Radio Access Network (RAN) Node, Core Network Node, and Method

Abstract

This disclosure defines procedures for handling threats related to the replay of SUCI in 5G systems, more specifically, methods for detecting and mitigating man-in-the-middle base stations that replay captured SUCI to track UEs.

Description

[Technical field]

[0001] This disclosure defines procedures to handle threats related to SUCI replay in 5G systems, more specifically, how to detect and mitigate man-in-the-middle base stations that replay captured SUCI to track UEs. [Background technology]

[0002] The 3GPP SA3 Working Group's "Strengthening Authentication in 5GS Study" highlights key issues related to SUCI replay attacks, and outlines specific SUCI linkability attacks and Denial of Service (DoS) attacks related to SUCI replay. The Subscriber Concealed Identifier is a one-time use subscriber identifier called the SUbscription Concealed Identifier (SUCI) that contains the Scheme-Output and additional unconcealed information required for the use of the home network routing and protection scheme. If the UE does not have a temporary mobile identifier (e.g., 5G-GUTI), the UE conceals the SUPI defined in 3GPP TS 33.501 in the SUCI and sends the SUCI in a registration request message. Upon receiving the registration request message, the 5GS performs the following steps: The initiation of the authentication procedure and the selection of the authentication method are shown in Figure 1. The authentication method applied to the UE is selected by the UDM. Figure 2 shows the 5G AKA based primary authentication and key agreement procedure.

[0003] When the UE sends the SUCI in the registration request message, the UE starts timer T3519. When T3519 is running, the UE sends the same SUCI if the registration request message is retransmitted. After timer T3519 expires, the UE deletes the SUCI. If a new SUCI is needed to send in the registration request message, the UE calculates the new SUCI, starts timer T3519 and sends the new SUCI in the registration request message. The same procedure can be applied if an identification procedure is triggered to obtain the SUCI from the UE.

[0004] Man in the Middle (MITM): MITM is a type of relay node. It includes a fake Radio Access Network Node and a fake UE. For example, the fake RAN node includes a fake base station or a fake gNB. The MITM fake RAN creates a fake cell, makes the UE camp on this cell, and captures Access Stratum (AS) and Non-Access Stratum (NAS) messages. The MITM fake UE modifies the content of the AS or NAS messages captured by the MITM fake RAN, and sends the AS and NAS messages to the legitimate RAN in the PLMN. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] 3GPP TR 21.905: "Vocabulary for 3GPP Specifications". V16.0.0 (2019-06) [Non-Patent Document 2] 3GPP TS 23.501: "System architecture for the 5G System (5GS)". V16.7.0 (2020-12) [Non-Patent Document 3] 3GPP TS 23.502: "Procedures for the 5G System (5GS)". V16.7.0 (2020-12) [Non-Patent Document 4] 3GPP TS 24.501: "Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3". V16.7.0 (2020-12) [Non-Patent Document 5] 3GPP TS 33.501: "Security architecture and procedures for 5G system" V16.5.0 (2020-12) [Non-Patent Document 6] 3GPP TS 33.102: "3G Security; Security architecture" V16.0.0 (2020-07) [Non-Patent Document 7] 3GPP TS 24.301: "Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS)" V16.7.0 (2020-12) [Non-Patent Document 8] 3GPP TS 29.272: "Evolved Packet System (EPS); Mobility Management Entity (MME) and Serving GPRS Support Node (SGSN) related interfaces based on Diameter protocol" V16.5.0 (2020-12) Summary of the Invention [Problem to be solved by the invention]

[0006] There is a strong market need to fix the SUCI replay attack and a complete solution to this security threat is required to make 3GPP systems more secure.

[0007] A fake base station (man-in-the-middle) captures the UE's SUCI (e.g., SUCI 1) when the UE is performing the registration procedure using the SUCI. The hacker sets up a fake base station at a different location or the same location. The fake base station traps the UE's initial NAS message and corrupts the UE's 5G-GUTI sent in the initial NAS message (e.g., registration request message) (i.e., the fake base station sends 5G-GUTI 2 instead of 5G-GUTI 1). The 5GC cannot find the UE context corresponding to 5G-GUTI 2 and sends an Identity Request message to obtain the UE's SUCI. The UE sends a SUCI (e.g., SUCI 2) in the Identity response message. The man-in-the-middle traps the identity response message and replaces SUCI 2 with SUCI 1. The man-in-the-middle sends an Identity response message containing SUCI 1, and the 5GC receives the Identity response message containing SUCI 1. Then, 5GC starts the authentication procedure using SUCI 1. If the authentication procedure using SUCI 1 is successfully completed, the hacker can know the location of the UE that sent the initial NAS message and the time when the UE sent the initial NAS message. For example, the hacker can know that the UE is located near the fake base station. Also, if the man-in-the-middle corrupts the 5G-GUTI of the initial NAS message sent by each UE in the cell of the fake base station, the 5GC will send a large number of identity response messages and start a large number of authentication procedures. This causes a DoS attack on both the 5GC and the UE. [Means for solving the problem]

[0008] In one disclosure, a method in a Radio Access Network (RAN) node includes receiving a Radio Resource Control (RRC) message. The RRC message includes a first identifier and a Non-Access-Stratum (NAS) message. The NAS message includes a second identifier. The method includes comparing the first identifier to the second identifier. The method includes discarding the RRC message if the first identifier differs from the second identifier.

[0009] According to one disclosure, a method in a core network node includes receiving a message, the message including a first identifier and a Non-Access-Stratum (NAS) message, the NAS message including a second identifier, the method includes comparing the first identifier to the second identifier, the method includes discarding the NAS message if the first identifier differs from the second identifier.

[0010] According to one disclosure, a method in a core network node includes storing a first identifier. The method includes receiving a message during a NAS procedure. The message includes a second identifier. The method includes comparing the first identifier and the second identifier. The method includes aborting the NAS procedure if the first identifier corresponds to the second identifier.

[0011] According to one disclosure, a method in a core network node includes receiving a first identifier. The method includes starting a timer. The method includes receiving a second identifier. The method includes determining whether the second identifier was transmitted after expiration of the timer. The method includes transmitting a message rejecting the NAS procedure if determining that the second identifier was transmitted after expiration of the timer.

[0012] According to one disclosure, a method in a core network node includes receiving a first identifier. The method includes starting a timer. The method includes receiving a second identifier. The method includes determining whether the second identifier was transmitted within a timer value of the timer. The method includes transmitting a message rejecting the NAS procedure if determining that the second identifier was transmitted within the timer value of the timer.

[0013] According to one disclosure, a method in a core network node includes receiving a first identifier. The method includes starting a timer. The method includes determining whether the timer has expired. The method includes transmitting a message rejecting the NAS procedure if the method determines that the timer has expired.

[0014] A method in a core network node according to one disclosure includes storing a first identifier. The method includes starting a timer. The method includes receiving a message during an authentication procedure. The message includes a second identifier. The method includes determining whether the first identifier corresponds to a second identifier and a timer is running. The method includes rejecting the authentication procedure if it determines that the first identifier corresponds to the second identifier and the timer is not running.

[0015] According to one disclosure, a Radio Access Network (RAN) node includes means for receiving a Radio Resource Control (RRC) message. The RRC message includes a first identifier and a Non-Access-Stratum (NAS) message. The NAS message includes a second identifier. The RAN node includes means for comparing the first identifier and the second identifier. The RAN node includes means for discarding the RRC message if the first identifier is different from the second identifier.

[0016] According to one disclosure, a core network node includes means for receiving a message, the message including a first identifier and a Non-Access-Stratum (NAS) message, the NAS message including a second identifier, the core network node includes means for comparing the first identifier and the second identifier, the core network node includes means for discarding the NAS message if the first identifier differs from the second identifier.

[0017] According to one disclosure, a core network node includes means for storing a first identifier. The core network node includes means for receiving a message during a NAS procedure. The message includes a second identifier. The core network node includes means for comparing the first identifier and the second identifier. The core network node includes means for aborting the NAS procedure if the first identifier corresponds to the second identifier.

[0018] A core network node according to one disclosure includes means for receiving a first identifier. The core network node includes means for starting a timer. The core network node includes means for receiving a second identifier. The core network node includes means for determining whether the second identifier was transmitted after expiration of the timer. The core network node includes means for transmitting a message rejecting the NAS procedure if it determines that the second identifier was transmitted after expiration of the timer.

[0019] A core network node according to one disclosure includes means for receiving a first identifier. The core network node includes means for starting a timer. The core network node includes means for receiving a second identifier. The core network node includes means for determining whether the second identifier has been transmitted within a timer value of the timer. The core network node includes means for transmitting a message rejecting the NAS procedure if it determines that the second identifier has been transmitted within the timer value of the timer.

[0020] According to one disclosure, a core network node includes means for receiving a first identifier. The core network node includes means for starting a timer. The core network node includes means for determining whether the timer has expired. The core network node includes means for transmitting a message rejecting the NAS procedure if it determines that the timer has expired.

[0021] A core network node according to one disclosure includes means for storing a first identifier. The core network node includes means for starting a timer. The core network node includes means for receiving a message during an authentication procedure. The message includes a second identifier. The core network node includes means for determining whether the first identifier corresponds to the second identifier. The core network node includes means for determining whether the timer is running. The core network node includes means for rejecting the authentication procedure if it determines that the first identifier corresponds to the second identifier and the timer is not running. [Brief description of the drawings]

