Encrypting IMSI for Wi-Fi Authentication Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless communication systems, particularly those using EAP-AKA and EAP-SIM protocols for Wi-Fi authentication, expose the International Mobile Subscriber Identity (IMSI) during authentication, compromising user privacy and failing to protect against active attacks, as the permanent identity is sometimes sent in the clear.
Innovation Solution
Implementing public key cryptography to encrypt the IMSI before transmission, with the wireless device configured with the authentication server's public key and the server possessing the corresponding private key, ensuring confidentiality and protecting against passive and active attackers by using a pseudonym or fast re-authentication identity when available.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the permanent identity (IMSI) is sent during authentication exchange, then authentication can be completed, but user privacy is compromised and the identity is exposed to passive and active attackers
Solution Approach 1:
The authentication process is segmented into distinct phases: initial authentication using temporary identifiers, and a separate identity retrieval phase where the permanent identity is encrypted and transmitted only after secure channel establishment. This segmentation prevents exposure of the IMSI during the main authentication exchange.
Solution Approach 2:
A pseudonym or temporary identifier is used in advance during the authentication exchange before the permanent identity is ever transmitted. This preliminary action using a placeholder identity protects the user's permanent identity from exposure while still enabling authentication to proceed.
Solution Approach 3:
An encrypted identity field acts as an intermediary between the authentication credentials and the permanent identity. The encrypted field contains the IMSI but protects it through encryption, serving as a mediator that allows the server to retrieve the permanent identity without exposing it in clear text during transmission.
2Object-affected harmful factors
If public key cryptography is used to encrypt the permanent identity, then confidentiality is improved, but device complexity increases due to key management requirements
Solution Approach 1:
The wireless device is configured with a universal public key from the home authentication server that can be used across multiple authentication sessions and different networks. This multi-functional key eliminates the need for device-specific key pairs, reducing complexity while maintaining confidentiality.
Solution Approach 2:
The public key is pre-configured in the wireless device before authentication occurs, eliminating the need for complex key exchange protocols during the authentication session. This preliminary configuration simplifies the authentication process while ensuring confidentiality through encryption.
Data Source
AI summary
This disclosure relates to techniques for performing Wi-Fi authentication in a wireless communication system. Public key cryptography may be used to enhance the confidentiality of the user's permanent identity in transit. In some embodiments, a RSA-OAEP (SHA-256) encryption scheme may be used to protect the permanent identity when the EAP client needs to send the user's permanent identity to the server in the absence of pseudonym or fast re-authentication identity. In some embodiments, a server certificate is used to authenticate a iWLAN tunnel to protect an IMSI during setup of a Wi-Fi call. Using the methods described herein on both or either of the EAP client and server side may offer improved privacy protection.