UE Network Authentication via Nonce and Signature
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current wireless communication systems, particularly in LTE networks, face vulnerabilities in security configurations that can be exploited, leading to potential attacks and compromised network integrity, especially with the deployment of new technologies and network functions at the edge.
Innovation Solution
Implementing a method where user equipment (UE) authenticates serving networks using a nonce and signature requests, with responses verified against operator-signed public key certificates, to enhance security and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security configuration processes are used in LTE networks, then device compatibility and ease of operation are maintained, but network security and reliability are compromised due to vulnerabilities to attacks
Solution Approach 1:
The patent applies preliminary action by having the UE request and obtain the network function's public key certificate in advance during the connection establishment phase, before actual data transmission begins. This allows the UE to verify the network's identity proactively rather than reactively, preventing unauthorized access before it can compromise security. The certificate verification is performed as a preliminary security check that validates the network function's authenticity.
Solution Approach 2:
The patent introduces a public key certificate as an intermediary element that mediates the trust relationship between the UE and the network function. Instead of direct authentication, the certificate acts as a trusted third-party credential that the network function presents to prove its identity. This intermediary mechanism enables secure verification without requiring complex direct authentication protocols between the UE and network function.
2Reliability
If security verification steps are added to authenticate serving networks, then network integrity is improved, but communication overhead and processing time increase
Solution Approach 1:
The patent performs certificate verification during the initial connection establishment phase rather than during ongoing data transmission. By completing the security verification upfront when the UE first connects to the network function, the patent ensures network integrity is established before communications begin, without adding delays to subsequent data transfer operations.
Solution Approach 2:
The patent replaces complex multi-step authentication mechanical systems with a simpler public key certificate verification mechanism. Instead of multiple challenge-response exchanges and key derivations, the system uses cryptographic signature verification on the certificate, which can be performed efficiently in software without requiring extensive back-and-forth communication between UE and network function.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, an apparatus, and a computer program product for wireless communication are provided. A method includes transmitting a request to a serving network with a nonce and a signature request directed to a network function of the serving network, receiving a response to the request from the serving network, and authenticating the serving network based on the signature of the network function. The nonce may provide replay protection. The response may include a signature of the network function. The request sent to the serving network may include a radio resource control (RRC) message or a tracking area update (TAU) request. The serving network may be authenticated using a trusted third party to verify a certificate associated with the serving network.