Network Steering Integrity Using UE-Verified MAC Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies lack a secure and reliable method for ensuring that Visited Public Land Mobile Networks (VPLMNs) do not alter or remove Network Steering Information intended for User Equipments (UEs) from Home Public Land Mobile Networks (HPLMNs, and there is no efficient way for HPLMNs to verify delivery of this information.
Innovation Solution
A method and system where a UE generates a configuration key (Kconf) from a home network root key (Kausf) to protect Network Steering Information with Message Authentication Codes (MAC-1 and MAC-2), allowing the UE to verify integrity and acknowledge receipt to the HPLMN, ensuring the VPLMN has not altered the information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If VPLMN relays Network Steering Information from HPLMN to UE, then information delivery is enabled, but information integrity cannot be guaranteed
Solution Approach 1:
The HPLMN signs the Network Steering Information with a MAC-1 before transmitting it to the VPLMN. This preliminary authentication action ensures that when the VPLMN relays the information to the UE, the integrity is already protected, allowing the UE to verify authenticity without adding complex real-time security mechanisms.
Solution Approach 2:
The patent introduces MAC-1 as an intermediary authentication element that bridges the HPLMN and VPLMN trust relationship. The VPLMN acts as a mediator that forwards the pre-authenticated information without needing to verify it itself, simplifying the security architecture while maintaining integrity.
2Reliability
If HPLMN steers UE to specific VPLMN, then network control is improved, but delivery verification is not possible
Solution Approach 1:
The UE verifies the MAC-1 on received Network Steering Information and provides feedback by sending an acknowledgement message with MAC-2 back to the HPLMN. This feedback loop allows the HPLMN to confirm successful delivery and authentication, improving reliability while keeping the operation simple through automated verification.
3Reliability
If UE receives Network Steering Information from VPLMN, then information access is enabled, but alteration detection is not possible
Solution Approach 1:
The HPLMN pre-computes the MAC-1 based on the Network Steering Information and transmits it together with the information to the VPLMN, which then forwards both to the UE. This preliminary computation allows the UE to detect any alterations by verifying the MAC-1 without needing complex detection mechanisms.
Data Source
AI summary
According to certain embodiments, a method by a user equipment (UE) for securing network steering information includes transmitting a registration request to a Visited Public Land Mobile Network (VPLMN). Upon successful authentication by an authentication server function (AUSF), a home network root key is generated. A protected message comprising Network Steering Information is received from a first network node. The protected message is protected using a configuration key (Kconf) and a first Message Authentication Code (MAC-1). The configuration key (Kconf) is determined from the home network root key, and the UE verifies the MAC-1. Based on the Kconf and the MAC-1, it is verified that the VPLMN did not alter Network Steering Information. An acknowledgement message, which is protected with a second Message Authentication Code (MAC-2), is transmitted to a Home Public Land Mobile Network (HPLMN).