Method and apparatus for supplying key for base station authentication in wireless communication system

Abstract

The present disclosure relates to a 5G or 6G communication system for supporting a higher data transmission rate. A method and apparatus in a wireless communication system are provided. System information is received from a base station. The system information includes information related to a public key of the base station. It is determined whether a public key corresponding to the information related to the public key is stored in the terminal. In a case where the public key is stored in the terminal and the system information includes signature information of the base station, the signature of the base station is verified. Based on whether the signature of the base station is verified, the base station is connected to or searched for another base station.

Description

Technical Field

[0001] The present disclosure generally relates to a method and apparatus for supplying a key for base station authentication in a wireless communication system, and more specifically, to a method and apparatus for a base station in a wireless communication system by which a base station signs and broadcasts system information, and a terminal supplied with a key for authenticating the system information. Background Art

[0002] 5G mobile communication technology defines a wide frequency band, making high transmission rates and new services possible, and can be realized not only in "below 6 GHz" frequency bands such as 3.5 GHz, but also in "above 6 GHz" frequency bands called mmWave including 28 GHz and 39 GHz. In addition, 6G mobile communication technology (called super 5G system) has been considered to be implemented in terahertz (THz) frequency bands (e.g., 95 GHz to 3 THz frequency bands) to achieve a transmission rate 50 times faster than 5G mobile communication technology and an ultra-low latency of one-tenth of 5G mobile communication technology.

[0003] In the early stages of 5G mobile communication technology development, in order to support services and meet performance requirements associated with enhanced mobile broadband (eMBB), ultra-reliable low latency communications (URLLC), and massive machine type communications (mMTC), standardization has been underway on beamforming and massive MIMO for mitigating radio wave path loss and increasing radio wave transmission distance in mmWave, support for dynamic operation of parameter sets (e.g., operating multiple subcarrier spacings) and slot formats for efficient utilization of mmWave resources, initial access technology for supporting multi-beam transmission and broadband, definition and operation of bandwidth parts (BWPs), new channel coding and decoding methods (such as low-density parity-check (LDPC) codes for large amounts of data transmission and polar codes for highly reliable control information transmission), L2 preprocessing, and standardization of network slicing for providing dedicated networks dedicated to specific services.

[0004] Currently, discussions are underway on improvements and performance enhancements of initial 5G mobile communication technologies in consideration of the services that 5G mobile communication technologies will support, and there is already physical layer standardization on technologies such as Vehicle-to-Everything (V2X) for assisting driving determination of autonomous vehicles based on information about the location and status of vehicles transmitted by vehicles and for enhancing user convenience, NR-U (New Radio Unlicensed) designed for system operation to comply with various regulatory-related requirements in unlicensed frequency bands, NR UE power saving, Non-Terrestrial Network (NTN) which is UE-satellite direct communication for providing coverage in areas where communication with terrestrial networks is unavailable, and positioning.

[0005] In addition, standardization is being conducted in air interface architecture / protocols on technologies such as Industrial Internet of Things (IIoT) for supporting new services through interworking and convergence with other industries, Integrated Access and Backhaul (IAB) for providing nodes for network service area expansion by supporting wireless backhaul links and access links in an integrated manner, mobility enhancement including conditional handover and dual active protocol stack (DAPS) handover, and two-step random access (2-step RACH for NR) for simplifying the random access procedure. Standardization is also being conducted in system architecture / services on 5G baseline architecture (e.g., service-based architecture or service-based interface) for combining network function virtualization (NFV) and software defined network (SDN) technologies, and mobile edge computing (MEC) for receiving services based on UE location.

[0006] As 5G mobile communication systems are commercialized, an exponentially growing number of connected devices will be connected to the communication network, and therefore, it is expected that enhanced functions and performance of 5G mobile communication systems and integrated operations of connected devices will be necessary. To this end, new research is planned in relation to efficient support for extended reality (XR) such as augmented reality (AR), virtual reality (VR), mixed reality (MR), etc., 5G performance improvement and complexity reduction by utilizing artificial intelligence (AI) and machine learning (ML), AI service support, metaverse service support, and drone communication.

[0007] Furthermore, such development of 5G mobile communication systems will serve as a foundation for developing not only new waveforms for providing coverage in the terahertz band for 6G mobile communication technology, multi-antenna transmission technologies (such as full-dimensional MIMO (FD-MIMO), array antennas, and large antennas), metamaterial-based lenses and antennas for improving coverage of terahertz band signals, high-dimensional spatial multiplexing technologies using orbital angular momentum (OAM), and reconfigurable smart surfaces (RIS), but also full-duplex technologies for improving frequency efficiency of 6G mobile communication technology and improving system networks, AI-based communication technologies for implementing system optimization by utilizing satellites and artificial intelligence (AI) from the design stage and internalizing end-to-end AI support functions, and next-generation distributed computing technologies for implementing services with a complexity level that exceeds the limits of UE operating capabilities by utilizing ultra-high performance communication and computing resources.

[0008] As described above, according to the development of wireless communication systems, open source tools and hacker techniques that make it easy to create fake base stations and mobile communication terminals have also emerged. With the development of such technology, it has become easier for attackers to conduct denial-of-service (DoS) attacks on users and communication service providers by using fake base stations. Therefore, a method for preventing DoS attacks from fake base stations is needed. Summary of the invention

[0009] Solution to the problem

[0010] An aspect of the present disclosure provides an apparatus and method for providing smooth efficiency for transmission or reception of a signal for base station authentication in a wireless communication system.

[0011] According to an embodiment, a method performed by a terminal in a wireless communication system is provided. The method includes receiving system information from a base station. The system information includes information related to a public key of the base station. Determining whether a public key corresponding to the information related to the public key is stored in the terminal. In the case where the public key is stored in the terminal and the system information includes signature information of the base station, verifying a signature of the base station. Based on whether the signature of the base station is verified, connecting to the base station or searching for another base station.

[0012] According to an embodiment, a method performed by an access and mobility management function (AMF) in a wireless communication system is provided. A registration request message is received from a terminal and includes information about a first list of public keys held by the terminal or an indicator indicating that a public key of a base station is not stored at the terminal. An encryption and integrity protection algorithm is identified based on the registration request message. A non-access stratum (NAS) command message is sent to the terminal based on the registration request message and the identified encryption and integrity algorithm.

[0013] According to an embodiment, a terminal in a wireless communication system may include at least one transceiver, and at least one processor functionally coupled to the at least one transceiver. The at least one processor is configured to receive system information from a base station. The system information includes information related to a public key of the base station. Determine whether a public key corresponding to the information related to the public key is stored in the terminal. In the case where the public key is stored in the terminal and the system information includes signature information of the base station, verify the signature of the base station. Based on whether the signature of the base station is verified, connect to the base station or search for another base station.

[0014] According to an embodiment, an AMF in a wireless communication system may include at least one transceiver, and at least one processor functionally coupled to the at least one transceiver. The at least one processor is configured to receive a registration request message from a terminal, the registration request message including information about a first list of public keys held by the terminal or an indicator indicating that the public key of the base station is not stored at the terminal, identify an encryption and integrity protection algorithm based on the registration request message, and send a NAS command message to the terminal based on the registration request message and the identified encryption and integrity algorithm.

[0015] Various embodiments of the present disclosure may provide an apparatus and a method for efficiently providing a service in a wireless communication system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above and other aspects, features and advantages of the present disclosure will become more apparent from the following detailed description in conjunction with the accompanying drawings, in which:

[0017] 1A is a diagram illustrating a communication network including a core network entity in a wireless communication system according to an embodiment;

[0018] 1B is a diagram showing a wireless environment including a core network in a wireless communication system according to an embodiment;

[0019] 2A is a diagram showing an example of a functional structure of a terminal according to an embodiment;

[0020] 2B is a diagram showing an example of a functional structure of a base station according to an embodiment;

[0021] 2C is a diagram showing an example of a functional structure of a core network entity according to an embodiment;

[0022] 3 is a diagram showing an example of a process for a terminal to receive a signal for verifying a public key of a base station according to an embodiment;

[0023] 4 is a diagram showing an example of a process for a terminal to receive a signal for verifying a public key of a base station according to an embodiment;

[0024] 5 is a diagram showing a detailed operation flow of a terminal receiving a public key for verifying a base station according to an embodiment;

[0025] 6 is a diagram showing an operation flow of a terminal receiving a public key for authenticating a base station according to an embodiment; and

[0026] FIG. 7 is a diagram illustrating an operational flow in which an AMF supplies a public key for authenticating a base station to a terminal according to an embodiment. DETAILED DESCRIPTION

[0027] The terms used in this disclosure are only used to describe specific embodiments and are not intended to limit the present disclosure. Singular expressions may include plural expressions unless they are clearly different in context. Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those commonly understood by those skilled in the art to which the present disclosure belongs. Unless clearly defined in the present disclosure, those terms as defined in commonly used dictionaries may be interpreted as having the same meaning as the contextual meaning in the relevant field, and should not be interpreted as having an ideal or overly formal meaning. In some cases, even the terms defined in the present disclosure should not be interpreted as excluding embodiments of the present disclosure.

[0028] Hereinafter, various embodiments of the present disclosure are described based on a hardware method. However, various embodiments of the present disclosure include techniques using both hardware and software, and therefore, various embodiments of the present disclosure may not exclude the software perspective.

[0029] The 3rd Generation Partnership Project (3GPP), which manages cellular mobile communication standards, has introduced a new core network structure called 5G Core (5GC) and has standardized it in order to promote the evolution from the traditional 4G LTE system to the 5G system (5GS). Compared with the Evolved Packet Core (EPC) which is the network core of the existing 4G, 5GC can support the following distinguishable functions.

[0030] First, in 5GC, the network slicing function is introduced. According to the requirements of 5G, 5GC is required to support various types of terminal types and services (for example, eMBB, URLLC or mMTC services). Various types of services have different requirements for the core network. For example, eMBB services require high data rates, while URLLC services require high stability and low latency. One of the technologies proposed to meet these various service requirements is network slicing.

[0031] Network slicing is a method of virtualizing one physical network to create several logical networks, and each network slice instance (NSI) can have different characteristics. Therefore, each NSI can have a network function (NF) that matches its characteristics, so various service requirements can be met. When an NSI suitable for the characteristics of the required service is allocated to each terminal, various 5G services can be efficiently supported.

[0032] Secondly, 5GC can easily support the network virtualization paradigm by separating the mobility management function and the session management function. In 4G Long Term Evolution (LTE), services can already be provided through signaling exchanges with a single core device, which is a mobility management entity (MME) used as registration, authentication, mobility management, and session management functions for all terminals. However, in 5G, the number of terminals has grown explosively, and the mobility and traffic / session characteristics that need to be supported are subdivided according to each terminal type. Therefore, if a single device such as MME supports all functions, the reduction in scalability indicating the addition of entities for each required function is inevitable. Therefore, in order to improve the scalability in terms of signaling load and the functional / implementation complexity of the core device responsible for the control plane, various functions are being developed based on a structure that separates the mobility management function from the session management function.

