Protocol expansion of a signaling message

The present invention relates to a method and an apparatus for identifying a change in a signaling message transmitted from a network unit to a communication terminal.

For communication networks, especially 2nd and 3rd generation mobile wireless systems such as GSM and UMTS networks, the network unit (switching unit = Mobile Service Switching Center [MSC] or Serving GPRS Support node = Serving GPRS Support Node [SGSN]) exchanges signaling messages with the communication terminal.

Ala-Laurila, J., ua: Wireless LAN access network architecture for mobile operators; IEEE Communications Magazine, Volume 39, Issue 11, Nov. 2001, S.82-89, WLAN access network technology, SIM-based user management functions And new wireless LAN architectures for coupling network operator roaming infrastructures are known. In the described system, WLAN access is authenticated and charged via a GSM-SIM card.

Postel, J .: User Datagram Protocol: Internet Engineering Task Force (IETF). 28. August 1980 (In Internet: In Internet: <u style="single">URL: http://www.ietf.org/rfc/rfc768.txt</u>) Describes the User Datagram Protocol (UDP) for packet-switched computer communication within a computer network. The Internet Protocol is the basis for the UDP Protocol, and another program with the smallest protocol mechanism provides a procedure for the application to send a message.

From document D3 (2004/0037320 A1), a technique for transmitting a packet from a transmission unit to a receiver unit via a wireless communication system is known. In this case, the data frame contained in the packet is received. One or more headers are generated in the protocol field for one or more protocols for a packet. In this case, RTP, UDP, IP, PPP, RLP and their variations are effective as protocols.

From document D4 (WO 03/036908 A1), a method for transmitting a message to a large number of terminals in a network by using a multicast service is known. In this case, the multicast message is encrypted and sent to multiple terminals at the same time.

Since the wireless interface between the base station and the communication terminal or mobile radio device basically offers a lot of potential for the attacker, the attacker can use the so-called "fake base station" to connect the communication terminal to the true base station. Occupy a position between and. A fake base station in this case behaves like a base station to a communication terminal and behaves like a communication terminal to a true base station. By tampering with the messages exchanged between the communication terminal and the network unit, the fake base station operates, for example, so that the mobile radio conversation is encrypted in a relatively weak manner and thereby can be eavesdropped relatively easily. be able to.

Methods for protecting against message tampering are implemented in UMTS networks in accordance with 3GPP TS 33.102, Universal Mobile Telecommunications System (UMTS); 3G security; Security architecture, Release 5.3.0 (2003-10-03), chapter 6.3.

When a mobile wireless device logs in to a communication network for the first time, an authentication procedure is performed, which authenticates the mobile wireless device to the communication network and is a secret temporary key between the mobile wireless device and the communication network. IK is arranged.

For this purpose, a response signed by the function f2K (RAND, Ki) from the subscriber's private key Ki and random number RAND in a special network unit, Authentication Center (AuC) in a communication network or mobile wireless network. The temporary private key IK is calculated by (signed response) (SRES) and yet another function f4K (RAND, Ki). RAND, SRES and IK are then transmitted to the mobile service switching center MSC or serving GPRS support node SGSN to which the mobile radio device is just connected. The MSC or SGSN finally sends a random number RAND to the mobile wireless device by the message "Authentication Request". In the mobile radio device, the response (signed response) (SRES) signed by the function f2K (RAND, Ki) and the function f4K (RAND, Ki) and the temporary secret key IK are calculated from the RAND and the private key Ki.

Subsequently, the mobile wireless device returns the value SRES to the communication network by an authentication response message (authentication response). The MSC or SGSN compares this value with the value calculated by the authentication center AuC. If the two match, the mobile radio device is considered successfully authenticated. At the same time, mobile wireless devices and communication networks generate a temporary private key IK by this procedure.

For every signaling message exchanged between the mobile radio and the communication network after the authentication procedure, the sender of the message calculates the check value hash (message, IK) with the private key IK each time. The check value hash (message, IK) is calculated by the temporary key IK. This is because the private key Ki should generally never be separated from the authentication center. After this, the inspection value is transmitted by a message and inspected by the mobile radio device. If the message has been modified by a fake base station, mobile radio equipment usually identifies this in that the test values no longer match. This is because the fake base station does not know the private key IK and therefore cannot calculate the check value for the modified message.

In UMTS networks, this method was, of course, introduced from the beginning, i.e. from the first protocol version. Mobile radios therefore know that the message must include a test value. Therefore, distinguish whether the mobile radio device is in the "old network" (the message does not contain the test value) or in the "new network" (the message must contain the test value). Is not needed.

