FAKE GNB/ENB DETECTION USING IDENTITY-BASED AUTHENTICATION AND ENCRYPTION

1 . An apparatus of a user equipment (UE) to perform an identity-based authentication and encryption process, the apparatus comprising:

one or more baseband processors to:

generate a Radio Resource Control (RRC) Verify-Request message to an Evolved Node B (eNB) or Next Generation Node B (gNB) in response to receiving an RRCConnectionRelease message in a Cell Reselection process, the UE being in RRC idle mode,

process an RRC Verify-Response message received from the eNB or gNB in response to the RRC Verify-Request message, and

verify authenticity of the eNB or gNB by verifying the RRC Verify-Response message; and

a memory to store the messages for the identity-based authentication and encryption process.

2 . The apparatus of claim 1 , wherein the RRCConnectionRelease message redirects the UE to a 2G network.

3 . The apparatus of claim 1 , wherein the RRC Verify-Request message includes:

a UE identity;

a UE nonce;

a Public Verification Token (PVT); and

a signature computed over the UE identity and UE nonce.

4 . The apparatus of claim 3 , wherein the signature is an Elliptic Curve-Based Certificateless Signatures for Identity-Based Encryption (ECCSI) signature.

5 . The apparatus of claim 3 , wherein verifying the RRC Verify-Response message includes obtaining the following from the RRC Verify-Response message:

an eNB/gNB nonce;

the UE nonce;

a PVT;

a payload including a Secret Shared Value (SSV); and

a signature computed over the eNB/gNB nonce, UE nonce, and payload.

6 . The apparatus of claim 5 , wherein the SSV is encrypted using Sakai-Kasahara Key Encryption (SAKKE).

7 . The apparatus of claim 5 , wherein verifying the RRC Verify-Response message further includes obtaining an eNB/gNB identity from the RRC Verify-Response message.

8 . The apparatus of claim 5 , wherein the one or more baseband processors are further to:

extract the SSV from the payload upon verifying the RRC Verify-Response message; and

derive an integrity key from the SSV.

9 . The apparatus of claim 8 , wherein the one or more baseband processors are further to:

utilize the derived integrity key to protect RRC messages until the UE authenticates with the eNB/gNB.

10 . The apparatus of claim 9 , wherein utilizing the derived integrity key includes generating a Short Message Authentication Code for Integrity (ShortMAC-I) for securing RRC messages.

11 . A computer-readable storage medium having stored thereon data representing sequences of instructions that, when executed by a processor, cause the processor to perform operations comprising:

camping a user equipment (UE) on a first cell in a Cell Selection process, the UE being in Radio Resource Control (RRC) idle mode;

performing a Cell Reselection process by the UE in the RRC idle mode;

receiving an RRCConnectionRelease message;

transmitting an RRC Verify-Request message in response to the RRCConnectionRelease message;

receiving an RRC Verify-Response message in response to the RRC Verify-Request message; and

verifying authenticity of an Evolved Node B (eNB) or Next Generation Node B (gNB) by verifying the RRC Verify-Response message.

12 . The medium of claim 11 , wherein the RRCConnectionRelease message redirects the UE to a 2G network.

13 . The medium of claim 11 , wherein the RRC Verify-Request message includes:

a UE identity;

a UE nonce;

a Public Verification Token (PVT); and

a signature computed over the UE identity and UE nonce.

14 . The medium of claim 13 , wherein verifying the RRC Verify-Response message includes obtaining the following from the RRC Verify-Response message:

an eNB/gNB nonce;

the UE nonce;

a PVT;

a payload including a Secret Shared Value (SSV); and

a signature computed over the eNB/gNB nonce, UE nonce, and payload.

15 . The medium of claim 14 , wherein verifying the RRC Verify-Response message further includes obtaining an eNB/gNB identity from the RRC Verify-Response message.

16 . The medium of claim 14 , further comprising instructions that, when executed by the processor, cause the processor to perform operations comprising:

upon verifying the RRC Verify-Response message, extracting the SSV from the payload; and

deriving an integrity key from the SSV.

17 . The medium of claim 16 , further comprising instructions that, when executed by the processor, cause the processor to perform operations comprising:

utilizing the derived integrity key to protect RRC messages until the UE authenticates with the eNB/gNB.

18 . A system of a user equipment (UE) to perform an identity-based authentication and encryption process, the system comprising:

one or more baseband processors to:

generate a Radio Resource Control (RRC) Verify-Request message to an Evolved Node B (eNB) or Next Generation Node B (gNB) in response to receiving an RRCConnectionRelease message in a Cell Reselection process, the UE being in RRC idle mode,

process an RRC Verify-Response message received from the eNB or gNB in response to the RRC Verify-Request message, and

verify authenticity of the eNB or gNB by verifying the RRC Verify-Response message;

a memory to store the messages for the identity-based authentication and encryption process;

a transmitter or receiver to transmit or receive signals; and

an antenna for wireless signal reception and transmission.

19 . The system of claim 18 , wherein the RRCConnectionRelease message redirects the UE to a 2G network.

20 . The system of claim 18 , wherein the RRC Verify-Request message includes:

a UE identity;

a UE nonce;

a Public Verification Token (PVT); and

a signature computed over the UE identity and UE nonce.

21 . The system of claim 20 , wherein verifying the RRC Verify-Response message includes obtaining the following from the RRC Verify Response message:

an eNB/gNB nonce;

the UE nonce;

a PVT;

a payload including a Secret Shared Value (SSV); and

a signature computed over the eNB/gNB nonce, UE nonce, and payload.

22 . The system of claim 21 , wherein verifying the RRC Verify-Response message further includes obtaining an eNB/gNB identity from the RRC Verify-Response message.

23 . The system of claim 21 , wherein the one or more baseband processors are further to:

extract the SSV from the payload upon verifying the RRC Verify-Response message; and

derive an integrity key from the SSV.

24 . The system of claim 23 , wherein the one or more baseband processors are further to:

utilize the derived integrity key to protect RRC messages until the UE authenticates with the eNB/gNB.