Message Protection Method for LTE Security Context Establishment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In LTE communications systems, messages transmitted between user equipment and network devices without security protection are vulnerable to forgery and replay attacks, leading to abnormal long-time denial of service and reduced network communication security.
Innovation Solution
A message protection method that involves sending a request message with a first random number, generating an abnormal response message with a signature based on the first random number, and verifying the signature using a third random number and credential to determine the validity of the response message, thereby preventing forgery and replay attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security protection is not performed on messages transmitted before a security context is established, then the message transmission process is simple and fast, but the network communication security is reduced and vulnerable to forgery and replay attacks
Solution Approach 1:
The patent applies preliminary action by pre-configuring credentials in the user device before actual communication occurs. These credentials are obtained through authentication with the network device in advance and stored locally. When messages are transmitted before security context establishment, the user device can immediately perform signature verification using these pre-configured credentials without delaying the communication process, thus providing security protection while maintaining transmission speed.
Solution Approach 2:
The patent uses disposable signature verification tokens that are generated and consumed in single-use pairs. Each request message includes a signature created with a temporary token, and the corresponding verification credential is consumed during verification. This approach provides strong security without requiring complex long-term key management systems, as each verification instance is self-contained and disposable.
2Reliability
If signature verification is performed on all messages, then message authenticity is ensured, but the processing time and computational overhead increase
Solution Approach 1:
The patent applies local quality by performing signature verification selectively rather than uniformly on all messages. The verification is applied specifically to messages transmitted before security context establishment, while messages after security establishment use the already-established secure channel. This localized approach ensures authenticity where needed without unnecessarily increasing processing time for all communications.
Solution Approach 2:
The patent reduces verification time through preliminary action by pre-obtaining and caching verification credentials during the authentication phase. When message verification is needed, the system uses these pre-prepared credentials immediately without requiring time-consuming key exchange or credential retrieval operations, thus ensuring message authenticity while minimizing processing time overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of this application provide a message protection method, user equipment, and a core network device. The method includes: sending a request message on which no security protection is performed to the core network device, where the request message includes a first random number; receiving an abnormal response message, where the abnormal response message includes a third random number and a signature; and determining, based on the third random number, the signature, and an obtained credential, whether the abnormal response message is a valid message. According to the message protection method provided in the embodiments of this application, security protection can be performed on a message transmitted before a security context is established between the user equipment and the core network device, so as to improve network communication security.