A similar proposal was made in the GSM system: in this case a check value was added to the authentication request message (authentication request) as a new message element. A fake (fraudulent) base station naturally tampers with the message (for example, for eavesdropping purposes), and this fake base station removes the test value and transfers the message to the mobile radio device in the old format. The question of how mobile radio devices could be identified as being in a new network was not solved by this proposal. Yet another proposal for GSM systems (3GPP TSG SA WG3 Security, Cipher key separation for A / Gb security enhancements, file S3-030463, 15-18 JULY 2003, San Francisco, USA, Agenda point 7.5, Source: Vodafone) is based on the fact that fake base stations must not change the value of the RAND parameter in an authentication request message (authentication request). This is because otherwise the mobile radio device will calculate the wrong SRES value and the authentication procedure will not work.

According to this proposal, a specially determined bit string is inserted in the first 32 bits of the RAND parameter, and this bit string is transmitted to the mobile radio device in the subsequent n bits of the RAND parameter. Instruct. (Standardized contribution S3-030463 specifically proposes to encode which GSM cryptographic algorithms are allowed on this network and which GSM cryptographic algorithms are not allowed on this network in the next 8 bits. This prevents fake base stations from tampering with messages on the wireless interface to mobile wireless devices and selecting cryptographically relatively weak cryptographic algorithms.)

A special bit string is required. This is because this protocol extension is not supported by all networks from the beginning. The longer the special bit string, the more and more communication networks that do not yet support this protocol extension randomly select the special bit string when selecting the RAND parameter, and the mobile radio device mistakenly in the RAND parameter in this case. The probability of interpreting other bits as information is reduced. For 32 bits, this probability is, for example, 1: 2.³² 1: 4x10⁹Is.

In general, the following requirements need to be met to solve the problem: i) New networks that support protocol extensions (UMTS networks, etc.) also support protocol extensions. The device should be aware of tampering with the authentication request message (authentication request).

ii) Communication terminals or mobile wireless devices should work in older networks (GSM networks, etc.) that do not yet support protocol extension. Inevitably, this communication terminal or mobile wireless device cannot identify message tampering in this case.

iii) The communication terminal or mobile radio equipment is in the old network or in the new network, especially when a fake base station attempts to disguise the "old network" for this communication terminal or mobile radio equipment. You must be able to identify if you are inside.

Understand that the concept "additional protocol extension" means that messages are not yet tamper-protected in signaling protocol version "n", but are protected after protocol version "n + 1". I want you to. The new version "n + 1" should be backward compatible with the predecessor version "n" in this case. Possible tampering with fake base stations is, for example, the easy omission of new message elements. It is presumed that the mobile radio device is in this case in a network with protocol version "n".

Problems with the method proposed in S3-030463 (3GPP TSG SA WG3 Security, Cipher key separation for A / Gb security enhancements, 15-18 JULY 2003, San Francisco, USA, Agenda point 7.5, Source: Vodafone) are protected. The information to be stored is embedded in the RAND parameter, that is, as more and more such information is added over time, fewer bits can be selected virtually randomly by the communication network. This tends to weaken the authentication function f2K (RAND, Ki). In addition, the length of the RAND parameter (16 bytes in GSM and UMTS networks) presets the upper limit of the amount of information that can be protected in this way.

An object of the present invention is to propose the possibility for efficient and easy identification of changes in signaling messages.

According to the present invention, the above problems are solved by the subject of independent claims. Improved embodiments of the present invention are described in the dependent claims.

