5G-AKA Authentication and SUCI for Privacy

The Problem: Permanent Identity Exposure in 4G

A major privacy weakness in 2G, 3G, and 4G networks is the handling of the subscriber's permanent identity, the International Mobile Subscriber Identity (IMSI). During the initial connection to the network, the IMSI is transmitted over the radio interface in plaintext.

This allows for a simple but effective attack using an "IMSI Catcher" (also known as a Stingray). This device impersonates a legitimate cell tower and tricks nearby phones into connecting to it. By capturing the initial, unencrypted registration messages, it can harvest the IMSIs of all phones in the area. Since the IMSI is a permanent identifier tied to a specific SIM card, an attacker can use it to track a person's location and presence over time.

5G was designed from the ground up to fix this fundamental flaw.

The 5G Solution: Concealing Identity with SUPI and SUCI

To solve the identity exposure problem, 5G introduces two key concepts: the Subscription Permanent Identifier (SUPI) and the Subscription Concealed Identifier (SUCI).

To get a clear definition of these terms and their security goals, let's read a few sections from an article by the telecom security firm P1 Security.

As the article explains:

• SUPI is the 5G equivalent of the IMSI. It's a globally unique, permanent identifier for your subscription, stored securely on your SIM card (USIM) and in the network's database (UDM). It should never be sent unencrypted over the air.
• SUCI is what the phone sends instead. The phone's USIM uses a public key provided by the home network to encrypt the SUPI. This encrypted result is the SUCI.

Only the home network, specifically the Unified Data Management (UDM) function, holds the corresponding private key to "de-conceal" the SUCI and reveal the SUPI. A passive attacker on the radio link only sees the SUCI, which is useless without the private key.

The following image provides a high-level view of this identifier flow.

For a more detailed look at how SUCI is constructed, the following video gives a comprehensive breakdown.

The Process: 5G Authentication and Key Agreement (AKA)

Now that we understand how the identity is protected, let's see how it fits into the full authentication procedure, known as 5G-AKA. This is a challenge-response protocol designed to achieve two goals:

1. Mutual Authentication: The device proves its identity to the network, and the network proves its identity to the device. This prevents you from connecting to a fake network.
2. Key Generation: A successful authentication results in the generation of fresh cryptographic keys that are used to encrypt and integrity-protect all subsequent messages between the device and the network.

The process leverages the SBA we discussed previously, involving API calls between the AMF, AUSF, and UDM. Here is a simplified step-by-step overview:

1. Registration Request: The device initiates the process by sending a Registration Request to the AMF. Crucially, this message contains the SUCI, not the SUPI.

2. Authentication Vector Request:

   • The AMF forwards the authentication request to the Authentication Server Function (AUSF).
   • The AUSF sees the SUCI and requests an authentication vector from the UDM.
   • The UDM uses its private key to de-conceal the SUCI, revealing the subscriber's SUPI. It now knows who is trying to connect.
   • The UDM generates a challenge consisting of a random number (RAND) and an authentication token (AUTN). It also calculates an expected response (XRES*).
   • The UDM sends these vectors back to the AUSF.

3. Challenge to the Device: The AMF sends the Authentication Request message containing the RAND and AUTN to the device.

4. Challenge Validation and Response:

   • The device's USIM uses its stored secret key (K) to validate the AUTN. If the AUTN is valid, the device has successfully authenticated the network.
   • If validation passes, the USIM calculates a response (RES*) to the challenge and sends it back to the AMF in an Authentication Response message.

5. Final Verification and Key Derivation:

   • The AMF forwards the device's response to the AUSF.
   • The AUSF compares the device's RES* with the expected response XRES* it received from the UDM.
   • If they match, the authentication is successful! The AUSF notifies the AMF.
   • Both the device and the AMF can now independently derive a session key (K_AMF), which becomes the root for all further security keys used to encrypt traffic.

To see this process laid out in technical detail, please review the following guide.

Is 5G-AKA Unbreakable?

The combination of SUCI and 5G-AKA represents a massive leap forward in cellular security. However, no system is perfect. The security relies on correct implementation by device manufacturers and network operators.

Flaws in a specific device's baseband processor or misconfigurations in the core network can still lead to vulnerabilities that bypass these protections. For a glimpse into how these strong protocols can sometimes be circumvented in practice, watch this short clip from a Black Hat security conference presentation.

This serves as a critical reminder: a strong standard is necessary, but not sufficient. Security depends on the entire chain of implementation, which is where security researchers and hackers often focus their efforts.

Conclusion

In this lesson, we dissected the core of 5G's subscriber authentication and privacy mechanism. You've seen how 5G was explicitly designed to fix the long-standing IMSI-catching vulnerability of previous generations.

Key Takeaways:

• 5G protects subscriber privacy by replacing the plaintext IMSI with two identifiers: the permanent SUPI and the encrypted SUCI.
• The SUCI is sent over the air during initial registration, preventing passive eavesdroppers from capturing a user's permanent identity.
• The 5G-AKA protocol provides strong, mutual authentication. The device verifies the network's identity, and the network verifies the device's identity.
• A successful 5G-AKA procedure establishes the root keys that are used to encrypt and integrity-protect all subsequent user and control data, ensuring a secure communication channel.

Preview of the Next Lesson:

We have now covered the 5G core's architecture (SBA) and its primary authentication mechanism (AKA with SUCI). In our next and final lesson of this module, we will synthesize this knowledge to explain how 5G security features collectively aim to address known 4G vulnerabilities, providing a broader comparison and solidifying your understanding of 5G's security posture.