UE security capabilities

Description

UE security capabilities refer to the set of identifiers corresponding to the ciphering and integrity algorithms implemented in the User Equipment (UE). These capabilities are crucial for the establishment of secure communication between the UE and the network. The UE security capabilities include algorithms for both Access Stratum (AS) and Non-Access Stratum (NAS) in EPS (Evolved Packet System), as well as for UTRAN and GERAN if these access types are supported by the UE. The capabilities are defined in 3GPP TS 33.401 (EPS security architecture) and TS 33.501 (5G security architecture). The UE signals its security capabilities to the network during initial attach, tracking area update, or other NAS procedures, allowing the network to select a mutually supported algorithm for ciphering and integrity protection.

The UE security capabilities are typically represented as a bitmask or a list of algorithm identifiers. For EPS, the algorithms include the EPS Encryption Algorithms (EEA) and EPS Integrity Algorithms (EIA). For 5G, the algorithms include the 5G Encryption Algorithms (NEA) and 5G Integrity Algorithms (NIA). The UE indicates which of these algorithms it supports. The network (e.g., MME or AMF) then selects one algorithm for ciphering and one for integrity from the intersection of the UE's capabilities and the network's own supported algorithms and policies. The selected algorithms are then used to protect the NAS and AS signaling and user data. The UE security capabilities are also used during handovers between different radio access technologies (RATs) to ensure that the target system supports the algorithms in use.

The UE security capabilities are part of the UE's security context. They are stored in the UE and in the network (e.g., in the MME/AMF). When the UE registers with the network, it includes its security capabilities in the Attach Request or Tracking Area Update Request message. The network may also request the UE's security capabilities during a Security Mode Command procedure. The UE security capabilities are essential for negotiating the security algorithms and ensuring that the UE and network can communicate securely. If the UE and network do not share any common algorithm, the network may reject the connection or fall back to a less secure algorithm (if allowed by policy).

The UE security capabilities also include capabilities for UTRAN and GERAN if the UE supports these access types. This is important for inter-RAT handovers, where the UE may move from E-UTRAN to UTRAN or GERAN. The UE must indicate which algorithms it supports for these access types so that the target network can select appropriate algorithms. The UE security capabilities are thus a comprehensive set of algorithm identifiers that cover all the access technologies the UE supports. This ensures that security is maintained even when the UE moves between different generations of networks.

In 5G, the UE security capabilities are extended to include the new 5G algorithms (NEA and NIA) and may also include capabilities for non-3GPP access. The UE security capabilities are signaled in the 5G NAS messages and are used by the AMF to select the 5G algorithms. The UE security capabilities are also used in the 5G security context, which is established during the primary authentication and key agreement procedure. The UE security capabilities are a fundamental part of the 3GPP security architecture, ensuring that the UE and network can agree on a common set of security algorithms and protect the communication accordingly.

Purpose & Motivation

UE security capabilities exist to enable the network and the UE to negotiate a common set of ciphering and integrity algorithms for secure communication. Before their introduction, security algorithms were often fixed or limited, leading to interoperability issues and potential security weaknesses. The UE security capabilities allow the network to select the strongest mutually supported algorithms, enhancing security and flexibility. They were introduced in Release 8 as part of the EPS security architecture, which aimed to provide a robust and scalable security framework for LTE. The capabilities solve the problem of algorithm negotiation by providing a standardized way for the UE to advertise its supported algorithms. They also support inter-RAT mobility by including capabilities for UTRAN and GERAN, ensuring that security is maintained during handovers. The UE security capabilities are essential for the security of both NAS and AS signaling and user data, and they are a prerequisite for the establishment of a secure connection.