Fixed Part Authorisation Code

Description

The Fixed Part Authorisation Code (FPAC) is a security credential defined within 3GPP specifications, specifically TS 43.020. It is algorithmically derived from a Cordless Telephony System Personal Identification Number (CTS-PIN), which serves as a root secret. The FPAC functions as an authorization token for fixed network equipment, often referred to as Fixed Parts (FPs) in contexts like DECT/GSM interworking or cordless telephony systems. Its primary role is to authenticate the fixed infrastructure to the network core or to other network elements, ensuring that only legitimate, provisioned hardware can participate in network operations.

Architecturally, the FPAC is generated and managed by network operators, typically within authentication servers or subscriber identity modules. The derivation process involves cryptographic algorithms that transform the CTS-PIN into the FPAC, ensuring that the original PIN is not transmitted or stored in plaintext. This code is then provisioned into the Fixed Part hardware during manufacturing or deployment. When the Fixed Part attempts to register with the network, it presents the FPAC along with other identifiers. The network verifies this code against its records, granting or denying access accordingly.

Key components in the FPAC ecosystem include the Authentication Centre (AuC) or similar security module that stores the CTS-PIN and computes the FPAC, the Fixed Part hardware that stores the FPAC securely, and the network access protocols that facilitate its exchange. The FPAC plays a critical role in preventing rogue base station attacks and unauthorized network extensions, thereby maintaining the integrity of the radio access network. It is particularly relevant in private or hybrid networks where fixed infrastructure might be deployed by enterprises or in residential settings.

While FPAC is rooted in earlier GSM and cordless telephony standards, its principles of fixed part authentication continue to influence security architectures in later cellular generations. It represents a foundational approach to device authentication, emphasizing the need to verify not just user equipment but also network infrastructure. The specification ensures interoperability across vendors by standardizing the derivation method and usage procedures.

Purpose & Motivation

The FPAC was created to address security vulnerabilities in fixed network components, particularly in cordless telephony and early cellular extensions. Prior to its introduction, fixed parts like base stations or access points could be easily spoofed or cloned, leading to unauthorized network access, service theft, and potential denial-of-service attacks. The CTS-PIN, from which FPAC is derived, was already established as a user authentication method in DECT systems; extending this to authorize infrastructure provided a consistent security framework.

Historically, as cellular networks evolved to support fixed wireless access and cordless telephony interworking (like DECT/GSM), there was a growing need to authenticate not just mobile handsets but also the fixed infrastructure connecting them. This was especially critical for residential or enterprise base stations that could be physically accessed. The FPAC solved this by providing a cryptographically derived, non-replayable code that uniquely identified and authorized each Fixed Part. It mitigated risks associated with counterfeit equipment and ensured that only operator-approved hardware could access network resources.

The creation of FPAC was motivated by the desire to create a unified security model across different access technologies. By leveraging the existing CTS-PIN infrastructure, it minimized additional complexity while enhancing protection. It addressed limitations of simple hardware serial numbers or static passwords, which were susceptible to theft or brute-force attacks. The FPAC's derivation process added a layer of cryptographic security, making it a robust solution for its time and laying groundwork for later authentication mechanisms in 3GPP networks.

Key Features

• Derived from CTS-PIN using standardized cryptographic algorithms
• Used for authenticating Fixed Parts (FP) in network access
• Prevents unauthorized infrastructure deployment
• Enhances security against rogue base station attacks
• Supports interoperability across vendor equipment
• Integrates with existing authentication centers (AuC)

Evolution Across Releases

Defining Specifications