Enabling Technologies for Wireless E-Business phần 2 docx

3 2 2 . 4 . 3 cdma 2000 cdma2000 is an evolution from IS-95 an d i s able to support high rate data over the air interface. cdma2000 is currently under the standardization of Third Generation Partners hi p Pro j ect 2 ( 3GPP2 ) an d i s a fa m il y of stan d ar d s. c d ma2000 1x h as b een w id e l y d ep l oye d over t h e wor ld . Over t h e b an d w id t h of 1.25 MHz , c d ma2000 1x ( 1x means s i ng l e carr i er ) can support a pea k rate of 307.2 kb ps. c d ma2000 1xEV- DO (1x evolution data o p timized) can r each a p eak rate of 2.4 Mb p s. The cdma2000 1xEV-DV (1x evolution for inte g rated data and voice) is furthe r e x p ected to deliver a maximal rate of 3.09 Mb p s. In this p art, we p rovide a brief int r oduction on cdma2000 1x, cdma2000 1xEV- DO, and cdma2000 1xEV-DV. cdma2000 1x cdma2000 1x operates in various frequency bands of 450, 800, 900, 1,700, 1,800, 1 , 900 , an d 2 , 100 MHz , an d i sfu ll y b ac k war d compat ibl e w i t h I S -95. Wh en compare d w i t h IS-95, c d ma2000 1x h as hi g h er vo i ce capac i ty, s upportin g 35 voice calls per sector per carrier. In contrast, the voice capacit y fo r IS-95 is 22 voice channels p er secto r p er carrier. This increase i n voice capacit y is due to a number of factors. Over the forward link, fast p ower c ontrol is emplo y ed; a 1/4 code rate is introduced; and transmit diversity can be im p lemented. Over the reverse link, the capacity improvement mainly comes from the newly adopted coherent demodulation. For vo i ce an d d ata, t h ere are t h ree common l y use d c h anne l s. T h e fun d amenta l c h anne l ( FCH ) i s to carry vo i ce, d ata, an d s i gna li ng at rate s from 1,200 b ps to 14.4 kb ps. T h e hi g h d ata rates are support ed b y t h e supp l ementa l c h anne l ( SCH ) , whose p eak rate can be 16 or 32 times of FCH. The dedicated control channel is u sed for si g nalin g or burst y data access. For data traffic, cdma2000 1x can s u pport a peak data rate of 153.6 kbps u u (release 0) and can be further increased to 307.2 kb p s (release A). The theoretical maximal rate for cdma2000 1x is 628 kb p s, which is achieved by combining two SCHs at 307.2 kb p s p lus an FCH at a rate o f 14.4 kb p s. At the p eak rate of 153.6 kb ps, t h e average rate i s aroun d 50–90 kb ps. At t h e BS, mu l t i p l e SCHs can b e use d ov e r t h e forwar d li n k as l ong as t h ere are e noug h Wa l s h co d es an d transm i ss i o n power. At an MS, t h e num b er o f s i mu l taneous SC Hs i s li m i te d to two. T h e SCH can b e e i t h er i n di v id ua lly ass ig ne d t o an MS, or s h are d amon g a num b er of MSs. Furthermore, turbo code has been introduced in cdma2000 1x. It has coding rates of 1/2, 1/3, and 1/4, and is de r ived from two 8-state p arallel concatenate d codes. Turbo code can deliver better p erf o rman ce than co n vo l u ti o n codes w it h l ong co di ng bl oc k s. T h erefore, i t i s on l y use d on t h e SCH w h en a frame h as more th an 360 bi ts. T ransm i t di vers i ty i s a l so a d opte d i n c d ma20 0 0 1x , w hi c h i s ca ll e d ort h ogona l t ransm i t di vers i t y . It i s an i mp l ementat i on of t h e ort h o g ona l space t i me bl oc k co d e. Bas i ca lly two ort h o g ona l s ig na l s are tra n s m i tt ed fr o m t wo ant e nna ele m e nt s D. Shen and V.O.K. Li 33 at the BS. At the MS, the received si g nals are optimall y combined to achieve the diversity gain. An important feature in cdma2000 1x is the newly introduced location capability. The g p sOne position technology from Qualcomm has been integrate d i nto d ev i ce c hi pset su i tes. H ighly accurate pos i t i on i n g can b e ac hi eve d t h rou gh ( A-GPS ) networ k ass i ste d -GPS. Convent i o n a l GPS requ i res severa l m i nutes to p ro d uce l ocat i on resu l ts. W i t h t h e ass i stance of t h e networ k , A-GPS can prov id e p ositionin g within secon d s. When GPS si g nal is not available, e. g ., for indoo r p ositionin g , advanced forward link trian g ulation and other mixed techniques are adopted to provide location information, at reduced accurac y . The introduction o f l ocation features would inevitably promot e a wide range of applications such as s ecurity, navigation, location-base d services , and mobile commerce. cdma2000 1xEV-DO Th e tec h n i ca l spec i f i cat i on for 1xEV-DO i s I S-856, re l ease d by 3GPP2. T h e c hi p rate i s st ill 1.2288 Mcps w i t h a b an d w id t h of 1.25 MHz. T h e 1xEV-DO i s d es ig ne d to eff i c i ent ly transfer d ata. For vo i ce, w i t h t h e a dd e d QoS features, vo i ce over IP can be ado p ted. With the o p timiza t ion for data onl y , the data rate is g reatl y i ncreased with res p ect to cdma2000 1x. The p eak forward link data rate can be as hi g h as 2.4 Mbps. Avera g e data rate f o r a user can be as hi g h as 300–800 kbps. One reason for t h e en h ance d spectru m eff i c i ency i s t h e sepa r at i on of vo i ce an d d ata. Vo i ce h as di fferent c h aracter i st i cs an d QoS requ i rements w i t h d ata. Fo r e xamp l e, vo i ce traff i c i s d e l ay sens i t i ve. A d e l ay over 100 ms i s not d es i ra bl e fo r vo i ce. To re d uce d e l a y , vo i ce traff i c common uses s h ort frame s i ze. However, sh ort frame s i ze a l so l ea d s to a dd e d over h ea d an d re d uce d eff i c i enc y . On t h e ot h e r h an d , d ata are b urst y i n nature an d more t o l era bl e of d e l a y . T h erefore, l on g frame s ize can be adopted to improve efficienc y . Another improvement in efficienc y comes from the turbo codin g on data f rames. Turbo codin g is most effective for lon g frames. For voice, the benefit o f t urbo coding can hardly be enjoyed. Besides BPSK and QPSK, higher level modulation schemes 8PSK and 16- QAM are used to achieve data rates above 1 Mb p s. The data rates of 1xEV-DO are f l ex ibly a dj uste d accor di n g to t h e c h anne l con di t i on. T h e MS constant ly mon i tors t h e rece i ve d s ig na l qua li t y from t h e BS an d sen d s report to t h e BS on e xpected channel qualit y . With favorable channel co n dition, hi g h transmission rates can be used. When channel qualit y deteriorates, the data rate is adaptivel y r educed. T he data rates over the forward and reverse link are asymmetric. This is natural f or data services since the data traffic is intrinsically asymmetric, with the forward l ink dominating the reverse link. The rever s e link data rate doubles from 9.6 kb p s up to 153.6 kb ps. The power control policy is different between cdma2000 1x and cdma2000 t 1xEV-DO. For vo i ce traff i c i n c d ma2000 1x , th e purpose of power contro l i s to achieve the desi g nated SINR with the least transmission p ower. In cdma2000 1xEV - DO, the hi g hest power is used to deliver the maximal achievable rate to a user. 2 Fun d amenta l s of Wi re l ess C ommun i cat i ons 34 Flexible resource mana g ement is utilized between BS and MSs to achieve hi g h s ystem t h roug h put. T h i s i s v i a bl e d ue to t h e d e l ay i nsens i t i ve nature of t h e d ata s erv i ce. T h e management of resources i s t h e j o b of t h e sc h e d u l er, w hi c h w ill di str ib ute t h em i n a fa i r manner to di fferent users. T h e c h anne l con di t i on s h ou ld b e i ncorporate d i nto t h e sc h e d u li n g process so t h at t h rou gh put an d QoS can b e p roper ly b a l ance d . For users i n d eep fa d es , i t i s more eff i c i ent to di vert t h e t i me sl ots to ot h er users w i t h g oo d c h a n nel co n di t io n s. T his is t he so - c a lled m ul t iuser diversit y in wireless data networks. 1xEV-DO full y supports IP. Therefore, securit y mechanisms such as virtual p rivate network can be overlaid on to p of 1xEV-DO. The 1xEV-DO air interface will be trans p arent to users, since 1xEV-DO is itself a PDN. 1xEV-DO is used for data sessions only. Dual mode devices will support both c d ma2000 1x vo i ce an d 1xEV-DO high sp e e d d ata serv i ce. Wh en a ca ll comes to a user w i t h an on g o i n g d ata c onnect i on , t h e use r is n o t i f ied. If t he use r decides t o pi c k up t h e ca ll , t h e d ata serv i ce i s temporar ily suspen d e d d ur i n g t h e per i o d of co n ve r s ati o n . Th e dev i ce w ill automaticall y transfer to t h e cd ma2000 1x air i nterface. In this wa y , a user will no t m iss a call durin g 1xEV-DO data service, an d th e tran s mi ss i o n be t wee n vo i ce an d 1xEV-DO data service is seamless and t rans p aren t t o a user. cdma2000 1x-EV-DV Th e focus of 1xEV-DV i s to i ncrease t h e forwar d li n k d ata rate w h en support i ng b ot h d ata an d vo i ce. H i g h spec t ra l eff i c i ency i s ac hi eve d w i t h t h e i ntro d uct i on of a new c h anne l , forwar d pac k et d ata c h anne l ( F-PDCH ) . On F-PDCH, t h e pea k d ata rate can b e as high as 3.09 M b ps. T o i mprove eff i c i enc y , resource s h ar i n g i s performe d amon g MSs. T h ere are t hree p ossible modulation schemes: QPSK, 8PSK, and 16-QAM. T y pe II h y bri d automatic re p eat re q uest (H-ARQ) is ado p ted . In this t y pe of ARQ, incremental redundanc y is transmitted with turbo codes. 2.4.4 Un i versal Mob i le Telecommun i cat i on Sy stem UMTS is the most widely supported third generation mobile communications d system. 3G systems are intend e d to provide global mobility with a wide range o f services, including telephon y , paging, messaging, Internet , and broadband data. The Int e rnat io na l T eleco m m unication Union started the m m process of d ef i n i n g t h e stan d ar d f or t hi r d g enerat i on s y stems, referre d to a s Int e rnat io na l M obile T eleco mm u n i - c ations 2000 (IMT-2000). ETSI was res p onsible f or UMTS standardization. In 1 99 8 3GPP was formed to continue t h e technical s p ecification work. Services UMTS offers teleservices (like s p eech or SMS) and bearer services, which p rovide t h e capa bili ty for i nformat i on transfer b etween access po i nts. It i s poss ibl e to D. Shen and V.O.K. Li 35 connect i on esta bli s h ment an d d ur i n g on g o i n g sess i on or connect i on. Bot h connection-oriented and connectionless s ervices are offered for PTP and PMP communication. T he data rates for UMTS are: • 144 kb ps for rura l out d oor an d sate lli te • 3 84 kb ps for ur b an out d oor • 2 .048 Mbps for indoor or low-ran g e outdoor Bearer services have different QoS p ara m eters for maximum transfer dela y , dela y variation, and bit error rate. Fou r QoS classes are defined in UMTS: r • C onversational clas s . This includes voice and video telephony. The speech codec in UMTS will employ the ad a ptive multirate technique. It has eight s ource rates , f rom 4.75 to 12.2 kb p s. Voice acti v i ty detector is used with b ac kg roun d no i se eva l uat i on. In vid eo te l ep h on y , UMTS spec i f i e d H . 