Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CHAPTER III: INFORMATION AND COMMUNICATION TECHNOLOGY
The Security and Fraud Prevention Group (SFPG) of the TETRA MoU Association
is tasked with updating the TETRA authentication algorithms (TAA) and TETRA
encryption algorithms (TEA) defined for TETRA standards. 75 TETRA networks
usually implement air interface encryption (AIE) between MS and SwMI (see
Figure 19). The AIE keys may be derived dynamically for every authentication
procedure, sent to individual MSs or CUGs using Over The Air Re-keying
(OTAR), or preloaded (static) in the terminal or subscriber identity module (SIM).
Furthermore, end-to-end encryption (E2EE) may be used to provide encryption
within the SwMI for more robust security (see Figure 19), for instance, over thirdparty
leased copper lines used on a BS-to-MSC link. The key management for
E2EE is provided by Over The Air Keying (OTAK) mechanisms.
Figure III—19 Implementation regions for air interface and end-to-end encryption schemes.
The TETRA standard defines three security classes depending on the usage of
authentication, encryption and OTAR key management (see Table 9). An MS may
support one, two or all security classes. Mission-critical PSS TETRA networks
such as VIRVE would normally employ the most robust (Class 3) security level.
Table III—9 Security classes defined by the TETRA standards.
Security
Class
Authentication Encryption OTAR
Class 1 Optional E2EE (optional); AIE (none) None
Class 2
Optional
E2EE (optional); AIE using static key
encryption (mandatory)
Optional
Class 3
Mandatory
E2EE (optional); AIE using dynamic key
encryption (mandatory)
Mandatory
The MS provides users with access to the TETRA network. Therefore, the
possibility of threat actors obtaining unauthorized access via stolen or lost
75 Some of the TEAs used by European agencies face strict export control for usage in countries
outside the Wassenaar Arrangement (2007).
NORDREGIO REPORT 2007:5 115