Patent Description:
The subject matter disclosed herein relates generally to wireless communications and more particularly relates to security mode integrity verification. There is disclosed herein a method performed by a remote unit and a remote unit.

The following abbreviations are herewith defined, at least some of which are referred to within the following description: Third Generation Partnership Project ("3GPP"), <NUM>th Generation ("<NUM>"), Authentication, Authorization, and Accounting ("AAA"), Positive-Acknowledgment ("ACK"), Authentication and Key Agreement ("AKA"), Aggregation Level ("AL"), Access and Mobility Management Function ("AMF"), Access Point ("AP"), Access Stratum ("AS"), Authentication Server Function ("AUSF"), Authentication Token ("AUTN"), Beam Failure Detection ("BFD"), Beam Failure Recovery ("BFR"), Binary Phase Shift Keying ("BPSK"), Base Station ("BS"), Buffer Status Report ("BSR"), Bandwidth ("BW"), Bandwidth Part ("BWP"), Cell RNTI ("C-RNTI"), Carrier Aggregation ("CA"), Contention-Based Random Access ("CBRA"), Clear Channel Assessment ("CCA"), Common Control Channel ("CCCH"), Control Channel Element ("CCE"), Cyclic Delay Diversity ("CDD"), Code Division Multiple Access ("CDMA"), Control Element ("CE"), Contention-Free Random Access ("CFRA"), Closed-Loop ("CL"), Coordinated Multipoint ("CoMP"), Channel Occupancy Time ("COT"), Cyclic Prefix ("CP"), Cyclical Redundancy Check ("CRC"), Channel State Information ("CSI"), Channel State Information-Reference Signal ("CSI-RS"), Common Search Space ("CSS"), Control Resource Set ("CORESET"), Discrete Fourier Transform Spread ("DFTS"), Downlink Control Information ("DCI"), Downlink ("DL"), Demodulation Reference Signal ("DMRS"), Data Radio Bearer ("DRB"), Discontinuous Reception ("DRX"), Downlink Pilot Time Slot ("DwPTS"), Enhanced Clear Channel Assessment ("eCCA"), Enhanced Mobile Broadband ("eMBB"), Evolved Node B ("eNB"), Extensible Authentication Protocol ("EAP"), Effective Isotropic Radiated Power ("EIRP"), European Telecommunications Standards Institute ("ETSI"), Frame Based Equipment ("FBE"), Frequency Division Duplex ("FDD"), Frequency Division Multiplexing ("FDM"), Frequency Division Multiple Access ("FDMA"), Frequency Division Orthogonal Cover Code ("FD-OCC"), Frequency Range <NUM> - sub <NUM> frequency bands and/or <NUM> to <NUM> ("FR1"), Frequency Range <NUM> - <NUM> to <NUM> ("FR2"), Universal Geographical Area Description ("GAD"), <NUM> Node B or Next Generation Node B ("gNB"), Global Navigation Satellite System ("GNSS"), General Packet Radio Services ("GPRS"), Guard Period ("GP"), Global Positioning System ("GPS"), Global System for Mobile Communications ("GSM"), Globally Unique Temporary UE Identifier ("GUTI"), Home AMF ("hAMF"), Hybrid Automatic Repeat Request ("HARQ"), Home Location Register ("HLR"), Handover ("HO"), Home PLMN ("HPLMN"), Home Subscriber Server ("HSS"), Hash Expected Response ("HXRES"), Identity or Identifier ("ID"), Information Element ("IE"), International Mobile Equipment Identity ("IMEI"), International Mobile Subscriber Identity ("IMSI"), International Mobile Telecommunications ("IMT"), Internet-of-Things ("IoT"), Layer <NUM> ("L1"), Layer <NUM> ("L2"), Layer <NUM> ("L3"), Licensed Assisted Access ("LAA"), Local Area Network ("LAN"), Load Based Equipment ("LBE"), Listen-Before-Talk ("LBT"), Logical Channel ("LCH"), Logical Channel Prioritization ("LCP"), Log-Likelihood Ratio ("LLR"), Long Term Evolution ("LTE"), Multiple Access ("MA"), Medium Access Control ("MAC"), Multimedia Broadcast Multicast Services ("MBMS"), Modulation Coding Scheme ("MCS"), Master Information Block ("MIB"), Multiple Input Multiple Output ("MIMO"), Mobility Management ("MM"), Mobility Management Entity ("MME"), Mobile Network Operator ("MNO"), massive MTC ("mMTC"), Maximum Power Reduction ("MPR"), Machine Type Communication ("MTC"), Multi User Shared Access ("MUSA"), Non Access Stratum ("NAS"), Narrowband ("NB"), Negative-Acknowledgment ("NACK") or ("NAK"), Network Entity ("NE"), Network Function ("NF"), Next Generation ("NG"), NG <NUM> S-TMSI ("NG-<NUM>-S-TMSI"), Non-Orthogonal Multiple Access ("NOMA"), New Radio ("NR"), NR Unlicensed ("NR-U"), Network Repository