5G NAS Deciphering via N12 Key Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Monitoring 5G networks faces challenges in obtaining cipher keys for deciphering user messages and establishing mappings between temporary and permanent user identities, with initial mapping negotiations occurring infrequently and potential disruptions breaking these mappings, and ciphered authentication messages lacking available keys.
Innovation Solution
A system and method that extract user information from messages over the N12 interface, capture and decipher user traffic on the N1/N2 interfaces by associating extracted user information with stored cipher keys, cycling through cached keys to successfully decipher messages, thereby reducing deciphering time and CPU consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If cipher keys are obtained through traditional methods, then security is maintained, but deciphering time increases to weeks or months
Solution Approach 1:
The system performs preliminary extraction and caching of cipher keys during the authentication phase (before monitoring is needed). By pre-obtaining and storing the keys in a cache during the initial authentication transaction, the system eliminates the need for time-consuming key extraction during later monitoring operations, reducing deciphering time from weeks/months to hours/days while maintaining security through controlled key management
2Productivity
If cipher keys are extracted and cached for quick deciphering, then deciphering speed increases, but CPU consumption increases
Solution Approach 1:
The system performs the computationally intensive key extraction operation once during authentication and caches the result. Subsequent monitoring operations simply retrieve pre-computed keys from cache rather than re-extracting them, dramatically reducing CPU consumption for each monitoring event while maintaining high deciphering speed
Solution Approach 2:
The system creates a cached copy of the cipher keys during authentication. This copy is then reused multiple times for deciphering different NAS messages without requiring the original computational resources, reducing CPU consumption while enabling rapid deciphering operations
3Measurement precision
If mappings between temporary and permanent user identities are established frequently, then user identification accuracy improves, but network overhead increases
Solution Approach 1:
The system establishes and caches the mapping between temporary and permanent user identities during the initial authentication phase. This pre-established mapping is then reused for subsequent monitoring operations, ensuring accurate user identification without requiring frequent network transactions for mapping updates, thus reducing network overhead while maintaining identification precision
Data Source
AI summary
An illustrative embodiment disclosed herein is a non-transitory computer readable medium. In some aspects, the non-transitory computer readable medium includes instructions for providing a mobile user monitoring solution that, when executed by a processor, cause the processor to capture a transaction transmitted over an N12 interface, extract, from the transaction, one of an expected response (XRES) or an authentication token (AUTN), a user identifier (ID), and a cipher key, capture a first message transmitted over an N1 interface, and determine that the first message is associated with the user ID and the cipher key extracted from the transaction.