NAS Message Cleartext Segmentation for PLMN Change Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a 5G NR environment, after a Public Land Mobile Network (PLMN) change, the initial Non-Access Stratum (NAS) message is often sent in plain text or using weak confidentiality algorithms, leaving it vulnerable to decryption.
Innovation Solution
The User Equipment (UE) sends only a limited set of Information Elements (IEs) in cleartext after a PLMN change if a null or weak ciphering algorithm is adopted for the NAS security context, allowing the new PLMN to perform a security mode control procedure and activate a stronger ciphering algorithm for secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the UE uses the existing NAS security context after PLMN change, then the initial NAS message can be sent quickly without re-authentication, but the message may be sent in plain text or with weak ciphering algorithm making it vulnerable to decryption
Solution Approach 1:
The initial NAS message is segmented into two parts: information elements that can be sent in cleartext and information elements that require ciphering. This segmentation allows the UE to send essential registration information quickly while protecting sensitive data, resolving the contradiction between transmission speed and confidentiality.
Solution Approach 2:
The UE performs preliminary assessment of the NAS security context before sending the initial NAS message. It determines in advance whether the existing ciphering algorithm is strong enough, and if not, triggers re-authentication procedures beforehand to establish secure encryption, ensuring both quick transmission and message protection.
2Device complexity
If the UE sends all information elements in cleartext after PLMN change, then signaling overhead is minimized, but the message becomes vulnerable to decryption by hackers
Solution Approach 1:
The message is divided into cleartext information elements and ciphered information elements. Only necessary registration information is sent in cleartext to minimize overhead, while sensitive information elements are encrypted using the NAS security context, balancing signaling efficiency with security protection.
Solution Approach 2:
Different parts of the NAS message receive different treatment based on their sensitivity. Non-sensitive information elements are transmitted in cleartext without encryption overhead, while sensitive information elements are encrypted locally using the appropriate ciphering algorithm, optimizing both overhead and security for each specific element.
3Reliability
If the UE uses a strong ciphering algorithm for the initial NAS message, then message confidentiality is improved, but the signaling overhead increases due to security mode control procedures
Solution Approach 1:
The UE performs preliminary evaluation of the NAS security context to determine the strength of the existing ciphering algorithm. If the algorithm is already strong, the UE can send the initial NAS message with minimal additional signaling. If the algorithm is weak, the UE triggers re-authentication procedures in advance, avoiding repeated security negotiations and reducing overall signaling overhead.
Solution Approach 2:
The UE applies ciphering only to the necessary information elements rather than the entire NAS message. This partial application of encryption provides adequate protection for sensitive data while minimizing the signaling overhead associated with full-message encryption and security mode control procedures.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A User Equipment (UE) including a wireless transceiver and a controller is provided. The wireless transceiver performs wireless transmission and reception. The controller selects a PLMN via the wireless transceiver, and determines whether a predetermined ciphering algorithm is adopted for a Non-Access Stratum (NAS) security context. In response to selecting the PLMN and the predetermined ciphering algorithm being adopted for the NAS security context, the controller sends an initial NAS message in which Information Elements (IEs) are in cleartext only to the selected PLMN via the wireless transceiver.