Function ("NRF"), Network Slice Instance ("NSI"), Network Slice Selection Assistance Information ("NSSAI"), Network Slice Selection Function ("NSSF"), Network Slice Selection Policy ("NSSP"), Operation, Administration, and Maintenance System or Operation and Maintenance Center ("OAM"), Orthogonal Frequency Division Multiplexing ("OFDM"), Open-Loop ("OL"), Other System Information ("OSI"), Power Angular Spectrum ("PAS"), Physical Broadcast Channel ("PBCH"), Power Control ("PC"), UE to UE interface ("PC5"), Primary Cell ("PCell"), Policy Control Function ("PCF"), Physical Cell Identity ("PCI"), Physical Downlink Control Channel ("PDCCH"), Packet Data Convergence Protocol ("PDCP"), Packet Data Network Gateway ("PGW"), Physical Downlink Shared Channel ("PDSCH"), Pattern Division Multiple Access ("PDMA"), Packet Data Unit ("PDU"), Physical Hybrid ARQ Indicator Channel ("PHICH"), Power Headroom ("PH"), Power Headroom Report ("PHR"), Physical Layer ("PHY"), Public Land Mobile Network ("PLMN"), Physical Random Access Channel ("PRACH"), Physical Resource Block ("PRB"), Physical Sidelink Control Channel ("PSCCH"), Primary Secondary Cell ("PSCell"), Physical Uplink Control Channel ("PUCCH"), Physical Uplink Shared Channel ("PUSCH"), Quasi Co-Located ("QCL"), Quality of Service ("QoS"), Quadrature Phase Shift Keying ("QPSK"), Registration Area ("RA"), RA RNTI ("RA-RNTI"), Radio Access Network ("RAN"), Random ("RAND"), Radio Access Technology ("RAT"), Random Access Procedure ("RACH"), Random Access Preamble Identifier ("RAPID"), Random Access Response ("RAR"), Resource Element Group ("REG"), Radio Link Control ("RLC"), RLC Acknowledged Mode ("RLC-AM"), RLC Unacknowledged Mode/Transparent Mode ("RLC-UM/TM"), Radio Link Monitoring ("RLM"), Radio Network Temporary Identifier ("RNTI"), Reference Signal ("RS"), Remaining Minimum System Information ("RMSI"), Radio Resource Control ("RRC"), Radio Resource Management ("RRM"), Resource Spread Multiple Access ("RSMA"), Reference Signal Received Power ("RSRP"), Round Trip Time ("RTT"), Receive ("RX"), Sparse Code Multiple Access ("SCMA"), Scheduling Request ("SR"), Sounding Reference Signal ("SRS"), Single Carrier Frequency Division Multiple Access ("SC-FDMA"), Secondary Cell ("SCell"), Secondary Cell Group ("SCG"), Shared Channel ("SCH"), Sub-carrier Spacing ("SCS"), Service Data Unit ("SDU"), Security Anchor Function ("SEAF"), Serving Gateway ("SGW"), System Information Block ("SIB"), SystemInformationBlockType1 ("SIB1"), SystemInformationBlockType2 ("SIB2"), Subscriber Identity/Identification Module ("SIM"), Signal-to-Interference-Plus-Noise Ratio ("SINR"), Sidelink ("SL"), Service Level Agreement ("SLA"), Sidelink Synchronization Signals ("SLSS"), Session Management Function ("SMF"), Special Cell ("SpCell"), Single Network Slice Selection Assistance Information ("S-NSSAI"), Scheduling Request ("SR"), Signaling Radio Bearer ("SRB"), Shortened TMSI ("S-TMSI"), Shortened TTI ("sTTI"), Synchronization Signal ("SS"), Sidelink SSB ("S-SSB"), Synchronization Signal Block ("SSB"), Subscription Concealed Identifier ("SUCI"), Supplementary Uplink ("SUL"), Subscriber Permanent Identifier ("SUPI"), Tracking Area ("TA"), TA Identifier ("TAI"), TA Update ("TAU"), Timing Alignment Timer ("TAT"), Transport Block ("TB"), Transport Block Size ("TBS"), Time-Division Duplex ("TDD"), Time Division Multiplex ("TDM"), Time Division Orthogonal Cover Code ("TD-OCC"), Temporary Mobile Subscriber Identity ("TMSI"), Transmission Power Control ("TPC"), Transmission Reception Point ("TRP"), Transmission Time Interval ("TTI"), Transmit ("TX"), Uplink Control Information ("UCI"), Unified Data Management Function ("UDM"), Unified Data Repository ("UDR"), User Entity/Equipment (Mobile Terminal) ("UE"), Uplink ("UL"), UL SCH ("UL-SCH"), Universal Mobile Telecommunications System ("UMTS"), User Plane ("UP"), UP Function ("UPF"), Uplink Pilot Time Slot ("UpPTS"), Ultra-reliability and Low-latency Communications ("URLLC"), UE Route Selection Policy ("URSP"), Vehicle-to-Vehicle ("V2V"), Visiting AMF ("vAMF"), Visiting NSSF ("vNSSF"), Visiting PLMN ("VPLMN"), Wide Area Network ("WAN"), and Worldwide Interoperability for Microwave Access ("WiMAX").