At the core of the present invention, in order to identify a change in a signaling message transmitted from a network unit to a communication terminal, the network unit in the transmitted signaling message (authentication request) and a bit string known to the communication terminal are signaled. It is to indicate that the check value is included in the message (authentication request; yet another message). The signaling message containing the check value is in this case an authentication request message or another message or signaling message following it. The inspection value received by the communication terminal after receiving this message is compared with the inspection value calculated by this communication terminal. Communication terminals, such as mobile wireless terminals, mobile computers, mobile organizers, etc., subsequently signal when this bit string is received in a signaling message (authentication request) and the comparison of these two test values gives a positive result. Message (authentication request; Yet another message) is defined as unchanged. The special bit string itself is protected in an appropriate manner during transmission, so that changes made by fake base stations are noticed by this communication terminal or network unit. Ideally, a special bit string is contained within the RAND parameter. A special bit string in the RAND parameter allows this communication terminal to identify with great certainty whether the communication network supports protocol extensions for signaling messages. If a fake base station modifies the RAND parameter to disguise the "old" network for the communications terminal, this is the network unit, especially the Mobile Services Switching Center (MSC) or Serving GPRS Support Node (SGSN). Be noticed by. This is because the authentication procedure fails. A further advantage is that the amount of information that can be protected by using unique test values is no longer limited in advance. If a new message element is added to the signaling message, this can be automatically taken into account by the calculation of the check value. New message elements can be added in later protocol versions as well. Furthermore, the authentication function f2K (RAND, Ki) is not significantly weakened. This is because only the bit string is embedded in the RAND parameter in the signaling message, and the other message elements to be protected are not embedded in the RAND parameter. This leaves the variability in the RAND parameters relatively high. Optionally, all subsequent signaling messages can also be protected by the check value. This provides relatively efficient protection against attackers in the unlikely event of a "fake base station". Ki) is not much weakened. This is because only the bit string is embedded in the RAND parameter in the signaling message, and the other message elements to be protected are not embedded in the RAND parameter. This leaves the variability in the RAND parameters relatively high. Optionally, all subsequent signaling messages can also be protected by the check value. This provides relatively efficient protection against attackers in the unlikely event of a "fake base station". Ki) is not much weakened. This is because only the bit string is embedded in the RAND parameter in the signaling message, and the other message elements to be protected are not embedded in the RAND parameter. This leaves the variability in the RAND parameters relatively high. Optionally, all subsequent signaling messages can also be protected by the check value. This provides relatively efficient protection against attackers in the unlikely event of a "fake base station".

The present invention will be described in detail with reference to the examples illustrated in the drawings. Here, FIG. 1 shows a network architecture with a "fake base station", FIG. 2 shows a simplified network architecture for practicing the methods of the invention, and Figure 3 receives a signaling message from a network unit. A schematic diagram of a communication terminal for the purpose is shown, and FIG. 4 shows a simplified schematic diagram of the network unit of the present invention.

Figure 1 shows the network architecture of a mobile radio network with a "fake base station" f-BSS, which is between the communication terminal or mobile radio device MS and the base station BSS. Occupies a position. The fake base station in this case behaves like a base station BSS to the mobile radio MS and behaves like a mobile radio MS to the true base station BSS. By tampering with the messages exchanged between the mobile radio device MS and the network unit MSC / SGSN, this fake base station f-BSS encrypts mobile radio conversations, for example, in a cryptographically relatively weak manner. It can be operated so that it can be eavesdropped relatively easily. The network unit MSC / SGSN is here the mobile service switching center MSC or the serving GPRS support node SGSN.

FIG. 2 shows a simplified schematic diagram for carrying out the method of the present invention. As already described, the "signed response" from the subscriber's private key Ki and random number RAND to the function f2K (RAND, Ki) in the communication network, here a special network unit in the mobile wireless network, the authentication center AuC. The temporary private key IK is calculated by (SRES) and yet another function f4K (RAND, Ki). RAND, SRES and IK are sent to the network unit MSC / SGSN (Mobile Service Switching Center MSC or Serving GPRS Support Node SGSN) depending on the mobile wireless network used in this case (GSM network, UMTS network, etc.) and this network. The mobile wireless device MS is just connected to the unit MSC / SGSN. The mobile service switching center MSC or serving GPRS support node SGSN eventually receives the signaling message "Authentication". The random number parameter RAND, the inspection value created by the network unit MSC / SGSN, and yet another parameter are transmitted to the mobile wireless device MS by Request). The RAND parameter contains a special bit string, which is known to both mobile radio equipment and the network unit MSC / SGSN and is protected against changes by, for example, "fake base stations". This protection calculates different values for the values (checked values, SRES, etc.) calculated by the network unit MSC / SGSN when the communication terminal MS changes the bit string by an attacker who has a "fake base station". , For example, as long as it can be detected by the network unit MSC / SGSN in the authentication response. The authentication center AuC selects and uses one of at least two bit strings known to both the network unit MSC / SGSN and the communication terminal MS for shipping between the network unit MSC / SGSN and the communication terminal MS. You can also do it. The RAND parameter with a special bit string is only when the communication terminal or mobile radio device MS is known to support protocol extension exactly in it, i.e. the network unit MSC / SGSN. Generally generated by the authentication center AuC only if the check value can be calculated and sent by the authentication request message. S3-030463 (3GPP TSG SA WG3 Security, Cipher key separation for A / Gb security enhancements, 15-18 JULY 2003, San Francisco, USA, Agenda point 7.5, Source: As suggested in Vodafone), this means that in the case of roaming, i.e. if the subscriber is not in his home communication network, the authentication center AuC must send the parameters RAND, SRES and IK. By comparing the identity of the mobile wireless network (or mobile service switching center MSC or serving GPRS support node SGSN) with a list, which communication network supports protocol extension is listed in this list. It will be resolved. The check value "hash" f (message, IK) is determined by the network unit MSC / SGSN from the content of the signaling message and the key IK.