[0033] With the development of open source tools and hacker techniques that make it easy to make fake base stations and mobile communication terminals, it has become easier for attackers to conduct DoS attacks on users and communication service providers by using fake base stations. Therefore, a method for preventing DoS attacks from fake base stations is needed. For example, there may be an attack on system information (SI) (hereinafter, SI may include SI messages or SI blocks) in a message broadcast by a base station. The fake base station can modify and broadcast SI messages. When the terminal uses the SI message sent by the fake base station, the terminal may reside on a fake base station instead of a base station that the terminal needs to access. The fake base station can relay messages between the terminal and the base station that the terminal needs to access. If the message is not encrypted, the fake base station can identify the information included in the message, and if the message is encrypted, the fake base station can intercept and discard packets to prevent users from receiving the desired services.

[0034] SI is a message broadcast to all UEs, and its protection was not strongly required in the past. However, since the development of open source tools and hacker techniques has promoted attacks using fake base stations, fake base stations can attack terminals by using SI messages sent by base stations that the terminal needs to access (for example, this is used with the term "real base station") to make the terminal reside on the fake base station. Therefore, there is a need to enable the terminal to determine whether the SI is sent by a real base station by protecting the SI. Security technologies for retransmission prevention and integrity protection need to be applied to prevent fake base stations from modifying and using system information. In addition, research on asymmetric key-based signature technology is also developing. Asymmetric key-based signature technology may include certificate-based asymmetric key signature technology and ID-based asymmetric key signature technology. Various embodiments of the present disclosure provide a method and device for supplying a public key for verifying SI signed by a base station to a terminal when using an asymmetric key-based signature technology.

[0035] According to an embodiment of the present disclosure, a pseudo base station is a base station that a terminal does not want to access, which is different from a real base station that the terminal needs to access, and can be referred to as an attacking base station, a pseudo base station, or various expressions similar or equivalent thereto. In addition, a real base station is a base station that a terminal needs to access, and can be referred to as a victim base station, a real base station, or various expressions similar or equivalent thereto. The operations described below may mainly indicate operations between a terminal and a real base station, and in this case, the base station may indicate a real base station that the terminal needs to access.

[0036] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. When describing the embodiments of the present disclosure, a detailed description of known functions or configurations incorporated herein will be omitted when it is determined that the description may make the subject matter of the present disclosure unnecessarily unclear.

[0037] In the accompanying drawings, some elements may be enlarged, omitted or schematically shown. In addition, the size of each element does not fully reflect the actual size. In the accompanying drawings, the same or corresponding elements are provided with the same or corresponding reference numerals.

[0038] In this article, it will be understood that each box of the flowchart diagram and the combination of boxes in the flowchart diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a component for realizing the function specified in one or more flowchart boxes. These computer program instructions can also be stored in a computer-available or computer-readable memory, which can instruct the computer or other programmable data processing device to act in a particular way, so that the instructions stored in the computer-available or computer-readable memory produce an article of instruction components including the function specified in one or more flowchart boxes. The computer program instructions can also be loaded on a computer or other programmable data processing device, so that a series of operating steps are performed on a computer or other programmable device, thereby generating a computer-implemented process, so that the instructions executed on a computer or other programmable device provide steps for realizing the function specified in one or more flowchart boxes.

[0039] In addition, each box of the flowchart diagram can represent a module, a fragment or a portion of a code, which includes one or more executable instructions for implementing one or more specified logical functions. In some alternative implementations, the functions marked in the box may not occur in order. For example, two boxes shown in succession can actually be executed substantially simultaneously, or these boxes can sometimes be executed in reverse order, depending on the functions involved.

[0040] As used in the embodiments of the present disclosure, a unit refers to a software element or a hardware element that performs a predetermined function, such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC). However, the term "unit" does not always have a meaning limited to software or hardware. A unit can be constructed to be stored in an addressable storage medium or to execute one or more processors. Therefore, a unit includes, for example, a software element, an object-oriented software element, a class element or a task element, a process, a function, a property, a procedure, a subroutine, a program code segment, a driver, a firmware, a microcode, a circuit, data, a database, a data structure, a table, an array, and a parameter. The elements and functions provided by the unit can be combined into a smaller number of elements or units, or divided into a larger number of elements or units. In addition, elements and units can be implemented as one or more CPUs in a reproduction device or a secure multimedia card.

[0041] In this document, a base station is an entity that allocates resources to a terminal, and may be at least one of an eNode B (eNB), a Node B, a base station (BS), a radio access network (RAN), an access network (AN), a RAN node, an NR Node B (NB), a gNode B (gNB), a wireless access unit, a base station controller, and a node on a network. A terminal may include a UE, a mobile station (MS), a cellular phone, a smart phone, a computer, or a multimedia system capable of performing a communication function. In addition, in the following description of various embodiments, a system based on LTE, LTE-A, or NR may be described by way of example, but various embodiments of the present disclosure may also be applied to other communication systems with similar technical backgrounds or channel types. In addition, based on the determination of those skilled in the art, the embodiments of the present disclosure may also be applied to other communication systems with some modifications without significantly departing from the scope of the present disclosure.

[0042] In this document, for the convenience of description, terms used to identify access nodes, terms referring to network entities, terms referring to messages, terms referring to interfaces between network entities, terms referring to various identification information, etc. are illustratively used. Therefore, the present disclosure is not limited to the terms used below, and other terms referring to subjects with equivalent technical meanings may be used.

[0043] The present disclosure explains various embodiments with the help of terms used in some communication specifications (e.g., the Third Generation Partnership Project (3GPP)), but these terms correspond only to examples. The various embodiments of the present disclosure can also be easily modified and then applied to other communication systems. In the following, some terms used in the core network of the present disclosure are predefined.

[0044] AMF access and mobility management function

[0045] CN Core Network

[0046] CNF containerized network functions

[0047] DNN data network name

[0048] PCF policy control function

[0049] HSS Home Subscriber Server

[0050] SMF session management function

[0051] UDM User Data Management

[0052] UPF user plane function

[0053] CNF containerized network functions

[0054] VNF Virtual Network Function

[0055] 1A is a diagram showing a communication network including a core network entity in a wireless communication system according to an embodiment. The 5G mobile communication network may include a 5G UE 110, a 5G RAN 120, and a 5G core network.

[0056] The 5G core network may include network functions including AMF 150 that provides mobility management functions for UE, SMF 160 that provides session management functions, UPF 170 that performs a data transfer role, PCF 180 that provides policy control functions, UDM 153 that provides functions for managing data (such as subscriber data and policy control data), or a unified data repository (UDR) that stores data for various network functions.

[0057] 1A, a terminal (e.g., UE) 110 may perform communication through a wireless channel (i.e., access network) established between the terminal and a base station (e.g., eNB or gNB). The terminal 110 is a device used by a user and may be a device configured to provide a user interface (UI). For example, the UE 110 may be a terminal equipped in a vehicle for driving. Alternatively, the terminal 110 may be a device that performs machine type communication (MTC) that operates without user involvement, or an autonomous driving vehicle. The UE may also be referred to as an electronic device, a terminal, a vehicle terminal, a mobile station, a subscriber station, a remote terminal, a wireless terminal, a user equipment, or other terms having technical meanings equivalent thereto. As a terminal, in addition to the UE, a customer premises equipment (CPE) or a dongle-type terminal may also be used. The CPE may be connected to a next generation radio access network (NG-RAN) node (such as a UE) and provide a network to other communication devices (e.g., a laptop).

[0058] The AMF 150 may provide functions for mobility management and access in a unit of the terminal 110, and the terminal 110 may be connected to one AMF 150. Specifically, the AMF 150 may perform at least one of the following functions: signaling between core network nodes for mobility between 3GPP access networks, an interface (e.g., N2 interface) with the radio access network (e.g., 5G RAN) 120, NAS signaling with the terminal 110, identification of the SMF 160, and transmission and provision of session management (SM) messages between the terminal 110 and the SMF 160. Some or all functions of the AMF 150 may be supported in a single instance of one AMF 150.

[0059] The SMF 160 may provide session management functions, and when the terminal 110 has multiple sessions, these sessions may be managed by different SMFs 160. Specifically, the SMF 160 may perform at least one of the following functions: session management (e.g., session establishment, modification, and release maintained with a tunnel between the UPF 170 and the access network node), selection and control of user plane (UP) functions, traffic steering configuration for routing traffic from the UPE 170 to an appropriate destination, entities of the SM part of the NAS message, downlink data notification (DDN), initiator of AN-specific SM information (e.g., transmitted to the access network via the AMF 150 through the N2 interface). Some or all of the functions of the SMF 160 may be supported in a single instance of one SMF 160.

[0060] In the 3GPP system, the conceptual link connecting the NFs in the 5GS may be referred to as a reference point. A reference point may also be referred to as an interface. The following description illustrates reference points included in the 5GS architecture represented in various embodiments of the present disclosure (hereinafter, this is used together with an interface).

[0061] -N1: Reference point between UE 110 and AMF 150

[0062] -N2: Reference point between (R)AN 120 and AMF 150

[0063] -N3: Reference point between (R)AN 120 and UPF 170

[0064] -N4: Reference point between SMF 160 and UPF 170

[0065] -N5: Reference point between PCF 180 and AF 130

[0066] -N6: Reference point between UPF 170 and DN 140

[0067] -N7: Reference point between SMF 160 and PCF 180

[0068] -N8: Reference point between UDM 153 and AMF 150

[0069] -N9: Reference point between two cores UPF 170

[0070] -N10: Reference point between UDM 153 and SMF 160

[0071] -N11: Reference point between AMF 150 and SMF 160

[0072] -N12: Reference point between AMF 150 and Authentication Server Function (AUSF) 151

[0073] -N13: Reference point between UDM 153 and authentication server function 151

[0074] -N14: Reference point between two AMF 150

[0075] - N15: Reference point between PCF 180 and AMF 150 in non-roaming scenarios, and between AMF 150 and PCF 180 in the visited network in roaming scenarios

[0076] Fig. 1B is a diagram showing a wireless environment including a core network in a wireless communication system according to an embodiment. Referring to Fig. 1B, the wireless communication system includes a RAN 120 and a CN.

[0077] RAN 120 is a network directly connected to UE (e.g., terminal 110) and an infrastructure that provides wireless access to terminal 110. RAN 120 includes a set of multiple base stations including base station 125, and multiple base stations can perform communication through interfaces established between them. At least some of the interfaces between multiple base stations may be wired or wireless. Base station 125 may have a structure in which a central unit (CU) and a distributed unit (DU) are separated from each other. In this case, one CU may control multiple DUs. Base station 125 may also be referred to as access point (AP), gNB, 5G node, wireless point, transmission / reception point (TRP) or other terms with equivalent technical meanings. Terminal 110 accesses radio access network 120 and communicates with base station 125 through a wireless channel. Terminal 110 may also be referred to as UE, mobile station, subscriber station, remote terminal, wireless terminal, user equipment or other terms with equivalent technical meanings.

[0078] CN is a network that manages the entire system, and controls RAN 120 and processes data and control signals for terminal 110, which are sent or received via RAN 120. CN performs various functions, including controlling user plane and control plane, handling of mobility, management of subscriber information, charging, and linking to different types of systems (e.g., LTE system). In order to perform various functions, the core network may include multiple entities having different NFs and functionally separated from each other. For example, CN 200 may include AMF 150, SMF 160, UPF 170, PCF 180, Network Repository Function (NRF) 159, UDM 153, Network Exposure Function (NEF) 155, and UDR 157.

