Base Station Authentication Using Core Network Signalling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile networks are vulnerable to attacks from false base stations (FBS) due to the lack of security protection for broadcasting messages, allowing adversaries to impersonate legitimate stations, leading to identity theft and location tracking, with existing solutions like GPP authentication being weakened and ineffective in preventing reconnection to false cells.
Innovation Solution
A method involving user devices sending authentication requests based on core network signalling protocols like MAP or Diameter, disconnecting from inauthentic base stations, and changing Access Control Classes (ACC) to steer away from malicious cells, using SIM card applications to verify base station authenticity through USSD or encrypted SMS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If broadcasting messages are not protected for confidentiality, authenticity or integrity, then mobile devices can easily connect to base stations, but false base stations can impersonate legitimate stations and conduct attacks
Solution Approach 1:
The patent applies preliminary action by performing authentication before the mobile device completes connection to the base station. The device sends an authentication request to verify the base station's legitimacy before establishing full communication, preventing false base stations from successfully impersonating legitimate stations while maintaining easy connection procedures.
2Reliability
If GPP authentication is used, then some security protection is provided, but the authentication has been weakened by standardized parameters and is ineffective in preventing reconnection to false cells
Solution Approach 1:
The patent extracts the authentication mechanism from the weakened GPP standard and implements a custom authentication approach using core network signalling protocols (MAP or Diameter). This extraction allows the device to perform authentication independently of the standardized parameters that have been exploited, while also adding the capability to block reconnection to false cells through Access Control Class changes.
Solution Approach 2:
The patent introduces an intermediary mechanism by involving the core network in the authentication process through signalling protocols. Instead of relying solely on base station-based authentication that can be spoofed, the device communicates authentication requests through the core network, creating an intermediary verification layer that prevents reconnection to false cells while maintaining security.
3Reliability
If the device waits for authentication response, then authentication security is improved, but connection time is increased
Solution Approach 1:
The patent applies partial action by implementing authentication only when necessary - specifically when the mobile device detects a potential false base station or when connecting to new networks. The authentication request is sent periodically but only triggers full verification procedures when anomalies are detected, balancing security requirements with connection time constraints rather than performing exhaustive authentication continuously.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
When a user device connects to a base station or cell tower, it is authenticated by the base station via its IMSI. However, the base station doesn't have to authenticate back. The present teachings introduce the idea of authenticating the base station using radio path signalling or core network signalling. The present teachings also introduce the concept of changing an Access Control Class, ACC, of a user device to a different ACC after disconnecting from a detected false base station.