Entity authentication

Description

Entity authentication is a core security service in 3GPP networks, defined as 'the provision of assurance of the claimed identity of an entity.' It is the process by which one party (the verifier) gains confidence in the identity of another party (the claimant). In the context of 3GPP, entity authentication is typically mutual, meaning both the UE and the network authenticate each other. This is essential to prevent unauthorized access, impersonation attacks, and to ensure that only legitimate users and network nodes can participate in communication.

The 3GPP security architecture specifies entity authentication for various entities, including the User Equipment (UE), the network (e.g., MME, AMF), and network elements. For UE authentication, 3GPP defines the Authentication and Key Agreement (AKA) protocol, which is used in 3G, 4G, and 5G networks. In 5G, the primary authentication is performed using 5G-AKA or EAP-AKA', as specified in TS 33.501. The authentication process involves the UE and the Authentication Server Function (AUSF) in the home network, with the help of the Security Anchor Function (SEAF) in the serving network. The AKA protocol uses a long-term secret key stored in the UE's Universal Subscriber Identity Module (USIM) and in the home network's Unified Data Management (UDM) to generate authentication vectors and session keys.

Entity authentication in 3GPP is not limited to UE authentication. It also covers authentication between network functions (e.g., NFs in the 5G core), between network elements in the management plane, and between the UE and non-3GPP access networks. For example, in the 5G Service-Based Architecture (SBA), network functions authenticate each other using OAuth 2.0 or TLS client certificates, as specified in TS 33.501. This ensures that only authorized NFs can access services provided by other NFs. Similarly, in the management plane, entity authentication is used to verify the identity of management systems and network elements, as described in TS 33.210 and TS 33.310.

The authentication process typically involves the exchange of credentials and the verification of those credentials. For UE authentication, the UE sends its identity (e.g., SUCI or 5G-GUTI) to the network, which retrieves the corresponding subscription data and generates an authentication challenge. The UE responds with a response that proves knowledge of the secret key. If the response is valid, the network authenticates the UE and both parties derive session keys for subsequent secure communication. The authentication can be one-way (network authenticates UE) or mutual (UE also authenticates network). In 3GPP, mutual authentication is standard for UE-network authentication.

Entity authentication is closely linked to other security services such as confidentiality, integrity, and key management. It is a prerequisite for establishing secure channels and for authorizing access to services. Without entity authentication, networks would be vulnerable to spoofing, man-in-the-middle attacks, and unauthorized access. Therefore, 3GPP has continuously enhanced authentication mechanisms across releases, introducing stronger algorithms, improved privacy protection (e.g., SUCI), and support for new entities like IoT devices and non-3GPP access. The definition of entity authentication has remained stable since Rel-8, reflecting its fundamental and unchanging nature in security architecture.

Purpose & Motivation

Entity authentication exists to provide assurance that an entity is indeed who it claims to be. In mobile networks, this is critical because the radio interface is inherently broadcast and vulnerable to eavesdropping and impersonation. Without authentication, anyone could impersonate a legitimate user or network node, leading to fraud, service theft, and privacy breaches. The purpose of entity authentication is to establish trust between communicating parties before any sensitive data is exchanged.

Historically, 2G networks used one-way authentication (network authenticates UE) with weak algorithms, which made them susceptible to attacks like false base stations. 3G introduced mutual authentication with stronger algorithms (MILENAGE, etc.) and improved key management. 4G LTE further enhanced security with hierarchical key derivation and interworking with non-3GPP access. 5G introduced a more flexible authentication framework, supporting 5G-AKA, EAP-AKA', and EAP-TLS for different use cases, including IoT and private networks.

The motivation for entity authentication is to protect both users and operators. For users, it ensures that their communications are not intercepted or manipulated by fake base stations. For operators, it prevents unauthorized access to network resources and ensures that only legitimate users are billed. It also enables lawful interception and emergency services by providing reliable identity information. As networks evolve towards 5G-Advanced and 6G, entity authentication will continue to be a cornerstone of security, adapting to new threats and technologies such as quantum computing and AI-driven attacks.