Ciphering (GBSS18.1 02)

GSM BSS
GBSS18.1
Ciphering Feature Parameter

Description
Issue 02
Date 2017-01-16
HUAWEI TECHNOLOGIES CO., LTD.

Copyright © Huawei Technologies Co., Ltd. 2018. All rights reserved.
No part of this document may be reproduced or transmitted in any form or by any means without prior written
consent of Huawei Technologies Co., Ltd.
Trademarks and Permissions
and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.
All other trademarks and trade names mentioned in this document are the property of their respective
holders.
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and the
customer. All or part of the products, services and features described in this document may not be within the
purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information,
and recommendations in this document are provided "AS IS" without warranties, guarantees or
representations of any kind, either express or implied.
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute a warranty of any kind, express or implied.
Huawei Technologies Co., Ltd.

Address: Huawei Industrial Base
Bantian, Longgang
Shenzhen 518129
People's Republic of China
Website: http://www.huawei.com
Email: support@huawei.com
Issue 02 (2017-01-16) Huawei Proprietary and Confidential i

Copyright © Huawei Technologies Co., Ltd.
GSM BSS
Ciphering Feature Parameter Description Contents
Contents
1 About This Document.................................................................................................................. 1

1.1 Scope.............................................................................................................................................................................. 1
1.2 Intended Audience.......................................................................................................................................................... 1
1.3 Change History............................................................................................................................................................... 1
2 Overview......................................................................................................................................... 3
2.1 Introduction.................................................................................................................................................................... 3
2.2 NEs Supporting the Feature............................................................................................................................................4
3 Kc Generation.................................................................................................................................5
4 A5 Ciphering Algorithm.............................................................................................................. 7
5 Algorithm Selection...................................................................................................................... 9
6 Signaling for Ciphering Procedure.......................................................................................... 11
7 Enhancements to the A5 Ciphering Algorithm..................................................................... 13
8 Impact on KPI...............................................................................................................................15
9 Related Features...........................................................................................................................17
9.1 GBFD-113501 A5/1 and A5/2 Ciphering Algorithm................................................................................................... 17
9.2 GBFD-113503 A5/3 Ciphering Algorithm...................................................................................................................17
9.3 GBFD-113521 A5/1 Encryption Flow Optimization................................................................................................... 18
9.4 GBFD-181205 A5/4 Ciphering Algorithm...................................................................................................................18
10 Engineering Guidelines........................................................................................................... 19
10.1 Deploying Ciphering.................................................................................................................................................. 19
10.1.1 Deployment Requirements...................................................................................................................................... 19
10.1.2 Activation................................................................................................................................................................ 20
10.1.3 Activation Observation............................................................................................................................................22
10.1.4 Deactivation.............................................................................................................................................................23
10.2 Deploying A5/1 Encryption Flow Optimization........................................................................................................ 24
10.2.1 Deployment Requirements...................................................................................................................................... 24
10.2.2 Activation................................................................................................................................................................ 24
10.2.3 Activation Observation............................................................................................................................................28
10.2.4 Deactivation.............................................................................................................................................................29
Issue 02 (2017-01-16) Huawei Proprietary and Confidential ii

GSM BSS
Ciphering Feature Parameter Description Contents
11 Parameters................................................................................................................................... 33
12 Counters...................................................................................................................................... 51
13 Glossary....................................................................................................................................... 53
14 Reference Documents............................................................................................................... 54
Issue 02 (2017-01-16) Huawei Proprietary and Confidential iii

GSM BSS
Ciphering Feature Parameter Description 1 About This Document
1 About This Document
1.1 Scope
This document describes Ciphering, including its technical principles, related features, and
engineering guidelines.
This document covers the following features:
l GBFD-113501 A5/1 and A5/2 Ciphering Algorithm
l GBFD-113503 A5/3 Ciphering Algorithm
l GBFD-113521 A5/1 Encryption Flow Optimization
l GBFD-181205 A5/4 Ciphering Algorithm
1.2 Intended Audience

This document is intended for personnel who:
l Need to understand the features described herein
l Work with Huawei products
1.3 Change History

This section provides information about the changes in different document versions. There are
two types of changes, which are defined as follows:
l Feature change
Changes in features of a specific product version
l Editorial change
Changes in wording or addition of information that was not described in the earlier
version
02 (2017-01-16)
This issue includes the following changes.
Issue 02 (2017-01-16) Huawei Proprietary and Confidential 1

GSM BSS
Ciphering Feature Parameter Description 1 About This Document
Change Type Change Description Parameter Change
Feature change None None
Editorial change Modified descriptions in Impact on System None

Performance.
01 (2016-02-29)
This issue includes the following changes.
Change Type Change Description Parameter

Change
Feature change Added the A5/4 ciphering algorithm. For details, CipherKeyChang
see: eAllow (BSC6900,
l 2 Overview BSC6910)
l 3 Kc Generation
l 4 A5 Ciphering Algorithm
l 5 Algorithm Selection
l 9 Related Features
l 10.1.1 Deployment Requirements
l 14 Reference Documents
Added the following counters to measure the
performance of the A5/4 ciphering algorithm:
l CELL.SPT.CIPHER.CMD.A5.4
l CELL.SPT.CIPHER.SUCC.A5.4
Editorial change None None
Draft A (2015-12-31)
Compared with Issue 01 (2015-06-27) of GBSS17.1, Draft A (2015-12-31) of GBSS18.1
includes the following changes.
Change Type Change Description Parameter Change
Feature change Modified descriptions in 5 Algorithm CipherCmdWaitCM-

Selection and 8 Impact on KPI. Timer (BSC6900,
BSC6910)
Editorial change None None

GSM BSS
Ciphering Feature Parameter Description 2 Overview
2 Overview
2.1 Introduction
The ciphering procedure is initiated on the network side. The BTS and MS cipher and
decipher information using the A5 algorithm and the ciphering key (Kc) that is generated by
the ciphering algorithm based on capabilities of the MS, BSS, and MSC. This processing
ensures the security of the information on the Um interface. The A5/1, A5/2, and A5/3
ciphering algorithms use the A8 algorithm to generate the Kc, and the A5/4 ciphering
algorithm uses the HMAC-SHA-256 algorithm to generate the 128-bit Kc.
The MS and network side use the same Ki and random number. They use the same ciphering
algorithm to generate the Kc values.
A ciphering or deciphering sequence is generated using the A5 algorithm based on the Kc

stored in the MS and the network and the frame number from the current pulse stream. The
network uses the same ciphering sequence in the uplink and downlink. For each burst, the
data is ciphered or deciphered as follows:
One sequence is used for MS ciphering and BTS deciphering.
The other sequence is used for BTS ciphering and MS deciphering.
GSM specifications define the following ciphering algorithms:
l A5/0 Ciphering Algorithm

NOTE
A5/0 means no ciphering at all.

GSM BSS
Ciphering Feature Parameter Description 2 Overview
Huawei GBSS supports A5/1, A5/2, A5/3, and A5/4 ciphering algorithms. It is recommended
that the same ciphering algorithm be used on the entire network. This prevents handover
failures between ciphering areas and non-ciphering areas due to the MS compatibility issues.
A network operator can use the A5 ciphering algorithm only after being granted by the 3GPP
Organizational Partners. As A5/1 and A5/2 ciphering algorithms have been decoded, it is
advisable that you use the more secure A5/3 ciphering algorithm or the A5/1 ciphering
algorithm with A5/1 Encryption Flow Optimization enabled.
Select ciphering algorithms according to the capabilities of the network and MSs. The
ciphering algorithms to be adopted must be allowed in ciphering commands delivered by the
MSC and in the BSC data configuration, and supported by the MSs. The BSC selects
ciphering algorithms based on the priorities of the algorithms. If the BSS does not support the
ciphering algorithms allowed in ciphering commands delivered by the MSC, it rejects the
implementation of the ciphering procedure.
To addresses the relatively weak data security of the A5 ciphering algorithm, the Ciphering
feature optimizes the ciphering procedure based on the characteristics of the Um interface
transmission on a GSM network. The feature enhances transmission security and provides
better protection against eavesdropping.
2.2 NEs Supporting the Feature

Table 2-1 NEs supporting the feature
Feature BSC6900 BSC6910 GBTS eGBTS
A5/1 and A5/2 Ciphering Algorithm √ √ √ √
A5/3 Ciphering Algorithm √ √ √ √
A5/1 Encryption Flow Optimization √ √ √ √
A5/4 Ciphering Algorithm √ √ √ √
NOTE
√ indicates that the NE supports this feature. × indicates that the NE does not support this feature.

