Data Integrity Protection and Encryption (RAN15.0 - 01) PDF

WCDMA RAN
Data Integrity Protection and

Encryption Feature Parameter
Description
Issue
01
Date
2013-04-28
HUAWEI TECHNOLOGIES CO., LTD.
Copyright Huawei Technologies Co., Ltd. 2014. All rights reserved.

No part of this document may be reproduced or transmitted in any form or by any means without prior written
consent of Huawei Technologies Co., Ltd.
Trademarks and Permissions

and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.
All other trademarks and trade names mentioned in this document are the property of their respective holders.
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and the
customer. All or part of the products, services and features described in this document may not be within the
purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information,
and recommendations in this document are provided "AS IS" without warranties, guarantees or representations
of any kind, either express or implied.
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute a warranty of any kind, express or implied.
Huawei Technologies Co., Ltd.

Address:
Huawei Industrial Base

Bantian, Longgang
Shenzhen 518129
People's Republic of China
Website:
http://www.huawei.com
Email:
support@huawei.com
Issue 01 (2013-04-28)
Huawei Proprietary and Confidential

Copyright Huawei Technologies Co., Ltd.
WCDMA RAN
Data Integrity Protection and Encryption Feature Parameter
Description
Contents
Contents
1 Introduction....................................................................................................................................1
1.1 Scope..............................................................................................................................................................................1
1.2 Intended Audience..........................................................................................................................................................1
1.3 Change History...............................................................................................................................................................1
2 Overview.........................................................................................................................................3
3 Technical Description...................................................................................................................4
3.1 Integrity Protection of Signaling....................................................................................................................................4
3.1.1 Integrity Algorithm......................................................................................................................................................4
3.1.2 Integrity Protection Procedure.....................................................................................................................................4
3.2 Encryption of Signaling and User Data..........................................................................................................................6
3.2.1 Encryption Algorithm..................................................................................................................................................6
3.2.2 Ciphering Procedure....................................................................................................................................................6
3.3 Negotiation of Encryption and Integrity Algorithms.....................................................................................................8
4 Engineering Guidelines.............................................................................................................10
4.1 Integrity Protection.......................................................................................................................................................10
4.1.1 Requirements.............................................................................................................................................................10
4.1.2 Data Preparation........................................................................................................................................................10
4.1.3 Feature Activation.....................................................................................................................................................10
4.1.4 Activation Check.......................................................................................................................................................10
4.1.5 Feature Deactivation..................................................................................................................................................11
4.1.6 Example.....................................................................................................................................................................11
4.2 Encryption....................................................................................................................................................................11
4.2.1 Requirements.............................................................................................................................................................11
4.2.2 Data Preparation........................................................................................................................................................11
4.2.3 Feature Activation.....................................................................................................................................................11
4.2.4 Activation Check.......................................................................................................................................................11
4.2.5 Feature Deactivation..................................................................................................................................................12
4.2.6 Example.....................................................................................................................................................................12
5 Parameters.....................................................................................................................................13
6 Counters........................................................................................................................................65
Issue 01 (2013-04-28)

ii
WCDMA RAN
Description
Contents
7 Glossary.........................................................................................................................................68
8 Reference Documents.................................................................................................................69
Issue 01 (2013-04-28)

iii
WCDMA RAN
Description
1 Introduction
Introduction
1.1 Scope
This document describes data integrity protection and encryption, including its technical
principles, related features, network impact, and engineering guidelines.
This document covers the following features:
l
WRFD-011401 Integrity Protection
WRFD-011402 Encryption
1.2 Intended Audience

This document is intended for personnel who:
l
Need to understand the features described herein
Work with Huawei products
1.3 Change History

This section provides information about the changes in different document versions. There are
two types of changes, which are defined as follows:
l
Feature change
Changes in features of a specific product version
Editorial change
Changes in wording or addition of information that was not described in the earlier version
01(2013-04-28)
This issue does not include any changes.
Issue 01 (2013-04-28)

WCDMA RAN
Description
1 Introduction
Draft A (2013-01-30)
Compared with issue 01(2012-07-20) of RAN14.0, Draft A (2013-01-30) of RAN15.0 does not
include any changes.
Issue 01 (2013-04-28)

WCDMA RAN
Description
2 Overview
Overview
To protect user data from illegal interception and to protect networks from illegal modification,
the WCDMA system introduces the function of data integrity protection and encryption.
The 3G system uses longer cipher keys, more robust encryption and data integrity algorithms
for the security of user data and networks.
The integrity protection mechanism handles the control of integrity protection of signaling data
and the coordination of integrity keys between different core networks (PS and CS). It enables
the receiving entity (the UE or the RNC) to check whether the signaling data is illegally changed.
It encrypts and decrypts the signaling data by using a certain integrity algorithm with an integrity
key (IK).
The encryption mechanism handles the control of ciphering of data and signaling data and the
coordination encryption keys between different core networks (PS and CS). It encrypts and
decrypts data and signaling by using a certain encryption algorithm with a cipher key (CK).
The function of data integrity protection and encryption is applied for the following purposes:
l
To enhance the security of networks and user data
To protect the data and networks from illegal interception and modification
To prevent the imitation behavior
Issue 01 (2013-04-28)

WCDMA RAN
Description
3 Technical Description
Technical Description
3.1 Integrity Protection of Signaling

This section describes the integrity algorithm parameters and the integrity protection procedure.
3.1.1 Integrity Algorithm

Currently, the RNC supports only UMTS Integrity Algorithm 1 (UIA1), that is, integrity
algorithm f9. The support for the algorithm can be set through the IntegrityProtectAlgo
parameter on the RNC side.
The UE is required to support the encryption and integrity algorithms.
The sub-parameter UL_INTER_PROTECT_SWITCH of PROCESSSWITCH specifies
whether to enable integrity protection for uplink RRC messages.
3.1.2 Integrity Protection Procedure

Integrity protection is implemented at the RRC layer of the radio interface by the UE and RNC.
Figure 3-1 shows how to authenticate data integrity of a signaling message by using the integrity
algorithm f9.
Issue 01 (2013-04-28)

WCDMA RAN
Description
Figure 3-1 Derivation of MAC-I or XMAC-I from a signaling message
Table 3-1 describes the input parameters to the integrity algorithm.

Table 3-1 Input parameters to the integrity algorithm
Item
Name
Description
IK
Integrity key
IK is 128 bits long. It is used to establish CS connections

(IKCS) between the CS domain and the UE, or PS
connections (IKPS) between the PS domain and the UE.
The most recently received IK, either IKCS or IKPS, is
used for integrity protection.
For UMTS subscribers, IK is generated during the
implementation of UMTS Authentication and Key
Agreement (AKA) and stored in the USIM with a copy
in the ME.
IK can be sent:
l From the USIM to the ME upon request of the ME
l From the HLR/AuC to the VLR/SGSN and stored in
the VLR/SGSN as part of a quintet
l In the RANAP message SECURITY MODE
COMMAND from the VLR/SGSN to the RNC
Issue 01 (2013-04-28)

WCDMA RAN
Description
Item
Name
Description
COUNT-I
Integrity
sequence
number
COUNT_I is 32 bits long. For Signaling Radio Bearers

(SRBs) from SRB0 to SRB4, there is one COUNT-I value
for each uplink SRB and one COUNT-I value for each
downlink SRB.
The COUNT-I consists of the Hyper Frame Number
(HFN) and the RRC Sequence Number (RRC SN). The
HFN is 28 bits long, and the RRC SN is 4 bits long. Each
time an RRC message is sent, the RRC SN increases by
1. At each RRC SN cycle, the HFN increases by 1.
FRESH
Fresh
FRESH is 32 bits long. It is a random number generated

by the RNC and is sent to the UE through the RRC
message SECURITY MODE COMMAND.
FRESH ensures that the MAC-I is unique.
DIRECTIO
N
Direction bit
DIRECTION is 1 bit long. It is used to indicate uplink or

downlink.
The value 0 indicates uplink, and the value 1 indicates
downlink.
MESSAGE
Signaling data
Message data
Based on these input parameters, the sender uses the integrity algorithm f9 to compute MAC-I,
that is, the message authentication code for data integrity. The MAC-I is then appended to the
message when it is sent over the radio access link. The receiver uses the same algorithm to
compute XMAC-I and then verifies the data integrity by comparing the XMAC-I with the
received MAC-I.
3.2 Encryption of Signaling and User Data

This section describes the encryption algorithm parameters and the ciphering procedure.
3.2.1 Encryption Algorithm

The RNC supports two encryption algorithms:
l
UMTS Encryption Algorithm 0 (UEA0): no encryption
UMTS Encryption Algorithm 1 (UEA1): encryption algorithm f8
Which algorithm to use can be set through the EncryptionAlgo parameter on the RNC side.
3.2.2 Ciphering Procedure

Encryption and decryption are implemented in the UE and the RNC (at layer 2).
Figure 3-2 shows how to encrypt and decrypt the signaling and user data by using the encryption
algorithm f8.
Issue 01 (2013-04-28)

WCDMA RAN
Description
Figure 3-2 Encryption and decryption of signaling and user data
Table 3-2 describes the input parameters to the integrity algorithm.

