Detecting Man-in-the-Middle Attacks in Dual Connectivity Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In scenarios where a user terminal maintains dual connectivity with a macro eNodeB and a secondary eNodeB, the secondary eNodeB cannot detect man-in-the-middle attacks due to the lack of air-interface control plane signaling interworking, posing risks to user plane data integrity and security.
Innovation Solution
The method involves the macro eNodeB sending a second check request message to the user terminal with identifier information and data packet count values, which the user terminal uses to determine if a man-in-the-middle attack exists between the secondary eNodeB and itself, and responds with a check response message to the macro eNodeB, enabling both nodes to participate in the detection process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the secondary eNodeB offloads traffic from the macro eNodeB to improve user plane throughput, then the user plane data transmission capacity is improved, but the ability to detect man-in-the-middle attacks deteriorates due to lack of air-interface control plane signaling interworking
Solution Approach 1:
The patent introduces the macro eNodeB as an intermediary mediator in the detection process. Since the secondary eNodeB cannot directly communicate with the user terminal for detection purposes, the macro eNodeB acts as a relay that forwards detection requests and responses between the secondary eNodeB and the user terminal, enabling indirect detection capability while maintaining the traffic offload architecture
Solution Approach 2:
The detection function is segmented into multiple components distributed across different network elements. The secondary eNodeB generates detection requests, the macro eNodeB forwards them and relays responses, and the user terminal performs the actual verification. This segmentation allows each component to perform its specialized function while collectively achieving attack detection without requiring full control plane signaling at the secondary eNodeB
2Measurement precision
If the secondary eNodeB performs independent attack detection, then the detection accuracy is improved, but the signaling complexity and system overhead increase
Solution Approach 1:
The detection message format is designed to be universal and multi-functional, serving both as a security verification mechanism and as a lightweight data transmission protocol. The same signaling structure used for traffic management is repurposed for security detection, eliminating the need for separate complex detection-specific signaling protocols
Solution Approach 2:
The user terminal performs self-verification by comparing packet count values received from different paths. The terminal uses its own stored information to independently verify the authenticity of data packets, reducing the need for complex external verification mechanisms and simplifying the overall signaling requirements
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of the present invention relate to a method and an apparatus for detecting a man-in-the-middle attack, and the method includes: receiving, by an MeNB, a first check request message sent by an SeNB, where the first check request message includes first identifier information and a first data packet count value; generating, by the MeNB, a second check request message according to the first identifier information, and sending the second check request message to a user terminal; receiving, by the MeNB, a first check response message generated by the user terminal according to the second check request message, where the first check response message includes second identifier information and a second data packet count value; and when the first data packet count value is the same as the second data packet count value, determining, by the MeNB, that no man-in-the-middle attack exists between the SeNB and the user terminal; or when the first data packet count value is different from the second data packet count value, determining, by the MeNB, that a man-in-the-middle attack exists between the SeNB and the user terminal.