoreproductioninallmedia.©EuropeanTelecommunicationsStandardsInstitute2000.Allrightsreserved.SIST EN 300 920 V7.1.1:2003

ETSIETSIEN300920V7.1.1(2000-08)3(GSM02.09version7.1.1Release1998)ContentsIntellectualPropertyRights.4Foreword.41Scope.51.1References.51.2Abbreviations.52General.63SecurityfeaturesprovidedinaGSMPLMN.63.1Subscriberidentityconfidentiality.63.1.1Definition.63.1.2Purpose.63.1.3Functionalrequirements.73.2Subscriberidentityauthentication.73.2.1Definition.73.2.2Purpose.73.2.3Functionalrequirements.73.2.4Authenticationduringamalfunctionofthenetwork.73.3Userdataconfidentialityonphysicalconnections(VoiceandNon-voice).83.3.1Definition.83.3.2Purpose.83.3.3Functionalrequirements.83.4Connectionlessuserdataconfidentiality.83.4.1Definition.83.4.2Purpose.83.4.3Functionalrequirements.93.5Signallinginformationelementconfidentiality.93.5.1Definition.93.5.2Purpose.93.5.3Functionalrequirements.9AnnexA(informative):Changehistory.10History.11SIST EN 300 920 V7.1.1:2003

ETSIETSIEN300920V7.1.1(2000-08)4(GSM02.09version7.1.1Release1998)IntellectualPropertyRightsIPRsessentialorpotentiallyessentialtothepresentdocumentmayhavebeendeclaredtoETSI.TheinformationpertainingtotheseessentialIPRs,ifany,ispubliclyavailableforETSImembersandnon-members,andcanbefoundinETSISR000314:"IntellectualPropertyRights(IPRs);Essential,orpotentiallyEssential,IPRsnotifiedtoETSIinrespectofETSIstandards",whichisavailablefromtheETSISecretariat.LatestupdatesareavailableontheETSIWebserver(http://www.etsi.org/ipr).PursuanttotheETSIIPRPolicy,noinvestigation,includingIPRsearches,hasbeencarriedoutbyETSI.NoguaranteecanbegivenastotheexistenceofotherIPRsnotreferencedinETSISR000314(ortheupdatesontheETSIWebserver)whichare,ormaybe,ormaybecome,essentialtothepresentdocument.ForewordThisEuropeanStandard(Telecommunicationsseries)hasbeenproducedbyETSITechnicalCommitteeSpecialMobileGroup(SMG).Thepresentdocumentdefinessecurityfeatureswithinthedigitalcellulartelecommunicationssystem.ThecontentsofthepresentdocumentmaybesubjecttocontinuingworkwithinSMGandmaychangefollowingformalSMGapproval.ShouldSMGmodifythecontentsofthepresentdocumentitwillthenbere-submittedforformalapprovalproceduresbyETSIwithanidentifyingchangeofreleasedateandanincreaseinversionnumberasfollows:Version7.x.ywhere:7GSMPhase2+Release1998;xtheseconddigitisincrementedforchangesofsubstance,i.e.technicalenhancements,corrections,updates,etc.;ythethirddigitisincrementedwheneditorialonlychangeshavebeenincorporatedinthespecification.NationaltranspositiondatesDateofadoptionofthisEN:14July2000DateoflatestannouncementofthisEN(doa):31October2000DateoflatestpublicationofnewNationalStandardorendorsementofthisEN(dop/e):30April2001DateofwithdrawalofanyconflictingNationalStandard(dow):30April2001SIST EN 300 920 V7.1.1:2003

ETSIETSIEN300920V7.1.1(2000-08)5(GSM02.09version7.1.1Release1998)1ScopeBearerandTeleservices,asrespectivelydefinedinGSM02.02andGSM02.03,aretheobjectswhichtheGSMPLMNoperatorsoffertotheircustomers.Besidesthesebasictelecommunicationsservices,featureswhichaimatup-gradingthesebasicservicesneedalsotobeoffered.DuetotheuseofradiocommunicationsinaPLMN,whichareofaspecialnaturecomparedtoclassicaldistributiontransmissiontechniquesusedinthefixednetworks,suchacategoryoffeaturesisrelatedtosecurityaspects.InaGSMPLMN,boththeusersandthenetworkoperatorhavetobeprotectedagainstundesirableintrusionofthirdparties.However,measuresshouldbeprovidedforinordertoinsuremaximumprotectionoftherightsoftheindividualsconcerns.Asaconsequence,asecurityfeatureiseitherasupplementaryservicetoTeleorBearerservices,whichcanbeselectedbythesubscriber,oranetworkfunctioninvolvedintheprovisionofoneorseveraltelecommunicationservices.ThepurposeofthepresentdocumentistodefinethesecurityfeatureswhicharetobeavailableinaGSMPLMN,togetherwiththeassociatedlevelsofprotection.Thepresentdocumentisonlyconcernedwiththosesecurityfeatureswhichaimattheup-gradingofthesecurityinaGSMPLMN.Inparticular,end-to-endsecurityisoutsidethescopeofthepresentdocument.TheimplementationaspectsofsecurityfeaturesaredescribedinGSM03.20.1.1ReferencesThefollowingdocumentscontainprovisionswhich,throughreferenceinthistext,constituteprovisionsofthepresentdocument.• Referencesareeitherspecific(identifiedbydateofpublication,editionnumber,versionnumber,etc.)ornon-specific.• Foraspecificreference,subsequentrevisionsdonotapply.• Foranon-specificreference,thelatestversionapplies.• Anon-specificreferencetoanETSshallalsobetakentorefertolaterversionspublishedasanENwiththesamenumber.• ForthisRelease1998document,referencestoGSMdocumentsareforRelease1998versions(version7.x.y).[1]GSM01.04:"Digitalcellulartelecommunicationssystem(Phase2+);Abbreviationsandacronyms".[2]GSM02.02:"Digitalcellulartelecommunicationssystem(Phase2+);BearerServices(BS)supportedbyaGSMPublicLandMobileNetwork(PLMN)".[3]GSM02.03
...