Definition
Authentication protocols are used to verify the identity of users or devices and are the entry point to the security architecture. Cellular networks use AKA (Authentication and Key Agreement), which completes mutual authentication based on the K key in the USIM and the network-side AuC/UDM, and derives session keys (KASME/KAMF) for subsequent air interface encryption and integrity protection. Access authentication and EAP are used in non-cellular or private network scenarios.
Types and Processes
- AKA: 3G/4G cellular authentication, where the network sends RAND/AUTN, the terminal calculates RES using K, and compares it with the network-side XRES to complete mutual authentication
- 5G AKA: 5G enhanced authentication, supports SUCI (Subscription Concealed Identifier) to protect privacy, EAP-AKA' is used for non-3GPP access
- EAP: Extensible Authentication Protocol, supports EAP-SIM, EAP-AKA, EAP-TLS, etc., used for Wi-Fi, VPN, private networks
Security Functions
Authentication prevents unauthorized access, cloned cards, and fake base station attacks; the keys derived after successful authentication are used for encryption and integrity, achieving end-to-end security. IoT devices use IoT-specific SIMs (eSIM/iSIM), supporting remote configuration and secure key storage.
Typical Use Cases
Cellular network access, private network access, RADIUS authentication, device identity verification, etc. SimtoLink's IoT SIM cards support standard AKA, ensuring devices legally access the operator network.
SimtoLink's IoT SIM cards support standard AKA authentication, ensuring devices' legal access to the operator network. The SimtoLink cloud platform can connect to authentication status, enabling visual management of device identity and security policies, providing IoT customers with secure and reliable connectivity assurance.
How the sequence number inside an authentication token blocks replay
The network challenge in AKA is not only a random number. The authentication token also carries a sequence number and a message authentication code computed with the long-term key. The device first checks that code, to confirm the challenge came from a network that holds the same key, then checks whether the sequence number falls inside an acceptable window. A challenge outside the window is dropped as a replay. The device sends a synchronization failure instead of a response. Comparing only the response, and not the sequence number, lets a cloned old challenge carry the procedure further.
The card and the network each keep a sequence number. If the card has been off the network for a long time, or the authentication center was replaced without a resynchronization, the two windows drift apart. The symptom is that every attach fails, and the failure reason stays on synchronization rather than looking like random radio loss. The remedy is to let the network accept one resynchronization and push the card sequence number into the current window, not to replace the module firmware.
A mismatched response and a synchronization failure are not the same cause
If the response the device computes does not match what the network expects, the two sides are using different long-term keys or different algorithm suites. A synchronization failure means the keys may still match and only the sequence number is behind or ahead. The first case needs a check of whether the card data was written wrong, or written into another card’s key slot. The second needs the freshness of the authentication vector and whether the device used a cached old challenge. If both cause codes are written as “authentication failed,” the site will reseat the card while the problem sits in the core-network vector cache.
5G AKA also requires the subscriber identity to be concealed. The device wraps the identity with the home-network public key and sends a concealed identity. The network can find the matching key only after it restores the identity. If restoration fails, the procedure stops before user data is fetched and never reaches the response comparison. Checking whether the public key matches, and whether an intermediate device truncated the concealed identity, is more direct than checking signal strength.
Non-3GPP access still has to land on the same set of credentials
EAP-AKA' embeds AKA in the extensible authentication framework for wireless LAN or untrusted access. The extra mark in the method name means the key-derivation inputs are not identical to cellular AKA. A session key already derived on the cellular side cannot be reused as the wireless-LAN authentication key. Certificate-based EAP-TLS does not read the long-term key in the card at all. The server checks the certificate chain and the signature from the private key. If the same device uses the card for cellular and a certificate for wireless LAN, the two identities must be provisioned separately. Revoking one does not automatically turn the other off.
A SimtoLink IoT SIM card holds the long-term key and the identity that operator AKA needs. The authentication protocol runs between the card and the core network. Passing AKA only means the cellular identity was accepted. An application account on a private network or a device cloud still needs its own authentication. If the platform shows the card online and the service login fails, read the AKA result and the application credential separately. Do not reset the card to fix an expired certificate.
Vectors used in a visited network still have to be checked at home
After the device leaves the home network, the visited network does not hold the long-term key. It asks the home side for authentication vectors, then runs AKA with the device using those vectors. If a vector is cached in transit, reused, or its sequence window does not match, the failure shows up in the visited network and the root is freshness on the home side. Restarting only the visited base station brings the failure back if the next vector is still old. The test is: the same card works at home and fails synchronization as soon as it is in the visited network. Check whether the vector request actually reaches the home authentication center before changing the visited antenna.
Only the home network can restore a concealed identity. If the visited network truncates or rewrites the identity, the home side cannot find the subscriber, the procedure ends before the key is fetched, and it never reaches the response comparison. Whether a SimtoLink IoT SIM card can roam depends on whether the subscription allows it and whether the visited network has the radio standard open. The authentication protocol itself does not switch to another long-term key while roaming. The platform should show home attach and roaming attach separately. If roaming fails and the home network is normal, resetting the card usually does not help. Check roaming permission and whether the visited network reused a vector.