In certain wireless communications networks, a false base station may authenticate a user equipment.

<CIT> describes recovering from security mode command failures. "<NPL>, and describes initial attach procedures in EMM Case <NUM>, which concerns initial attach procedures for a user attaching to a network for the first time.

Claim <NUM> defines a method performed by a remote unit and claim <NUM> defines a remote unit. In the following, any method and/or apparatus referred to as embodiments but nevertheless do not fall within the scope of the appended claims are to be understood as examples helpful in understanding the invention.

Methods for security mode integrity verification are disclosed. Apparatuses and systems also perform the functions of the methods. One embodiment of a method includes transmitting a request message to one or more network devices. In some embodiments, the method includes, in response to transmitting the request message, authenticating with the one or more network devices. In certain embodiments, the method includes, in response to successfully authenticating with the one or more network devices, receiving a security mode command message. In various embodiments, the method includes verifying the integrity of the security mode command message. In some embodiments, the method includes, in response to the verification of the integrity of the security mode command message indicating that a security key is invalid, performing a cell reselection procedure.

One apparatus for security mode integrity verification includes a transmitter that transmits a request message to one or more network devices. In certain embodiments, the apparatus includes a processor that, in response to transmitting the request message, authenticates with the one or more network devices. In various embodiments, the apparatus includes a receiver that, in response to successfully authenticating with the one or more network devices, receives a security mode command message, wherein the processor: verifies the integrity of the security mode command message; and, in response to the verification of the integrity of the security mode command message indicating that a security key is invalid, performs a cell reselection procedure.

Another embodiment of a method for security mode integrity verification includes receiving a request message corresponding to a user equipment. In some embodiments, the method includes, in response to receiving the request message, determining whether the request message is valid based on information corresponding to the user equipment. In certain embodiments, the method includes, in response to determining that the request message is invalid, transmitting a response message indicating to the user equipment that the request message is rejected.

Another apparatus for security mode integrity verification includes a receiver that receives a request message corresponding to a user equipment. In certain embodiments, the apparatus includes a processor that, in response to receiving the request message, determines whether the request message is valid based on information corresponding to the user equipment. In various embodiments, the apparatus includes a transmitter that, in response to determining that the request message is invalid, transmits a response message indicating to the user equipment that the request message is rejected.

A further embodiment of a method for authentication includes receiving an authentication request message corresponding to a user equipment. In some embodiments, the method includes, in response to receiving the authentication request message: determining whether the user equipment has moved from a first public land mobile network to a second public land mobile network within a predetermined period of time; in response to the user equipment having moved from the first public land mobile network to the second public land mobile network within the predetermined period of time, determining a likelihood factor that indicates a likelihood that the user equipment moved from the first public land mobile network to the second public land mobile network; and, in response to the likelihood factor being less than a predetermined threshold, transmitting an authentication response message indicating a failed authentication.

A further apparatus for authentication includes a transmitter and a processor. In certain embodiments, the apparatus includes a receiver that receives an authentication request message corresponding to a user equipment, wherein, in response to receiving the authentication request message: the processor determines whether the user equipment has moved from a first public land mobile network to a second public land mobile network within a predetermined period of time; the processor, in response to the user equipment having moved from the first public land mobile network to the second public land mobile network within the predetermined period of time, determines a likelihood factor that indicates a likelihood that the user equipment moved from the first public land mobile network to the second public land mobile network; and the transmitter, in response to the likelihood factor being less than a predetermined threshold, transmits an authentication response message indicating a failed authentication.

<FIG> depicts an embodiment of a wireless communication system <NUM> for security mode integrity verification. In one embodiment, the wireless communication system <NUM> includes remote units <NUM> and network units <NUM>. Even though a specific number of remote units <NUM> and network units <NUM> are depicted in <FIG>, one of skill in the art will recognize that any number of remote units <NUM> and network units <NUM> may be included in the wireless communication system <NUM>.

In one embodiment, the remote units <NUM> may include computing devices, such as desktop computers, laptop computers, personal digital assistants ("PDAs"), tablet computers, smart phones, smart televisions (e.g., televisions connected to the Internet), set-top boxes, game consoles, security systems (including security cameras), vehicle on-board computers, network devices (e.g., routers, switches, modems), aerial vehicles, drones, or the like. The remote units <NUM> may communicate directly with one or more of the network units <NUM> via UL communication signals. In certain embodiments, the remote units <NUM> may communicate directly with other remote units <NUM> via sidelink communication.

In one embodiment, a remote unit <NUM> may transmit a request message to one or more network devices (e.g., network unit <NUM>). In some embodiments, the remote unit <NUM> may, in response to transmitting the request message, authenticate with the one or more network devices. In certain embodiments, the remote unit <NUM> may, in response to successfully authenticating with the one or more network devices, receive a security mode command message. In various embodiments, the remote unit <NUM> may verify the integrity of the security mode command message. In some embodiments, the remote unit <NUM> may, in response to the verification of the integrity of the security mode command message indicating that a security key is invalid, perform a cell reselection procedure. Accordingly, the remote unit <NUM> may be used for security mode integrity verification.

In various embodiments, a network unit <NUM> may receive a request message corresponding to a user equipment (e.g., remote unit <NUM>). In some embodiments, the network unit <NUM> may, in response to receiving the request message, determine whether the request message is valid based on information corresponding to the user equipment. In certain embodiments, the network unit <NUM> may, in response to determining that the request message is invalid, transmit a response message indicating to the user equipment that the request message is rejected. Accordingly, the network unit <NUM> may be used for security mode integrity verification.

