TSG-SA WG3 (Security) meeting #7	S3-99368
The Hague, 26th October – 27th October 1999	

Agenda Item:	

Source:	Ericsson

Title:	Distribution of authentication vectors between VLRs/SGSNs

Document for:	Decision
___________________________________________________________________________
1	Abstract
The mechanism for distribution of authentication vectors between VLRs described in the main body of the TS 33.102 v3.1.0 is not covering the behaviour when a UMTS capable VLR/SGSN receives triplets from a non-UMTS capable VLR/SGSN. This mechanism states that the new visited VLR/SGSN shall stored the authentication vectors received from the previously visited VLR/SGSN, but it was not taken into account that the authentication vectors received from a non-UMTS capable VLR/SGSN are not valid in an UMTS security context. This problem raises because the UMTS user would use real UMTS data in the MS and the SN would use derived UMTS data from derived GSM data.
Consequently, those authentication vectors would cause an authentication error if the new visited VLR/SGSN tried to use them in that context. 
2	Introduction
In the main body of the TS 33.102 v3.1.0 (chapter 6.3.4) is described a procedure that aims to provide a newly visited VLR with unused authentication vectors from a previously visited VLR. 
The procedure is invoked by the newly visited SN/VLRn after a location update request sent by the user. Typically the user identifies himself using a temporary user identity TMSIo and the location area identity LAIo of a location area under the jurisdiction of SN/VLRo. 
Upon receipt of the request the VLRo verifies whether it has any unused authentication vectors in its database and if so, sends the unused authentication vectors to VLRn. The previously visited VLRo shall then delete these authentication vectors from its database.
Upon receipt the VLRn stores the received authentication vectors.
The corresponding procedure also applies to SGSN nodes.
3	Distribution of authentication vectors between VLRs/SGSNs
For a UMTS user (USIM), the triplets derived from quintuplets can only be used in GSM security context (GSM radio access network) since for a UMTS security context (UMTS radio access network) the needed quintuplet would be derived in the VLR/SGSN from the already derived triplet, obtaining as a result a non-real quintuplet. That non-real quintuplet would provoke an authentication error because the UMTS user would be using a real quintuplet in the MS.
Consequently the behaviour in the VLR/SGSN nodes should be different depending on the triplet origin. 
When a non-UMTS capable VLR/SGSN sends its non-used authentication vectors, the MAP v2 protocol or GTP R97 will be used (only triplets can be sent). Therefore, the VLR/SGSN receiving these authentication vectors will not have any way so that it could know if these triplets were derived from the quintuplets corresponding to a UMTS user (derivation performed in the HE) or they are real triplets corresponding to a GSM user.
Due to this lack of knowledge regarding the triplet origin and the authentication error that could be provoked, the VLR/SGSN should behave as if the triplets were derived in the HE, from the quintuplet corresponding to a UMTS user.
This implies that a UMTS capable VLR/SGSN should handled the received authentication vectors as follows:
•	The authentication vectors received from a non-UMTS capable VLR (MAP v2 protocol) can only be used in a GSM security context	
•	The authentication vectors received from a non-UMTS capable VLR (MAP v2 protocol) shall not be sent to any other UMTS capable VLR.
•	The authentication vectors received from a non-UMTS capable SGSN (GTP R97) can only be used in a GSM security context	
•	The authentication vectors received from a non-UMTS capable SGSN (GTP R97) shall not be sent to any other UMTS capable SGSN.
The following examples show the some of the possible cases where these authentication vectors should not be simply stored. 

In the case shown in Figure 1, MSC/VLR ‘B’ can use the AV received from ‘A’ but these AVs shall not be sent to ‘C’ when this MSC/VLR requests for unused authentication vectors.
A corresponding example applies to PS network. 

4	Conclusions
The chapter 6.3.4 in TS 33.102 v3.1.0 should be updated so that it states that the AVs received by a UMTS capable VLR/SGSN from a non-UMTS capable VLR/SGSN can only be used in a GSM security context and they shall not be sent to any other UMTS capable VLR/SGSN.