EPC RLOS Access Using One-Way Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in allowing unauthenticated User Equipment (UE) to access Restricted Local Operator Services (RLOS) while minimizing Denial of Service (DoS) attacks, particularly in 3GPP systems, due to issues with key management and provisioning overheads, and lack of control over unauthenticated UE access.
Innovation Solution
A method and system for unauthenticated UEs to perform one-way device authentication using embedded public and/or private keys, enabling limited connectivity and subscription service access without modifying existing GSMA eUICC specifications, and utilizing standardized GSMA eUICC profile provisioning procedures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If unauthenticated UE is allowed to access RLOS, then service availability is improved, but network security deteriorates due to DoS attacks
Solution Approach 1:
The patent segments authentication into two distinct modes: unauthenticated access for RLOS and authenticated access for full services. This segmentation allows the network to provide service availability to unauthenticated UEs while maintaining network security through separate authentication pathways, resolving the contradiction between ease of operation and reliability.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism using device certificates and public key infrastructure. This intermediary layer verifies UE identity without requiring full authentication credentials, enabling controlled access that balances service availability with network security against DoS attacks.
2Reliability
If device authentication is implemented for RLOS, then network security is improved, but device complexity increases due to key management
Solution Approach 1:
The patent applies preliminary action by embedding device certificates and cryptographic keys into the UE during manufacturing or initial provisioning. This preliminary setup eliminates the need for complex runtime key management, as the authentication credentials are pre-configured and automatically used during RLOS access, thus improving network security without increasing operational device complexity.
Solution Approach 2:
The authentication mechanism enables self-service by allowing UEs to automatically perform device authentication using their embedded certificates without requiring manual key management or user intervention. The UE independently manages its own authentication credentials, reducing the complexity burden on both the device and the network operator.
3Speed
If unauthenticated access is permitted, then service access speed is improved, but loss of information increases due to lack of authorization verification
Solution Approach 1:
The patent applies partial action by implementing selective authentication: only the essential device identity verification is performed for RLOS access, while full user authorization verification is deferred or omitted. This partial authentication approach enables fast service access speed for RLOS while maintaining sufficient authorization verification to prevent abuse, balancing speed and information integrity.
Data Source
AI summary
Embodiments disclosed herein relate to allowing unauthenticated UEs to gain restricted access to an operator network to access network access subscription service. Once the unauthenticated UE successfully downloads a subscription profile for accessing the operator network, the unauthenticated UE can disconnect and can, thereafter, authenticate to the operator network using the subscription profile. Embodiments disclosed herein can perform one-way authentication to the operator network for obtaining a limited connectivity to reduce DoS attacks on the operator network. More specifically, these embodiments can support unauthenticated UEs to allow unauthenticated UEs to access the operator network for RLOS while minimizing DoS attack.