GSM BSS
Ciphering Feature Parameter Description 3 Kc Generation
3 Kc Generation
This section describes the generation of the ciphering key (Kc), which is used to encrypt user
data. The A5/1, A5/2, and A5/3 ciphering algorithms use the 64-bit Kc, and the A5/4
ciphering algorithm uses the 128-bit Kc.
The MS and the network use the same Kc to cipher and decipher user data.
An MS is allocated an International Mobile Station Identity (IMSI) and Ki after it is
registered in the GSM network. The MS and the network store the same Ki and RAND for
authentication. The RAND is generated by the network and sent to the MS. Both the network
and the MS use the A8 algorithm to generate the ciphering key Kc. Figure 3-1 shows the
generation of the 64-bit Kc.
Figure 3-1 Generation of the 64-bit Kc
Unlike the A5/1, A5/2, and A5/3 ciphering algorithms which use the 64-bit Kc, the A5/4
ciphering algorithm uses the 128-bit Kc and the Kc is generated in a way different from that
of generating the Kc for other ciphering algorithm. The network side and MS generate the
128-bit Kc only when the UMTS Authentication and Key Agreement (AKA) procedure is
complete. Figure 3-2 shows the generation of the 128-bit Kc.

GSM BSS
Ciphering Feature Parameter Description 3 Kc Generation
Figure 3-2 Generation of the 128-bit Kc

GSM BSS
Ciphering Feature Parameter Description 4 A5 Ciphering Algorithm
4 A5 Ciphering Algorithm
This section describes the A5 ciphering algorithm, which includes GBFD-113501 A5/1 and
A5/2 Ciphering Algorithm ,GBFD-113503 A5/3 Ciphering Algorithm, and GBFD-181205
A5/4 Ciphering Algorithm. The A5 ciphering algorithm is used to generate a pseudo-random
sequence.
Based on the 64-bit or 128-bit Kc stored in the MS and the network and the 22-bit Link
Logical Control (LLC) frame number of the current pulse stream, the A5 ciphering algorithm
generates a 114-bit ciphering sequence or a 114-bit deciphering sequence. The A5 algorithm
ciphers or deciphers data by performing the Exclusive OR (XOR) operation between the
ciphering/deciphering sequence and the information bit in the data (ciphered or not ciphered).
The network uses the same ciphering sequence in the uplink and downlink. For each burst,
one sequence is used for MS ciphering and BTS deciphering while the other is used for BTS
ciphering and MS deciphering.
The ciphering or deciphering on the radio links is performed by the BTS and MS. Figure 4-1
shows the ciphering/deciphering process.

GSM BSS
Ciphering Feature Parameter Description 4 A5 Ciphering Algorithm
Figure 4-1 Ciphering/deciphering process

GSM BSS
Ciphering Feature Parameter Description 5 Algorithm Selection
5 Algorithm Selection
The ciphering algorithms are selected based on the capabilities of the network, BSS, and MS.
The ciphering algorithm supported by the BSS side is specified by the parameter ENCRY
(BSC6900, BSC6910).
The process of selecting the ciphering algorithms is as follows:
1. In the call access procedure, the MS sends an Establish Indication message to the BSC.
– If the parameter ECSC (BSC6900, BSC6910) in the system information is set to
No, the MS reports Classmark 1 or Classmark 2 to the BSC to indicate support for
the A5/1, A5/2, and A5/3 ciphering algorithms.
– If the parameter ECSC (BSC6900, BSC6910) in the system information is set to
Yes, the MS reports Classmark 1, Classmark 2, and Classmark 3 to the BSC to
indicate support for the A5/1, A5/2, A5/3, A5/4, A5/5, A5/6, and A5/7 ciphering
algorithms.
2. Upon receiving the Cipher Mode Command message from the MSC, the BSC checks
whether it has received Classmark 2 from the MS when the A5/3 or A5/4 ciphering
algorithm is supported.
If the BSC has not received Classmark 2, it starts a timer waiting for Classmark 2 when
CipherCmdWaitCMTimer (BSC6900, BSC6910), which specifies the timer, is set to a
value other than 0. In this case, if the BSC has received Classmark 2 before the timer
expires, it stops the timer and selects ciphering algorithms based on the MS capability; if
the BSC has not received Classmark 2 when the timer expires, it selects ciphering
algorithms based on the current MS capability information. If CipherCmdWaitCMTimer
(BSC6900, BSC6910) is set to 0, the BSC performs ciphering without waiting for
Classmark 2.
NOTE
To set CipherCmdWaitCMTimer (BSC6900, BSC6910) to a value other than 0, you need to set
ECSC (BSC6900, BSC6910) to YES(Yes) in advance. This ensures that MSs can report
Classmark messages properly.
Ciphering algorithm selection complies with the following principles:

l The ciphering algorithms to be adopted should be those supported by the MSC, allowed
in the BSC data configuration, and supported by the MS. If you wish to use the A5/4
ciphering algorithm, the BTS RF modules must support this algorithm.
l The priorities of the ciphering algorithms are specified by EncryptionAlgorithm1st
(BSC6900, BSC6910), EncryptionAlgorithm2nd (BSC6900, BSC6910),

GSM BSS
Ciphering Feature Parameter Description 5 Algorithm Selection
EncryptionAlgorithm3rd (BSC6900, BSC6910), EncryptionAlgorithm4th (BSC6900,

BSC6910), EncryptionAlgorithm5th (BSC6900, BSC6910), EncryptionAlgorithm6th
(BSC6900, BSC6910), and EncryptionAlgorithm7th (BSC6900, BSC6910). If the
ciphering algorithm priority is not set, the default priority is used.
l The BSC selects ciphering algorithms based on the priorities of the algorithms and sends
an Encryption Command message to the BTS.
NOTE
l The default priorities of ciphering algorithms are A5/7 to A5/0, in descending order.
l For some MSs to be handed over from WCDMA cells to GSM cells, if the MSs are not enabled with
Ciphering in WCDMA cells, they cannot be enabled with Ciphering after being handed over to GSM
cells. To avoid MS handover failures in this situation, set HOCipherSw (BSC6900, BSC6910) and
JudgeRNCCipherState (BSC6900, BSC6910) to appropriate values.
NOTICE
l If the BSS does not support the ciphering algorithms specified in the Cipher Mode
Command message from the MSC, it sends the MSC a Ciphering Mode Reject message
with cause value "Ciphering Algorithms Not Supported".
l If the MSC requests to change the ciphering algorithms but the BSS has enabled the
former ciphering algorithms, the BSS sends a Ciphering Mode Reject message to the
MSC.
l If the ciphering algorithms supported by the MSC, allowed in the BSC data configuration,
and supported by the MS are different, determine whether two MSs communicate with
each other in non-encryption mode based on the setting of the ENCRY_OPT_SWITCH
(BSC6900, BSC6910) parameter.
l If the A5/4 ciphering algorithm is enabled in a cell, you are advised to enable this
algorithm in its neighboring cells.

GSM BSS
Ciphering Feature Parameter Description 6 Signaling for Ciphering Procedure
6 Signaling for Ciphering Procedure
This section describes the signaling procedure for ciphering. The ciphering procedure is
generally triggered by location updates, service access, or inter-BSC handovers. To complete
the ciphering procedure, the BSC and MSC must be configured with ciphering algorithms and
the BTS and MS must have the codec capabilities associated with the ciphering algorithms.
Whether ciphering algorithms are used in the radio telecommunications system depends on
the entity that manages radio resources. Figure 6-1 shows the ciphering procedure, which is
initiated by the network and executed by the BTS.
Figure 6-1 Ciphering procedure
Initiating the Setting of the Ciphering Mode

When the authentication procedure is complete, the MSC sends a Ciphering Mode Command
message containing the Kc to the BSC. The BSC then sends a Ciphering Mode Command
message to the MS through the BTS over the Um interface. This message indicates whether
the ciphering will be performed by the MS and which ciphering algorithm will be used by the
MS.
Completing the Setting of the Ciphering Mode

The following operations complete the setting of the ciphering mode:

GSM BSS
Ciphering Feature Parameter Description 6 Signaling for Ciphering Procedure
1. Upon receiving a valid Ciphering Mode Command message, the MS loads the Kc stored
in the SIM card. If the MS receives an invalid Ciphering Mode Command message, it
considers the message to be erroneous. In this case, the MS sends an RR Status message
with cause value "Protocol Error" and does not take any action.
A valid Ciphering Mode Command message can be one of the following:
– One that indicates "start ciphering" and is received by the MS in "not ciphered"
mode.
– One that indicates "no ciphering" and is received by the MS in "not ciphered"
mode.
– One that indicates "no ciphering" and is received by the MS in "ciphered" mode.
2. After the MS receives the Ciphering Mode Command message and completes the
ciphering, it starts to send and receive messages in ciphered mode.
– If the MS has started the operations specified in the Ciphering Mode Command
message, it sends a Ciphering Mode Complete message to the network.
– If the "cipher response" field in the Ciphering Mode Command message is
"IMEISV request", the MS includes its IMEI in the Ciphering Mode Complete
message.
3. Upon receiving the Ciphering Mode Complete message from the MS, the network starts
information transmission in ciphered mode.
Rejecting the Ciphering Mode

If the BSS does not support the ciphering algorithms specified in the Cipher Mode Command
message from the MSC, it sends the MSC a Ciphering Mode Reject message with the cause
value "Ciphering Algorithms Not Supported".

