BSF Entity Protection via Dual Temporary Identities
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Generic Authentication Architecture (GAA) security technologies are vulnerable to attacks as user identities, particularly IMPI, are sent in plain text, making them susceptible to wiretaps, and temporary identities can be intercepted for malicious re-authentication requests, putting the Bootstrapping Service Function (BSF) entity at risk.
Innovation Solution
Generating two different temporary identities after mutual authentication between the User Equipment (UE) and the BSF entity, one for re-authentication requests and another for service requests, to prevent attackers from intercepting and misusing temporary identities, thereby enhancing security and reducing unnecessary load on the BSF.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user identities (IMPI) are sent in plain text for authentication, then authentication process is simple and fast, but security is compromised as identities become susceptible to wiretaps and interception
Solution Approach 1:
The patent uses temporary identities (B-TID, TMPI) as copies of the real user identity (IMPI). These temporary identities are generated during authentication and used subsequently to reference the user without exposing the real IMPI. The temporary identity acts as a safe substitute that can be transmitted without encryption while maintaining security.
Solution Approach 2:
The patent introduces temporary identities as an intermediary layer between the user's real identity and the network systems. Instead of directly transmitting IMPI, the system uses B-TID and TMPI as mediators that carry user identification information without revealing the actual IMPI, thus protecting against wiretaps while enabling authentication.
2Device complexity
If a single temporary identity is used for both service requests and re-authentication requests, then device complexity is reduced, but security is compromised as attackers can intercept and reuse the same identity for malicious purposes
Solution Approach 1:
The patent segments the temporary identity into two distinct types: B-TID for service requests and TMPI for re-authentication requests. This segmentation ensures that even if one temporary identity is intercepted, attackers cannot misuse it for both service access and re-authentication, as each has its own dedicated temporary identity with specific usage scope.
Solution Approach 2:
The patent applies different qualities to different temporary identities based on their specific purposes. B-TID is optimized for service request scenarios while TMPI is optimized for re-authentication scenarios. Each temporary identity has its own characteristics and usage context, providing localized security optimization for different operational needs.
3Extent of automation
If the BSF entity processes all authentication requests including re-authentication, then centralized control is maintained, but system load increases and resource efficiency decreases
Solution Approach 1:
The patent extracts the re-authentication processing function from the BSF entity and relocates it to the NAF entity. When a user needs re-authentication, the NAF can independently verify the temporary identity against the HSS without involving the BSF. This extraction reduces the BSF's processing load while maintaining centralized control through HSS verification.
Solution Approach 2:
The patent enables NAF entities to perform self-service re-authentication verification. Instead of all authentication requests going through the BSF, the NAF can independently handle re-authentication by verifying temporary identities with the HSS, allowing the system to serve itself and reducing dependency on the BSF for routine authentication operations.
Data Source
Figure 1~2
Figure 3
AI summary
A method for protecting a BSF entity from attack. The method includes: obtaining a first temporary identity and a second temporary identity after a UE performing mutual authentication with the BSF entity, where the first temporary identity is different from the second temporary identity; by the UE, originating a re-authentication request to the BSF entity through the first temporary identity; and originating a service request to a NAF entity through the second temporary identity. The present invention also provides a system for protecting a BSF entity from attack, an apparatus for protecting a BSF entity from attack,. The present invention prevents attackers from intercepting the temporary identity at the Ua interface and using the temporary identity to originate a re-authentication request at the Ub interface, thus protecting the BSF entity from attack effectively, avoiding unnecessary load on the BSF entity and saving resources.