264M f o r ci r cui t- swi t ch e d connect i ons an d sess i on i n i t i at i on protoco l for IP mu l t i me di a app li cat i ons. • Streamin g class . In this class, multimedia data are transferred as a stead y and continuous stream. Some exam p les are multimedia, video on demand, and webcast. Usuall y streamin g media is less sensitive to dela y . Therefore, b uffering can be adopted to smooth out delay jitter. • I nteractive c l ass. T hi s type of app li cat i on r equ i res i nteract i on b etween p art i es. For examp l e, We b b rows i n g an d networ k g am i n g b e l on g to t h e i nt e ra c t ive cl a ss. • B ack g round class . T hi s i s t h e tra di t i ona l b est effort serv i ce , suc h as ema il, SMS, and file downloadin g . L ocation services are also p rovided in UMTS. Similar to cdma2000, the l ocation methods in UMTS include: 1 .Ce ll - id b ase d pos i t i on i ng 2 .Pos i t i on i ng b ase d on t i me di fference of arr i va l 3 . Networ k -ass i ste d GPS ( A-GPS ) Architecture An UMTS networ k cons i sts of t h ree i nteract i ng d oma i ns: core networ k ( CN ) , UMTS terrestr i a l ra di o access networ k ( UTRAN ) , an d user equ i pment ( UE ) . T h e ma i n funct i on of t h e core networ k i s to prov id e sw i tc hi ng, rou ti ng, an d trans i t fo r user traffic. Core network also contain s the databases and network mana g emen t f unctions. Fi g . 2.20 shows th e UMTS network elements. T he CN architecture for UMTS is base d o n GPRS. All e q ui p ment have to be modified for UMTS o p eration and services. T he CN can be divided into circuit- s witched and packet-switched parts. Circuit-switching equipment such as MSC an d GSMC rema i n t h e same as i n GSM. T h e pac k et d oma i n i s manage d b y SGSN an d GGSN , t h e same as i n GPRS. T h e exte r na l networ k s a l so h ave two types: c i rcu i t-sw i tc h e d networ k s suc h as P S TN a n d ISDN, an d pac k et-sw i tc h e d networ k s such a s t he Int e rn e t . 2 Fun d amenta l s of Wi re l ess C ommun i cat i ons negotiate and renegotiate the characteristics of a bearer service at session o r 36 U TRAN p rovides the air interface access method for user e q ui p ment. In UMTS , t h e b ase stat i on i s referre d to as No d e-B , w hil e BSC i s ca ll e d ra di o networ k contro ll er ( RNC ) . Th e funct i ons of No d e-B i nc l u d e: • Ra di o transm i ss i on an d recept i on • M odul at io n /de m odul at io n • C hannel coding • Microdiversity • E rror handling • Cl ose d l oop power contro l Fi g. 2.20 . UMTS system arc hi tecture D. Shen and V.O.K. Li 3 7 T he functions of RNC include: • Ra di o resource contro l • A d m i ss i on contro l • Ch anne l a ll ocat i on • Power contro l sett i n g s • Han dove r co ntr o l • Macrodiversity • C iphering • Segmentation/reassembly • Broa d cast s ig na li n g • Open- l oop power contro l Fig . 2.21. UMST l o gi ca l e l ements an d i nterfaces U E cons i sts of two parts: • Mo bil e equ i pment i s t h e ra di o te rm i na l used f o r ra dio co mm u n ic at io n . • UMTS su b scr ib er id ent i t y mo d u l e ( USIM ) performs t h e same ro l e as t h e SIM card. Its functions are mainl y related to securit y aspects, such as a u th e nti c ati o n . U MTS has the same t y pes of id e ntit y as in GPRS, such as IMSI, TMSI, P - T M S I , IMEI , etc. U MTS spec i f i es i nterfaces b etween l og i ca l networ k e l ements. T h e ma j or ones i nc l u d e: • Uu i nterface: t h e i nterface b etween UE an d UTRAN , w hi c h i s a l so t h e ra dio i nt e rfa ce. • C u i nterface: t h e i nterface b etween US IM car d an d U E. • Iu interface: this interface connects UTRAN to the CN. • Iur interface: the interface between RNCs. • Iu b i nterface: t h e i nterface t h at connects No d e-B w i t h RN C . F ig . 2.21 ill ustrates t h e re l at i ons hi p b et w een t h e l o gi ca l networ k e l ements an d i nterfaces. 