鉴权加密流程

1、33102分组域和电路域的鉴权加密流程是互相独立的。目前SGSN实现的时候，可以实现两种处理：1、是否鉴权；2、隔多少次鉴权一次。可以配置间隔的次数。对于加密来说，每次搭建Iu连接，就需要进行加密的重新协商。哪怕是由于进行业务引起的Iu连接建立。但是此时只是重新协商一致性校验的相关参数和加密算法，密钥CK和IK是不会变的（因为密钥的产生是在鉴权流程中根据RAND产生的，所以只有鉴权之后，才会产生新的密钥）。3G是不能重用鉴权参数（5元组）的。因为AUTN中有跟时间同步相关的参数，所以无法重用。a. 鉴权流程Figure 5: Authentication and key agreementUp

2、on receipt of a request from the VLR/SGSN, the HE/AuC sends an ordered array of n authentication vectors (the equivalent of a GSM "triplet") to the VLR/SGSN. The authentication vectors are ordered based on sequence number. Each authentication vector consists of the following components: a

3、random number RAND, an expected response XRES, a cipher key CK, an integrity key IK and an authentication token AUTN. Each authentication vector is good for one authentication and key agreement between the VLR/SGSN and the USIM.When the VLR/SGSN initiates an authentication and key agreement, it sele

4、cts the next authentication vector from the ordered array and sends the parameters RAND and AUTN to the user. Authentication vectors in a particular node are used on a first-in / first-out basis. The USIM checks whether AUTN can be accepted and, if so, produces a response RES which is sent back to t

5、he VLR/SGSN. The USIM also computes CK and IK. The VLR/SGSN compares the received RES with XRES. If they match the VLR/SGSN considers the authentication and key agreement exchange to be successfully completed. The established keys CK and IK will then be transferred by the USIM and the VLR/SGSN to th

6、e entities which perform ciphering and integrity functions.VLR/SGSNs can offer secure service even when HE/AuC links are unavailable by allowing them to use previously derived cipher and integrity keys for a user so that a secure connection can still be set up without the need for an authentication

7、and key agreement. Authentication is in that case based on a shared integrity key, by means of data integrity protection of signalling messages (see 6.4).The authenticating parties shall be the AuC of the user's HE (HE/AuC) and the USIM in the user's mobile station. The mechanism consists of

8、 the following procedures:总的来说，CK和IK当作鉴权五元组中的一部分，存在SGSN/VLR中。但是SGSN/VLR并不把它们下发给UE，而是只下发AUTN和RAND。UE通过对AUTN的鉴权，达到对网络鉴权的目的。然后，如果通过了AUTN的鉴权的话，UE利用RAND，根据USIM中已经写好的算法，算出RES，然后发给SGSN/VLR。SGSN/VLR收到后，将其与鉴权五元组中的XRES相比，如果相同，就代表该UE是合法的。这样就完成了网络对UE的鉴权。然后，UE在USIM中算出CK和IK，同时，SGSN/VLR也采用相同的CK和IK。（这两个CK和IK之所以相同，是

9、由于他们都是通过同一个RAND算出来的。所以这样的话，UE和SGSN/VLR就能采用相同的CK和IK来进行数据加密了。）KSI:UMTS中使用KSI，GSM中使用CKSN。The key set identifier (KSI) is a number which is associated with the cipher and integrity keys derived during authentication. The key set identifier is allocated by the network and sent with the authentication req

10、uest message to the mobile station where it is stored together with the calculated cipher key CK and integrity key IK. KSI in UMTS corresponds to CKSN in GSM. The USIM stores one KSI/CKSN for the PS domain key set and one KSI/CKSN for the CS domain key set.KSI用于网络鉴别保存在UE中的CK和IK。The purpose of the ke

11、y set identifier is to make it possible for the network to identify the cipher key CK and integrity key IK which are stored in the mobile station without invoking the authentication procedure. This is used to allow re-use of the cipher key CK and integrity key IK during subsequent connection set-ups

12、.IK:IK有128bit。在CS和PS与UE之间都可以存在各自的IK。如IKcs，IKps。IK用于在UE和RNC之间的RRC层的完整性保护。一致性校验是在RRC层进行的。The UIA（UMTS完整性算法） shall be implemented in the ME and in the RNC.Integrity protection shall be applied at the RRC layer.由于在UE和网络之间传送的大多数的信令信息是相当敏感的，所以必须保证它们的完整性。Most control signalling information elements that ar

13、e sent between the MS and the network are considered sensitive and must be integrity protected. A message authentication function shall be applied on these signalling information elements transmitted between the ME and the RNC.CK:CK有128bit。在CS和PS与UE之间都可以存在各自的CK。如CKcs ，CKps加密是在RLC或者MAC层进行的。是在UE和RNC之间