In certain embodiments, a network unit <NUM> may receive an authentication request message corresponding to a user equipment (e.g., remote unit <NUM>). In some embodiments, the network unit <NUM> may, in response to receiving the authentication request message: determine whether the user equipment has moved from a first public land mobile network to a second public land mobile network within a predetermined period of time; in response to the user equipment having moved from the first public land mobile network to the second public land mobile network within the predetermined period of time, determining a likelihood factor that indicates a likelihood that the user equipment moved from the first public land mobile network to the second public land mobile network; and, in response to the likelihood factor being less than a predetermined threshold, transmitting an authentication response message indicating a failed authentication. Accordingly, the network unit <NUM> may be used for authentication.

<FIG> depicts one embodiment of an apparatus <NUM> that may be used for security mode integrity verification. The apparatus <NUM> includes one embodiment of the remote unit <NUM>. Furthermore, the remote unit <NUM> may include a processor <NUM>, a memory <NUM>, an input device <NUM>, a display <NUM>, a transmitter <NUM>, and a receiver <NUM>. In some embodiments, the input device <NUM> and the display <NUM> are combined into a single device, such as a touchscreen. In certain embodiments, the remote unit <NUM> may not include any input device <NUM> and/or display <NUM>. In various embodiments, the remote unit <NUM> may include one or more of the processor <NUM>, the memory <NUM>, the transmitter <NUM>, and the receiver <NUM>, and may not include the input device <NUM> and/or the display <NUM>.

In various embodiments, the processor <NUM> may, in response to transmitting the request message, authenticate with the one or more network devices.

The transmitter <NUM> is used to provide UL communication signals to the network unit <NUM> and the receiver <NUM> is used to receive DL communication signals from the network unit <NUM>, as described herein.

In some embodiments, the transmitter <NUM> may transmit a request message to one or more network devices (e.g., network unit <NUM>). In various embodiments, the receiver <NUM> may, in response to successfully authenticating with the one or more network devices, receive a security mode command message, wherein the processor <NUM>: verifies the integrity of the security mode command message; and, in response to the verification of the integrity of the security mode command message indicating that a security key is invalid, performs a cell reselection procedure.

<FIG> depicts one embodiment of an apparatus <NUM> that may be used for security mode integrity verification. The apparatus <NUM> includes one embodiment of the network unit <NUM>. Furthermore, the network unit <NUM> may include a processor <NUM>, a memory <NUM>, an input device <NUM>, a display <NUM>, a transmitter <NUM>, and a receiver <NUM>. As may be appreciated, the processor <NUM>, the memory <NUM>, the input device <NUM>, the display <NUM>, the transmitter <NUM>, and the receiver <NUM> may be substantially similar to the processor <NUM>, the memory <NUM>, the input device <NUM>, the display <NUM>, the transmitter <NUM>, and the receiver <NUM> of the remote unit <NUM>, respectively.

In various embodiments, the receiver <NUM> may receive a request message corresponding to a user equipment (e.g., remote unit <NUM>). In certain embodiments, the processor <NUM> may, in response to receiving the request message, determine whether the request message is valid based on information corresponding to the user equipment. In various embodiments, the transmitter <NUM> may, in response to determining that the request message is invalid, transmit a response message indicating to the user equipment that the request message is rejected.

In some embodiments, the receiver <NUM> may receive an authentication request message corresponding to a user equipment (e.g., remote unit <NUM>), wherein, in response to receiving the authentication request message: the processor <NUM> may determine whether the user equipment has moved from a first public land mobile network to a second public land mobile network within a predetermined period of time; the processor <NUM> may, in response to the user equipment having moved from the first public land mobile network to the second public land mobile network within the predetermined period of time, determine a likelihood factor that indicates a likelihood that the user equipment moved from the first public land mobile network to the second public land mobile network; and the transmitter <NUM> may, in response to the likelihood factor being less than a predetermined threshold, transmit an authentication response message indicating a failed authentication. Although only one transmitter <NUM> and one receiver <NUM> are illustrated, the network unit <NUM> may have any suitable number of transmitters <NUM> and receivers <NUM>.

<FIG> is a schematic block diagram <NUM> illustrating one embodiment of an authentication relay attack. The diagram <NUM> includes a victim UE <NUM> and a false BS <NUM> both located at a first location <NUM>, and a malicious UE <NUM>, a genuine BS <NUM>, a genuine AMF <NUM> all located at a second location <NUM>. The diagram <NUM> also includes a UDM/AUSF of victim UE <NUM>. The diagram <NUM> illustrates an authentication attack <NUM> that occurs across the devices.

In certain configurations, the victim UE <NUM> may be attracted to the false BS <NUM> (e.g., malicious gNB). In such configurations, the false BS <NUM> may collaborate with the malicious UE <NUM>. Moreover, there may be a private channel between the false BS <NUM> and the malicious UE <NUM>. In these configurations, the distance between the false BS <NUM> and the malicious UE <NUM> may be very far, and the false BS <NUM> and the malicious UE <NUM> may be linked by a LAN or a WAN to form a malicious network through two PLMNs.