GSM BSS
Ciphering Feature Parameter Description 7 Enhancements to the A5 Ciphering Algorithm
7 Enhancements to the A5 Ciphering

Algorithm
This section describes the enhancements to the A5 ciphering algorithm for better security. The
ciphering procedure is optimized based on the characteristics of the Um interface transmission
in GSM. The optimization enhances transmission security and provides better protection
against eavesdropping. (GBFD-113521 A5/1 Encryption Flow Optimization)
The ciphering procedure is optimized in the following aspects:
l Quick SDCCH handover is adopted in the MS access process, thereby making it more
difficult to track a call.
In a quick SDCCH handover, the BTS initiates an intra-cell SDCCH handover
immediately after sending the ciphering command to the MS. The subsequent ciphered
signaling can be transmitted and received on a new SDCCH. SDFASTHOSWITCH
(BSC6900, BSC6910) specifies whether quick SDCCH handover is enabled. To avoid
incompatibility with the MS, the BSC sends the handover command after receiving the
ciphering complete message from the MS.
l The timing TCH handover is introduced to make it more difficult to track a call.
Intra-cell handovers are performed at a specified time for speech calls.
TCHTIMEHOSWITCH (BSC6900, BSC6910) specifies whether the timing TCH
handover is enabled. If TCHTIMEHOSWITCH (BSC6900, BSC6910) is set to
ON(On), the handover timer is started and the length of the timer is
TCHTIMEHOPERIOD (BSC6900, BSC6910). When TCHTIMEHOPERIOD
(BSC6900, BSC6910) expires, an intra-cell forced handover is performed.
l The Hopping Sequence Number (HSN) in the Flex Training Sequence Code (TSC) and
Flex Mobile Allocation Index Offset (MAIO) differentiates TCHs in a cell, making it
difficult for an intruder to track other TCHs according to the characteristics of a certain
TCH.
The parameter FLEXTSCSWITCH (BSC6900, BSC6910) enables or disables the Flex
TSC function. If FLEXTSCSWITCH (BSC6900, BSC6910) is set to ON(On), channels
participate in frequency hopping and each channel is randomly assigned a TSC, ranging
from 0 to 7.
For details about Flex MAIO, see Flex MAIO Feature Parameter Description.
l After sending the Ciphering Mode Command message to the MS, the BTS stops sending
system information 5, 5bis, and 5ter over the SACCH on the SDCCH.

GSM BSS
Ciphering Feature Parameter Description 7 Enhancements to the A5 Ciphering Algorithm
STOPSI5SWITCH (BSC6900, BSC6910) specifies whether to stop sending System

Information 5, 5bis, and 5ter. If STOPSI5SWITCH (BSC6900, BSC6910) is set to
ON(On), the BTS stops sending System Information 5, 5bis, and 5ter over the SACCH
on the SDCCH after sending the ciphering command, and sends System Information 6 or
L2 filling frames instead.
l The dummy bits are randomized.
DUMMYBITRANDSWITCH (BSC6900, BSC6910) specifies whether to randomize the
dummy bits. If DUMMYBITRANDSWITCH (BSC6900, BSC6910) is set to ON(On),
the BTS randomizes all the 0x2b dummy bits in the signaling and all the dummy bits in
L2 filling frames. To avoid incompatibility with the MS, the BTS reserves the initial
0x2b dummy bits when randomizing signaling.
l Filling information of SI 6 is randomized.
The randomization of filling information of SI 6 is specified by SI6RandomBit
(BSC6900, BSC6910). If this parameter is set to YES(Yes), the BTS fills a random bit in
the idle spare bit following the valid information in SI 6 sent to the MS. The idle spare
bit is contained in the SI6 rest octets IE. The bit stream of SI 6 on the channel that carries
the ongoing call changes after the ciphering procedure starts. Therefore, intruders cannot
compare the bit streams and decipher the A5/1 ciphering algorithm.

GSM BSS
Ciphering Feature Parameter Description 8 Impact on KPI
8 Impact on KPI
Impact on System Capacity

None
Impact on System Performance

Ciphering algorithms increase traffic on radio signaling links and the call access delay,
possibly increasing the SDCCH traffic and SDCCH congestion rate. If the BSS does not
support the specified ciphering algorithm, call access or handovers will fail, affecting
performance counters, such as the assignment success rate and handover success rate.
Before ciphering is complete, a radio signaling link fault will cause a ciphering failure to
report, possibly reducing the SDCCH call drop rate.
When CipherCmdWaitCMTimer (BSC6900, BSC6910) is set to a value other than 0, the call
access delay is increased, and the SDCCH occupation duration is prolonged, possibly
increasing the SDCCH traffic and SDCCH congestion rate.
Enabling A5/1 Encryption Flow Optimization has the following impacts on system
performance:
l Quick SDCCH handover
– The success rate of intra-cell handovers increases. Consequently, the handover
success rate on the entire network increases.
– The number of intra-cell handovers increases. Consequently, the number of call
drops and the call drop rate increase.
l Timing TCH handover
– The success rate of intra-cell handovers increases. Consequently, the handover
success rate on the entire network increases.
– The number of intra-cell handovers increases. Consequently, the number of call
drops and the call drop rate increase. In addition, the increased number of TCH
handovers results in an MOS decrease.
l Flex TSC
It is recommended that Flex TSC be enabled in an asynchronous network. This is
because enabling Flex TSC will impair link performance and therefore lead to call drop,
crosstalk, and noise in a synchronous network where Soft-Synchronized Network or
IBCA is enabled.

GSM BSS
Ciphering Feature Parameter Description 8 Impact on KPI
l Stopping sending system information 5, 5bis, and 5ter after encryption

If frequencies in the BA 1 and BA2 lists have been manually modified, the received
system information 5, 5bis, and 5ter may be incomplete. This decreases the handover
success rate and increases the SDCCH call drop rate.
l Dummy bit randomization
The dummy bit randomization has a slight impact on KPIs. It can decrease the
probability of intermodulation interference generated when the MS receives signals and
therefore decreases the probability of downlink call drops due to sequence errors.
However, such call drops account for a small proportion of call drops on the live
network. Therefore, the KPIs will not be affected greatly.
l Filling information of SI 6 randomization
The filling information of SI 6 randomization has no impact on KPIs.

GSM BSS
Ciphering Feature Parameter Description 9 Related Features
9 Related Features
9.1 GBFD-113501 A5/1 and A5/2 Ciphering Algorithm

Prerequisite Features
None.
Mutually Exclusive Features

None.
Impacted Features
None.
9.2 GBFD-113503 A5/3 Ciphering Algorithm

None.

None.
Impacted Features
None.

GSM BSS
Ciphering Feature Parameter Description 9 Related Features
9.3 GBFD-113521 A5/1 Encryption Flow Optimization

Feature ID Feature Name Description
GBFD-113501 A5/1 and A5/2 A5/1 Encryption Flow Optimization

Ciphering Algorithm depends on the A5/1 ciphering
algorithm in this feature.

GBFD-115830 VAMOS The Flex TSC function is mutually

exclusive with the GBFD-115830
VAMOS feature.
Impacted Features
None.
9.4 GBFD-181205 A5/4 Ciphering Algorithm

None.