Table 3-2 Input parameters to the encryption algorithm
Item
Name
Description
CK
Cipher key
CK is 128 bits long. It is used to establish CS connections

(CKCS) between the CS domain and the UE, or PS
connections (CKPS) between the PS domain and the UE.
The user data for the CS domain is always encrypted by the
CK received from the CS domain, and that for the PS domain
is encrypted by the CK received from the PS domain. The
signaling data is always encrypted by the most recently
received CK, either CKCS or CKPS.
For UMTS subscribers, CK is generated during the
implementation of UMTS Authentication and Key
Agreement (AKA). It is stored in the USIM with a copy in
the ME.
The CK can be sent:
l From the USIM to the ME upon request of the ME
l From the HLR/AuC to the VLR/SGSN and stored in the
VLR/SGSN as part of the quintet
l In the RANAP message SECURITY MODE
COMMAND from the VLR/SGSN to the RNC
Issue 01 (2013-04-28)

WCDMA RAN
Description
Item
Name
Description
COUNTC
Cipher sequence
number
COUNT-C is 32 bits long. For Radio Bearers (RBs) using the

RLC Acknowledged Mode (AM) or Unacknowledged Mode
(UM), there is one COUNT-C value for each uplink RB and
one COUNT-C value for each downlink RB. The COUNTC consists of the Hyper Frame Number (HFN) and the RLC
Sequence Number (RLC SN). The HFN increases by 1 at
each RLC SN cycle.
All the RBs using the RLC Transparent Mode (TM) in one
CN domain correspond to one COUNT-C, which is uplink
and downlink insensitive. The COUNT-C consists of the
HFN and the Connection Frame Number (CFN). The HFN
increases by 1 at each CFN cycle.
NOTE
l Under AM, the RLC HFN is 20 bits long and the RLC SN is 12
bits long.
l Under UM, the RLC HFN is 25 bits long and the RLC SN is 7
bits long.
l Under TM, the HFN is 24 bits long and the CFN is 8 bits long.
DIRECT
ION
Direction bit
DIRECTION is 1 bit long. It is used to indicate uplink or

downlink.
The value 0 indicates uplink, and the value 1 indicates
downlink.
LENGT
H
Length
indication
LENGTH is 16 bits long. It is used to indicate only the length

of the required keystream block instead of the actual bits in
the block.
BEARE
R
Radio bearer
identifier
BEARER is 5 bits long. It is used to identify the radio bearer

type.
As shown in Figure 3-2, the UMTS encryption mechanism is based on the stream cipher concept.
To be more specific, plaintext data is added bit by bit to pseudo-random mask data generated
by CK and other parameters. The benefit of such an encryption mechanism is that the generation
of the pseudo-random mask data is independent of the plaintext data. Therefore, the final
encryption process is fast.
The decryption on the receiving side is the same, because adding the pseudo-random mask bits
twice has the same result as adding zeros once.
3.3 Negotiation of Encryption and Integrity Algorithms

This section describes the negotiation between the UE and the network. In addition, it describes
methods of encryption and integrity algorithms employed on the CN side.
When a UE wishes to establish a connection with the network, the UE indicates to the network
in the UE/USIM classmark which encryption and integrity algorithms the UE supports. The UE/
USIM classmark information itself must be integrity protected.
Issue 01 (2013-04-28)

WCDMA RAN
Description
The RNC does not have the integrity key IK when receiving the UE/USIM classmark. Therefore,
this information must be stored in the RNC. The data integrity check of the UE/USIM classmark
is performed, during the security mode setup procedure by using the most recently generated
IK.
The network compares its integrity-related information with that indicated by the UE. Such
information includes integrity protection capabilities, integrity protection preferences, and any
special requirements of the subscription of the UE. Then, the network acts according to the
following rules:
l
If the network and the UE have no versions of the UIA algorithm in common, the connection
is released.
If the network and the UE have at least one version of the UIA algorithm in common, the
network chooses one of the mutually acceptable versions for use on that connection.
The network compares its encryption-related information with that indicated by the UE. Such
information includes ciphering capabilities, ciphering preferences, and any special requirements
of the subscription of the UE. Then, the network acts according to the following rules:
l
If the network and the UE have no versions of the UEA algorithm in common and the
network is not prepared to use an unciphered connection, then the connection is released.
If the network and the UE have no versions of the UEA algorithm in common and the user
and the network are willing to use an unciphered connection, then an unciphered connection
is used.
If the network and the UE have at least one version of the UIA algorithm in common, the
network chooses one of the mutually acceptable versions for use on that connection.
The CS and PS domains use the same preferences and special requirements for the ciphering
and integrity mode setting, for example, the preference of the algorithms.
If there are RABs connecting the UE to both CS and PS domains, the two domains must employ
the same encryption policy, that is, whether to encrypt signaling and user data or not. If
encryption is required, the user data for the CS domain is always encrypted by the CK received
from the CS domain, and that for the PS domain is encrypted by the CK received from the PS
domain. The signaling data, however, is always encrypted by the latest CK received from either
the PS or CS domain.
NOTE
The algorithms of integrity protection and encryption cannot be changed when the UE is connected to
another CN.
Issue 01 (2013-04-28)

WCDMA RAN
Description
4 Engineering Guidelines
Engineering Guidelines
4.1 Integrity Protection

This section describes how to activate, verify, and deactivate the basic feature WRFD-011401
Integrity Protection.
4.1.1 Requirements
It is recommended that the RNC and CN use the same integrity protection algorithm.
The RNC supports only the UIA1 algorithm. Therefore, the UIA1 algorithm must be included
in the integrity protection algorithms configured for the CN.
4.1.2 Data Preparation

It is recommended that the RNC and CN use the same integrity protection algorithm.
The RNC supports only the UIA1 algorithm. Therefore, the UIA1 algorithm must be included
in the integrity protection algorithms configured for the CN.
4.1.3 Feature Activation

Step 1 Run the RNC MML command SET UUIA (CME single configuration: UMTS Radio Global
Configuration Express > Security Mode Configuration > Integrity Protection Algorithm; CME
batch modification center: Modifying RNC Parameters in Batches) to set Integrity protection
algorithm (IntegrityProtectAlgo) to enable the RNC to support the integrity protection
algorithm.
----End
4.1.4 Activation Check

Step 1 On the LMT, click Trace > UMTS Services, and then double-click Iu Interface Trace. The
Iu Interface Trace dialog box is displayed.
Step 2 Keep UE1 and UE2 in idle mode in CELL1.
Issue 01 (2013-04-28)

10
WCDMA RAN
Description
Step 3 Use UE2 to call UE1.

Step 4 The messages RANAP_SECURITY_ MODE_COMMAND and
RANAP_SECURITY_MODE_COMPLETE should be displayed. The
chosenIntegrityProtectionAlgorithm IE of the latter message indicates the integrity protection
algorithm.
----End
4.1.5 Feature Deactivation

None
4.1.6 Example
//Activating integrity protection
SET UUIA: IntegrityProtectAlgo=UIA1-1
4.2 Encryption
This section describes how to activate, verify, and deactivate the basic feature WRFD-011402
Encryption.
4.2.1 Requirements
There must be intersection between the encryption algorithms configured on the RNC, on the
core network and that supported by the UE.
4.2.2 Data Preparation

There must be intersection between the encryption algorithms configured on the RNC, on the
core network and that supported by the UE.
4.2.3 Feature Activation

Step 1 Run the RNC MML command SET UUEA (CME single configuration: UMTS Radio Global
Configuration Express > Security Mode Configuration > Encryption Algorithm; CME batch
modification center: not supported) to set Encryption algorithm (EncryptionAlgo) to enable
the RNC to support the encryption algorithm.
----End
4.2.4 Activation Check

Step 1 On the LMT, click Trace > UMTS Services, and then double-click Iu Interface Trace. The
Iu Interface Trace dialog box is displayed.
Step 2 Keep UE1 and UE2 in idle mode in CELL1.
Step 3 Use UE2 to call UE1.
Issue 01 (2013-04-28)

11
WCDMA RAN
Description
Step 4 The messages RANAP_SECURITY_ MODE_COMMAND and

chosenEncryptionAlgorithm IE of the latter message indicates the encryption algorithm.
Step 5 End the calling. UE1 and UE2 return to the idle mode.
Step 6 The messages RANAP_SECURITY_MODE_COMMAND and
chosenEncryptionAlgorithm IE of the latter message indicates the encryption algorithm.
----End
4.2.5 Feature Deactivation

None
4.2.6 Example
//Activating encryption
SET UUEA: EncryptionAlgo=UEA0-1&UEA1-1;
Issue 01 (2013-04-28)

