The USIM will not accept arbitrary jumps in sequence numbers, but only increases by a value of at most Δ.
Therefore (before applying the freshness conditions of Annex C.2.2
) the received sequence number SQN shall only be accepted by the USIM if SEQ-SEQ MS
≤ Δ. If SQN can not be accepted then the USIM shall generate a synchronisation failure message using SQN MS
Conditions on the choice of Δ:
Δ shall be sufficiently large so that the MS will not receive any sequence number with SEQ - SEQ MS > Δ if the HE/AuC functions correctly.
In order to prevent that SEQ MS ever reaches the maximum batch number value SEQmax during the lifetime of the USIM the minimum number of steps SEQmax /Δ required to reach SEQmax shall be sufficiently large.
The USIM shall maintain an array of a previously accepted sequence number components: SEQ MS
(0), SEQ MS
(1),… SEQ MS
(a-1). The initial sequence number value in each array element shall be zero.
To verify that the received sequence number SQN is fresh, the USIM shall compare the received SQN with the sequence number in the array element indexed using the index value IND contained in SQN, i.e. with the array entry SEQ MS
(i) where i = IND is the index value.
If SEQ > SEQ MS (i) the USIM shall consider the sequence number to be guaranteed fresh and subsequently shall set SEQ MS (i) to SEQ.
If SEQ ≤ SEQ MS (i) the USIM shall generate a synchronisation failure message using the highest previously accepted sequence number anywhere in the array, i.e. SQN MS.
The USIM shall also be able to put a limit L on the difference between SEQ MS
and a received sequence number component SEQ. If such a limit L is applied then, before verifying the above conditions (a) and (b), the sequence number shall only be accepted by the USIM if SEQ MS
- SEQ < L. If SQN can not be accepted then the USIM shall generate a synchronisation failure message using SQN MS
Using the above array mechanism, it is not required that a previously visited VLR/SGSN deletes the unused authentication vectors when a user de-registers from the serving network (super-charger concept). Retaining the authentication vectors for use when the user returns later may be more efficient as regards signalling when a user abroad switches a lot between two serving networks.
The array mechanism may also be used to avoid unjustified rejection of user authentication requests when authentication vectors in two VLR/SGSNs from different mobility management domains (circuit and packet) are used in an interleaving fashion.
When a VLR/SGSN uses fresh authentication vectors obtained during a previous visit of the user, the USIM can reject them although they have not been used before (because the array size a and the age limit L are finite). Rejection of a sequence number can therefore occur in normal operation, i.e., it is not necessarily caused by (malicious) replay or a database failure.
The mechanism presented in this clause may allow the USIM to exploit knowledge about which authentication vectors were sent to the same VLR/SGSN. It may be assumed that authentication vectors sent to the same VLR/SGSN are always used in the correct order. Consequently, only one sequence number among those sent to the same VLR/SGSN has to be stored.
With the exception of SQN MS , the entries of the array need not be stored in full length if a limit L (age limit) on the difference between SEQ MS and a received sequence number component SEQ is applied.
Condition (2) of Annex C.2.1 on Δ means that SQN MS can reach its maximum value only after a minimum of SEQmax /Δ successful authentications have taken place.
There is a dependency of the choice of Δ and the size n of global counter GLC in Annex C.1.1.1
: Δ shall be chosen larger than 2n