Systems and methods for protecting cellular network messages
A client-side electronic device includes a receiver, a processor, and a memory. The receiver communicates with a message server over a communication medium of a communication network. The memory stores computer-executable instructions, which, when executed by the processor, cause the device to receive, from the message server, a broadcast message, a timestamp associated with the broadcast message, and a first digital signature of the broadcast message and a second digital signature of the timestamp. The executed instruction further cause the device to verify an integrity of the broadcast message based the first or second digital signatures, determine a freshness of the broadcast message based on the received timestamp, calculate a trust state of the broadcast message based on the integrity verification and the freshness determination, and store the broadcast message in the memory along with the calculated trust state.
1. A system for broadcasting messages over a network, comprising:
a signing server;
a message server for broadcasting messages over a network, the message server in communication with the signing server and a client-side device,
wherein the signing server programmed to:
receive a digital signing request from the message server, wherein the digital signing request includes a Master Information Block (MIB) and a System Information Block (SIB);
compute a digital signature over the MIB, the SIB, and a timestamp; and
transmit the digital signature and timestamp to the message server in a signing response to the digital signing request, and
wherein the message server is programmed to:
transmit the digital signing request to the signing server; and
receive, from the signing server, the signing response to the digital signing request.
2. The system of claim 1 , wherein the signing response includes one or more digital signatures.
3. The system of claim 1 , wherein the message server is further programmed to transmit the MIB and SIB to the client-side device.
4. The system of claim 1 , wherein the message server is further programmed to transmit a message comprising the timestamp and the digital signature to the client-side device.
5. The system of claim 4 , wherein the client-side device is programmed to verify the digital signature and the timestamp.
6. The system of claim 1 , wherein the message server is a gNB.
7. The system of claim 1 , wherein an access and mobility management function (AMF) interfaces between the message server and the signing server.
8. The system of claim 7 , wherein the AMF interfaces between the signing server and a plurality of message servers.
9. The system of claim 1 , wherein a key used to compute the digital signature is short-lived and includes an expiration time.
10. The system of claim 9 , wherein the key has a short key length.
11. The system of claim 1 , wherein the signing server is further programmed to:
generate a key chain from a seed including at least 64 iterations, wherein a last iteration of the key chain is an anchor key; and
compute the digital signature over the Master Information Block (MIB), the System Information Block (SIB), the timestamp, and the anchor key.
12. The system of claim 11 , wherein the signing response includes the timestamp, the seed, and the digital signature.
13. The system of claim 11 , wherein message server is further programmed to:
generate the key chain from the seed;
generate a plurality of message authentication codes (MAC) for a plurality of values of dynamic content;
iterate through the plurality of values of dynamic content by transmitting the MIB, the SIB, and a MAC associated with the current value of dynamic content to the client-side device; and
transmit a message comprising the timestamp, the anchor key, the digital signature, and a current key of the key chain to the client-side device.
14. A method for broadcasting messages over a network, the method implemented by a signing server in communication with a message server for broadcasting messages over a network, the message server in communication with a client-side device, wherein the method comprises:
transmitting, by the message server to the signing server, a digital signing request to the signing server, wherein the digital signing request includes a Master Information Block (MIB) and a System Information Block (SIB);
receiving, by the signing server from the message server, a digital signing request;
computing, by the signing server, a digital signature over the MIB, the SIB, and a timestamp;
transmitting, by the signing to the message server, the digital signature and timestamp; and
receiving, by the message server from the signing server, a signing response to the digital signing request.
15. The method of claim 14 further comprising:
transmitting, by the message server, a message comprising the timestamp and the digital signature to the client-side device, and
verifying, by the client-side device, the digital signature and the timestamp.
16. The method of claim 14 , wherein the message server is a gNB.
17. The method of claim 14 , wherein an access and mobility management function (AMF) interfaces between the message server and the signing server.
18. The method of claim 14 , wherein a key used to compute the digital signature is short-lived and includes an expiration time, and wherein the key has a short key length.
19. The method of claim 14 further comprising:
generating, by the signing server, a key chain from a seed including at least 64 iterations, wherein a last iteration of the key chain is an anchor key; and
computing, by the signing server, the digital signature over the Master Information Block (MIB), the System Information Block (SIB), the timestamp, and the anchor key.