72
4.5.5.1
ETSI EN 300 392-7 V2.3.1 (2006-06)
Change of DCK
DCK shall be changed explicitly using the authentication protocols described in clause 4.4.2. The DCK in use shall change at the following times: •
on successful authentication;
•
if a DCK has been previously established and is in use it shall be retained throughout the authentication protocol and only discarded after confirmation of the success of the authentication.
The new DCK shall be considered valid after the last repeat of the PDU containing the result R1 or R2 (as authentication PDUs are transmitted using layer 2 acknowledgement the receipt of the acknowledgement of the RESULT PDU shall be the trigger to invoke the new DCK). The MS and SwMI shall be synchronized at this time.
4.5.5.2
Change of CCK
The SwMI may administer the change of CCK using the D-CK-CHANGE-DEMAND PDU. Each cell in an LA shall update the CCK in use as indicated in the D-CK-CHANGE-DEMAND PDU. NOTE 1: It is at the discretion of the SwMI how much warning of CCK change is given. The SwMI MM shall notify all MSs in the cell of the new CCK-id in the SYSINFO broadcast and in the header of the MAC-RESOURCE PDU described in clause 6.5.1. NOTE 2: When the SwMI changes the CCK for downlink, it will still receive two slots where ESIs are encrypted with the old CCK on the uplink. For the duration of these two slots the SwMI shall use old CCK for decrypting ESI addresses in the uplink and new CCK for encrypting in the downlink. For change of CCK the D-CK-CHANGE-DEMAND may be addressed to group and broadcast addresses.
4.5.5.3
Change of GCK
The SwMI may administer the change of GCK using the D-CK CHANGE DEMAND PDU. Where the procedure is used the D-CK CHANGE DEMAND PDU may be addressed to group and broadcast addresses. The SwMI may choose to link the crypto-periods of all GCKs on the network, in this case all GCKs have the same GCK-VN and only one GCK-VN need be conveyed to the MS. If the SwMI supports the latter mechanism, a short GCK-VN (representing the 2 least significant bits of the GCK-VN) shall be conveyed in the Security Information Element of SYSINFO, with the full GCK-VN provided using D-CK CHANGE DEMAND with Key Change Type of "All GCKs".
4.5.5.4
Change of SCK for TMO
If over the air cipher key selection is provided the SwMI may administer the change of SCK using the D-CK CHANGE DEMAND PDU. This shall be performed across the entire network. The SwMI MM shall notify all MSs in the cell of the new SCKN/SCK-VN in the SYSINFO broadcast, and SCK-VN in the header of the MAC-RESOURCE PDU described in clause 6.5.1. NOTE:
When the SwMI changes the SCK for downlink, it will still receive two slots encrypted with the old SCK. For the duration of these two slots the SwMI shall use old SCK for decrypting ESI addresses and message contents in the uplink and new SCK for encrypting in the downlink.
For change of SCK the D-CK CHANGE DEMAND may be addressed to group and broadcast addresses.
ETSI