In the mobile wireless device MS, the "signed response" (SRES) and the temporary private key IK are calculated by the functions f2K (RAND, Ki) and f4K (RAND, Ki) from the RAND parameter and the private key Ki. Signaling message "Authentication Request" A special bit string in the RAND parameter of Request) tells this mobile radio device MS that this signaling message must contain the check value "hash" f (message, IK). Random. Of course, a special bit string may be included in another parameter if the mobile radio equipment MS or network unit MSC / SGSN is guaranteed to be able to identify changes in this parameter by a fake base station. .. Next, the communication terminal MS or mobile wireless device MS calculates a unique inspection value "hash" f (message, IK), and this inspection value "hash" f (message, IK) is the content of the message and a temporary secret. Calculated from the key IK, this calculated test value is compared to the test value contained in the signaling message. If the RAND parameter contains a special bit string but the inspection value is missing, or if the transmitted inspection value does not match the inspection value calculated by the mobile radio device MS itself (the two inspection values are the same). G), it is presumed that the message was tampered with on the way from the network unit MSC / SGSN to the mobile wireless device MS. Multiple communication networks may be involved in sending a signaling message from the network unit MSC / SGSN to the communication terminal MS, for example, in the case of inter-communication network handover.

After this, the mobile radio device MS sends a signaling message "authentication response" with the SRES parameter calculated by the mobile radio device MS to the network unit MSC / SGSN for the end of authentication.

FIG. 3 shows a schematic diagram of a communication terminal MS for receiving a signaling message from the network unit MSC / SGSN. The communication terminal MS has a receiving unit E and a transmitting unit S for mobile communication, particularly for mobile communication by a mobile wireless network. Processing unit V can identify that the signaling message must contain the check value "hash" f (message, IK) based on the signaling message, especially the special bit string in the RAND parameter. it can. Next, the communication terminal MS or mobile wireless device MS calculates a unique inspection value "hash" f (message, IK), and this inspection value "hash" f (message, IK) is the content of the message and a temporary secret. Calculated from the key IK, this calculated test value is compared to the test value contained in the signaling message. The communication terminal MS defines this signaling message as unchanged only if the comparison of these two test values gives a positive result. In this case, what is considered a positive result is that these two test values match. In a modified embodiment of the present invention, a special bit string also includes all subsequent messages transmitted from the communication network or network unit MSC / SGSN to the communication terminal MS within the communication network in which the communication terminal is located. It is signaled that the test value must be included.

FIG. 4 shows a simplified schematic diagram of the network unit MSC / SGSN of the present invention. This network unit MSC / SGSN has a receiving unit EE and a transmitting unit SE for mobile communication, especially for mobile communication by a mobile wireless network. The processing unit VE receives the parameters from the authentication center AuC according to Fig. 2 and determines the inspection value "hash" f (message, IK). This inspection value "hash" f (message, IK) is transmitted by this processing unit VE with yet another parameter to the connected communication terminal MS in a signaling message.

Advantageously, the bit string and the check value are transmitted from the network unit MSC / SGSN to the communication terminal MS in the same signaling message.

Advantageously, the bit string and the check value are transmitted from the network unit MSC / SGSN to the communication terminal MS in at least two different signaling messages.

Advantageously, the network unit MSC / SGSN sends a signaling message to the communication terminal MS over at least one communication network.

<figref num="1">Shows a network architecture with a "fake base station".</figref><figref num="2">A simplified network architecture for practicing the methods of the present invention is shown.</figref><figref num="3">The schematic diagram of the communication terminal for receiving a signaling message from a network unit is shown.</figref><figref num="4">A simplified schematic diagram of the network unit of the present invention is shown.</figref>

Code description

MS Communication Terminal, Mobile Radio Equipment BSS Base Station f-BSS Fake Base Station MSC Exchange Unit = Mobile Service Switching Center SGSN Serving GPRS Support Node MSC / SGSN Network Unit AuC Authentication Center Ki Private Key RAND Random Number SRES Signed Response IK Temporary Private key E Receiving unit V Processing unit S Sending unit EE Receiving unit VE Processing unit SE Sending unit