[0022] [Figure 1] FIG. 1 illustrates the initiation of an authentication procedure and the selection of an authentication method. [Diagram 2] FIG. 2 illustrates a 5G AKA-based primary authentication and key agreement procedure. [Diagram 3] FIG. 3 illustrates a procedure for detecting and processing a corrupted NAS message in an (R)AN. [Figure 4] FIG. 4 is a diagram showing the procedure for detecting and processing a corrupted NAS message in AMF. [Diagram 5] FIG. 5 is a diagram showing the procedure for detecting and processing a corrupted NAS message in AMF. [Figure 6] FIG. 6 is a diagram showing a procedure for detecting and handling a corrupted NAS message in UDM. [Figure 7] FIG. 7 is a block diagram illustrating the main components of a UE. [Figure 8]FIG. 8 is a block diagram illustrating the main components of an exemplary (R)AN node. [Figure 9] FIG. 9 is a block diagram illustrating the main components of AMF. [Figure 10] FIG. 10 illustrates the initiation of the authentication procedure and the selection of an authentication method. [Figure 11] FIG. 11 illustrates the initiation of the authentication procedure and the selection of an authentication method. [Figure 12] FIG. 12 illustrates a successful RRC connection establishment procedure. [Figure 13] FIG. 13 is a diagram showing the procedures of RRC connection establishment and network rejection. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] About abbreviations This document applies 3GPP TR 21.905 (Non-Patent Document 1) and the abbreviations shown below. If the same abbreviation is defined in 3GPP TR 21.905 (Non-Patent Document 1), the abbreviation defined in this document takes precedence over it. 4G-GUTI 4G Globally Unique Temporary UE Identity 5GC 5G Core Network 5GLAN 5G Local Area Network 5GS 5G System 5G-AN 5G Access Network 5G-AN PDB 5G Access Network Packet Delay Budget 5G-EIR 5G-Equipment Identity Register 5G-GUTI 5G Globally Unique Temporary Identifier 5G-BRG 5G Broadband Residential Gateway 5G-CRG 5G Cable Residential Gateway 5G GM 5G Grand Master 5G-RG 5G Residential Gateway 5G-S-TMSI 5G S-Temporary Mobile Subscription Identifier 5G VN 5G Virtual Network 5QI 5G QoS Identifier AF Application Function AMF Access and Mobility Management Function AS Access Stratum ATSSS Access Traffic Steering, Switching, Splitting ATSSS-LL ATSSS Low-Layer AUSF Authentication Server Function AUTN Authentication token BMCA Best Master Clock Algorithm BSF Binding Support Function CAG Closed Access Group CAPIF Common API Framework for 3GPP northbound APIs CHF Charging Function CN PDB Core Network Packet Delay Budget CP Control Plane DAPS Dual Active Protocol Stacks DL Downlink DN Data Network DNAI DN Access Identifier DNN Data Network Name DRX Discontinuous Reception DS-TT Device-side TSN translator ePDG evolved Packet Data Gateway EBI EPS Bearer Identity EPS Evolved Packet System EUI Extended Unique Identifier FAR Forwarding Action Rule FN-BRG Fixed Network Broadband RG FN-CRG Fixed Network Cable RG FN-RG Fixed Network RG FQDN Fully Qualified Domain Name GFBR Guaranteed Flow Bit Rate GMLC Gateway Mobile Location Centre GPSI Generic Public Subscription Identifier GUAMI Globally Unique AMF IdentifierGUTI Globally Unique Temporary UE Identity HR Home Routed (roaming) IAB Integrated access and backhaul IMEI / TAC IMEI Type Allocation Code IPUPS Inter PLMN UP Security I-SMF Intermediate SMF I-UPF Intermediate UPF LADN Local Area Data Network LBO Local Break Out (roaming) LMF Location Management Function LoA Level of Automation LPP LTE Positioning Protocol LRF Location Retrieval Function MCC Mobile country code MCX Mission Critical Service MDBV Maximum Data Burst Volume MFBR Maximum Flow Bit Rate MICO Mobile Initiated Connection Only MITM Man In the Middle MNC Mobile Network Code MPS Multimedia Priority Service MPTCP Multi-Path TCP Protocol N3IWF Non-3GPP InterWorking Function N5CW Non-5G-Capable over WLAN NAI Network Access Identifier NEF Network Exposure Function NF Network Function NGAP Next Generation Application Protocol NID Network identifier NPN Non-Public Network NR New Radio NRF Network Repository Function NSI ID Network Slice Instance Identifier NSSAA Network Slice-Specific Authentication and Authorization NSSAAF Network Slice-Specific Authentication and Authorization Function NSSAI Network Slice Selection Assistance Information NSSF Network Slice Selection Function NSSP Network Slice Selection Policy NW-TT Network-side TSN translator NWDAF Network Data Analytics Function PCF Policy Control Function PDB Packet Delay Budget PDR Packet Detection Rule PDU Protocol Data Unit PEI Permanent Equipment Identifier PER Packet Error Rate PFD Packet Flow Description PNI-NPN Public Network Integrated Non-Public Network PPD Paging Policy Differentiation PPF Paging Proceed Flag PPI Paging Policy Indicator PSA PDU Session Anchor PTP Precision Time Protocol QFI QoS Flow Identifier QoE Quality of Experience RACS Radio Capabilities Signalling optimisation (R)AN (Radio) Access Network RG Residential Gateway RIM Remote Interference Management RQA Reflective QoS Attribute RQI Reflective QoS Indication RSN Redundancy Sequence Number SA NR Standalone New Radio SBA Service Based Architecture SBI Service Based Interface SCP Service Communication Proxy SD Slice Differentiator SEAF Security Anchor Functionality SEPP Security Edge Protection Proxy SMF Session Management Function SMSF Short Message Service Function SN Sequence Number SN name Serving Network Name. SNPN Stand-alone Non-Public Network S-NSSAI Single Network Slice Selection Assistance Information SSC Session and Service Continuity SSCMSP Session and Service Continuity Mode Selection PolicySST Slice / Service Type SUCI Subscription Concealed Identifier SUPI Subscription Permanent Identifier SV Software Version TMSI Temporary Mobile Subscriber Identity TNAN Trusted Non-3GPP Access Network TNAP Trusted Non-3GPP Access Point TNGF Trusted Non-3GPP Gateway Function TNL Transport Network Layer TNLA Transport Network Layer Association TSC Time Sensitive Communication TSCAI TSC Assistance Information TSN Time Sensitive Networking TSN GM TSN Grand MasterTSP Traffic Steering Policy TT TSN Translator TWIF Trusted WLAN Interworking Function UCMF UE radio Capability Management Function UDM Unified Data Management UDR Unified Data Repository UDSF Unstructured Data Storage Function UL Uplink UL CL Uplink Classifier UPF User Plane Function URLLC Ultra Reliable Low Latency Communication URRP-AMF UE Reachability Request Parameter for AMF URSP UE Route Selection Policy VID VLAN Identifier VLAN Virtual Local Area Network W-5GAN Wireline 5G Access Network W-5GBAN Wireline BBF Access Network W-5GCAN Wireline 5G Cable Access Network W-AGF Wireline Access Gateway Function

[0024] Definitions This document refers to 3GPP TR 21.905 (Non-Patent Document 1) and the following terms and definitions apply. Terms defined in this document take precedence over the definitions of the same terms in 3GPP TR 21.905 (Non-Patent Document 1).

[0025] general The principles of the following embodiments also apply when a UE initiates an initial registration procedure and sends SUCI 2 in a registration request message, and the MIMT replaces SUCI 2 in the registration request message with SUCI 1.

[0026] Additionally, those skilled in the art will appreciate that elements in the figures are illustrated for simplicity and may not necessarily be drawn to scale. Furthermore, with respect to the structure of a device, one or more components of the device may be represented in the figures by conventional symbols, and the figures may show only certain details that are pertinent to an understanding of the embodiments of the present disclosure, so as not to obscure the figures with details that will be readily apparent to one of ordinary skill in the art having the benefit of the description herein.

[0027] For the purposes of promoting an understanding of the principles of the present disclosure, reference will be made to the embodiments illustrated in the drawings and specific language will be used to describe them. It will nevertheless be understood that no limitation of the scope of the present disclosure is intended thereby. Such changes and further modifications in the illustrated system, and such further applications of the principles of the present disclosure as would normally occur to one skilled in the art, are to be construed as being within the scope of the present disclosure.

[0028] The terms "comprise," "comprising," or other variations are intended to cover a non-exclusive inclusion, such that a process or method comprising a list of steps does not include only those steps, but may include other steps not expressly listed or inherent in such process or method. Similarly, one or more devices or entities or subsystems or elements or structures or components preceding "comprises... a" is not intended to preclude, without more constraints, the presence of other devices, subsystems, elements, structures, components, additional devices, additional subsystems, additional elements, additional structures, or additional components. The appearance of "in one embodiment," "in another embodiment," and similar phrases throughout this specification may, but do not necessarily, all refer to the same embodiment.

[0029] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. The systems, methods, and examples provided herein are illustrative only and are not intended to be limiting.

[0030] In the following specification and claims, reference will be made to a number of terms, which shall be defined to have the following meanings: The singular forms "a," "an," and "the" include plural references unless the context clearly dictates otherwise.

[0031] As used herein, information relates to data and knowledge, since data is meaningful information and represents values ​​attributed to parameters. Furthermore, knowledge refers to an understanding of an abstract or concrete concept. It should be noted that this exemplary system is simplified to facilitate the description of the disclosed subject matter and is not intended to limit the scope of the present disclosure. Other devices, systems, and configurations may be used in addition to or in place of the system to implement the embodiments disclosed herein, and all such embodiments are contemplated as being within the scope of the present disclosure.

[0032] First exemplary embodiment (Solution 1: Detection of corrupted NAS messages in NG-RAN). When the UE starts the initial NAS procedure, the UE sets the 5G-GUTI in both the AS message (e.g., RRC Setup Request message and RRC Setup Complete message) and the initial NAS message (e.g., registration request message or service request message). If a man-in-the-middle attacker (MITM) only modifies the 5G-GUTI in the NAS message and does not modify the 5G-GUTI in the AS message, the legitimate (R)AN can compare the 5G-GUTI in the NAS message with the 5G-GUTI in the AS message. For example, the legitimate (R)AN includes a legitimate gNB. If the 5G-GUTI in the NAS message and the 5G-GUTI in the AS message do not match, the legitimate (R)AN will determine that the NAS message is corrupted and will discard the NAS message.

[0033] Note that in this solution, the MITM includes a fake (R)AN and a fake UE. For example, the fake (R)AN includes a fake gNB.

[0034] FIG. 3 illustrates a procedure for detecting and processing corrupted NAS messages in an (R)AN.

[0035] The detailed steps of the solution are described below. 0) The UE is successfully registered in the PLMN and has a valid 5G-GUTI (e.g. 5G-GUTI 1 containing 5G-TMSI 1). 1) The UE is camped on a cell of a fake (R)AN (e.g., the UE is camped on a cell of a fake gNB in ​​a fake (R)AN). The UE initiates an initial NAS procedure (e.g., a Registration procedure or a service request procedure) on that cell.

[0036] 2a) The UE sends an RRC Setup Request message to a fake (R)AN (e.g., a fake gNB). 2b) The fake (R)AN (e.g., fake gNB) sends an RRC Setup message to the UE. 2c) The UE sends an RRC Setup Complete message to the fake (R)AN (e.g., fake gNB). The RRC Setup Complete message contains a 5G-GUTI (i.e., 5G-GUTI 1 containing 5G-TMSI 1) or a 5G-S-TMSI containing 5G-TMSI (i.e., 5G-TMSI 1) and a Dedicated NAS-message. The Initial NAS message (e.g., Registration Request message) in the Dedicated NAS-message also contains a 5G-GUTI (i.e., 5G-GUTI 1 containing 5G-TMSI 1).

[0037] 3) The MITM corrupts the 5G-TMSI component of 5G-GUTI 1 in a NAS message (e.g., a Registration Request message) with a random 5G-TMSI (i.e., 5G-GUTI 1 is changed to 5G-GUTI 2). For example, the MITM changes 5G-GUTI 1 to 5G-GUTI 2 by corrupting (or changing) 5G-TMSI 1 in 5G-GUTI 1 to 5G-TMSI 2. 5G-GUTI 2 contains 5G-TMSI 2. The MITM may change 5G-TMSI1 to a 5G-TMSI other than 5G-TMSI1 (i.e., the MITM may change 5G-TMSI1 to a 5G-TMSI different from 5G-TMSI1).

[0038] 4a) The bogus UE sends an RRC Setup Request message to a legitimate (R)AN (e.g., a legitimate gNB) of the PLMN. For example, the legitimate (R)AN includes a legitimate gNB. Also, for example, the legitimate (R)AN and the legitimate gNB may be referred to as an (R)AN node or an (R)AN device. 4b) The legitimate (R)AN (e.g., a legitimate gNB) sends an RRC Setup message to the Fake UE. 4c) The fake UE sends an RRC Setup Complete message to a legitimate (R)AN (e.g., a legitimate gNB). The RRC Setup Complete message includes a 5G-S-TMSI containing the same 5G-GUTI (i.e., 5G-GUTI 1) or 5G-TMSI (i.e., 5G-TMSI 1) as in step 2c and a Dedicated NAS-message. The initial NAS message (e.g., a Registration Request message) included in the Dedicated NAS-message includes the 5G-GUTI (i.e., 5G-GUTI 2 containing 5G-TMSI 2) corrupted by the MITM in step 3.

[0039] 5) The authorized (R)AN (e.g., an authorized gNB) compares the 5G-GUTI 1 or 5G-S-TMSI including 5G-TMSI 1 received in the RRC Setup Complete message of step 4c (i.e., at the RRC layer) with the 5G-GUTI 2 including 5G-TMSI 2 from the initial NAS message (e.g., Registration Request message). If the authorized (R)AN determines that 5G-GUTI 1 and 5G-GUTI 2 are different (i.e., 5G-GUTI 1 does not match (or correspond to) 5G-GUTI 2), the authorized (R)AN (e.g., an authorized gNB) determines that the initial NAS message is corrupted.

