Correlating Air and Network Authentication Parameters for Traffic Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless communication networks face challenges in decrypting encrypted traffic due to the lack of necessary parameters being transmitted over the air interface, necessitating a combined network-side and off-air monitoring approach to reconstruct decryption parameters.
Innovation Solution
A system and method that monitor both air and wired interfaces to correlate and reconstruct authentication parameters, enabling decryption of encrypted traffic by obtaining initial keys from correlated sets and deriving subsequent keys for decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If only off-air monitoring is used to obtain authentication parameters, then the monitoring can be performed without network-side access, but the necessary parameters for decryption are not transmitted over the air interface making decryption impossible
Solution Approach 1:
The patent combines off-air monitoring with network-side monitoring to obtain complete authentication parameters. The system merges data from two monitoring approaches: authentication parameters captured from air interface traffic and additional parameters obtained from network-side monitoring, enabling complete decryption capability that neither approach could achieve alone.
2Reliability
If combined network-side and off-air monitoring is implemented to obtain complete authentication parameters, then decryption capability is enabled, but the system complexity increases due to multiple monitoring interfaces and correlation requirements
Solution Approach 1:
The patent introduces a correlation module as an intermediary that bridges off-air monitoring and network-side monitoring components. This mediator correlates authentication parameters from both sources, managing the complexity of integrating multiple monitoring interfaces while enabling complete decryption capability.
3Loss of information
If authentication parameters are obtained from multiple sources and correlated, then complete parameter sets for decryption are reconstructed, but the time required for parameter correlation and decryption increases
Solution Approach 1:
The patent performs preliminary correlation of authentication parameters from network-side monitoring and stores them in advance. By pre-processing and storing correlated parameter sets before they are needed for decryption, the system reduces the time required during actual decryption operations, as the correlation work has already been completed.
Data Source
AI summary
A monitoring system monitors authentication sessions both on the air interface between the terminals and the network, and on at least one wired network-side interface between network-side elements of the network. The monitoring system constructs a database of sets of network-side authentication parameters using network-side monitoring. Each set of network-side authentication parameters originates from a respective authentication session and is associated with the International Mobile Station Identity (IMSI) of the terminal involved in the session. In order to start decrypting the traffic of a given terminal, the system obtains the off-air authentication parameters of that terminal using off-air monitoring, and finds an entry in the database that matches the air-interface authentication parameters. From the combination of correlated network-side and off-air authentication parameters, the processor is able to extract the parameters needed for decryption.