MAP Send Authentication Info for GSM Security
MAP Send Authentication Info is the Mobile Application Part operation used in GSM to move authentication material from a Home Location Register to a Visitor Location Register. It belongs to the SS7 application layer, not the radio interface.
Its mechanics still matter for legacy training, migration and incident reconstruction, particularly in Australia, where cellular generations have been retired while archived signaling and subscriber records remain important.
Role of the MAP operation
The serving VLR needs a subscriber’s expected response and ciphering material before it can complete GSM authentication. Normally, the HLR obtains an authentication triplet from the Authentication Centre and sends it to the VLR with MAP-Send-Authentication-Info, following a location-update or roaming procedure.
| Aspect | MAP Send Authentication Info | MAP Request Authentication Info |
|---|---|---|
| Purpose | Delivers a GSM authentication triplet to the VLR | Asks the AuC to generate authentication data |
| Typical direction | HLR to VLR | HLR to AuC |
| Typical result | RAND, SRES and Kc become available to the VLR | The AuC returns RAND, SRES and Kc |
| Trust boundary | HLR–VLR signaling | HLR–AuC signaling |
These operations solve different problems. Request Authentication Info asks for fresh material; Send Authentication Info delivers that material to the node that will challenge the handset. The distinction prevents an AuC from being confused with a VLR or an authentication response from being mistaken for a subscriber-data update.
Path through the signaling stack
MAP encodes the operation using ASN.1 Basic Encoding Rules and carries it in a TCAP transaction. TCAP uses SCCP for end-to-end signaling addressing, while SCCP relies on MTP3 routing and MTP2 links. In many deployments, signaling ran over a national SS7 network; SIGTRAN later provided IP-based transport for equivalent signaling systems.
During analysis, correlate the MAP invoke and response, TCAP transaction identifier, IMSI, serving VLR and originating HLR. A valid delivery does not mean the subscriber was successfully authenticated: it only shows that one network node supplied material to another. The protocol training library offers useful background on the surrounding MAP, TCAP and MTP layers.
Authentication data and verification
In classic GSM, the triplet contains RAND, SRES and Kc. RAND is the challenge, SRES is the expected response, and Kc is the key used for voice encryption. These values are associated with a subscriber identity and the network’s authentication algorithm.
The subscriber’s secret Ki stays inside the SIM. The VLR passes RAND to the handset over the air interface; the SIM computes SRES with A3 and derives Kc with A8. The network compares the returned SRES with its expected value. MAP moves the network-side values, while the challenge-response exchange itself occurs between the VLR and SIM.
Security consequences of legacy signaling
The sensitive part is that Kc can appear in clear form within MAP signaling between network nodes, subject to the protections of the underlying links and gateways. An intruder with access to intercepted signaling could gain more than subscriber metadata, although actual exploitation still depends on position, timing and network reachability.
Early SS7 networks relied heavily on network trust, perimeter control and specialised firewalls. Modern defences include tightly restricted SCCP routing, access-controlled signaling gateways, anomaly detection, strong separation between operational domains and authenticated IP transports. Retiring an interface remains effective when the old protocol is genuinely unreachable.
Australian network realities
Australia’s major carriers—Telstra, Optus and the Vodafone/TPG business—have retired 2G, and Telstra and Optus completed their 3G switch-offs in 2024. Operations teams commonly talk about “the mobile network”, “handset coverage” and “mobile outages”, reflecting a market where reliability and national roaming carry commercial weight.
Conditions vary sharply between Sydney, Melbourne and Brisbane and remote areas of Western Australia and the Northern Territory. Mining, pastoral and road-corridor users depend on regional coverage, satellite options or specialised enterprise networks. Triple Zero 000 calling also makes accurate subscriber location and modern voice-over-LTE or 5G fallback operationally significant.
ACMA regulates the communications market, while the Australian Signals Directorate’s ACSC publishes security guidance for telecommunications. Operators must also account for the Telecommunications Act 1997, the Telecommunications (Interception and Access) Act 1979 and privacy obligations. Connected parking systems offer an adjacent identity lesson: smart parking resources concern a different industry, but trusted-device access still requires explicit boundaries.
Checks and durable lessons
When reviewing traces or reconstructing a retired GSM flow, check the following details:
- Confirm the HLR, VLR and AuC roles and operation direction.
- Match RAND, SRES and Kc fields to the subscriber identity.
- Correlate TCAP transaction IDs with the location-update event.
- Separate SS7 delivery from the over-the-air SIM challenge.
For a lab or migration environment, apply these controls:
- Isolate legacy signaling and remove unnecessary interconnects.
- Restrict SCCP destinations, gateway access and administrative privileges.
- Alert on unusual authentication requests and repeated triplet requests.
- Use authenticated IP transports and reauthentication for active networks.
The lasting point is that MAP Send Authentication Info moved trust-sensitive GSM material across the network. Protecting the HLR–VLR path was therefore as important as protecting the SIM challenge itself.