[0040] For example, a legitimate (R)AN (e.g., a legitimate gNB) compares 5G-TMSI 1 in 5G-GUTI 1 or 5G-S-TMSI in the RRC Setup Complete message with 5G-TMSI 2 in 5G-GUTI 2 in the initial NAS message. If the legitimate (R)AN determines that 5G-TMSI 1 is different from 5G-TMSI 2 (i.e., 5G-TMSI 1 does not match (or correspond to) 5G-TMSI 2), the legitimate (R)AN determines that the initial NAS message is corrupted.

[0041] If the authorized (R)AN (e.g., authorized gNB) determines that the initial NAS message is corrupted, the authorized (R)AN discards the RRC Setup Complete message. The authorized (R)AN (e.g., authorized gNB) further releases the RRC connection.

[0042] A legitimate (R)AN (e.g., a legitimate gNB) may report the detection of a corrupted NAS message to the operation and maintenance system along with an RRC Setup Complete message or some key parameters (e.g., 5G-GUTI 1, 5G-S-TMSI, 5G-TMSI 1, 5G-GUTI 2, 5G-TMSI 2, cell identifiers, etc.).

[0043] Second Exemplary Embodiment (Solution 2: Detection of Corrupted NAS Messages in AMF)

[0044] When the UE initiates the initial NAS procedure, the UE sets the 5G-GUTI in both the AS message (e.g., the RRC Setup Request message and the RRC Setup Complete message) and the initial NAS message (e.g., the Registration Request message or the Service Request message). If a man-in-the-middle attacker (MITM) only modifies the 5G-GUTI in the NAS message and does not modify the 5G-GUTI in the AS message, the legitimate AMF can compare the 5G-GUTI in the NAS message with the 5G-GUTI in the NGAP message. If the 5G-GUTI in the NAS message and the 5G-GUTI in the NGAP message do not match, the AMF determines that the NAS message is corrupted and discards the NAS message.

[0045] FIG. 4 shows a procedure for detecting and handling corrupted NAS messages in the AMF. The detailed steps of this solution are described below. 0) The UE is successfully registered in the PLMN and has a valid 5G-GUTI (e.g. 5G-GUTI 1 with 5G-TMSI 1).

[0046] 1) The UE is camped on a cell of a fake (R)AN. For example, the UE is camped on a cell of a fake gNB in ​​a fake (R)AN. The UE initiates an initial NAS procedure (e.g., a registration procedure, or a service request procedure) in that cell.

[0047] 2a) The UE sends an RRC Setup Request message to a fake (R)AN (e.g., a fake gNB). 2b) The fake (R)AN (e.g., fake gNB) sends an RRC Setup message to the UE. 2c) The UE sends an RRC Setup Complete message to the fake (R)AN (e.g., fake gNB). The RRC Setup Complete message contains a 5G-GUTI (i.e., 5G-GUTI 1 containing 5G-TMSI 1) or a 5G-S-TMSI 1 containing a 5G-TMSI (i.e., 5G-TMSI 1) and a Dedicated NAS-message. The initial NAS message (e.g., Registration Request message) in the Dedicated NAS-message also contains a 5G-GUTI (i.e., 5G-GUTI 1 containing 5G-TMSI 1).

[0048] 3) The MITM corrupts the 5G-TMSI component of 5G-GUTI 1 in a NAS message (e.g., a Registration Request message) with a random 5G-TMSI (i.e., 5G-GUTI 1 is changed to 5G-GUTI 2). For example, the MITM changes 5G-GUTI 1 to 5G-GUTI 2 by corrupting (or changing) 5G-TMSI 1 in 5G-GUTI 1 to 5G-TMSI 2. 5G-GUTI 2 contains 5G-TMSI 2. The MITM may change 5G-TMSI1 to a 5G-TMSI other than 5G-TMSI1 (i.e., the MITM may change 5G-TMSI1 to a 5G-TMSI different from 5G-TMSI1).

[0049] 4a) The fake UE sends an RRC Setup Request message to a legitimate (R)AN (e.g., a legitimate gNB) of the PLMN. For example, the legitimate (R)AN includes a legitimate gNB. 4b) The legitimate (R)AN (e.g., a legitimate gNB) sends an RRC Setup message to the fake UE. 4c) The fake UE sends an RRC Setup Complete message to the legitimate (R)AN (e.g., legitimate gNB). The RRC Setup Complete message contains the same 5G-GUTI (i.e., 5G-GUTI 1) or 5G-TMSI (i.e., 5G-TMSI 1) as in step 2c and a Dedicated NAS-message. The initial NAS message (e.g., Registration Request message) in the Dedicated NAS-message contains the 5G-GUTI (i.e., 5G-GUTI 2 containing 5G-TMSI 2) corrupted by the MITM in step 3.

[0050] 5) The authorized (R)AN (e.g., authorized gNB) sends an Initial UE message to the AMF. The Initial UE message includes 5G-GUTI 1 or 5G-S-TMSI 1 received by the RRC Setup Complete message of step 4c. The Initial UE message also includes a NAS-PDU. The NAS-PDU includes the Initial NAS message (e.g., a registration request message) mentioned in step 4c. That is, the NAS-PDU includes the 5G-GUTI (i.e., 5G-GUTI 2 including 5G-TMSI 2) corrupted by the MITM in step 3. For example, the AMF is referred to as a core network node or a core network device.

[0051] 6) The AMF compares the 5G-S-TMSI 1 containing 5G-GUTI 1 or 5G-TMSI 1 received in the initial UE message with the 5G-GUTI 2 containing 5G-TMSI 2 in the initial NAS message (e.g., registration request message). If the AMF determines that 5G-GUTI 1 and 5G-GUTI 2 are different (i.e. 5G-GUTI 1 does not match (or correspond to) 5G-GUTI 2), it determines that the initial NAS message is corrupted. For example, the AMF compares 5G-TMSI 1 in 5G-GUTI 1 or 5G-S-TMSI 1 of the initial UE message with 5G-TMSI 2 in 5G-GUTI 2 of the initial NAS message. If the AMF determines that 5G-TMSI 1 is different from 5G-TMSI 2 (i.e., 5G-TMSI 1 does not match (or correspond to) 5G-TMSI 2), the AMF determines that the initial NAS message is corrupted.

[0052] If the AMF determines that the initial NAS message is corrupted, the AMF discards the NAS message (e.g., a registration request message). The AMF may report the detection of a corrupted NAS message to the operation and maintenance system together with the initial UE message or some key parameters (e.g., 5G-GUTI 1, 5G-S-TMSI 1, 5G-TMSI 1, 5G-GUTI 2, 5G-TMSI 2, cell identifiers, etc.). The above processes performed by the AMF may also be performed by the SEAF.

[0053] Variation 1 of Solution 2 In step 6 of solution 2, if the AMF determines that the NAS message is corrupted, it sends an NGAP message including 5G-TMSI 2 of the NAS message (e.g., a registration request message) received in step 5 to the legitimate (R)AN, and requests the legitimate (R)AN to perform an RRC Setup screening process for 5G-TMSI 2. The NGAP message may be a new NGAP message or an existing NGAP message.

[0054] Upon receiving the NGAP message, the legitimate (R)AN discards the RRC Setup Complete message containing 5G-TMSI 2 or the NAS message containing 5G-TMSI 2 in the RRC signaling as it is a corrupted or spoofed 5G-TMSI. The above processes performed by the AMF may also be performed by the SEAF.

[0055] Third Exemplary Embodiment (Solution 3: Determining Fake UEs During Identity Request Procedure) Whenever the MITM corrupts the 5G-GUTI in the registration request message, the AMF cannot find the UE context related to the corrupted 5G-GUTI in the AMF and sends an Identity Request message to the UE to fetch the UE's SUCI. If the AMF has stored the SUCI received in the identity response message from the UE, or the combination of the 5G-GUTI received in the registration request message and the SUCI received in the identity response message from the UE, with a corrupted 5G-GUTI for a predefined period in the past, the AMF can find a linkability attack attempt if the received SUCI matches the one stored in the AMF. If the AMF finds a possible linkability attack attempt, the AMF aborts the initial NAS procedure.

[0056] Figure 5 shows the procedure for detecting and handling corrupted NAS messages in the AMF. The detailed steps of the procedure are given below: 0-a) The UE is successfully registered with the PLMN and has a valid 5G-GUTI 1 (e.g., 5G-GUTI 1 including 5G-TMSI 1). The UE has previously sent SUCI 1 in a registration request message. For example, the UE has sent SUCI 1 in a registration request message before the UE had a valid 5G-GUTI. 0-b) The MITM has previously captured and stored the UE's SUCI 1 from a registration request message. 0-c) The AMF stores SUCI 1 previously received in the identity response message.

[0057] Furthermore, the AMF may store SUCIs other than SUCI 1. Furthermore, the AMF may store a combination of the 5G-GUTI received in the registration request message and the SUCI received in the identity response message triggered by the registration request message. The AMF may store a combination of the 5G-TMSI and the SUCI included in the 5G-GUTI. For example, the AMF may store a combination of the 5G-GUTI and SUCI1, or a combination of the 5G-TMSI of the 5G-GUTI and SUCI1.

[0058] 1) The UE is camped on a cell of a fake (R)AN. For example, the UE is camped on a cell of a fake gNB in ​​a fake (R)AN. The UE initiates an initial NAS procedure (e.g., a registration procedure, or a service request procedure) in that cell.

[0059] 2a) The UE sends an RRC Setup Request message to a fake (R)AN (e.g., a fake gNB). 2b) The fake (R)AN (e.g., fake gNB) sends an RRC Setup message to the UE. 2c) The UE sends an RRC Setup Complete message to the fake (R)AN (e.g., fake gNB). The RRC Setup Complete message contains a 5G-GUTI (i.e., 5G-GUTI 1 containing 5G-TMSI 1) or a 5G-S-TMSI 1 containing a 5G-TMSI (i.e., 5G-TMSI 1) and a Dedicated NAS-message. The initial NAS message (e.g., Registration Request message) in the Dedicated NAS-message also contains a 5G-GUTI (i.e., 5G-GUTI 1 containing 5G-TMSI 1).

[0060] 3) The MITM corrupts the 5G-TMSI component of 5G-GUTI 1 in a NAS message (e.g., a Registration Request message) with a random 5G-TMSI (i.e., 5G-GUTI 1 is changed to 5G-GUTI 2). For example, the MITM changes 5G-GUTI 1 to 5G-GUTI 2 by corrupting (or changing) 5G-TMSI 1 in 5G-GUTI 1 to 5G-TMSI 2. 5G-GUTI 2 contains 5G-TMSI 2. The MITM may change 5G-TMSI1 to a 5G-TMSI other than 5G-TMSI1 (i.e., the MITM may change 5G-TMSI1 to a 5G-TMSI different from 5G-TMSI1).

[0061] 4) The fake UE sends an RRC Setup Request message to a legitimate (R)AN (e.g., a legitimate gNB) of the PLMN. For example, the legitimate (R)AN includes a legitimate gNB. The legitimate (R)AN (e.g., a legitimate gNB) sends an RRC Setup message to the fake UE. After the fake UE successfully sets up the RRC connection, it sends an RRC Setup Complete message to the legitimate (R)AN (e.g., a legitimate gNB). The RRC Setup Complete message includes a 5G-S-TMSI 1 containing the same 5G-GUTI (i.e., 5G-GUTI 1) or 5G-TMSI (i.e., 5G-TMSI 1) as in step 2c, and a Dedicated NAS-message. The initial NAS message (e.g., a Registration Request message) in the dedicated NAS-message includes the 5G-GUTI (i.e., 5G-GUTI 2 containing 5G-TMSI 2) corrupted by the MITM in step 3.

[0062] 5) The authorized (R)AN (e.g., authorized gNB) sends an Initial UE message to the AMF during the NAS procedure. The Initial UE message includes 5G-GUTI 1 or 5G-S-TMSI 1 received by the RRC Setup Complete message in step 4. The Initial UE message also includes a NAS-PDU. The NAS-PDU includes the Initial NAS message (e.g., a Registration Request message) mentioned in step 4. That is, the NAS-PDU includes the 5G-GUTI corrupted by the MITM in step 3 (i.e., 5G-GUTI 2 including 5G-TMSI 2).

[0063] 6) When the AMF receives an initial UE message containing 5G-TMSI 2, the AMF does not find a UE context for the UE associated with 5G-TMSI 2 in 5G-GUTI 2. The AMF sends an Identity Request message with identity type set to SUCI to the UE to obtain the UE's SUCI. Initiate the Identification procedure.

[0064] 7) The UE calculates the SUCI (i.e., SUCI 2) and sends an Identity response message including SUCI 2 to the fake (R)AN (e.g., fake gNB).

[0065] 8) The fake (R)AN (e.g., fake gNB) replaces SUCI 2 in the Identity response message with SUCI 1 based on SUCI 1 stored in the MITM.

[0066] 9) The fake (R)AN (e.g., a fake gNB) sends an Identity Request message including SUCI 1 to the AMF.

[0067] 10) When the AMF receives SUCI 1, it compares SUCI 1 with all SUCIs stored in the AMF. If the AMF finds a match for SUCI 1 (or if the AMF determines that SUCI 1 corresponds to one of the SUCIs stored in the AMF), the AMF determines that SUCI 1 is no longer valid. The AMF discards the Registration request message and aborts the initial NAS procedure (e.g., the registration procedure). The AMF determines that there is a MITM that modifies the SUCI in the Identity response message. The AMF may report the detection of a corrupted NAS message to the operation and maintenance system together with the initial UE message or some key parameters (e.g., 5G-GUTI 1, 5G-S-TMSI 1, 5G-TMSI 1, 5G-GUTI 2, 5G-TMSI 2, SUCI 1, cell identifier, etc.).

[0068] Further, in step 10, the AMF may determine whether the combination of the 5G-GUTI 2 or 5G-TMSI 2 received in step 5 and the SUCI 1 received in step 9 is included in the combinations stored in the AMF. If the AMF finds the combination of the 5G-GUTI 2 or 5G-TMSI 2 received in step 5 and the SUCI 1 received in step 9 among the stored combinations (or determines that the combination of the 5G-GUTI 2 or 5G-TMSI 2 received in step 5 and the SUCI 1 received in step 9 corresponds to a stored combination), it determines that the SUCI 1 is no longer valid. The AMF discards the registration request message and aborts the initial NAS procedure (e.g., registration procedure). The AMF determines that there is a MITM that changes the 5G-GUTI in the NAS message and the SUCI in the Identity response message. The above processes performed by the AMF may be performed by the SEAF.

[0069] Variation 1 of Solution 3 In one example, the NWDAF may subscribe to a MITM detection service provided by the AMF. When the AMF receives the SUCI in the registration request message or identity response message, the AMF sends the received SUCI, the associated 5G-GUTI, the received E-UTRAN cell identifier (ECI), the received E-UTRAN cell global identifier (ECGI), the received NR cell identifier (NCI), the received NR cell global identifier (NCGI), time information when the AMF receives the registration request message or identity response message, and important parameters of the registration request message or identity response message to the NWDAF using a first message, which is an existing message or a new message between the NF and the NWDAF. The AMF may wait for a response message from the NWDAF.

[0070] If the received SUCI does not have an associated T3519 running in the NWDAF for a predefined period (e.g., 24 hours), the NWDAF starts T3519 for the received SUCI. If the received SUCI does not have an associated T3510 running in the NWDAF, the NWDAF starts T3510 for the received SUCI. The NWDAF starts T3511 if T3510 expires for the received SUCI.

[0071] If the received SUCI has an associated T3519 running or the associated T3519 has recently expired within a predefined period (e.g., 24 hours), or if the received SUCI has an associated T3510 running or an associated T3511 running in the NWDAF, the following processing is applied in the NWDAF.

[0072] - If the NWDAF detects that the AMF sends the same SUCI after the T3519 timer value (e.g., 60 seconds) or that the AMF sends the same SUCI within 25 seconds (the sum of the T3510 and T3511 timer values), it sends a second message, which can be an existing message between the NWDAF and the NF or a new message, to the AMF to reject the registration procedure. When the AMF receives the second message, it rejects the registration procedure with a cause value such as illegal UE or fake base station. - If the NWDAF detects that the AMF sends the same SUCI within the T3519 timer value, it sends a third message, which may be an existing message or a new message between the NF and the NWDAF, indicating that it will proceed with the registration procedure. Upon receiving the third message, the AMF proceeds with the registration procedure.

[0073] In one example, if the NWDAF determines that the same SUCI was sent by different AMFs, the NWDAF determines that man-in-the-middle is functioning in the network. In this case, the NWDAF sends a request to the AMF that sent the SUCI to reject the registration procedure as described above. The AMF follows the procedure as defined above.

[0074] If the NWDAF determines that a MITM is present in the network, it notifies the Operation and Maintenance (OAM) so that OAM can take some kind of security action. The above processes performed by the AMF may also be performed by the SEAF.

[0075] Variation 2 of Solution 3 In one example, the NWDAF may subscribe to a MITM detection service provided by the AMF.

[0076] When the AMF receives the same SUCI after T3519 in a registration request message or identity response message, it sends the received SUCI, the associated 5G-GUTI, the received E-UTRAN Cell Identity (ECI), the received E-UTRAN Cell Global Identification (ECGI), the received NR Cell Identity (NCI), the received NR Cell Global Identity (NCGI), the time information when the AMF received the registration request message or identity response message, and the important parameters of the registration request message or identity response message to the NWDAF using a first message, which may be an existing message or a new message between the NF and the NWDAF. The AMF may wait for a response message from the NWDAF.

[0077] If the received SUCI does not have an associated T3519 running in the NWDAF for a predefined period (e.g., 24 hours), the NWDAF will start a T3519 for the received SUCI.

[0078] If the received SUCI has an associated T3519 running, or if the associated T3519 has recently expired within a predefined period (e.g., 24 hours), the following processing applies to the NWDAF.

[0079] - If the NWDAF detects that the SUCI is not sent by the UE after the T3519 timer (e.g., the NWDAF detects the expiration of T3519), the NWDAF sends a second message, which can be an existing message or a new message between the NWDAF and the NF, to the AMF to reject the registration procedure. Upon receiving the second message, the AMF rejects the registration procedure with a cause value such as incorrect UE or fake base station.

[0080] - If the NWDAF detects that the AMF has sent the same SUCI within the T3519 timer value, it sends a third message, either an existing message or a new message between the NF and the NWDAF, indicating to proceed with the registration procedure. Upon receiving the third message, the AMF proceeds with the registration procedure.

[0081] In one example, if the NWDAF determines that the same SUCI was sent by a different AMF, the NWDAF determines that man-in-the-middle is functioning in the network. In this case, the NWDAF sends a request to the AMF that sent the SUCI to reject the registration procedure, as described above. The AMF follows the procedure defined above.

[0082] When the NWDAF determines that a MITM is present in the network, it notifies the Operation and Maintenance (OAM) so that OAM can take some security action. The above processes performed by the AMF may also be performed by the SEAF.

[0083] Fourth embodiment (Solution 4 UDM discards SUCI after 60 seconds) When UDM receives a SUCI in Nudm_UEAuthentication_Get Request for the first time, UDM starts timer T3519 (60 seconds). If UDM receives the same SUCI in Nudm_UEAuthentication_Get Request while timer T3519 is running, UDM starts the authentication procedure, otherwise (i.e., if UDM receives the same SUCI in Nudm_UEAuthentication_Get Request when timer T3519 is not running or has expired), UDM determines that the UE is a fake UE and rejects Nudm_UEAuthentication_Get Request. UDM keeps n latest SUCIs per SUPI (n is a positive integer) after timer T3519 expires for each SUCI. UDM rejects Nudm_UEAuthentication_Get Request if a fake UE stores one of the stored SUCIs.

[0084] FIG. 6 shows the procedure for detecting and handling corrupted NAS messages in UDM. The detailed steps of the procedure are given below: 0-a) The UE is successfully registered with the PLMN and has a valid 5G-GUTI 1 (e.g., 5G-GUTI 1 including 5G-TMSI 1). The UE has previously sent SUCI 1 in a registration request message. For example, the UE has sent SUCI 1 in a registration request message before the UE had a valid 5G-GUTI. 0-b) The MITM has previously obtained and stored the UE's SUCI 1 from a registration request message. 0-c) The UDM receives SUCI 1 for the first time in Nudm_UEAuthentication_GetRequest during the authentication procedure. For example, the UDM is called a core network node or a core network device. 0-d) The UDM stores SUCI1 and starts a timer T3519 for SUCI1 (for example, the value of T3519 is 60 seconds). Note that the UDM may start the timer T3519 when it receives SUCI1. Furthermore, when the UDM receives SUCI1, it may deconceal SUCI1 into a SUPI and store the combination of SUCI1 and SUPI. Furthermore, the UDM may deconceal a SUCI other than SUCI 1 into a SUPI, and the UDM may store the combination of the SUCI and SUPI. The UDM may store multiple combinations of SUCI and SUPI (e.g., a combination of SUCI1 and SUPI1, a combination of SUCI2 and SUPI2, etc.). The UDM may hold (or maintain) the SUCI (e.g., SUCI 1) received for each SUPI for a predetermined period (e.g., 24 hours).

[0085] 1a) The UE is camped on a cell of a fake (R)AN. For example, the UE is camped on a cell of a fake gNB of the fake (R)AN. The UE initiates an initial NAS procedure (e.g., a registration procedure or a service request procedure) on the cell. The UE sends an RRC Setup Request message to the fake (R)AN (e.g., the fake gNB). 1b) The fake (R)AN (e.g., fake gNB) sends an RRC Setup message to the UE. 1c) The UE sends an RRC Setup Complete message to the fake (R)AN (e.g., fake gNB). The RRC Setup Complete message contains a 5G-GUTI (i.e., 5G-GUTI 1 containing 5G-TMSI 1) or a 5G-S-TMSI 1 containing a 5G-TMSI (i.e., 5G-TMSI 1) and a Dedicated NAS-message. The initial NAS message (e.g., Registration Request message) in the Dedicated NAS-message also contains a 5G-GUTI (i.e., 5G-GUTI 1 containing 5G-TMSI 1).

[0086] 2) The MITM corrupts the 5G-TMSI component of 5G-GUTI 1 in a NAS message (e.g., a Registration Request message) with a random 5G-TMSI (i.e., 5G-GUTI 1 is changed to 5G-GUTI 2). For example, the MITM changes 5G-GUTI 1 to 5G-GUTI 2 by corrupting (or changing) 5G-TMSI 1 in 5G-GUTI 1 to 5G-TMSI 2. 5G-GUTI 2 contains 5G-TMSI 2. The MITM may change 5G-TMSI1 to a 5G-TMSI other than 5G-TMSI1 (i.e., the MITM may change 5G-TMSI1 to a 5G-TMSI different from 5G-TMSI1).

[0087] 3) The fake UE sends an RRC Setup Request message to a legitimate (R)AN (e.g., a legitimate gNB) of the PLMN. For example, the legitimate (R)AN includes a legitimate gNB. The legitimate (R)AN (e.g., a legitimate gNB) sends an RRC Setup message to the fake UE. After the fake UE successfully sets up an RRC connection, it sends an RRC Setup Complete message to the legitimate (R)AN (e.g., a legitimate gNB). The RRC Setup Complete message includes a 5G-S-TMSI 1 containing the same 5G-GUTI (i.e., 5G-GUTI 1) or 5G-TMSI (i.e., 5G-TMSI 1) as in step 1c, and a Dedicated NAS-message. The initial NAS message (e.g., a Registration Request message) in the dedicated NAS-message includes the 5G-GUTI (i.e., 5G-GUTI 2 containing 5G-TMSI 2) corrupted by the MITM in step 2.

[0088] 4) The authorized (R)AN (e.g., authorized gNB) sends an Initial UE message to the AMF during the NAS procedure. The Initial UE message includes 5G-GUTI 1 or 5G-S-TMSI 1 received by the RRC Setup Complete message in step 3. The Initial UE message also includes a NAS-PDU. The NAS-PDU includes an Initial NAS message (e.g., a Registration Request message) as described in step 3. That is, the NAS-PDU includes the 5G-GUTI corrupted by the MITM in step 2 (i.e., 5G-GUTI 2 including 5G-TMSI 2).

[0089] 5) When the AMF receives an initial UE message containing 5G-TMSI 2, the AMF does not find a UE context for the UE related to 5G-TMSI 2 in 5G-GUTI 2. The AMF sends an Identity Request message with identity type set to SUCI to the UE to obtain the UE's SUCI. Initiate the Identification procedure.

[0090] 6) The UE calculates the SUCI (i.e., SUCI 2) and sends an Identity response message including SUCI 2 to the fake (R)AN (e.g., fake gNB).

[0091] 7) The fake (R)AN (e.g., fake gNB) replaces SUCI 2 in the Identity response message with SUCI 1 based on SUCI 1 stored in the MITM.

[0092] 8) The fake (R)AN (e.g., a fake gNB) sends an Identity Request message including SUCI 1 to the AMF.

[0093] 9) Upon receiving SUCI1, the AMF sends a Nausf_UEAuthentication_Authenticate Request message including SUCI1 to the AUSF. The Nausf_UEAuthentication_Authenticate Request message may include the associated 5G-GUTI for the SUCI, the E-UTRAN cell identifier (ECI), the E-UTRAN cell global identifier (ECGI), the NR cell identifier (NCI), the NR cell global identifier (NCGI), and time information when the AMF received the registration request message or the identity response message.

[0094] 10) Upon receiving a Nausf_UEAuthentication_Authenticate Request message including SUCI 1, the AUSF sends a Nudm_UEAuthentication_Get Request message including SUCI 1 to the UDM. The Nudm_UEAuthentication_Get Request message may include the associated 5G-GUTI for the SUCI, the E-UTRAN cell identifier (ECI), the E-UTRAN cell global identifier (ECGI), the NR cell identifier (NCI), the NR cell global identifier (NCGI), and time information when the AMF received the registration request message or the identity response message.

[0095] 11) When the UDM receives the Nudm_UEAuthentication_Get Request message containing SUCI 1, the UDM deciphers SUCI 1 to a SUPI. The UDM determines whether SUCI 1 for the SUPI is stored in the UDM and timer T3519 is running. For example, if the UDM determines that SUCI 1 matches one of the stored SUCIs as mentioned in step 0-d (or if the UDM determines that SUCI 1 corresponds to one of the stored SUCIs as mentioned in step 0-d), it considers that SUCI 1 for the SUPI is stored in the UDM. Otherwise, the UDM considers that SUCI 1 for the SUPI is not stored in the UDM.

[0096] For example, the UDM determines whether the combination of SUCI1 and the SUPI obtained by unmasking SUCI1 matches one of the stored combinations as described in step 0-d. If the UDM determines that the combination matches one of the stored combinations (or if the UDM determines that the combination corresponds to one of the stored combinations), the UDM considers that SUCI1 for the SUPI is stored in the UDM. Otherwise, the UDM considers that SUCI1 for the SUPI is not stored in the UDM.

[0097] The UDM takes one of the following actions: i) If SUCI 1 for the SUPI is not stored, the UDM stores SUCI 1 for the SUPI and starts timer T3519 (e.g. if the combination of SUCI 1 and the SUPI obtained by deciphering SUCI 1 is not stored in the UDM, the UDM stores the combination and starts timer T3519 for SUCI 1). The UDM starts the authentication procedure for the UE by sending a Nudm_UEAuthentication_Get Response message.

[0098] ii) If SUCI 1 for SUPI is stored and timer T3519 for SUCI 1 is running, the UDM initiates an authentication procedure for the UE.

[0099] iii) If SUCI 1 for the SUPI is stored for the SUPI and timer T3519 has expired (or T3519 is not running), the UDM rejects the Nudm_UEAuthentication_Get Request message and sends a Nudm_UEAuthentication_Get Response message with a rejection cause (e.g., rogue UE). That is, the UDM rejects the authentication procedure. The rejection cause may be included in the Nudm_UEAuthentication_Get Response message. The UDM may determine that a MITM is present in the network. Once the NWDAF or UDM determines that a MITM is present in the network, the NWDAF or UDM notifies the Operation and Maintenance (OAM) so that the OAM can take some security action.

[0100] In one example, the UDM sends the configured reject cause to the fraudulent UE if the UDM first receives SUCI 1 after the expiration of timer T3519.

[0101] In another example, if the UDM receives SUCI 1 multiple times after the expiry of timer T3519, the UDM can determine that a MITM is present and that the MITM has corrupted the SUCI. In this case, the UDM performs an authentication procedure, and after the authentication procedure is successful, the UDM sends a new message to the AUSF with a rejection cause set to the fraudulent UE. The AUSF then sends a message with the rejection cause to the AMF. The AMF establishes a security context with the UE using the partial security context created in the latest authentication procedure by initiating a security mode command procedure. Once the security context is established, the AMF sends a registration reject message with an integrity protected rejection cause to the UE. Upon receiving the registration reject message with a rejection cause, the UE barrs the current cell, i.e., the UE does not consider the current cell for camping.

[0102] 12) The UDM sends a Nudm_UEAuthentication_Get Response message to the AUSF, including the rejection cause (e.g., unauthorized UE). The rejection cause may be included in the Nudm_UEAuthentication_Get Response message.

[0103] 13) The AUSF sends a Nausf_UEAuthentication_Authenticate Response message to the AMF containing the rejection cause (e.g., unauthorized UE).

[0104] 14) Upon receiving a Nausf_UEAuthentication_Authenticate Response message with a rejection cause (e.g., unauthorized UE), the AMF aborts the registration procedure and sends to the UE a Registration Reject message with the 5GMM cause set to the rejection cause (e.g., unauthorized UE). The AMF may report the detection of a corrupted NAS message to the operation and maintenance system together with the initial UE message or some key parameters (e.g., 5G-GUTI 1, 5G-S-TMSI 1, 5G-TMSI 1, 5G-GUTI 2, 5G-TMSI 2, SUCI 1, cell identifier, etc.).

[0105] 15) Upon receiving a Registration Reject message with a rejection cause (e.g., Rogue UE), the UE shall abort the registration procedure and, if the 5GMM cause is set to Rogue UE, the UE shall enter a restricted service state and shall consider the USIM as invalid until the UE is power cycled. Also, upon receiving a Registration Reject message with, e.g., a rejection cause, the UE shall bar the current cell, i.e. the UE shall not consider the current cell for camping.

[0106] Variation 1 of Solution 4 In one example, the NWDAF may subscribe to a MITM detection service provided by the UDM. When the UDM receives the SUCI in the Nudm_UEAuthentication_GetRequest message, it sends the received SUCI, the associated 5G-GUTI, the received E-UTRAN cell identifier (ECI), the received E-UTRAN cell global identifier (ECGI), the received NR cell identifier (NCI), the received NR cell global identifier (NCGI), time information when the AMF received the registration request message or the identity response message, and some important parameters of the Nudm_UEAuthentication_GetRequest message to the NWDAF using a first message, which may be an existing message or a new message between the NF and the NWDAF.

[0107] Note that the Nausf_UEAuthentication_Authenticate Request message and the Nudm_UEAuthentication_GetRequest message may include the SUCI and associated 5G-GUTI, the E-UTRAN Cell Identifier (ECI), the E-UTRAN Cell Global Identifier (ECGI), the NR Cell Identifier (NCI), the NR Cell Global Identifier (NCGI), and time information when the AMF received the registration request message or the identity response message. The UDM may wait for a response message from the NWDAF.

[0108] If a received SUCI does not have an associated T3519 running in the NWDAF for a predefined period (e.g., 24 hours), the NWDAF starts T3519 for the received SUCI. If a received SUCI does not have an associated T3510 running in the NWDAF, the NWDAF starts T3510 for the received SUCI. The NWDAF starts T3511 if T3510 for the received SUCI expires.

[0109] If the received SUCI has an associated T3519 running or the associated T3519 has recently expired within a predefined period (e.g., 24 hours), or if the received SUCI has an associated T3510 running or an associated T3511 running in the NWDAF, the following processing is applied in the NWDAF.

[0110] - If the NWDAF detects that the UDM sends the same SUCI after the T3519 timer value (e.g. 60 seconds) or that the UDM sends the same SUCI within 25 seconds (the sum of the T3510 and T3511 timer values), the NWDAF sends a second message, which can be an existing message or a new message between the NWDAF and the NF, to the UDM to reject the registration procedure. When the UDM receives the second message, it rejects the registration procedure with a cause value such as a rogue UE or a fake base station. The NWDAF determines that a MITM is present in the network.

[0111] - If the NWDAF detects that the UDM sends the same SUCI within the T3519 timer value, it sends a third message, either an existing message between the NF and the NWDAF or a new message, indicating to proceed with the registration procedure. Upon receiving the third message, the UDM proceeds with the registration procedure.

[0112] Variation 2 of Solution 4 In one example, the NWDAF may subscribe to MITM detection services provided by the UDM.

[0113] When the UDM receives the same SUCI in the Nudm_UEAuthentication_GetRequest message after T3519, it sends the received SUCI, the associated 5G-GUTI, the received E-UTRAN Cell Identifier (ECI), the received E-UTRAN Cell Global Identifier (ECGI), the received NR Cell Identifier (NCI), the received NR Cell Global Identifier (NCGI), time information when the AMF received the registration request message or the identity response message and some important parameters of the Nudm_UEAuthentication_GetRequest message to the NWDAF using a first message, which may be an existing message between the NF and the NWDAF or a new message.

[0114] Note that the Nausf_UEAuthentication_Authenticate Request message and the Nudm_UEAuthentication_GetRequest message may include the SUCI and associated 5G-GUTI, the E-UTRAN Cell Identifier (ECI), the E-UTRAN Cell Global Identifier (ECGI), the NR Cell Identifier (NCI), the NR Cell Global Identifier (NCGI), and time information when the AMF received the registration request message or the identity response message. The UDM may wait for a response message from the NWDAF.

[0115] If the received SUCI does not have an associated T3519 running in the NWDAF for a predefined period (e.g., 24 hours), the NWDAF will start a T3519 for the received SUCI.

[0116] If the received SUCI has an associated T3519 running, or if the associated T3519 has recently expired within a predefined period (e.g., 24 hours), the following processing applies to the NWDAF.

[0117] - If the NWDAF detects that no SUCI is sent by the UE after the T3519 timer (e.g., the NWDAF detects that T3519 has expired), the NWDAF sends a second message, which can be an existing message or a new message between the NWDAF and the NF, to the UDM to reject the registration procedure. When the UDM receives the second message, it rejects the registration procedure with a cause value such as rogue UE or fake base station. The NWDAF determines that a MITM is present in the network.

[0118] - If the NWDAF detects that the UDM sends the same SUCI within the T3519 timer value, it sends a third message, either an existing message or a new message between the NF and the NWDAF, indicating to proceed with the registration procedure. Upon receiving the third message, the UDM proceeds with the registration procedure.

[0119] If the NWDAF determines that a MITM is present in the network, it notifies the Operation and Maintenance (OAM) so that OAM can take some security action.

