the HLR. These include a signed response, random number, and ciphering key. Each triplet is used only once and AuC delivers new triplets on demand. The principle of authentication is to compare the subscriber authenti- cation key Ki in the authentication center and in the SIM without ever send- ing the Ki on the radio path. For authentication the network sends a random number to the mobile at the beginning of each call. The SIM then uses an algorithm, A3, to process a response that is dependent on the random number as well as on the secret subscriber specific key stored in the SIM. The Authentication and IMEI check Mobile station MSC/VLR HLR/AuC/EIR Authentication Authentication triplet Mobile IMEI check equipment Encryption of speech and data Mobile station Encrypted Plain speech MSC/VLR Mobile subscriber identity AuC = Authentication center Mobile station MSC/VLR TMSI1 EIR = Equipment identity register IMSI= IMSI = TMSI1 SIM = Subcriber identity module Reallocation TMSI1 IMSI = International mobile TMSI2 IMSI= subcriber identity IMSI = TMSI1 TMSI2 TMSI = Temporary MSI Figure 5.15 The security functions of GSM. Mobile Communications AuC has also computed this response, called signed response (SRES), and delivered it in the authentication triplet to the VLR. The VLR performs a comparison and if they match, the MS is allowed to use the network. 5.6.4.2 IMEI Check The international mobile equipment identity (IMEI) check procedure is used to ensure that the mobile equipment does not belong to the black list where the EIR stores the serial numbers of stolen mobiles. If an IMEI is found on the black list, a connection cannot be established. The IMEI is a manufacturer-specific code that is stored in each piece of mobile equipment when manufactured. 5.6.4.3 Encryption of Speech and Data Speech and data are encrypted before forwarding the radio or air interface. The main algorithm for ciphering is A5, which defines how the ciphering sequence is generated. For encryption an exclusive-or operation is performed with data an