Siemens Atea, Belgium (genevieve.vanneste@vnet.atea.be)
Vodafone Ltd, England (Nigel.Jefferies@vf.vodafone.co.uk)

1. Introduction

1. The ASPeCT UMTS authentication demonstration

1. Demonstration set-up

A demonstrator, on a PC base, has been developed [D17], demonstrating the authentication framework with both public key and secret key based authentication mechanisms for UMTS. On the user’s side a smart card is available, providing the authentication functionality. The demonstrator shows the feasibility of a multi-application card for GSM and UMTS. The card contains both a GSM SIM application and a preliminary UMTS application. Various problems arise in supporting multiple applications on a single card, such as application selection and independence of applications. A careful approach is required to ensure both adequate security and sufficient interoperability. The functionality of the terminal is put on a PC. At the network’s side an Authentication centre (AuC) has been developed. This AuC can function in a visited network (with the NO) or in a home network (with the SP).

A second demonstration smart card has also been developed to demonstrate the advantages of using public key based mechanisms in UMTS. This card features the same UMTS application described above and also a public key based Visa Cash Reloadable Stored Value Card. This application provides the user with an electronic purse which is intended for low to medium value payments and is being introduced by one of the major payment organisations. (Note that this implementation has not been certified by Visa and is only intended to demonstrate the feasibility of such a multi-application card). If appropriate software was developed for the handset then it would be possible to use such a purse to make payments for services and to remotely load the card with more money – alternatively the card must be removed from the phone and inserted in the merchant’s conventional card reader.

By providing the user with a smart card which supports the public key mechanism needed for the UMTS authentication it is possible, at minimal extra cost, to add extra applications to the card which make use of its public key capability. Such applications will substantially enhance the user’s perception of the value of UMTS and, indeed, could provide the payment mechanism for the services which UMTS makes possible.

2. Results of the UMTS authentication demonstration

The authentication framework has been evaluated as a basis for a UMTS scenario in which the evolution of security functionality is possible. The principle objective of the authentication framework: ‘to provide a flexible procedure for user-network authentication allowing a number of different mechanisms and algorithms to be incorporated, with the ability to migrate smoothly from one mechanism to another’ is fulfilled.

The authentication framework is compliant with the majority of UMTS requirements as laid out in [33.20]. Both public and secret key approaches are supported, permitting different service providers to use different mechanisms. The UMTS modular approach is supported. User anonymity is preserved throughout the authentication process. Finally, the cost of additional information transfer is minimal, compared to the extensive flexibility in selecting the authentication mechanism which will be imperative in the UMTS environment.

 

3. Further work required

1. Benefits of Public key authentication mechanisms

1. The ASPeCT authentication trial

A trial is currently taking place of authentication in an experimental UMTS environment with real users, provided by ACTS project AC013 EXODUS [EXO]

1. The set-up of the authentication trial

The UMTS authentication trial uses an ASPeCT mutual authentication protocol between smart cards (or UIMs) attached to EXODUS terminals, and an ASPeCT AuC attached to an EXODUS SCP. In the trial, ASPeCT security services are integrated into the EXODUS signalling system. The experimental UMTS platform provided by EXODUS is enhanced by the authentication functionality provided by ASPeCT. The main objective of the trial is to show the feasibility of the implementation on a real network.

Communication between the ASPeCT terminal and the network will be provided by DECT and fixed broadband access. The terminal itself will be enhanced with the necessary ASPeCT software to interface with a smart card-based UIM connected to the terminal. The user part of the authentication protocol will run on the ASPeCT UIM.

The UMTS network functionality will be provided by the EXODUS core network. The security mechanisms will be incorporated into the EXODUS core network using an ASPeCT AuC connected to the EXODUS SCP. Authentication is conducted over INAP, using the Authentication-req operation. Interrogation of the service provider is realised using the INAP HandleInformationRequest operation.

The trial configuration is available across two UMTS Islands in Basel and Milan. Within this configuration the distinction between the network operator and the service provider can not be made. Each SCP has home subscribers and visiting subscribers. The AuC connected to the SCP will fulfil two roles, home-AuC and visited-AuC. As home-AuC, its only functionality is the translation of the authentication capability class into authentication mechanisms. As visited-AuC, it has to run the full protocol.



 

Figure 1: ASPeCT - EXODUS trial configuration

2. Evaluating the results of the authentication trial

To evaluate the trial, two assessment criteria are used, namely quality and performance. Neither criterion on its own is sufficient to evaluate the system, as a successful system must both be of a usable quality and adequate performance.

The quality of the system is more related to the users’ view of the system, whilst the performance of the system is more related to the network providers' view. However, it is clear that there is some degree of overlap in these definitions. To assess the technical feasibility of the trialled system, the performance of the system is measured directly from the system’s log files. To assess the quality of the system, the response of the users to various actions is recorded and assessed.

1. Technical feasibility

Data for performance measurements is obtained in the form of log files produced by the AuC, SCP and Terminal.

This data is recorded using a simple tag system, which makes it a fairly straightforward matter to deduce the various timings for each part of the call setup process.

These timings can then be compared against the gross timings defined within the GSM network to assess whether an adequate performance is achieved, and to determine what overhead is added by the authentication framework.

In addition to these performance measurements, the use of the authentication framework will be assessed to see whether it provides the functionality to satisfy the requirements of an authentication process.

2. User Acceptability

The trial assesses the quality and hence the user acceptability of the system in three ways, each representing a separate section of the user trial documentation.

The first section is used to determine the user’s perceived response of the system to a series of individual actions, and the user records these using a five-level scale of satisfaction: {Bad, Poor, Fair, Good, Excellent}. Once these are averaged for all users, an average level of response is attained for each action.

The second section records the overall assessment of the system by each user and contains a group of more general questions at the end of the list of actions. These use the same scale of satisfaction, and ask questions about the overall usability and quality of the system. Once these are averaged for all users, an overall level of satisfaction will be recorded.

Finally, a third comments section allows feedback on issues not covered specifically under the previous two sections, and allows the users to input more individual views. These are analysed to see whether there are any common responses, which are then recorded.

 

2. A GSM-UMTS evolution strategy

1. Conclusion

The results achieved within ASPeCT build a firm basis for integration of new and advanced security mechanisms into the UMTS architecture. Public-key authentication mechanisms are clear contenders for use in UMTS, and the adoption of a flexible authentication framework will allow the evolution of security features, including a future upgrade path.

This paper is based on the work carried out as part of the ACTS project AC095, ASPeCT (Advanced Security for Personal Communications Technologies) [ASP].

 

2. References