[0120] User Equipment (UE) Figure 7 is a block diagram illustrating the main components of a UE. As shown, the UE includes transceiver circuitry operable to transmit signals to and receive signals from connected node(s) via one or more antennas. Although not necessarily shown in Figure 7, the UE of course has all the usual functionality of a conventional mobile device (such as a user interface), which may be provided by any one or any combination of hardware, software and firmware, as appropriate. Software may be pre-installed in memory and / or downloaded, for example, over a telecommunications network or from a removable data storage device (RMD).

[0121] The controller controls the operation of the UE according to software stored in the memory. The software includes, among other things, an operating system and a communication control module having at least a transceiver control module. The communication control module (using its transceiver control submodule) is responsible for signaling and processing (generation / transmission / reception) of uplink / downlink data packets between the UE and other nodes such as base stations / (R)AN nodes, MME, AMF (and other core network nodes). Such signaling may include, for example, appropriately formatted signaling messages related to establishing and maintaining connections (RRC connection establishment and other RRC messages), periodic location update related messages (tracking area update, paging area updates, location area update), etc. Such signaling may include, for example, in the case of reception, broadcast information (e.g. Master Information and System Information).

[0122] (R)AN Node FIG. 8 is a block diagram illustrating the main components of an exemplary (R)AN node, e.g., a base station ("eNB" in LTE, "gNB" in 5G). As shown, the (R)AN node includes transceiver circuitry operable to transmit signals to and receive signals from connected UE(s) via one or more antennas, and to transmit signals to and receive signals from other network nodes (directly or indirectly) via a network interface. A controller controls the operation of the (R)AN node according to software stored in memory. The software may be pre-installed in the memory and / or may be downloaded, for example, via a telecommunications network or from a removable data storage device (RMD). The software includes, among other things, an operating system and a communications control module having at least a transceiver control module.

[0123] The communication control module (using its transceiver control submodule) is responsible for handling (generating / sending / receiving) signaling (e.g., directly or indirectly) between the (R)AN node and other nodes such as UEs, MMEs, AMFs, etc. The signaling may include suitably formatted signaling messages such as periodic location update related messages (tracking area updates, paging area updates, location area updates, etc.), S1 AP messages and NG AP messages (i.e., messages over the N2 reference point), related to radio connectivity and location procedures (for a particular UE), in particular to connection establishment and maintenance (RRC connection establishment and other RRC messages). Such signaling may also include, for example, in the case of transmission, broadcast information (e.g., master information and system information).

[0124] The controller, if implemented, is also configured (by software or hardware) to handle related tasks such as UE mobility estimate and / or moving trajectory estimation.

[0125] AMF FIG. 9 is a block diagram showing the main components of the AMF. The AMF is included in the 5GC. As shown, the AMF includes a transceiver circuit operable to transmit signals to and receive signals from other nodes (including UEs) via a network interface. A controller controls the operation of the AMF according to software stored in the memory. The software may be pre-installed in the memory and / or can be downloaded, for example, via a telecommunications network or from a removable data storage device (RMD). The software includes, among other things, an operating system and a communication control module having at least a transceiver control module.

[0126] The communication control module (using its transceiver control sub-module) is responsible for handling (generating / sending / receiving) signaling (directly or indirectly) between the AMF and other nodes such as UEs, base stations / (R)AN nodes (e.g., "gNBs" or "eNBs"). Such signaling may include, for example, appropriately formatted signaling messages related to the procedures described herein, such as NG AP messages (i.e., messages over the N2 reference point) for conveying NAS messages to and from the UE, etc.

[0127] A user equipment (or "UE", "mobile station", "mobile device" or "wireless device") in this disclosure is an entity that connects to a network via the air interface.

[0128] It should be noted that a UE in this specification is not limited to a dedicated communication device, but can apply to any device having communication capabilities as a UE described in this specification, as described in the following paragraphs.

[0129] The terms “user equipment” or “UE” (as this term is used by 3GPP), “mobile station”, “mobile device”, and “wireless device” are generally intended to be synonymous with each other and also include standalone mobile stations such as terminals, mobile phones, smartphones, tablets, cellular IoT devices, IoT devices, and machines.

[0130] It will be understood that the terms "UE" and "wireless device" also encompass devices that remain stationary for extended periods of time.

[0131] The UE may, for example, be an item of equipment for production or manufacturing and / or an item of energy related machinery (for example equipment or machinery such as: boilers; engines; turbines; solar panels; wind turbines; hydroelectric generators; thermal generators; nuclear generators; batteries; nuclear systems and / or related equipment; heavy electrical machinery; pumps including vacuum pumps; compressors; fans; blowers; hydraulic equipment; pneumatic equipment; metal processing machinery; manipulators; robots and / or application systems thereof; tools; moulds or dies; rolls; conveying equipment; lifting equipment; material handling equipment; textile machinery, sewing machines, printing and related machinery, paper converting machinery, chemical machinery, mining and construction machinery and related equipment, agricultural and forestry machinery, safety and environmental protection equipment, tractors, precision bearings, chains, gears, power transmission equipment, lubrication equipment, valves, pipe fittings, and / or application systems of the aforementioned equipment and machinery).

[0132] A UE may be, for example, an item of transportation equipment (e.g., rail cars; automobiles; motorcycles; bicycles; trains; buses; carts; rickshaws; boats and other watercraft; aircraft; rockets; satellites; drones; balloons, and the like).

[0133] A UE may be, for example, an item of information and communications equipment (eg, information and communications equipment such as: electronic computers and related equipment; communications and related equipment; electronic components, etc.).

[0134] The UE may be, for example, a refrigerator, a refrigerator application product, an item of trade and / or service industry equipment, a vending machine, an automated service machine, an office machine or equipment, consumer electronics and electronic devices (e.g., consumer electronics such as: audio equipment; video equipment; loudspeakers; radios; televisions; microwave ovens; rice cookers; coffee machines; dishwashers; washing machines; dryers; electronic fans or related appliances; cleaners, etc.).

[0135] The UE may be, for example, an electrical application system or device (eg, an electrical application system or device such as: an x-ray system; a particle accelerator; a radioisotope device; a sonic device; an electromagnetic application device; an electronic power application device, etc.).

[0136] The UE may be, for example, an electronic lamp, a lighting fixture, a measuring instrument, an analyzer, a tester, or a surveying or sensing device (e.g., surveying or sensing devices such as: smoke alarms; human alarm sensors; motion sensors; radio tags, etc.), a watch or clock, laboratory equipment, optical equipment, medical equipment and / or systems, a weapon, an item of cutlery, a hand tool, etc.

[0137] The UE may be, for example, a personal digital assistant or related equipment with wireless communication capabilities, such as a wireless card or module designed for attachment or insertion into another electronic device (e.g., a personal computer, an electrical measuring machine).

[0138] The UE may be a device or part of a system that uses various wired and / or wireless communication technologies to provide the applications, services, and solutions described below as the Internet of Things (IoT).

[0139] Internet of Things devices (or "Things") may be equipped with appropriate electronics, software, sensors, network connectivity, etc., enabling these devices to collect and exchange data with each other and with other communicating devices. IoT devices may consist of automated equipment that follows software instructions stored in internal memory. IoT devices may operate without the need for human supervision or interaction. IoT devices may also remain stationary and / or inactive for long periods of time. IoT devices may be implemented as part of a (generally) stationary piece of equipment. IoT devices may also be embedded in non-stationary equipment (e.g., vehicles) or attached to animals or people being monitored / tracked.

[0140] It will be appreciated that IoT technology can be implemented on any communication device that can be connected to a communication network to send and receive data without regard to control by human input or software instructions stored in memory.

[0141] It will be appreciated that an IoT device may also be referred to as a machine type communication (MTC) device or a machine-to-machine (M2M) communication device or a narrowband IoT UE (NB-IoT UE). It will be appreciated that a UE may support one or more IoT or MTC applications. Some examples of MTC applications are listed in Table 3 (Source: 3GPP TS 22.368, Annex B, the contents of which are incorporated herein by reference). This list is not exhaustive and is intended to illustrate some examples of machine type communication applications. Table 1: Some examples of machine-type communication applications. [Table 1]

[0142] The applications, services, and solutions may be MVNO (Mobile Virtual Network Operator) services, emergency wireless communication systems, PBX (Private Branch eXchange) systems, PHS / digital cordless communication systems, POS (Point of sale) systems, advertising call systems, MBMS (Multimedia Broadcasting and Multicast Services), V2X (Vehicle to Everything) systems, train radio systems, location-related services, disaster / emergency wireless communication services, and community services, video streaming services, femtocell application services, VoLTE (Voice over LTE) services, billing services, radio on-demand services, roaming services, activity monitoring services, communication carrier / communication network selection services, function restriction services, PoC (Proof of Concept) services, personal information management services, ad hoc networks / DCN (Delay Tolerant Networking) services, and the like.

[0143] Furthermore, the above-mentioned UE categories are merely examples of applications of the technical ideas and exemplary embodiments described herein, and it should be understood that these technical ideas and embodiments are not limited to the above-mentioned UEs and may be modified in various ways.

[0144] The whole or part of the exemplary embodiments disclosed above can be described as follows, but are not limited thereto.

[0145] / *************** UDM-based solution *************** / 6.1.2 Initiating Authentication and Selecting an Authentication Method The initiation of primary authentication is shown in Figure 6.1.2-1 (see Figure 10 of this application). Figure 6.1.2-1: Starting the authentication procedure and selecting the authentication method The SEAF may initiate authentication with the UE during any procedure of establishing a signaling connection with the UE, according to SEAF policies. The UE shall use the SUCI or 5G-GUTI in the registration request.

[0146] Whenever the SEAF wants to initiate authentication, it shall invoke the Nausf_UEAuthentication service by sending a Nausf_UEAuthentication_Authenticate Request message to the AUSF.

[0147] The Nausf_UEAuthentication_Authenticate Request message shall contain one of the following: - SUCI as defined in the current specification, or - SUPI as defined in TS 23.501 [2].

[0148] The SEAF shall include the SUPI in the Nausf_UEAuthentication_Authenticate Request message if the SEAF has a valid 5G-GUTI and reauthenticates the UE. Otherwise, the SUCI is included in the Nausf_UEAuthentication_Authenticate Request. The SUPI / SUCI structure is part of the stage 3 protocol design.

[0149] The Nausf_UEAuthentication_Authenticate Request shall further include: - The serving network name, as defined in clause 6.1.1.4 of this document.

[0150] NOTE 2: The local policy on the selection of the authentication method does not have to be per UE but can be the same for all UEs.

[0151] Upon receiving the Nausf_UEAuthentication_Authenticate Request message, the AUSF shall verify that the requesting SEAF of the serving network has the right to use the serving network name in the Nausf_UEAuthentication_Authenticate Request by comparing the serving network name with the expected serving network name. The AUSF shall temporarily store the received serving network name. If the serving network is not authorized to use the serving network name, the AUSF shall respond with "serving network not authorized" in the Nausf_UEAuthentication_Authenticate Response.

[0152] The Nudm_UEAuthentication_Get Request sent from the AUSF to the UDM contains the following information: - SUCI or SUPI; - serving network name;

[0153] Upon receiving a Nudm_UEAuthentication_Get Request, the UDM shall invoke the SIDF if a SUCI is received. The SIDF shall decipher the SUCI to obtain the SUPI before the UDM can process the request.

[0154] Based on the SUPI, the UDM / ARPF shall select the authentication method. NOTE 3: The Nudm_UEAuthentication_Get Response to the Nudm_UEAuthentication_Get Request and the Nausf_UEAuthenticate Response message to the Nausf_UEAuthentication_Authenticate Request message are described as part of the authentication procedure in subclause 6.1.3.

[0155] To detect Man-in-the-Middle (i.e., MITM) attack attempts, the UDM SHALL track the received SUCI per SUPI for a predefined period (e.g., 24 hours). Upon receiving a Nudm_UEAuthentication_Get Request, the UDM SHALL decipher the SUCI to the SUPI and perform one of the following actions:

[0156] i) The UDM starts timer T3519 for the received SUCI and performs the authentication procedure as defined in subclause 6.1.3 if the UDM does not contain a SUCI for the SUPI and T3519 has not been performed in the UDM.

[0157] ii) If timer T3519 is running in the UDM for a SUCI of a SUPI, the UDM performs the authentication procedure as defined in subclause 6.1.3. iii) For a SUPI, if a SUCI already exists in the UDM and timer T3519 for the SUCI is not running (i.e. has expired), the UDM shall reject the authentication procedure by sending a Nudm_UEAuthentication_Get Response with cause set to unauthorized UE.

[0158] Furthermore, if the NWDAF determines that a MITM is present in the network, the NWDAF notifies the Operation and Maintenance (OAM) so that the OAM can take any security action.

[0159] / *************************AMF based solution ************* / 6.1.2 Initiating Authentication and Selecting an Authentication Method The initiation of primary authentication is shown in Figure 6.1.2-1 (see Figure 11 of this application). Figure 6.1.2-1: Starting the authentication procedure and selecting the authentication method

[0160] The SEAF may initiate authentication with the UE during any procedure of establishing a signaling connection with the UE, according to SEAF policies. The UE shall use the SUCI or 5G-GUTI in the registration request.

[0161] Whenever the SEAF wants to initiate authentication, it shall invoke the Nausf_UEAuthentication service by sending a Nausf_UEAuthentication_Authenticate Request message to the AUSF.

[0162] The Nausf_UEAuthentication_Authenticate Request message shall contain one of the following: - SUCI as defined in the current specification, or - SUPI as defined in TS 23.501 [2].

[0163] The SEAF shall include the SUPI in the Nausf_UEAuthentication_Authenticate Request message if the SEAF has a valid 5G-GUTI and reauthenticates the UE. Otherwise, the SUCI is included in the Nausf_UEAuthentication_Authenticate Request. The SUPI / SUCI structure is part of the stage 3 protocol design.

[0164] The Nausf_UEAuthentication_Authenticate Request shall further include: - The serving network name, as defined in Section 6.1.1.4 of this document.

[0165] NOTE 2: The local policy on the selection of the authentication method does not have to be per UE but can be the same for all UEs.

[0166] Upon receiving the Nausf_UEAuthentication_Authenticate Request message, the AUSF shall verify that the requesting SEAF of the serving network has the right to use the serving network name in the Nausf_UEAuthentication_Authenticate Request by comparing the serving network name with the expected serving network name. The AUSF shall temporarily store the received serving network name. If the serving network is not authorized to use the serving network name, the AUSF shall respond with "serving network not authorized" in the Nausf_UEAuthentication_Authenticate Response.

[0167] The Nudm_UEAuthentication_Get Request sent from the AUSF to the UDM contains the following information: - SUCI or SUPI; - serving network name;

[0168] Upon receiving a Nudm_UEAuthentication_Get Request, the UDM shall invoke the SIDF if a SUCI is received. The SIDF shall decipher the SUCI to obtain the SUPI before the UDM can process the request.

[0169] Based on the SUPI, the UDM / ARPF shall select the authentication method. NOTE 3: The Nudm_UEAuthentication_Get Response to the Nudm_UEAuthentication_Get Request and the Nausf_UEAuthenticate Response message to the Nausf_UEAuthentication_Authenticate Request message are described as part of the authentication procedure in subclause 6.1.3.

[0170] To detect Man-in-the-Middle (i.e. MITM) attack attempts, the AMF / SEAF shall track the received SUCI for a predefined period (e.g. 24 hours). Alternatively, if the AMF does not find a certain number of UE contexts based on the received 5G-GUTI in the Initial NAS message or 5G-S-TMSI in the Initial UE message, it may start storing the SUCI received in the Identity response message. Upon receiving a registration request message or an identity response message containing a SUCI, the AMF / SEAF shall perform one of the following actions:

[0171] i) The AMF / SEAF starts timer T3519 for the received SUCI if the AMF / SEAF does not contain the SUCI and T3519 is not performed in AMF / SEAF for the SUCI, and starts the authentication procedure as defined in subclause 6.1.3.

[0172] ii) If timer T3519 is running in the AMF / SEAF for SUCI, the AMF / SEAF starts the authentication procedure as defined in subclause 6.1.3.

[0173] iii) If the SUCI already exists in the AMF / SEAF and the timer T3519 for the SUCI is not running (i.e. expired), the AMF / SEAF shall reject the registration procedure or the initial NAS message by sending a response message (e.g., registration rejected) with the cause set to unauthorized UE. Furthermore, the AMF shall notify the NWDAF indicating a MITM attack by sending a message containing (SUCI, global cell ID, at least one parameter received in the initial UE message or initial NAS message). Furthermore, if the NWDAF determines that a MITM is in the network, the NWDAF shall notify it to the Operation and Maintenance (OAM) for the OAM to take some security action.

[0174] / ********************************************RAN-based solution *********************************************************** / 5.3.3 RRC Connection Establishment 5.3.3.1 General Figure 5.3.3.1-1: RRC connection established successfully. (See Figure 12 of this application.) Figure 5.3.3.1-2: RRC connection establishment, network rejection. (See Figure 13 of this application) The purpose of this procedure is to establish an RRC connection, which includes the SRB1 establishment, and is used to transfer initial NAS dedicated information / messages from the UE to the network.

[0175] The network may, for example, apply the following procedure: - When establishing an RRC connection; - When the UE resumes or re-establishes the RRC connection, if the network is unable to obtain or verify the UE context. In this case, the UE receives RRCSetup and responds with RRCSetupComplete.

[0176] 5.3.3.1a Conditions for Establishment of an RRC Connection for Sidelink Communication For NR sidelink communication, RRC connection establishment is initiated only if: 1> If configured by higher layers to transmit NR sidelink communication and relevant data is available to transmit: 2> if a frequency on which the UE is configured to transmit NR sidelink communications is included in the sl-FreqInfoList in SIB12 provided by the cell on which the UE is camped, and the valid version of SIB12 does not include sl-TxPoolSelectedNormal for that frequency;

[0177] For V2X sidelink communication, an RRC connection is initiated only if the conditions specified for V2X sidelink communication in clause 5.3.3.1a of TS 36.331

[10] are met. NOTE: Higher layers initiate the RRC connection. The interaction with the NAS is left to the UE implementation.

[0178] 5.3.3.2 Start The UE initiates this procedure when higher layers request establishment of an RRC connection while the UE is in RRC_IDLE and has acquired mandatory system information for sidelink communication as described in 5.2.2.1 or as specified in subclause 5.3.3.1a. Before initiating this procedure, the UE shall ensure that it has valid and up-to-date essential system information as specified in subclause 5.2.2.2.

[0179] At the start of the procedure, the UE shall: 1> When requesting the establishment of an RRC connection, higher layers provide an Access Category and one or more Access Identities: 2> Execute the unified access control procedure specified in 5.3.14 using the access categories and access identities provided by higher layers; 3> If the access attempt is prohibited, the procedure ends; 1> apply the default L1 parameter values ​​specified in the corresponding physical layer specification, except for parameters whose values ​​are provided in SIB1; 1> apply the default MAC Cell Group configuration as specified in 9.2.2; 1> apply the CCCH configuration specified in 9.1.1.2; 1> Apply timeAlignmentTimerCommon included in SIB1; 1> Start timer T300; 1> Initiate sending of RRCSetupRequest message according to 5.3.3.3;

[0180] 5.3.3.3 Actions related to sending the RRCSetupRequest message The UE sets the content of the RRCSetupRequest message as follows: 1> Set ue-Identity as follows: 2> If higher layers provide 5G-S-TMSI: 3> set ue-Identity to ng-5G-S-TMSI-Part1; 2> In other cases 3>0...2 39 Draw a 39-bit random value in the range -1 and set ue-Identity to this value;

[0181] NOTE 1: If the UE is registered in the TA of the current cell, higher layers provide 5G-S-TMSI. 1> Set establishmentCause according to information received from higher layers; The UE shall submit the RRCSetupRequest message to lower layers for transmission. The UE shall continue cell reselection related measurements and cell reselection evaluations. If the conditions for cell reselection are met, the UE shall perform cell reselection as specified in 5.3.3.6.

[0182] 5.3.3.4 Reception of RRCSetup by the UE Upon receiving RRCSetup, the UE shall perform the following actions: 1> RRCSetup is received in response to an RRCReestablishmentRequest; or 1> If RRCSetup is received in response to RRCResumeRequest or RRCResumeRequest1: 2> Discard all stored UE Inactive AS contexts and suspendConfig; 2> K RRCenc Key, K RRCint Key, K UPint Key, K UPenc Destroy all current AS security contexts, including keys; 2> Release radio resources of all established RBs except SRB0, including releasing the RLC entity, associated PDCP entities, and SDAP; 2> Release the RRC configurations, except for the default L1 parameter values, the default MAC cell group configuration, and the CCCH configuration; 2> Indicate RRC connection fallback to higher layers; 2> Stop timer T380 if it is running; 1> Perform the cell group configuration procedure as specified in 5.3.5.5 according to the received masterCellGroup; 1> perform the radio bearer configuration procedure as specified in 5.3.5.6 according to the received radioBearerConfig; 1> discard the cell reselection priority information provided by cellReselectionPriorities or inherited from other RATs, if stored; 1> Stop timers T300, T301 or T319 if they are running; 1> If the T390 is running: 2> Stop timer T390 for all access categories; 2> Perform the actions specified in 5.3.14.4; 1> If T302 is running: 2> Stop timer T302; 2> Perform the actions specified in 5.3.14.4; 1> Stop timer T320 if it is running; 1> If RRCSetup is received in response to RRCResumeRequest, RRCResumeRequest1, or RRCSetupRequest: 2> If the T331 is running: 3> Stop timer T331; 3> Take the action specified in 5.7.8.3; 2>Enter RRC_CONNECTED; 2> Stop the cell reselection procedure; 1> Consider the current cell as PCell; 1> Set the content of the RRCSetupComplete message as follows: 2> If higher layers provide 5G-S-TMSI: 3> If RRCSetup is received in response to RRCSetupRequest: 4> set ng-5G-S-TMSI-Value to ng-5G-S-TMSI-Part2; 3> If not: 4> set ng-5G-S-TMSI-Value to ng-5G-S-TMSI; 2> set selectedPLMN-Identity to the PLMN or SNPN selected by higher layers (TS 24.501

[23] ) from the PLMN(s) included in the plmn-IdentityList in SIB1, or to the PLMN(s) or SNPN(s) included in the npn-IdentityInfoList; 2> If the upper layer provides 'Registered AMF': 3> Include and configure registeredAMF as follows: 4> If the PLMN identity of the 'Registered AMF' is different from the PLMN selected by higher layers: 5> Include plmnIdentity in registeredAMF and set it to the value of PLMN identity in 'Registered AMF' received from higher layers; 4> set amf-Identifier to the value received from higher layers; 3> Include guami-Type and set it to the value provided by the upper layer; 2> If the higher layer provides one or more S-NSSAIs (see TS 23.003

[21] ): 3> Include s-NSSAI-List and set its contents to the value provided by higher layers; 2> Set the dedicatedNAS-Message to include the information received from the upper layer; 2> If you connect as an IAB-node: 3> include iab-NodeIndication; 2> If SIB1 includes idleModeMeasurementsNR and the UE has NR idle / inactive measurement information for cells other than the PCell available in VarMeasIdleReport, or 2> If SIB1 includes idleModeMeasurementsEUTRA and the UE has E-UTRA idle / inactive measurement information available in VarMeasIdleReport: 3> Include idleMeasAvailable; 2> If the UE has logged measurements available in NR and the RPLMN is included in the plmn-IdentityList stored in the VarLogMeasReport: 3> Include logMeasAvailable in the RRCSetupComplete message; 2> If the UE has Bluetooth logged measurements available and the RPLMN is included in the plmn-IdentityList stored in the VarLogMeasReport: 3> Include logMeasAvailableBT in the RRCSetupComplete message; 2> If the UE has WLAN logged measurements available and the RPLMN is included in the plmn-IdentityList stored in the VarLogMeasReport: 3> Include logMeasAvailableWLAN in the RRCSetupComplete message; 2> If the UE has connection establishment failure or connection resume failure information available in VarConnEstFailReport and the RPLMN is equal to the plmn-Identity stored in VarConnEstFailReport: 3> Include connEstFailInfoAvailable in the RRCSetupComplete message; 2> If the UE has radio link failure or handover failure information available in the VarRLF-Report and the RPLMN is included in the plmn-IdentityList stored in the VarRLF-Report: 3> If reconnectCellId in VarRLF-Report is not set: 4> Set timeUntilReconnection in VarRLF-Report to the time elapsed since the last radio link or handover failure; 4> Set nrReconnectCellId of reconnectCellId of VarRLF-Report to the global cell identity and tracking area code of the PCell; 3> Include rlf-InfoAvailable in the RRCSetupComplete message; 2> If the UE supports inter-RAT MRO NR RLF reporting as defined in TS 36.306

[62] and the UE has radio link failure or handover failure information available in the VarRLF-Report of TS 36.331

[10] : 3> If reconnectCellId in VarRLF-Report in TS 36.331

[10] is not set: 4> set timeUntilReconnection in VarRLF-Report of TS 36.331

[10] to the time elapsed since the last radio link or handover failure in LTE; 4> Set the nrReconnectCellId of the reconnectCellId of the VarRLF-Report in TS 36.331

[10] to the global cell ID and tracking area code of the PCell; 3> If the UE is capable of cross-RAT RLF reporting and the RPLMN is included in the plmn-IdentityList stored in the VarRLF-Report of TS 36.331

[10] 4> Include rlf-InfoAvailable in the RRCSetupComplete message; 2> If the UE supports storing mobility history information and the UE has mobility history information available in VarMobilityHistoryReport: 3> Include mobilityHistoryAvail in the RRCSetupComplete message; 2> If RRCSetup was received in response to RRCResumeRequest, RRCResumeRequest1 or RRCSetupRequest: 3> If speedStateReselectionPars is set in SIB2: 4> include mobilityState in the RRCSetupComplete message and set it to the mobility state of the UE just before entering RRC_CONNECTED state (specified in TS 38.304

[20] ); 1> Submit an RRCSetupComplete message to the lower layers for transmission, at which point the procedure is terminated.

[0183] 5.3.3.5 Reception of RRCSetupComplete by the network When the network receives the RRCSetupComplete message, it compares the 5G-GUTI received during RRC connection establishment with the 5G-GUTI included in the dedicatedNAS-Message, and if they are identical, it proceeds with the RRC connection establishment procedure; otherwise, it discards the RRCSetupComplete message and releases the RRC connection locally.

[0184] The above timers and timer names (e.g., T3510, T3511, T3519) are merely examples, that is, other timers and other timer names may be used in the processes in the above embodiments. Furthermore, all or part of the embodiment examples disclosed above can be described as the following supplementary notes, but the present invention is not limited thereto.

[0185] (Appendix 1) receiving a Radio Resource Control (RRC) message including a first identifier and a Non-Access-Stratum (NAS) message including a second identifier; comparing the first identifier with the second identifier; discarding the RRC message if the first identifier is different from the second identifier; A method for a Radio Access Network (RAN) node. (Appendix 2) the first identifier and the second identifier are associated with a user equipment; 2. The method of claim 1, wherein the RAN node (Appendix 3) the RAN node is a base station; 3. The method of claim 1 or 2, wherein the RAN node (Appendix 4) receiving a message including a first identifier and a Non-Access-Stratum (NAS) message including a second identifier; comparing the first identifier with the second identifier; discarding the NAS message if the first identifier is different from the second identifier; A method for a core network node. (Appendix 5) the first identifier and the second identifier are associated with a user equipment; 5. A method for a core network node as claimed in claim 4. (Appendix 6) sending a message requesting that messages including the second identifier be discarded if the first identifier is different from the second identifier; 6. A method for a core network node according to claim 4 or 5. (Appendix 7) The core network node is an Access and Mobility Management Function (AMF); 7. A method for a core network node according to any one of Supplementary Notes 4 to 6. (Appendix 8) storing the first identifier; receiving a message during the NAS procedure that includes a second identifier; Comparing the first identifier and the second identifier; if the first identifier corresponds to the second identifier, aborting the NAS procedure; A method for a core network node. (Appendix 9) The core network node is an Access and Mobility Management Function (AMF); 9. A method for a core network node according to claim 8. (Appendix 10) the first identifier is stored together with a third identifier; receiving a message including a fourth identifier; comparing a first combination of the first identifier and the third identifier and a second combination of the second identifier and the fourth identifier; if the first combination corresponds to the second combination, aborting the NAS procedure. 10. A method of a core network node according to claim 8 or 9. (Appendix 11) Receiving a first identifier; Start a timer, receiving a second identifier; determining whether the second identifier was transmitted after expiration of the timer; transmitting a message to reject the NAS procedure when it is determined that the second identifier was transmitted after the expiration of the timer. A method for a core network node. (Appendix 12) Receiving a first identifier; Start a timer, receiving a second identifier; determining whether the second identifier was transmitted within a timer value of the timer; transmitting a message to reject the NAS procedure when it is determined that the second identifier has been transmitted within a timer value of the timer. A method for a core network node. (Appendix 13) Receiving a first identifier; Start a timer, determining whether the timer has expired; sending a message to reject the NAS procedure when it is determined that the timer has expired; A method for a core network node. (Appendix 14) The core network node is a Network Data Analytics Function (NWDAF); A method for a core network node according to any one of Supplementary Notes 11 to 13. (Appendix 15) storing the first identifier; Start a timer, During the authentication procedure, a message is received that includes a second identifier; determining whether the first identifier corresponds to the second identifier and whether the timer is running; rejecting the authentication procedure if it is determined that the first identifier corresponds to the second identifier and the timer is not running. A method for a core network node. (Appendix 16) The method of claim 15, wherein the core network node is a Unified Data Management (UDM). (Appendix 17) means for receiving a Radio Resource Control (RRC) message including a first identifier and a Non-Access-Stratum (NAS) message including a second identifier; means for comparing the first identifier with the second identifier; and means for discarding the RRC message if the first identifier is different from the second identifier. Radio Access Network (RAN) node. (Appendix 18) the first identifier and the second identifier are associated with a user equipment; 17. The RAN node according to claim 17. (Appendix 19) the RAN node is a base station; 19. The RAN node of claim 17 or 18. (Appendix 20) means for receiving a message including a first identifier and a Non-Access-Stratum (NAS) message including a second identifier; means for comparing the first identifier with the second identifier; means for discarding the NAS message if the first identifier is different from the second identifier. Core network node. (Appendix 21) the first identifier and the second identifier are associated with a user equipment; 21. The core network node of claim 20. (Appendix 22) means for transmitting a message requesting that a message including the second identifier be discarded if the first identifier is different from the second identifier; 22. A core network node according to claim 20 or 21. (Appendix 23) The core network node is an Access and Mobility Management Function (AMF); 23. A core network node according to any one of Supplementary Notes 20 to 22. (Appendix 24) means for storing a first identifier; means for receiving a message during a NAS procedure, the message including a second identifier; means for comparing the first identifier with the second identifier; and means for aborting the NAS procedure if the first identifier corresponds to the second identifier. Core network node. (Appendix 25) The core network node is an Access and Mobility Management Function (AMF); 25. A core network node as claimed in claim 24. (Appendix 26) the first identifier is stored together with a third identifier; means for receiving a message including a fourth identifier; means for comparing a first combination of the first identifier and the third identifier and a second combination of the second identifier and the fourth identifier; and means for aborting the NAS procedure if the first combination corresponds to the second combination. 26. A core network node according to claim 24 or 25. (Appendix 27) means for receiving a first identifier; means for initiating a timer; means for receiving a second identifier; means for determining whether the second identifier was transmitted after expiration of the timer; means for transmitting a message to reject a NAS procedure when it is determined that the second identifier was transmitted after expiration of the timer. Core network node. (Appendix 28) means for receiving a first identifier; means for initiating a timer; means for receiving a second identifier; means for determining whether the second identifier has been transmitted within a timer value of the timer; means for transmitting a message to reject a NAS procedure when it is determined that the second identifier has been transmitted within a timer value of the timer. Core network node. (Appendix 29) means for receiving a first identifier; means for initiating a timer; means for determining whether the timer has expired; means for transmitting a message for rejecting a NAS procedure when it is determined that the timer has expired; Core network node. (Appendix 30) The core network node is a Network Data Analytics Function (NWDAF); 30. A core network node according to any one of Supplementary Notes 27 to 29. (Appendix 31) means for storing a first identifier; means for initiating a timer; means for receiving a message including a second identifier during an authentication procedure; means for determining whether the first identifier corresponds to the second identifier; means for determining whether the timer is running; means for rejecting the authentication procedure if it is determined that the first identifier corresponds to the second identifier and the timer is not running. Core network node. (Appendix 32) 32. The core network node of claim 31, wherein the core network node is a Unified Data Management (UDM).

[0186] This application claims the benefit of priority to Indian Patent Application No. 202111000766 filed on January 7, 2021, the disclosure of which is incorporated herein by reference in its entirety.

Claims

1. means for receiving a Radio Resource Control (RRC) message including a first identifier and a Non-Access-Stratum (NAS) message including a second identifier; means for comparing the first identifier with the second identifier; means for discarding the RRC message if the first identifier is different from the second identifier; Each of the first identifier and the second identifier includes at least one of a Globally Unique Temporary Identifier (GUTI) and a Temporary Mobile Subscription Identifier (TMSI), The first identifier and the second identifier are identical when the RRC message is transmitted by the user equipment. Radio Access Network (RAN) node.

2. The first identifier and the second identifier are associated with a user device. The RAN node of claim 1.

3. The RAN node is a base station 3. A RAN node according to claim 1 or 2.

4. means for receiving a message including a first identifier and a Non-Access-Stratum (NAS) message including a second identifier; means for comparing the first identifier with the second identifier; means for discarding the NAS message if the first identifier is different from the second identifier; Each of the first identifier and the second identifier includes at least one of a Globally Unique Temporary Identifier (GUTI) and a Temporary Mobile Subscription Identifier (TMSI), The first identifier and the second identifier of a Radio Resource Control (RRC) message on which the NAS message is based are identical when the RRC message is transmitted by the user equipment. Core network node.

5. The first identifier and the second identifier are associated with a user device. A core network node as claimed in claim 4.

6. means for transmitting a message requesting that a message including the second identifier be discarded if the first identifier is different from the second identifier; A core network node according to claim 4 or 5.

7. The core network node is an Access and Mobility Management Function (AMF); A core network node according to any one of claims 4 to 6.

8. receiving a Radio Resource Control (RRC) message including the first identifier and a Non-Access-Stratum (NAS) message including the second identifier; comparing the first identifier with the second identifier; discarding the RRC message if the first identifier is different from the second identifier; Each of the first identifier and the second identifier includes at least one of a Globally Unique Temporary Identifier (GUTI) and a Temporary Mobile Subscription Identifier (TMSI), The first identifier and the second identifier are identical when the RRC message is transmitted by the user equipment. A method for a Radio Access Network (RAN) node.

Images