Skip to content

Key Sets⚓︎

Keysets are collections of encryption keys and algorithms used to authenticate SIM cards and establish secure communication between Mobile Assets and the network. They ensure mutual trust and encrypted interactions, safeguarding the integrity of the system.

This section provides tools to manage Keysets, including adding new Keysets, mapping them to HSS Keyset Identifiers at specific Sites, and applying them during Mobile Asset setup. Proper Keyset management is essential for secure and efficient network operations.

 

Enable Keyset Authentication⚓︎

Keyset authentication ensures secure communication and mutual trust between the SIM card and the network. It uses encryption keys and algorithms to verify the authenticity of Mobile Assets. Keysets are collections of encryption keys and algorithms that ensure secure SIM authentication and network integrity.

  • Loading Keysets: Performed by the Expeto Site Installer during site setup: the SIM batch's transport key is loaded into the Site's subscriber store under the HSS Keyset Identifier.
  • Adding and Mapping Keysets: Performed by a Network Administrator with Keyset permissions using Expeto xControl. The Site must have Keyset Mapping enabled by the Expeto Site Installer.
  • Applying Keysets: Network Administrators assign Keysets when adding Mobile Assets (individually or via Bulk Import).

Note

A Keyset can only be assigned once to a Mobile Asset and cannot be changed.

Add a Keyset⚓︎

Keysets are essential for enabling encrypted authentication and ensuring secure communication between Mobile Assets and the network. Adding a Keyset creates a reference that can be used during Mobile Asset configuration.

  1. Navigate to the Keysets section in Expeto xControl. The list of existing Keysets will be displayed.

  2. Click New to create a new Keyset.

  3. Enter the following details:

    • Name: Provide a unique name for the Keyset.
    • Customer: Select the Customer that will use this Keyset.
    • K4 Field Type: Select which values of the SIM batch the SIM vendor encrypted under the transport key: K Only, or K And OPC when the OPc is encrypted as well. None means neither is encrypted.

  4. Click Submit to save the new Keyset.

Once added, the Keyset will appear in the Keyset list and can be used for Mobile Assets at any Site belonging to the selected Customer.

Note

To enable encrypted authentication, the Keyset must be mapped to the HSS Keyset Identifier. See the next section for details.

API: Create a Keyset

 

Map a Keyset⚓︎

Mapping a Keyset links it to the corresponding HSS Keyset Identifier (KSI) at a specific Site, enabling secure authentication for Mobile Assets. This step is essential to complete the Keyset configuration process.

Note

The Add Mobile Asset permission is required to perform this task. The CUSTOMER_ADMIN role does not include the Add Keyset Mapping permission.

API: Create a Keyset Mapping

Before You Begin⚓︎

Ensure the following prerequisites are met:

  • Keyset Mapping: Must be enabled for the Site by a Site Installer.
  • Keyset Loading: The Site Installer must load the Keyset into the HSS.
  • HSS Keyset Identifier: The Site Installer must provide the HSS Keyset Identifier.

To Map a Keyset:⚓︎

  1. Navigate to the Sites section in Expeto xControl.
  2. Select the Site where the Keyset will be mapped and click Edit.
  3. Select the Keyset Mappings tab. If Keyset Mapping is not yet enabled for the Site, switch Enable on.
  4. Click Add Keyset Mapping.

  5. Select the Keyset.

    If no Keyset names are available, ensure you have added a Keyset.

  6. Enter the HSS Identifier provided by the Site Installer: a whole number, such as 1. It must equal the name the transport key was loaded under in the Site's subscriber store. 0 is reserved for Mobile Assets whose K is not encrypted.

  7. Optionally, enter an HSS Description (for example, Keyset for SIM batch 12).
  8. Click Submit to save the mapping.

Note

  • The same Keyset can be referenced by multiple Sites owned by the same Customer.
  • Keysets must be loaded individually into each Site's HSS database.
  • The Keyset name must remain consistent across Sites, but the HSS Keyset Identifier may vary depending on how the Keyset was loaded.

Mapping ensures that the Keyset is properly associated with the Site and can be used for Mobile Asset authentication.

 

Understanding SIM Authentication Security⚓︎

Every SIM shares two secrets with the network: its key K, and OPc, a value derived from K and the operator variant. The network never sends either over the air. It authenticates the SIM with a challenge computed from them, and the SIM authenticates the network in return.

What a Keyset protects⚓︎

The SIM vendor delivers each batch with K, and usually OPc, encrypted under the batch's transport key. The Keyset names that batch in xControl, and its K4 Field Type records which of the two values are encrypted. xControl stores the encrypted values as delivered and never holds the transport key. The Agent provisions the encrypted values into the Site's subscriber store with the HSS Keyset Identifier of the Keyset Mapping, and the subscriber store decrypts them with the transport key loaded under that identifier. A Mobile Asset's K and OPc therefore exist in clear only inside the subscriber store.

The authentication process⚓︎

  1. Challenge. When the device attaches or registers, the subscriber store generates a random challenge (RAND), an authentication token (AUTN) and the expected response (XRES) from the SIM's K and OPc and a sequence number.
  2. Network authentication. The SIM checks AUTN with its own K and OPc. A valid token proves the challenge comes from the home network; the sequence number in it protects against replayed challenges.
  3. Device authentication. The SIM computes its response (RES) from the challenge. The network compares it with XRES: the MME on 4G, the AUSF on 5G. A match authenticates the SIM, and both sides derive the keys that protect the device's signalling and traffic.

Key takeaways⚓︎

  • K and OPc never leave the subscriber store in clear and are never sent to the device.
  • The transport key is loaded into each Site's subscriber store, never into xControl.
  • A wrong transport key, or a Keyset Mapping whose identifier differs from the name the key was loaded under, fails every authentication of that batch.