Handover mechanisms in next generation heterogeneous wireless ...

SECURITY FOR HANDOVER ACROSS HETEROGENEOUS WIRELESS NETWORKS
Authentication Centre (AuC) and the Subscriber Identity Module (SIM). Confidentiality
and anonymity on the radio path is provided by encrypting data streams between mobile
user and access network. However, GSM was not designed to protect against active
attacks on the radio path, because they would require an attacker to masquerade as a
GSM network [44].
In a GSM network, authentication is often involved in many system operations such as
mobile registration, mobile handover and so forth. To initiate an authentication process,
the AuC in the home network generates a 128-bit random number (RAND). This
random number RAND will be sent to the Mobile Host (MH) as a challenge. Then, both
the MH and the AuC produce a 32-bit signed response SRES by applying a vendor-
specific A3 algorithm, 3( , i ) K RAND A SRES � . The MH sends its SRES to the HLR for
verification. The HLR checks whether the SRES from the MH is identical to what it has
obtained from the AuC. Alternatively, the SRES and the RAND could be provided to the
VLR in advance. In this case, the SRES comparison can be done locally at the VLR on
the visited network.
If the MH is accepted for access, an encryption key K c is generated by another vendor-
specific algorithm A8, K c � A8(
RAND,
K i ) . The K c is produced by the MH and the
AuC separately. Then, the AuC sends its copy of K c to the visited network. The visited
network applies an A5 encryption algorithm to cipher the data streams between the BS
and the MH. The ciphering * � A5(
K , F ) XOR data will be applied on both
data c n
directions. F n is a 22-bit frame number, and 114-bit data are used as input.
Although GSM provides many security measures to protect against some typical attacks
such as eavesdropping, unauthorised access and masquerade, it is still vulnerable to
false base station attacks [44]. As the costs of mobile base equipments reduce greatly
and such kind of attacks become easier to implement, GSM mobile users would
inevitably be at a risk when roaming globally.
Mutual Authentication Method
- 37 -