1. 後卓越計畫 進度報告 楊舜仁老師實驗室 2006.12.06

2. 3GPP-WLAN Interworking (collaboration with ICL/ITRI)

3. WLAN Authentication Message Flow (1) WLAN UE WLAN AN 3GPP AAA Server HSS/HLRWAG 2.802.11 probe response 5.802.11 association request 6.802.11 association response 1.802.11 probe request 4.802.11 open system authentication response 3.802.11 open system authentication request

4. WLAN UE WLAN AN 3GPP AAA Server HSS/ HLR WAG 7. EAP Request /Identity 8. EAP Response /Identity NAI based temp identifier or IMSI 9. EAP Response /Identity NAI based temp identifier or IMSI 10. AV retrieval 11. Multimedia Auth Answer AV(1….n) WLAN Authentication Message Flow (2)

5. WLAN UE WLAN AN 3GPP AAA Server HSS/ HLR WAG 12. EAP Request /SIM- Start [AT_VERSION_LIST] 13. EAP Request /SIM- Start [AT_VERSION_LIST] 14. EAP Response / SIM-Start [AT_NONCE_MT, AT_SELECTED_VERSI ON ] 15. EAP Response / SIM-Start [AT_NONCE_MT, AT_SELECTED_VERSI ON ] 16. EAP Request /SIM- challenge [AT_RAND AT_MAC] 17. EAP Request /SIM- challenge [AT_RAND AT_MAC] WLAN Authentication Message Flow (3)

6. WLAN UE WLAN AN 3GPP AAA Server HSS/ HLR WAG Verifies AT_MAC 21. EAP Success [keying material] 20. Policy enforcement delivery 22. EAP Success Peer runs GSM algorithms, verifies AT_MAC and derives session keys 18. EAP Response /SIM- challenge[AT_MAC] 19. EAP Response /SIM- challenge[AT_MAC] WLAN Authentication Message Flow (4)

7. PDG A uthentication Scenario

8. IMS Authentication MSSGSNHSS/AuCCSCF PDP Context Activation Register (impi) Multimedia Auth Request (impi) Multimedia Auth Answer AV(1….n) Select authentication vector AV 401 Unauthorized (RAND || AUTN) Register (RES) Compare RES and XRES 200 OK Server Assignment Request Server Assignment Answer

9. Message flow of EAP-SIM (briefly) ClientServer EAP/identity EAP/SIM-start EAP/SIM-challenge EAP/Success(failure) Server EAP/identity EAP/SIM-start EAP/SIM-challenge EAP/Success(failure) Client OriginalOur scheme

10. Our Proposed Scheme on PDG Scenario (1) StationTTGGGSNAAA srvHLR/ HSS 1.IKE_SA_INIT [Hdr, SA,D_H value, Nonces] 2.IKE_AUTH Request [Hdr, IDi(user ID),IDr(W-APN), CP, SAi2, TSi, TSr] 3.EAP-Resp/Identity [User ID, W-APN 4.Check user’s subscription on if tunnel is allowed User profile and AVs retrieval if needed 5.EAP-Req/SIM-Start 6.IKE_AUTH Request [Hdr, IDr(PDG ID), Cert, AUTH, EAP-Req/SIM-Start] 7.IKE_AUTH Response [Hdr,EAP-Resp/SIM-Challenge] 8.EAP-Resp/SIM-Challenge 9.EAP-Success + keying material 10.AUTH payload is computed using the keying material (MSK) 11.IKE_AUTH Response [Hdr,EAP-Success ] 12.IKE_AUTH Request [Hdr,AUTH]

11. StationTTGGGSNAAA srvHLR/ HSS 13 Check the correctness of AUTH payload 14.Create PDP Context request 15.Create PDP Context response 16.IKE_AUTH Response [Hdr, AUTH, CP, SAr2, TSi, TSr] Our Proposed Scheme on PDG Scenario (2)

12. IMS Authentication Reduction MSSGSN HSS/AuC CSCF PDP Context Activation Store the (imsi,impi) pair Check if IMSI HSS (impi)=imsi 200 OK (Impi rand) (impi,imsi, rand) (Impi, rand) (IMSI HSS (impi), User profile,CK, IK) Retrieve the IMSI value Select a rand and compute CK=f3 k (rand) IK=f4 k (rand) Compute CK=f3 k (rand) IK=f4 k (rand)