12
WCDMA RAN
Description
5 Parameters
Parameters
Table 5-1 Parameter description

Parameter ID
NE
MML
Command
Feature ID
Feature Name
Description
IntegrityProtectAlgo
BSC6900
SET UUIA
WRFD-011401
Integrity
Protection
Meaning:The
integrity
protection
algorithm
supported by
RNC. Only
UIA1 is
supported
currently.
GUI Value
Range:UIA1
Unit:None
Actual Value
Range:UIA1
Default
Value:UIA1:1
Issue 01 (2013-04-28)

13
WCDMA RAN
Description
5 Parameters
Parameter ID
NE
MML
Command
Feature ID
Feature Name
Description
IntegrityProtectAlgo
BSC6910
SET UUIA
WRFD-011401
Integrity
Protection
Meaning:The
integrity
protection
algorithm
supported by
RNC. Only
UIA1 is
supported
currently.
GUI Value
Range:UIA1
Unit:None
Actual Value
Range:UIA1
Default
Value:UIA1:1
Issue 01 (2013-04-28)

14
WCDMA RAN
Description
5 Parameters
Parameter ID
NE
MML
Command
Feature ID
Feature Name
Description
PROCESSSWI
TCH
BSC6900
SET
URRCTRLSWI
TCH
WRFD-021102
Cell Barring
WRFD-150205
Layered Paging
in Idle Mode
Meaning:1)
INVOKE_TRA
CE_SWITCH.
1: This switch is
turned on. RNC
will start Invoke
Trace procedure
upon receiving
INVOKE
TRACE
Message form
CN. 0: This
switch is turned
off. RNC won't
start the Invoke
Trace procedure
though it
receives the
INVOKE
TRACE
message. 2)
SYS_INFO_UP
DATE_FOR_I
U_RST. 1: This
switch is turned
on. The SIB1
does not contain
broken-down
CN information.
In this case, the
UE will not
select brokendown network
when Iu
transmission
failure occurs. 0:
This switch is
turned off. The
SIB1 contains
the brokendown CN
information. In
this case, the UE
will select
broken-down
network but the
RNC will reject
the request when
WRFD-150204
WRFD-010101
WRFD-150231
WRFD-020500
WRFD-021303
WRFD-020132
WRFD-020124
WRFD-140206
WRFD-020134
WRFD-020128
WRFD-010612
12
WRFD-010641
WRFD-020806
Platinum User
Prioritizing
3GPP R9
Specifications
RIM Based
UMTS Target
Cell Selection
for LTE
Enhanced Fast
Dormancy
IMSI Based
Handover
Web browsing
acceleration
Uplink Flow
Control of User
Plane
Layered Paging
in URA_PCH
Push to Talk
Quality
Improvement
for Subscribed
Service
HSUPA Iub
Flow Control in
Case of Iub
Congestion
HSUPA
Adaptive
Transmission
Differentiated
Service Based
on SPI Weight
Issue 01 (2013-04-28)

15
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
Iu transmission
failure occurs. 3)
DRNC_DIREC
T_DSCR.
Whether the
Directed
Signaling
Connection reestablishment
(DSCR)
procedure is
triggered during
a cell update
over the Iur
interface for
UEs that are not
in the
CELL_DCH
state or for UEs
that are in the
CELL_DCH
state and do not
have an Iur
connection. This
switch is set on
the drift radio
network
controller
(DRNC) side. 1:
This switch is
turned on.
DRNC will start
DSCR
procedure
directly in RRC
states other than
CELL_DCH or
CELL_DCH
that do not have
an Iur
connection. 0:
This switch is
turned off.
DRNC will
transfer RRC
CELL UPDATE
message to
SRNC. 4)
Issue 01 (2013-04-28)

16
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
PTUSER_IDEN
TIFY_ENH_S
WITCH
(Platinum user
identify
enhancement
switch) Whether
platinum users
are identified in
DRNC or
relocation
scenarios. 1:
This switch is
turned on.
Platinum users
are identified
and their
services are
guaranteed in
DRNC or
relocation
scenarios. 0:
This switch is
turned off.
Platinum users
are not
identified in
DRNC or
relocation
scenarios. 5)
RNC_SHARE_
SWITCH. 1:
This switch is
turned on. The
traffic sharing
function is
enabled. 0: This
switch is turned
off. The traffic
sharing function
is disabled,
service access
will be affected
under heavy
traffic. 6)
RNCAP_IMSI_
HO_SWITCH.
1: This switch is
Issue 01 (2013-04-28)

17
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
turned on. Imsi
handover
function will be
used. 0: This
switch is turned
off. Imsi
handover
function will not
be used. 7)
TERMINAL_V
ERSION_DEB
ASE_SWITCH.
1: This switch is
turned on.
Terminal
version R4 will
debase to R99.
0: This switch is
turned off.
Terminal
version R4 will
not debase to
R99. 8)
SYS_HO_OUT
_CIPHER_SWI
TCH. 1: This
switch is turned
on. The RNC
will add
ciphering byte at
GSM
HANDOVER
COMMAND if
the GSM system
do not add any
cipher
information at
that message. 0:
This switch is
turned off. The
RNC will not
add ciphering
byte at GSM
HANDOVER
COMMAND if
the GSM system
do not add any
cipher
Issue 01 (2013-04-28)

18
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
information at
that message. 9)
SYS_HO_CIPH
ER_CONFIG.
1: This switch is
turned on. The
cipher
configuration in
the added cipher
byte in GSM
will be A5/1. 0:
This switch is
turned off. The
cipher
configuration is
A5/0. 10)
BARRED_CEL
L_FOR_CSDO
MAIN_RST. 1:
This switch is
turned on. Cell
will be bared
when CS
domain is
invalid. 0: This
switch is turned
off. The CS
domain will be
bared when CS
domain is
invalid. It is
invalid If
SYS_INFO_UP
DATE_FOR_I
U_RST is not
checked. 11)
CR2284R1_SW
ITCH. 1: This
switch is turned
on. The RNC
performs the
processing
based on
CR2284R1, that
is, based on the
description in
section 8.6.6.28
of Release 5 TS
Issue 01 (2013-04-28)

19
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
25.331. In this
section, it
describes that
the HFN is
increased by one
when RB setup
is accompanied
by a Timing reinitialized hard
handover. 0:
This switch is
turned off. The
HFN is not
increased by one
when RB setup
is accompanied
handover. 12)
CDT_MSG_FU
LL_TRACE. 1:
This switch is
turned on. CDT
trace function
starts tracing
from message
RRC
CONNECT
REQUEST. 0:
This switch is
turned off. CDT
trace function
starts tracing
from message
COMMON ID.
13)
CR2284R1_CO
MPATIBLE_S
WITCH.
CR2284R1
causes the
compatible
problem. if UE
is not consistent
with RNC
regarding
whether accept
the CR2284R1
Issue 01 (2013-04-28)

20
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
or not, it will
cause the
problem of
streaming when
UEs are
communicating
with each other.
So RNC creates
this switch.
when it is
checked, RNC is
auto-adaptive to
accept the
CR2284R1
according to UE
version
information.
The principles
that RNC judges
UE whether to
accept the
CR2284R1 are
as follows: R5
and above UE
accepts the CR;
R99/R4 UE, if it
receives the
START LIST
value from RB
SETUP
COMPLETE,R
NC figures that
UE accepts the
CR; R99/R4 UE,
if it only
receives the
START value
from RB
SETUP
COMPLETE,R
NC figures that
UE does not
accept the CR;
when it is not
checked,
whether RNC
accept the CR or
not is according
Issue 01 (2013-04-28)

21
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
to
CR2284R1_SW
ITCH. The
relations
between these
two switches
CR2284R1_SW
ITCH and
CR2284R1_CO
MPATIBLE_S
WITCH are as
follows: 1: This
switch is turned
on. RNC is selfcompatible, so
the
CR2284R1_SW
ITCH is invalid;
0: This switch is
turned off. The
CR2284R1_SW
ITCH is valid.
14)
COMBINE_OP
ERATION_DR
D_SWITCH. 1:
This switch is
turned on. RNC
will not reject
the message RB
SETUP CMP
without the IE
active time. 0:
This switch is
turned off. RNC
will reject the
message RB
SETUP CMP
without the IE
active time. 15)
UL_INTER_PR
OTECT_SWIT
CH. 1: This
switch is turned
on. RNC will do
integrity
protection check
for uplink RRC
Issue 01 (2013-04-28)

22
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
messages. 0:
This switch is
turned off. RNC
will not do
integrity
protection check
for uplink RRC
messages. 16)
FAST_DORM
ANCY_SWITC
H. 1: This switch
is turned on.
RNC will apply
FAST
DORMANCY
function. 0: This
switch is turned
off. RNC will
not apply FAST
DORMANCY
function. 17)
SYS_HO_IN_C
IPHER_SWITC
H. During an
incoming GSMto-UMTS
handover, if the
RNC cannot
obtain a UE's
encryption
capability
information
from the
RELOC REQ
message: 1: This
switch is turned
on. The
encryption
algorithm that is
configured for
both the RNC
and CN is used.
For example, if
the CN is
configured with
the encryption
algorithm UEA1
and the RNC is
Issue 01 (2013-04-28)