None.
Impacted Features
GBFD-510301 Public Voice Group Call This feature does not take effect if
Service either of the following features is
enabled:
GBFD-510302 Public Voice Broadcast
Service l GBFD-510301 Public Voice Group
Call Service
l GBFD-510302 Public Voice
Broadcast Service

GSM BSS
Ciphering Feature Parameter Description 10 Engineering Guidelines
10 Engineering Guidelines
10.1 Deploying Ciphering
10.1.1 Deployment Requirements

Table 10-1 Deployment requirements
Aspect Requirement
Related features See 9 Related Features.
BSC None
BTS 3900 series base stations support the A5/4 ciphering algorithm only in
non-baseband extension mode.
The RRU3004, DRFU, RRU3008 V1, RRU3908 V1, GRFU V1,
MRFU V1, AAU3902, and RXU06 RF modules of 3900 series base
stations do not support the A5/4 ciphering algorithm.
GSM networking None
MS MSs support the ciphering feature.

To support the A5/4 ciphering algorithm, the MS must support A5/4
ciphering and the 128-bit Kc (GSM), and the USIM card must be
installed in the MS.
MSC The MSC supports the ciphering feature.

To support the A5/4 ciphering algorithm, the MSC must use Release
9 or a later version and support the 128-bit Kc (GSM).

GSM BSS
Aspect Requirement
License l GBFD-113501 A5/1 and A5/2 Ciphering Algorithm

None
l GBFD-113503 A5/3 Ciphering Algorithm or GBFD-181205 A5/4
Ciphering Algorithm
The license controlling this feature has been activated. For details
on how to activate the license, see License Management Feature
Parameter Description. For details about license items, see
License Control Item Description.
Others None
10.1.2 Activation
Using MML Commands

On the BSC LMT, perform the following steps:
Step 1 Run the SET BSCBASIC command with A Interface Tag, Um Interface Tag, and Abis
Interface Tag set to GSM_PHASE_2Plus.
Step 2 Run the SET GCELLBASICPARA command with Encryption Algorithm set to A5/0 and
A5/3.
NOTE
l This procedure uses the A5/3 ciphering algorithm as an example. The configuration procedures of
other ciphering algorithms are the same as this procedure.
l A5/0 must be selected in Encryption Algorithm of basic cell parameters.
Step 3 (Optional) Run the SET GCELLBASICPARA command to set the ciphering algorithm
priorities. In this step, set Encryption Algorithm 1 through Encryption Algorithm 7 as
follows:
l Set Encryption Algorithm 1 to A51(A5/1).
NOTE
l The default priorities of ciphering algorithms are A5/7 to A5/0, in descending order. If no priorities are
configured for ciphering algorithms, the default priorities apply.
l Each priority corresponds to an encryption algorithm, and different priorities cannot correspond to the
same ciphering algorithm.
----End

GSM BSS
MML Command Examples

//Setting interface tags
SET BSCBASIC: AVer=GSM_PHASE_2Plus, UmVer=GSM_PHASE_2Plus,
AbisVer=GSM_PHASE_2Plus;
//Setting ciphering algorithms
SET GCELLBASICPARA: IDTYPE=BYID, CELLID=0,
ENCRY=A5/0-1&A5/1-0&A5/2-0&A5/3-1&A5/4-0&A5/5-0&A5/6-0&A5/7-0;
//Setting the encryption algorithm priority
SET GCELLBASICPARA: IDTYPE=BYID, CELLID=0, EncryptionAlgorithm1st=A51,
EncryptionAlgorithm2nd=A52, EncryptionAlgorithm3rd=A53,
EncryptionAlgorithm4th=A54, EncryptionAlgorithm5th=A55, EncryptionAlgorithm6th=A56,
EncryptionAlgorithm7th=A57;
Using the CME

NOTE
When configuring the Ciphering feature on the CME, you must perform a single configuration first, and
then perform batch modifications if required.
You must perform a single configuration for a parameter before batch modifications of the parameter.
You are advised to perform batch modifications before logging out of the parameter setting interface.
Step 1 Configure a single object on the CME. (CME single configuration)

Set parameters on the CME configuration interface according to the operation sequence
described in Table 10-2. For the method of performing the CME single configuration, see
CME Single Configuration Operation Guide.
Step 2 (Optional) Modify objects in batches on the CME. (CME batch modification center)
To modify objects, such as BSCs, BTSs, cells, and TRXs, in batches, click the icon on the
CME configuration interface to start the batch modification wizard. For the method of
performing batch modifications through the CME batch modification center, press F1 on the
wizard interface to obtain online help.
----End
Table 10-2 Configuring parameters on the CME

SN Managed Object NE Paramet Paramet Configurable in
(MO) er er ID CME Batch
Name Modification
Center
1 BSCBASIC BSC6900/ A AVer Yes

BSC6910 Interface
Tag
BSC6900/ Um UmVer
BSC6910 Interface
Tag

GSM BSS
SN Managed Object NE Paramet Paramet Configurable in

(MO) er er ID CME Batch
Name Modification
Center
BSC6900/ Abis AbisVer

BSC6910 Interface
Tag
2 GCELLBASICPARA BSC6900/ Encrypti ENCRY Yes

BSC6910 on
Algorith
m
3 GCELLBASICPARA BSC6900/ Encrypti Encryptio Yes

NOTE BSC6910 on nAlgorith
Configure this MO when Algorith m1st
you set ciphering m1
algorithm priorities.
BSC6900/ Encrypti Encryptio
BSC6910 on nAlgorith
Algorith m2nd
m2

Algorith m3rd
m3

Algorith m4th
m4

Algorith m5th
m5

Algorith m6th
m6

Algorith m7th
m7
10.1.3 Activation Observation

NOTE
This procedure uses the A5/3 ciphering algorithm as an example.

GSM BSS
Step 1 On the BSC LMT, run the SET BSCBASIC command with A Interface Tag, Um Interface
Tag, and Abis Interface Tag set to GSM_PHASE_2Plus.
Step 2 Run the SET GCELLBASICPARA command with Cell Index set to the index of the test
cell and Encryption Algorithm set to A5/0 and A5/3.
Step 3 On the BSC LMT, double-click A Interface Trace to create a trace task. On the Basic tab,
specify the DPC of the test cell in the DPC(HEX) text box and select BSSAP in the Trace
Type area. Specify the ID of the test cell in the Cell ID (cell1, cell2, ...cell16): text box on the
BSSAP tab page. Then, click Submit.
Step 4 After the A Interface Trace window is displayed, use an MS to initiate a call in the test cell.
Expected result: The call is set up, and the chosen-encryption-algorithm IE in the Cipher
Mode Complete message is gsm-a5-3.
----End
10.1.4 Deactivation
Using MML Commands

Run the SET GCELLBASICPARA command with Cell Index set to the index of the test
cell and Encryption Algorithm to A5/0.

//Setting Encryption Algorithm to A5/0
SET GCELLBASICPARA: IDTYPE=BYID, CELLID=0,

ENCRY=A5/0-1&A5/1-0&A5/2-0&A5/3-0&A5/4-0&A5/5-0&A5/6-0&A5/7-0;
Using the CME

NOTE
When configuring the A5/3 Ciphering Algorithm feature on the CME, you must perform a single
configuration first, and then perform batch modifications if required.
described in Table 10-3. For the method of performing the CME single configuration, see
CME Single Configuration Operation Guide.
----End

GSM BSS

SN MO NE Parameter Paramet Configurable in
Name er ID CME Batch
Modification Center
1 GCELLBAS BSC6900/ Cell Index CELLID Yes

ICPARA BSC6910
BSC6900/ Encryption ENCRY

BSC6910 Algorithm
10.2 Deploying A5/1 Encryption Flow Optimization
10.2.1 Deployment Requirements
Table 10-4 Deployment requirements

Aspect Requirement
Related features See 9 Related Features.
BSC None
BTS None
GSM networking None
MS MSs support the ciphering feature.
MSC The MSC supports the ciphering feature.
License The license controlling this feature has been activated. For details on
how to activate the license, see License Management Feature
Parameter Description. For details about license items, see License
Control Item Description.
Others The A5/1 encryption algorithm has been enabled.
10.2.2 Activation
Using MML Commands

l Activating quick SDCCH handover

a. Run the SET GCELLHOBASI command with SDCCH HO Allowed set to
YES(Yes).
b. Run the SET GCELLSOFT command with SD Quick HO set to ON(On).

GSM BSS
l Activating timing TCH handover

a. Run the SET GCELLHOBASIC command with Intracell HO Allowed set to
YES(Yes).
b. Run the SET GCELLSOFT command with TCH Time Handover Switch set to
ON(On) and TCH Time Handover Period set to an appropriate value.
l Activating Flex TSC
Run the SET GCELLSOFT command with Flex TSC Switch set to ON(On).
l Activating dummy bit randomization
Run the SET GCELLSOFT command with Dummy Bit Randomization Switch set to
ON(On).
l Activating the function of stopping sending system information 5, 5bis, and 5ter after
encryption
Run the SET GCELLSOFT command with Stop Send SI 5/5bis/5ter after Encrypt
set to ON(On).
l Activating the randomization of the filling information of SI 6
Run the SET GCELLSOFT command with SI 6 Filling Random Bits After Cipher
set to YES(Yes).