2 Fun d amenta l s of Wi re l ess C ommun i cat i ons 3 8 Radio Access Th e a i r i nterface tec h no l ogy of UTRAN i s ca ll e d w id e b an d CDMA ( WCDMA ) . W CDMA h as two b as i c operat i on mo d es: f requency- di v i s i on d up l ex i ng ( FDD ) an d t i m e - divisio n d up l ex i n g ( TDD ) . Th e ma j or parameters of t h e FDD stan d ar d are summar i ze d as fo ll ows: • C hi p rate: 3.84 Mc p s • Bandwidth: 5 MHz • C hannel coding schemes: convolutiona l coding and turbo coding, which is used f o r d ata traff ic • Mo d u l at i on sc h eme: QPS K • Pu l se s h ape: root-ra i se d cos i n e wi t h a r oll o f fa c t o r o f 0 . 22 • Frame len g th: 10 ms • Power control rate: 1,500 Hz • Power control ste p size: 0.5, 1, 1.5, 2 dB • P h ys i ca l l ayer sprea di ng factor: 4-25 6 for up li n k , 4-512 for d own li n k Th e max i ma l d ata rate for WCDMA FDD mo d e i s 384 kb ps an d can b e i ncreased to 2 Mb p s. T he FDD mode re q uires a p air of 5-MHz bands. In certain situations, there are no such paired bands. Further, the traf fic over 3G networks is expected to be f f asymmetric, which means traffic over downlink will be much heavier than u p link. T herefore, the p aired bandwidth allocation is not flexible and suitable fo r asymmetric traffic. Th e TDD mo d e of WCDMA i s b etter su i te d for unpa i re d b an d s an d asymmetr i c traff i c. T hi s i s b ecause TDD ne ed s on l y one frequency b an d , an d t h e ti me s l ots for up li n k an d d own li n k ca n be adaptively adjusted. The major n parameters of WCDMA TDD are: • C hi p rate: 1.28 or 3.84 Mc p s. • Bandwidth: 1.6 MHz (at 1.28 Mc p s) or 5 MHz (at 3.84 Mc p s). • C hannel coding: convol u t ional and turbo coding. • Modulation: Q PSK. • Frame l en g t h : 10 ms. • Nu m be r o f slo t s/ fram e: 15 . • P owe r co ntr ol rat e: 100 o r 200 Hz ove r up li n k , 800 Hz over d own li n k . • Power control ste p size: 1, 2, 3 dB. • Physical layer spreading f a ctor: 1, 2, 4, 8, 16. f f • Th e TDD mo d e a l so emp l oys a num b e r of tec h no l og i es suc h as j o i nt d etect i on an d smart antenna to furt h er i mprove capac i ty. It can b e expecte d th at goo d spectra l eff i c i ency can b e ac hi eve d w i t h t hi s TDD mo d e. 2.4.5 Security Features in cdma2000 and UMTS UMTS and cdma2000 bear man y resembl a n ces in terms of securit y features. T herefore, we elaborate onl y on the securit y schemes in UMTS. D. Shen and V.O.K. Li 39 T he UMTS securit y framework is an enhance m ent and extension of the securit y f eatures in 2G systems. The major secu r ity aspects are still the authentication of UE and encryption between UE and the serving network (SN). Authentication and Key Agreement Th e aut h ent i cat i on an d k ey generat i on proce d ure i n UMTS i s c a ll e d aut h ent i cat i on an d k e y a g reement ( AKA ) , w hi c h i s use d for aut h ent i cat i on an d g enerat i on of k e y s for encr y pt i on an d i nte g r i t y protect i on . It should be n o t e d t h at U MT S a ll ows t h e U E to aut h ent i cate t h e networ k . T h is is c a lled m u t u a l a u t he nt ic at io n . In contrast, onl y UE is authenticated in GSM, and a UE can never re j ect the network. W ith mutual authentication, it is p ossible for the UE to re j ect the network. T he AKA p rocedure is im p lemented at the USIM card at UE and AuC of the networ k . T h e aut h ent i cat i on process at t h e networ k s id e i nvo l ves h ome e nv i ronment ( HE ) an d SN. T h e HE ma i n l y cons i sts of t h e HLR an d AuC. T h e SN refers to SGSN for pac k et-sw i tc h e d d ata an d VLC / MSC for c i rcu i t-sw i tc h e d d ata . Th e operat i on