5G Initial NAS Message Encryption via Public Key

Solution Overview

Problem

The initial Non-Access Stratum Protocol Message in 5G systems faces challenges in securing initial NAS message transmission, particularly during initial registration, where sensitive information is sent in cleartext, making it vulnerable to eavesdropping and tracking, and lacks effective protection against passive attackers.

Innovation Solution

Implementing public key encryption for the initial NAS message, where the serving PLMN network advertises a public key, allowing the UE to encrypt sensitive information, and using a private key for decryption by the AMF, ensuring confidentiality and integrity protection, and incorporating a nonce, timestamp, or sequence number to prevent replay attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If the initial NAS message is transmitted in cleartext for simplicity and ease of processing, then the device complexity is reduced, but the security and confidentiality of the transmission deteriorates

Engineering Contradiction:

Improvemessage processing complexityVSAvoideavesdropping and tracking vulnerability

Core Design Contradiction:

Device complexityVSObject-affected harmful factors

Solution Approach 1:

The network performs preliminary action by advertising its public key in system information blocks (SIB) before the UE attempts to register. This allows the UE to obtain the public key in advance and encrypt the initial NAS message before transmission, resolving the security issue without requiring complex real-time key exchange mechanisms

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A public key acts as an intermediary between the network and the UE for secure communication. The public key enables the UE to encrypt messages without requiring direct secret sharing with the network, while the corresponding private key held by the network enables decryption. This intermediary mechanism provides security without the complexity of direct key management between parties

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If public key encryption is implemented for the initial NAS message, then the security and confidentiality are improved, but the device complexity and processing overhead increases

Engineering Contradiction:

Improveprotection against passive attacksVSAvoidencryption processing complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The UE performs self-service by autonomously encrypting its initial NAS message using the public key obtained from the network's system information. This eliminates the need for complex interactive key exchange protocols or additional authentication messages, as the UE independently prepares the encrypted message before transmission

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent uses a disposable encryption approach where the UE generates a new encryption context for each initial registration attempt using the public key. This avoids the need for long-term secret key management and complex key refresh mechanisms, reducing overall system complexity while maintaining security

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Speed

If sensitive information is sent in cleartext for faster processing, then the transmission speed is improved, but the integrity and confidentiality protection deteriorates

Engineering Contradiction:

Improvemessage transmission speedVSAvoidmessage confidentiality and integrity

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

The network performs preliminary action by advertising its public key in system information blocks (SIB) before the UE attempts to register. This allows the UE to obtain the public key in advance and encrypt the initial NAS message before transmission, resolving the security issue without requiring complex real-time key exchange mechanisms

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A public key acts as an intermediary between the network and the UE for secure communication. The public key enables the UE to encrypt messages without requiring direct secret sharing with the network, while the corresponding private key held by the network enables decryption. This intermediary mechanism provides security without the complexity of direct key management between parties

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11863975B2Protection of initial non-access stratum protocol message in 5G systems

Publication Date: 2024.01.02 APPLE INC

AI summary

Systems and methods of protecting an initial NAS message are described. The NAS message is encrypted using the home PLMN public key during initial registration with the network using a registration request message. An AMF of the serving PLMN sends a serving PLMN public key which is then used to encrypt information including an S-NSSAI of later initial NAS messages after initial registration is completed. The S-NSSAI may not be sent in the later initial NAS message if the S-NSSAI is provided at an access stratum level. The RRC message may contain an indication that the S-NSSAI is encrypted using the serving PLMN public key.