External Key Management Server

Description

The External KMS (Key Management Server) is a security entity that serves as the root of trust for a specific External Security Domain. It is responsible for managing cryptographic keys used to protect communications and data within that domain. In 3GPP networks, the External KMS is defined in specifications such as 3GPP TS 33.180 and TS 33.880, which cover security aspects of mission-critical services and other applications. The External KMS operates outside the 3GPP network operator's domain but interfaces with it to provide key management services for external security domains, such as those used by mission-critical push-to-talk (MCPTT) or other vertical industries.

The External KMS generates, distributes, and manages keys for entities within its security domain. It ensures that only authorized entities can access the keys and that keys are securely stored and transported. The KMS may use protocols such as MIKEY (Multimedia Internet KEYing) or other key management protocols to deliver keys to the relevant parties. In the context of 3GPP, the External KMS interacts with the 3GPP network's key management infrastructure, such as the Key Management Function (KMF) or the Authentication Server Function (AUSF), to enable secure communication between UEs and application servers.

The architecture typically involves a hierarchy of key management functions. The External KMS is at the top of the hierarchy for its domain, and it may delegate key management to subordinate KMS instances. The root of trust means that all entities in the domain trust the External KMS to generate and distribute valid keys. The External KMS may also perform key derivation, key update, and key revocation. It ensures that keys are fresh and that compromised keys can be revoked.

In 3GPP, the External KMS is particularly relevant for mission-critical services, where security and privacy are paramount. For example, in MCPTT, the External KMS manages the keys used to encrypt voice and data communications among group members. It ensures that only authorized users can participate in the group and that the communication is confidential and integrity-protected. The External KMS may also be used for other applications, such as IoT security or network slicing, where separate security domains are needed.

The External KMS is defined in 3GPP TS 33.180, which specifies the security architecture for mission-critical services. The term was introduced in Release 14 and has been maintained in subsequent releases. In Release 16, the wording was slightly changed from 'acts as the root of trust' to 'is the root of trust', but the meaning remains the same. The External KMS continues to be a key component for enabling secure mission-critical communications over 3GPP networks.

Purpose & Motivation

The External KMS exists to provide a trusted key management service for external security domains that require secure communication over 3GPP networks. Before its introduction, key management for mission-critical and other external applications was often handled in an ad-hoc manner, leading to interoperability issues and potential security weaknesses. The External KMS solves this by defining a standardized root of trust that can manage keys for a specific domain, ensuring that all entities within that domain can securely obtain and use cryptographic keys.

It addresses the need for end-to-end security in scenarios where the 3GPP network operator is not the only entity involved. For example, in mission-critical push-to-talk, the service may be provided by a third party, and the keys need to be managed by that third party's KMS. The External KMS allows the 3GPP network to interwork with such external KMSs, providing a secure and standardized interface. This enables new business models and ensures that security is not compromised when services span multiple domains.

Furthermore, the External KMS supports the growing demand for secure communication in vertical industries, such as public safety, transportation, and utilities. These industries often have their own security policies and key management requirements. The External KMS provides a way to integrate their key management infrastructure with 3GPP networks, ensuring that their security requirements are met. As 5G evolves, the External KMS will continue to play a vital role in enabling secure and trusted communication for a wide range of applications.