LTE NAS Security Architecture Protocol Discriminator Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The current LTE NAS architecture lacks support for new message types, security implementation, and proper handling of NAS message length and sequence numbers, particularly during handovers and radio link failures, which hinders efficient message routing and security in LTE networks.
Innovation Solution
Enhancements to the LTE Layer 3 protocol discriminator field, introduction of new message types, and a new NAS architecture that enables security by determining ciphering and integrity checks based on protocol discriminators, message types, and security state variables, along with handling of sequence numbers and hyper frame numbers during handovers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the current LTE L3 header structure is used, then the existing protocol routing is maintained, but it cannot support new NAS message types and protocols
Solution Approach 1:
The L3 header is segmented into distinct fields including protocol discriminator (PD) fields that can be independently configured. This segmentation allows new message types to be supported by setting specific PD values without redesigning the entire header structure, thus improving adaptability while maintaining manageable complexity.
Solution Approach 2:
The protocol discriminator fields are designed to be multi-functional, serving both existing GPRS/UMTS protocols and new LTE NAS protocols. By making the PD fields universal rather than protocol-specific, the header structure can accommodate diverse message types without requiring separate header formats for each protocol.
2Reliability
If a single security layer in MAC/RLC is used, then the implementation is simpler, but security is compromised in LTE with vulnerable base stations
Solution Approach 1:
The security architecture is segmented into two distinct layers: NAS security terminating in the MME and AS security terminating in the eNode-B. This segmentation isolates critical authentication and key management functions in the core network while allowing lighter security functions at the radio access level, improving overall security without requiring complete redesign of the entire security system.
Solution Approach 2:
The NAS security layer acts as an intermediary between the core network and the radio access network. By placing security termination in the MME (core network) rather than at the eNode-B (radio access), the system mediates security functions through a trusted core network element, protecting against vulnerabilities in distributed base stations while maintaining manageable complexity through clear separation of security responsibilities.
3Reliability
If NAS security is always active, then security is maximized, but processing overhead and latency increase
Solution Approach 1:
NAS security is implemented dynamically rather than statically. The system can transition between security active and inactive states based on operational requirements, allowing security to be applied only when needed. This dynamic approach maximizes security during sensitive operations while reducing processing overhead during routine communications, thereby minimizing time loss without compromising overall security posture.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A method and apparatus performs processing of the non-access stratus (NAS) layer (layer 3) in long term evolution (LTE) wireless transmit/receive units (WTRUs), which allows the NAS protocol layer to route layer 3 messages to the correct NAS entity, and encode new NAS message types and information elements. A new architecture is presented that enables NAS security. When a NAS message is generated, a determination is made to whether or not to cipher, de-cipher and/or intergrity check the NAS message based on at least one of a protocol discriminator (PD) of the NAS message, an indicator field in a header of the NAS message, the type of the NAS message, a NAS security state variable, and an indication by an upper layer protocol. The NAS security state variable indicates whether NAS security is currently actove or not and may comprise one bit.