//Activating quick SDCCH handover
SET GCELLHOBASIC: IDTYPE=BYID, CELLID=0, SIGCHANHOEN=YES;
SET GCELLSOFT: IDTYPE=BYID, CELLID=0, SDFASTHOSWITCH=ON;
//Activating timing TCH handover
SET GCELLHOBASIC: IDTYPE=BYID, CELLID=0, INTRACELLHOEN=YES;
SET GCELLSOFT: IDTYPE=BYID, CELLID=0, TCHTIMEHOSWITCH=ON,

TCHTIMEHOPERIOD=60;
//Activating Flex TSC
SET GCELLSOFT: IDTYPE=BYID, CELLID=0, FLEXTSCSWITCH=ON;
//Activating dummy bit randomization
SET GCELLSOFT: IDTYPE=BYID, CELLID=0, DUMMYBITRANDSWITCH=ON;
//Activating the function of stopping sending system information 5, 5bis, and 5ter after
encryption
SET GCELLSOFT: IDTYPE=BYID, CELLID=0, STOPSI5SWITCH=ON;
//Activating the randomization of the filling information of SI 6
SET GCELLSOFT: IDTYPE=BYID, CELLID=0, SI6RandomBit=YES;

GSM BSS
Using the CME

NOTE
When configuring the A5/1 Encryption Flow Optimization feature on the CME, you must perform a
single configuration first, and then perform batch modifications if required.
described in Table 10-5 through Table 10-10. For the method of performing the CME single
configuration, see CME Single Configuration Operation Guide.
----End
l Activating quick SDCCH handover
SN MO NE Parameter Parameter Configura

Name ID ble in CME
Batch
Modificati
on Center
1 GCELLHO BSC6900/ SDCCH HO SIGCHANH Yes

BASIC BSC6910 Allowed OEN
2 GCELLSOF BSC6900/ SD Quick SDFASTHO Yes

T BSC6910 HO SWITCH
l Activating timing TCH handover

Name ID ble in CME
Batch
Modificati
on Center
1 GCELLHO BSC6900/ Intracell HO INTRACEL Yes

BASIC BSC6910 Allowed LHOEN

GSM BSS

Name ID ble in CME
Batch
Modificati
on Center
2 GCELLSOF BSC6900/ TCH Time TCHTIMEH Yes

T BSC6910 Handover OSWITCH
Switch
l Activating Flex TSC
Table 10-7 Configuring the parameter on the CME

Name ID ble in
CME Batch
Modificati
on Center
1 GCELLSOF BSC6900/ Flex TSC FLEXTSCS Yes

T BSC6910 Switch WITCH
l Activating dummy bit randomization

Name ID ble in CME
Batch
Modificati
on Center
1 GCELLSOF BSC6900/ Dummy Bit DUMMYBI Yes

T BSC6910 Randomizati TRANDSW
on Switch ITCH
l Activating the function of stopping sending system information 5, 5bis, and 5ter after
encryption

GSM BSS

Name ID ble in CME
Batch
Modificati
on Center
1 GCELLSOF BSC6900/ Stop Send SI STOPSI5S Yes

T BSC6910 5/5bis/5ter WITCH
after Encrypt
l Activating the randomization of the filling information of SI 6

Name ID ble in CME
Batch
Modificati
on Center
1 GCELLSOF BSC6900/ SI 6 Filling SI6Random Yes

T BSC6910 Random Bits Bit
After Cipher
10.2.3 Activation Observation

l Verifying quick SDCCH handover
Use an MS to initiate a call. On the BSC LMT, trace BSSAP messages over the A
interface.
Expected result: Handover Performed messages are observed.
l Verifying timing TCH handover
Use an MS to initiate a call. On the BSC LMT, trace BSSAP messages over the A
interface.
Expected result: The call is set up and Handover Performed messages are observed after
a period specified by TCH Time Handover Period.
l Verifying Flex TSC
a. Use an MS to initiate a call, trace CS messages over the Um interface on the BSC
LMT, and record the TSC values contained in Assignment Command messages.
b. Terminate the call.
c. Use the MS to initiate another call, trace CS messages over the Um interface on the
BSC LMT, and record the TSC values contained in Assignment Command
messages.
d. Compare the TSC values obtained from the two calls.
Expected result: The TSC values are different.

GSM BSS
l Verifying dummy bit randomization

Use MSs to initiate several calls. Use a drive tester to trace the Um interface messages.
Expected result: After the BTS sends a Um interface command to the MS, the drive
tester traces "RR-RSP" in layer 2 message. "Message dump" contained in "RR-RSP"
shows that some dummy bits are not 0x2B. This means that the dummy bits have been
randomized.
l Verifying the function of stopping sending system information 5, 5bis, and 5ter after
encryption
Use an MS to initiate a call. Then, use a drive test (DT) instrument to trace messages
over the Um interface.
Expected result: SI 5, 5bis, and 5ter is not found in Um interface messages over the
SACCH on the SDCCH after the BTS sends a Ciphering Mode Command message to
the MS.
l Verifying the randomization of the filling information of SI 6
Use an MS to initiate a call. Then, use a DT instrument to trace messages over the Um
interface.
Expected result: The tail filling bit of SI 6 in Um messages is not 2B. This indicates the
filling information of SI 6 is randomized.
10.2.4 Deactivation
Using MML Commands
l Deactivating quick SDCCH handover
Run the SET GCELLSOFT command with SD Quick HO set to OFF(Off).
l Deactivating timing TCH handover
Run the SET GCELLSOFT command with TCH Time Handover Switch set to
OFF(Off).
l Deactivating Flex TSC
Run the SET GCELLSOFT command with Flex TSC Switch set to OFF(Off).
l Deactivating dummy bit randomization
Run the SET GCELLSOFT command with Dummy Bit Randomization Switch set to
OFF(Off).
l Deactivating the function of stopping sending system information 5, 5bis, and 5ter after
encryption
Run the SET GCELLSOFT command with Stop Send SI 5/5bis/5ter after Encrypt
set to OFF(Off).
l Deactivating the randomization of the filling information of SI 6
Run the SET GCELLSOFT command with SI 6 Filling Random Bits After Cipher
set to NO(No).

//Deactivating quick SDCCH handover
SET GCELLSOFT: IDTYPE=BYID, CELLID=0, SDFASTHOSWITCH=OFF;

GSM BSS
//Deactivating timing TCH handover

SET GCELLSOFT: IDTYPE=BYID, CELLID=0, TCHTIMEHOSWITCH=OFF;
//Deactivating Flex TSC
SET GCELLSOFT: IDTYPE=BYID, CELLID=0, FLEXTSCSWITCH=OFF;
//Deactivating dummy bit randomization
SET GCELLSOFT: IDTYPE=BYID, CELLID=0, DUMMYBITRANDSWITCH=OFF;
//Deactivating the function of stopping sending system information 5, 5bis, and 5ter after
encryption
SET GCELLSOFT: IDTYPE=BYID, CELLID=0, STOPSI5SWITCH=OFF;
//Deactivating the randomization of the filling information of SI 6
SET GCELLSOFT: IDTYPE=BYID, CELLID=0, SI6RandomBit=NO;
Using the CME

NOTE
When configuring the A5/1 Encryption Flow Optimization feature on the CME, you must perform a
single configuration first, and then perform batch modifications if required.

described in Table 10-11 through Table 10-16. For the method of performing the CME single
configuration, see CME Single Configuration Operation Guide.
----End
l Deactivating quick SDCCH handover

Name ID ble in
CME
Batch
Modificati
on Center
1 GCELLSO BSC6900/ SD Quick SDFASTH Yes

FT BSC6910 HO OSWITCH

GSM BSS
l Deactivating timing TCH handover

Name ID ble in
CME
Batch
Modificati
on Center
1 GCELLSO BSC6900/ TCH Time TCHTIME Yes

FT BSC6910 Handover HOSWITC
Switch H
l Deactivating Flex TSC

Name ID ble in
CME
Batch
Modificati
on Center
1 GCELLSO BSC6900/ Flex TSC FLEXTSCS Yes

FT BSC6910 Switch WITCH
l Deactivating dummy bit randomization

Name ID ble in
CME
Batch
Modificati
on Center
1 GCELLSO BSC6900/ Dummy Bit DUMMYB Yes

