RRC Access Request Authentication Against Terminal Spoofing DoS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems face challenges in verifying the legitimacy of user terminals during initial RRC connection establishment, leading to Denial of Service (DoS) attacks due to malicious terminals impersonating legitimate devices, which occupy channel resources and cause air interface disruptions.
Innovation Solution
A method involving user terminals generating access request messages with cipher text and signatures based on base station public keys and terminal private keys to authenticate legitimacy, and base stations parsing these messages to verify the authenticity of user terminals using corresponding private and public keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control methods are used in wireless communication systems, then authentication can be performed, but signaling overhead increases and authentication efficiency decreases
Solution Approach 1:
The authentication process is divided into multiple stages: initial access request, first authentication response from the core network, second authentication response from the base station, and final access confirmation. This segmentation allows distributed authentication responsibilities, reducing the time burden on any single component while maintaining comprehensive security verification.
Solution Approach 2:
The base station acts as an intermediary between the user terminal and the core network authentication entity. It receives authentication requests from terminals, forwards them to the core network, and relays authentication responses back to terminals. This intermediary role distributes signaling overhead and enables parallel authentication processing, improving overall authentication efficiency.
2Reliability
If traditional access control methods are used in wireless communication systems, then authentication can be performed, but signaling overhead increases
Solution Approach 1:
Authentication signaling is segmented into multiple stages with different functions. The first authentication response from the core network contains initial verification information, while the second authentication response from the base station contains additional verification data. This segmentation allows efficient reuse of authentication information across multiple access requests, reducing redundant signaling overhead.
Solution Approach 2:
The authentication mechanism designed for random access scenarios is made universally applicable to both random access and scheduled access types. The same authentication signaling structure and procedures are used across different access modes, eliminating the need for separate authentication protocols and reducing overall signaling overhead in the system.
3Ease of manufacture
If authentication information is not updated, then system operation is simple, but security vulnerabilities accumulate over time
Solution Approach 1:
Authentication information is dynamically updated during system operation. The base station and core network can update authentication credentials in response to security events, time-based conditions, or access pattern changes. This dynamic update mechanism maintains security freshness without requiring complete re-authentication, balancing operational simplicity with security requirements.
Solution Approach 2:
The system performs preliminary authentication setup during initial network registration and periodic updates during scheduled operations. Authentication information is prepared and validated in advance before actual access requests occur, ensuring security credentials are current and valid. This preliminary action prevents security vulnerabilities from accumulating while maintaining smooth operational flow.
Data Source
Figure 1~2
Figure 3
Figure 4A
AI summary
Disclosed in the present application are a method for verifying an access request, a user terminal, and a base station. The method provided by the present application comprises: generating an access request message, wherein the access request message carries a ciphertext and a signature, the ciphertext is determined on the basis of a base station public key of a base station of a cell where a user terminal is located, and an identity identifier of the user terminal, and the signature is determined on the basis of a terminal private key and the identity identifier of the user terminal; and sending the access request message to the base station, wherein the access request message is used by the base station to determine, according to the signature and the ciphertext which are obtained by analyzing the access request message, whether the user terminal is legitimate so as to determine whether to allow the user terminal to access.