TS 33.102 — 3G Security; Security architecture

Release: Rel 12 · Version assessed: 12.8.0 · Network: 3G, 4G · Applies to: AuC, HLR, HSS, MME · Interfaces: D, Gr, S6a

Assessed for the home-environment side (Authentication Centre and HLR/HSS of the subscriber database) and the serving-network side the platform implements (the MME). Access-network and terminal clauses (UTRAN ciphering, integrity and USIM behaviour) are outside the assessed functions.

Mandatory items: 9, of which 7 supported, 1 partially supported and 1 not applicable.

Mandatory items

Ref.	Item	Status	Support	Remarks
6.3.1	Authentication and key agreement: general	Mandatory	Supported	UMTS AKA with MILENAGE; quintets for UTRAN, triplets for GERAN and E-UTRAN vectors for the MME are produced by the same Authentication Centre.
6.3.2	Distribution of authentication data from the home environment to the serving network	Mandatory	Supported	Quintets over MAP SendAuthenticationInfo (D and Gr), E-UTRAN vectors over S6a Authentication-Information-Request; the number of vectors requested and the Immediate-Response-Preferred indication are honoured.
6.3.3	Authentication and key agreement (challenge, response and key derivation)	Mandatory	Supported	The Authentication Centre generates RAND, XRES, CK, IK and AUTN (SQN masked with AK, AMF, MAC-A); the MME compares RES with XRES and rejects a mismatch with Authentication Reject and EMM cause 3.
6.3.4	Distribution of IMSI and temporary authentication data within one serving network domain	Mandatory	Not applicable (SGSN role)
6.3.5	Re-synchronisation procedure	Mandatory	Supported	AUTS is carried in MAP SendAuthenticationInfo and in the S6a Re-Synchronization-Info AVP; the Authentication Centre verifies MAC-S, resets the sequence number and returns fresh vectors.
6.3.6	Reporting authentication failures from the serving network to the home environment	Mandatory	Partial	MAP AuthenticationFailureReport from a VLR or SGSN is accepted; S6a carries no failure report and the MME reports none.
6.3.7	Length of authentication parameters	Mandatory	Supported	128-bit K, RAND, CK and IK; 48-bit SQN and AK; 16-bit AMF; 64-bit MAC and RES.
6.8.1.2	Authentication and key agreement of UMTS subscribers in GSM: derivation of GSM triplets by the home environment	Mandatory	Supported	GERAN vectors (RAND, SRES, Kc) are derived from the UMTS vector when a GERAN vector is requested.
C.1	Generation of sequence numbers in the Authentication Centre	Mandatory	Supported	The sequence number is managed per subscriber in the Authentication Centre and re-synchronised from AUTS.

Optional items

The specification leaves these 1 items to the implementation; 0 are supported or partially supported. An item marked Not applicable belongs to an area the platform does not provide, named in the Support column. Expand for the full list.

1 optional item

Ref.	Item	Support	Remarks
6.8.2	Authentication and key agreement for GSM subscribers	Not supported	Subscriptions are UMTS subscriptions with a 128-bit K; a 2G SIM attaching over E-UTRAN is refused with DIAMETER_AUTHORIZATION_REJECTED.

Assessed 2026-09-17 against TS 33.102 version 12.8.0.