23
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
configured with
encryption
algorithms
UEA0 and
UEA1, then the
RNC uses the
encryption
algorithm
UEA1. 0: This
switch is turned
off. Default
configured of
encrypted
parameter UIA1
and UEA0 is
used. 18)
PTT_EARLY_
TRANS_SWIT
CH_OFF. 1:
This switch is
turned on. PTT
user will not
apply the early
transmission
function. 0: This
switch is turned
off. PTT user
will apply the
early
transmission
function. 19)
UPLINK_MDC
_ENHENCEM
ENT_SWITCH.
This switch has
become invalid.
20)
NODEB_PRIV
ATE_INTERF
ACE_SWITCH.
1: This switch is
turned on. The
NodeB private
interface data
can be taken to
the NodeB
through the IUB
protocol
Issue 01 (2013-04-28)

24
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
message. 0: This
switch is turned
off. The NodeB
private interface
data can not be
taken to the
NodeB through
the IUB protocol
message. 21)
PTT_SPEC_LI_
SWITCH_OFF.
1: This switch is
turned on.
Special LI
(Length
Indicator) will
not be used for
PTT user. 0:
This switch is
turned off.
Special LI
(Length
Indicator) will
be used for PTT
user. 22)
RNC_DF_2_U
RA_PCH_SWI
TCH. 1: This
switch is turned
on. RNC will
support
transferring Fast
Dormancy UE
from
CELL_DCH or
CELL_FACH to
URA_PCH. 0:
This switch is
turned off. RNC
will not support
transferring Fast
Dormancy UE
from
CELL_DCH or
CELL_FACH to
URA_PCH. 23)
FD_TAC_MAT
CH_SWITCH.
Issue 01 (2013-04-28)

25
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
1: This switch is
turned on. The
RNC uses TAC
matching to
determine
whether to apply
the FAST
DORMANCY
function for pre
fast dormancy
UEs. 0: This
switch is turned
off. The RNC
applies the
FAST
DORMANCY
function for pre
fast dormancy
UEs of 3GPP
Release 5 or
later. 24)
NONPTT_L1_F
AST_SYNC_S
WITCH. 1: This
switch is turned
on. If a UE sets
up a non-PTT
service on the
DCH, the RNC
includes the
Postverification
period
information
element (IE) in a
Uu message to
instruct the UE
to perform
concurrent
uplink and
downlink
synchronization
. 0: This switch
is turned off. If a
UE sets up a
non-PTT service
on the DCH, the
RNC does not
Issue 01 (2013-04-28)

26
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
include the Postverification
period IE in a Uu
message. The
UE first
performs
downlink
synchronization
and then uplink
synchronization
. 25)
URAPCH_LAY
ERED_PAGIN
G_RT_SWITC
H. Whether the
RNC allows
Layered Paging
in URA_PCH
for a UE
processing realtime services. 1:
This switch is
turned on. The
RNC sends
paging
messages to the
cell on which a
UE processing
real-time
services camped
recently and to
the neighboring
cells of this cell.
The RNC pages
the UE in the
entire UTRAN
registration area
(URA) only
when it does not
receive a
response from
the UE. This
significantly
reduces the
number of
paging
messages on the
Uu interface. 0:
Issue 01 (2013-04-28)

27
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
This switch is
turned off. The
RNC directly
pages the UE in
the entire URA.
26)
URAPCH_LAY
ERED_PAGIN
G_NRT_SWIT
CH. Whether the
RNC allows
Layered Paging
in URA_PCH
for a UE
processing nonreal-time
services. 1: This
switch is turned
on. The RNC
sends paging
messages to the
cell on which a
UE processing
non-real-time
services camped
recently and to
the neighboring
cells of this cell.
The RNC pages
the UE in the
entire URA only
when the RNC
does not receive
a response from
the UE. This
significantly
reduces the
number of
paging
messages on the
Uu interface. 0:
This switch is
turned off. The
RNC directly
pages the UE in
the entire URA.
27)
IDLE_LAYER
Issue 01 (2013-04-28)

28
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
ED_PAGING_
NRT_SWITCH.
Whether to
enable layered
paging for UEs
in the idle state
who will
establish nonreal-time
service. 1: This
switch is turned
on. The first
broadcasts a
paging message
in the cell who
has interacted
with the UE for
the last time and
its neighboring
cells. If the UE
cannot be paged,
the RNC then
broadcasts a
paging message
in the LAC or
RAC area. 0:
This switch is
turned off. The
RNC directly
broadcasts a
paging message
in the LAC or
RAC area. 28)
IDLE_LAYER
ED_PAGING_
RT_SWITCH.
Whether to
enable layered
paging for UEs
in the idle state
who will
establish realtime service. 1:
This switch is
turned on. First
broadcasts a
paging message
in the cell who
Issue 01 (2013-04-28)

29
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
has interacted
with the UE for
the last time and
its neighboring
cells. If the UE
cannot be paged,
the RNC then
broadcasts a
paging message
in the LAC or
RAC area. 0:
This switch is
turned off. The
RNC directly
broadcasts a
paging message
in the LAC or
RAC area. 29)
INTELLIGENT
_WIFI_DETEC
T_AND_SELE
CTION.
Whether to
enable
intelligent Wi-Fi
detection and
selection for the
RNC. 1: This
switch is turned
on. The RNC
supports
intelligent Wi-Fi
detection and
selection. 0:
This switch is
turned off. The
RNC does not
supports
intelligent Wi-Fi
detection and
selection. 30)
INTERRAT_L
OAD_REPORT
_FOR_LTE_S
WITCH.
Whether to
enable the RIMbased cell load
Issue 01 (2013-04-28)

30
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
sharing function
(Multiple
Report). 1: This
switch is turned
on. RIM-based
load sharing can
be achieved
between UMTS
and LTE cells.
Upon receiving
a load sharing
request from an
LTE cell, a
UMTS cell
responds with its
own load
information. 0:
This switch is
turned off.
UMTS cells do
not support the
RIM-based cell
load sharing
function.
Therefore,
UMTS cells do
not respond to
load sharing
requests from
LTE cells. 31)
PTUSER_IDEN
TIFY_SWITCH
. Whether to
preferentially
guarantee
platinum users
in terms of
network access,
voice quality, or
PS service rate.
1: This switch is
turned on. The
RNC recognizes
platinum users
and
preferentially
guarantees their
user experience.
Issue 01 (2013-04-28)

31
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
0: This switch is
turned off. The
RNC does not
recognize
platinum users
and does not
preferentially
guarantee their
user experience.
Disuse
Statement:In
future versions,
the
RNC_SHARE_
SWITCH,
TERMINAL_V
ERSION_DEB
ASE_SWITCH,
CR2284R1_SW
ITCH,
CR2284R1_CO
MPATIBLE_S
WITCH,
COMBINE_OP
ERATION_DR
D_SWITCH
and
UPLINK_MDC
_ENHENCEM
ENT_SWITCH
bit field value
under the
PROCESSSWI
TCH parameter
will be deleted.
Although the
configuration
interface in this
version supports
delivery and
synchronization
of the bit field
value, the bit
field value is no
longer internally
used. Instead,
the function of
RNC_SHARE_
Issue 01 (2013-04-28)

32
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
SWITCH will
be controlled by
the
RncShareSwitc
h parameter in
the SET
UCTRLPLNSH
AREPARA
command.
GUI Value
Range:INVOK
E_TRACE_SW
ITCH,
SYS_INFO_UP
DATE_FOR_I
U_RST,
DRNC_DIREC
T_DSCR,
PTUSER_IDEN
TIFY_ENH_S
WITCH,
RNC_SHARE_
SWITCH,
RNCAP_IMSI_
HO_SWITCH,
TERMINAL_V
ERSION_DEB
ASE_SWITCH,
SYS_HO_OUT
_CIPHER_SWI
TCH,
SYS_HO_CIPH
ER_CONFIG,
BARRED_CEL
L_FOR_CSDO
MAIN_RST,
CR2284R1_SW
ITCH,
CDT_MSG_FU
LL_TRACE,
CR2284R1_CO
MPATIBLE_S
WITCH,
COMBINE_OP
ERATION_DR
D_SWITCH,
UL_INTER_PR
Issue 01 (2013-04-28)