[0079] The terminal 110 accesses the AMF 150 connected to the RAN 120 and performs a mobility management function for the core network. The AMF 150 is a function or device that serves both access to the radio access network 120 and mobility management for the terminal 110. The SMF 160 is an NF that manages sessions. The AMF 150 is connected to the SMF 160, and the AMF 150 routes session-related messages for the terminal 110 to the SMF 160. The SMF 160 is connected to the UPF 170 and allocates user plane resources to be provided to the terminal 110, and establishes a tunnel between the base station 125 and the UPF 170 for data transmission. The PCF 180 controls information related to charging and policies for sessions used by the terminal 110.

[0080] The NRF 159 performs a function of storing information about NFs installed in the mobile communication service provider network and notifying the stored information. The NRF 159 can be connected to all NFs. When the service provider network operates each NF, each NF is registered in the NRF 159, thereby notifying the NRF 159 that the corresponding NF is being operated in the network. The UDM 153 is an NF that fulfills a role similar to that of a Home Subscriber Server (HSS) of a 4G network, and stores subscription information of the terminal 110 or a context used by the terminal 110 in the network.

[0081] NEF 155 will fulfill the third (3 rd ) The role of connecting a third-party server to the NF in the 5G mobile communication system. In addition, the NEF performs the role of providing data to the UDR 157 or updating the UDR 157 or obtaining data. The UDR 157 performs the function of storing the subscription information of the terminal 110, storing policy information, storing data exposed to the outside, or storing information required by a third-party application. In addition, the UDR 157 performs the role of providing the stored data to another NF.

[0082] Fig. 2A is a diagram showing an example of a functional structure of a terminal according to an embodiment. The configuration shown in Fig. 2A may be understood as a configuration of the terminal 110. Terms ending with "unit" or including suffixes "device", "machine", etc. used herein may refer to a unit that processes at least one function or operation, and may be implemented by hardware, software, or a combination of hardware and software.

[0083] 2A , the terminal includes a communication unit 205 , a storage unit 210 , and a controller 215 .

[0084] The communication unit 205 performs a function for sending or receiving a signal through a wireless channel. For example, the communication unit 205 may perform a conversion function between a baseband signal and a bit stream according to the physical layer specification of the system. For example, when sending data, the communication unit 205 generates complex symbols by encoding and modulating the transmission bit stream. In addition, when receiving data, the communication unit 205 reconstructs the received bit stream by demodulating and decoding the baseband signal. In addition, the communication unit 205 up-converts the baseband signal to an RF band signal, then transmits the converted RF band signal through an antenna, and down-converts the RF band signal received through the antenna to a baseband signal. For example, the communication unit 205 may include a transmission filter, a reception filter, an amplifier, a mixer, an oscillator, a digital-to-analog converter (DAC), an analog-to-digital converter (ADC), and the like.

[0085] In addition, the communication unit 205 may include multiple transmit / receive paths. In addition, the communication unit 205 may include at least one antenna array including multiple antenna elements. In terms of hardware, the communication unit 205 may be composed of digital circuits and analog circuits (e.g., radio frequency integrated circuits (RFICs)). The digital circuits and analog circuits may be implemented as a single package. In addition, the communication unit 205 may include multiple radio frequency (RF) chains. In addition, the communication unit 205 may perform beamforming.

[0086] The communication unit 205 transmits and receives signals as described above. Therefore, the whole or part of the communication unit 205 may be referred to as a transmitter, a receiver, or a transceiver. In addition, in the following description, transmission and reception performed through a wireless channel are used as the meaning including that the above-mentioned processing is performed by the communication unit 205.

[0087] The storage unit 210 stores data used for the operation of the terminal, such as basic programs, application programs, and configuration information. The storage unit 210 may be configured as a volatile memory, a nonvolatile memory, or a combination of a volatile memory and a nonvolatile memory. The storage unit 210 provides the stored data according to a request of the controller 215.

[0088] The controller 215 controls the overall operation of the terminal. For example, the controller 215 sends and receives signals through the communication unit 205. In addition, the controller 215 records data in the storage unit 210 and reads data from the storage unit 210. In addition, the controller 215 can perform the functions of the protocol stack required in the communication specification. To this end, the controller 215 may include at least one processor or microprocessor, or may be a part of a processor. In addition, the controller 215 and a part of the communication unit 205 may be referred to as a communication processor (CP). The controller 215 may perform control so that synchronization using a wireless communication network is performed. For example, the controller 215 may control the terminal to perform operations according to various embodiments.

[0089] The terminal may be configured by a mobile equipment (ME) and a universal mobile telecommunication service (UMTS) subscriber identity module (USIM). The ME may include a mobile terminal (MT) and a terminal equipment (TE). The MT may be a part of a wireless access protocol operation, and the TE may be a part of a control function operation. For example, in a wireless communication terminal (e.g., a mobile phone), the MT and the TE may be integrated with each other, and in a notebook computer, the MT and the TE may be separated from each other. The present disclosure may represent the ME and the USIM as entities distinguished from each other according to the operation of each element, but is not limited thereto, and may express a terminal (e.g., UE) including the ME and the USIM, or may express the ME as a terminal.

[0090] 2B is a diagram showing an example of a functional structure of a base station according to an embodiment. The configuration shown in FIG. 2B may be understood as a configuration of the base station 120.

[0091] 2B , the base station includes a wireless communication unit 235 , a backhaul communication unit 220 , a storage unit 225 , and a controller 230 .

[0092] The wireless communication unit 235 performs a function for sending or receiving a signal through a wireless channel. For example, the wireless communication unit 235 can perform a conversion function between a baseband signal and a bit stream according to the physical layer specification of the system. For example, when sending data, the wireless communication unit 235 generates complex symbols by encoding and modulating the transmission bit stream. In addition, when receiving data, the wireless communication unit 235 reconstructs the received bit stream by demodulating and decoding the baseband signal.

[0093] In addition, the wireless communication unit 235 up-converts the baseband signal into an RF band signal, then transmits the converted RF band signal through the antenna, and down-converts the RF band signal received through the antenna into a baseband signal. To this end, the wireless communication unit 235 may include a transmission filter, a reception filter, an amplifier, a mixer, an oscillator, a DAC, an ADC, etc. In addition, the wireless communication unit 235 may include multiple transmission / reception paths. In addition, the wireless communication unit 235 may include at least one antenna array consisting of multiple antenna elements.

[0094] In terms of hardware, the wireless communication unit 235 may be composed of a digital unit and an analog unit, and the analog unit may include a plurality of subunits according to operating power, operating frequency, etc. The digital unit may be implemented as at least one processor (eg, a digital signal processor (DSP)).

[0095] The wireless communication unit 235 transmits and receives signals as described above. Therefore, the whole or part of the wireless communication unit 235 may be referred to as a transmitter, a receiver, or a transceiver. In addition, in the following description, the transmission and reception performed through the wireless channel are used as the meaning including that the above-mentioned processing is performed by the wireless communication unit 235.

[0096] The backhaul communication unit 220 provides an interface for performing communication with other nodes within the network. That is, the backhaul communication unit 220 converts a bit stream sent from a base station to another node (e.g., another access node, another base station, a higher node, a core network, etc.) into a physical signal, and converts a physical signal received from another node into a bit stream.

[0097] The storage unit 225 stores data used for the operation of the base station, such as basic programs, application programs, and configuration information. The storage unit 225 may be configured as a volatile memory, a nonvolatile memory, or a combination of a volatile memory and a nonvolatile memory. The storage unit 225 provides the stored data according to a request of the controller 230.

[0098] The controller 230 controls the overall operation of the base station. For example, the controller 230 sends and receives signals through the wireless communication unit 235 or the backhaul communication unit 220. In addition, the controller 230 records data in the storage unit 225 and reads data from the storage unit 225. In addition, the controller 230 can perform the functions of the protocol stack required in the communication protocol. Alternatively, the protocol stack can be included in the wireless communication unit 235. To this end, the controller 230 may include at least one processor. The controller 230 may perform control so that synchronization using the wireless communication network is performed. For example, the controller 230 may control the base station to perform operations according to the embodiment.

[0099] FIG2C is a diagram showing an example of a functional structure of a core network entity according to an embodiment. In a wireless communication system, a configuration of a core network entity is shown. The configuration shown in FIG2C may be understood as a configuration of a device having at least one function of a network entity including the AMF 150 of FIG1 .

[0100] 2C , the core network entity includes a communication unit 240 , a storage unit 245 , and a controller 250 .

[0101] The communication unit 240 provides an interface for performing communication with other devices within the network. That is, the communication unit 240 converts a bit stream sent from a core network entity to another device into a physical signal, and converts a physical signal received from another device into a bit stream. That is, the communication unit 240 can send and receive signals. Therefore, the communication unit 240 can be referred to as a modem, a transmitter, a receiver, or a transceiver. The communication unit 240 can allow the core network entity to communicate with other devices or systems through a backhaul connection (e.g., a wired backhaul or a wireless backhaul) or a network.

[0102] The storage unit 245 stores data used for the operation of the core network entity, such as basic programs, applications, and configuration information. The storage unit 245 may be configured as a volatile memory, a non-volatile memory, or a combination of a volatile memory and a non-volatile memory. The storage unit 245 provides the stored data according to a request of the controller 250.

[0103] The controller 250 controls the overall operation of the core network entity. For example, the controller 250 sends or receives a signal via the communication unit 240. In addition, the controller 250 records data in the storage unit 245 and reads data from the storage unit 245. To this end, the controller 250 may include at least one processor. The controller 250 may perform control so that synchronization using a wireless communication network is performed. For example, the controller 250 may control the core network entity to perform operations according to an embodiment.

[0104] In this document, the terms used to identify access nodes, the terms used to indicate network entities, the terms used to indicate messages, the terms used to indicate interfaces between network entities, the terms used to indicate various identification information, etc. are examples for convenience of explanation. Therefore, the present disclosure is not limited to the terms provided below, and other terms indicating objects with equivalent technical meanings may be used.

[0105] In the following, for ease of explanation, the terms and names defined in the 5GS and NR specifications are used. However, the present disclosure is not limited to these terms and names, and can be applied to wireless communication networks that follow other specifications in the same manner. In particular, the present disclosure can be applied to 3GPP 5G mobile communication standards (e.g., 5GS and NR).

[0106] The base station may have a private key for signing the SI message. The terminal may have a public key capable of verifying the value with which the SI message is signed using the private key of the base station. As a method of supplying a public key to the terminal, a method of supplying and selling a public key to the USIM by a communication service provider may be provided. Alternatively, after a mutual authentication process with the core network, the terminal may receive a NAS security mode command or an access layer (AS) security mode command message, which is initially integrity protected, and receive a public key capable of verifying the value of the signature provided by the base station that the terminal wants to access. Alternatively, after the process of registering the terminal is completed, the network may update the public key of the terminal through a UE parameter update (UPU) or a roaming guidance (SoR) process, if necessary.

[0107] The terminal may store the public key for signature verification in the USIM or ME. In the case where the public key can be stored in the USIM, if the system information sent by the base station includes a signature, the terminal (eg, ME) may use an interface with the USIM to perform a process of receiving the public key from the USIM. Alternatively, the terminal may transmit the SI message to the USIM, and the USIM may perform a process of verifying the transmitted message.

