D2D Mode B Discovery Integrity Protection via MIC Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current D2D mode B discovery services lack integrity protection, making them vulnerable to replay attacks, as integrity protection is not performed on discovery response messages, query request and response messages, and matching report messages.
Innovation Solution
Implementing a security method that includes ProSe function entities sending ProSe response codes and keys, calculating and verifying Message Integrity Codes (MICs) using HMAC-SHA-256, and including parameters like current time and validity periods in messages to ensure integrity protection across all four processes of D2D mode B discovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If integrity protection is not performed on discovery messages, then the complexity of the discovery process is low and operations are simple, but the system becomes vulnerable to replay attacks and security breaches
Solution Approach 1:
The patent introduces MIC (Message Integrity Code) as an intermediary security mechanism. The ProSe function entity generates MIC values based on message contents and secret keys, which are then attached to discovery messages. This intermediary component enables security verification without requiring complex cryptographic protocols between UEs, thus improving reliability while controlling complexity.
Solution Approach 2:
The patent implements preliminary action by pre-generating secret keys (ProSe application key, ProSe discovery key) and attaching validity periods to discovery messages before transmission. The ProSe function entity prepares integrity protection parameters in advance, including MIC generation and validity period assignment, which prevents replay attacks without requiring complex real-time verification mechanisms.
2Reliability
If validity periods are added to discovery messages, then replay attacks are prevented, but the message structure and processing become more complex
Solution Approach 1:
The patent applies local quality by adding validity period parameters specifically to discovery messages that require security protection, rather than modifying all message types uniformly. The validity period is attached as a localized parameter within the discovery message structure, enabling targeted security enhancement without globally complicating the message framework.
Solution Approach 2:
The patent uses parameter changes by introducing time-based validity period parameters (validity start time, validity end time) to discovery messages. These parameters transform static discovery messages into time-sensitive secured messages, enabling replay attack prevention through simple time comparison operations rather than complex cryptographic verification.
3Reliability
If MIC calculation and verification are implemented, then message integrity is protected, but the processing time and computational overhead increase
Solution Approach 1:
The patent replaces complex cryptographic verification mechanisms with simpler MIC-based integrity checking. Instead of using resource-intensive public key cryptography or mutual authentication protocols, the system uses HMAC-based MIC calculation and verification, which are computationally lighter and faster, thus reducing processing time while maintaining integrity protection.
Solution Approach 2:
The patent implements self-service by having the ProSe function entity generate and attach MIC values to discovery messages during message creation. The receiving UE simply verifies the attached MIC using pre-shared keys without requiring additional authentication handshakes or external verification services, reducing computational overhead and processing time.
Data Source
AI summary
A security method for D2D mode B discovery is disclosed in the embodiments of the present disclosure, in four processes of the D2D mode B discovery service, integrity protection is performed, by adding corresponding parameters, on a discovery response message of a passive terminal, a discovery response message of an active terminal, a query request message sent by the active terminal to the passive terminal, a query response message sent by the passive terminal to the active terminal, and the matching report message of the active terminal. A security system, terminal for D2D mode B discovery and a storage medium are further disclosed in the embodiments of the present disclosure.