Wireless Device Attestation Using Secure Enclave Challenge Response
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current 5G wireless network security protocols are vulnerable to attacks such as eavesdropping, denial of service, and man-in-the-middle attacks due to insufficient authentication methods, particularly at the edge of the wireless network, where the connection between mobile equipment and network nodes is less secure.
Innovation Solution
Implementing a secured challenge and response mechanism that utilizes a shared secret operator assigned symmetric equipment key, combined with an asymmetric key pair and a secure enclave, to verify the authenticity and integrity of mobile equipment, ensuring secure communication with network nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current 5G security protocols with AKA authentication are used, then basic identity verification is achieved, but the wireless connection at the network edge remains vulnerable to attacks such as eavesdropping, man-in-the-middle attacks, and denial of service
Solution Approach 1:
The patent divides the authentication process into distinct phases: initial AKA authentication, followed by a secondary challenge-response verification. The authentication credentials are segmented into multiple components (authentication token, device fingerprint, challenge response) that are verified separately, creating layered security that addresses the vulnerability to attacks while maintaining basic identity verification
Solution Approach 2:
The patent implements preliminary security measures by establishing device fingerprints and security credentials before the mobile equipment connects to the network. The network node pre-generates challenge tokens and stores device-specific security profiles, enabling rapid verification without requiring real-time computation during authentication, thus preventing attacks before they can compromise the connection
2Object-affected harmful factors
If additional security measures such as challenge-response mechanisms are implemented, then attack resistance is improved, but the complexity of the authentication process increases
Solution Approach 1:
The patent implements self-service authentication where the mobile equipment autonomously generates its own challenge responses using stored security credentials. The device fingerprint and authentication tokens are locally verified without requiring manual intervention or complex network-side processing, reducing overall system complexity while maintaining strong attack resistance
Solution Approach 2:
The patent changes authentication parameters by transitioning from simple password-based verification to multi-factor challenge-response authentication. The system dynamically adjusts security parameters (challenge tokens, response thresholds, verification strictness) based on risk assessment, providing strong attack resistance while keeping the user interface simple and manageable
3Reliability
If the USIM stores multiple cryptographic keys and secrets, then security verification capability is enhanced, but the risk of key compromise and replay attacks increases
Solution Approach 1:
The patent adds a temporal dimension to key usage by implementing challenge-response authentication where each authentication session uses a unique challenge token that expires after verification. This transforms static key storage into dynamic, time-limited credential usage, enhancing security verification capability while preventing replay attacks and reducing key compromise risk
Solution Approach 2:
The patent introduces an intermediary verification mechanism where the network node acts as a mediator between the USIM and the authentication process. The network node verifies device fingerprints and challenge responses without directly exposing cryptographic keys, and uses this intermediary layer to prevent unauthorized key access and mitigate compromise risks while maintaining strong verification capability
4Reliability
If the network node performs additional verification steps, then authentication security is improved, but the processing time and network latency increase
Solution Approach 1:
The patent performs preliminary verification by pre-computing device fingerprints and storing security profiles in the network node before authentication occurs. This allows the network node to quickly compare challenge responses against pre-prepared verification data, maintaining high authentication security while significantly reducing processing time and network latency during actual login
Data Source
AI summary
A method and system for providing a secured challenge and response for wireless/mobile/IOT network security that provides a secure provisioning of mobile equipment, a challenging of the mobile equipment and the verification of the mobile equipment by a network node to verify that mobile equipment is an authentic and secure device provisioned by the operator. The challenging including sealing a shared secret operator assigned symmetric equipment key in a secure enclave and transmitting the shared secret operator assigned symmetric equipment key to a subscriber identity module for generation of a cipher key and integrity for use in verification of the mobile equipment with a network node.