UE Capability Verification in NAS Security Mode Attach
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In mobile communications, an attacker can modify UE capability information during the attach procedure, leading to incorrect service provisioning due to lack of integrity protection in the attach request message, resulting in denial of service issues.
Innovation Solution
The UE and MME verify UE capability information using hash values and message authentication codes to ensure consistency, ensuring correct capability information is provided to the MME.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If integrity protection is not implemented in the attach request message, then the attach procedure is simple and fast, but the UE capability information can be modified by attackers leading to service denial
Solution Approach 1:
The patent applies preliminary action by having the UE calculate and include a hash value of the attach request message before the MME processes the capability information. This preliminary hashing step ensures that any modification to the UE capability information will be detected during the subsequent verification process, preventing service denial while maintaining procedure simplicity.
Solution Approach 2:
The patent implements feedback by having the MME send back a NAS security mode command message containing the first hash value to the UE. The UE then verifies the consistency between the received hash value and the original attach request message hash, providing feedback mechanism that ensures integrity without adding complex authentication protocols.
2Reliability
If the MME trusts the attach request message without verification, then the service provisioning is fast, but the MME may provide services based on modified UE capability information
Solution Approach 1:
The patent applies self-service by having the UE perform the verification operation itself. The UE calculates the hash value of the attach request message and compares it with the received first hash value from the MME. This self-verification approach ensures service provisioning accuracy while minimizing the verification time burden on the MME network side.
3Object-affected harmful factors
If no verification mechanism is used, then the communication overhead is low, but man-in-the-middle attacks can successfully modify UE capability information
Solution Approach 1:
The patent uses an intermediary approach by introducing a hash value as a mediator between the UE and MME. This hash value acts as a digital fingerprint that verifies the integrity of the attach request message. The MME includes this hash value in the NAS security mode command message, allowing the UE to verify that no man-in-the-middle attack has occurred without requiring complex cryptographic authentication.
Data Source
AI summary
The present disclosure relates to mobile communications technologies, and in particular, to a mobile communication method, apparatus, and device. The method includes: receiving, by user equipment UE, a non-access stratum NAS security mode command message from a mobility management entity MME, where the NAS security mode command message carries first verification matching information used to verify UE capability information received by the MME; determining, by the UE based on the first verification matching information, whether the UE capability information received by the MME is consistent with UE capability information sent by the UE to the MME; and if the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME, sending, by the UE, a NAS security mode complete message to the MME.