1. 1 Replay protection method for CAVE based AKA Anand Palanigounder Qualcomm Inc. apg@qualcomm.com

2. 2 High level solution outline Store 16-bit sequence numbers (MS_SQN and HSS_SQN) and 128-bit AKA re- synchronization tokens (MS_AUTS and HSS_AUTS) at both MS and HSS If these parameters are not available (e.g. when UIM is inserted into a new ME), initiate AKA re-synchronization procedure to agree on these parameters

3. 3 When stored parameters are available then procedures @ the HSS/H-AAA AKA_KEY= formed from CAVE keys (same as in the 2G IMS baseline) AKA_RAND = CAVE_RAND (32 bits) | HSS_RAND (96 bits) AUTN = MS_VERIFY | HSS_SQN (16 bits) | MAC (64 bits), where –MAC = f1(AKA_RAND, MS_VERIFY, HSS_SQN) –MS_VERIFY = 48-bits of prf (HSS_AUTS, AKA_RAND) Increase HSS_SQN by 1 Calculate XRES, CK and IK from AKA_KEY, AKA_RAND and HSS_AUTS using AKA functions (f2, f3 and f4 respectively)

4. 4 When stored parameters are available then procedures @ the MS AKA_KEY = formed from CAVE keys (same as in 2G IMS baseline) Mobile verifies AUTN – if MAC failed -> network authentication failure; –Otherwise, check SQN - if SQN out of range -> start re-sync procedure If AUTN successful, MS proceeds with CK, IK and RES calculations using AKA_KEY, AKA_RAND and MS_AUTS Increment SQN by 1

5. 5 Initialization procedure used when the stored parameters are not available at the HSS and/or MS –For example, when UIM inserted in to a new ME, etc @ HSS –Generate random values for unknown parameters and form challenge (see slide #3) –When re-sync response is received, verify MAC –If successful set HSS_AUTS=AUTS and set HSS_SQN=0 @ the MS –If MAC check successful, then start re-sync procedure to agree on the parameters –Select 64-bit random number in place of 48-bit MS_VERIFY and 16-bits of HSS_SQN and calculate MAC –Set AUTS to (64-bit random number |MAC) and store as MS_AUTS and set MS_SQN=0

6. 6 Advantages of the method Independent of AKA transport (HTTP Digest or EAP) Independent of access technology-specific or device-specific parameters (timestamp, IMEI etc) –No protocol or implementation changes needed Single solution for using 2G R-UIM with IMS or UMB/CAN Re-sync procedure only run when –no stored parameters at MS/HSS –SQN out of range (this is same as 3G AKA)

7. 7 Conclusion and Proposal Discuss and Adopt as the replay protection method for 2G R-UIM based AKA solutions –2G IMS –Another optional method for UMB access authentication using 2G R-UIM