14、进行的。The ciphering function is performed either in the RLC sub-layer or in the MAC sub-layer, according to the following rules:-If a radio bearer is using a non-transparent RLC mode (AM or UM), ciphering is performed in the RLC sub-layer.-If a radio bearer is using the transparent RLC mode, ciphering

15、 is performed in the MAC sub-layer (MAC-d entity).Ciphering when applied is performed in the S-RNC and the ME and the context needed for ciphering (CK, HFN, etc.) is only known in S-RNC and the ME.鉴权流程由网络侧发起，其目的是：由网络来检查是否允许终端接入网络；提供鉴权参数五元组中的随机数数组，供终端计算出加密密钥（CK）；同时，供终端计算出与网络侧进行一致性检查的密钥（IK）；最后一个目的是可以提

16、供终端对网络的鉴权。 与GSM的鉴权流程相比，3G的鉴权流程增加了一致性检查的功能及终端对网络的鉴权功能。这些功能使3G的安全特性有了进一步的增强。网络侧在发起鉴权前，如果VLR内还没有鉴权参数五元组，此时将首先发起到HLR取鉴权集的过程，并等待鉴权参数五元组的返回。鉴权参数五元组的信息包含RAND、XRES、AUTN、CK和IK。在检测到鉴权参数五元组的存在后，网络侧下发鉴权请求消息。此消息中将包含某个五元组的RAND和AUTN。用户终端在接收到此消息后，由其USIM验证AUTN，即终端对网络进行鉴权，如果接受，USIM卡将利用RAND来计算出CK与IK和签名XRES。如果USIM认为鉴权成

17、功，在鉴权响应消息中将返回XRES。网络侧在收到鉴权响应消息之后，比较此鉴权响应消息中的XRES与存储在VLR数据库中的鉴权参数五元组的XRES，确定鉴权是否成功：成功，则继续后面的正常流程；不成功，则会发起异常处理流程，释放网络侧与此终端间的连接，并释放被占用的网络资源、无线资源。（不成功的处理见后面的描述）在成功的鉴权之后，终端将会把CK（加密密钥）与IK（一致性检查密钥）存放到USIM卡中。鉴权失败的话，SGSN会发起一个鉴权失败报告消息给HLR，此时HLR可能会发起一个cancle location （也就是HLR发起的分离流程啦）VLR/SGSN可能会发起一次新的鉴权加密流程。Upo

18、n receipt of user authentication response Reporting authentication failures from the SGSN/VLR to the HLRThe purpose of this procedure is to provide a mechanism for reporting authentication failures from the serving environment back to the home environment.The procedure is shown in Figure 13.Figure 1

19、3: Reporting authentication failure from VLR/SGSN to HLRThe procedure is invoked by the serving network VLR/SGSN when the authentication procedure fails. The authentication failure report shall contain the subscriber identity and a failure cause code. The possible failure causes are either that the

20、network signature was wrong or that the user response was wrong.The HE may decide to cancel the location of the user after receiving an authentication failure report.b. 加密1、在A/Gb模式下，手机在发送了Authentication and Ciphering Response消息后，就开始加密了。2G的加密是在LLC层的。其中在Authentication and Ciphering request消息中带有2G的加密算法

21、。In A/Gb mode, the scope of ciphering is from the ciphering function in the SGSN to the ciphering function in the MS. Ciphering is done in the LLC layer, and from the perspective of the existing GSM MS-BTS radio path, an LLC PDU is transmitted as plain text.SGSN在收到一个正确的Authentication and Ciphering R

22、esponse消息后，就开始加密。In A/Gb mode, the MS starts ciphering after sending the Authentication and Ciphering Response message. The SGSN starts ciphering when a valid Authentication and Ciphering Response message is received from the MS.2、在Iu模式下，加密的开始是受 security mode setup 流程控制的。当发送了security mode command 下行

23、消息后，下行的消息（包括该消息）就开始了一致性校验；当UE返回了security mode complete 消息后，上行的消息（包括该消息）就开始了一致性校验。加密的相关信息，包括CK的选择、加密算法的选择，则是在加密模式设定（security mode setup ）的流程中确定的。所以，根据流程图，可以看到在3G里面，是在security mode complete 消息发送后，UE和UTRAN才开始进行加密的（因为通过前面的消息交互，确定了相关的CK和算法）。这个加密是在RLC层的。加密是在RLC（确认和非确认模式），透明模式的RLC加密在MAC层，都属于空口层二，数据链路层。针对业务

24、数据和信令。一致性检查在RRC，针对信令。Security mode set-up procedureThis section describes one common procedure for both ciphering and integrity protection set-up. It is mandatory to start integrity protection of signalling messages by use of this procedure at each new signalling connection establishment between MS