In various embodiments, the victim UE <NUM> may perform a registration request, a service request, or a TAU request procedure. In such embodiments, the false BS <NUM> may forward a message of the victim UE <NUM> to the malicious UE <NUM>, and the malicious UE <NUM> may forward the message to the genuine AMF <NUM> in a home network through the genuine BS <NUM> (e.g., remote legitimate gNB). If the AMF <NUM> initiates an authentication procedure, the false BS <NUM> and the malicious UE may forward the authentication messages between the remote legitimate gNB and the victim UE <NUM> to complete authentication. Accordingly, the victim UE <NUM> may successfully access the genuine BS <NUM> and register to the home network through the false BS <NUM> and the malicious UE <NUM>.

In certain embodiments, a network-aware user's location and a user's actual location may be inconsistent. For example, if the user is in London, the attacker forwards the message to the genuine BS <NUM> located in New York through the false BS <NUM> and the malicious UE <NUM>, so that the core network considers the user located in New York, providing a way to set up a false alibi or undermine a criminal investigation with false evidence. The victim UE <NUM> may be directed by an attacker to access the roaming network resulting in a charging fraud.

Unlike a typical man-in-the-middle attack, the adversary in this attack can neither decrypt the encrypted traffic between the victim UE <NUM> and the core networks, nor can inject valid encrypted traffic unless the service provider blatantly disregards the standard's security recommendations and choose a weak-security context and/or no-security context during connection establishment.

In certain embodiments, the genuine AMF <NUM> does not store actual location information of a UE, but the location information may be reported by a gNB. Once the UE accesses a malicious gNB, and the attacker adopts an authentication relay attack as described above, an AMF saved current location information of the UE and actual UE location information may be inconsistent, resulting in incorrect location positioning of the UE.

In various embodiments, there may not be a way to: <NUM>) determine at a UE or an AMF that a malicious attack is occurring; or <NUM>) inform the UE and the AMF about an ongoing malicious attack.

As found herein, the term BS may be used for a base station but may also be replaceable by any other radio access node (e.g., BS, eNB, gNB, AP, NR, and so forth). Moreover, embodiments described herein may be applicable also to various types of networks including IEEE <NUM> variants, GSM, GPRS, UMTS, LTE variants, CDMA <NUM>, Bluetooth, ZigBee, Sigfoxx, and so forth.

In one embodiment, a UE and/or an AMF may detect an ongoing man in the middle attack.

In certain embodiments, a victim UE may use a different <NUM>-GUTI (e.g., as UE ID in NAS signaling messages) than expected from an actual PLMN of a malicious UE. The malicious UE may filter out those identifiers or the NAS message may be encrypted with a current security context since the victim UE does not know that its message is rerouted to a different destination. This network based solution may look at the plausibility for the victim UE to change geographic locations within a time difference of a timestamp of the last known location in a UDM and a new location forced by the malicious UE.

<FIG> is a schematic block diagram illustrating network communications <NUM>. The illustrated communications <NUM> are between a victim UE <NUM>, a false BS <NUM>, a malicious UE <NUM>, a genuine BS <NUM>, an AMF <NUM>, and a UDM/AUSF <NUM>. The victim UE <NUM> and the false BS <NUM> are located at the same general location in a first PLMN, and the malicious UE <NUM>, the genuine BS <NUM>, and the AMF <NUM> are located at the same general location in a second PLMN. Each of the communications <NUM> described herein may include one or more messages. The communications <NUM> may be for an NAS registration or a service request procedure triggered by the victim UE <NUM>.

In one embodiment, in a first communication <NUM> transmitted between the victim UE <NUM> and the false BS <NUM>, the victim UE <NUM> performs an RRC setup procedure with the false BS <NUM>.

In another embodiment, in a second communication <NUM> transmitted from the false BS <NUM> to the malicious UE <NUM>, the false BS <NUM> transmits a message that triggers the malicious UE <NUM> to the malicious UE <NUM>. The malicious UE <NUM> may be triggered by a first RRC message, an RRC setup request, and/or an RRC setup complete message. In some embodiments, the malicious UE <NUM> replaces the victim UE's <NUM>-TMSI (e.g., NG-<NUM>-S-TMSI) from an RRC setup request with the malicious UE's <NUM>-TMSI, such as in the form of a random string. In various embodiments, an RRC layer uses a random string if there is no S-TMSI provided from upper layers (e.g., an NAS layer).

In certain embodiments, in a third communication <NUM> transmitted between the malicious UE <NUM> and the genuine BS <NUM>, the malicious UE <NUM> performs an RRC setup procedure with the genuine BS <NUM>.

In some embodiments, in a fourth communication <NUM> transmitted from the genuine BS <NUM> to the AMF <NUM>, the genuine BS <NUM> transmits an initial NAS message to the AMF <NUM>. The initial NAS message may include a <NUM>-GUTI of the first PLMN and/or may be integrity protected.

