cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
62020
Views
15
Helpful
4
Comments

 

Introduction

EAP-SIM is an Extensible Authentication Protocol (EAP) [RFC3748] mechanism for authentication and session key distribution using the Global System for Mobile communications (GSM) Subscriber Identity Module (SIM). [Hence the name !] .

EAP Authentication

As you all know EAP is an authentication framework which supports multiple authentication methods.

EAP typically runs directly over data link layers such as Point-to-Point Protocol (PPP) or IEEE 802 . 

GSM cellular networks use a subscriber identity module (SIM) card to  carry out user authentication..

EAP-SIM uses a SIM authentication algorithm between the client and an Authentication, Authorization and Accounting (AAA) server providing mutual authentication between the client and the network. 

In EAP-SIM the communication between the SIM card and the  Authentication Centre (AuC) replaces the need for a pre-established  password between the client and the AAA server.

Note - GSM is a second generation mobile network standard.

Second  generation mobile networks and third generation mobile networks use different authentication and key agreement mechanisms.                  

EAP-AKA specifies an EAP method that is based on the Authentication and  Key Agreement (AKA) mechanism used in 3rd generation mobile networks  Universal Mobile Telecommunications System (UMTS) and CDMA2000.

Advantages of EAP - AKA

  1. The use of the AKA also as a secure PPP authentication method in devices that already contain an identity module.
  2. The use of the 3rd generation mobile network authentication infrastructure in the context of wireless LANs
  3. Relying on AKA and the existing infrastructure in a seamless way with any other technology that can use EAP.

Requirements  

  • To run an EAP-SIM/AKA authentication, a client as wpa_supplicant, which has access to a (U)SIM, is needed.
  • The WLAN access point on the network has to support EAP (which is often transcribed as WPA(2)-RADIUS or WPA(2)-ENTERPRISE).
  • The WLAN AP/Controller has to have access to a RADIUS server, which handles the authentication and session key generation.
  • The RADIUS server in a productive environment needs for EAP-SIM/AKA access to the home location register (HLR) of the MNO where the (U)SIMs are registered .

Diagram

This is explained in the diagram below  

 

  • EAP SIM is based on the authentication and encryption algorithms stored on the Global System for Mobile Communications (GSM) SIM.
  • Its based on a challenge-response mechanism and employs a shared secret key, Ki, which is stored on the SIM and otherwise known only to the GSM operator's Authentication Center (AuC).
  • When a GSM SIM is given a 128-bit random number (RAND) as a challenge, it calculates a 32-bit response (SRES) and a 64-bit encryption key (Kc)
  • EAP SIM also enhances the basic GSM authentication mechanism by providing for mutual authentication between the client and the AAA server
  • Secure keyed hashing algorithm, HMAC-SHA1 (one way hashing) . 

Sample call flow  - EAP SIM

 

Call flows are exactly same as EAP-SIM with the type AKA. The USIM security algorithms are used in this case. 
 

Abbreviations

  • GSM - Global System for Mobile communications.
  • IMS - International Mobile Subscriber Identifier, used in GSM to identify subscribers.
  • MAC - Message Authentication Code .
  • HLR - Home Location Register .
  • NAI - Network Access Identifier .
  • RAND is a 128-bit random challenge issued from the base station to the mobile.
  • SRES - The authentication result parameter in GSM, corresponds to the RES parameter in 3G AKA, 32 bits.
  • USIM - UMTS Subscriber Identity Module.  USIM is an application that is resident on devices such as smart cards distributed by UMTS operators.

  

Comments
Akram Sheriff
Cisco Employee
Cisco Employee

 

Great Doc Sharath :) , I have couple of queries on  this  

1) Would it be Possible to have a Location based attribute to assign the VLAN/IP_Addr dynamically to the EAP-SIM User  similar to the Dynamic VLAN Assignment  from the Radius server in an Enterprise Environment ?

 

2)  In a Mobile roaming scenario, does the Point of attachment of the USIM Client change or  is it taken care by PMIPV6  ?

 

robertjustice
Level 1
Level 1

This is great. But can you tell me can the IR829 connect in WGB using EAP-SIM to a root AP/WLC?

 

or how do we get the LTE modem/router in the 829 to be supplicant to the AP for EAP-SIM?

 

thank you!

1977699221
Level 1
Level 1

Great Doc Sharath :

In an Android 13 mobile phone project, the requirement is that "the terminal should allow the user to override the automatic WLAN network selection function of EAP-SIM and EAP-AKA pre installed configuration files." can you help provide a solution or solution?

Thank you!

Rich R
VIP
VIP

@1977699221 that's a phone configuration requirement and nothing to do with the protocol or mobile networks in general.
It will be entirely dependent on the Android implementation on that device so you'll need to talk to the device vendor about how to configure the device.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: