From my understanding this is how SIM authentication works:
- When the mobile device starts up it obtains IMSI from the SIM card and send it to the operator network
- Operator network finds the Ki(128 bit symmetric auth key) of the given IMSI generates RAND(a radnom number) and encrypts the RAND with Ki and that gives the value RAND_1, and also sends RAND to the mobile device which forwards it to the SIM card
- SIM card receives RAND and encrypt it using Ki and calculates RAND_2 and sends it trough mobile device to operator network
- Operator network compares RAND_1 and RAND_2 and if they are equal the SIM is succesfully authenticated to the network
So, that's how the SIM authenticates itself to the network. But, how does the network prooves it's identity. Someone could easily set up their own tower and act like the operator network?