Section: 4.7.7.3 Authentication and ciphering completion by the network
Content: Upon receipt of the AUTHENTICATION AND CIPHERING RESPONSE message, the network stops the timer T3360 and checks the validity of the response (see 3GPP TS 43.020[ Security related network functions ]  [13] and 3GPP TS 33.102[ 3G security; Security architecture ]  [5a]). For this, it may use the A&C reference number information element within the AUTHENTICATION AND CIPHERING RESPONSE message to determine whether the response is correlating to the last request that was sent. In A/Gb mode, in a UMTS authentication challenge if the MS has indicated support of integrity protection to the network and if the AUTHENTICATION AND CIPHERING REQUEST message authentication, then the network shall check and verify the message authentication code received in the AUTHENTICATION AND CIPHERING RESPONSE message from the MS by using the new integrity key GPRS GSM Kint derived from the new UMTS security context as described in subclause 4.7.7.3b and annex H in 3GPP TS 43.020[ Security related network functions ]  [13]. When a successful authentication takes place after a successful verification of the RES and the message authentication code received in the AUTHENTICATION AND CIPHERING RESPONSE message from the MS, the GMM layer in the network shall indicate this successful authentication to the LLC layer. If the check and verification of the message authentication code included in the AUTHENTICATION AND CIPHERING RESPONSE message fails in the network, then the network shall ignore the GMM message. If the AUTHENTICATION AND CIPHERING RESPONSE message is received in the network without a message authentication code then the network shall silently discard the GMM message. In A/Gb mode, in the case of an established GSM security context, the GMM layer shall notify the LLC sublayer if ciphering shall be used or not. Furthermore, if ciphering shall be used, then the GMM layer shall also notify the LLC sublayer which GEA algorithm and GPRS GSM ciphering key that shall be used (see 3GPP TS 44.064[ Mobile Station - Serving GPRS Support Node (MS-SGSN); Logical Link Control (LLC) Layer Specification ]  [78a]). In A/Gb mode, in the case of an established UMTS security context, the GMM layer shall notify the LLC sublayer if ciphering shall be used or not. Furthermore, if ciphering shall be used, then the GMM layer shall also notify the LLC sublayer which GEA algorithm and which ciphering key (i.e. GPRS GSM ciphering key or GPRS GSM Kc128) that shall be used (see 3GPP TS 44.064[ Mobile Station - Serving GPRS Support Node (MS-SGSN); Logical Link Control (LLC) Layer Specification ]  [78a]). If the network has selected a GEA ciphering algorithm that requires a 128-bit ciphering key, then the ME shall derive a GPRS GSM Kc128 as described in the subclause 4.7.7.3a. In A/Gb mode, if an established UMTS security context context is available in the network, if the MS has indicated support of integrity protection to the network, the GMM layer in the network shall assign the GPRS GSM integrity algorithm and the GPRS GSM Kint integrity key to the LLC layer, after it has received the AUTHENTICATION AND CIPHERING RESPONSE message from the MS (see 3GPP TS 43.020[ Security related network functions ]  [13] and 3GPP TS 44.064[ Mobile Station - Serving GPRS Support Node (MS-SGSN); Logical Link Control (LLC) Layer Specification ] [78a]). Upon receipt of the AUTHENTICATION AND CIPHERING FAILURE message, the network stops the timer T3360. In Synch failure case, the core network may renegotiate with the HLR/AuC and provide the MS with new authentication parameters.