Section: 6.8.10.2 SRVCC from circuit switched GERAN to HSPA
Content: SRVCC handover from circuit switched GERAN to HSPA is defined in TS 23.216[ Single Radio Voice Call Continuity (SRVCC); Stage 2 ]  [37]. Figure 20: SRVCC handover from GERAN to HSPA The numbering in the following clauses refers to the signalling numbering in Figure 20. In the following, the term "latest" keys refer to the keys from the latest UMTS AKA or GSM AKA run respectively. If the current UMTS or GSM security context is mapped from an EPS security context and no AKA has been run in the current CS access, the term "latest" keys refer to the keys from the currently active UMTS or GSM security context 2. For UMTS subscribers, the source MSC server enhanced for SRVCC shall generate a NONCEMSC and derive CK'PS and IK'PS from this NONCEMSC and the latest CKCS and IKCS. The derivation shall be according to annex B.6. For The source MSC server enhanced for SRVCC shall further set the KSI'PS equal to the KSICS associated with the latest key set for UMTS subscribers, For GSM susbscribers, the source MSC server enhanced for SRVCC shall derive GPRS Kc' from the generated NONCEMSC and the latest GSM Kc. The derivation shall be according to annex B.7. The MSC server enhanced for SRVCC shall further set the CKSN'PS equal to CKSNCS associated with the latest key set for GSM subscribers. For UMTS subscribers, the MSC server enhanced for SRVCC shall transfer the CK'PS/IK'PS and the KSI'PS, to the target SGSN in the CS to PS handover request. For GSM subscribers, the MSC server enhanced for SRVCC shall transfer the GPRS Kc' and the CKSN'PS, to the target SGSN in the CS to PS handover request. NOTE 1: The MSC server enhanced for SRVCC does not include any authentication vectors in the CS to PS HO request, since this could result in that authentication vectors intended for use only in the CS domain would end up being used in a PS domain by accident. NOTE 2: The MSC server enhanced for SRVCC does not include any UE security capability information in the CS to PS HO request, since the target SGSN either has this information available, or will retrieve the information from the old SGSN. 3 and 4. The target SGSN can request context information for the UE from an old SGSN. The target SGSN shall discard any CKPS, IKPS, GPRS Kc, CKSNPS and KSIPS received from an old SGSN. If the target SGSN received any authentication vectors from the old SGSN, the target SGSN shall process these authentication vectors according to clause 6.3.4 of the present document. 5. If the target SGSN received a GPRS Kc' and a CKSN'PS from the MSC server enchanced for SRVCC, then the target SGSN shall compute CK' PS and IK'PS from the GPRS Kc' using functions c4 and c5 of the present document. The target SGSN shall associate the CK' PS and IK'PS with KSI'PS, which shall be set equal to CKSN'PS received from the source MSC server enhanced for SRVCC. SGSN shall send the CK'PS, IK'PS to the target RNC. 6a. The target RNC shall include the transparent container (RRCConnectionReconfiguration message) sent to the source BSC via the core network. 7. The target SGSN shall include the transparent container received from the target RNC in the CS to PS HO Response message sent to source MSC server enhanced for SRVCC. 8. Source MSC server enhanced for SRVCC shall include the transparent container and the NONCEMSC in the CS to PS HO command sent to the source BSC. 9. The source BSC shall include the transparent container and the NONCEMSC in the CS to PS HO command sent to the ME. NOTE: This CS to PS HO command is optionally ciphered for GERAN. For UMTS subscribers, the ME shall derive CK'PS and IK'PS. The derivation shall be done according to annex B.6, using the NONCEMSC received in the CS to PS HO command, the latest CKCS and IKCS. The ME shall set KSI'PS equal to KSICS and associate the newly derived keys with KSI'PS. If the USIM supports storage of GPRS Kc, the ME shall derive GPRS Kc' from CK'PS and IK'PS using the function c3 of the present specification. The ME shall associate the GPRS Kc' with CKSN'PS which shall be set equal to KSI’PS. The ME shall overwrite the stored parameters CKPS, IKPS , KSIPS , GPRS ciphering key Kc and GPRS CKSN PS if any, with the derived parameters CK’PS, IK’PS, KSI’PS, GPRS ciphering key Kc’ and GPRS CKSN’ PS in both ME and USIM when the SRVCC handover has been completed successfully.. For GSM subscribers, the ME shall derive GPRS Kc' according to annex B.7, using the NONCEMSC received in the CS to PS HO command and the latest GSM Kc. The ME shall set CKSN'PS equal to CKSNCS associated with the latest GSM security context and associate it with the GPRS Kc'. The ME shall in this case also derive CK'PS and IK'PS from the GPRS Kc' using the c4 and c5 functions of the present specification. The ME shall associate the CK'PS and IK'PS with KSI'PS which shall be set equal to CKSN'PS. The ME shall overwrite the stored parameters 64-bit GPRS ciphering key Kc and GPRS CKSNPS, if any, with the derived parameters GPRS ciphering key Kc’ and GPRS CKSN’PS in both ME and SIM when the SRVCC handover has been completed successfully. 10. .The ME sends the CS to PS handover confirmation message to the target RNC and the CK'PS and IK'PS shall become the active key set both in the ME and in the RNC. If the SRVCC handover fails, the ME and the network shall discard all changes of state as specified above.