[0108] The storage type of the public key for signature verification may correspond to mapping the public land mobile network (PLMN) ID to the ID or index of the public key and storing it in the non-volatile memory (NVM) of the ME or USIM (for example, this type may be in the form of PLMNID+public key identifier (PKID) public key (PK)). The terminal may identify the PLMN ID and PK ID in the system information sent by the base station. The terminal may identify the PK that can verify the signature of the corresponding PLMN in the NVM of the USIM or ME, and verify the signature of the SI, and may identify whether the base station is trustworthy based on the verification.

[0109] When broadcasting SI, the base station may send the system information together with a PKID representing a public key capable of verifying the value of a signature provided by the base station.

[0110] The terminal can receive the public key of each base station through the NAS security mode command / AS security mode command during the registration process or the protected message of UPU / SoR after the registration process, which will be used to verify the signatures of the base station where the terminal is currently camped and other base stations used to sign the SI.

[0111] The terminal may store a key supplied from the network during or after the registration process in the NVM of the USIM or ME, and may verify the signature included in the SI sent by the authentic base station by using the stored key.

[0112] As described above, the fake base station may deceive or forge the system information of the real base station that the terminal needs to access. In order to solve this problem, various methods may be needed.

[0113] The base station may transmit or broadcast SI including information related to the base station, and the terminal may receive SI from the base station. For system information, the information related to the base station included in the SI may include at least one of a physical cell ID (PCI) of the base station, a timestamp, and a signature value.

[0114] A terminal that has received system information including PCI from a base station can verify the signature of the base station that has sent the SI message based on the PCI value of the real base station that the terminal needs to access. Alternatively, the terminal can identify whether the received system information is system information sent by the base station that needs to be accessed or system information recycled by a pseudo base station based on the received information about the timestamp.

[0115] A method based on an asymmetric key may be used. Unlike a symmetric key method in which one key is shared and used, a method based on an asymmetric key may include a public key and a private key. A method based on an asymmetric key may include a certificate-based digital signature method and an ID-based signature method.

[0116] More specifically, in a certificate-based digital signature method, a base station may sign using a private key in a pair of private and public keys, and a terminal may verify the signature by using the public key of the base station (e.g., included in a certificate). The terminal may already have the public key of a root certificate authority (CA) that has issued a certificate to the base station. In an ID-based signature method, the terminal may verify the signature by using a key management service (KMS) public key. In an asymmetric key-based method, it may be assumed that the terminal already has a public key (e.g., a root CA public key or a KMS public key). Therefore, a method and apparatus for sending or receiving a signal based on enhancing the security of a base station by individually and adaptively supplying a public key to a terminal is disclosed.

[0117] FIG. 3 is a diagram illustrating an example of a process for a terminal to receive a signal for authenticating a public key of a base station according to an embodiment.

[0118] FIG. 3 shows operations including a phase of updating the public key by the network for a terminal that already has a public key for signature verification and a phase of provisioning to a terminal that does not have a public key for signature verification.

[0119] Various embodiments may be implemented to include at least one of the stages shown in FIG3. For example, referring to FIG3, according to various embodiments of the present disclosure, some or all of the operations of stages 305 to 312 as part of the process of registering a terminal may be omitted or replaced with other operations. Various embodiments of the present disclosure may include all operations of FIG3, some of them, or a combination of some operations, or may include a combination with some operations shown in FIG4.

[0120] One or more of the following configurations may be pre-performed for the process shown in FIG. 3 .

[0121] -First Pre-configuration

[0122] The server of the first service provider may have a public key that can be used for signature verification in the network of the second service provider in a contractual relationship (eg a roaming contract).

[0123] -Second pre-configuration

[0124] The AMF may have at least one of a public key for signature verification of a gNB connectable to the AMF, a public key for other base stations in the Home Public Land Mobile Network (HPLMN), or a public key for a base station of a Visited PLMN (VPLMN). Alternatively, the gNB may have the above information. Alternatively, during the registration process, the AMF may receive a public key list including at least one of the above public keys from the UDM.

[0125] 3 , at 301 , a terminal may perform an initial attach procedure.

[0126] At 302, the base station may broadcast SI including a signature. When the SI sent by the base station includes a signature, the SI may include an indicator (PK indicator) indicating a public key for signature verification (e.g., a certificate including a public key of the base station or a public key ID indicating a public key for signature verification). The base station may use the value or timestamp of the PCI as an additional input for signing. In addition, the SI sent by the base station may include at least one of a PLMN ID or a cell ID related to the base station.

[0127] According to an embodiment, a terminal that has received SI including PCI from a base station can verify the signature of the base station that has sent SI based on the PCI value of the real base station that the terminal needs to access. Alternatively, the terminal can identify whether the received SI has been sent by the base station that needs to be accessed or is recycled by a pseudo base station based on the received information about the timestamp.

[0128] At 303, the terminal may perform an operation based on the received system information. If the SI is a message related to a disaster text message and the SI including the disaster text message does not include signature information, the terminal may recognize that the disaster text message has not been verified (e.g., the terminal may provide a notification that "this is an unverified disaster text message"). Regardless of whether the terminal has a public key for base station verification, if the changeable value (e.g., timestamp) included in the SI is unacceptable to the terminal (e.g., in the terminal's determination, the changeable value is an old time value), the terminal may stop the above operation, escape from the base station (or the cell of the base station) that has sent the SI, and select another cell. The terminal may verify the signature. More specifically, the terminal may verify the SI signed by the base station based on a private key based on the public key of the base station known to the terminal. An asymmetric key method is used, so the public key and the private key may be different. The terminal may recognize that the verification of the base station is complete based on the public key corresponding to the private key used for the signature.

[0129] When the SI received by the terminal in stage 302 does not include a signature, the terminal may proceed to stage 304 without additional operations.

[0130] In the case where the SI includes a signature and the USIM of the terminal supports the function of storing a public key to be used for signature verification, the ME can receive from the USIM or identify in the USIM a public key corresponding to the information about the public key included in the system information (in the case of a certificate including the public key of the base station, the corresponding CA certificate, or in the case of a public key ID indicating a public key used for signature verification, the public key matching the corresponding ID).

[0131] In a case where the SI includes a signature and the USIM of the terminal does not have a function of storing a public key to be used for signature verification, the ME may identify a public key corresponding to the information about the public key included in the SI in a memory of the ME.

[0132] When the public key is recognized in the memory of the USIM or ME, the terminal can verify the signature included in the SI. When the verification is successful, the terminal can proceed to stage 304. When the verification fails, the terminal can recognize that there is an attacker base station (e.g., a fake base station). When the verification fails, the terminal can search for another cell and attempt to attach. When the terminal has determined that the base station that has sent the SI to the terminal is an attacker base station, the terminal can stop the process of connecting to the base station that has sent the SI (e.g., the cell access process) and search for another cell (or base station). When the terminal has determined that the base station that has sent the SI to the terminal is a real base station, the terminal can continue the process of connecting to the base station that has sent the SI.

[0133] When the terminal fails to find the public key in the memory of the USIM or ME, the terminal may proceed to stage 304 .

[0134] At 304, the terminal and the base station may perform RRC connection configuration. An initial access procedure may be performed for the procedure of RRC connection configuration between the terminal and the base station.

[0135] From 301 to 303 of FIG. 3 , the terminal may successfully or unsuccessfully verify the signature of the base station, and for a resulting additional verification process, some stages of FIG. 3 or some stages of FIG. 4 may be performed.

[0136] At 305, the terminal may transmit a registration request message to the AMF via the base station. The registration request message sent by the terminal may include information about the encryption and integrity protection algorithms supported by the terminal. The registration request message sent by the terminal may include at least one public key in a list of public keys currently held by the terminal and to be used for signature verification. When there is no public key for verifying the value of the signature provided by the base station that the terminal needs to access, the registration request message sent by the terminal may include an indicator indicating such information, or at least one public key in a list of public keys currently held by the terminal and to be used for signature verification. The list of public keys may include, for example, the public key itself or information indicating the public key (e.g., PLMNID+PKID). When there is an attacking base station (e.g., a fake base station), the fake base station may receive the registration request message sent by the terminal, modify the information including the message, and send the message to the AMF.

[0137] At 306, the terminal and the network (eg, including a base station or a core network entity) may perform mutual authentication.

[0138] At 307, the AMF may not modify the indicator or the public key list included in the message received from the terminal. The AMF may send a NAS security mode command message including the indicator or the public key list received from the terminal. The AMF may identify the encryption and integrity protection algorithm related to the NAS message transmission or reception performed by the terminal. The AMF may identify the encryption and integrity protection algorithm related to the NAS message transmission or reception based on the information about the encryption and integrity protection algorithm supported by the terminal (the information is received from the terminal). The AMF may generate an encryption key or an integrity protection key for NAS based on the identified algorithm and K_amf. The AMF may perform integrity protection of the NAS security mode command message by using the generated integrity protection key for NAS, and send the message. The NAS security mode command message may be the first message subjected to integrity protection in the NAS message. Before the terminal receives the message subjected to integrity protection, the message subjected to integrity protection may not be randomly modified by other entities (e.g., an attacking base station). The NAS message may include at least one of the integrity protection algorithm or the encryption algorithm selected by the AMF.

[0139] At 308, the terminal may compare the indicator or public key list included in the message that has been integrity protected and received from the AMF with the indicator or public key list sent by the terminal to the AMF in stage 305. When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal can recognize that a man-in-the-middle (MitM) attack has occurred during transmission or reception with the core network. When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal can recognize that there is an attacking base station (e.g., a fake base station). When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal can search for another cell and attempt to attach.

[0140] At 309, when the information received in stage 307 is the same as the information sent by the terminal in stage 305, the terminal may notify the AMF that there is no message forgery by sending a NAS security mode complete message. The terminal may generate an encryption key or an integrity protection key for NAS based on the encryption algorithm and integrity protection algorithm received from the AMF at 307. The terminal may perform encryption and integrity protection on subsequent NAS messages including the NAS security mode complete message based on the generated key, and send the message.

[0141] At 310, when the AMF receives the NAS security mode completion message from the terminal, the AMF can recognize that the information received in stage 305 has not been forged. The AMF can identify the information of the public key that will be used for signature verification and is currently owned by the terminal based on the information received in stage 305. When there is information that needs to be updated in the public key owned by the terminal, the AMF can transmit the information to the base station. The situation where an update is required may include a situation in which some of the public keys owned by the terminal are revoked, or a public key of a specific PLMN is added / removed due to a new contractual relationship.

[0142] At 311, the base station may update the public key of the terminal through the AS security mode command message to be integrity protected by using the public key information received from the AMF. The base station may send a message including the updated public key to the terminal. The message sent to the terminal may include at least one of the public key for the base station that has received the public key information from the AMF, the public key for other base stations of the HPLMN, or the public key for the base station of the VPLMN.

[0143] At 312, when the AS security mode command message received by the terminal from the base station includes the public key, the terminal may store the public key in the USIM or the NVM of the ME based on whether the USIM storage function is available. The AS security mode command may be a message in the AS message that is first subjected to integrity protection.

[0144] At 313, the terminal may send an AS security mode completion message to the base station. The AS security mode completion message may be a message that is first encrypted and integrity protected in the AS message. Before the terminal receives the integrity protected message, the integrity protected message may not be randomly modified by other entities (e.g., an attacking base station).