FT BSC6910 Randomizat ITRANDS
ion Switch WITCH
l Deactivating the function of stopping sending system information 5, 5bis, and 5ter after
encryption

GSM BSS

Name ID ble in
CME
Batch
Modificati
on Center
1 GCELLSO BSC6900/ Stop Send STOPSI5S Yes

FT BSC6910 SI 5/5bis/ WITCH
5ter after
Encrypt
l Deactivating the randomization of the filling information of SI 6

Name ID ble in
CME
Batch
Modificati
on Center
1 GCELLSO BSC6900/ SI 6 Filling SI6Random Yes

FT BSC6910 Random Bit
Bits After
Cipher

GSM BSS
Ciphering Feature Parameter Description 11 Parameters
11 Parameters
Table 11-1 Parameters

Parame NE MML Feature Feature Description
ter ID Comma ID Name
nd
HOCip BSC690 SET None None Meaning:

herSw 0 BSCEX Whether the BSC selects an after-handover encryption
SOFTP algorithm based on the encryption algorithm carried in
ARA the Chosen Encryption Algorithm (Serving) IE if this
IE is carried in the Handover Request message during
a handover. This parameter is invalid if the Handover
Request message does not carry the IE.
If this parameter is set to ON, and the target cell
supports the encryption algorithm carried in the
Chosen Encryption Algorithm (Serving) IE, the BSC
selects this algorithm as the after-handover encryption
algorithm. Otherwise, the BSC selects an after-
handover encryption algorithm based on the target cell
configurations.
If this parameter is set to OFF, the BSC selects the
after-handover encryption algorithm based on the
target cell configurations.
GUI Value Range: OFF(Off), ON(On)
Unit: None
Actual Value Range: OFF, ON
Default Value: OFF(Off)

GSM BSS

nd
HOCip BSC691 SET None None Meaning:

herSw 0 BSCEX Whether the BSC selects an after-handover encryption
SOFTP algorithm based on the encryption algorithm carried in
ARA the Chosen Encryption Algorithm (Serving) IE if this
IE is carried in the Handover Request message during
a handover. This parameter is invalid if the Handover
Request message does not carry the IE.
If this parameter is set to ON, and the target cell
supports the encryption algorithm carried in the
Chosen Encryption Algorithm (Serving) IE, the BSC
selects this algorithm as the after-handover encryption
algorithm. Otherwise, the BSC selects an after-
handover encryption algorithm based on the target cell
configurations.
If this parameter is set to OFF, the BSC selects the
after-handover encryption algorithm based on the
target cell configurations.
Unit: None

GSM BSS

nd
JudgeR BSC690 SET None None Meaning:

NCCiph 0 BSCEX Whether the BSC determines the after-handover
erState SOFTP encryption status based on the encryption status
ARA carried in the RNC when the Handover Request
message does not carry the Chosen Encryption
Algorithm (Serving) IE during an inter-RAT incoming
external inter-cell handover.
If this parameter is set to ON, and the Handover
Request message carries the Old BSS to New BSS
information IE, which carries the UE security
information, the BSC selects the after-handover
encryption algorithm based on the encryption
algorithm configured for the target cell and starts
encrypting data. Otherwise, the BSC does not start
encrypting data.
If this parameter is set to OFF, the BSC determines
whether to start data encryption based on the
encryption algorithm configured for the target cell
instead of the encryption status carried in the original
RNC.
Unit: None

GSM BSS

nd
JudgeR BSC691 SET None None Meaning:

NCCiph 0 BSCEX Whether the BSC determines the after-handover
erState SOFTP encryption status based on the encryption status
ARA carried in the RNC when the Handover Request
message does not carry the Chosen Encryption
Algorithm (Serving) IE during an inter-RAT incoming
external inter-cell handover.
If this parameter is set to ON, and the Handover
Request message carries the Old BSS to New BSS
information IE, which carries the UE security
information, the BSC selects the after-handover
encryption algorithm based on the encryption
algorithm configured for the target cell and starts
encrypting data. Otherwise, the BSC does not start
encrypting data.
If this parameter is set to OFF, the BSC determines
whether to start data encryption based on the
encryption algorithm configured for the target cell
instead of the encryption status carried in the original
RNC.
Unit: None
Cipher BSC690 SET GBFD-1 A5/3 Meaning: Length of the timer the BSC waits for a
CmdWa 0 BSCEX 13503 Cipherin Classmark message when the A5/3 or A5/4 ciphering
itCMTi SOFTP g algorithm is supported, if it has not received a
mer ARA Algorith Classmark message containing the ciphering
m algorithm support capability of an MS upon receiving
the Cipher Mode Command message. When this
parameter is set to 0, the BSC performs ciphering
without waiting for a Classmark message. When this
parameter is set to a value other than 0, the BSC waits
for a Classmark message from the MS. In this case, if
the BSC has received a Classmark message before the
timer expires, it stops the timer and performs
ciphering; if the BSC has not received a Classmark
message when the timer expires, it performs ciphering
based on the current MS capability information.
GUI Value Range: 0~7
Unit: s
Actual Value Range: 0~7
Default Value: 0

GSM BSS

nd
Cipher BSC691 SET GBFD-1 A5/3 Meaning: Length of the timer the BSC waits for a
CmdWa 0 BSCEX 13503 Cipherin Classmark message when the A5/3 or A5/4 ciphering
itCMTi SOFTP g algorithm is supported, if it has not received a
mer ARA Algorith Classmark message containing the ciphering
m algorithm support capability of an MS upon receiving
the Cipher Mode Command message. When this
parameter is set to 0, the BSC performs ciphering
without waiting for a Classmark message. When this
parameter is set to a value other than 0, the BSC waits
for a Classmark message from the MS. In this case, if
the BSC has received a Classmark message before the
timer expires, it stops the timer and performs
ciphering; if the BSC has not received a Classmark
message when the timer expires, it performs ciphering
based on the current MS capability information.
GUI Value Range: 0~7
Unit: s
Default Value: 0
Cipher BSC690 SET GBFD-1 A5/4 Meaning:

KeyCha 0 BSCEX 81205 Cipherin Whether the BSC allows cipher key change during a
ngeAllo SOFTP g call.
w ARA Algorith
m If this parameter is set to YES(Yes), the BSC allows
cipher key change during a call.
If this parameter is set to NO(No), the BSC does not
allow cipher key change during a call.
GUI Value Range: NO(No), YES(Yes)
Unit: None
Actual Value Range: NO, YES
Default Value: YES(Yes)
Cipher BSC691 SET GBFD-1 A5/4 Meaning:

KeyCha 0 BSCEX 81205 Cipherin Whether the BSC allows cipher key change during a
ngeAllo SOFTP g call.
w ARA Algorith
m If this parameter is set to YES(Yes), the BSC allows
cipher key change during a call.
If this parameter is set to NO(No), the BSC does not
allow cipher key change during a call.
Unit: None

GSM BSS

nd
ENCRY BSC690 SET GBFD-1 A5/3 Meaning: Encryption algorithm supported by the BSS
0 GCELL 13503 Cipherin side
BASIC GBFD-1 g GUI Value Range: A5/0, A5/1, A5/2, A5/3, A5/4,
PARA 13501 Algorith A5/5, A5/6, A5/7
m
GBFD-1 Unit: None
81205 A5/1
and Actual Value Range: A5/0, A5/1, A5/2, A5/3, A5/4,
A5/2 A5/5, A5/6, A5/7
Cipherin Default Value:
g A5/0:1,A5/1:0,A5/2:0,A5/3:0,A5/4:0,A5/5:0,A5/6:0,A
Algorith 5/7:0
m
A5/4
Cipherin
g
Algorith
m
ENCRY BSC691 SET GBFD-1 A5/3 Meaning: Encryption algorithm supported by the BSS
0 GCELL 13503 Cipherin side
BASIC GBFD-1 g GUI Value Range: A5/0, A5/1, A5/2, A5/3, A5/4,
PARA 13501 Algorith A5/5, A5/6, A5/7
m
GBFD-1 Unit: None
81205 A5/1
and Actual Value Range: A5/0, A5/1, A5/2, A5/3, A5/4,
A5/2 A5/5, A5/6, A5/7
Cipherin Default Value:
g A5/0:1,A5/1:0,A5/2:0,A5/3:0,A5/4:0,A5/5:0,A5/6:0,A
Algorith 5/7:0
m
A5/4
Cipherin
g
Algorith
m

