Section: 6.8.10.1 SRVCC from HSPA to circuit switched UTRAN/GERAN
Content: HSPA SRVCC to UTRAN/GERAN is described in TS 23.216[ Single Radio Voice Call Continuity (SRVCC); Stage 2 ]  [37]. Case 1: UMTS subscribers: Case 1.1: HO to UTRAN When the SRNC decides to start a SRVCC from HSPA to UTRAN, it shall initiate the SRVCC Preparation procedure described in TS 25.413[ UTRAN Iu interface Radio Access Network Application Part (RANAP) signalling ]  [31]. The source SGSN shall generate a NONCE and derive CK'CS||IK'CS from the NONCE and the CKPS||IKPS generated during the latest UMTS AKA procedure. In case the current UMTS security context is mapped from an EPS security context and there has been no UMTS AKA run since the current UMTS security context was mapped, the CKPS, IKPS and GPRS Kc belonging to the mapped UMTS security context shall be considered to be the keys from the latest UMTS AKA. The source SGSN shall transfer CK’CS, IK’CS, KSI’CS (=KSIPS) and the NONCE to the SRNC and transfer CK’CS, IK’CS and KSI’CS (=KSIPS) to the MSC server enhanced for SRVCC. The SRNC shall transfer the NONCE to the target RNC. The target RNC shall include the NONCE in the handover command to be sent to the UE. The SRNC shall also transfer the security context, including CK’CS, IK’CS, KSI’CS and START CS (which is received by the SRNC during RRC connection establishment), to the target RNC. Upon reception of the handover command, the ME shall derive CK'CS||IK'CS from CKPS||IKPS and the NONCE, and set KSI’CS to KSIPS. The ME shall convert GSM ciphering key Kc’ from CK’CS||IK’CS, and set GSM CKSN’ CS equal to KSI’CS. For the definition of the Key Derivation Function and its inputs see Annex B.3. NOTE 1: Due to replacing all the UTRAN CS key parameters CK, IK, KSI with CK'CS, IK'CS and KSI’CS on USIM and in ME, a new GSM ciphering key Kc’ needs to be derived from the new UTRAN CS key parameters CK and IK (i.e. CK’CS and IK’CS), which is part of the new UMTS security context as well, as any old GSM ciphering key Kc stored on USIM and in ME, belongs to an old UMTS security context and can no longer be taken into use. Case 1.2: HO to GERAN When the SRVCC is from HSPA to GERAN, the source SGSN shall generate a NONCE and derive CK’CS, and IK’CS from the NONCE and the CKPS||IKPS generated during the latest UMTS AKA procedure. In case the current UMTS security context is mapped from an EPS security context and there has been no UMTS AKA run since the current UMTS security context was mapped, the CKPS, IKPS and GPRS Kc belonging to the mapped UMTS security context shall be considered to be the keys from the latest UMTS AKA. The source SGSN shall append the NONCE to the GSM HO command, received from the target BSS, when forwarding the command to the SRNC. The SRNC shall forward the NONCE together with the GSM HO command to the UE. The source SGSN shall transfer the security context, including CK’CS, IK’CS and KSI’CS (=KSIPS) to the MSC server enhanced for SRVCC. The MSC server enhanced for SRVCC and the ME shall convert CK’CS||IK’CS to GSM ciphering key Kc’, and set GSM CKSN’ CS to KSI’CS. Upon reception of the handover command, the ME shall derive CK’CS, and IK’CS from CKPS||IKPS and the NONCE, convert GSM ciphering key Kc’ from CK’CS||IK’CS, and set GSM CKSN’ CS to KSI’CS. For the definition of the Key Derivation Function and its inputs see Annex B.3. NOTE 2: See note 1. If a 128-bit GSM ciphering algorithm is taken into use, the target MSC server enhanced for SRVCC and UE shall derive the GSM ciphering key Kc128 key derived from CK'CS||IK'CS as described in annex B.5. For both cases 1.1 and 1.2: The MSC server enhanced for SRVCC shall overwrite the stored parameters CKCS, IKCS and KSICS if any, with the parameters CK’CS, IK’CS and KSI’CS received from the source SGSN when the SRVCC handover has been completed successfully. The ME shall overwrite the stored parameters CKCS, IKCS , KSICS , GSM ciphering key Kc and GSM CKSN CS if any, with the derived parameters CK’CS, IK’CS, KSI’CS, GSM ciphering key Kc’ and GSM CKSN’ CS in both ME and USIM when the SRVCC handover has been completed successfully. If the SRVCC handover isn’t completed successfully, the MSC server enhanced for SRVCC and the UE shall discard CK’CS, IK’CS and KSI’CS. NOTE 1: The new derived security context overwriting the stored values in the USIM is for allowing reusing the derived security context without invoking the authentication procedure in the subsequent