Method for preventing empty integrity protection algorithm from being used in normal communication and system thereof

Abstract

The invention discloses a method for preventing an empty integrity protection algorithm from being used in the normal communication, which is applied to a long term evolution (LTE) system or a system architecture evolution (SAE) system. The method comprises the following steps: a user equipment (UE) sends security capability to a network according to an attach request; a mobile management entity (MME) in the network ensures the type of the attach request is normal or non-urgent and then memorizes the UE security capability which indicates that the UE dose not support the empty integrity protection algorithm (EIAO). The corresponding system comprises the UE and the MME; the UE is used for sending the UE security capability to the MME by the attach request; the MME is used for determining the type of the attach request to be normal or non-urgent and then memorizing the UE security capability which indicates that the UE dose not support the EIAO. After the adoption of the invention, the use of EIAO is limited in normal communication and a network attacker cannot get around a normal security protection mechanism by starting the EIAO in normal networking.

Description

technical field [0001] The invention relates to an access security mechanism in a mobile communication system, in particular to a method and system for preventing a null integrity protection algorithm from being used in normal communication. Background technique [0002] The access security of the 3rd Generation Partnership Project (3rd Generation Partnership Project, 3GPP) long term evolution (Long Term Evolution, LTE) system / system architecture evolution (System Architecture Evolution, SAE) adopts a two-layer security architecture. That is to say, the security mechanisms of the Access Stratum (AS for short) and the Non Access Stratum (NAS for short) are separate, and each has its own independent security context. When a user equipment (User Equipment, UE for short) accesses an LTE / SAE network, the UE needs to first register with the network through an attach procedure (Attach procedure). If mutual authentication has not been performed between the UE and the network, the n...

AI Technical Summary

Problems solved by technology

In the above scenario, when the UE switches over the X2 interface, the network attacker can use the source eNB to send false information to the target eNB, deceiving the target eNB that the UE is currently making an emergency call. However, in the current technical specification, there is no special mechanism to make the target eNB During the X2 handover, the eNB confirms the current service status of the UE to the MME (only the MME and the UE can really know it). The MME only compares whether the UE security capabilities transmitted from the source eNB to the target eNB are correct. Support EIA0, MME will not prevent the target eNB from using the EIA0 algorithm, resulting in no security protection for the communication between the UE and the target eNB

Images