Mobile Equipment Keystream Protection Against User-Plane Hijacking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile networks are vulnerable to Man-in-the-Middle attacks that exploit keystream vulnerabilities in the user plane, particularly in layer 3 (ICMP, SMS over SIP) and layer 2, without effective mechanisms to check data integrity, affecting common users and potentially compromising data security.
Innovation Solution
A vulnerability detection and prevention unit in mobile equipment, independent of the application and baseband processors, analyzes IP packets for keystream vulnerabilities, alters known plaintext parts with random text, and acknowledges responses to prevent keystream hijacking, with an optional database update mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If encryption is applied on the PDCP sublayer using AES counter mode, then data confidentiality is improved, but data integrity protection is lost making the system vulnerable to keystream hijacking
Solution Approach 1:
The patent segments the encryption process into two independent parts: (1) AES-CTR encryption for confidentiality at the PDCP layer, and (2) a separate integrity protection mechanism using HMAC-SHA256 that operates on the ciphertext. This segmentation allows each layer to perform its specific function without compromising the other, solving the contradiction between confidentiality and integrity protection.
Solution Approach 2:
The patent introduces an intermediary integrity protection layer (HMAC-SHA256) that mediates between the encryption process and the data transmission. This intermediary computes an authentication tag over the ciphertext and associated data, providing integrity verification without interfering with the confidentiality provided by AES-CTR encryption.
2Device complexity
If no integrity check mechanism is implemented on the user plane, then device complexity is reduced, but the system becomes vulnerable to Man-in-the-Middle attacks
Solution Approach 1:
The patent implements self-service integrity protection where the mobile equipment and network automatically perform HMAC-SHA256 authentication tagging without requiring user intervention or additional protocol negotiations. The integrity protection is seamlessly integrated into the existing data plane, providing security without increasing perceived complexity for users or requiring complex protocol modifications.
3Reliability
If keystream protection mechanisms are added to the data plane, then security against hijacking is improved, but transmission latency increases
Solution Approach 1:
The patent applies preliminary action by pre-computing the HMAC-SHA256 authentication tag along with the AES-CTR encryption process rather than performing integrity verification after transmission. The associated data (including sequence numbers and packet lengths) is incorporated into the HMAC computation in advance, allowing for efficient parallel processing and minimizing additional latency.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention refers to a method, a mobile equipment, and a system for vulnerability detection and prevention for keystream protection. The method comprises generating a vulnerability detection and prevention unit located in a secure processing region that is independent of an application processor and a baseband processor of a mobile equipment; receiving IP packets, wherein the IP packets are sent from a network to an application protocol functions layer in the application processor, or sent from the application protocol functions layer to the network; analyzing the received IP packets to determine whether the IP packets are associated with predetermined keystream vulnerabilities; and altering the known and plaintext part of the IP packets using a random data in response to determining that the IP packets are associated with the predetermined key stream vulnerabilities.