of AKA h as two sta g e s. T h e f i rst sta g e i s to transfer t h e authentication vector (AV) from the HE to the SN. The AV contains securit y c r ede ntial s suc h a s c hallen g e–response authentication data and encr y ption ke y s. It s hould be p ointed out that the transfer be t w een HE and SN sh o u l d be secu r ed. F or this p ur p ose, mobile a pp lication p art ( M AP) p rotocol is used, which p rovides s ecure mechanisms for the AV transfer. The second stage is the execution of the one-pass challenge–response procedure at the SN to achieve mutual authentication b etween t h e USIM an d t h e networ k . S i m il ar to GSM , t h e aut h ent i cat i on i s a l so b ase d on a pres h are d 128- bi t secret k e y , K, w hi c h i s store d i n b ot h USIM an d Au C i n HE. In UMTS, a number of al g orithms are desi g ned for authentication purpose an d are different from those in GSM. The a l g orithms related to a u th e nti c ati o n ar e fr o m f 0 to f5*. In Table 2.3, we list t he securit y -related al g orith m s in UMTS. In p ractice, the authentication algorithms (from f0 to f5*) are operator specific. This means it is up to the operator to decide the exact algorithms for implementation. 3 GPP developed a set of algorithms c a l led MILENAGE as an exam p le set of a l gor i t h ms. In t h e aut h ent i cat io n process, t h e f0 a l go r i t h m i s use d to generate t h e ran d om number RAND. An authentication token AUTN is also g enerated b y the SGSN/VLR. At the network side, fun c t ion f1 is invoked to produce messa g e authentication code (MAC-A). Then t h e challen g e messa g e, composed of RAND, AUTN, and MAC-A, is sent to the UE. Within the AUTN, there is also a se q uence number (SQN). The function f5 may be optionally used to p r o duce an anonymity key (AK) for the concealment of SQN in the challenge. This is achieved by XOR i ng SQN w i t h AK. 2 Fun d amenta l s of Wi re l ess C ommun i cat i ons 40 W hen UE receives the challen g e, UE authenticates the network b y comparin g t h e l oca l compute d MAC w i t h t h e rece i ve d MAC-A. After aut h ent i cat i on of t h e networ k , an aut h ent i cat i on response ( RES ) i s compute d b y t h e USIM emp l oy i ng t h e f2 a l gor i t h m. T h en RES i s s ent b ac k to t h e networ k f or t h e aut h ent i cat i on o f UE. In t h e meant i me , a 1 2 8 - bi t c i p h er k e y ( CK ) i s ca l cu l ate d by t h e f3 a lg or i t h m, an d a 128- bi t i nte g r i t y k e y ( IK ) by t h e f4 a lg or i t h m. In UMTS, conf id ent i a li ty i s ac hi eve d t h roug h encrypt i on. T h e CK i s 128 bi ts, w hi c h d ou bl es t h e 64- b i t k ey i n GSM. T h e a dd e d bi ts s i gn i f i cant l y i mprove encryption security. Another difference bet ween GSM and UMTS is the scope of t t e ncr y pt i on. In GSM, c i p h er i n g en d s at BT S, an d i nformat i on f l ow b etween BTS a nd BSC is in the clear. However, in man y practical s y stems, several links f 0 random challen g e g eneration function f 1 n e t wo r k a u t he nt ic at io n f u n c t io n f1 * res y nc h ron i zat i on messa g ea u t he nt ic at io n f u n c t io n f 2 user c h a ll enge–response generat i on funct i on f 3 cipher ke y derivation function f 4 inte g rit y derivation function f5 anonymity key derivation f unction for norm f f al operat i on f5* anonymity key derivation f unction for resynchronization f f f 6 MAP encryption algorith m f 7 MAP inte g rit y al g orithm f 8 UMTS encr y pt i on a lg or i t h m f 9 UMTS i ntegr i ty a l gor i t hm T a b l e 2 . 