All wireless telecommunication networks (e.g. Wi-Fi, WiBro and LTE provide “user authentication” and “security over radio link (integrity check (protection/verification) and ciphering (or encryption))” features.

User authentication is required for network operators to ensure that only those who subscribe to them (i.e. paid subscribers) can access their networks. In wireless networks, there is no physical line (circuit line) connecting subscribers and the networks as in wired networks. Thus, security over the radio link is needed to prevent subscriber data from being intercepted and misused by someone over the air.
 
We will discuss the LTE authentication and security over the radio links below to give you a good understanding of the concept thereof. Detailed information about how “authentication and security” work will be difficult topics for beginners. So, a simple and easy, rather than detailed, explanation of the topics will be provided herein. 
 

Authentication

LTE uses a procedure called EPS-AKA for authentication between UE and the network. Here the authentication is “mutual”. That is, the network authenticates UE and UE also authenticates the network. First, in order to perform authentication, not only UE but also HSS (subscriber’s DB) should have IMSI, a unique subscriber ID, and LTE K, a LTE security key, and of course the two in UE and HSS should be identical. When a user subscribes to LTE service, the user is given USIM, which contains IMSI and LTE K, and HSS also be provisioned with the same information by the operator.

Later when the user turns on UE, UE requests the network for authentication by sending an Attach Request message. Upon receiving the message, MME (an entity that serves as a brain for the LTE radio access network) requests HSS for authentication vectors needed for authenticating the user using IMSI. Thereafter, MME, using this authentication information, authenticates the user, who also authenticates the network by generating and using authentication information as HSS did.

It was not easy to explain without mentioning further details. Anyway, we will come back to this topic later sometime and will move on to the next one.
 
Security over Radio Links
 
In wireless communication, “authentication” and “security” cannot be discussed separately. That is because once authentication between a user and the user’s network is performed successfully, a master key is generated as a result of such authentication. From the master key (i.e. KASME in LTE and MSK in WiBro), keys required for integrity check and ciphering (or encryption) over the radio links are derived using complicated algorithms.
Here, we will briefly go over what integrity check and ciphering are. 

• Integrity Check: Integrity check is the process that consists of integrity protection by a sender and integrity verification by a receiver. A sender uses its key and message (data to send) and derives, for example, a 32-bit value by using a certain algorithm. Then it sends the value (A) by attaching it at the end of the message. Then, the receiver of the message also uses the same key to derive a 32-bit value from the integrity protected received message by using the same algorithm, and checks whether the value is same as the value (A) attached at the end of the received message. If the message had been somehow manipulated by someone while being transmitted, the message would have been changed and also the 32-bit value derived by the receiver have become different from the one attached at the end of the message. That way, the receiver knows the message has been manipulated and then discards it.
• Encryption/Ciphering: It refers to the process of encryption/ciphering by a sender and deciphering or decryption by a receiver. The sender ciphers the message using its key and a certain algorithm and sends it to the receiver, who then decrypts it using the same key and algorithm. 

So, both UE and MME use this KASME to generate a key, KNASint (NAS=NAS message, int=Integrity) to be used in integrity check of messages sent between UE and MME (the messages transmitted between the two are called NAS messages. User data is never delivered to MME and only control messages are transmitted between UE and MME). They also generate KNASenc (enc=encryption), a key to be used in ciphering. This way, the messages sent between UE and MME are integrity protected and ciphered using these keys, and thus become secured.
 
Now, KRRCint (RRC=RRC message, int=Integrity) and KRRCenc (enc=encryption) for integrity check and ciphering of all control messages sent between UE and eNB are generated. Again, this way the control messages between UE and eNB are integrity protected and ciphered, and thus can be securely transmitted.
 
Finally, KUPenc (UP=User Plane, enc=encryption), a key to be used when all user data sent between UE and eNB (IP packets sent by user) is ciphered (but not integrity protected) is generated. Using this key, data sent between UE and eNB are ciphered for secure exchange.
 
You may feel like you haven’t even touched the core of LTE security. However, a detailed discussion of authentication and security over the radio links is not quite necessary for LTE beginners because there are so many other topics to cover, including LTE QoS, Attach Procedure, Handover, etc.
 

If you can just understand and remember "LTE performs mutual authentication between UE and the network using EPS-AKA. The traffic between UE and MME, and also between UE and eNB is integrity protected and ciphered and thus is very secured”, that would be enough for now.