Management of user equipment security capabilities in communication system
Techniques for security management in communication systems are provided. For example, a method includes receiving, from user equipment, a request indicating one or more security capabilities of the user equipment. The method also includes determining whether the indicated one or more security capabilities meet one or more designated criteria of a communication network, and rejecting the request by the user equipment responsive to determining that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network. For example, the request is rejected when it is determined that the user equipment does not support any encryption and/or integrity algorithms, or fails to support mandatory encryption and/or integrity algorithms. This serves to prevent malicious user equipment from gaining access to the communication network.
1. An apparatus comprising:
at least one processor;
at least one memory including computer program code;
the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to:
receive, from user equipment, a request indicating one or more security capabilities of the user equipment;
determine whether the indicated one or more security capabilities meet one or more designated criteria of a communication network;
reject the request by the user equipment responsive to determining that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network; and
send a rejection notification to the user equipment, the rejection notification comprising a failure cause indication based at least in part on the determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network;
wherein the failure cause indication comprises a cause code indicating to the user equipment that an initial access request or a mobility request has failed due to the one or more security capabilities of the user equipment not being acceptable to the communication network.
2. The apparatus of claim 1 , wherein the rejection notification further comprises a back-off timer value.
3. The apparatus of claim 1 , wherein the initial access request comprises an initial registration request or an initial attach request and the mobility request comprises a mobility registration request or a mobility tracking area update request.
4. The apparatus of claim 1 , wherein the indicated one or more security capabilities comprise an indication of one or more encryption algorithms supported by the user equipment, and further wherein the determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network comprises determining that the user equipment (i) does not support any encryption algorithm or (ii) fails to support a mandatory encryption algorithm.
5. The apparatus of claim 1 , wherein the indicated one or more security capabilities comprise an indication of one or more integrity algorithms supported by the user equipment, and further wherein the determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network comprises determining that the user equipment (i) does not support any integrity algorithm or (ii) fails to support a mandatory integrity algorithm.
6. The apparatus of claim 1 , wherein the communication network comprises a 5G network and the apparatus comprises an access and mobility management function (AMF) of the 5G network.
7. The apparatus of claim 1 , wherein the communication network comprises a 4G network and the apparatus comprises mobility management entity (MME) of the 4G network.
8. The apparatus of claim 1 , wherein the failure cause indication comprises a 5G System (5GS) mobility management (5GMM) cause value.
9. The apparatus of claim 1 , wherein the failure cause indication comprises an Evolved Packet System (EPS) mobility management (EMM) cause value.
10. The apparatus of claim 1 , wherein the failure cause indication signals the user equipment to (i) abort a registration procedure with the communication network and (ii) reset a registration attempt counter.
11. A method comprising:
receiving, from user equipment, a request indicating one or more security capabilities of the user equipment;
determining whether the indicated one or more security capabilities meet one or more designated criteria of a communication network;
rejecting the request by the user equipment responsive to determining that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network; and
sending a rejection notification to the user equipment, the rejection notification comprising a failure cause indication based at least in part on the determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network;
wherein the failure cause indication comprises a cause code indicating to the user equipment that an initial access request or a mobility request has failed due to the one or more security capabilities of the user equipment not being acceptable to the communication network.
12. An article of manufacture comprising a non-transitory computer-readable storage medium having embodied therein executable program code that when executed by a processor causes the processor to perform the steps of claim 11 .
13. An apparatus comprising:
at least one processor;
at least one memory including computer program code;
the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to:
send, to a security management node in a communication network, a request indicating one or more security capabilities of the apparatus; and
receive, from the security management node, a rejection notification responsive to the indicated one or more security capabilities not meeting one or more designated criteria of the communication network;
wherein the rejection notification comprises a failure cause indication based at least in part on a determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network; and
wherein the failure cause indication comprises a cause code indicating to the apparatus that an initial access request or a mobility request has failed due to the one or more security capabilities of the apparatus not being acceptable to the communication network.
14. The apparatus of claim 13 , wherein the initial access request comprises an initial registration request or an initial attach request and the mobility request comprises a mobility registration request or a mobility tracking area update request.
15. The apparatus of claim 13 , the indicated one or more security capabilities comprise an indication of one or more encryption algorithms supported by the apparatus, and further wherein the rejection notification is received responsive to a determination that the apparatus (i) does not support any encryption algorithm or (ii) fails to support a mandatory encryption algorithm.
16. The apparatus of claim 13 , the indicated one or more security capabilities comprise an indication of one or more integrity algorithms supported by the apparatus, and further wherein the rejection notification is received responsive to a determination that the apparatus (i) does not support any integrity algorithm or (ii) fails to support a mandatory integrity algorithm.
17. The apparatus of claim 13 , wherein in response to receiving the rejection notification the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus to:
abort an attempt to access the communication network; and
reset an access attempt counter.
18. The apparatus of claim 13 , wherein in response to receiving the rejection notification the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus to refrain from attempting to access the communication network based at least in part on a timer value included in the rejection notification.
19. A method comprising:
sending, to a security management node in a communication network, a request indicating one or more security capabilities of an apparatus; and
receiving, from the security management node, a rejection notification responsive to the indicated one or more security capabilities not meeting one or more designated criteria of the communication network;
wherein the rejection notification comprises a failure cause indication based at least in part on a determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network; and
wherein the failure cause indication comprises a cause code indicating to the apparatus that an initial access request or a mobility request has failed due to the one or more security capabilities of the apparatus not being acceptable to the communication network.
20. An article of manufacture comprising a non-transitory computer-readable storage medium having embodied therein executable program code that when executed by a processor causes the processor to perform the steps of claim 19 .