25、and VLR/SGSN. The four exceptions when it is not mandatory to start integrity protection are:-If the only purpose with the signalling connection establishment and the only result is periodic location registration, i.e. no change of any registration information.-If there is no MS-VLR/SGSNsignalling a

26、fter the initial L3 signalling message sent from MS to VLR/SGSN, i.e. in the case of deactivation indication sent from the MS followed by connection release.-If the only MS-VLR/SGSN signalling after the initial L3 signalling message sent from MS to VLR/SGSN, and possible user identity request and au

27、thentication (see below), is a reject signalling message followed by a connection release.When the integrity protection shall be started, the only procedures between MS and VLR/SGSN that are allowed after the initial connection request (i.e. the initial Layer 3 message sent to VLR/SGSN) and before t

28、he security mode set-up procedure are the following:-Identification by a permanent identity (i.e. request for IMSI), and-Authentication and key agreement.The message sequence flow below describes the information transfer at initial connection establishment, possible authentication and start of integ

29、rity protection and possible ciphering.Figure 14: Local authentication and connection set-upNOTE 1:The network must have the "UE security capability" information before the integrity protection can start, i.e. the "UE security capability" must be sent to the network in an unprote

30、cted message. Returning the "UE security capability" later on to the UE in a protected message will give UE the possibility to verify that it was the correct "UE security capability" that reached the network.Detailed description of the flow above:1.RRC connection establishment in

31、cludes the transfer from MS to RNC of the ME security capability optionally the GSM Classmarks 2 and 3 and the START values for the CS service domain respective the PS service domain. The UE security capability information includes the ciphering capabilities (UEAs) and the integrity capabilities (UI

32、As) of the MS. The START values and the UE security capability information are stored in the SRNC. If the GSM Clasmarks 2 and 3 are transmitted during the RRC Connection establishment, the RNC must store the GSM ciphering capability of the UE (see also message 7).2.The MS sends the Initial L3 messag

33、e (Location update request, CM service request, Routing area update request, attach request, paging response etc.) to the VLR/SGSN. This message contains e.g. the user identity and the KSI. The included KSI (Key Set Identifier) is the KSI allocated by the CS service domain or PS service domain at th

34、e last authentication for this CN domain.4.The VLR/SGSN determines which UIAs and UEAs that are allowed to be used in order of preference.5.The VLR/SGSNinitiates integrity and ciphering by sending the RANAP message Security Mode Command to SRNC. This message contains an ordered list of allowed UIAs

35、in order of preference, and the IK to be used. If ciphering shall be started, it contains the ordered list of allowed UEAs in order of preference, and the CK to be used. If a new authentication and security key generation has been performed (see 3 above), this shall be indicated in the message sent

36、to the SRNC. The indication of new generated keys implies that the START value to be used shall be reset (i.e. set to zero) at start use of the new keys. Otherwise, it is the START value already available in the SRNC that shall be used (see 1. above).7.The SRNC generates the RRC message Security mod

37、e command. The message includes the ME security capability, optionally the GSM ciphering capability (if received during RRC Connection establishment), the UIA and FRESH to be used and if ciphering shall be started also the UEA to be used. Additional information (start of ciphering) may also be inclu

38、ded. Because of that the MS can have two ciphering and integrity key sets, the network must indicate which key set to use. This is obtained by including a CN type indicator information in the Security mode command message. Before sending this message to the MS, the SRNC generates the MAC-I (Message

39、Authentication Code for Integrity) and attaches this information to the message.8.At reception of the Security mode command message, the MS controls that the "UE security capability" received is equal to the "UE security capability" sent in the initial message. The same applies t

40、o the GSM ciphering capability if it was included in the RRC Connection Establishment. The MS computes XMAC-I on the message received by using the indicated UIA, the stored COUNT-I and the received FRESH parameter. The MS verifies the integrity of the message by comparing the received MAC-I with the

41、 generated XMAC-I.9.If all controls are successful, the MS compiles the RRC message Security mode complete and generates the MAC-I for this message. If any control is not successful, the procedure ends in the MS.10.At reception of the response message, the SRNC computes the XMAC-I on the message. Th

42、e SRNC verifies the data integrity of the message by comparing the received MAC-I with the generated XMAC-I.11.The transfer of the RANAP message Security Mode Complete response, including the selected algorithms, from SRNC to the VLR/SGSN ends the procedure.The Security mode command to MS starts the

43、 downlink integrity protection, i.e. this and all following downlink messages sent to the MS are integrity protected using the new integrity configuration. The Security mode complete from MS starts the uplink integrity protection, i.e. this and all following messages sent from the MS are integrity p

44、rotected using the new integrity configuration. When ciphering shall be started, the Ciphering Activation time information that is exchanged between SRNC and MS during the Security mode set-up procedure sets the RLC Sequence Number/Connection Frame Number when to start ciphering in Downlink respective Up