[0145] At 314, the AMF, which knows the public keys held by the terminal (for example, the AMF can recognize the public key list currently held by the terminal by combining the public key list received from the terminal in stage 305 and the public key list information transmitted by the AMF to the base station in stage 310) can transmit a subscription permanent identifier (SUPI) as an identifier indicating the terminal and the list of public keys held by the terminal to the UDM.

[0146] At 315 , when the UDM having received the list of public keys owned by the terminal identifies that updating is required based on the received list of public keys, the UDM may perform a procedure of the UPU or SoR to determine whether to update the public key of the terminal for signature verification.

[0147] At 316, when it is determined based on the received list of public keys that a list of public keys for the UE needs to be updated (for example, a new public key for a base station newly deployed in the HPLMN has been added, information about a public key to be used in another service provider's network has been added due to a new contractual relationship with another service provider, or a specific public key has become unnecessary due to the discarding (revocation) of a public key owned by the terminal), the UDM may perform an update in the terminal through a UPU / SoR procedure.

[0148] According to an embodiment, the process of performing terminal update through the UPU / SoR process may be performed by at least one of the terminal, the base station, or the network entity. The process of updating the list of public keys of the terminal (for example, including at least one of the public key of the base station, the public key of other base stations of the HPLMN, or the public key of the base station of the VPLMN) may include: updating the public key of the terminal by using the UPU process, or updating the public key information related to the VPLMN of the terminal by using the SoR process.

[0149] At 317, the terminal that has received the update information of the public key for signature verification through the UPU / SoR process can update the public key information in the NVM of the USIM or ME based on the public key required to verify the signature of the base station and the indicator indicating the public key (including the case of PLMNID+PKID form), and can store the updated content.

[0150] According to various embodiments of the present disclosure, some stages shown in FIG. 3 may be performed again based on the updated public key or public key list of the terminal.

[0151] FIG. 4 is a diagram illustrating an example of a process for a terminal to receive a signal for authenticating a public key of a base station according to an embodiment.

[0152] FIG4 shows an operation including a stage in which a network updates a public key for a terminal that already has a public key for signature verification and a stage in which a terminal that does not have a public key for signature verification is supplied. An embodiment may be implemented to include at least one of the stages shown in FIG4 . For example, with reference to FIG4 , some or all of the operations of 405 to 409 as part of the process of registering a terminal may be omitted or may be replaced with other operations. An embodiment may include all of the operations of FIG4 , some of them, or a combination of some operations, or may include a combination with some of the operations shown in FIG3 . In addition, the terms (e.g., information and parameters) of the present disclosure are not limited to themselves and may be replaced with terms having equivalent or similar meanings thereto.

[0153] One or more of the following configurations may be pre-performed for the process shown in FIG. 4 .

[0154] -First Pre-configuration

[0155] The server of the first service provider may have a public key that can be used for signature verification in the network of the second service provider in a contractual relationship (eg a roaming contract).

[0156] -Second pre-configuration

[0157] The AMF may have at least one of a public key for signature verification of a gNB connectable to the AMF, a public key for other base stations in the HPLMN, or a public key for a base station of the VPLMN. Alternatively, during the registration process, the AMF may receive a public key list including at least one of the above public keys from the UDM.

[0158] 4 , at 401 , a terminal may perform an initial attach procedure.

[0159] At 402, the base station may broadcast SI including a signature. When the SI sent by the base station includes a signature, the SI may include an indicator (PK indicator) indicating a public key for signature verification (e.g., a certificate including a public key of the base station or a public key ID indicating a public key for signature verification). The base station may use the value or timestamp of the PCI as an additional input for signing. In addition, the system information sent by the base station may include a PLMN ID associated with the base station.

[0160] A terminal that has received SI including PCI from a base station can verify the signature of the base station that has sent SI based on the PCI value of the real base station that the terminal needs to access. Alternatively, the terminal can identify whether the received SI has been sent by the base station that needs to be accessed or is recycled by a pseudo base station based on the received information about the timestamp.

[0161] At 403, the terminal may perform an operation based on the received SI. If the SI is a message related to a disaster text message and the SI including the disaster text message does not include signature information, the terminal may recognize that the disaster text message has not been verified (e.g., the terminal may provide a notification that “this is an unverified disaster text message”). Regardless of whether the terminal has a public key for base station verification, if the changeable value (e.g., timestamp) included in the SI is unacceptable to the terminal (e.g., in the terminal's determination, the changeable value is an old time value), the terminal may stop the above operation, escape from the base station (or the cell of the base station) that has sent the SI, and select another cell. The terminal may verify the signature. More specifically, the terminal may verify the SI signed by the base station based on a private key based on the public key of the base station known to the terminal. An asymmetric key method is used, so the public key and the private key may be different. The terminal may recognize that the verification of the base station is complete based on the public key corresponding to the private key used for the signature.

[0162] When the SI received by the terminal at 402 does not include a signature, the terminal may proceed to 404 without additional operation.

[0163] In the case where the SI includes a signature and the USIM of the terminal supports the function of storing a public key to be used for signature verification, the ME can receive from the USIM or identify in the USIM a public key corresponding to the information about the public key included in the system information (in the case of a certificate including the public key of the base station, the corresponding CA certificate, or in the case of a public key ID indicating a public key used for signature verification, the public key matching the corresponding ID).

[0164] In a case where the SI includes a signature and the USIM of the terminal does not have a function of storing a public key to be used for signature verification, the ME may identify a public key corresponding to the information about the public key included in the SI in a memory of the ME.

[0165] When the public key is recognized in the memory of the USIM or ME, the terminal can verify the signature included in the SI. When the verification is successful, the terminal can proceed to 404. When the verification fails, the terminal can recognize that there is an attacker base station (e.g., a fake base station). When the verification fails, the terminal can search for another cell and try to attach. When the terminal has determined that the base station that has sent the system information to the terminal is an attacker base station, the terminal can stop the process of connecting to the base station that has sent the system information (e.g., the cell access process) and search for another cell (or base station). When the terminal has determined that the base station that has sent the system information to the terminal is a real base station, the terminal can continue the process of connecting to the base station that has sent the system information.

[0166] When the terminal fails to find the public key in the memory of the USIM or ME, the terminal may proceed to 404 .

[0167] At 404, the terminal and the base station may perform RRC connection configuration. An initial access procedure may be performed for the procedure of RRC connection configuration between the terminal and the base station.

[0168] From 401 to 403 of FIG. 4 , the terminal may successfully or unsuccessfully verify the signature of the base station, and for a resulting additional verification process, some stages of FIG. 3 or some stages of FIG. 4 may be performed.

[0169] At 405, the terminal may transmit a registration request message to the AMF via the base station. The registration request message sent by the terminal may include information about the encryption and integrity protection algorithms supported by the terminal. The registration request message sent by the terminal may include at least one public key in a list of public keys currently held by the terminal and to be used for signature verification. When there is no public key for verifying the value of the signature provided by the base station that the terminal needs to access, the registration request message sent by the terminal may include an indicator indicating such information, or at least one public key in a list of public keys currently held by the terminal and to be used for signature verification. The list of public keys may include, for example, the public key itself or information indicating the public key (e.g., PLMNID+PKID). When there is an attacking base station (e.g., a fake base station), the fake base station may receive the registration request message sent by the terminal, modify the information including the message, and send the message to the AMF.

[0170] At 406, the terminal and the network (eg, including a base station or a core network entity) may perform mutual authentication.

[0171] At 407, the AMF may not modify the indicator or the public key list included in the message received from the terminal. The AMF may send a NAS security mode command message including the indicator or the public key list received from the terminal. The AMF may identify the encryption and integrity protection algorithm related to the NAS message transmission or reception performed by the terminal. The AMF may identify the encryption and integrity protection algorithm related to the NAS message transmission or reception based on the information about the encryption and integrity protection algorithm supported by the terminal (the information is received from the terminal). The AMF may generate an encryption key and an integrity protection key for NAS based on the identified algorithm and K_amf. The AMF may perform integrity protection of the NAS security mode command message by using the generated integrity protection key for NAS, and send the message. The NAS security mode command message may be the first message subjected to integrity protection in the NAS message. Before the terminal receives the message subjected to integrity protection, the message subjected to integrity protection may not be randomly modified by other entities (e.g., an attacking base station). The NAS message may include at least one of the integrity protection algorithm or the encryption algorithm selected by the AMF. The AMF may identify the received list of public keys and may send an additional list of public keys when the list of public keys of the terminal needs to be updated. The additional list of public keys sent by the AMF may include at least one of the public key of the base station where the terminal is currently residing, the public key of other base stations in the HPLMN, or the public key of the base station of the VPLMN.

[0172] At 408, when the terminal receives the public key from the AMF, the terminal may store the received public key in the NVM of the USIM or ME. The terminal may compare the indicator or public key list included in the message that has been integrity protected and received from the AMF with the indicator or public key list sent by the terminal to the AMF in stage 405. When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal may recognize that a MitM attack has occurred during transmission or reception with the core network. When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal may recognize that there is an attacking base station (e.g., a fake base station). When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal may search for another cell and attempt to attach.

[0173] At 409, the terminal may send a NAS security mode complete message to the AMF, the NAS security mode complete message including a list of public keys owned by the terminal for signature verification. The terminal may generate an encryption key or integrity protection key for NAS based on the encryption algorithm and integrity protection algorithm received from the AMF at 407. The terminal may perform encryption and integrity protection on subsequent NAS messages including the NAS security mode complete message based on the generated key, and send the message.

[0174] At 410, the AMF may transmit the list of received public keys along with the SUPI to UDP.

[0175] At 411 , when the UDM having received the list of public keys owned by the terminal recognizes that updating is required based on the received list of public keys, the UDM may perform a procedure of UPU or SoR to determine whether to update the public key of the terminal for signature verification.

[0176] At 412, when it is determined based on the list of public keys received at 410 that the list of public keys needs to be updated (for example, a new public key for a base station newly deployed in the HPLMN has been added, information about a public key to be used in a network of another service provider has been added due to a new contractual relationship with another service provider, or a specific public key has become unnecessary due to the revocation of a public key owned by the terminal), the UDM may update the list of public keys of the terminal through a UPU / SoR procedure. The process of performing terminal update through a UPU / SoR procedure may be performed by at least one of a terminal, a base station, or a network entity. The process of updating the list of public keys of the terminal (for example, including at least one of a public key of a base station, a public key of other base stations of the HPLMN, or a public key of a base station of a VPLMN) may include: updating the public key of the terminal by using a UPU procedure, or updating public key information related to the VPLMN of the terminal by using a SoR procedure.

[0177] At 413, the terminal that has received the update information of the public key for signature verification through the UPU / SoR process can update the public key information in the NVM of the USIM or ME based on the public key required to verify the signature of the base station and the indicator indicating the public key (including the case of PLMNID+PKID form), and can store the updated content.

[0178] Some of the stages shown in FIG. 4 may be performed again based on the updated public key or public key list of the terminal.

