User Plane Function Token Verification for LTE Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In LTE networks, the security is compromised as attackers can steal tokens and impersonate legitimate devices, leading to fraudulent activities by verifying illegitimately.
Innovation Solution
A data packet verification method is implemented by a user plane function entity, where a second token is generated based on the terminal device's identifier and service identifier, ensuring that only legitimate devices can pass verification by comparing the generated token with the token carried in the data packet.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a token is randomly generated by the CN device for access device verification, then the verification process is simple and fast, but the security is compromised because attackers can steal and reuse the token to impersonate legitimate devices
Solution Approach 1:
The verification mechanism is segmented into multiple independent components: terminal device identifier, service identifier, and token. Each component serves a specific function and must be correct for verification to succeed. This segmentation prevents attackers from using stolen tokens alone for impersonation, as they would also need to provide correct identifiers.
Solution Approach 2:
The verification parameters are changed from a single token-based system to a multi-parameter system including terminal device identifier, service identifier, and token. This parameter expansion increases the complexity of the verification mechanism but significantly improves security by making token theft insufficient for impersonation.
2Reliability
If verification is performed based on multiple parameters including terminal device identifier and service identifier, then network security is enhanced, but the verification complexity and processing time increase
Solution Approach 1:
The terminal device identifier and service identifier are prepared and associated with the token in advance during the token generation phase. This preliminary action ensures that when verification occurs, the identifiers are already available and properly associated with the correct service and terminal, reducing the complexity of the verification process itself.
Solution Approach 2:
The user plane function entity acts as an intermediary that manages the verification process. It receives the data packet with the token, extracts the terminal device identifier and service identifier, generates the expected token based on these parameters, and performs the verification comparison. This intermediary role simplifies the overall system architecture by centralizing the verification logic.
Data Source
AI summary
A data packet verification method and a device improve network security. The method includes: receiving a data packet of a terminal device, where the data packet carries a first token and a service identifier, and the service identifier is used to indicate a type of a service to which the data packet belongs; obtaining first input information based on the data packet, and generating a second token based on the first input information, where the first input information includes an identifier of the terminal device and the service identifier carried in the data packet; and sending the data packet when the first token is the same as the second token.