5G GBA Authentication Using SUCI to Protect Subscriber Identity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing 5G communication networks lack a secure authentication mechanism between User Equipment (UE) and Network Application Function (NAF) using the Generic Bootstrapping Architecture (GBA), which exposes subscriber identifiers like IMSI, leading to potential security breaches.
Innovation Solution
An authentication method utilizing a Bootstrapping Service Function (BSF) that receives identifiers such as SUCI or TMPI, acquires authentication vectors (AV) from UDM/ARPF or AUSF, and performs GBA authentication, ensuring privacy by using SUCI or converted identifiers to protect subscriber information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication mechanisms are used in 5G networks, then authentication between UE and NAF can be established, but subscriber identifiers like IMSI are exposed leading to security breaches
Solution Approach 1:
The patent introduces a Bootstrapping Service Function (BSF) as an intermediary between the UE and NAF. The BSF receives authentication requests, retrieves authentication vectors from UDM/ARPF, and performs GBA authentication to establish secure connections without exposing subscriber identifiers like IMSI. This mediator approach resolves the contradiction by enabling authentication while protecting identifier exposure.
Solution Approach 2:
The patent extracts the identifier handling function from the traditional authentication path. Instead of directly using IMSI for authentication, the system uses SUCI (Subscriber Concealed Identifier) or TMPI (Temporary Identifier) that are obtained through the BSF. This extraction of identifier usage from the direct authentication path prevents identifier exposure while maintaining authentication capability.
2Reliability
If GBA authentication is implemented in 5G networks, then secure connection between UE and NAF is established, but the system complexity increases due to additional network functions
Solution Approach 1:
The BSF is designed as a multi-functional network element that handles multiple authentication scenarios (GBA authentication, security context validation, AV retrieval). By consolidating these functions in a single universal component, the patent reduces overall network architecture complexity while maintaining comprehensive security capabilities.
Solution Approach 2:
The BSF performs preliminary authentication actions by validating security contexts and retrieving authentication vectors before actual UE-NAF communication. This preliminary action approach streamlines the authentication process and reduces the complexity of real-time authentication decisions during UE-NAF interactions.
3Productivity
If security context validation is performed for TMPI, then authentication efficiency is improved, but the time to validate security context periods is increased
Solution Approach 1:
The BSF performs partial validation by checking only the time period validity of security contexts for TMPI identifiers, rather than complete re-authentication. This partial action approach improves authentication efficiency for returning users while minimizing the time loss associated with validation, as full authentication is not required when security contexts are still valid.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
Provided is an authentication method based on a GBA, and the method includes: a BSF receives an initialization request message sent by a UE, wherein the initialization request message carries a first identifier of the UE, and the first identifier comprises at least one of the following: a SUCI, an identifier converted from the SUCI, and a TMPI associated with the subscriber identity; the BSF acquires an AV of the UE according to the first ID; the BSF completes GBA authentication with the UE according to the acquired AV. In this way, the privacy of the SUPI is protected for the UE, and the SUCI or the identifier converted from the SUCI is used to perform the bootstrapping process of the GBA, thereby improving the security of the GBA authentication process.