33
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
OTECT_SWIT
CH,
FAST_DORM
ANCY_SWITC
H,
SYS_HO_IN_C
IPHER_SWITC
H,
PTT_EARLY_
TRANS_SWIT
CH_OFF,
UPLINK_MDC
_ENHENCEM
ENT_SWITCH,
NODEB_PRIV
ATE_INTERF
ACE_SWITCH,
PTT_SPEC_LI_
SWITCH_OFF,
RNC_DF_2_U
RA_PCH_SWI
TCH,
FD_TAC_MAT
CH_SWITCH,
NONPTT_L1_F
AST_SYNC_S
WITCH,
URAPCH_LAY
ERED_PAGIN
G_RT_SWITC
H,
URAPCH_LAY
ERED_PAGIN
G_NRT_SWIT
CH,
IDLE_LAYER
ED_PAGING_
NRT_SWITCH,
IDLE_LAYER
ED_PAGING_
RT_SWITCH,
INTELLIGENT
_WIFI_DETEC
T_AND_SELE
CTION,
INTERRAT_L
OAD_REPORT
_FOR_LTE_S
Issue 01 (2013-04-28)

34
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
WITCH,
PTUSER_IDEN
TIFY_SWITCH
Unit:None
Actual Value
Range:INVOK
E_TRACE_SW
ITCH,
SYS_INFO_UP
DATE_FOR_I
U_RST,
DRNC_DIREC
T_DSCR,
PTUSER_IDEN
TIFY_ENH_S
WITCH,
RNC_SHARE_
SWITCH,
RNCAP_IMSI_
HO_SWITCH,
TERMINAL_V
ERSION_DEB
ASE_SWITCH,
SYS_HO_OUT
_CIPHER_SWI
TCH,
SYS_HO_CIPH
ER_CONFIG,
BARRED_CEL
L_FOR_CSDO
MAIN_RST,
CR2284R1_SW
ITCH,
CDT_MSG_FU
LL_TRACE,
CR2284R1_CO
MPATIBLE_S
WITCH,
COMBINE_OP
ERATION_DR
D_SWITCH,
UL_INTER_PR
OTECT_SWIT
CH,
FAST_DORM
ANCY_SWITC
H,
Issue 01 (2013-04-28)

35
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
SYS_HO_IN_C
IPHER_SWITC
H,
PTT_EARLY_
TRANS_SWIT
CH_OFF,
UPLINK_MDC
_ENHENCEM
ENT_SWITCH,
NODEB_PRIV
ATE_INTERF
ACE_SWITCH,
PTT_SPEC_LI_
SWITCH_OFF,
RNC_DF_2_U
RA_PCH_SWI
TCH,
FD_TAC_MAT
CH_SWITCH,
NONPTT_L1_F
AST_SYNC_S
WITCH,
URAPCH_LAY
ERED_PAGIN
G_RT_SWITC
H,
URAPCH_LAY
ERED_PAGIN
G_NRT_SWIT
CH,
IDLE_LAYER
ED_PAGING_
NRT_SWITCH,
IDLE_LAYER
ED_PAGING_
RT_SWITCH,
INTELLIGENT
_WIFI_DETEC
T_AND_SELE
CTION,
INTERRAT_L
OAD_REPORT
_FOR_LTE_S
WITCH,
PTUSER_IDEN
TIFY_SWITCH
Issue 01 (2013-04-28)

36
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
Default
Value:INVOKE
_TRACE_SWI
TCH:
0,SYS_INFO_
UPDATE_FOR
_IU_RST:
0,DRNC_DIRE
CT_DSCR:
0,PTUSER_ID
ENTIFY_ENH_
SWITCH:
0,RNC_SHARE
_SWITCH:
1,RNCAP_IMS
I_HO_SWITCH
:
0,TERMINAL_
VERSION_DE
BASE_SWITC
H:
0,SYS_HO_OU
T_CIPHER_S
WITCH:
0,SYS_HO_CIP
HER_CONFIG:
1,BARRED_CE
LL_FOR_CSD
OMAIN_RST:
0,CR2284R1_S
WITCH:
0,CDT_MSG_F
ULL_TRACE:
0,CR2284R1_C
OMPATIBLE_
SWITCH:
1,COMBINE_O
PERATION_D
RD_SWITCH:
1,UL_INTER_P
ROTECT_SWI
TCH:
1,FAST_DOR
MANCY_SWI
TCH:
0,SYS_HO_IN_
CIPHER_SWIT
CH:
Issue 01 (2013-04-28)

37
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
0,PTT_EARLY
_TRANS_SWI
TCH_OFF:
0,UPLINK_MD
C_ENHENCE
MENT_SWITC
H:
0,NODEB_PRI
VATE_INTER
FACE_SWITC
H:
0,PTT_SPEC_L
I_SWITCH_OF
F:
0,RNC_DF_2_
URA_PCH_SW
ITCH:
0,FD_TAC_M
ATCH_SWITC
H:
0,NONPTT_L1
_FAST_SYNC_
SWITCH:
0,URAPCH_L
AYERED_PAG
ING_RT_SWIT
CH:
0,URAPCH_L
AYERED_PAG
ING_NRT_SWI
TCH:
0,IDLE_LAYE
RED_PAGING
_NRT_SWITC
H:
0,IDLE_LAYE
RED_PAGING
_RT_SWITCH:
0,INTELLIGE
NT_WIFI_DET
ECT_AND_SE
LECTION:
0,INTERRAT_
LOAD_REPOR
T_FOR_LTE_S
WITCH:
0,PTUSER_ID
Issue 01 (2013-04-28)

38
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
ENTIFY_SWIT
CH:0
Issue 01 (2013-04-28)

39
WCDMA RAN
Description
5 Parameters
Parameter ID
NE
MML
Command
Feature ID
Feature Name
Description
PROCESSSWI
TCH
BSC6910
SET
URRCTRLSWI
TCH
WRFD-021102
Cell Barring
WRFD-150205
Layered Paging
in Idle Mode
Meaning:1)
INVOKE_TRA
CE_SWITCH.
1: This switch is
turned on. RNC
will start Invoke
Trace procedure
upon receiving
INVOKE
TRACE
Message form
CN. 0: This
switch is turned
off. RNC won't
start the Invoke
Trace procedure
though it
receives the
INVOKE
TRACE
message. 2)
SYS_INFO_UP
DATE_FOR_I
U_RST. 1: This
switch is turned
on. The SIB1
does not contain
broken-down
CN information.
In this case, the
UE will not
select brokendown network
when Iu
transmission
failure occurs. 0:
This switch is
turned off. The
SIB1 contains
the brokendown CN
information. In
this case, the UE
will select
broken-down
network but the
RNC will reject
WRFD-150204
WRFD-010101
WRFD-150231
WRFD-020500
WRFD-021303
WRFD-020132
WRFD-020124
WRFD-140206
WRFD-020134
WRFD-020128
WRFD-010612
12
WRFD-010641
WRFD-020806
Platinum User
Prioritizing
3GPP R9
Specifications
RIM Based
UMTS Target
Cell Selection
for LTE
Enhanced Fast
Dormancy
IMSI Based
Handover
Web browsing
acceleration
Uplink Flow
Control of User
Plane
Layered Paging
in URA_PCH
Push to Talk
Quality
Improvement
for Subscribed
Service
HSUPA Iub
Flow Control in
Case of Iub
Congestion
HSUPA
Adaptive
Transmission
Differentiated
Service Based
on SPI Weight
Issue 01 (2013-04-28)

40
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
the request when
Iu transmission
failure occurs. 3)
DRNC_DIREC
T_DSCR.
Whether the
Directed
Signaling
Connection reestablishment
(DSCR)
procedure is
triggered during
a cell update
over the Iur
interface for
UEs that are not
in the
CELL_DCH
state or for UEs
that are in the
CELL_DCH
state and do not
have an Iur
connection. This
switch is set on
the drift radio
network
controller
(DRNC) side. 1:
This switch is
turned on.
DRNC will start
DSCR
procedure
directly in RRC
states other than
CELL_DCH or
CELL_DCH
that do not have
an Iur
connection. 0:
This switch is
turned off.
DRNC will
transfer RRC
CELL UPDATE
message to
Issue 01 (2013-04-28)

41
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
SRNC. 4)
PTUSER_IDEN
TIFY_ENH_S
WITCH
(Platinum user
identify
enhancement
switch) Whether
platinum users
are identified in
DRNC or
relocation
scenarios. 1:
This switch is
turned on.
Platinum users
are identified
and their
services are
guaranteed in
DRNC or
relocation
scenarios. 0:
This switch is
turned off.
Platinum users
are not
identified in
DRNC or
relocation
scenarios. 5)
RNC_SHARE_
SWITCH. 1:
This switch is
turned on. The
traffic sharing
function is
enabled. 0: This
switch is turned
off. The traffic
sharing function
is disabled,
service access
will be affected
under heavy
traffic. 6)
RNCAP_IMSI_
HO_SWITCH.
Issue 01 (2013-04-28)

