How does LTE verify the identity of UEs connecting to the network?

LTE (Long-Term Evolution) networks verify the identity of User Equipment (UE) connecting to the network through a process called Authentication and Key Agreement (AKA). This process involves the exchange of information and cryptographic functions to ensure that the UE is legitimate and authorized to access the network. Here's a detailed technical explanation of how LTE verifies the identity of UEs:

1. Permanent UE Identity:
   • Each UE in an LTE network is associated with a permanent identity called the International Mobile Subscriber Identity (IMSI). The IMSI is stored in the Subscriber Identity Module (SIM) or Universal Subscriber Identity Module (USIM) card, which is inserted into the UE.
2. Temporary UE Identity:
   • To enhance user privacy, LTE uses a temporary identity called the Temporary Mobile Subscriber Identity (TMSI). The TMSI is assigned to the UE during the registration process and is used to identify the UE within a specific location area without revealing the permanent IMSI over the air.
3. Authentication Vector Generation:
   • When the UE initiates connection to the network, the Evolved NodeB (eNB) or the Authentication Center (AuC) generates an authentication vector. This vector includes a random challenge (RAND), the TMSI or IMSI, and other parameters.
4. Transmission to UE:
   • The authentication vector is sent to the UE over the air interface.
5. UE Authentication Response:
   • The UE uses the received authentication vector, along with the secret key (Ki) stored in its SIM or USIM card, to compute a response known as the Authentication Token (AUTN). The UE also generates a cipher key (CK) and an integrity key (IK) as part of this process.
6. Transmission of Authentication Response:
   • The UE sends the AUTN, along with the generated CK and IK, back to the eNB over the air interface.
7. Network Verification:
   • The eNB forwards the received authentication information to the Authentication Center (AuC) in the core network. The AuC uses the same parameters from the authentication vector to independently compute the expected AUTN.
8. Comparison and Authentication:
   • The eNB compares the AUTN received from the UE with the expected AUTN computed by the AuC. If they match, the UE is considered authenticated. The CK and IK are shared between the UE and the network, establishing secure communication.
9. Derivation of Session Keys:
   • Upon successful authentication, the UE and the network derive session keys, including the KeNB* (KeNB-star), which is used to encrypt and authenticate user data during the session.
10. Secure Communication Establishment:
    • With the derived session keys, the UE and the network establish secure communication channels, including the Radio Bearer Control (SRB) for signaling and the Radio Bearer Data (DRB) for user data. These channels are used for ongoing communication between the UE and the network.
11. Periodic Reauthentication:
    • To maintain security, LTE networks implement periodic reauthentication. The UE and the network go through the authentication process at predefined intervals to derive new session keys and ensure ongoing secure communication.
12. Access Control:
    • The authentication process serves as a mechanism for access control. Only UEs that successfully authenticate with valid credentials are allowed access to the LTE network.

By employing these steps, LTE networks verify the identity of UEs connecting to the network, ensuring that only authorized devices with valid credentials can access network resources. The AKA process enhances the security of LTE networks by protecting against unauthorized access and eavesdropping.