Once the AMF <NUM> in the second PLMN receives the initial NAS message (e.g., any suitable NAS message, such as an NAS transport, an uplink NAS transport, a message containing PDU session establishment, authentication, modification, and/or release request, and so forth) forwarded from the malicious UE <NUM> in the fourth communication <NUM>, the AMF <NUM> may determine <NUM> that there is no NAS context (e.g., security, access, and/or mobility context) corresponding to the <NUM>-GUTI, and the AMF <NUM> may determine that the <NUM>-GUTI contains a PLMN ID different from the PLMN ID of the second PLMN. The AMF <NUM> may not be able to check the integrity protection of the NAS message and may not be able to decipher an NAS container. The victim UE <NUM> may assume that it is in the same PLMN network that it started in. In certain embodiments, the victim UE <NUM> may send a message that has a complete initial NAS message ciphered in an NAS container along with cleartext IEs with whole message integrity protected. This initial NAS message may be a service request, a periodic reregistration message, a mobility reregistration message, and/or another message. If the victim UE <NUM> would perform PLMN selection (e.g., due to roaming), then the victim UE <NUM> may send SUCI in an unprotected initial NAS message since it does not have a security context and a valid <NUM>-GUTI assigned from the PLMN where the victim UE <NUM> camps. This may be used as a first indication of an authentication relay attack.

If the message received by the AMF <NUM> is a service request or a registration request, the AMF <NUM> may reject the request because the victim UE <NUM> is unknown in the network. In certain embodiments, in a fifth communication <NUM> transmitted from the AMF <NUM> to the victim UE <NUM>, the AMF <NUM> may transmit an NAS message rejection to the victim UE <NUM>. The NAS message rejection may include information indicating that the <NUM>-GUTI is invalid and/or a PLMN mismatch. The victim UE <NUM> may detect <NUM> an error cause, reregister, and/or perform cell reselection. For example, the victim UE <NUM> may detect implicitly based on the error cause that it is camping at a false BS and may perform cell reselection. The victim UE may internally mark the cell of the false BS as an invalid cell so that it does not go back to it at a later time after performing cell-reselection.

In various embodiments, if the victim UE <NUM> does not perform cell reselection, in a sixth communication <NUM> transmitted from the victim UE <NUM> to the AMF <NUM>, the victim UE <NUM> itself may initiate an initial registration request with its SUCI and/or UE capabilities via a transmission to the AMF <NUM>. The victim UE <NUM> may use this as a criteria to recognize the false BS <NUM> because the victim UE <NUM> assumes it already has had a successful registration with the current PLMN, replayed by the false BS <NUM>. As a result, in some embodiments, a seventh communication <NUM> may be skipped.

In certain embodiments, in the seventh communication <NUM> transmitted between the victim UE <NUM> and the AMF <NUM>, the AMF <NUM> of the second PLMN does not know the identity of the victim UE <NUM>, therefore the AMF <NUM> transmits an identity request to the victim UE <NUM> and requests SUCI. The identity request is forwarded to the victim UE <NUM> and the victim UE <NUM> provides its SUCI to the AMF <NUM> in an identity reply message.

In some embodiments, in an eighth communication <NUM> transmitted from the AMF <NUM> and the UDM/AUSF <NUM>, the AMF <NUM> sends a Nausf_UEAuthentication_Authenticate request message to the UDM/AUSF <NUM> of the HPLMN of the victim UE <NUM>. This request message contains the serving network identifier (e.g., identifier of the second PLMN). To provide the HPLMN with extra location information, the AMF <NUM> may send the location of the victim UE <NUM> according to GAD. This information may help the HPLMN to identify a distance between a location of a last registration in the UDM/AUSF <NUM> and the new location from the AMF <NUM>, as well as the time difference.

In various embodiments, the UDM/AUSF <NUM> may make <NUM> a plausibility check to determine whether it is possible to travel from the last known location to the new location within the time that the present registration request occurred. If implemented in the HPLMN, then the HPLMN may deny the authentication request to the AMF <NUM> with a location mismatch cause value. Alternatively, the UDM/AUSF <NUM> may provide the last known location of the victim UE <NUM> including timestamp to the AMF <NUM> using GAD, and the AMF <NUM> may make the decision about whether the location differences between the first PLMN and the second PLMN are possible based on corresponding timestamps. This check may be performed in roaming scenarios based on PLMN IDs and in non-roaming scenarios based on tracking area IDs or global cell IDs. The result of this location change evaluation may be a factor in detecting the man in the middle attack.

In some embodiments, in a ninth communication <NUM> transmitted from the UDM/AUSF <NUM> to the AMF <NUM> and, the UDM/AUSF <NUM> provides a challenge to the AMF <NUM> (e.g., SEAF, an AKA' challenge, or a <NUM> serving environment authentication vector such as RAND, AUTN, and/or HXRES*).

In certain embodiments, in a tenth communication <NUM> between the victim UE <NUM>, the false BS <NUM>, the malicious UE <NUM>, the genuine BS <NUM>, the AMF <NUM>, and/or the UDM/AUSF <NUM>, the UDM/AUSF <NUM> may perform a normal primary authentication procedure (e.g., <NUM> AKA or EAP-AKA').

Once the authentication is successful, the victim UE <NUM> derives <NUM> and the UDM/AUSF <NUM> derives <NUM>SEAF but with different PLMN IDs as input to the KDF, resulting in two different keys (e.g., one key in the victim UE <NUM> and one key in the UDM/AUSF <NUM> i.e. KSEAF1 and KSEAF2).

In various embodiments, in an eleventh communication <NUM> transmitted from the UDM/AUSF <NUM> to the AMF <NUM>, the UDM/AUSF <NUM> provides the KSEAF2 to the AMF <NUM>. The AMF <NUM> derives a KAMF and NAS keys.

