[UMTS - 3G] UTRAN Authentication Procedure


This is a mutual authentication mechanism, in which UE/SIM is authenticated by Network and Network is authenticated by UE/SIM. In this procedure message follow is more or less same as GSM Procedure, But key generation is complex, multiple key are generated, Integrity protection is also taken care and a sequence number is also maintained. As in every authentication procedure (telecom) it also have three major entities.

1) User Entity (SIM, User Equipment)
2) Controlling Entity (SGSN)
3) Authentication Entity(HSS/HLR,AuC)

Following table contains the attribute used in KEY generation, Table gives the usage of each attribute,size and place where they are used/stored.

Field Name
Description
Size
Used/Stored at
IMSI
To uniquely identify a SIM
Up to 15
digits
Both UE , HSS
Secret Key (K)
Sometimes called as shared key because it is stored in both User Entity and Authentication Entity.
128 Bits
Both UE , HSS
Algorithm F1
Used to generate MAC
64 Bits
HSS
Algorithm F1*
Used to generate MAC-S
64 Bits
UE
Algorithm F2
Used to generate XRES/RES i.e. Expected Response.
64 Bits
HSS,UE
Algorithm F3
Used to generate CK; Cipher Key
128 Bits
HSS,UE
Algorithm F4
Used to generate IK; Integrity Key
128 Bits
HSS,UE
Algorithm F5
Used to generate AK; Anonymity Key; used to hide/reveal sequence Number
48 Bits
HSS
Algorithm F5*
Used to generate AK; Anonymity Key; used to hide/reveal sequence Number
48 Bits
UE
Sequence Numbers
32 different Sequence Numbers - for synchronization i.e. no breach of security over the air
48 Bits
HSS,UE
Delta Value
Delta Value- a allowed range of sequence number difference at HSS and UE.

UE
AMF
Authentication Management Field. Usage is operator dependent.
Bit 0 is “AMF Separation Bit” and is used to in EPS
Bits 1 to 7 are reserved for future standardization use.
Bits 8 to 15 are open for proprietary use
16 Bits
HSS
AUTN
AUTN := SQN Å AK || AMF || MAC

128 Bits
HSS
AUTS
AUTS = SQNMS Å AK || MAC-S

112 Bits
UE


Here we are directly moving how does it works.

Step -1 User sends a attach request toward SGSN, and SGSN send authentication request toward HSS/HLR.

Step -2 After receiving authentication request HSS/HLR shall generate Authentication Vectors (AV) consisting of RAND,XRES, AUTN ,CK ,IK.

Step-3  Following steps explains how AV are generated.



a) First of all HSS generates RAND a random number.

b) Now randomly pick any sequence number out of 32. At very first all sequence number is set to zero and shall be increase by one as a considered sequence number is used. Sequence Number is of following format.Give a minute to following image which is self-explanatory (8-Motions)




c) Say sequence number with index IND 3 (three) is picked then value of  SEQ shall be incremented by one and updated information is stored in HSS. if suppose once again sequence number with IND 3 (three) is selected then again one is incremented as shown below.

d) Now generate XRES, ATUN, CK , IK. Give few seconds to following image it has 9 motions.
Authentication Vector generation at HSS


Step -4 HSS sends generated Vector and to Controlling Entity (SGSN).
Step -5 SGSN keeps XRES, CK, IK with it and sends AUTN and RAND to UE.
Step -6 Now on receive of RAND and AUTN UE shall extract MAC, SQN, and AMF.
Step -7 UE compares SQN [SEQ+IND] received with SQN [SEQ+IND] at its end in following way. if received SEQ in valid delta range then moves to step -8. Generally value of delta is one; otherwise shall trigger re-synchronization request to SGSN(explained later). Give few seconds to following image,it contains 8 motions.
Sequence Number processing at HSS and UE end


Step -8 UE shall generate XMAC, RES, CK, IK. in following way. Give a minute to following IMAGE which is self-explanatory, it contains 5 motions.
Authentication Vector Processing at UE


Step -9 Now RES is sent to Controlling Entity (SGSN).
Step -10 Controlling Entity shall compare RES with XRES store at its own end.
[RES=XRES]
Step -11 If both are not equal then Controlling entity shall send attach rejected to UE.
Step -12 If both are equal , implies user is Authenticated, shall invoke next message of Attach Procedure.

Usage of OP/OPc and Transport Key

Your Comments /Suggestions and Questions are always welcome.we would try to clarify your doubts with best of our knowledge. So feel free to put Query.

4 comments: