5G Authentication Encrypting IMSI with Public Key
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional LTE authentication protocols expose the International Mobile Subscriber Identity (IMSI) during authentication, making it vulnerable to unauthorized access and potential denial of service attacks, as the IMSI is transmitted unencrypted over the radio access network.
Innovation Solution
The proposed solution involves encrypting the IMSI using a public key, such as a home network public key or a serving network public key, and generating a message authentication code (MAC) signature to secure the authentication process, ensuring that only authorized entities can decrypt and verify the IMSI, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the IMSI is transmitted unencrypted during authentication, then the authentication process is simple and fast, but the security is compromised and the IMSI becomes vulnerable to interception and misuse
Solution Approach 1:
The patent introduces a public key infrastructure as an intermediary mechanism between the UE and the authentication server. The UE encrypts the IMSI using a public key before transmission, and the authentication server decrypts it using the corresponding private key. This intermediary cryptographic layer protects the IMSI from direct exposure while maintaining authentication functionality.
Solution Approach 2:
The patent performs preliminary encryption of the IMSI before it is transmitted over the radio access network. The UE generates a random number and encrypts the IMSI using a public key in advance, so that when the IMSI is sent during authentication, it is already protected. This preliminary action prevents interception and misuse of the IMSI during the authentication process.
2Reliability
If the IMSI is encrypted using a public key, then the security and privacy of the IMSI is improved, but the computational complexity and processing time increase
Solution Approach 1:
The patent changes the cryptographic parameters by using asymmetric encryption (public key cryptography) instead of symmetric encryption. This allows the UE to encrypt the IMSI with a public key that is computationally efficient for the UE to generate and transmit, while the authentication server can decrypt it with its private key. The parameter change optimizes the balance between security and computational burden.
3Reliability
If a MAC signature is generated and verified, then the integrity of the authentication message is ensured, but the authentication process becomes more complex and time-consuming
Solution Approach 1:
The patent uses a MAC signature as an intermediary verification mechanism. The UE generates a MAC signature by computing a hash function of the encrypted IMSI and other authentication parameters. The authentication server verifies this signature to ensure message integrity without needing to decrypt or fully process the entire authentication message, thus reducing processing time while maintaining security.
Data Source
AI summary
This disclosure provides techniques for securely communicating user equipment (UE) specific information from a UE to a network-side device. In particular, the UE may either encrypt the UE specific information using an encryption key to form an encrypted portion, where the UE specific information includes subscriber identity information and the encryption key is calculated in accordance with a public key of a home network of the UE. The UE generates a message authentication code (MAC) signature based on the encrypted portion and a first integrity key, where the first integrity key is calculated in accordance with the public key of the home network. The UE sends, to a network-side device, a request message including the encrypted portion, the MAC signature and a network identifier of the home network.