42
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
1: This switch is
turned on. Imsi
handover
function will be
used. 0: This
switch is turned
off. Imsi
handover
function will not
be used. 7)
TERMINAL_V
ERSION_DEB
ASE_SWITCH.
1: This switch is
turned on.
Terminal
version R4 will
debase to R99.
0: This switch is
turned off.
Terminal
version R4 will
not debase to
R99. 8)
SYS_HO_OUT
_CIPHER_SWI
TCH. 1: This
switch is turned
on. The RNC
will add
ciphering byte at
GSM
HANDOVER
COMMAND if
the GSM system
do not add any
cipher
information at
that message. 0:
This switch is
turned off. The
RNC will not
add ciphering
byte at GSM
HANDOVER
COMMAND if
the GSM system
do not add any
Issue 01 (2013-04-28)

43
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
cipher
information at
that message. 9)
SYS_HO_CIPH
ER_CONFIG.
1: This switch is
turned on. The
cipher
configuration in
the added cipher
byte in GSM
will be A5/1. 0:
This switch is
turned off. The
cipher
configuration is
A5/0. 10)
BARRED_CEL
L_FOR_CSDO
MAIN_RST. 1:
This switch is
turned on. Cell
will be bared
when CS
domain is
invalid. 0: This
switch is turned
off. The CS
domain will be
bared when CS
domain is
invalid. It is
invalid If
SYS_INFO_UP
DATE_FOR_I
U_RST is not
checked. 11)
CR2284R1_SW
ITCH. 1: This
switch is turned
on. The RNC
performs the
processing
based on
CR2284R1, that
is, based on the
description in
section 8.6.6.28
Issue 01 (2013-04-28)

44
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
of Release 5 TS
25.331. In this
section, it
describes that
the HFN is
increased by one
when RB setup
is accompanied
handover. 0:
This switch is
turned off. The
HFN is not
increased by one
when RB setup
is accompanied
handover. 12)
CDT_MSG_FU
LL_TRACE. 1:
This switch is
turned on. CDT
trace function
starts tracing
from message
RRC
CONNECT
REQUEST. 0:
This switch is
turned off. CDT
trace function
starts tracing
from message
COMMON ID.
13)
CR2284R1_CO
MPATIBLE_S
WITCH.
CR2284R1
causes the
compatible
problem. if UE
is not consistent
with RNC
regarding
whether accept
Issue 01 (2013-04-28)

45
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
the CR2284R1
or not, it will
cause the
problem of
streaming when
UEs are
communicating
with each other.
So RNC creates
this switch.
when it is
checked, RNC is
auto-adaptive to
accept the
CR2284R1
according to UE
version
information.
The principles
that RNC judges
UE whether to
accept the
CR2284R1 are
as follows: R5
and above UE
accepts the CR;
R99/R4 UE, if it
receives the
START LIST
value from RB
SETUP
COMPLETE,R
NC figures that
UE accepts the
CR; R99/R4 UE,
if it only
receives the
START value
from RB
SETUP
COMPLETE,R
NC figures that
UE does not
accept the CR;
when it is not
checked,
whether RNC
accept the CR or
Issue 01 (2013-04-28)

46
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
not is according
to
CR2284R1_SW
ITCH. The
relations
between these
two switches
CR2284R1_SW
ITCH and
CR2284R1_CO
MPATIBLE_S
WITCH are as
follows: 1: This
switch is turned
on. RNC is selfcompatible, so
the
CR2284R1_SW
ITCH is invalid;
0: This switch is
turned off. The
CR2284R1_SW
ITCH is valid.
14)
COMBINE_OP
ERATION_DR
D_SWITCH. 1:
This switch is
turned on. RNC
will not reject
the message RB
SETUP CMP
without the IE
active time. 0:
This switch is
turned off. RNC
will reject the
message RB
SETUP CMP
without the IE
active time. 15)
UL_INTER_PR
OTECT_SWIT
CH. 1: This
switch is turned
on. RNC will do
integrity
protection check
Issue 01 (2013-04-28)

47
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
for uplink RRC
messages. 0:
This switch is
turned off. RNC
will not do
integrity
protection check
for uplink RRC
messages. 16)
FAST_DORM
ANCY_SWITC
H. 1: This switch
is turned on.
RNC will apply
FAST
DORMANCY
function. 0: This
switch is turned
off. RNC will
not apply FAST
DORMANCY
function. 17)
SYS_HO_IN_C
IPHER_SWITC
H. During an
incoming GSMto-UMTS
handover, if the
RNC cannot
obtain a UE's
encryption
capability
information
from the
RELOC REQ
message: 1: This
switch is turned
on. The
encryption
algorithm that is
configured for
both the RNC
and CN is used.
For example, if
the CN is
configured with
the encryption
algorithm UEA1
Issue 01 (2013-04-28)

48
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
and the RNC is
configured with
encryption
algorithms
UEA0 and
UEA1, then the
RNC uses the
encryption
algorithm
UEA1. 0: This
switch is turned
off. Default
configured of
encrypted
parameter UIA1
and UEA0 is
used. 18)
PTT_EARLY_
TRANS_SWIT
CH_OFF. 1:
This switch is
turned on. PTT
user will not
apply the early
transmission
function. 0: This
switch is turned
off. PTT user
will apply the
early
transmission
function. 19)
UPLINK_MDC
_ENHENCEM
ENT_SWITCH.
This switch has
become invalid.
20)
NODEB_PRIV
ATE_INTERF
ACE_SWITCH.
1: This switch is
turned on. The
NodeB private
interface data
can be taken to
the NodeB
through the IUB
Issue 01 (2013-04-28)

49
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
protocol
message. 0: This
switch is turned
off. The NodeB
private interface
data can not be
taken to the
NodeB through
the IUB protocol
message. 21)
PTT_SPEC_LI_
SWITCH_OFF.
1: This switch is
turned on.
Special LI
(Length
Indicator) will
not be used for
PTT user. 0:
This switch is
turned off.
Special LI
(Length
Indicator) will
be used for PTT
user. 22)
RNC_DF_2_U
RA_PCH_SWI
TCH. 1: This
switch is turned
on. RNC will
support
transferring Fast
Dormancy UE
from
CELL_DCH or
CELL_FACH to
URA_PCH. 0:
This switch is
turned off. RNC
will not support
transferring Fast
Dormancy UE
from
CELL_DCH or
CELL_FACH to
URA_PCH. 23)
FD_TAC_MAT
Issue 01 (2013-04-28)

50
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
CH_SWITCH.
1: This switch is
turned on. The
RNC uses TAC
matching to
determine
whether to apply
the FAST
DORMANCY
function for pre
fast dormancy
UEs. 0: This
switch is turned
off. The RNC
applies the
FAST
DORMANCY
function for pre
fast dormancy
UEs of 3GPP
Release 5 or
later. 24)
NONPTT_L1_F
AST_SYNC_S
WITCH. 1: This
switch is turned
on. If a UE sets
up a non-PTT
service on the
DCH, the RNC
includes the
Postverification
period
information
element (IE) in a
Uu message to
instruct the UE
to perform
concurrent
uplink and
downlink
synchronization
. 0: This switch
is turned off. If a
UE sets up a
non-PTT service
on the DCH, the
Issue 01 (2013-04-28)

51
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
RNC does not
include the Postverification
period IE in a Uu
message. The
UE first
performs
downlink
synchronization
and then uplink
synchronization
. 25)
URAPCH_LAY
ERED_PAGIN
G_RT_SWITC
H. Whether the
RNC allows
Layered Paging
in URA_PCH
for a UE
processing realtime services. 1:
This switch is
turned on. The
RNC sends
paging
messages to the
cell on which a
UE processing
real-time
services camped
recently and to
the neighboring
cells of this cell.
The RNC pages
the UE in the
entire UTRAN
registration area
(URA) only
when it does not
receive a
response from
the UE. This
significantly
reduces the
number of
paging
messages on the
Issue 01 (2013-04-28)

52
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
Uu interface. 0:
This switch is
turned off. The
RNC directly
pages the UE in
the entire URA.
26)
URAPCH_LAY
ERED_PAGIN
G_NRT_SWIT
CH. Whether the
RNC allows
Layered Paging
in URA_PCH
for a UE
processing nonreal-time
services. 1: This
switch is turned
on. The RNC
sends paging
messages to the
cell on which a
UE processing
non-real-time
services camped
recently and to
the neighboring
cells of this cell.
The RNC pages
the UE in the
entire URA only
when the RNC
does not receive
a response from
the UE. This
significantly
reduces the
number of
paging
messages on the
Uu interface. 0:
This switch is
turned off. The
RNC directly
pages the UE in
the entire URA.
27)
Issue 01 (2013-04-28)

