Authentication mechanism for 5G technologies
Embodiments of this disclosure provide techniques for securely communicating an IMSI over the air from a UE to an SeAN, as well as for securely validating an unencrypted IMSI that the SeAN receives from the home network, during authentication protocols. In particular, the UE may either encrypt the IMSI assigned to the UE using an IMSI encryption key (K IMSIenc ) or compute a hash of the IMSI assigned to the UE using an IMSI integrity key (K IMSIint ), and then send the encrypted IMSI or the hash of the IMSI to the serving network. The encrypted IMSI or hash of the encrypted IMSI may then be used by the SeAN to validate an unencrypted IMSI that was previously received from an HSS in the home network of the UE.
1. A method for secure authentication, the method comprising:
sending, by a user equipment (UE), an encrypted International Mobile Subscriber Identity (IMSI) or a hash of the IMSI to a base station in a serving network, the encrypted IMSI or the hash of the IMSI having been generated using an IMSI encryption key (K IMSIenc ) or an IMSI integrity key (K IMSIint ) associated with a serving home network, wherein the K IMSIenc or the K IMSIint is derived by the UE based at least in part on a COUNTER received from the base station in the serving network.
2. The method of claim 1 , further comprising:
computing, by the UE, a response parameter (RES) based on a pre-provisioned key (K_key) associated with the UE and a random number (RAND); and
sending the RES to the base station in the serving network.
3. The method of claim 1 , wherein the K IMSIenc or the K IMSIint is a NAS encryption or integrity key.
4. The method of claim 1 , wherein the K IMSIenc or the K IMSIint is further derived based on a shared key.
5. The method of claim 1 , wherein the K IMSIenc or the K IMSIint is an IAS encryption or integrity key (K IMSIenc ).
6. The method of claim 1 , wherein the K IMSIenc or the K IMSIint is further derived based on a shared key computed by the UE using at least a public key of the home network and the COUNTER received from the base station in the serving network.
7. The method of claim 1 , wherein the K IMSIenc or the K IMSIint is a serving network public key (SPuK).
8. The method of claim 1 , wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via an initial authentication-request (IAR) message.
9. The method of claim 1 , wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via a user authentication request message.
10. A user equipment (UE) comprising:
a processor; and
a non-transitory computer readable storage medium storing programming for execution by the processor, the programming including instructions to:
send an encrypted International Mobile Subscriber Identity (IMSI) or a hash of the IMSI to a base station in a serving network, the encrypted IMSI or the hash of the IMSI having been generated using an IMSI encryption key (K IMSIenc ) or an IMSI integrity key (K IMSIint ) associated with a home network, wherein the K IMSIenc or the K IMSIint is derived by the UE based at least in part on a COUNTER received from the base station in the serving network.
11. The UE of claim 10 , wherein the programming further includes instructions to:
compute a response parameter (RES) based on a pre-provisioned key (K_key) associated with the UE and a random number (RAND); and
send the RES to the base station in the serving network.
12. The UE of claim 10 , wherein the K IMSIenc or the K IMSIint is a NAS encryption or integrity key.
13. The UE of claim 10 , wherein the K IMSIenc or the K IMSIint is further derived based on a shared key.
14. The UE of claim 10 , wherein the K IMSIenc or the K IMSIint is an IAS encryption or integrity key (K IASenc ).
15. The UE of claim 10 , wherein the K IMSIenc or the K IMSIint is further derived based on a shared key computed by the UE using at least a public key of the home network and the COUNTER received from the base station in the serving network.
16. The UE of claim 10 , wherein the K IMSIenc or the K IMSIint is a serving network public key (SPuK).
17. The UE of claim 10 , wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via an initial authentication-request (IAR) message.
18. The UE of claim 10 , wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via a user authentication request message.
19. A computer program product comprising a non-transitory computer readable storage medium storing programming, the programming including instructions to:
send an encrypted International Mobile Subscriber Identity (IMSI) or a hash of the IMSI from a user equipment (UE) to a base station in a serving network, the encrypted IMSI or the hash of the IMSI having been generated using an IMSI encryption key (K IMSIenc ) or an IMSI integrity key (K IMSIint ) associated with a home network, wherein the K IMSIenc or the K IMSIint is derived by the UE based at least in part on a COUNTER received from the base station in the serving network.
20. The computer program product of claim 19 , wherein the programming further includes instructions to:
compute a response parameter (RES) based on a pre-provisioned key (K_key) associated with the UE and a random number (RAND); and
send the RES from the UE to the base station in the serving network.
21. The computer program product of claim 19 , wherein the K IMSIenc or the K IMSIint is a NAS encryption or integrity key.
22. The computer program product of claim 19 , wherein the K IMSIenc or the K IMSIint is further derived based on a shared key.
23. The computer program product of claim 19 , wherein the K IMSIenc or the K IMSIint is an IAS encryption or integrity key (K IASenc ).
24. The computer program product of claim 19 , wherein the K IMSIenc or the K IMSIint is further derived based on a shared key computed by the UE using at least a public key of the home network and the COUNTER received from the base station in the serving network.
25. The computer program product of claim 19 , wherein the K IMSIenc or the K IMSIint is a serving network public key (SPuK).
26. The computer program product of claim 19 , wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via an initial authentication request (IAR) message.
27. The computer program product of claim 19 , wherein the encrypted IMSI or the Hash of the IMSI is sent to the base station in the serving network via a user authentication request message.