Section: 6.3.4 Distribution of IMSI and temporary authentication data within one serving network domain
Content: The purpose of this procedure is to provide a newly visited VLR/SGSN with temporary authentication data from a previously visited VLR/SGSN within the same serving network domain. The procedure is shown in Figure 11. Figure 11: Distribution of IMSI and temporary authentication data within one serving network domain The procedure shall be invoked by the newly visited VLRn/SGSNn after the receipt of a location update request (resp. routing area update request) from the user wherein the user is identified by means of a temporary user identity TMSIo (resp. P-TMSIo) and the location area identity LAIo (resp. routing area identity RAIo) under the jurisdiction of a previously visited VLRo/SGSNo that belongs to the same serving network domain as the newly visited VLRn/SGSNn. The protocol steps are as follows: a) The VLRn/SGSNn sends a user identity request to the VLRo/SGSNo, this message contains TMSIo and LAIo (resp. P-TMSIo and RAIo). b) The VLRo/SGSNo searches the user data in the database. If the user is found, the VLRo/SGSNo shall send a user identity response back that: i) shall include the IMSI, ii) may include a number of unused authentication vectors (quintets or triplets) ordered on a first-in / first-out basis, and iii) may include the current security context data: CK, IK and KSI (UMTS) or Kc and CKSN (GSM). The SGSNn shall derive Kc128 from the current security context data according to annex B.5 if it received a CK/IK pair and KSI from the SGSNo and if the SGSNn is to use a 128-bit GSM ciphering algorithm in GSM. The VLRn shall derive Kc128 from the current security context data according to annex B.5 if it received a CK/IK pair and KSI from the VLRo and if the VLRn is to signal a 128-bit GSM ciphering algorithm as a permitted ciphering algorithm to the BSS in GSM. The VLRo/SGSNo subsequently deletes the authentication vectors which have been sent and the data elements on the current security context. If the user cannot be identified the VLRo/SGSNo shall send a user identity response indicating that the user identity cannot be retrieved. c) If the VLRn/SGSNn receives a user identity response with an IMSI, it creates an entry and stores any authentication vectors and any data on the current security context that may be included. If the VLRn/SGSNn receives a user identity response indicating that the user could not be identified, it shall initiate the user identification procedure described in 6.2.