3 . Secur i t y a lg or i t h ms i n UMTS D. Shen and V.O.K. Li al gor i t h m funct i on Confidentiality and Integrity 41 b etween BTS an d BSC are a l so t h roug h ra di o . T h erefore, encrypt i on ta k es p l ace b etween M S an d RN C i n U MT S . E ncr y pt i on ensures t h e conf id ent i a li t y of t h e messa g es. On t h e ot h er h an d , i t i s necessar y to protect encr y pte d messa g es from b e i n g ma li c i ous ly mo di f i e d . T hi s i s achieved b y the i n t e g rit y al g orithms. Th e integrity mechanism is to produce a m messa g e authentication code (MAC). In UMTS, i n te g rit y protection is onl y ado p ted for the si g nalin g messa g es between MS and RNC. Th e encrypt i on an d i ntegr i ty a l gor i t h ms i n UMTS are a ll b ase d on t h e Kasum i M ore spec i f i ca lly , t h e encr y pt i on a lg or i t h m i s f8. It pro d uces k e y stream bl oc k s of 64 bi ts , w hi c h i s t h en XORe d w i t h t h e p l a i ntext da ta. It requ i res a 128- bi t C K that is g enerated b y f3. T he inte g rit y al g orithm is f9. It is also based on Kasumi but operates in the cipher-block-chainin g mode. It takes the messa g e as the input and operates with the IK produced by f4. The final output from f9 is a 64-bit cipher block. Afterward m i t i s truncate d to 32 bi ts to pro d uce t h e MAC. T h e MAC i s t h en transferre d toget h er w i t h t h e encrypte d message. At t h e rece i ver, t h e MAC i s re-generate d an d compare d w i t h t h e rece i ve d MAC. If t h e two a g ree, t h e i nte g r i t y of t h e messa g e i s aff i rm ed. 2.5 Summary In t hi s c h apter, we prese n t ed a b r ie f i ntr oduc t io n of the f u n d am e nta ls o f wi r eless communications. We described the cellular standards of GSM, GPRS, IS-95, cdma2000, and UMTS. We also introduced the security aspects of these standards. References 2 Fun d amenta l s of Wi re l ess C ommun i cat i ons cipher. Kasumi is a block cipher with eight rounds of operation. It operates on t 64- bi t d ata bl oc k w i t h a k ey l engt h of 128 bi ts. 1. J. Eberspä cher, H J. V ä ä gel, C. Be ttstetter, GSM Switching, Services and ö ö P rotocols, 2nd Edition, Wile y , New York, 2001. 2. T. Halonen, J. Romero, J. Melero, GSM, GPRS and EDGE Performance, W ile y , New York, 2002. 3 . D . Goo d man, “Secon d generat i on w i re l ess i nformat i on networ k s , ” IEEE Trans. Ve hi cu l ar Tec h no l ., vo l . 40, no. 2, pp . 366 – 3 7 4 , May 1991 . 4 . M . Ra h nema, “Overv i ew of t h e GSM system an d protoco l arc hi tecture,” I EEE Commun. Ma g ., pp. 92–100, Ju ly 1993. 5. A . Me h rotra, L. S. Go ldi n g , “Mo bili t y an d secur i t y mana g ement i n t h e GSM s y stem and some proposed future improvements,” Proc. IEEE, vol. 86, no. 7, pp . 1480 – 1 497, Jul y 1998. 6 . B . Schneier, Applied Cr y pto g raph y : Protocols, Al g orithms, and Source Code in C , 2nd Edition , Wiley, New York, 1996. [...]... example, the point (9, 5) satisfies this equation since: x3+x ≡ 93+9 ≡ 729 +9 ≡ 2 mod 23 ≡ 25 ≡ 52 ≡ y2 mod 23 + These points are graphed as below in Fig 3.6: 3 Wireless Security 53 Y 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 X Fig 3.6 Points of equation y2−x3+x over F23 − + Elliptic Curve over Fp Addition Elliptic curve groups are additive... for 64P 2P = ( P + P) 2 2 P = (2 P + 2 P) 2 3 P = (2 2 P + 2 2 P ) 6 elliptic curve double adding 2 4 P = (2 3 P + 2 3 P) 2 5 P = (2 4 P + 2 4 P) 2 6 P = (2 5 P + 2 5 P) P In fact, the value of 32P and 4Pare both obtained in the process, thus, two more elliptic curve addition (64P + 32P + 4P) are enough to complete the job The 62 W.