Section: 6.3.5 Re-synchronisation procedure
Content: A VLR/SGSN may send two types of authentication data requests to the HE/AuC, the (regular) one described in subsection 6.3.2 and one used in case of synchronisation failures, described in this subsection. Upon receiving a synchronisation failure message from the user, the VLR/SGSN sends an authentication data request with a "synchronisation failure indication" to the HE/AuC, together with the parameters: - sent to the MS in the preceding user authentication request, and - AUTS received by the VLR/SGSN in the response to that request, as described in subsection 6.3.3. An VLR/SGSN will not react to unsolicited "synchronisation failure indication" messages from the MS. The VLR/SGSN does not send new user authentication requests to the user before having received the response to its authentication data request from the HE/AuC (or before it is timed out). When the HE/AuC receives an authentication data request with a "synchronisation failure indication" it acts as follows: 1. The HE/AuC retrieves SQNMS from Conc(SQNMS) by computing Conc(SQNMS) Å f5*K(RAND). 2. The HE/AuC checks if SQNHE is in the correct range, i.e. if the next sequence number generated SQNHE using would be accepted by the USIM. 3. If SQNHE is in the correct range then the HE/AuC continues with step (6), otherwise it continues with step (4). 4. The HE/AuC verifies AUTS (cf. subsection 6.3.3). 5. If the verification is successful the HE/AuC resets the value of the counter SQNHE to SQNMS. 6. The HE/AuC sends an authentication data response with a new batch of authentication vectors to the VLR/SGSN. If the counter SQNHE was not reset then these authentication vectors can be taken from storage, otherwise they are newly generated after resetting SQNHE. In order to reduce the real-time computation burden on the HE/AuC, the HE/AuC may also send only a single authentication vector in the latter case. Whenever the VLR/SGSN receives a new batch of authentication vectors from the HE/AuC in an authentication data response to an authentication data request with synchronisation failure indication it deletes the old ones for that user in the VLR/SGSN. The user may now be authenticated based on a new authentication vector from the HE/AuC. Figure 12 shows how re-synchronisation is achieved by combining a user authentication request answered by a synchronisation failure message (as described in section 6.3.3) with an authentication data request with synchronisation failure indication answered by an authentication data response (as described in this section). Figure 12: Resynchronisation mechanism