Digest AKA Authentication Using HMAC-MD5 Against MITM Attacks

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing authentication protocols, such as EAP and Digest AKA, are vulnerable to man-in-the-middle (MITM) attacks, particularly in the context of the 3GPP IP Multimedia Subsystem, where a malicious third party can impersonate a client and gain access to secure resources by intercepting and forwarding authentication challenges and credentials.

Innovation Solution

The proposed solution introduces a new Digest AKA algorithm that employs the HMAC-MD5 keyed hash function using an AKA Integrity Key (IK) or Cipher Key (CK), setting the 'algorithm' field to 'AKAv1-HMAC-MD5' or 'AKAv2-HMAC-MD5' in authentication challenges, and defines a new value A1' to enhance security, ensuring that only authenticated clients can produce valid Digest credentials.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If Digest AKA authentication protocol is used, then authentication capability is provided, but vulnerability to MITM attacks occurs

Engineering Contradiction:

Improveauthentication capabilityVSAvoidMITM attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces HMAC-MD5 as an intermediary authentication mechanism between the client and server. This intermediary uses cryptographic hash functions with keys derived from AKA to create authenticated challenge-response pairs, preventing MITM attacks while maintaining the original Digest AKA authentication flow.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent modifies the authentication parameters by introducing new algorithm identifiers (AKAv1-HMAC-MD5, AKAv2-HMAC-MD5) and changing the hash computation method from simple MD5 to HMAC-MD5. These parameter changes enhance security against MITM attacks while preserving backward compatibility with existing AKA infrastructure.

Inventive Principle:

Principle #35Parameter changes

2Object-affected harmful factors

If authentication protocol is enhanced to prevent MITM attacks, then security is improved, but protocol complexity increases

Engineering Contradiction:

ImproveMITM attack preventionVSAvoidprotocol complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The patent nests the HMAC-MD5 authentication mechanism within the existing Digest AKA protocol structure. The enhanced authentication is integrated into the challenge-response exchange, allowing the original AKA flow to be preserved while adding security layers without significantly increasing visible protocol complexity.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The HMAC-MD5 mechanism serves multiple functions: it authenticates challenges, verifies responses, and prevents MITM attacks simultaneously. This multi-functionality reduces the need for separate authentication components, thereby limiting the increase in protocol complexity while achieving enhanced security.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS7908484B2Method of protecting digest authentication and key agreement (AKA) against man-in-the-middle (MITM) attack

Publication Date: 2011.03.15 NOKIA TECHNOLOGIES OY

AI summary

Disclosed is a method and system to discourage a MITM attacker in a data communications system that includes client and a server. The method includes, in a Digest Authentication and Key Agreement (AKA) challenge sent to the client from the server, setting an “algorithm” field to ‘algorithm=“AKAv1-HMAC-MD5”’ for directing the client to use the HMAC-MD5 keyed hash function when producing Digest credentials; and using at least one of an AKA Integrity Key (IK) or an AKA Cipher Key (CK) in the keyed hash function.