[0179] 5 is a diagram showing a detailed operation flow of a terminal receiving a public key for verifying a base station according to an embodiment. The terminal may be composed of an ME and a USIM. The ME may include an MT and a TE. The MT may be part of a wireless access protocol operation, and the TE may be part of a control function operation. For example, in a wireless communication terminal (e.g., a mobile phone), the MT and the TE may be integrated with each other, and in a notebook computer, the MT and the TE may be separated from each other. The present disclosure may represent the ME and the USIM as entities distinguished from each other according to the operation of each element, but is not limited thereto, and may express a terminal (e.g., a UE) including the ME and the USIM, or may express the ME as a terminal to describe various embodiments of the present disclosure.

[0180] Referring to Figure 5, at 510, the terminal may receive SI from the base station. Although not shown in Figure 5, the terminal may perform an initial access (e.g., initial attachment) operation with the base station. The terminal may receive system information including a signature of the base station, which is broadcast by the base station. When the SI sent by the base station includes a signature, the SI may include an indicator (PK indicator) indicating a public key for signature verification (e.g., a certificate including a public key of the base station or a public key ID indicating a public key for signature verification). The base station may use the value or timestamp of the PCI as an additional input for signing. In addition, the SI sent by the base station may include at least one of a PLMN ID or a cell ID associated with the base station.

[0181] A terminal that has received SI including PCI from a base station can verify the signature of the base station that has sent the system information based on the PCI value of the real base station that the terminal needs to access. Alternatively, the terminal can identify whether the received SI has been sent by the base station that needs to be accessed or is recycled by a pseudo base station based on the received information about the timestamp.

[0182] At 520, the terminal may identify whether a public key corresponding to the public key of the base station is stored.

[0183] In the case where the SI includes a signature and the USIM of the terminal supports the function of storing a public key to be used for signature verification, the ME can receive from the USIM or identify in the USIM a public key corresponding to the information about the public key included in the system information (in the case of a certificate including the public key of the base station, the corresponding CA certificate, or in the case of a public key ID indicating a public key used for signature verification, the public key matching the corresponding ID).

[0184] In a case where the SI includes a signature and the USIM of the terminal does not have a function of storing a public key to be used for signature verification, the ME may identify a public key corresponding to the information about the public key included in the SI in a memory of the ME.

[0185] When identifying that a public key corresponding to the public key of the base station is stored, the terminal may proceed to 530 .

[0186] When identifying that the public key corresponding to the public key of the base station is not stored, the terminal may proceed to 540 .

[0187] Although not shown in FIG. 5 , when the SI received by the terminal does not include a signature, the terminal may proceed to stage 540 without additional operations.

[0188] At 530, the terminal may verify the signature of the base station based on the received SI. The terminal may verify the signature. More specifically, the terminal may verify the SI signed by the base station based on the private key based on the public key of the base station known by the terminal. An asymmetric key method is used, so the public key and the private key may be different. The terminal may recognize that the verification of the base station is completed based on the public key corresponding to the private key used for signing.

[0189] When the public key is recognized in the memory of the USIM or ME, the terminal can verify the signature included in the SI. When the verification is successful, the terminal can proceed to 540. When the verification fails, the terminal can recognize that there is an attacking base station (e.g., a fake base station). When the verification fails, the terminal can proceed to 570. When the verification fails, the terminal can search for another cell and try to attach.

[0190] Although not shown in FIG. 5 , the terminal may perform an initial access procedure for a procedure of RRC connection configuration with the base station.

[0191] At 540, the terminal may send a registration request message to the AMF.

[0192] The registration request message sent by the terminal may include information about the encryption and integrity protection algorithms supported by the terminal. The registration request message sent by the terminal may include at least one public key in the list of public keys currently held by the terminal and to be used for signature verification. When there is no public key for verifying the value of the signature provided by the base station that the terminal needs to access, the registration request message sent by the terminal may include an indicator indicating such information, or at least one public key in the list of public keys currently held by the terminal and to be used for signature verification. The list of public keys may include, for example, the public key itself or information indicating the public key (e.g., PLMNID+PKID). When there is an attacking base station (e.g., a fake base station), the fake base station may receive the registration request message sent by the terminal, modify the information including the message, and send the message to the AMF.

[0193] Although not shown in FIG. 5 , the terminal may perform a mutual authentication procedure with a network (eg, including a base station or a core network entity).

[0194] At 550, the terminal may receive a NAS security mode command message from the AMF. The terminal may receive a NAS security mode command message including an indicator or a public key list that has been sent to the AMF from the AMF. The AMF may identify an encryption and integrity protection algorithm related to NAS message transmission or reception performed by the terminal. The AMF may identify an encryption and integrity protection algorithm related to NAS message transmission or reception based on information about encryption and integrity protection algorithms supported by the terminal (the information is received from the terminal). The AMF may generate an encryption key or an integrity protection key for NAS based on the identified algorithm and K_amf. The AMF may perform integrity protection of the NAS security mode command message by using the generated integrity protection key for NAS, and send the message. The NAS security mode command message may be the first message subjected to integrity protection in the NAS message. Before the terminal receives the message subjected to integrity protection, the message subjected to integrity protection may not be randomly modified by other entities (e.g., an attacking base station). The NAS message may include at least one of an integrity protection algorithm or an encryption algorithm selected by the AMF.

[0195] The AMF may identify the received list of public keys and, when the list of public keys of the terminal needs to be updated, may send an additional list of public keys to the terminal. The additional list of public keys sent by the AMF may include at least one of a public key for a base station where the terminal is currently residing, a public key for other base stations in the HPLMN, or a public key for a base station of a VPLMN.

[0196] At 560, the terminal may verify the signature of the base station based on a comparison between the received NAS security mode command message and the registration request message. The terminal may identify the presence of an attacker base station (e.g., a fake base station) based on a comparison between the received NAS security mode command message and the registration request message. When the terminal receives the public key from the AMF, the terminal may store the received public key in the NVM of the USIM or ME.

[0197] The terminal may compare the indicator or public key list included in the message that has been integrity protected and received from the AMF with the indicator or public key list sent by the terminal to the AMF in stage 540. When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal may recognize that a MitM attack has occurred during transmission or reception with the core network. When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal may recognize that an attacking base station (e.g., a fake base station) exists. When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal may proceed to 570. When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal may search for another cell and attempt to attach.

[0198] Although not shown in Fig. 5, the terminal may also perform a series of processes for updating the list of public keys.The terminal may also perform all operations described below, some of them, or a combination of some operations.

[0199] When the information received by the terminal at 550 is the same as the information sent at 540, the terminal may notify the AMF that there is no message forgery by sending a NAS security mode complete message. The terminal may generate an encryption key or integrity protection key for NAS based on the encryption algorithm and integrity protection algorithm received from the AMF in stage 550. The terminal may perform encryption and integrity protection on subsequent NAS messages including the NAS security mode complete message based on the generated key and send the message.

[0200] Although not shown in FIG. 5, the base station may update the public key of the terminal through the AS security mode command message to be subjected to integrity protection by using the public key information received from the AMF. The terminal may receive a message including the updated public key from the base station. The message received by the terminal may include at least one of the public key for the base station that has received the public key information from the AMF, the public key of other base stations for the HPLMN, or the public key of the base station for the VPLMN.

[0201] When the AS security mode command message received by the terminal from the base station includes the public key, the terminal can store the public key in the USIM or the NVM of the ME based on whether the USIM storage function is available. The AS security mode command can be a message in the AS message that is first subjected to integrity protection.

[0202] The terminal may send an AS security mode command message to the base station. The AS security mode completion message may be a message that is first encrypted and integrity protected in the AS message. Before the terminal receives the integrity protected message, the integrity protected message may not be randomly modified by other entities (e.g., an attacking base station).

[0203] When it is determined based on the list of public keys received from the AMF that the list of public keys needs to be updated (for example, a new public key for a base station newly deployed in the HPLMN has been added, information about a public key to be used in the network of another service provider has been added due to a new contractual relationship with another service provider, or a specific public key has become unnecessary due to the revocation of a public key owned by the terminal), the UDM may update the list of public keys of the terminal through a UPU / SoR procedure. The process of updating the list of public keys of the terminal (for example, including at least one of the public key of the base station, the public keys of other base stations of the HPLMN, or the public keys of base stations of the VPLMN) may include: updating the public key of the terminal by using a UPU procedure, or updating public key information related to the VPLMN of the terminal by using a SoR procedure.

[0204] The terminal that has received the update information of the public key for signature verification through the UPU / SoR process can update the public key information in the NVM of the USIM or ME based on the public key required to verify the signature of the base station and the indicator indicating the public key (including the case of PLMNID+PKID form), and can store the updated content.

[0205] At 570, the terminal may search for another cell and attempt to attach.

[0206] Some of the stages shown in FIG. 5 may be performed again based on the updated public key or public key list of the terminal.

[0207] The operation of the terminal may not be limited to the operation described with reference to Figure 5. The terminal may perform all operations, some of them, or a combination of some operations of Figure 5. The terminal may perform all operations, some of them, or a combination of some operations of Figures 3 to 5.

[0208] 6 is a diagram showing an operational flow of a terminal receiving a public key for verifying a base station according to an embodiment. The terminal may be composed of an ME and a USIM. The ME may include an MT and a TE. The MT may be part of a wireless access protocol operation, and the TE may be part of a control function operation. For example, in a wireless communication terminal (e.g., a mobile phone), the MT and the TE may be integrated with each other, and in a notebook computer, the MT and the TE may be separated from each other. The present disclosure may represent the ME and the USIM as entities distinguished from each other according to the operation of each element, but is not limited thereto, and may express a terminal (e.g., a UE) including the ME and the USIM, or may express the ME as a terminal to describe various embodiments of the present disclosure.

[0209] Referring to Figure 6, at 610, the terminal may receive SI from the base station. Although not shown in Figure 6, the terminal may perform an initial access (e.g., initial attachment) operation with the base station. The terminal may receive SI including a signature of the base station, which is broadcast by the base station. When the SI sent by the base station includes a signature, the SI may include an indicator (PK indicator) indicating a public key for signature verification (e.g., a certificate including a public key of the base station or a public key ID indicating a public key for signature verification). The base station may use the value or timestamp of the PCI as an additional input for signing. In addition, the SI sent by the base station may include at least one of a PLMN ID or a cell ID associated with the base station.

[0210] A terminal that has received SI including PCI from a base station can verify the signature of the base station that has sent SI based on the PCI value of the real base station that the terminal needs to access. Alternatively, the terminal can identify whether the received SI has been sent by the base station that needs to be accessed or is recycled by a pseudo base station based on the received information about the timestamp.

[0211] At 620, the terminal may perform signature verification based on the SI. More specifically, the terminal may perform operations based on the received system information.

[0212] The terminal can verify the signature. More specifically, the terminal can verify the SI signed by the base station based on the private key based on the public key of the base station known by the terminal. An asymmetric key method is used, so the public key and the private key can be different. The terminal can recognize that the verification of the base station is completed based on the public key corresponding to the private key used for signing.

[0213] When the SI received by the terminal does not include a signature, the terminal may proceed to the next stage without additional operation.

[0214] In the case where the SI includes a signature and the USIM of the terminal supports the function of storing a public key to be used for signature verification, the ME can receive from the USIM or identify in the USIM a public key corresponding to the information about the public key included in the SI (in the case of a certificate including the public key of the base station, the corresponding CA certificate, or in the case of a public key ID indicating a public key used for signature verification, the public key matching the corresponding ID).