In some embodiments, a successful authentication procedure results in a new KSEAF, which may mean that all derived keys are renewed in the AMF <NUM> and the victim UE <NUM>. Thus, a security mode command procedure may be carried out after every authentication procedure.

In certain embodiments, in a twelfth communication <NUM> transmitted from the AMF <NUM> to the victim UE <NUM>, the AMF <NUM> sends a security mode command to the victim UE <NUM>. The security mode command may be integrity protected with a key (e.g., KNASint2).

Upon reception of the security mode command message, the victim UE <NUM> may know that the authentication procedure was successful. The victim UE <NUM> tries <NUM> to verify the integrity of the security mode command but the victim UE <NUM> fails due to the key mismatch of KSEAFs and the resulting KNASint keys (e.g., KNASint1 is different than KNASint2).

Therefore, in various embodiments, in a thirteenth communication <NUM> transmitted from the victim UE <NUM> to the AMF <NUM>, the victim UE <NUM> sends a security mode reject message including an appropriate error cause value (e.g., integrity check failure) to the AMF <NUM>. The victim UE <NUM> may integrity protect the message (e.g., the security mode reject message) with the victim UE's <NUM> own derived key KNASint1. The AMF <NUM> may verify <NUM> whether it was a transmission failure or a key mismatch, and the AMF <NUM> may determine the NAS key mismatch based on one or more of the following: <NUM>) the AMF <NUM> receives a security mode reject with the error cause that the victim UE <NUM> could not verify the integrity of the previously sent security mode command; and/or <NUM>) the AMF <NUM> may be unable to verify the integrity of the security mode reject from the victim UE <NUM> (e.g., the AMF <NUM> may know that victim UE <NUM> has performed successful authentication).

In some embodiments, in a fourteenth communication <NUM> transmitted from the AMF <NUM> to the victim UE <NUM>, the AMF <NUM> may reject the registration by transmitting a registration reject message to the victim UE <NUM>. The AMF <NUM> may indicate to the victim UE <NUM> to re-register after a cell or PLMN reselection in order to allow the victim UE <NUM> to try from another (e.g., perhaps genuine) cell.

The victim UE <NUM> may detect <NUM> the false BS <NUM> and/or perform cell reselection. The victim UE <NUM> may internally mark the cell of the false BS <NUM> as an invalid cell so that it does not go back to it at a later time after performing cell-reselection. Moreover, the AMF <NUM> may inform <NUM> the UDM/AUSF <NUM> about the key mismatch. As may be appreciated, one reason for the key mismatch may be a man in the middle attack. Especially if the AUSF/UDM <NUM> takes into account the result of the plausibility check in step <NUM>, and if the victim UE <NUM> changes to a genuine cell and starts an initial registration again.

As described herein, detection of a man in the middle attack may be made with a false base station and a malicious UE in different locations by exchanging location information between UE and AMF.

In various embodiments described herein, an AMF may: <NUM>) provide location information with timestamp in a generic format to the HPLMN of the victim UE so that the AUSF/UDM can make a plausibility check whether it is possible to travel between the two destinations within the given time of the two timestamps of the last known location in the UDM and the location of the malicious UE; <NUM>) checks the last known location information with timestamp in a generic format retrieved from the HPLMN of the victim UE so in order to make a plausibility check whether it is possible to travel between the two destinations within the given time of the two timestamps of the currently occurred request at the AMF; <NUM>) detect NAS key mismatch based on a) integrity check failure reported from the UE (e.g., in the security mode reject message), and b) the fact that the performed primary authentication was successful. ; <NUM>) send an NAS reject message (e.g. service request and/or registration reject message) to the UE indicating cell and/or PLMN reselection or invalid GUTI (or no UE's context) and/or PLMN mismatch; and/or <NUM>) inform an UDM/AUSF about a NAS key mismatch.

In some embodiments as described herein, a UDM/AUSF may: <NUM>) provides last known location information with timestamp in a generic format to the AMF of the malicious UE so that the AMF can make a plausibility check whether it is possible to travel between the two destinations within the given time of the two timestamps of the last known location in the UDM and the location of the malicious UE; <NUM>) checks the last known location information with timestamp in a generic format retrieved from the AMF of the malicious UE in order to make a plausibility check whether it is possible to travel between the two destinations within the given time of the two timestamps of the currently occurred request at the AMF and the last known location in the UDM of the Victim UE; and/or <NUM>) detect man in the middle attack based on quick PLMN change of the UE and NAS key mismatch error from the AMF.

In certain embodiments as described herein, a UE may: <NUM>) perform successful authentication but experience an integrity check failure of the received security mode command. , the UE may send a security mode reject message including an error cause of e.g. integrity check failure, and/or the UE may integrity protect the message with its derived NAS key so that the AMF can verify whether it was a transmission failure or a key mismatch; <NUM>) implicitly and/or internally (e.g., not based on an NAS reject message) determine to perform cell re-selection if a primary authentication is successful, but a security mode command integrity check fails (e.g., due to false BS as man in the middle attach); <NUM>) perform cell reselection after receiving a NAS message reject with an error cause that the <NUM>-GUTI is invalid, especially if additionally indicated that the PLMN ID is not matching, but the UE had a successful registration before in the PLMN where the false BS is located and is imitating a local BS so that the UE does not recognize a change; <NUM>) implicitly and/or internally (e.g., not based on an NAS reject message) determine to perform cell re-selection if it experiences a time out after sending a security mode reject message dropped by the attacker (e.g., false BS or malicious UE), taking into account a) a security mode command integrity check failure, b) a successful authentication, and/or c) a re-registration or identity request; <NUM>) internally mark a cell of a false BS as an invalid cell so that it does not go back to it at a later time after performing cell-reselection; and/or <NUM>) may use as a criteria to perform cell and/or PLMN reselection (e.g., due to detect false BS) if a service request is rejected or re-registration request is rejected, even the UE assumes to have a valid security context and successful registration with the PLMN.

