RRC Base Station Authentication Using On-Demand Digital Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Nefarious actors can deploy illegitimate wireless devices posing as legitimate base stations to intercept user equipment, compromising security by attempting to connect and obtain personal or network information, which existing technologies fail to adequately authenticate.
Innovation Solution
Implementing a method where radio access network nodes transmit an on-demand digital signature capability indication to user equipment, generate and verify on-demand digital signatures based on unique identifiers, and establish communication sessions only if authentication is successful.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If conventional connection establishment procedures are used without digital signature verification, then connection speed and simplicity are improved, but security against fake base stations deteriorates
Solution Approach 1:
The patent applies preliminary action by performing digital signature verification during the connection establishment process itself, rather than as a separate subsequent step. The radio access network node generates and provides a digital signature (MAC) along with system information blocks during initial connection setup, allowing the user equipment to verify authenticity before fully establishing the connection. This resolves the contradiction by embedding security verification within the connection establishment procedure, maintaining speed while improving reliability.
2Reliability
If digital signature verification is implemented during connection establishment, then authentication reliability is improved, but device complexity and processing overhead worsen
Solution Approach 1:
The patent uses an intermediary approach by introducing a Message Authentication Code (MAC) as a simplified verification mechanism. Instead of implementing complex digital signature algorithms directly in the user equipment, the system uses a MAC generated by the radio access network node based on system information blocks and a secret key. This intermediary MAC verification process provides strong authentication reliability while keeping the user equipment processing requirements manageable, thus resolving the contradiction between reliability and device complexity.
3Reliability
If on-demand digital signatures are generated for each connection request, then security against replay attacks is improved, but processing time and energy consumption worsen
Solution Approach 1:
The patent applies periodic action by generating on-demand digital signatures (MACs) only when connection establishment is requested, rather than continuously or for every possible connection scenario. The radio access network node generates a MAC in response to specific connection requests from user equipment, providing security against replay attacks only when needed. This on-demand approach significantly reduces energy consumption compared to continuous verification, while maintaining strong security when connections are attempted, thus resolving the contradiction between security and energy consumption.
Data Source
AI summary
A radio access network node and a user equipment may be configured with a private key and a complementary public key, respectively, to be used to determine whether radio resource control signal connection establishment messages received at the user equipment are received from a legitimate node or from a false base station. The user equipment may request from a node that broadcast a connection establishment message an on demand digital signature based on the connection establishment message. In response to the request, the node may transmit, via an on demand system information message, an on demand digital signature generated based on the connection establishment message and the private key. The user equipment may determine a local digital signature based on the connection establishment message and the public key. The user equipment may perform a connection establishment action based on whether the local digital signature matches the on demand digital signature.