User Equipment Authentication Nonce Replay Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication mechanisms in communication networks are vulnerable to attacks that can reveal user sequence numbers, potentially leaking personal information, as malicious entities can replay authentication requests to derive sequence number information.
Innovation Solution
Implementing a mechanism where user equipment stores previous nonces and responds with a preconfigured dummy synchronization failure token when a repeated nonce is detected, preventing the disclosure of sequence number information by not adapting the sequence number based on such tokens.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the network sends authentication requests with sequence numbers to ensure authentication freshness, then authentication reliability is improved, but sequence number information may be leaked to malicious entities through replay attacks
Solution Approach 1:
The patent introduces a nonce as an intermediary element that decouples the authentication freshness verification from the sequence number. The nonce serves as a mediator that carries the freshness information without exposing the sequence number, thus preventing replay attacks while maintaining authentication reliability.
Solution Approach 2:
The patent extracts the freshness verification function from the sequence number and transfers it to the nonce. By separating these functions, the sequence number is no longer needed for freshness verification, eliminating the security vulnerability while preserving the authentication mechanism's reliability.
2Reliability
If the user equipment adapts sequence numbers based on synchronization failure tokens to maintain authentication state, then authentication synchronization is improved, but personal information may be disclosed through repeated nonce detection
Solution Approach 1:
Instead of adapting the sequence number based on the synchronization failure token (which could leak information), the patent inverts the approach by using a newly generated nonce for the next authentication request. This reverses the information flow direction, preventing personal information disclosure while maintaining synchronization.
Solution Approach 2:
The patent generates a new nonce in advance for the next authentication request before the current authentication completes. This preliminary action ensures that even if the current nonce is repeated or analyzed, the next authentication will use a fresh nonce, preventing information leakage while maintaining proper synchronization.
Data Source
AI summary
In accordance with an example embodiment, there is provided an apparatus, such as a user equipment, configured to receive, from a communication network, an authentication request which comprises a nonce and a received sequence number, check, whether the received sequence number is advanced with respect to a first sequence number, the first sequence number being from a most recent previous authentication request handled by the apparatus, check, responsive to the received sequence number not being advanced with respect the first sequence number, whether the nonce is identical to one from among plural stored nonces, and send, responsive to the nonce being identical to the one stored nonce, a response to the authentication request which comprises as a synchronization failure token a dummy value which is not derived from the first sequence number.