Authentication center in GSM

Question

We know that the AuC (Authentication Center) is used to identify GSM subscribers in the case of roaming or when the subscriber is requesting access to mobile network for the first time. But, I'm wondering what if the mobile is switched off then on, is the authentication needed or not? what also about if the mobile is out coverage and restored it? I don't really know what are conditions where the subscriber should pass by AuC?

Answer 1

When the mobile is turned on, if the LAI in the BCCH broadcast is the same as the one stored on the SIM card at IMSI detach (i.e. the location area has changed), then it sends an IMSI attach rather than a location update. If it is not the same, then it sends a location update type IMSI attach, and this performs a combined procedure.

On receiving a location update request or a CM service request (which sets up a session with the MSC such that the mobile can then initiate a call setup) or a CM service request that additionally contain a paging response from the mobile to an incoming call, etc., the MSC uses the VLR to determine whether to perform authentication according to the data configuration. I am not sure what this configuration might be actually. I would assume that authentication happens every single time a call or a location update occurs, or perhaps just a location update. The location update will perform the authentication procedure if it is required. It's either going to be required on just location updates, or both location updates and calls. I haven't read anything on this actually -- what the range of options are and what the typical configuration is, and I can't think of the logical justifications right now. This says that authentication is only performed if the TMSI that the mobile sends in the location update request or CM service request is not in the VLR, in this case authentication occurs and a new TMSI is assigned. I do not know when the TMSI expires, but certainly this will happen the first time you visit this MSC, and a new one is always reassigned upon a location update. The mobile uses the TMSI it has been most recently assigned, which identifies an active association between a SIM IMSI and a MSC that it is currently visiting.

If authentication is required, the VLR checks whether authentication triplets are available. If authentication triplets are available, the MSC sends an Authentication request message carrying the first authentication triplet.

If no authentication triplets are available, the VLR obtains authentication triplets from the HLR over MAP/D and stores them: The VLR identifies the HLR serving the subscriber based on the IMSI of the mobile carried in the received location update request, and then sends a MAP_SEND_AUTHENTICATION_INFO_REQ message to the HLR. The message carries the IMSI of the subscriber and the number of required authentication triplets (5 by default and can be configured as required). The HLR requests the AUC (usually integrated with the HLR) for an authentication triplet. The AUC generates a RAND (random challenge number), an SRES = A3(Ki, RAND) and a Kc = A8(Ki, RAND) and returns them to the HLR. The HLR then sends a MAP_SEND_AUTHENTICATION_INFO_RSP message carrying the authentication triplet to the VLR. If a TMSI+LAI is sent in the location update request then the VLR uses the LAI to identify the PVLR (old VLR) and sends the TMSI to it in a MAP_SEND_IDENTIFICATION_REQUEST and it applies with the stored authentication triplet in the response. The VLR returns the RAND to the MSC and now the MSC can send an Authentication request message carrying the RAND from the first authentication set (SRES, RAND, Kc) to the MS and the remaining authentication triplets are kept by and stored in the VLR.

On receiving the authentication request, the MS sends the RAND to the SIM. The SIM uses the A3 authentication algorithm to generate an SRES by using the RAND and the Ki stored in the SIM (the same as the one at the AUC) and uses the A8 authentication algorithm to generate a Kc, i.e. SRES = A3(Ki, RAND) and a Kc = A8(Ki, RAND). Then, the SIM sends the SRES and Kc to the MS. The MS sends an MM Authentication Response message carrying the SRES to the MSC which it then forwards to the VLR. The VLR compares the SRES reported by the MS and the SRES provided earlier by the AUC. If the SRESs are the same, authentication is complete and the VLR proceeds with location updating if this is a location update (update location to HLR, HLR cancels location in old VLR indicated in HLR, inserts subscriber info into new requesting VLR), generates a new TMSI and returns the Kc to the MSC in a set ciphering mode command (which will be the same Kc the mobile now has) and the MSC sends a BSSMAP CIPHER MODE COMMAND message to start the encryption flow. If the SRESs are not the same, the VLR denies the authentication and the MSC sends an Authentication reject message to the MS. On receiving the message, the MS stops accessing the network and adds the network to the list of unauthorized networks.

The BSS sends the RR CIPHERING MODE COMMAND to the mobile in the clear. The MS responds with RR CIPHERING MODE COMPLETE. This message is transmitted with ciphering, using Kc and A5 -- encryption comes after the GSM 5.03 encoding stage, and the payload is inserted into the logical channel provided by GSM 5.02. All messages from now on are ciphered. The BSS receives it and sends a BSSMAP CIPHER MODE COMPLETE to the MSC.

The MSC sends Location updating accept to the MS with the new TMSI and the MS responds with TMSI reallocation complete. The MSC sends TMSI reallocation ACK to the VLR.