Securing network steering information
According to certain embodiments, a method by a user equipment (UE) for securing network steering information includes transmitting a registration request to a Visited Public Land Mobile Network (VPLMN). Upon successful authentication b an authentication server function (AUSF), a home network root key is generated. A protected message comprising Network Steering information is received from a first network node. The protected message is protected using a configuration key (Kconf) and a first Message Authentication Code (MAC-1). The configuration key (Kconf) is determined from the home network root key, and the UE verifies the MAC-1. Based on the Kconf and the MAC-1, it is verified that the VPLMN did not alter Network Steering Information. An acknowledgement message, which is protected with a second Message Authentication Code (MAC-2), is transmitted to a Home Public Land Mobile Network (HPLMN).
1. A method performed by a user equipment (UE) for securing network steering information, comprises:
transmitting a registration request to a Visited Public Land Mobile Network (VPLMN);
upon successful primary authentication, generating a home network root key;
receiving, from a first network node, a protected message comprising Network Steering Information, which is protected based on a configuration key (Kconf) derived from the home network root key and a first Message Authentication Code (MAC-1);
based on the home network root key and a verified MAC-1, determining that the VPLMN did not alter Network Steering Information; and
transmitting an acknowledgement message to a Home Public Land Mobile Network (HPLMN), the acknowledgement message is transmitted with a second Message Authentication Code (MAC-2).
2. The method of f claim 1 , wherein the home network root key is an authentication server function key (Kausf) and the first network node comprises an authentication server function (AUSF).
3. The method of claim 2 , wherein the Network Steering Information is generated by a second network node and protected by the AUSF.
4. The method of claim 1 , wherein the Network Steering Information is generated by User Data Management (UDM).
5. The method of claim 1 , wherein the protected message is piggybacked with a Registration Accept message.
6. A user equipment (UE) comprising:
memory configured to store instructions; and
processing circuitry configured to execute the instructions to cause the UE to:
transmit a registration request to a Visited Public Land Mobile Network (VPLMN);
upon successful primary authentication, generate a home network root key;
receive, from a first network node, a protected message comprising Network Steering Information, which is protected based on a configuration key (Kconf) derived from the home network root key and a first Message Authentication Code (MAC-1);
based on the home network root key and a verified MAC-1, determine that the VPLMN did not alter Network Steering Information; and
transmit an acknowledgement message to a Home Public Land Mobile Network (HPLMN), the acknowledgement message is transmitted with a second Message Authentication Code (MAC-2).
7. The UE of claim 6 , wherein the home network root key is an authentication server function key (Kausf) and the first network node comprises an authentication server function (AUSF).
8. The UE of claim 7 , wherein the Network Steering Information is generated by a second network node and protected by the AUSF.
9. The UE of claim 8 , wherein the Network Steering Information is generated by User Data Management (UDM).
10. The UE of claim 6 , wherein the protected message is piggybacked with a Registration Accept message.
11. A method for securing network steering information by a first network node operating as an authentication server function (AUSF), the method comprises:
generating a home network root key;
receiving Network Steering Information from a second network node;
generating a protected message comprising the Network Steering Information, the protected message being protected based on a configuration key (Kconf) derived from the home network root key and a first Message Authentication Code (MAC-1);
transmitting the protected message comprising the Network Steering Information to a user equipment (UE);
receiving, from the UE, an acknowledgement message protected with a second Message Authentication Code (MAC-2), the acknowledgment indicating that the VPLMN did not alter the Network Steering Information; and
forwarding the acknowledgment message indicating that the VPLMN did not alter the Network Steering Information to the second network node.
12. The method of claim 11 , wherein the home network root key is an AUSF key (Kausf) and the protected message is piggybacked with a Registration Accept message.
13. The method of claim 11 , wherein the second network node is operating as at least one of a Point Coordination Function (PCF) or a User data Management (UDM).
