EPS authentication, please explain?

Question

I am looking at the EPS authentication, can someone please explain in detail?

Answer 1

Not sure what you are looking exactly, but following Procedure should help.

1. The purpose of the EPS authentication and key agreement (AKA) procedure is to provide mutual authentication between the user and the network and to agree on a key KASME
2. The EPS AKA procedure is always initiated and controlled by the network. However, the UE can reject the EPS authentication challenge sent by the network. The UE shall proceed with an EPS authentication challenge only if an USIM is present
3. When a NAS signalling connection exists, the network can initiate an authentication procedure at any time. The network initiates the authentication procedure by sending an AUTHENTICATION REQUEST message to the UE
4. The MME sends unciphered AUTHENTICATION REQUEST message to the UE which includes a random number RAND and an authentication parameter AUTN (these values are retrieved from HSS via Auth Info exchange). Now the UE’s job is to compute the authentication response parameter RES and send it back to the MME in AUTHENTICATION RESPONSE message
5. The value of RES is computed by the USIM using RAND, AUTN and the secret key ‘K’ which is stored in the USIM.
6. The IE Authentication parameter RAND (EPS challenge) will carry the RAND of length 128-bits. It provides the MS with a non-predictable number to be used to calculate the authentication response parameter RES

7. The IE Authentication parameter AUTN (EPS challenge) will carry the AUTN of length 128-bits. It provides the MS with a means of authenticating the network. The AUTN consists of (SQN xor AK)||AMF||MAC = 48 + 16 + 64 = 128-bits. In the AUTHENTICATION REQUEST example below, AUTN value = 6e323b36c46c5555a3df0e6e323b6391 which means that,

   SQN xor AK = 6e323b36c46c
               AMF: 5555 
               MAC: a3df0e6e323b6391
   

For more detail please look at TS33.401 and TS33.102. Following IEE paper should also help http://www.ijiee.org/papers/57-C099.pdf

Ref:
http://my.safaribooksonline.com/book/electrical-engineering/communications-engineering/9781119991915/7-eps-authentication-and-key-agreement/horn1031c07_sec1_0002_htm
http://howltestuffworks.blogspot.in/2011/11/authentication-request.html

Comments

Thank you very much for such a brief and excellent explanation, Salil.

Answer 2

EPS Authentication is a mutual authentication process, In which MME sends "Aunthentication Request" message to UE and UE responds back to MME using "Authentication Response".

1. MME sends RAND and AUTN within the Authentication Request message. RAND is nothing but a random number generated at the MME and AUTN is a combination of some other few parameters.
   AUTN = SQN (48 bits) XOR AK || AMF (16 bits) || MAC (128 bits). To generate AUTN, subscriber key (K) is being used.

2. Once UE receives Authentication request message from MME. Based on RAND and AUTN, it also generates and responds back with XRES parameter using the Authentication Response message to the MME.

I have wireshark log of lte attach procedure, if you are interested then I can send to you.

Answer 3

Authentication is a process to check whether the particular user (IMSI) is registered in network properly. It may done in HSS . So, Authentication is user specific and Authorization is service specific.

Comments

In Lte, this process is known as mutual authentication since UE and network both authenticate to each other. I just brought up this point here because your statement is pertaining towards only one side (i.e. Authentication @ Network)

---

thanks vimal