Interface Identifier Filtering for Wireless Packet Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The UMTS system faces a security risk due to the inability to prevent unauthorized packet transmission using random interface identifiers in IPv6 addresses, as attackers can change the interface identifier, making it difficult to detect and prevent such attacks.
Innovation Solution
Implementing the interface identifier as a filter parameter in the TFT template, where the network node is informed of the allocated interface identifier, allowing only packets with matching filter conditions to be transmitted, thereby preventing unauthorized packet transmission by using the interface identifier to uniquely identify data flows and distinguish PDP contexts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the GGSN uses only an IPv6 prefix to direct packets to the mobile station, then the mobile station can dynamically change the interface identifier, but this creates a security risk where attackers can transmit packets using random interface identifiers
Solution Approach 1:
The mobile station informs the GGSN of the interface identifier before packets are transmitted. The GGSN stores this information and uses it to filter incoming packets, allowing only packets with the notified interface identifier to be forwarded to the mobile station. This preliminary notification establishes a security filter before the attack scenario can occur.
Solution Approach 2:
The interface identifier acts as an intermediary parameter between the mobile station and the GGSN. The mobile station communicates its intended interface identifier to the GGSN, which then uses this intermediary value to mediate packet filtering decisions, allowing legitimate packets while blocking unauthorized ones with random interface identifiers.
2Reliability
If the GGSN checks the whole IP address including interface identifier, then security is improved, but the complexity of address management increases
Solution Approach 1:
The solution extracts only the necessary portion of the IP address - the interface identifier - for filtering purposes. Instead of managing and checking the entire IP address, the GGSN isolates and uses only the interface identifier component that was notified by the mobile station, simplifying the management complexity while maintaining filtering accuracy.
3Loss of information
If TFT templates are used to select PDP contexts, then data flow identification is improved, but all packets with the allocated prefix are still transmitted to the mobile station creating security gaps
Solution Approach 1:
The interface identifier is notified to and stored by the GGSN before packet filtering occurs. This preliminary action establishes a security criterion that works in conjunction with TFT templates, ensuring that even if TFT matching occurs, packets are only transmitted if their interface identifier matches the notified value, thereby closing the security gap.
Data Source
AI summary
The invention relates to a method of transmitting packet data from a first subsystem to a wireless terminal device via the network node of a second subsystem. In the method, at least one filter is formed to guide mapping of at least one data flow of the first subsystem to at least one data flow of the second subsystem. At least one filter is attached to at least one data flow of the second subsystem. The filter comprises at least part of the interface identifier of the IP address, which at least part of the interface identifier is allocated in the wireless terminal device. Hereby, mapping of the data flow of the first subsystem to the data flow of the second subsystem is performed on the basis of the interface identifiers of the destination IP addresses in the received packets.