[0215] In the case where the SI includes a signature and the USIM of the terminal does not have a function of storing a public key to be used for signature verification, the ME may identify, in a memory of the ME, a public key corresponding to the information about the public key included in the system information.

[0216] When the public key is recognized in the memory of the USIM or ME, the terminal can verify the signature included in the SI. When the verification is successful, the terminal can proceed to the next stage. When the verification fails, the terminal can recognize that there is an attacking base station (e.g., a fake base station). When the verification fails, the terminal can search for another cell and try to attach. When the terminal has determined that the base station that has sent the SI to the terminal is an attacking base station, the terminal can stop the process of connecting to the base station that has sent the SI (e.g., the cell access process) and search for another cell (or base station). When the terminal has determined that the base station that has sent the SI to the terminal is a real base station, the terminal can continue the process of connecting to the base station that has sent the SI.

[0217] When the terminal fails to find the public key in the memory of the USIM or ME, the terminal may proceed to the next stage.

[0218] Although not shown in FIG. 6 , the terminal may perform an initial access procedure for a procedure of RRC connection configuration with the base station.

[0219] At 630, the terminal may send a registration request message to the AMF.

[0220] The registration request message sent by the terminal may include information about the encryption and integrity protection algorithms supported by the terminal. The registration request message sent by the terminal may include at least one public key in the list of public keys currently held by the terminal and to be used for signature verification. When there is no public key for verifying the value of the signature provided by the base station that the terminal needs to access, the registration request message sent by the terminal may include an indicator indicating such information, or at least one public key in the list of public keys currently held by the terminal and to be used for signature verification. The list of public keys may include, for example, the public key itself or information indicating the public key (e.g., PLMNID+PKID). When there is an attacking base station (e.g., a fake base station), the fake base station may receive the registration request message sent by the terminal, modify the information including the message, and send the message to the AMF.

[0221] Although not shown in FIG. 6 , the terminal may perform a mutual authentication procedure with a network (eg, including a base station or a core network entity).

[0222] At 640, the terminal may receive a NAS security mode command message from the AMF. The terminal may receive a NAS security mode command message including an indicator or a public key list that has been sent to the AMF from the AMF. The AMF may identify an encryption and integrity protection algorithm related to NAS message transmission or reception performed by the terminal. The AMF may identify an encryption and integrity protection algorithm related to NAS message transmission or reception based on information about encryption and integrity protection algorithms supported by the terminal (the information is received from the terminal). The AMF may generate an encryption key or an integrity protection key for NAS based on the identified algorithm and K_amf. The AMF may perform integrity protection of the NAS security mode command message by using the generated integrity protection key for NAS, and send the message. The NAS security mode command message may be the first message subjected to integrity protection in the NAS message. Before the terminal receives the message subjected to integrity protection, the message subjected to integrity protection may not be randomly modified by other entities (e.g., an attacking base station). The NAS message may include at least one of an integrity protection algorithm or an encryption algorithm selected by the AMF.

[0223] The AMF may identify the received list of public keys and, when the list of public keys of the terminal needs to be updated, may send an additional list of public keys to the terminal. The additional list of public keys sent by the AMF may include at least one of a public key for a base station where the terminal is currently residing, a public key for other base stations in the HPLMN, or a public key for a base station of a VPLMN.

[0224] At 650, the terminal may verify the signature of the base station based on a comparison between the received NAS security mode command message and the registration request message. The terminal may identify the presence of an attacker base station (e.g., a fake base station) based on a comparison between the received NAS security mode command message and the registration request message. When the terminal receives the public key from the AMF, the terminal may store the received public key in the NVM of the USIM or ME.

[0225] The terminal may compare the indicator or public key list included in the message that has been integrity protected and received from the AMF with the indicator or public key list sent by the terminal to the AMF at 630. When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal may recognize that a MitM attack has occurred during transmission or reception with the core network. When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal may recognize that an attacking base station (e.g., a fake base station) exists. When the comparison result indicates that the indicator or public key list sent by the terminal is identified as different from the indicator or public key list received by the terminal, the terminal may search for another cell and attempt to attach.

[0226] Although not shown in Fig. 6, the terminal may also perform a series of processes for updating the list of public keys.The terminal may also perform all operations described below, some of them, or a combination of some operations.

[0227] When the information received by the terminal at 640 is the same as the information sent at 630, the terminal may notify the AMF that there is no message forgery by sending a NAS security mode complete message. The terminal may generate an encryption key or an integrity protection key for NAS based on the encryption algorithm and integrity protection algorithm received from the AMF at 640. The terminal may perform encryption and integrity protection on subsequent NAS messages including the NAS security mode complete message based on the generated key and send the message.

[0228] The base station may update the public key of the terminal through the AS security mode command message to be integrity protected by using the public key information received from the AMF. The terminal may receive a message including the updated public key from the base station. The message received by the terminal may include at least one of the public key for the base station that has received the public key information from the AMF, the public key of other base stations for the HPLMN, or the public key of the base station for the VPLMN.

[0229] When the AS security mode command message received by the terminal from the base station includes the public key, the terminal can store the public key in the USIM or the NVM of the ME based on whether the USIM storage function is available. The AS security mode command can be a message in the AS message that is first subjected to integrity protection.

[0230] The terminal may send an AS security mode command message to the base station. The AS security mode completion message may be a message that is first encrypted and integrity protected in the AS message. Before the terminal receives the integrity protected message, the integrity protected message may not be randomly modified by other entities (e.g., an attacking base station).

[0231] When it is determined based on the list of public keys received from the AMF that the list of public keys needs to be updated (for example, a new public key for a base station newly deployed in the HPLMN has been added, information about a public key to be used in the network of another service provider has been added due to a new contractual relationship with another service provider, or a specific public key has become unnecessary due to the revocation of a public key owned by the terminal), the UDM may update the list of public keys of the terminal through a UPU / SoR procedure. The process of updating the list of public keys of the terminal (for example, including at least one of the public key of the base station, the public keys of other base stations of the HPLMN, or the public keys of base stations of the VPLMN) may include: updating the public key of the terminal by using a UPU procedure, or updating public key information related to the VPLMN of the terminal by using a SoR procedure.

[0232] The terminal that has received the update information of the public key for signature verification through the UPU / SoR process can update the public key information in the NVM of the USIM or ME based on the public key required to verify the signature of the base station and the indicator indicating the public key (including the case of PLMNID+PKID form), and can store the updated content.

[0233] Some of the stages shown in FIG. 6 may be performed again based on the updated public key or public key list of the terminal.

[0234] The operation of the terminal may not be limited to the operation described with reference to Fig. 6. The terminal may perform all operations, some of them, or a combination of some operations of Fig. 6. The terminal may perform all operations, some of them, or a combination of some operations of Fig. 3 to Fig. 6.

[0235] FIG. 7 is a diagram illustrating an operational flow in which an AMF supplies a public key for authenticating a base station to a terminal according to an embodiment.

[0236] Referring to FIG. 7 , at 710 , the AMF may receive a registration request message from the terminal. The AMF may receive the registration request message from the terminal via the base station. The registration request message sent by the terminal may include information about the encryption and integrity protection algorithms supported by the terminal. The registration request message received from the terminal may include at least one public key in a list of public keys currently held by the terminal and to be used for signature verification. When there is no public key for verifying the value of the signature provided by the base station that the terminal needs to access, the registration request message received from the terminal may include an indicator indicating such information, or at least one public key in a list of public keys currently held by the terminal and to be used for signature verification. The list of public keys may include, for example, the public key itself or information indicating the public key (e.g., PLMNID+PKID). When there is an attacking base station (e.g., a fake base station), the fake base station may receive the registration request message sent by the terminal, modify the information including the message, and send the message to the AMF.

[0237] Although not shown in FIG. 7 , the AMF may perform a mutual authentication procedure with the terminal or a network (eg, including a base station or a core network entity).

[0238] At 720, the AMF may identify an encryption or integrity protection algorithm based on the registration request message received from the terminal.

[0239] The AMF may identify the encryption and integrity protection algorithms associated with the transmission or reception of NAS messages performed by the terminal. The AMF may identify the encryption and integrity protection algorithms associated with the transmission or reception of NAS messages based on information about the encryption and integrity protection algorithms supported by the terminal (the information is received from the terminal). The AMF may generate an encryption key or integrity protection key for NAS based on the identified algorithm and K_amf. The AMF may perform integrity protection of the NAS security mode command message by using the generated integrity protection key for NAS, and send the message to the terminal.

[0240] At 730, the AMF may send a NAS security mode command message to the terminal based on the identified encryption or integrity protection algorithm.

[0241] The AMF may not modify the indicator or public key list included in the message received from the terminal. The AMF may send a NAS security mode command message including the indicator or public key list received from the terminal to the terminal.

[0242] The AMF may perform integrity protection of the NAS security mode command message by using the integrity protection key for NAS generated in stage 720, and send the message to the terminal. The NAS security mode command message may be the first message in the NAS message that has been integrity protected. Before the terminal receives the integrity-protected message, the integrity-protected message may not be randomly modified by other entities (e.g., an attacking base station). The NAS message may include at least one of an integrity protection algorithm or an encryption algorithm selected by the AMF.

[0243] The AMF may identify the received list of public keys and may send an additional list of public keys when the list of public keys of the terminal needs to be updated. The additional list of public keys sent by the AMF may include at least one of the public key of the base station where the terminal is currently residing, the public key of other base stations in the HPLMN, or the public key of the base station of the VPLMN.

[0244] At 740, the AMF may receive a NAS Security Mode Complete message.

[0245] The AMF may receive, from the terminal, a NAS security mode complete message including a list of public keys owned by the terminal for signature verification.

[0246] When the information received from the AMF is the same as the information sent by the terminal to the AMF, the terminal can notify the AMF that there is no message forgery by sending a NAS security mode complete message.

[0247] The terminal may generate an encryption key or integrity protection key for NAS based on the encryption algorithm and integrity protection algorithm received from the AMF. The AMF may receive subsequent NAS messages including the NAS security mode completion message based on the key generated by the terminal and based on encryption and integrity protection.

[0248] Although not shown in Figure 7, the AMF can also perform a series of operations related to the AS signaling with the terminal. When the AMF receives the NAS security mode completion message from the terminal, the AMF can identify that the information received from the terminal has not been forged. The AMF can identify the information of the public key that will be used for signature verification and is currently owned by the terminal based on the information received from the terminal. When there is information that needs to be updated in the public key owned by the terminal, the AMF can transmit the information to the base station. The situation where an update is required may include a situation in which some of the public keys owned by the terminal are revoked, or a public key of a specific PLMN is added / removed due to a new contractual relationship.

[0249] At 750, the AMF may send a public key list of the terminal to the UDM based on the NAS security mode complete message received from the terminal. According to an embodiment, the AMF, which knows the public keys held by the terminal (for example, the AMF may recognize the public key list currently held by the terminal by combining the public key list received from the terminal and the public key list information transmitted by the AMF to the base station) may transmit a SUPI as an identifier indicating the terminal and a list of public keys held by the terminal to the UDM.

[0250] The operation of the AMF may not be limited to the operation described with reference to FIG7. The terminal may perform all operations of FIG7, some of them, or a combination of some operations. The terminal may perform all operations of FIG3 to FIG7, some of them, or a combination of some operations.

