Systems and methods for protecting cellular network messages
A client-side electronic device includes a receiver, a processor, and a memory. The receiver communicates with a message server over a communication medium of a communication network. The memory stores computer-executable instructions, which, when executed by the processor, cause the device to receive, from the message server, a broadcast message, a timestamp associated with the broadcast message, and a first digital signature of the broadcast message and a second digital signature of the timestamp. The executed instruction further cause the device to verify an integrity of the broadcast message based the first or second digital signatures, determine a freshness of the broadcast message based on the received timestamp, calculate a trust state of the broadcast message based on the integrity verification and the freshness determination, and store the broadcast message in the memory along with the calculated trust state.
1. A message server for broadcasting messages over a communication network, comprising:
a transceiver configured for operable communication with a signing server and at least one client-side device over a communication medium of the communication network;
a processor including a memory configured to store computer-executable instructions, which, when executed by the processor, cause the message server to:
transmit a digital signing request to the signing server;
receive, from the signing server, a signing response to the digital signing request, wherein the signing response includes a digital certificate;
compute a digital signature over a Master Information Block (MIB), a System Information Block (SIB), and a timestamp;
transmit the MIB and SIB to the client-side device; and
transmit a message comprising the timestamp, the digital signature, and the digital certificate to the client-side device.
2. The message server of claim 1 , wherein the message server comprises a gNB.
3. The message server of claim 1 , wherein the client-side device is configured to verify the signature and the timestamp.
4. The message server of claim 1 , wherein an access and mobility management function (AMF) is disposed as a first interface between the message server and the signing server.
5. The message server of claim 4 , wherein the AMF includes a second interface between the signing server and a plurality of different message servers.
6. The message server of claim 4 , wherein the instructions further cause the message server to open a connection to the AMF prior to transmitting the digital signing request.
7. The message server of claim 6 , wherein the instructions further cause the message server to close the connection to the AMF subsequent to receiving the digital certificate.
8. The message server of claim 1 , wherein the digital certificate is short-lived and includes an expiration time.
9. The message server of claim 8 , wherein the instructions further cause the message server to replace the short-lived digital certificate on a periodic basis.
10. The message server of claim 1 , wherein the digital certificate has a short key length.
11. The message server of claim 1 , wherein the instructions further cause the message server to:
generate a public and private key pair; and
generate the digital signing request based on the public and private key pair.
12. The message server of claim 1 , wherein the instructions further cause the message server to:
generate a key chain including at least 64 iterations, wherein a last iteration of the key chain is an anchor key; and
compute the digital signature over the Master Information Block (MIB), the System Information Block (SIB), the timestamp, and the anchor key.
13. The message server of claim 12 , wherein the instructions further cause the message server to:
generate a plurality of message authentication codes (MAC) for a plurality of values of dynamic content;
iterate through the plurality of values of dynamic content by transmitting the MIB, the SIB, and a MAC associated with the current value of dynamic content to the client-side device; and
transmit the message comprising the timestamp, the anchor key, the digital signature, and a current key of the key chain to the client-side device.