Enhanced security for access stratum transmission
This disclosure relates to techniques, base stations, and user equipment devices (UEs) for performing base station authentication through access stratum signaling transmissions. The UE may operate in idle mode and may receive an authentication message from a base station through the wireless interface while operating in idle mode. The UE may determine whether a signature comprised within the authentication message is valid, and the UE may continue a connection procedure with the base station based on a determination that the signature is valid. If it is determined that the signature is invalid, the UE may designate the base station as a barred base station and may perform cell re-selection. The authentication message may be one of a radio resource control (RRC) connection setup message, a special RRC message, a media access control (MAC) message, or a random access channel (RACH) message comprising a random access response (RAR) message.
1. A user equipment device (UE), comprising:
at least one radio;
a memory; and
at least one processor communicatively coupled to the at least one radio and the memory;
wherein the at least one radio, the memory, and the at least one processor are configured cause the UE to:
operate in an idle mode;
while operating in the idle mode, receive an authentication message from a base station as part of an initiation of a connection procedure, wherein the authentication message is a broadcast message comprised within a special system information block (SIB) transmitted from the base station;
determine whether a signature comprised within the authentication message is valid, wherein the signature is determined from content of the special SIB and at least one other broadcast message; and
continue the connection procedure with the base station based on a determination that the signature is valid.
2. The UE of claim 1 ,
wherein the UE is further configured to:
based on a determination that the signature comprised within the authentication message is invalid:
designate the base station as a barred base station; and
perform cell re-selection to initiate a connection procedure with another base station.
3. The UE of claim 1 ,
wherein the authentication message is received in response to an on-demand system information request by the UE.
4. The UE of claim 1 ,
wherein the authentication message further comprises a contention resolution message, and
wherein the contention resolution message is checked together with the signature.
5. The UE of claim 1 ,
wherein the authentication message is received as part of an initial access procedure.
6. The UE of claim 1 ,
wherein the UE is further configured to:
receive a public key from the base station;
transmit a nonce to the base station as part of a challenge-response authentication procedure;
wherein the authentication message is received during the challenge-response authentication procedure in response to the UE transmitting the nonce to the base station; and
wherein the signature is based on the nonce and a private key of the base station.
7. The UE of claim 1 ,
wherein the signature is cell specific.
8. The UE of claim 1 ,
wherein the signature is UE-specific.
9. A method for authenticating an identity of a base station using access stratum transmissions, the method comprising:
by a user equipment device (UE):
receiving an authentication message from the base station while the UE is operating in an idle mode as part of an initiation of a connection procedure, wherein the authentication message is a broadcast message comprised within a special system information block (SIB) transmitted from the base station;
determining, by the UE, whether a signature comprised within the authentication message is valid, wherein the signature is determined from content of the special SIB and at least one other broadcast message; and
continuing the connection procedure with the base station based on a determination that the signature is valid.
10. The method of claim 9 ,
wherein the authentication message is periodically broadcast by the base station.
11. The method of claim 9 , the method further comprising:
by the UE:
based on a determination that the signature comprised within the authentication message is invalid:
designating the base station as a barred base station; and
performing cell re-selection to initiate a connection procedure with another base station.
12. The method of claim 9 ,
wherein the authentication message further comprises a contention resolution message, and
wherein the contention resolution message is checked together with the signature.
13. An apparatus, comprising:
a processor configured to cause a user equipment (UE) to:
operate in an idle mode;
while operating in the idle mode, receive an authentication message from a base station as part of an initiation of a connection procedure, wherein the authentication message is a broadcast message comprised within a special system information block (SIB) transmitted from the base station;
determine whether a signature comprised within the authentication message is valid, wherein the signature is determined from content of the special SIB and at least one other broadcast message; and
continue the connection procedure with the base station based on a determination that the signature is valid.
14. The apparatus of claim 13 ,
wherein the processor is further configured to cause the UE to:
based on a determination that the signature comprised within the authentication message is invalid:
designate the base station as a barred base station; and
perform cell re-selection to initiate a connection procedure with another base station.
15. The apparatus of claim 13 ,
wherein the processor is further configured to cause the UE to:
receive a public key from the base station;
transmit a nonce to the base station as part of a challenge-response authentication procedure;
wherein the authentication message is received during the challenge-response authentication procedure in response to the UE transmitting the nonce to the base station; and
wherein the signature is based on the nonce and a private key of the base station.
16. The apparatus of claim 13 ,
wherein the signature is cell-specific.
17. The apparatus of claim 13 ,
wherein the signature is UE-specific.
18. The UE of claim 1 ,
wherein the authentication message is periodically broadcast by the base station.
19. The method of claim 9 ,
wherein the signature is cell-specific or UE-specific.
20. The apparatus of claim 13 ,
wherein the authentication message is periodically broadcast by the base station.