Section: 6.8.3 Distribution and use of authentication data between VLRs/SGSNs
Content: The distribution of authentication data (unused authentication vectors and/or current security context data) between R99+ VLRs/SGSNs of the same service network domain is performed according to chapter 6.3.4. The following four cases are distinguished related to the distribution of authentication data between VLRs/SGSNs (of the same or different releases). Conditions for the distribution of such data and for its use when received at VLRn/SGSNn are indicated for each case: a) R99+ VLR/SGSN to R99+ VLR/SGSN UMTS and GSM authentication vectors can be distributed between R99+ VLRs/SGSNs. Note that originally all authentication vectors (quintets for UMTS subscribers and triplets for GSM subscribers) are provided by the HLR/AuC. Current security context data can be distributed between R99+ VLRs/SGSNs. VLRn/SGSNn shall not use current security context data received from VLRo/SGSNo to authenticate the subscriber using local authentication in the following cases: i) Security context to be established at VLRn/SGSNn requires a different set of keys than the one currently in use at VLRo/SGSNo. This change of security context is caused by a change of ME release (R’99 ME R’98 ME) when the user registers at VLRn/SGSNn. ii) Authentication data from VLRo includes 64-bit Kc+CKSN but no unused AVs and the subscriber has a R’99 ME (under GSM BSS or UTRAN). In this situation, VLRn have no indication of whether the subscriber is GSM or UMTS and it is not able to decide whether the 64-bit Kc received can be used (in case the subscriber were a GSM subscriber). In these two cases, received current security context data shall be discarded and a new AKA procedure shall be performed. b) R98- VLR/SGSN to R98- VLR/SGSN Only triplets can be distributed between R98- VLRs/SGSNs. Note that originally for GSM subscribers, triplets are generated by HLR/AuC and for UMTS subscribers, they are derived from UMTS authentication vectors by R99+ HLR/AuC. UMTS AKA is not supported and only GSM security context can be established by a R98- VLR/SGSN. R98- VLRs are not prepared to distribute current security context data. Since only GSM security context can be established under R98- SGSNs, security context data can be distributed and used between R98- SGSNs. c) R99+ VLR/SGSN to R98- VLR/SGSN R99+ VLR/SGSN can distribute to a new R98- VLR/SGSN triplets originally provided by HLR/AuC for GSM subscribers or can derive triplets from stored quintets originally provided by R99+ HLR/AuC for UMTS subscribers. Note that R98- VLR/SGSN can only establish GSM security context. R99+ VLRs shall not distribute current security context data to R98- VLRs. Since R98- SGSNs are only prepared to handle GSM security context data, R99+ SGSNs shall only distribute GSM security context data (64-bit Kc, CKSN) to R98- SGSNs. d) R98- VLR/SGSN to R99+ VLR/SGSN. In order to not establish a GSM security context for a UMTS subscriber, triplets provided by a R98- VLR/SGSN can only be used by a R99+ VLR/SGSN to establish a GSM security context under GSM-BSS with a R98- ME. In all other cases, R99+ VLR/SGSN shall request fresh AVs (either triplets or quintets) to HE. In the event, the R99+ VLR/SGSN receives quintets, it shall discard the triplets provided by the R98- VLR/SGSN. R98- VLRs are not prepared to distribute current security context data. R98- SGSNs can distribute GSM security context data only. The use of this information at R99+ SGSNn shall be performed according to the conditions stated in a).