Key Distribution Method for Mobile Network Eavesdropping Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile communication security architectures, particularly in 2G/3G/4G networks, rely on segment encryption, which is flexible but insecure as intermediate nodes can intercept plaintext data, making them vulnerable to eavesdropping attacks.
Innovation Solution
A key distribution method involving a first key management system that generates and manages shared keys for network elements, performs encryption and integrity protection on service keys, and sends security protection parameters to ensure secure communication between network elements, thereby protecting against eavesdropping.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If segment encryption is used in existing mobile communication security architecture, then flexibility is improved, but security against eavesdropping attacks deteriorates because intermediate nodes can obtain plaintext
Solution Approach 1:
The patent segments the encryption architecture into two distinct layers: access encryption (between UE and network element) and end-to-end encryption (between UE and PDN gateway). This segmentation allows each layer to serve its specific security function while maintaining overall system flexibility. The access encryption uses existing PDCP protocol for flexibility, while end-to-end encryption uses IPSec for strong security protection.
Solution Approach 2:
The patent introduces a key distribution system as an intermediary component that manages and distributes encryption keys between different network elements. This intermediary system enables secure key management without requiring direct trust between all nodes, thereby improving security while maintaining the flexible segmented encryption architecture. The key distribution system acts as a mediator that coordinates encryption operations across multiple network elements.
2Ease of operation
If PDCP security protocol is used for encryption between UE and eNodeB, then ease of operation is improved, but security deteriorates because eNodeB can be compromised by attackers performing wiretapping
Solution Approach 1:
The patent segments security protection into two independent parts: access security (handled by PDCP protocol between UE and eNodeB) and end-to-end security (handled by IPSec between UE and PDN gateway). This segmentation allows the system to maintain ease of operation through the well-established PDCP protocol while adding strong end-to-end protection through IPSec, thereby resolving the contradiction between ease of operation and security against wiretapping.
Solution Approach 2:
The patent implements end-to-end encryption with IPSec as a preventive measure before data reaches the PDN gateway, cushioning against potential eNodeB compromise or wiretapping attacks. By establishing encryption at the UE level that extends to the PDN gateway, the system prepares advance protection that remains effective even if intermediate nodes are compromised, thus maintaining both ease of operation and security reliability.
3Reliability
If IPSec security protocol is used for end-to-end communication, then security against eavesdropping is improved, but device complexity increases due to additional encryption layers
Solution Approach 1:
The patent segments the security protocol stack into distinct functional layers: access layer (PDCP protocol for UE-eNodeB communication) and end-to-end layer (IPSec for UE-PDN gateway communication). This segmentation organizes the complexity by assigning specific security functions to specific layers, making the overall system more manageable. Each layer operates independently with well-defined interfaces, reducing the complexity burden on individual components while maintaining strong end-to-end security.
Data Source
AI summary
The present invention disclose a key distribution method. The method includes obtaining, by a first key management system, a shared key of a first network element, where the shared key of the first network element is generated according to a key parameter obtained after the first network element performs authentication or a root key of the first network element; obtaining a service key, where the service key is used to perform encryption and/or integrity protection on communication data in a first service between the first network element and a second network element; performing encryption and/or integrity protection on the service key by using the shared key of the first network element, to generate a first security protection parameter; and sending the first security protection parameter to the first network element. According to present invention, data can be protected against an eavesdropping attack in a sending process.