Section: 6.3.2 Distribution of authentication data from HE to SN
Content: The purpose of this procedure is to provide the VLR/SGSN with an array of fresh authentication vectors from the user's HE to perform a number of user authentications. Figure 6: Distribution of authentication data from HE to VLR/SGSN The VLR/SGSN invokes the procedures by requesting authentication vectors to the HE/AuC. The authentication data request shall include the IMSI and the requesting node type (PS or CS). Upon the receipt of the authentication data request from the VLR/SGSN, the HE may have pre-computed the required number of authentication vectors and retrieve them from the HLR database or may compute them on demand. The HE/AuC sends an authentication response back to the VLR/SGSN that contains an ordered array of n authentication vectors AV(1..n). The authentication vectors are ordered based on sequence number. Figure 7 shows the generation of an authentication vector AV by the HE/AuC. Figure 7: Generation of authentication vectors The HE/AuC starts with generating a fresh sequence number SQN and an unpredictable challenge . For each user the HE/AuC keeps track of a counter: SQNHE The HE has some flexibility in the management of sequence numbers, but some requirements need to be fulfilled by the mechanism used: a) The generation mechanism shall allow a re-synchronisation procedure in the HE described in section 6.3.5. b) In case the SQN exposes the identity and location of the user, the AK may be used as an anonymity key to conceal it. c) The generation mechanism shall allow protection against wrap around of the counter SQN in the USIM. A method how to achieve this is given in informative Annex C.2. NOTE: A wrap around of the counter SQN could lead to a repeated use of a key pair (CK, IK). This repeated key use could potentially be exploited by an attacker to compromise encryption or forge message authentication codes applied to data sent over the 3GPP-defined air interfaces. The mechanisms for verifying the freshness of sequence numbers in the USIM shall to some extent allow the out-of-order use of sequence numbers. This is to ensure that the authentication failure rate due to synchronisation failures is sufficiently low. This requires the capability of the USIM to store information on past successful authentication events (e.g. sequence numbers or relevant parts thereof). The mechanism shall ensure that a sequence number can still be accepted if it is among the last x = 32 sequence numbers generated. This shall not preclude that a sequence number is rejected for other reasons such as a limit on the age for time-based sequence numbers. The same minimum number x needs to be used across the systems to guarantee that the synchronisation failure rate is sufficiently low under various usage scenarios, in particular simultaneous registration in the CS- and the PS-service domains, user movement between VLRs/SGSNs which do not exchange authentication information, super-charged networks. The use of SQNHE is specific to the method of generation sequence numbers. A method is specified in Annex C.1 how to generate a fresh sequence number. A method is specified in Annex C.2 how to verify the freshness of a sequence number. An authentication and key management field AMF is included in the authentication token of each authentication vector. Annex H defines the usage of the AMF. Example uses of the proprietary part of the AMF are included in Annex F. Subsequently the following values are computed: - a message authentication code MAC = f1K(SQN || || AMF) where f1 is a message authentication function; - an expected response XRES = f2K () where f2 is a (possibly truncated) message authentication function; - a cipher key CK = f3K () where f3 is a key generating function; - an integrity key IK = f4K () where f4 is a key generating function; - an anonymity key AK = f5K () where f5 is a key generating function or f5 0. Finally the authentication token AUTN = || AMF || MAC is constructed. Here, AK is an anonymity key used to conceal the sequence number as the latter may expose the identity and location of the user. The concealment of the sequence number is to protect against passive attacks only. If no concealment is needed then f5 0 (AK = 0).