Authentication Key Segmentation for Isolated LTE Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Isolated LTE networks, particularly in public safety and commercial contexts, face security vulnerabilities due to the lack of comprehensive security measures for scenarios with limited or no backhaul, where local MMEs are more susceptible to attacks, and users can be tricked into connecting to malicious isolated networks, compromising their security.
Innovation Solution
Implementing a method where the macro HSS generates different authentication keys for isolated and public networks using distinct key derivation functions, ensuring that even if a local MME is compromised, it cannot successfully fake a public network, by recognizing the class of the radio network and using specific KDFs for isolated LTE networks, preventing successful communication with malicious networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the same authentication key is used for both isolated and public networks, then device complexity is reduced and ease of operation is improved, but security is compromised as local MMEs can be tricked into accepting malicious isolated networks
Solution Approach 1:
The authentication key management is segmented by network type. The system divides authentication into separate key pairs: one for isolated networks and one for public networks. This segmentation ensures that compromise in one network type does not affect the other, directly resolving the security vulnerability while maintaining manageable complexity through clear separation of concerns
Solution Approach 2:
Different authentication key derivation functions are applied based on the local network context. The system determines whether the current network is isolated or public and applies the appropriate KDF locally. This local quality approach allows the system to maintain simple operation procedures while adapting security measures to the specific network environment
2Reliability
If a dedicated USIM for IOPS mode is implemented, then security is improved by preventing unauthorized access, but adaptability deteriorates as users cannot use the same USIM for both isolated and public networks
Solution Approach 1:
The authentication system achieves multi-functionality by enabling a single USIM to operate securely in both isolated and public networks. The network side determines the network type and applies the appropriate authentication key derivation, making the USIM universal across different network modes without requiring separate dedicated USIMs for each network type
3Reliability
If local MMEs in isolated networks use the same authentication procedure as public networks, then ease of operation is improved, but security deteriorates as local MMEs become susceptible to attacks and can be tricked into connecting users to malicious networks
Solution Approach 1:
The network type determination acts as an intermediary layer between the authentication request and the key derivation process. This intermediary determines whether the network is isolated or public and routes the authentication through the appropriate key derivation function, providing security protection without significantly complicating the overall authentication procedure from the user perspective
Data Source
Figure 1
Figure 2
AI summary
The present invention provides apparatuses, methods, computer programs, computer program products and computer-readable media regarding security in isolated LTE networks. The method comprises receiving, at a network element, a message from a management entity, determining, at the network element, a class of a radio network to which the management entity belongs, selecting a function for generating an authentication key based on the determined class, and generating the authentication key using the selected function.