Mutual Authentication Method for Mobile Network Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current authentication protocols in 3G and 4G mobile networks are vulnerable to security breaches, particularly due to the compromise of shared secret keys, which can lead to cloning of UICC/USIM cards and interception of communications, compromising network security.

Innovation Solution

A method of mutual authentication between user equipment and a communication network that includes verifying conditions related to sequence numbers and indices, ensuring synchronization and preventing desynchronization, thereby making it impossible for attackers to obtain sequence numbers and trace user equipment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If the authentication token carries the sequence number masked by an anonymization key, then the sequence number can be transmitted through the network, but an attacker who intercepts the communication can obtain the sequence number and trace user equipment

Engineering Contradiction:

Improvesequence number transmissionVSAvoidtraceability of user equipment

Core Design Contradiction:

Loss of informationVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the sequence number from the authentication token structure, transmitting only an authentication message instead of the complete authentication token that previously contained the masked sequence number. This separation removes the traceability vulnerability while preserving authentication functionality.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces an intermediary mechanism where the sequence number is processed through cryptographic operations (masking with anonymization key, then further processing with authentication key) to create an authentication message that serves as a mediator between the need for sequence number transmission and the need to prevent traceability.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If explicit resynchronization commands are sent by user equipment, then desynchronization between client and server can be corrected, but this creates traceability that compromises user privacy

Engineering Contradiction:

Improvesynchronization between client and serverVSAvoiduser privacy and traceability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent enables the system to perform resynchronization automatically without explicit user equipment commands. The server detects desynchronization conditions and initiates resynchronization procedures, making the system self-correcting and eliminating the need for user-initiated resynchronization requests that would create traceability.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent implements a feedback mechanism where the server monitors authentication exchanges for signs of desynchronization and automatically responds with resynchronization commands. This closed-loop feedback system maintains synchronization without requiring explicit user equipment requests.

Inventive Principle:

Principle #23Feedback

3Ease of operation

If the authentication key K is shared between user equipment and network, then mutual authentication and session key establishment can occur, but the security of the network is compromised if this key is compromised

Engineering Contradiction:

Improveauthentication and key establishmentVSAvoidnetwork security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent segments the authentication process into multiple independent components: sequence number management, anonymization key generation, authentication message creation, and resynchronization mechanisms. This segmentation ensures that compromise of one element (like the authentication key) does not necessarily compromise the entire authentication system, as other segments remain secure and functional.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentEP3523998B1Method for mutual authentication between user equipment and a communications network

Publication Date: 2023.07.26 ORANGE SA

Figure 1
Figure 2~4

AI summary

The invention relates to a method for mutual authentication between user equipment (UE) and a communications network, said network comprising a mobility management entity (MME) and a home subscriber server (HSS), said method, implemented by the user equipment, comprising: receiving (E8) an authentication challenge comprising an authentication token (AUTN) based on a first index (idxOp,c) and a first authentication message (MAC1) calculated by the home subscriber server and based on a first sequence number (SQNOp,c); checking (E9) that one of the conditions belonging to a set of conditions is true, said set of conditions comprising: the first sequence number is the same as a second sequence number (SQNc) stored in the user equipment, and the first sequence number is the same as the preceding value (SQNc -1) of the second sequence number and the first index is strictly higher than a second index (idxc) stored in the client equipment; and calculating and sending (E13), when one of the conditions is true, an authentication result (RES) and an authentication message (MAC4), based on the preceding value of the second sequence number, said authentication result to be checked in order to authenticate the user equipment.