Authentication data

Description

Authentication data is a term used in 3GPP security specifications to refer to the data elements that are part of a security context or authentication vectors. It encompasses the parameters and keys used during authentication procedures to verify the identity of a subscriber or network entity and to establish secure communication. Introduced in Release 8, this term became necessary with the evolution of LTE and SAE, where security contexts and authentication vectors play a central role in the Authentication and Key Agreement (AKA) process.

In the context of 3GPP, authentication data typically includes the random challenge (RAND), the authentication token (AUTN), the expected response (XRES), and the cipher key (CK) and integrity key (IK). These elements are part of an authentication vector, which is generated by the home environment (e.g., HSS) and used by the serving network (e.g., MME) to authenticate the UE. The authentication data is also part of the security context, which is established after successful authentication and includes the derived keys and other security parameters.

The security context is a set of security-related information stored in the UE and the network, which is used to protect subsequent communication. It includes the authentication data, such as the keys and the authentication result, as well as other parameters like the selected encryption and integrity algorithms. The authentication data within the security context ensures that the UE and network can maintain secure communication without re-running the full authentication procedure for every message.

In 5G, the concept of authentication data has been extended to support new authentication methods such as 5G-AKA and EAP-AKA'. The authentication data may include additional parameters like the home network public key and the subscription concealed identifier (SUCI) for privacy protection. The definition of authentication data was revised in Release 20 to clarify that it refers to 'An authentication vector or transformed authentication vector,' reflecting the evolving terminology in 5G and beyond.

Authentication data is critical for ensuring the integrity and confidentiality of signaling and user data. It is used in various procedures, including initial attach, handover, and service requests. The proper management and protection of authentication data are essential to prevent attacks such as replay, man-in-the-middle, and key compromise. The 3GPP specifications (e.g., TS 33.401 for LTE and TS 33.501 for 5G) define the exact format and usage of authentication data.

Purpose & Motivation

Authentication data exists to provide a standardized way to refer to the security parameters used during authentication and key agreement procedures. Before Release 8, the term was not explicitly defined, and specifications referred to specific parameters like RAND, XRES, etc. As networks became more complex and new authentication methods emerged, a generic term was needed to encompass all these data elements.

The introduction of authentication data allowed for clearer specification of security contexts and authentication vectors, facilitating interoperability between different network elements and vendors. It also enabled the reuse of authentication data across different procedures, such as handovers and service requests, without re-authentication. The revision in Release 20 further clarifies the term in the context of 5G, where transformed authentication vectors are used to support new authentication frameworks.