5G NAS deciphering enhance rate of convergence mechanism

1. A non-transitory computer readable medium comprising instructions for providing a mobile user monitoring solution that, when executed by a processor, cause the processor to:

capture a second message transmitted over an N1 interface in a 5G network;

determine that a first user identifier (ID) of a first type of user ID in the second message does not correspond to a mapping in a stored table, the stored table comprising mappings between user IDs of the first type and (i) user IDs of a second type, or (ii) cipher keys;

capture a transaction transmitted over an N12 interface in the 5G network;

responsive to the determination, extract, from the transaction, (i) one of an expected response (XRES) or an authentication token (AUTN), (ii) a second user ID, and (iii) a cipher key;

capture a first message transmitted over an N1 interface in the 5G network; and

determine that the first message is associated with the user ID and the cipher key extracted from the transaction.

2. The medium of claim 1 , comprising instructions that, when executed by a processor, further cause the processor to store the one of the XRES or the AUTN, the user ID, and the cipher key in a storage medium.

3. The medium of claim 2 , comprising instructions that, when executed by a processor, further cause the processor to:

extract, from the first message, a second one of the XRES or the AUTN that matches the one of the XRES or the AUTN; and

retrieve, from the storage medium, the cipher key and the user ID using the second one of the XRES or the AUTN.

4. The medium of claim 1 , comprising instructions that, when executed by a processor, further cause the processor to:

extract, from the second message transmitted over the N1 interface, a first time that the second message is transmitted; and

extract, from a third message transmitted over the N1 interface, a second time that the third message is transmitted, wherein the transaction is transmitted at a time between the first time and the second time.

5. The medium of claim 4 , comprising instructions that, when executed by a processor, further cause the processor to:

capture a fourth message;

determine that the fourth message is ciphered; and

decipher the fourth message using the cipher key.

6. The medium of claim 5 , comprising instructions that, when executed by a processor, further cause the processor to:

extract a plurality of cipher keys from a plurality of transaction that are transmitted at the time between the first time and the second time; and

cycle through each of the plurality of cipher keys, attempting to decipher the fourth message with a current one of the plurality of cipher keys, until successfully deciphering the fourth message using the current one of the plurality of cipher keys.

7. The medium of claim 5 , wherein the transaction is an authentication request and an authentication response, the first message is an authentication message, the second message is a registration message, the third message is a security mode command message, and the fourth message is another message transmitted subsequent to the security mode command message being transmitted.

8. The medium of claim 1 , comprising instructions that, when executed by a processor, further cause the processor to:

capture a subsequent message transmitted over the N1 interface;

decipher the subsequent message using the cipher key;

extract session details from the subsequent message; and

store the session details in a storage medium.

9. An apparatus comprising a processor and a memory, wherein the memory includes programmed instructions that, when executed by the processor, cause the apparatus to

capture a second message transmitted over an N1 interface in a 5G network;

determine that a first user identifier (ID) of a first type of user ID in the second message does not correspond to a mapping in a stored table, the stored table comprising mappings between user IDs of the first type and (i) user IDs of a second type, or (ii) cipher keys;

capture a transaction transmitted over an N12 interface in the 5G network;

responsive to the determination, extract, from the transaction, (i) one of an expected response (XRES) or an authentication token (AUTN), (ii) a second user ID, and (iii) a cipher key;

capture a first message transmitted over an N1 interface in a 5G network; and

determine that the first message is associated with the user ID and the cipher key extracted from the transaction.

10. The apparatus of claim 9 , wherein the memory includes programmed instructions that, when executed by a processor, further cause the apparatus to store the one of the XRES or the AUTN, the user ID, and the cipher key in a storage medium.

11. The apparatus of claim 10 , wherein the memory includes programmed instructions that, when executed by a processor, further cause the apparatus to:

extract, from the first message, a second one of the XRES or the AUTN that matches the one of the XRES or the AUTN; and

retrieve, from the storage medium, the cipher key and the user ID using the second one of the XRES or the AUTN.

12. The apparatus of claim 9 , wherein the memory includes programmed instructions that, when executed by a processor, further cause the apparatus to:

extract, from the second message transmitted over the N1 interface, a first time that the second message is transmitted; and

extract, from a third message transmitted over the N1 interface, a second time that the third message is transmitted, wherein the transaction is transmitted at a time between the first time and the second time.

13. The apparatus of claim 12 , wherein the memory includes programmed instructions that, when executed by a processor, further cause the apparatus to:

capture a fourth message;

determine that the fourth message is ciphered; and

decipher the fourth message using the cipher key.

14. The apparatus of claim 13 , wherein the memory includes programmed instructions that, when executed by a processor, further cause the apparatus to:

extract a plurality of cipher keys from a plurality of transaction that are transmitted at the time between the first time and the second time; and

cycle through each of the plurality of cipher keys, attempting to decipher the fourth message with a current one of the plurality of cipher keys, until successfully deciphering the fourth message using the current one of the plurality of cipher keys.

15. The apparatus of claim 13 , wherein the transaction is an authentication request and an authentication response, the first message is an authentication message, the second message is a registration message, the third message is a security mode command message, and the fourth message is another message transmitted subsequent to the security mode command message being transmitted.

16. The apparatus of claim 9 , wherein the memory includes programmed instructions that, when executed by a processor, further cause the apparatus to:

capture a subsequent message transmitted over the N1 interface;

decipher the subsequent message using the cipher key;

extract session details from the subsequent message; and

store the session details in a storage medium.

17. A method comprising:

capture a second message transmitted over an N1 interface in a 5G network;

determining that a first user identifier (ID) of a first type of user ID in the second message does not correspond to a mapping in a stored table, the stored table comprising mappings between user IDs of the first type and (i) user IDs of a second type, or (ii) cipher keys;

capturing a transaction transmitted over an N12 interface in the 5G network;

responsive to the determination, extracting, from the transaction, (i) one of an expected response (XRES) or an authentication token (AUTN), (ii) a second user ID, and (iii) a cipher key;

capturing a first message transmitted over an N1 interface in a 5G network; and

determining that the first message is associated with the user ID and the cipher key extracted from the transaction.

18. The method of claim 17 , further comprising storing the one of the XRES or the AUTN, the user ID, and the cipher key in a storage medium.

19. The method of claim 18 , further comprising:

extracting, from the first message, a second one of the XRES or the AUTN that matches the one of the XRES or the AUTN; and

retrieving, from the storage medium, the cipher key and the user ID using the second one of the XRES or the AUTN.

20. The method of claim 17 , further comprising:

extracting, from the second message transmitted over the N1 interface, a first time that the second message is transmitted; and

extracting, from a third message transmitted over the N1 interface, a second time that the third message is transmitted, wherein the transaction is transmitted at a time between the first time and the second time.