Definition
Air interface encryption (Air Interface Encryption) encrypts and integrity protects user plane data and control plane signaling transmitted between the base station and the terminal, preventing eavesdropping and tampering. It is the core mechanism of the security architecture at the access layer. LTE/5G use the 128-EEA (encryption) and 128-EIA (integrity) algorithms, with keys derived from KASME/KAMF through the key management process, enabling configurable algorithms (NEA0/1/2, NIA0/1/2) and algorithm negotiation.
Encryption and integrity algorithms
- 128-EEA1 (SNOW 3G): Stream cipher, 3GPP legacy algorithm
- 128-EEA2 (AES-CTR): AES block cipher in CTR mode, widely deployed
- 128-EEA3 (ZUC): National stream cipher, compliant with domestic regulations
- 128-EIA: Corresponding integrity algorithm (EIA1/2/3), uses HMAC or similar MAC
Key hierarchy and derivation
Air interface encryption keys (KRRCenc, KUPenc, KRRCint, etc.) are derived step by step from KgNB generated during the authentication process to achieve key isolation. Keys are refreshed during handover and periodic updates to ensure forward security. NEA0/NIA0 denote null encryption/null integrity, used only for testing or special scenarios.
Typical Use Cases
All LTE/5G user plane and control plane data require air interface encryption and integrity protection. SimtoLink's IoT SIM cards automatically enjoy air interface encryption in the operator network, and data transmitted between the device and the base station is encrypted to prevent wireless eavesdropping.
SimtoLink's IoT SIM cards automatically enjoy air interface encryption protection on the carrier network. User plane data is encrypted during transmission between the base station and the terminal to prevent eavesdropping. The SimtoLink cloud platform can work with key management to provide end-to-end encryption solutions for high-security scenarios, ensuring the security of IoT data.
Where algorithm negotiation stops in the security mode command
Air-interface encryption is not a single algorithm written in at power-on. After attach and mutual authentication, the network names the ciphering algorithm and the integrity algorithm in the security mode command, and the device answers according to its capabilities. If negotiation fails, the device often sits at “camped, not yet in the ciphered state”: broadcast and paging still arrive, but a dedicated bearer will not come up. First check whether the capability report includes the algorithm the network asked for, then whether the card supports the matching key derivation. Treating this step as a weak signal and moving the antenna misses a signaling rejection of the algorithm.
The control plane and the user plane can use different algorithms. Control-plane ciphering protects radio resource control messages. User-plane ciphering protects service packets after packet-data convergence. If only one side is on, an air-interface capture can still read the other side. If a test configuration leaves a null-cipher flag behind, a commercial card that attaches to a trial cell leaves user-plane cleartext on the radio link. The problem is not an application password.
How the counter and the bearer ID feed ciphering
One traffic key serves many packets. What makes each ciphertext different is the counter, the bearer ID, and the direction bit. The counter increases with each transmission. The receiver uses it to stay aligned with the keystream or with counter mode. If uplink and downlink counters are independent but the module reuses them as one variable, the peer decrypts garbage, and retransmission cannot repair it, because the keystream is already out of step. After a handover or a re-establishment the counters usually have to be realigned. The old count must not be carried into the new cell.
The bearer ID keeps several bearers on the same device apart. Even if the signaling bearer and the data bearer are derived from the same base-station key, different inputs mean the ciphertext will not collide. If only the data bearer is replaced and the signaling bearer still uses the old parameters, the device can attach and every service packet is a bad frame. The test is: integrity still passes, decryption fails. Check the counter and the bearer ID before replacing the card.
How far the listening surface spreads once the null algorithm is on
Null ciphering and null integrity belong only in a lab or on an access network that states the exception. Once they are on, a neighbor with an ordinary receiver can see the signaling flow and the user-plane payload. If the application has no protection of its own, passwords and measurements appear in cleartext on the air. The null algorithm does not replace transport-layer or application-layer encryption. It only turns access-stratum protection off. On a normal commercial network a device should not ask for the null algorithm. If the network allows it for old devices, the scope should stay inside an isolated test cell.
When a SimtoLink IoT SIM card uses an operator radio network, the air-interface algorithms are negotiated by the network and the module. The card does not store air-interface traffic keys. It only supplies the material derived after authentication. If the card can register and the capture is still cleartext, check whether the cell is a test configuration and whether the module is locked to the null algorithm. If the application must also keep the path beyond the core network from being read, add end-to-end encryption outside the access-stratum protection the card provides. Those two key layers must not be mixed.
Cleartext captured in different places indicates different faults
Air-interface encryption ends at the base station, not at the application server. Cleartext on the radio side means negotiation landed on the null algorithm, or ciphering never started. Cleartext captured after the core network means access-stratum protection has already ended, and the rest of the path is not the air-interface algorithm’s job. The two captures do not support the same conclusion. Mark whether the probe sits between the device and the base station, or between the gateway and the server. The first case needs the algorithm identifier and whether security mode completed. The second needs to know whether the application or the transport layer has its own protection, which has nothing to do with the key in the card.
On the same device the signaling bearer and the data bearer may have one ciphered and the other not. Cleartext only on the data bearer does not mean the whole security mode failed. Check whether the user-plane algorithm entry was left empty. If a test cell allows the null algorithm, a commercial card that camps there stays in cleartext until it reselects to a normal cell and negotiates again. A SimtoLink card does not show the current air-interface algorithm on the platform. Whether the algorithm is in effect is the module security-mode result. The platform can prove that the card finished authentication. It cannot prove that nobody on the air interface negotiated the algorithm down to null.