53
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
IDLE_LAYER
ED_PAGING_
NRT_SWITCH.
Whether to
enable layered
paging for UEs
in the idle state
who will
establish nonreal-time
service. 1: This
switch is turned
on. The first
broadcasts a
paging message
in the cell who
has interacted
with the UE for
the last time and
its neighboring
cells. If the UE
cannot be paged,
the RNC then
broadcasts a
paging message
in the LAC or
RAC area. 0:
This switch is
turned off. The
RNC directly
broadcasts a
paging message
in the LAC or
RAC area. 28)
IDLE_LAYER
ED_PAGING_
RT_SWITCH.
Whether to
enable layered
paging for UEs
in the idle state
who will
establish realtime service. 1:
This switch is
turned on. First
broadcasts a
paging message
Issue 01 (2013-04-28)

54
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
in the cell who
has interacted
with the UE for
the last time and
its neighboring
cells. If the UE
cannot be paged,
the RNC then
broadcasts a
paging message
in the LAC or
RAC area. 0:
This switch is
turned off. The
RNC directly
broadcasts a
paging message
in the LAC or
RAC area. 29)
INTELLIGENT
_WIFI_DETEC
T_AND_SELE
CTION.
Whether to
enable
intelligent Wi-Fi
detection and
selection for the
RNC. 1: This
switch is turned
on. The RNC
supports
intelligent Wi-Fi
detection and
selection. 0:
This switch is
turned off. The
RNC does not
supports
intelligent Wi-Fi
detection and
selection. 30)
INTERRAT_L
OAD_REPORT
_FOR_LTE_S
WITCH.
Whether to
enable the RIM-
Issue 01 (2013-04-28)

55
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
based cell load
sharing function
(Multiple
Report). 1: This
switch is turned
on. RIM-based
load sharing can
be achieved
between UMTS
and LTE cells.
Upon receiving
a load sharing
request from an
LTE cell, a
UMTS cell
responds with its
own load
information. 0:
This switch is
turned off.
UMTS cells do
not support the
RIM-based cell
load sharing
function.
Therefore,
UMTS cells do
not respond to
load sharing
requests from
LTE cells. 31)
PTUSER_IDEN
TIFY_SWITCH
. Whether to
preferentially
guarantee
platinum users
in terms of
network access,
voice quality, or
PS service rate.
1: This switch is
turned on. The
RNC recognizes
platinum users
and
preferentially
guarantees their
Issue 01 (2013-04-28)

56
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
user experience.
0: This switch is
turned off. The
RNC does not
recognize
platinum users
and does not
preferentially
guarantee their
user experience.
Disuse
Statement:In
future versions,
the
RNC_SHARE_
SWITCH,
TERMINAL_V
ERSION_DEB
ASE_SWITCH,
CR2284R1_SW
ITCH,
CR2284R1_CO
MPATIBLE_S
WITCH,
COMBINE_OP
ERATION_DR
D_SWITCH
and
UPLINK_MDC
_ENHENCEM
ENT_SWITCH
bit field value
under the
PROCESSSWI
TCH parameter
will be deleted.
Although the
configuration
interface in this
version supports
delivery and
synchronization
of the bit field
value, the bit
field value is no
longer internally
used. Instead,
the function of
Issue 01 (2013-04-28)

57
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
RNC_SHARE_
SWITCH will
be controlled by
the
RncShareSwitc
h parameter in
the SET
UCTRLPLNSH
AREPARA
command.
GUI Value
Range:INVOK
E_TRACE_SW
ITCH,
SYS_INFO_UP
DATE_FOR_I
U_RST,
DRNC_DIREC
T_DSCR,
PTUSER_IDEN
TIFY_ENH_S
WITCH,
RNC_SHARE_
SWITCH,
RNCAP_IMSI_
HO_SWITCH,
TERMINAL_V
ERSION_DEB
ASE_SWITCH,
SYS_HO_OUT
_CIPHER_SWI
TCH,
SYS_HO_CIPH
ER_CONFIG,
BARRED_CEL
L_FOR_CSDO
MAIN_RST,
CR2284R1_SW
ITCH,
CDT_MSG_FU
LL_TRACE,
CR2284R1_CO
MPATIBLE_S
WITCH,
COMBINE_OP
ERATION_DR
D_SWITCH,
Issue 01 (2013-04-28)

58
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
UL_INTER_PR
OTECT_SWIT
CH,
FAST_DORM
ANCY_SWITC
H,
SYS_HO_IN_C
IPHER_SWITC
H,
PTT_EARLY_
TRANS_SWIT
CH_OFF,
UPLINK_MDC
_ENHENCEM
ENT_SWITCH,
NODEB_PRIV
ATE_INTERF
ACE_SWITCH,
PTT_SPEC_LI_
SWITCH_OFF,
RNC_DF_2_U
RA_PCH_SWI
TCH,
FD_TAC_MAT
CH_SWITCH,
NONPTT_L1_F
AST_SYNC_S
WITCH,
URAPCH_LAY
ERED_PAGIN
G_RT_SWITC
H,
URAPCH_LAY
ERED_PAGIN
G_NRT_SWIT
CH,
IDLE_LAYER
ED_PAGING_
NRT_SWITCH,
IDLE_LAYER
ED_PAGING_
RT_SWITCH,
INTELLIGENT
_WIFI_DETEC
T_AND_SELE
CTION,
INTERRAT_L
OAD_REPORT
Issue 01 (2013-04-28)

59
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
_FOR_LTE_S
WITCH,
PTUSER_IDEN
TIFY_SWITCH
Unit:None
Actual Value
Range:INVOK
E_TRACE_SW
ITCH,
SYS_INFO_UP
DATE_FOR_I
U_RST,
DRNC_DIREC
T_DSCR,
PTUSER_IDEN
TIFY_ENH_S
WITCH,
RNC_SHARE_
SWITCH,
RNCAP_IMSI_
HO_SWITCH,
TERMINAL_V
ERSION_DEB
ASE_SWITCH,
SYS_HO_OUT
_CIPHER_SWI
TCH,
SYS_HO_CIPH
ER_CONFIG,
BARRED_CEL
L_FOR_CSDO
MAIN_RST,
CR2284R1_SW
ITCH,
CDT_MSG_FU
LL_TRACE,
CR2284R1_CO
MPATIBLE_S
WITCH,
COMBINE_OP
ERATION_DR
D_SWITCH,
UL_INTER_PR
OTECT_SWIT
CH,
FAST_DORM
ANCY_SWITC
Issue 01 (2013-04-28)

60
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
H,
SYS_HO_IN_C
IPHER_SWITC
H,
PTT_EARLY_
TRANS_SWIT
CH_OFF,
UPLINK_MDC
_ENHENCEM
ENT_SWITCH,
NODEB_PRIV
ATE_INTERF
ACE_SWITCH,
PTT_SPEC_LI_
SWITCH_OFF,
RNC_DF_2_U
RA_PCH_SWI
TCH,
FD_TAC_MAT
CH_SWITCH,
NONPTT_L1_F
AST_SYNC_S
WITCH,
URAPCH_LAY
ERED_PAGIN
G_RT_SWITC
H,
URAPCH_LAY
ERED_PAGIN
G_NRT_SWIT
CH,
IDLE_LAYER
ED_PAGING_
NRT_SWITCH,
IDLE_LAYER
ED_PAGING_
RT_SWITCH,
INTELLIGENT
_WIFI_DETEC
T_AND_SELE
CTION,
INTERRAT_L
OAD_REPORT
_FOR_LTE_S
WITCH,
PTUSER_IDEN
TIFY_SWITCH
Issue 01 (2013-04-28)

61
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
Default
Value:INVOKE
_TRACE_SWI
TCH:
0,SYS_INFO_
UPDATE_FOR
_IU_RST:
0,DRNC_DIRE
CT_DSCR:
0,PTUSER_ID
ENTIFY_ENH_
SWITCH:
0,RNC_SHARE
_SWITCH:
1,RNCAP_IMS
I_HO_SWITCH
:
0,TERMINAL_
VERSION_DE
BASE_SWITC
H:
0,SYS_HO_OU
T_CIPHER_S
WITCH:
0,SYS_HO_CIP
HER_CONFIG:
1,BARRED_CE
LL_FOR_CSD
OMAIN_RST:
0,CR2284R1_S
WITCH:
0,CDT_MSG_F
ULL_TRACE:
0,CR2284R1_C
OMPATIBLE_
SWITCH:
1,COMBINE_O
PERATION_D
RD_SWITCH:
1,UL_INTER_P
ROTECT_SWI
TCH:
1,FAST_DOR
MANCY_SWI
TCH:
0,SYS_HO_IN_
CIPHER_SWIT
CH:
Issue 01 (2013-04-28)