[0251] By using the configuration diagrams shown in Figures 1A to 7, the diagrams of the control / data signal transmission or reception method, and the diagrams of the operation process, it is not intended to limit the scope of the embodiments of the present disclosure. In other words, all configuration units, entities, or operation stages mentioned with reference to Figures 1A to 7 should not be interpreted as necessary elements for practicing the present disclosure, and the present disclosure can be implemented with only some of these elements without departing from the main purpose of the present disclosure.

[0252] A method performed by a terminal in a wireless communication system may include receiving system information from a base station. The system information may include information related to a public key of the base station. The method may also include determining whether a public key corresponding to the information related to the public key of the base station is stored in the terminal. In the case where the public key is stored, the method may also include verifying a signature of the base station. In addition, the method may also include connecting to the base station or searching for another base station based on whether the signature of the base station is verified.

[0253] The method further includes establishing a radio resource control (RRC) connection with the base station in a case where the system information does not include signature information of the base station.

[0254] The method may further include: in a case where the public key is not stored in the terminal, sending a registration request message to the AMF, the registration request message including information about a first list of public keys held by the terminal or an indicator indicating that the public key is not stored in the terminal, and receiving an encrypted and integrity-protected NAS command message from the AMF based on the first list of public keys held by the terminal.

[0255] The method may further include comparing information included in the registration request message with information included in the NAS command message, and searching for cells of base stations other than the base station based on a result of the comparison.

[0256] In the method, the NAS command message may include information on the second list of public keys that need to be updated for the terminal.

[0257] The method may also include: receiving an AS command message including a second list of public keys that need to be updated for the terminal from the base station, storing the second list of public keys that need to be updated for the terminal, and sending an AS completion message to the base station based on the result of storing the second list of public keys.

[0258] The method may further include receiving information about a list of public keys that need to be updated from the UDM based on the registration request message and the UE UPU / SoR procedure.

[0259] A method performed by an AMF in a wireless communication system may include: receiving a registration request message from a terminal, the registration request message including information about a first list of public keys held by the terminal or an indicator indicating that a public key of a base station is not stored at the terminal. The method may also include identifying an encryption and integrity protection algorithm based on the registration request message, and sending a NAS command message to the terminal based on the registration request message and the identified encryption and integrity algorithm.

[0260] The method may further include sending, to the terminal, a second list of public keys that need to be updated for the terminal, and receiving, from the terminal, a forged NAS completion message notifying that the NAS command message does not exist.

[0261] The method may further include sending a message including information about a first list of public keys held by the terminal to the UDM based on the NAS completion message, and the message sent to the UDM may include information about a SUPI required to identify the terminal.

[0262] A terminal in a wireless communication system may include at least one transceiver and at least one processor functionally coupled to the at least one transceiver. The at least one processor is configured to receive system information from a base station. The system information may include information related to a public key of the base station. The at least one processor is also configured to determine whether a public key corresponding to the information related to the public key is stored in the terminal. In the case where the public key is stored in the terminal and the system information includes signature information of the base station, the at least one processor is configured to verify the signature of the base station, and based on the result of the verification, connect to the base station or search for another base station.

[0263] The at least one processor may also be configured to, if the system information does not include signature information of the base station, establish an RRC connection with the base station.

[0264] The at least one processor may also be configured to, when the public key is not stored in the terminal, send a registration request message to the AMF, the registration request message including information about a first list of public keys held by the terminal or an indicator indicating that the public key is not stored in the terminal, and receive an encrypted and integrity-protected NAS command message from the AMF based on the first list of public keys held by the terminal.

[0265] The at least one processor may also be configured to compare information included in the registration request message with information included in the NAS command message, and search for cells of base stations other than the base station based on a result of the comparison.

[0266] The NAS command message may include information about the second list of public keys that need to be updated for the terminal.

[0267] The at least one processor may also be configured to receive an AS command message including a second list of public keys that need to be updated for the terminal from the base station, store the second list of public keys, and send an AS completion message to the base station based on a result of storing the second list of public keys.

[0268] The at least one processor may be further configured to receive information about a list of public keys that need to be updated from the UDM based on the registration request message and the UE UPU / SoR procedure.

[0269] An AMF in a wireless communication system may include at least one transceiver and at least one processor functionally coupled to the at least one transceiver. The at least one processor is configured to receive a registration request message from a terminal, the registration request message including information about a first list of public keys held by the terminal or an indicator indicating that a public key of a base station is not stored at the terminal, identify an encryption and integrity protection algorithm based on the registration request message, and send a NAS command message to the terminal based on the registration request message and the identified encryption and integrity algorithm.

[0270] The at least one processor may be further configured to send a second list of public keys that need to be updated for the terminal to the terminal, and receive a forged NAS completion message from the terminal notifying that the NAS command message does not exist.

[0271] The at least one processor may be further configured to send a message including information about a first list of public keys held by the terminal to the UDM based on the NAS completion message, and the message sent to the UDM may include information about a SUPI required to identify the terminal.

[0272] The above operations of the embodiment can be implemented by providing a memory device storing corresponding program codes for any unit of the device. That is, the controller in the device can perform the above operations by reading and executing the program codes stored in the memory device with the help of a processor or CPU.

[0273] The various units or modules of the entity or terminal device described herein can be operated using hardware circuits such as complementary metal oxide semiconductor-based logic circuits, firmware, or hardware circuits such as a combination of software and / or hardware, and firmware and / or software embedded in a machine-readable medium. For example, various electrical structures and methods can be implemented using transistors, logic gates, and circuits such as application-specific integrated circuits.

[0274] The methods according to various embodiments described in the claims or specification of the present disclosure may be implemented by hardware, software, or a combination of hardware and software.

[0275] When the method is implemented by software, a computer-readable storage medium for storing one or more programs (software modules) may be provided. One or more programs stored in the computer-readable storage medium may be configured to be executed by one or more processors within an electronic device. At least one program may include instructions for causing an electronic device to perform a method according to various embodiments of the present disclosure as defined by the appended claims and / or disclosed herein.

[0276] The program (software module or software) can be stored in a non-volatile memory, including random access memory and flash memory, read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic disk storage device, compact disk-ROM (CD-ROM), digital versatile disk (DVD) or other type of optical storage device or tape cassette. Alternatively, any combination of some or all of them can form the memory in which the program is stored. In addition, multiple such memories may be included in the electronic device.

[0277] In addition, the program can be stored in an attachable storage device that can access the electronic device through a communication network such as the Internet, an intranet, a local area network (LAN), a wide LAN (WLAN), and a storage area network (SAN), or a combination thereof. Such a storage device can access the electronic device via an external port. In addition, a separate storage device on a communication network can access the portable electronic device.

[0278] In the above detailed embodiments of the present disclosure, the elements included in the present disclosure are expressed in the singular or plural, depending on the detailed embodiments presented. However, for ease of description, the singular form or plural form is appropriately selected for the presented situation, and the present disclosure is not limited to the elements expressed in the singular or plural. Therefore, an element expressed in the plural may also include a single element, or an element expressed in the singular may also include multiple elements.

[0279] Although specific embodiments have been described in the detailed description of the present disclosure, it is clear that various modifications and changes can be made thereto without departing from the scope of the present disclosure. Therefore, the scope of the present disclosure should not be limited to the embodiments, but should be defined by the appended claims and their equivalents.

Claims

1. A method performed by a user equipment (UE) in a wireless communication system, the method comprising: receiving, from a base station, system information including information related to a first public key of the base station; determining whether a second public key corresponding to information related to the first public key is stored in the UE; In a case where the second public key is stored in the UE and the system information includes signature information of the base station, verifying the signature of the base station; as well as Whether the signature based on the base station is verified: establishing a connection with the base station; or Search for another base station.

2. The method according to claim 1, further comprising: In a case where the system information does not include signature information of the base station, a radio resource control (RRC) connection is established with the base station.

3. The method according to claim 1, further comprising: In case the second public key is not stored in the UE: sending a registration request message to an access and mobility management function (AMF) node, the registration request message including information about the first list of public keys stored in the UE or an indicator indicating that the second public key is not stored in the UE; as well as A non-access stratum (NAS) command message subjected to encryption and integrity protection is received from an AMF node based on a first list of public keys stored in the UE.

4. The method according to claim 3, further comprising: comparing information included in the REGISTRATION REQUEST message with information included in the NAS COMMAND message; as well as Based on the result of the comparison, a cell of the another base station different from the base station is searched.

5. The method according to claim 3, wherein: The NAS command message includes information about the second list of public keys that need to be updated for the UE.

6. The method according to claim 3, further comprising: receiving an access stratum (AS) command message from the base station, the AS command message including a second list of public keys that need to be updated for the UE; a second list storing public keys; as well as Based on the result of storing the second list of public keys, an AS completion message is sent to the base station.

7. The method according to claim 3, further comprising: Based on a registration request message and a UE parameter update (UPU) / steer of roaming (SoR) procedure, information about a second list of public keys that need to be updated is received from a unified data manager (UDM) node.

8. A method performed by an access and mobility management function (AMF) node in a wireless communication system, the method comprising: receiving a registration request message from a user equipment (UE), the registration request message including information about a first list of public keys stored in the terminal or an indicator indicating that a public key of the base station is not stored in the UE; Identifying encryption and integrity protection algorithms based on the registration request message; as well as A Non-Access Stratum (NAS) Command message is sent to the UE based on the Registration Request message and the identified ciphering and integrity protection algorithms.

9. The method according to claim 8, further comprising: sending, to the UE, a second list of public keys that need to be updated for the UE; as well as A spurious NAS Complete message is received from the UE notifying the absence of a NAS Command message.

10. The method according to claim 9, further comprising: Based on the NAS Complete message, sending a message including information about the first list of public keys stored in the UE to a unified data manager (UDM), Among them, the message sent to the UDM node includes information about a Subscription Permanent Identifier (SUPI) required to identify the UE.

11. A user equipment (UE) in a wireless communication system, the UE comprising: Transceiver; as well as A controller, coupled to the transceiver, Wherein, the controller is configured as: receiving, from a base station, system information including information related to a first public key of the base station, determining whether a second public key corresponding to information related to the first public key is stored in the UE, In a case where the second public key is stored in the UE and the system information includes signature information of the base station, verifying the signature of the base station; Whether the signature based on the base station is verified: Establishing a connection with the base station, or Search for another base station.

12. The UE according to claim 11, wherein: The controller is also configured to: In a case where the system information does not include signature information of the base station, a radio resource control (RRC) connection is established with the base station.

13. The UE according to claim 11, wherein: The controller is further configured to, if the second public key is not stored in the UE: sending a registration request message to an access and mobility management function (AMF) node, the registration request message including information about the first list of public keys stored in the UE or an indicator indicating that the second public key is not stored in the UE; A non-access stratum (NAS) command message subjected to encryption and integrity protection is received from an AMF node based on a first list of public keys stored in the UE.

14. The UE according to claim 13, wherein: The controller is also configured to: comparing information included in the Registration Request message with information included in the NAS Command message; and Based on the result of the comparison, a cell of the another base station different from the base station is searched.

15. The UE according to claim 13, wherein: The NAS command message includes information about the second list of public keys that need to be updated for the UE.

Images