Method and system for safeguarding user access

Abstract

The invention provides a method and a system for safeguarding user access. The method is applied to an LTE (Long Term Evolution) system. UE accessing the LTE system issues an access safety activating command, verifies the integrity of a safe mode command message in an activating process and sends a verification failure message to a network side if verification fails, wherein preset discrimination information is added to the verification failure message, and the network side receives the verification failure message, detects whether the discrimination information is legal or not and restores the configuration before activation if the discrimination information is legal. In traditional NAS (Network Attached Storage) SMC (Self-Modifying Code) and AS SMC flows, the safeguarding of the verification failure message is enhanced so that the network side is hardly attacked by false messages.

Description

technical field [0001] The invention relates to the field of mobile communication, in particular to a method and system for user access security protection. Background technique [0002] 3GPP (Third Generation Partnership Project, Third Generation Partnership Project) long-term evolution (Long Term Evolution, referred to as LTE) system / system architecture evolution (System Architecture Evolution, referred to as SAE) communication access security adopts a layered security architecture mechanism, according to The hierarchical structure is divided into a Non Access Stratum (NAS for short) security mechanism and an Access Stratum (AS for short) security mechanism, each of which has its own independent security context. Among them, MME (Mobility Management Entity, mobile management entity) is responsible for initial establishment, configuration and management of the security context of NAS layer; eNB (evolved Node B, evolved node) is responsible for initial establishment, configu...

AI Technical Summary

Problems solved by technology

[0028] In this way, there will be a security problem: since the NAS security mode reject message returned by the UE to the MME and the AS security mode failure message of the eNB have not been protected, a network attacker can completely fake the UE and send these two messages to the MME or eNB, and the MME Or after eNB receives a fake NAS security mode reject message or AS security mode failure message, it will try to restart the NAS\AS SMC process, but it will still receive a fake message without security protection

In the end, because the security mechanism cannot be activated, the connection between the UE and the network side will be disconnected

As a result, the normal communication between the UE and the network side will be seriously interfered, making it impossible to communicate normally

Images