CAG Identifier Encryption for Wireless Access Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current wireless communication systems face issues with privacy exposure and denial-of-service attacks in closed access group (CAG) scenarios, particularly due to insecure transmission of CAG identifiers and unnecessary signaling loads caused by invalid access attempts.
Innovation Solution
Implementing a core network apparatus and user equipment (UE) that protect CAG identifiers using encryption and integrity protection mechanisms, ensuring secure authentication and subscription checks, and managing access attempts to prevent unauthorized access and reduce signaling congestion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CAG identifier is transmitted over the air in clear text, then the UE can access the CAG cell, but privacy of the NPN services is exposed and man-in-the-middle attacks can associate UE with NPN
Solution Approach 1:
The patent introduces an intermediary encryption mechanism where the CAG identifier is protected using the UE's public key. The network receives the encrypted CAG identifier, decrypts it using the UE's private key, and verifies it against the allowed CAG list. This intermediary encryption layer prevents direct observation of the CAG identifier while maintaining access functionality.
Solution Approach 2:
The patent changes the state of the CAG identifier from plaintext to encrypted form during transmission. The CAG identifier is transformed using cryptographic parameters (public key encryption) before being sent over the air, and then transformed back to plaintext only within the secure network entity (AMF) for verification purposes.
2Reliability
If unprotected NAS rejection is sent to UE for CAG ID access request, then the UE can be rejected from accessing the CAG cell, but the UE cannot verify the authenticity of the rejection message
Solution Approach 1:
The patent introduces integrity protection as an intermediary mechanism that allows the UE to verify the authenticity of the NAS rejection message. The rejection message is signed with the network's private key, and the UE verifies it using the network's public key, providing cryptographic proof of authenticity without requiring unprotected transmission.
Solution Approach 2:
The patent replaces the mechanical/trust-based system of unprotected message transmission with a cryptographic verification system. Instead of relying on the assumption that unprotected messages are authentic, the system uses digital signatures and public key infrastructure to provide mathematical proof of message authenticity.
3Reliability
If the UE sends CAG identifier in every registration request, then the network can verify subscription, but unnecessary signaling load is generated during invalid access attempts
Solution Approach 1:
The patent extracts the CAG identifier verification from every registration request by introducing a separate initial authentication phase. The encrypted CAG identifier is sent only once during initial access, and subsequent registrations can proceed without re-transmitting it, reducing redundant signaling while maintaining verification capability through the already-established security context.
Data Source
AI summary
Accordingly, embodiments herein disclose a method for handling a closed access group (CAG) related procedure in a wireless communication system. A network may receive a radio resource control (RRC) resume request message from a user equipment (UE). The network may determine whether the at least one CAG identifier (ID) broadcasted in a CAG cell is included in an allowed CAG list of the UE (100) in response to the RRC resume request message. The network may proceed with a RRC resume procedure in response to determining that the at least one CAG ID is included in the allowed CAG list.