Access Stratum Mutual Authentication Using PKI and Certificate Revocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for efficient public key infrastructure (PKI)-based mutual authentication between a user equipment (UE) and a base station in wireless communication systems, particularly in next-generation mobile communication systems, to ensure secure and reliable connections amidst the challenges of increased device connectivity and enhanced security requirements.
Innovation Solution
A method and device for PKI-based mutual authentication in the access stratum (AS) section of wireless communication systems, involving encryption of certificate revocation information messages using private keys, hash functions, and operator public keys, along with location-based management of certificate revocation information, and authentication failure reporting mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If 5G-NSSAI and 4G-NSSAI are mapped to the same 3GPP access type, then access simplicity is improved, but access security deteriorates due to potential authentication bypass
Solution Approach 1:
The patent segments the NSSAI handling by creating separate mapping tables for 5G-NSSAI and 4G-NSSAI to different 3GPP access types. This prevents the security bypass issue while maintaining simplified access through automated mapping, as each mapping table operates independently with its own security validation rules.
Solution Approach 2:
The patent introduces an intermediary mapping table that acts as a bridge between 5G/4G-NSSAI and 3GPP access types. This intermediary structure enables secure translation and validation of access type mappings, preventing direct bypass while maintaining simplified access procedures through automated intermediary processing.
2Productivity
If access authentication is optimized for 5G systems, then 5G access performance is improved, but compatibility with existing 4G authentication mechanisms deteriorates
Solution Approach 1:
The patent implements a universal mapping framework that handles both 5G-NSSAI and 4G-NSSAI authentication through a common structure. The mapping tables and processing logic are designed to be multi-functional, supporting both 5G optimized authentication and 4G compatible authentication mechanisms simultaneously, thus improving 5G performance while maintaining 4G compatibility.
Solution Approach 2:
The patent uses parameter changes by dynamically adjusting the mapping relationships between NSSAI and access types based on the system type (5G or 4G). The mapping tables can be configured with different parameters for 5G and 4G systems, allowing optimized 5G authentication performance while maintaining compatibility with 4G authentication mechanisms through parameter-based adaptation.
3Reliability
If multiple mapping tables are maintained separately for 5G and 4G, then access security is improved, but device complexity increases
Solution Approach 1:
The patent merges the management of multiple mapping tables by implementing a unified mapping management mechanism that handles both 5G-NSSAI and 4G-NSSAI mapping tables through a single processing framework. This unified approach maintains separate mapping tables for security purposes while reducing management complexity through combined processing logic and centralized configuration management.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The disclosure relates to a 5G or 6G communication system for supporting higher data transmission rates than 4G communication systems such as LTE systems. According to an embodiment, a method for operating a user equipment (UE) for a mutual authentication operation in an access stratum (AS) section comprises transmitting a first message including a first random valueto a base station, receiving, from the base station, a second message including a second random value and a base station certificate for the base station, in response to the first message, and identifying information included in the base station certificate and verifying validity of the base station certificate, when the base station certificate is valid according to a result of the verification of the base station certificate.