5G Network Relay Authentication Against Unauthorized UE Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 3GPP systems lack proper authorization mechanisms for UE-to-Network Relays, leading to vulnerabilities that can result in unauthorized access and potential Denial of Service (DOS) attacks or unauthorized service usage in 5G networks.
Innovation Solution
Implementing a security procedure that involves generating and managing 5G ProSe Relay User Keys (PRUK) identifiers through authentication servers and unified data management functions to authorize and authenticate communication devices as relays, ensuring secure network access and communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing 3GPP systems allow UE-to-Network Relays without proper authorization mechanisms, then network access flexibility is improved, but network security deteriorates leading to unauthorized access and potential DOS attacks
Solution Approach 1:
The patent implements preliminary authorization actions by establishing authentication and authorization procedures before relaying operations begin. The network device performs identity verification and establishes relay authorization in advance, preventing unauthorized access before it can occur while still allowing legitimate flexible access.
Solution Approach 2:
The patent introduces an intermediary authorization mechanism where the network device acts as a mediator between the UE-to-Network Relay and the core network. This intermediary performs security checks and authorization verification, enabling flexible access for authorized devices while blocking unauthorized access attempts.
2Ease of operation
If existing 3GPP systems permit relay communication without authentication, then communication ease is improved, but network vulnerability increases allowing unauthorized service usage
Solution Approach 1:
The patent implements preliminary authentication procedures before relay communication begins. The network device verifies the identity and authorization of relay devices in advance, ensuring that only authenticated devices can establish relay connections. This maintains communication ease for authorized devices while eliminating network vulnerability from unauthorized access.
3Reliability
If the network device rejects identifiers without proper authentication procedures, then security is improved, but communication complexity increases
Solution Approach 1:
The patent implements a universal authentication framework using standardized 3GPP procedures that can handle multiple identifier types and relay scenarios through a unified mechanism. The network device uses general-purpose authentication procedures that work across different relay configurations, maintaining security while avoiding the need for complex specialized procedures for each scenario.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Techniques are described to perform network relay security. An example wireless communication method includes receiving, by a network device, a request message that includes an identifier associated with a first communication device; determining, by the network device in response to the receiving, that the first communication device is authenticated based on a local policy of the network device; and sending, by the network device in response to the determining, a message to a second communication device to relay to the first communication device, where the message indicates that the identifier is rejected by the network device for communication with the first communication device, or where the message indicates that the first communication device is triggered to send another identifier.