62
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
0,PTT_EARLY
_TRANS_SWI
TCH_OFF:
0,UPLINK_MD
C_ENHENCE
MENT_SWITC
H:
0,NODEB_PRI
VATE_INTER
FACE_SWITC
H:
0,PTT_SPEC_L
I_SWITCH_OF
F:
0,RNC_DF_2_
URA_PCH_SW
ITCH:
0,FD_TAC_M
ATCH_SWITC
H:
0,NONPTT_L1
_FAST_SYNC_
SWITCH:
0,URAPCH_L
AYERED_PAG
ING_RT_SWIT
CH:
0,URAPCH_L
AYERED_PAG
ING_NRT_SWI
TCH:
0,IDLE_LAYE
RED_PAGING
_NRT_SWITC
H:
0,IDLE_LAYE
RED_PAGING
_RT_SWITCH:
0,INTELLIGE
NT_WIFI_DET
ECT_AND_SE
LECTION:
0,INTERRAT_
LOAD_REPOR
T_FOR_LTE_S
WITCH:
0,PTUSER_ID
Issue 01 (2013-04-28)

63
WCDMA RAN
Description
Parameter ID
NE
MML
Command
5 Parameters
Feature ID
Feature Name
Description
ENTIFY_SWIT
CH:0
EncryptionAlgo
BSC6900
SET UUEA
WRFD-011402
Encryption
Meaning:The
encryption
algorithm
supported by
RNC. Both
UEA0 and
UEA1 can be
selected at one
time.
GUI Value
Range:UEA0,
UEA1
Unit:None
Actual Value
Range:UEA0,
UEA1
Default
Value:UEA0:1,
UEA1:1
EncryptionAlgo
BSC6910
SET UUEA
WRFD-011402
Encryption
Meaning:The
encryption
algorithm
supported by
RNC. Both
UEA0 and
UEA1 can be
selected at one
time.
GUI Value
Range:UEA0,
UEA1
Unit:None
Actual Value
Range:UEA0,
UEA1
Default
Value:UEA0:1,
UEA1:1
Issue 01 (2013-04-28)

64
WCDMA RAN
Description
6 Counters
Counters
Table 6-1 Counter description

Counter ID
Counter Name
Counter
Description
NE
Feature ID
Feature Name
67190317
VS.IU.AttSecM
ode
Number of
SECURITY
MODE
COMMAND
Messages
Received by
RNC from CN
BSC6900
WRFD-011401
Integrity
Protection
67190318
VS.IU.SuccSecMode
Number of
SECURITY
MODE
COMPLETE
Messages Sent
by RNC to CN
BSC6900
WRFD-011401
Integrity
Protection
67190319
VS.IU.RejSecM
d.Rnl
Number of
SECURITY
MODE
REJECT
Messages Sent
by RNC to CN
(Radio Network
Layer Cause)
BSC6900
WRFD-011401
Integrity
Protection
67190320
VS.IU.RejSecM
d.Tnl
Number of
SECURITY
MODE
REJECT
Messages Sent
by RNC to CN
(Transport
Layer Cause)
BSC6900
WRFD-011401
Integrity
Protection
Issue 01 (2013-04-28)

65
WCDMA RAN
Description
6 Counters
Counter ID
Counter Name
Counter
Description
NE
Feature ID
Feature Name
67190321
VS.IU.RejSecM
d.NAS
Number of
SECURITY
MODE
REJECT
Messages Sent
by RNC to CN
(NAS Cause)
BSC6900
WRFD-011401
Integrity
Protection
67190323
VS.IU.RejSecM
d.Unsp
Number of
SECURITY
MODE
REJECT
Messages Sent
by RNC to CN
(Unspecified
Failure)
BSC6900
WRFD-011401
Integrity
Protection
67190324
VS.UU.AttSec
Mode
Number of
SECURITY
MODE
COMMAND
Messages Sent
by RNC to UE
BSC6900
WRFD-011401
Integrity
Protection
67190325
VS.UU.SuccSec
Mode
Number of
SECURITY
MODE
COMPLETE
Messages
Received by
RNC from UE
BSC6900
WRFD-011401
Integrity
Protection
67190317
VS.IU.AttSecM
ode
Number of
SECURITY
MODE
COMMAND
Messages
Received by
RNC from CN
BSC6910
WRFD-011401
Integrity
Protection
67190318
VS.IU.SuccSecMode
Number of
SECURITY
MODE
COMPLETE
Messages Sent
by RNC to CN
BSC6910
WRFD-011401
Integrity
Protection
Issue 01 (2013-04-28)

66
WCDMA RAN
Description
6 Counters
Counter ID
Counter Name
Counter
Description
NE
Feature ID
Feature Name
67190319
VS.IU.RejSecM
d.Rnl
Number of
SECURITY
MODE
REJECT
Messages Sent
by RNC to CN
(Radio Network
Layer Cause)
BSC6910
WRFD-011401
Integrity
Protection
67190320
VS.IU.RejSecM
d.Tnl
Number of
SECURITY
MODE
REJECT
Messages Sent
by RNC to CN
(Transport
Layer Cause)
BSC6910
WRFD-011401
Integrity
Protection
67190321
VS.IU.RejSecM
d.NAS
Number of
SECURITY
MODE
REJECT
Messages Sent
by RNC to CN
(NAS Cause)
BSC6910
WRFD-011401
Integrity
Protection
67190323
VS.IU.RejSecM
d.Unsp
Number of
SECURITY
MODE
REJECT
Messages Sent
by RNC to CN
(Unspecified
Failure)
BSC6910
WRFD-011401
Integrity
Protection
67190324
VS.UU.AttSec
Mode
Number of
SECURITY
MODE
COMMAND
Messages Sent
by RNC to UE
BSC6910
WRFD-011401
Integrity
Protection
67190325
VS.UU.SuccSec
Mode
Number of
SECURITY
MODE
COMPLETE
Messages
Received by
RNC from UE
BSC6910
WRFD-011401
Integrity
Protection
Issue 01 (2013-04-28)

67
WCDMA RAN
Description
7 Glossary
Glossary
For the acronyms, abbreviations, terms, and definitions, see the Glossary.
Issue 01 (2013-04-28)

68
WCDMA RAN
Description
8 Reference Documents
Reference Documents
1.
3GPP TS 33.102, "3G Security; Security Architecture"
2.
3GPP TS 31.111, "USIM Application Toolkit (USAT)"
Issue 01 (2013-04-28)

69

Data Integrity Protection and Encryption (RAN15.0 - 01) PDF

Enviado por

Dados do documento

Título original

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

Data Integrity Protection and Encryption (RAN15.0 - 01) PDF

Enviado por

Direitos autorais:

Formatos disponíveis

WCDMA RAN

Data Integrity Protection and

HUAWEI TECHNOLOGIES CO., LTD.

Copyright Huawei Technologies Co., Ltd. 2014. All rights reserved.

Trademarks and Permissions

Huawei Technologies Co., Ltd.

Huawei Industrial Base

Huawei Proprietary and Confidential

Huawei Proprietary and Confidential

Huawei Proprietary and Confidential

WRFD-011401 Integrity Protection

1.2 Intended Audience

Need to understand the features described herein

Work with Huawei products

1.3 Change History

Huawei Proprietary and Confidential

Huawei Proprietary and Confidential

To enhance the security of networks and user data

To prevent the imitation behavior

Huawei Proprietary and Confidential

3.1 Integrity Protection of Signaling

3.1.1 Integrity Algorithm

3.1.2 Integrity Protection Procedure

Huawei Proprietary and Confidential

Figure 3-1 Derivation of MAC-I or XMAC-I from a signaling message

Table 3-1 describes the input parameters to the integrity algorithm.

IK is 128 bits long. It is used to establish CS connections

Huawei Proprietary and Confidential

COUNT_I is 32 bits long. For Signaling Radio Bearers

FRESH is 32 bits long. It is a random number generated

DIRECTION is 1 bit long. It is used to indicate uplink or

3.2 Encryption of Signaling and User Data

3.2.1 Encryption Algorithm

UMTS Encryption Algorithm 0 (UEA0): no encryption

UMTS Encryption Algorithm 1 (UEA1): encryption algorithm f8

3.2.2 Ciphering Procedure

Huawei Proprietary and Confidential

Figure 3-2 Encryption and decryption of signaling and user data

Table 3-2 describes the input parameters to the integrity algorithm.

CK is 128 bits long. It is used to establish CS connections

Huawei Proprietary and Confidential

COUNT-C is 32 bits long. For Radio Bearers (RBs) using the

DIRECTION is 1 bit long. It is used to indicate uplink or

LENGTH is 16 bits long. It is used to indicate only the length

BEARER is 5 bits long. It is used to identify the radio bearer

3.3 Negotiation of Encryption and Integrity Algorithms

Huawei Proprietary and Confidential

Huawei Proprietary and Confidential

4.1 Integrity Protection

4.1.2 Data Preparation

4.1.3 Feature Activation

4.1.4 Activation Check

Huawei Proprietary and Confidential

Step 3 Use UE2 to call UE1.

4.1.5 Feature Deactivation

4.2.2 Data Preparation

4.2.3 Feature Activation

4.2.4 Activation Check

Huawei Proprietary and Confidential

Step 4 The messages RANAP_SECURITY_ MODE_COMMAND and

4.2.5 Feature Deactivation

Huawei Proprietary and Confidential

Table 5-1 Parameter description