14. A first network node operating as an authentication server function (AUSF) for securing network steering information, the network node comprising:
memory configured to store instructions; and
processing circuitry configured to execute the instructions to cause the network node to:
generate a home network root key;
receive Network Steering Information from a second network node;
generate a protected message comprising the Network Steering Information, the protected message being protected based on a configuration key (Kconf) derived from the home network root key and a first Message Authentication Code (MAC-1);
transmit the protected message comprising the Network Steering Information to a user equipment (UE);
receive, from the UE, an acknowledgement message protected with a second Message Authentication Code (MAC-2), the acknowledgment indicating that the VPLMN did not alter the Network Steering Information; and
forward the acknowledgment message indicating that the VPLMN did not alter the Network Steering Information to the second network node.
15. The first network node of claim 14 , wherein the home network root key is an AUSF key (Kausf).
16. The first network node of claim 14 wherein the protected message is piggybacked with a Registration Accept message.
17. The first network node of claim 14 , the second network node is operating as at least one of a Point Coordination Function (PCF) or a User data Management (UDM).
18. A method for securing network steering information by a first network node, the method comprising:
transmitting Network Steering Information and a first Message Altercation Code (MAC-1) to a second network node operating as an authentication server function (AUSF) for protection of the Network Steering Information based on a configuration key (Kconf) derived from a home network root key and the first Message Authentication Code (MAC-1);
receiving, from the UE, an acknowledgement message protected with a second Message Authentication Code (MAC-2), the acknowledgment indicating that the VPLMN did not alter the Network Steering Information;
verifying the MAC-2; and
determining based on the acknowledgement that the VPLMN did not alter the Network Steering Information.
19. The method of claim 18 , wherein the home network root key is an AUSF key (Kausf).
20. The method of claim 18 , wherein the first network node operates as a User Data Management (UDM) or a Point Coordination Function (PCF).
21. The method of claim 18 , further comprising:
receiving from the second network node operating as the AUSF, the MAC-1 and the MAC-2;
storing the MAC-2.
22. The method of claim 21 , wherein:
verifying the MAC-2 comprises comparing the MAC-2 received from the second network node operating as the AUSF to the MAC-2 protecting the acknowledgment message from the UE, and
determining based on the acknowledgement that the VPLMN did not alter the Network Steering Information comprises determining that the MAC-2 received from the second network node operating as the AUSF is the same as the MAC-2 protecting the acknowledgment message from the UE.
23. A first network node for securing network steering information, the network node comprising:
memory configured to store instructions; and
processing circuitry configured to execute the instructions to cause the network node to:
transmit Network Steering Information and a first Message Altercation Code (MAC-1) to a second network node operating as an authentication server function (AUSF) for protection of the Network Steering Information based on a configuration key (Kconf) derived from a home network root key and the first Message Authentication Code (MAC-1);
receive, from the UE, an acknowledgement message protected with a second Message Authentication Code (MAC-2), the acknowledgment indicating that the VPLMN did not alter the Network Steering Information;
verify the MAC-2; and
determine based on the acknowledgement that the VPLMN did not alter the Network Steering Information.
24. The first network node of claim 23 , wherein the home network root key is an AUSF key (Kausf).
25. The first network node of claim 23 , wherein the first network node operates as a User Data Management (UDM) or a Point Coordination Function (PCF).
26. The first network node of claim 23 , wherein the processing circuitry is configured to:
receive from the second network node operating as the AUSF, the MAC-1 and the MAC-2;
store the MAC-2.
27. The first network node of claim 26 , wherein:
verifying the MAC-2 comprises comparing the MAC-2 received from the second network node operating as the AUSF to the MAC-2 protecting the acknowledgment message from the UE, and
determining based on the acknowledgement that the VPLMN did not alter the Network Steering Information comprises determining that the MAC-2 received from the second network node operating as the AUSF is the same as the MAC-2 protecting the acknowledgment message from the UE.