5G Initial NAS Message Encryption via Public Key
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G systems, the initial non-access stratum (NAS) protocol message transmission faces challenges in securing sensitive information, particularly during the initial access to the NG-RAN, where a large number of parameters carrying sensitive information are sent in the clear, potentially leading to tracking and passive attacker eavesdropping issues.
Innovation Solution
The proposed solution involves using public key encryption to encrypt parts of the Initial NAS message, allowing the UE to encrypt using the serving PLMN's public key, and the AMF to decrypt using the corresponding private key, thereby enhancing security and preventing tracking and passive attacker threats. Additionally, the use of integrity and confidentiality protection mechanisms ensures secure transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If initial NAS message parameters are transmitted in clear text, then transmission simplicity is maintained, but security and tracking protection deteriorate
Solution Approach 1:
The initial NAS message is segmented into multiple parts: some parameters are encrypted while others remain in clear text. Specifically, the UE identity and other sensitive information are encrypted using public key encryption, while other necessary parameters are transmitted in clear text for network processing.
Solution Approach 2:
Different security levels are applied to different parts of the message based on their sensitivity. Sensitive fields such as UE identity are encrypted with public key cryptography, while less sensitive parameters are transmitted in clear text, achieving localized security enhancement without complete encryption overhead.
2Reliability
If public key encryption is applied to Initial NAS message, then security is improved, but message length and processing complexity increase
Solution Approach 1:
Instead of encrypting the entire Initial NAS message, only the critical sensitive portions (such as UE identity) are encrypted using public key cryptography. This partial encryption approach provides sufficient security for the most important information while avoiding the excessive complexity of encrypting the complete message.
3Object-affected harmful factors
If public key encryption is used for UE identity, then tracking protection is enhanced, but processing time and computational overhead increase
Solution Approach 1:
The network pre-generates and stores public keys before they are needed for encryption. This preliminary preparation of cryptographic materials reduces the computational burden during the actual initial access process, as the UE simply needs to perform encryption with a pre-available public key rather than generating key pairs in real-time.
Data Source
AI summary
Systems and methods of protecting an initial NAS message are described. Depending on whether a security context for a serving PLMN is stored, the UE uses either a public key from the serving PLMN or a key from the security context to encrypt parts of the initial NAS message. An initial NAS message containing the encrypted parts is then sent to an AMF of the serving PLMN. The serving PLMN public key is transmitted via a SIB. Prior to transmission of the initial NAS message or in parallel with it, an RRC message is sent to the base station. The RRC message contains the UE identifier and/or a NSSAI encrypted using the serving PLMN public key.