LTE & UMTS Protocols + Enhancement Protocols
•Télécharger en tant que PPTX, PDF•
0 j'aime•913 vues
Video Also Available: https://youtu.be/0tkCk7X3wHE A Summary of The LTE (4G) and UMTS (3G) Authentication and Key Agreement Protocols with some Enhancements Proposed by many researchers.This Summary will be used in my Final Year Project of my Engineering Diploma. I am Working on enhancing the LTE AKA by investigating the Vulnerable and Weakned areas in the protocol and propose solutions for them.Lot to come in the next weeks, anyone interested in sharing their thoughts with me, I'll be glad to hear it.
Recommandé
Contenu connexe
En vedette
En vedette (11)
Dernier
Dernier (20)
LTE & UMTS Protocols + Enhancement Protocols
- 1. Authentications & Key Agreement Protocols 3G/UMTS , 4G/LTE/EPS and their Enhancements By Ahmad Kabbara
- 3. UMTS Security Context Done only at initialization of the terminal 3/12
- 4. EMSUCU 4/12
- 7. LTE – Security Context 7/12
- 9. Advantages of SE - AKA: • All transmission connections between the nodes of the EPS all secured by asymmetric cyphering. Inconvenients of SE – AKA: • Vulnerable against Reject attack: Sending multiple A intercepted msgs • Vulnerable against Service Blocking(MITM): change Snid • Vulnerable against Brute Force or Intelligent Brute Force attack against IMSI 9/12
- 10. EC – AKA 10/12
- 11. EC – AKA 2 11/12
- 12. Advantages of EC – AKA: • Oppose the dictionary attack against IMSI by the generation of Dynamic IMSI • Always guarantees to have dynamic Cyphering and Integrity Keys on each User Attach Request. Inconvenients of EC – AKA: • Vulnerable against Reject Attack :by intercepting msg A.*solved by ECAKA2 • Vulnerable against Denial of Service Attack against HSS/AuC by sending multiple A msgs. • Vulnerable against MITM Attack: Compromise the Av by knowing PKM change msg B ot B’ by changing Snid to another authorized one. 12/12
Notes de l'éditeur
- Possible Attacks: Attaque de déni de service, Modification des capacités de sécurité d’UE, Attaque sur le message de rejet du mode de sécuritéModification des messages AKA (RAND, AUTN et RES),Attaques contre la clé secrète permanente K,Attaque sur la voie radio,Attaque contre la carte à puce UICC,Attaqued’homme au milieu (MITM), Attaques sur les réponses des données d’authentification (AVs),Attaque de l’extérieur, Attaque de l’intérieur,
- IMSI Protection by encrypting IMSI to avoid IMSI Catching and user Traceability
- First Solutions : Integrity Protection of all MessagesSecond Solution: Key K Protection
- chiffrement à clés asymétriques, de presque tous les messages échangés entre les différentesentités du réseau.Vulnerable Contreuneattaque par dictionnaire, attaque par rejoue, attaque dedéni de service sur le HSS/AuC et sur l’UE, et attaque MITM.The public key encryption is used to resist the replayAttack.This AKA has no longer need for the SQN to ensure the freshness of the Av, since Av can not be decrypted and Kasmeca not be avquired.Inconvenient: the cyphering of IMSI at first is considered a secure way of view but all the msg is in plain text and can be broke by Intelligent Brute Force.Attaque par dictionnaire : by building a table of authorised IMSIs Denial of Service Attack: by intercepting the attach request msg and and send it back so he will use all the ressources to do a denial of service attack against HSS/AuC when doing multiple of this procedure .Service Blocking AttacK : done by MITM by intercepting msg B and changing the Snid to another authorized oneDenial of Service attack against UE: by changing the RES sent in clear text Cause: Lack of Source Authentication and msgsIntegrity.Only Use of Asymetric Cyphering Algorithms
- chiffrement asymétrique pour chiffrer les messages A, B, et C en se basant sur les clés publiques de HSS (PKH), et de MME (PKM), et surle chiffrement symétrique pour chiffrer les autres messages D, E et F en se basant sur la clé de chiffrement EK générée dans l’UE et dans le HSS, et envoyé par ce dernier au MME.Use of AsymetricCypheringAlgorithms for msgs A,B,C and SymetricCypheringAlgorithms for msg D,E,F
- EC-AKA2 vs EC-AKA EC-AKA2 has the following enhancements over EC-AKA: EC-AKA2 has added SNID in the NAS Attach Request to become immune to the MITM attack discussed in the serving network authentication leading to UE tracking. EC-AKA2 has adopted a restriction over EC-AKA during handover; if when a new eNB having no access to the old eNB and requesting the UE to send its IMSI, EC-AKA2 forces the UE to re-run an EC-AKA2 instance. This modification in EC-AKA2, will immune the protocol against the threat “User tracking due to linkability of IMSI/TMSI and RNTI”. EC-AKA2 forces the system to change the used TMSI after changing the UE’s state to LTE_ACTIVE, thus abiding to 3GPP’s recommendations.