Two-Factor Authentication for Cellular Base Stations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current one-factor authentication methods in radio access networks are insecure, as they rely on username/password combinations, which can be compromised by rogue devices or attackers, posing a significant risk to network security, especially in machine-to-machine communications where IoT devices and base stations access the core network.
Innovation Solution
Implementing a two-factor authentication method that uses historical communication data between base stations and a coordination server, where a challenge question is generated based on stored historical information, requiring a response verified using a key derived from this data to grant access to the core network, thus enhancing security by making it difficult for attackers to access the entire communication history.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If one-factor authentication (username/password) is used for base station authentication, then the authentication process is simple and quick, but network security is compromised as attackers can access the network if they obtain credentials
Solution Approach 1:
The system performs preliminary actions by storing historical communication data (challenge-response pairs) between base stations and the coordination server before authentication is needed. This historical data serves as a foundation for generating challenge questions, allowing the system to implement two-factor authentication without requiring real-time complex computations during the actual authentication process
Solution Approach 2:
The patent introduces an intermediary mechanism using historical communication data as a mediator between the base station and coordination server. The challenge question is derived from this historical data, acting as an intermediate element that connects the base station's identity verification with the coordination server's authentication decision, thereby enhancing security while maintaining process efficiency
2Reliability
If two-factor authentication using historical communication data is implemented, then network security is significantly improved, but the authentication process becomes more complex
Solution Approach 1:
The system extracts only the necessary elements from historical communication data (challenge-response pairs) to generate challenge questions, rather than using the entire historical dataset. This extraction approach maintains security by utilizing sufficient historical information while reducing the computational and operational complexity of the authentication process
Solution Approach 2:
The patent changes parameters by deriving challenge questions from historical communication data with specific parameters (challenge identifiers, response values, timestamps) rather than using raw historical data directly. This parameter transformation simplifies the authentication operation by converting complex historical records into structured challenge questions that are easier to process and verify
3Object-affected harmful factors
If attackers can collect substantial communication history, then they may be able to compromise the two-factor authentication system, but collecting this data requires extended undetected presence in the network
Solution Approach 1:
The system implements periodic action by using time-stamped challenge-response pairs from historical communication data. The challenge questions are derived from these periodic communication events, and the system can configure the time window for selecting historical data (e.g., last 24 hours, last 7 days), creating temporal layers of security that require attackers to maintain undetected presence over extended periods
Solution Approach 2:
The system performs preliminary action by pre-storing and organizing historical communication data with metadata (timestamps, challenge identifiers, response values) before authentication attempts. This preliminary organization allows the system to efficiently select relevant historical data for challenge generation while making it computationally infeasible for attackers to reverse-engineer or predict the selection criteria, thereby extending the time required for successful attacks
Data Source
AI summary
A method for authenticating radio access network devices is disclosed, comprising: authenticating, at a coordination server, a base station in a radio access network using a first authentication factor; selecting, following successful authentication of the base station using the first authentication factor, a challenge question based on historical information of the base station stored within a database; sending, from the coordination server to the base station, a request containing the challenge question to further authenticate the base station based on the historical information of the base station; receiving, from the base station at the coordination server, a response to the challenge question; verifying, at the coordination server, the correctness of the response using a key derived from the historical information; and granting the base station access to a core network of a mobile operator, thereby addressing security issues unsolved by one-factor authentication.