GSM BSS

nd
ECSC BSC690 SET GBFD-1 GSM/T Meaning: The early classmark sending control
0 GCELL 14302 D- (ECSC) parameter specifies whether the MSs in a cell
CCBAS GBFD-1 SCDMA use early classmark sending. After a successful
IC 11101 Interope immediate assignment, the MS sends additional
rability classmark information to the network as early as
System possible. The additional classmark information mainly
Informat contains the CM3 (classmark 3) information. The
ion CM3 (classmark 3) information contains the
Sending frequency band support capability of the MS (used for
the future channel assignment), power information
about each frequency band supported by the MS (used
for the handover between different frequency bands),
and encryption capability of the MS.
Unit: None
ECSC BSC691 SET GBFD-1 GSM/T Meaning: The early classmark sending control
0 GCELL 14302 D- (ECSC) parameter specifies whether the MSs in a cell
CCBAS GBFD-1 SCDMA use early classmark sending. After a successful
IC 11101 Interope immediate assignment, the MS sends additional
rability classmark information to the network as early as
System possible. The additional classmark information mainly
Informat contains the CM3 (classmark 3) information. The
ion CM3 (classmark 3) information contains the
Sending frequency band support capability of the MS (used for
the future channel assignment), power information
about each frequency band supported by the MS (used
for the handover between different frequency bands),
and encryption capability of the MS.
Unit: None

GSM BSS

nd
Encrypt BSC690 SET GBFD-1 A5/3 Meaning: Encryption algorithm with priority 1.
ionAlgo 0 GCELL 13503 Cipherin GUI Value Range: A51(A5/1), A52(A5/2),
rithm1s BASIC GBFD-1 g A53(A5/3), A54(A5/4), A55(A5/5), A56(A5/6),
t PARA 13501 Algorith A57(A5/7)
m
GBFD-1 Unit: None
13521 A5/1
and Actual Value Range: A51, A52, A53, A54, A55, A56,
A5/2 A57
Cipherin Default Value: A57(A5/7)
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
rithm1s BASIC GBFD-1 g A53(A5/3), A54(A5/4), A55(A5/5), A56(A5/6),
t PARA 13501 Algorith A57(A5/7)
m
GBFD-1 Unit: None
13521 A5/1
A5/2 A57
Cipherin Default Value: A57(A5/7)
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation

GSM BSS

nd
rithm2n BASIC GBFD-1 g A53(A5/3), A54(A5/4), A55(A5/5), A56(A5/6),
d PARA 13501 Algorith A57(A5/7)
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
81205 Cipherin Default Value: A56(A5/6)
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m
rithm2n BASIC GBFD-1 g A53(A5/3), A54(A5/4), A55(A5/5), A56(A5/6),
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m

GSM BSS

nd
rithm3r BASIC GBFD-1 g A53(A5/3), A54(A5/4), A55(A5/5), A56(A5/6),
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m
rithm3r BASIC GBFD-1 g A53(A5/3), A54(A5/4), A55(A5/5), A56(A5/6),
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m

GSM BSS

nd
rithm4t BASIC GBFD-1 g A53(A5/3), A54(A5/4), A55(A5/5), A56(A5/6),
h PARA 13501 Algorith A57(A5/7)
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m

GSM BSS

nd
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m

GSM BSS

nd
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m

GSM BSS

nd
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m
m
GBFD-1 Unit: None
13521 A5/1
GBFD-1 A5/2 A57
g
Algorith
m
A5/1
Encrypti
on Flow
Optimiz
ation
A5/4
Cipherin
g
Algorith
m

GSM BSS

nd
ENCRY BSC690 SET GBFD-1 A5/1 Meaning: This parameter specifies the transmission
_OPT_ 0 AITFO 13501 and mode when the BSS does not support the encryption
SWITC THPAR A5/2 algorithm of the MSC. When this parameter is set to
H A Cipherin Yes, the BSS uses non-encryption transmission mode.
g When this parameter is set to No, the BSS rejects the
Algorith call.
m GUI Value Range: NO(No), YES(Yes)
Unit: None
ENCRY BSC691 SET GBFD-1 A5/1 Meaning: This parameter specifies the transmission
_OPT_ 0 AITFO 13501 and mode when the BSS does not support the encryption
SWITC THPAR A5/2 algorithm of the MSC. When this parameter is set to
H A Cipherin Yes, the BSS uses non-encryption transmission mode.
g When this parameter is set to No, the BSS rejects the
Algorith call.
m GUI Value Range: NO(No), YES(Yes)
Unit: None
SDFAS BSC690 SET GBFD-1 A5/1 Meaning: Whether to enable the SDCCH quick
THOS 0 GCELL 13521 Encrypti handover function. If this parameter is set to ON, the
WITCH SOFT on Flow BSC hands over an MS to another SDCCH after
Optimiz sending an encrypted command to the MS. This
ation ensures that subsequent encrypted commands can be
sent and received on the SDCCH, increasing network
security.
Unit: None

GSM BSS

nd
SDFAS BSC691 SET GBFD-1 A5/1 Meaning: Whether to enable the SDCCH quick
THOS 0 GCELL 13521 Encrypti handover function. If this parameter is set to ON, the
WITCH SOFT on Flow BSC hands over an MS to another SDCCH after
Optimiz sending an encrypted command to the MS. This
ation ensures that subsequent encrypted commands can be
sent and received on the SDCCH, increasing network
security.
Unit: None
TCHTI BSC690 SET GBFD-1 A5/1 Meaning: This parameter specifies whether to perform
MEHO 0 GCELL 13521 Encrypti periodic intra-cell handover for speech services on
SWITC SOFT on Flow TCH.
H Optimiz GUI Value Range: OFF(Off), ON(On)
ation
Unit: None
TCHTI BSC691 SET GBFD-1 A5/1 Meaning: This parameter specifies whether to perform
MEHO 0 GCELL 13521 Encrypti periodic intra-cell handover for speech services on
SWITC SOFT on Flow TCH.
H Optimiz GUI Value Range: OFF(Off), ON(On)
ation
Unit: None
TCHTI BSC690 SET GBFD-1 A5/1 Meaning: This parameter specifies the interval at
MEHO 0 GCELL 13521 Encrypti which the speech service on a TCH is handed over.
PERIO SOFT on Flow GUI Value Range: 1~600
D Optimiz
ation Unit: s
Default Value: 60
TCHTI BSC691 SET GBFD-1 A5/1 Meaning: This parameter specifies the interval at
MEHO 0 GCELL 13521 Encrypti which the speech service on a TCH is handed over.
PERIO SOFT on Flow GUI Value Range: 1~600
D Optimiz
ation Unit: s
Default Value: 60

GSM BSS

nd
FLEXT BSC690 SET GBFD-1 Soft- Meaning: Whether to enable the function of the Flex
SCSWI 0 GCELL 18201 Synchro training sequence code (TSC). If the value of this
TCH SOFT GBFD-1 nized parameter is ON and the BTS supports the Flex TSC
17001 Network function, the BSS dynamically allocates TSCs to
Flex hopping frequencies for improving the security of
GBFD-1 calls.
13521 MAIO
A5/1 GUI Value Range: OFF(Off), ON(On)
Encrypti Unit: None
on Flow
Optimiz
ation Default Value: OFF(Off)
FLEXT BSC691 SET GBFD-1 Soft- Meaning: Whether to enable the function of the Flex
SCSWI 0 GCELL 18201 Synchro training sequence code (TSC). If the value of this
TCH SOFT GBFD-1 nized parameter is ON and the BTS supports the Flex TSC
17001 Network function, the BSS dynamically allocates TSCs to
Flex hopping frequencies for improving the security of
GBFD-1 calls.
13521 MAIO
A5/1 GUI Value Range: OFF(Off), ON(On)
Encrypti Unit: None
on Flow
Optimiz
ation Default Value: OFF(Off)
STOPSI BSC690 SET GBFD-1 A5/1 Meaning: This parameter specifies whether the
5SWIT 0 GCELL 13521 Encrypti sending of system information 5, 5bis, and 5ter can be
CH SOFT on Flow stopped on the SACCH on the SDCCH after the BTS
Optimiz issues a ciphering command.
ation GUI Value Range: OFF(Off), ON(On)
Unit: None
STOPSI BSC691 SET GBFD-1 A5/1 Meaning: This parameter specifies whether the
5SWIT 0 GCELL 13521 Encrypti sending of system information 5, 5bis, and 5ter can be
CH SOFT on Flow stopped on the SACCH on the SDCCH after the BTS
Optimiz issues a ciphering command.
ation GUI Value Range: OFF(Off), ON(On)
Unit: None

GSM BSS

nd
DUMM BSC690 SET GBFD-1 A5/1 Meaning: Whether a BTS randomizes the dummy bits
YBITR 0 GCELL 13521 Encrypti in all messages except system information that are
ANDS SOFT on Flow sent to MSs on dedicated channels. If this parameter is
WITCH Optimiz set to OFF, dummy bits are filled by 0x2B. If this
ation parameter is set to ON, dummy bits are filled by
random values.
Unit: None
DUMM BSC691 SET GBFD-1 A5/1 Meaning: Whether a BTS randomizes the dummy bits
YBITR 0 GCELL 13521 Encrypti in all messages except system information that are
ANDS SOFT on Flow sent to MSs on dedicated channels. If this parameter is
WITCH Optimiz set to OFF, dummy bits are filled by 0x2B. If this
ation parameter is set to ON, dummy bits are filled by
random values.
Unit: None
SI6Ran BSC690 SET GBFD-1 A5/1 Meaning: Whether to fill random bits in system
domBit 0 GCELL 13521 Encrypti information (SI) 6 after a ciphering command is sent.
SOFT on Flow GUI Value Range: NO(No), YES(Yes)
Optimiz
ation Unit: None
Default Value: NO(No)
SI6Ran BSC691 SET GBFD-1 A5/1 Meaning: Whether to fill random bits in system
domBit 0 GCELL 13521 Encrypti information (SI) 6 after a ciphering command is sent.
SOFT on Flow GUI Value Range: NO(No), YES(Yes)
Optimiz
ation Unit: None
Default Value: NO(No)

GSM BSS
Ciphering Feature Parameter Description 12 Counters
12 Counters
Table 12-1 Counters

Counter ID Counter Counter NE Feature ID Feature Name
Name Description
1282432419 CELL.SPT.CIP A3413C:Numbe BSC6900 GBFD-113503 A5/3 Ciphering

HER.CMD.A5. r of Cipher Algorithm
3 Commands
(A5/3)
1282432420 CELL.SPT.CIP A3433S:Numbe BSC6900 GBFD-113503 A5/3 Ciphering

HER.SUCC.A5. r of Successful Algorithm
3 Cipher Times
(A5/3)
1282440447 CELL.SPT.CIP A3413D:Numb BSC6900 GBFD-181205 A5/4 Ciphering

HER.CMD.A5. er of Cipher Algorithm
4 Commands
(A5/4)
1282440448 CELL.SPT.CIP A3433X:Numb BSC6900 GBFD-181205 A5/4 Ciphering

HER.SUCC.A5. er of Successful Algorithm
4 Cipher Times
(A5/4)
1282432419 CELL.SPT.CIP A3413C:Numbe BSC6910 GBFD-113503 A5/3 Ciphering

HER.CMD.A5. r of Cipher Algorithm
3 Commands
(A5/3)
1282432420 CELL.SPT.CIP A3433S:Numbe BSC6910 GBFD-113503 A5/3 Ciphering

HER.SUCC.A5. r of Successful Algorithm
3 Cipher Times
(A5/3)
1282440447 CELL.SPT.CIP A3413D:Numb BSC6910 GBFD-181205 A5/4 Ciphering

HER.CMD.A5. er of Cipher Algorithm
4 Commands
(A5/4)

GSM BSS
Ciphering Feature Parameter Description 12 Counters
Counter ID Counter Counter NE Feature ID Feature Name

Name Description
1282440448 CELL.SPT.CIP A3433X:Numb BSC6910 GBFD-181205 A5/4 Ciphering

HER.SUCC.A5. er of Successful Algorithm
4 Cipher Times
(A5/4)
1282436790 BS.MSC.CIPH L0059B:Numbe BSC6900 GBFD-113501 A5/1 and A5/2

ER.MOD.CMD r of Ciphering GBFD-113503 Ciphering
.NUM Commands Algorithm
GBFD-113521
A5/3 Ciphering
GBFD-181205 Algorithm
A5/1
Encryption
Flow
Optimization
A5/4 Ciphering
Algorithm
1282436790 BS.MSC.CIPH L0059B:Numbe BSC6910 GBFD-113501 A5/1 and A5/2

ER.MOD.CMD r of Ciphering GBFD-113503 Ciphering
.NUM Commands Algorithm
GBFD-113521
A5/3 Ciphering
GBFD-181205 Algorithm
A5/1
Encryption
Flow
Optimization
A5/4 Ciphering
Algorithm

GSM BSS
Ciphering Feature Parameter Description 13 Glossary
13 Glossary
For the acronyms, abbreviations, terms, and definitions, see Glossary.

GSM BSS
Ciphering Feature Parameter Description 14 Reference Documents
14 Reference Documents
1. 3GPP 48.058: "Base Station Controller - Base Transceiver Station (BSC-BTS) Interface
Layer 3 Specification"
2. 3GPP TS 33.102: "3rd Generation Partnership Project; Technical Specification Group
Services and System Aspects; 3G Security; Security architecture(Release 12)"
Services and system Aspects; Security related network functions(Release 12)"
GSM/EDGE Radio Access Network; Mobile radio interface layer 3 specification; Radio
Resource Control (RRC) protocol(Release 12)"
GSM/EDGE Radio Access Network; Mobile Switching Centre - Base Station
System(MSC-BSS) interface; Layer 3 specification(Release 12) "
Core Network and Terminals; Mobile radio interface Layer 3 specification; Core
network protocols; Stage 3(Release 12)"
Services and System Aspects; 3G Security; Specification of the A5/3 Encryption
Algorithms for GSM andEDGE, and the GEA3 Encryption Algorithm for GPRS;
Document 1: A5/3 and GEA3 Specifications(Release 6)"
Services and System Aspects; 3G Security; Specification of the A5/4 Encryption
Algorithms for GSM and ECSD, and the GEA4 Encryption Algorithm for
GPRS(Release 12)"


Ciphering (GBSS18.1 02)

Diunggah oleh

Informasi Dokumen

Judul Asli

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

Ciphering (GBSS18.1 02)

Diunggah oleh

Hak Cipta:

Format Tersedia

GSM BSS

Ciphering Feature Parameter

HUAWEI TECHNOLOGIES CO., LTD.

Trademarks and Permissions

Huawei Technologies Co., Ltd.

Issue 02 (2017-01-16) Huawei Proprietary and Confidential i

1 About This Document.................................................................................................................. 1

Issue 02 (2017-01-16) Huawei Proprietary and Confidential ii

Issue 02 (2017-01-16) Huawei Proprietary and Confidential iii

1 About This Document

1.2 Intended Audience

1.3 Change History

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 1

Change Type Change Description Parameter Change

Feature change None None

Editorial change Modified descriptions in Impact on System None

Change Type Change Description Parameter

Editorial change None None

Change Type Change Description Parameter Change

Feature change Modified descriptions in 5 Algorithm CipherCmdWaitCM-

Editorial change None None

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 2

A ciphering or deciphering sequence is generated using the A5 algorithm based on the Kc

One sequence is used for MS ciphering and BTS deciphering.

The other sequence is used for BTS ciphering and MS deciphering.

GSM specifications define the following ciphering algorithms:

l A5/0 Ciphering Algorithm

A5/0 means no ciphering at all.

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 3

2.2 NEs Supporting the Feature

A5/1 and A5/2 Ciphering Algorithm √ √ √ √

A5/3 Ciphering Algorithm √ √ √ √

A5/1 Encryption Flow Optimization √ √ √ √

A5/4 Ciphering Algorithm √ √ √ √

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 4

Figure 3-1 Generation of the 64-bit Kc

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 5

Figure 3-2 Generation of the 128-bit Kc

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 6

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 7

Figure 4-1 Ciphering/deciphering process

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 8

Ciphering algorithm selection complies with the following principles:

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 9

EncryptionAlgorithm3rd (BSC6900, BSC6910), EncryptionAlgorithm4th (BSC6900,

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 10

6 Signaling for Ciphering Procedure

Figure 6-1 Ciphering procedure

Initiating the Setting of the Ciphering Mode

Completing the Setting of the Ciphering Mode

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 11

Rejecting the Ciphering Mode

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 12

7 Enhancements to the A5 Ciphering

The ciphering procedure is optimized in the following aspects:

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 13

STOPSI5SWITCH (BSC6900, BSC6910) specifies whether to stop sending System

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 14

Impact on System Capacity

Impact on System Performance

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 15

l Stopping sending system information 5, 5bis, and 5ter after encryption

Issue 02 (2017-01-16) Huawei Proprietary and Confidential 16