Attach Request Verification for UE Capability Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In mobile communications, an attacker can perform a man-in-the-middle attack during the attach request message exchange, modifying UE capability information, leading to incorrect service provisioning by the MME, which may prevent the UE from using essential services like voice calls.
Innovation Solution
The UE and MME employ verification mechanisms using hash values and message authentication codes to ensure the integrity and consistency of UE capability information, sending a NAS security mode complete message only when the information matches, thereby preventing unauthorized modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the attach request message has no integrity protection, then the attach procedure can be completed quickly, but the UE capability information can be modified by attackers leading to incorrect service provisioning
Solution Approach 1:
The MME performs Hash calculation on the received attach request message to generate verification matching information before sending the NAS security mode command message to the UE. This preliminary action allows the UE to later verify the integrity of UE capability information without adding complex real-time protection mechanisms to the attach request message itself.
Solution Approach 2:
The patent introduces verification matching information (Hash value or NAS-MAC) as an intermediary element that enables indirect verification of UE capability information integrity. Instead of directly protecting the attach request message, the system uses this intermediary verification data to ensure information integrity through the NAS security mode command message.
2Reliability
If verification mechanisms are implemented to ensure UE capability information integrity, then security against man-in-the-middle attacks is improved, but the communication overhead and processing time increase
Solution Approach 1:
The MME creates a Hash copy or NAS-MAC of the attach request message and includes it in the NAS security mode command message. This copying approach allows the UE to verify information integrity by comparing the received verification data with independently calculated values, avoiding the need to re-transmit or re-process the entire attach request message.
Solution Approach 2:
The patent transforms the verification approach by changing the parameter representation from the original attach request message to a condensed verification form (Hash value or NAS-MAC). This parameter transformation significantly reduces the data size that needs to be transmitted and processed, thereby reducing communication overhead and processing time while maintaining security.
3Measurement precision
If the UE verifies UE capability information received by the MME, then the accuracy of service provisioning is improved, but the device complexity of the UE increases
Solution Approach 1:
The patent extracts only the essential verification elements (Hash value or NAS-MAC) from the complete attach request message and includes them in the NAS security mode command message. This extraction allows the UE to perform verification using only these critical elements rather than processing the entire message, thereby reducing the complexity of the verification mechanism while maintaining accuracy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to mobile communications technologies, and in particular, to a mobile communication method, apparatus, and device. The method includes: receiving, by user equipment UE, a non-access stratum NAS security mode command message from a mobility management entity MME, where the NAS security mode command message carries first verification matching information used to verify UE capability information received by the MME; determining, by the UE based on the first verification matching information, whether the UE capability information received by the MME is consistent with UE capability information sent by the UE to the MME; and if the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME, sending, by the UE, a NAS security mode complete message to the MME. The mobile communication method, apparatus, and device of embodiments of the present invention can ensure that the MME obtains correct UE capability information.