connection set-ups, and also for avoiding that one KSI value indicates to two different key sets and consequently leads to security context desynchronization. NOTE 2: An operator concerned about the security of keys received from an UTRAN of another operator may want to enforce a policy in the MSC server to run an AKA as soon as possible after the handover. One example of ensuring this is the deletion of the derived security context in the MSC server after the UE has left active state. The MSC server enhanced for SRVCC shall delete the stored parameters CKCS and IKCS if the SRVCC handover is not completed successfully. Case 2: GSM subscribers Case 2.1: HO to UTRAN When the SRNC decides to start a SRVCC from HSPA to UTRAN, it shall initiate the SRVCC Preparation procedure (see TS 25.413[ UTRAN Iu interface Radio Access Network Application Part (RANAP) signalling ] ). The source SGSN shall generate a NONCE and derive GSM ciphering key Kc’ from the NONCE and the GPRS Kc generated in the latest successful GSM AKA. The source SGSN shall set GSM CKSN’CS and KSI’CS to GPRS CKSNPS. . The source SGSN shall compute CK’CS, IK’CS from GSM ciphering key Kc’, using the conversion functions c4 and c5, and transfer CK’CS, IK’CS and KSI’CS to the SRNC. The SRNC shall transfer the NONCE to the target RNC. The target RNC shall include the NONCE in the handover command to be sent to the UE. The SRNC shall transfer the security context, including CK’CS, IK’CS, KSI’CS and START CS (which is received by the SRNC during RRC connection establishment), to the target RNC. The source SGSN shall also transfer GSM ciphering key Kc’ and GSM CKSN’ CS to the MSC server enhanced for SRVCC. Upon reception of the handover command, the UE shall derive GSM ciphering key Kc’ from the GPRS Kc generated in the latest successful GSM AKA and the NONCE. The UE shall set GSM CKSN’CS and KSI’CS to GPRS CKSNPS. The UE shall compute CK’CS, IK’CS from GSM ciphering key Kc’, using the conversion functions c4 and c5. For the definition of the Key Derivation Functions see Annex B.4. Case 2.2: HO to GERAN When the SRVCC is from HSPA to GERAN, the source SGSN shall generate a NONCE and derive GSM ciphering key Kc’ from the NONCE and the 64-bit GPRS Kc generated in the latest successful GSM AKA. The source SGSN shall append the NONCE to the GSM HO command, received from the target BSS, when forwarding the command to the SRNC. The SRNC shall forward the NONCE together with the GSM HO command to the UE. The source SGSN shall set GSM CKSN’CS to GPRS CKSNPS and transfer GSM ciphering key Kc’ and GSM CKSN’CS to the MSC server enhanced for SRVCC. Upon reception of the handover command, the UE shall derive GSM ciphering key Kc’ from the GPRS Kc generated in the latest successful GSM AKA and the NONCE, and set GSM CKSN’CS to GPRS CKSNPS. For the definition of the Key Derivation Functions see Annex B.4. For both cases 2.1 and 2.2: The MSC server enhanced for SRVCC shall overwrite the stored parameters 64-bit GSM ciphering key Kc and GSM CKSNCS, if any, with the parameters GSM ciphering key Kc’ and GSM CKSN’CS received from the source SGSN when the SRVCC handover has been completed successfully. The UE shall overwrite the stored parameters 64-bit GSM ciphering key Kc and GSM CKSNCS, if any, with the derived parameters GSM ciphering key Kc’ and GSM CKSN’CS in both ME and SIM when the SRVCC handover has been completed successfully. If the SRVCC handover isn’t completed successfully, the MSC server enhanced for SRVCC and the UE shall discard GSM ciphering key Kc’ and GSM CKSN’CS. NOTE 3: The new derived security context overwriting the stored values in the SIM is for allowing reusing the derived security context without invoking the authentication procedure in the subsequent connection set-ups, and also for avoiding that one CKSN value indicates to two different key sets and consequently leads to security context desynchronization. If the SRVCC is for an emergency call and the session in HSPA complies with clause 6.4.9.1, the security procedure in this subclause shall be applied. If the SRVCC is for an emergency call and the session in HSPA complies with clause 6.4.9.2, the security procedure in this subclause shall not be applied, i.e., no key derivation is needed. The MSC server enhanced for SRVCC shall delete the stored parameters CKCS and IKCS if the SRVCC handover isn’t completed successfully, so for any subsequent CS connection a new CS key-set is generated.