UE Handover Blocking for Unprotected RRC Reconfiguration Messages

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current wireless communication protocols allow fake base stations to manipulate user equipment (UE) into handover through unprotected RRC messages, posing a security risk.

Innovation Solution

User equipment (UE) is configured to detect and respond to unprotected RRC messages by transitioning to RRC_IDLE, logging, and reporting failures, thereby preventing handover to malicious base stations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If the network transmits RRC messages without security protection, then the messages can be received and processed by the UE, but the system becomes vulnerable to manipulation by fake base stations

Engineering Contradiction:

Improvemessage reception and processingVSAvoidsecurity against fake base stations

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent applies preliminary action by having the UE check security activation status before processing handover-related RRC messages. The UE proactively verifies whether security is activated prior to acting on reconfigurationWithSync fields, preventing manipulation by fake base stations before it can cause harm.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary security check mechanism between message reception and handover execution. The UE acts as an intermediary that intercepts RRC messages, verifies security activation status, and only permits handover operations when security is confirmed to be activated, thereby mediating between unprotected message reception and secure handover execution.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If the UE performs handover based on received RRC messages, then network mobility is enabled, but the UE may be manipulated to handover to malicious base stations

Engineering Contradiction:

Improvenetwork mobilityVSAvoidmanipulation by fake base stations

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary anti-action by implementing a preventive security check that counteracts potential manipulation before handover occurs. The UE checks whether security is activated before processing reconfigurationWithSync fields, thereby preemptively neutralizing the harmful effect of fake base station manipulation while preserving legitimate network mobility.

Inventive Principle:

Principle #9Preliminary anti-action

3Adaptability or versatility

If the UE processes all RRC messages, then communication flexibility is maintained, but security vulnerabilities increase

Engineering Contradiction:

Improvecommunication flexibilityVSAvoidsecurity risks from unprotected messages

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies local quality by differentiating the processing of RRC messages based on security activation status. Specifically, the UE processes reconfigurationWithSync fields only when security is activated, while maintaining the ability to receive and process other RRC messages for normal communication operations. This selective processing approach maintains communication flexibility for legitimate operations while blocking security risks from unprotected handover messages.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS12556989B2Systems and methods for preventing handover caused by an insecure message from a network node

Publication Date: 2026.02.17 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

AI summary

Systems, methods, and apparatus for handling messages from network nodes of a wireless communications system are disclosed. An example method performed by a terminal includes receiving a message from a network node. The terminal determines that the message contains a reconfigurationWithSync field and that security is not activated when the message is received. Responsive to the determining, the terminal prevents triggering of a handover operation.