<FIG> is a flow chart diagram illustrating one embodiment of a method <NUM> for security mode integrity verification. In some embodiments, the method <NUM> is performed by an apparatus, such as the remote unit <NUM>. In certain embodiments, the method <NUM> may be performed by a processor executing program code, for example, a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.

The method <NUM> may include transmitting <NUM> a request message to one or more network devices. In some embodiments, the method <NUM> includes, in response to transmitting the request message, authenticating <NUM> with the one or more network devices. In certain embodiments, the method <NUM> includes, in response to successfully authenticating with the one or more network devices, receiving <NUM> a security mode command message. In various embodiments, the method <NUM> includes verifying <NUM> the integrity of the security mode command message. In some embodiments, the method <NUM> includes, in response to the verification of the integrity of the security mode command message indicating that a security key is invalid, performing <NUM> a cell reselection procedure.

In certain embodiments, the method <NUM> further comprises, in response to the verification of the integrity of the security mode command message indicating that the security key is invalid, transmitting a security mode reject message. In some embodiments, the method <NUM> further comprises, in response to transmitting the security mode reject message, receiving a registration rejection message.

In various embodiments, the method <NUM> further comprises, in response to the verification of the integrity of the security mode command message indicating that the security key is invalid, storing information indicating that a cell corresponding to the one or more network devices is an invalid cell. In one embodiment, performing the cell reselection procedure comprises starting an initial registration with a second cell different from a first cell corresponding to the one or more network devices.

<FIG> is a flow chart diagram illustrating another embodiment of a method <NUM> for security mode integrity verification. In some embodiments, the method <NUM> is performed by an apparatus, such as the network unit <NUM>. In certain embodiments, the method <NUM> may be performed by a processor executing program code, for example, a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.

The method <NUM> may include receiving <NUM> a request message corresponding to a user equipment. In some embodiments, the method <NUM> includes, in response to receiving the request message, determining <NUM> whether the request message is valid based on information corresponding to the user equipment. In certain embodiments, the method <NUM> includes, in response to determining that the request message is invalid, transmitting <NUM> a response message indicating to the user equipment that the request message is rejected.

In certain embodiments, the request message comprises a network access stratum registration message, a service request message, a radio resource control message, a radio resource control setup request message, or some combination thereof. In some embodiments, the information corresponding to the user equipment comprises a globally unique temporary identifier, a user equipment identifier, or a combination thereof.

In various embodiments, the method <NUM> further comprises successfully authenticating the user equipment. In one embodiment, the method <NUM> further comprises receiving a security mode reject message indicating that a security mode command message integrity check performed by the user equipment failed.

<FIG> is a flow chart diagram illustrating one embodiment of a method <NUM> for authentication. In some embodiments, the method <NUM> is performed by an apparatus, such as the network unit <NUM>. In certain embodiments, the method <NUM> may be performed by a processor executing program code, for example, a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.

The method <NUM> may include receiving <NUM> an authentication request message corresponding to a user equipment. In some embodiments, the method <NUM> includes, in response to receiving the authentication request message: determining <NUM> whether the user equipment has moved from a first public land mobile network to a second public land mobile network within a predetermined period of time; in response to the user equipment having moved from the first public land mobile network to the second public land mobile network within the predetermined period of time, determining a likelihood factor that indicates a likelihood that the user equipment moved from the first public land mobile network to the second public land mobile network; and, in response to the likelihood factor being less than a predetermined threshold, transmitting an authentication response message indicating a failed authentication.

In certain embodiments, the likelihood factor corresponds to a distance between the first public land mobile network and the second public land mobile network taking into account the predetermined period of time between two registrations corresponding to the first public land mobile network and the second public land mobile network. In some embodiments, the method <NUM> further comprises receiving information indicating a security key mismatch detected by the user equipment. In various embodiments, the method <NUM> further comprises setting a parameter to a value indicating a potential security issue in response to receiving the information indicating the security key mismatch detected by the user equipment.

Claim 1:
A method (<NUM>) performed by a remote unit, the method (<NUM>) comprising:
transmitting (<NUM>) a request message to one or more network devices;
in response to transmitting the request message, authenticating (<NUM>) with the one or more network devices;
in response to successfully authenticating with the one or more network devices, receiving (<NUM>) a security mode command message having a first security key derived with a public land mobile network identity associated with the one or more network devices as input;
deriving a second security key with an associated public land mobile network identifier as input;
verifying (<NUM>) the integrity of the security mode command message is invalid by determining a mismatch between the first security key and the second security key; and
in response to the verification of the integrity of the security mode command message indicating invalidity, performing (<NUM>) a cell reselection procedure.