-B Lee interested readers may refer to [3.19] for more advanced details... ≠ Q 3x + a ) mod p if P = Q 2 yP 2 P For example, if P = (15, 3) and Q = (21 , 6) in y2 = x3 + x over F23, to find R = P + Q, then Step 1) Calculate slope w = ( 6 − 3 ) mod 23 = ( 3 ) mod 23 = ( 1 ) mod 23 = 12 21 − 15 6 2 Step 2) Calculate R = P + Q’s coordinates (xR, yR), where (x xR = ( 122 – 15 – 21 ) mod 23 = 108 mod 23 = 16, and yR = ( 12( 15 – 16) – 3) mod 23 = 15 mod 23 = 8 Thus derive R = P + Q... computation d− 3 Wireless Security 61 However, with Scalar Multiplication Addition Chain method, d is firstly expressed in binary format d = 2n−1 + dn -2 2n−1 +…+ d1 2 + d0, where di ∈{0}or{1}, for i = 0, 1, 2, …,n 2 And, d ⋅ P = 2 n −1 i P+ 2 P 0≤i ≤ n − 2 , d i =1 Therefore, only n−1 elliptic curve double adding are needed with Addition Chain method 2P = (P + P) 2 2 P = (2P + 2P) 3 2 2 n − 1 elliptic... 42 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 D Shen and V.O.K Li N Ferguson, B Schneier, Practical Cryptography, Wiley, New York, 20 03 A Biryukov, A Shamir, D Wagner, “Realtime cryptanalysis of A5/1 on a PC,” Fast Software Encryption Workshop 20 00, New York City, USA, 10– 12 April 20 00 P Ekdahl, T Johansson, “Another attack on A5/1,” IEEE Trans Inform Theory, vol 49, no 1, pp 28 4 28 9,... adding 2 P = (2 P + 2 P) 2 n −1 P = (2 n 2 P +2 n 2 P) Consequently, the time complexity is reduced from O(d) to O(log d) Take 100·P for example, instead 99 rounds of addition operation as P 100 P = P + P + + P , 99 additions with Addition Chain method, we have 100 ⋅ P = (1100100) 2 ⋅ P = (2 6 + 2 5 + 2 2 ) P = 64P + 32P + 4 P ) In the following, only 6 elliptic curve double adding are need for 64P 2P... over the field F 23 With 2 a = 1 and b = 0, the elliptic curve equation is y2 (mod 23 )= x3+ x (mod 23 ) The 23 points which satisfy this equation are: (0,0) (1,5) (1,18) (9,5) (9,18) (11,10) (11,13) (13,5) (13, 18) (15, 3) (15, 20 ) (16, 8) (16, 15) (17, 10) (17, 13) (18, 10) (18, 13) (19, 1) (19, 22 ) (20 , 4) (20 , 19) (21 , 6) (21 , 17), we can easily verify these points to be correct, for example, the... = P + Q = (16, 8) In the following, we will demonstrate what if R = P + P 2 Step 1) Compute w = ( 3 ⋅ (15) + 1) mod 23 = ( 9 ) mod 23 = ( 3 ) mod 23 = 13 2 3 6 2 Step 2) Find R’s coordinates ( x R , y R ) , where xR = (1 32 – 15 – 15) mod 23 = 139 mod 23 = 1, and d d yR = (13(15 – 1) – 3) mod 23 = 179 mod 23 = 18 So deduce R = 2P = (1, 18) P Compared to Fig 3.6, we can discover the resulting points (16,... multimedia vision for IMT -20 00: a focus on standardization,” IEEE Commun Mag., pp 129 –136, September 20 00 H Holma, A Toskala, WCDMA for UMTS: Radio Access for Third Generation Mobile Communications, 2nd Edition, Wiley, New York, 20 02 K Boman, G Horn, P Howard, V Niemi, “UMTS security,” Electron Commun J., pp 191 20 4, October 20 02 G Koien, “An introduction to access security in UMTS,” IEEE Wireless Commun.,... wireless networks: overview of transition to third generation,” IEEE Commun Mag., pp 164–1 72, September 20 00 J.-H Park, Wireless Internet access for mobile subscribers based on the GPRS/UMTS network,” IEEE Commun Mag., pp 38–49, April 20 02 R Parry, “cdma2000 1xEV-DO: a 3G wireless Internet access system,” IEEE Potential, pp 10–13, October/November 20 02 A Soong, S.-J Oh, A Damnjanovic, Y.C Yoon, “Forward . o f 0 . 22 • Frame len g th: 10 ms • Power control rate: 1,500 Hz • Power control ste p size: 0.5, 1, 1.5, 2 dB • P h ys i ca l l ayer sprea di ng factor: 4 -25 6 for up li n k , 4-5 12 for d own li n k . commerce. cdma2000 1xEV-DO Th e tec h n i ca l spec i f i cat i on for 1xEV-DO i s I S-856, re l ease d by 3GPP2. T h e c hi p rate i s st ill 1 .22 88 Mcps w i t h a b an d w id t h of 1 .25 MHz are offered for PTP and PMP communication. T he data rates for UMTS are: • 144 kb ps for rura l out d oor an d sate lli te • 3 84 kb ps for ur b an out d oor • 2 .048 Mbps for indoor or