Patent Description:
Security of mobile networks has been increased from generation to generation. The latest <NUM> developments have, alongside a mutual authentication of the user equipment (UE) to the mobile network as well as the mobile network to the UE and the increased key length for encryption of user data, also introduced the integrity of user data. Thereby it can be ensured that user data cannot be modified on the air interface by a man-in-the-middle attack.

Particularly during connection establishment between UE and base station, points of attack may be generated. Two of the fundamental vulnerabilities with regard to security are the first messages a UE interchanges with a mobile network (Radio Resource Control (RRC) connection setup) as well as the generally unprotected system broadcast messages (System Information Block (SIB)) which provide an overview of available mobile networks (for Public Land Mobile Network (PLMN) Selection) and information needed to access the chosen network plus information which influences the idle mode mobility of an User Equipment (UE), which mobile network should be chosen for communication.

<CIT> discloses a method and apparatus for providing broadcast channel encryption to enhance cellular network security. It is particularly directed towards prevention of radio jamming attacks.

SIBs may be transmitted via a Broadcast Control Channel (BCCH) and may provide a command for cell selection and cell reselection, i.e. the process of a UE selecting or changing a cell of the cellular network. With respect to the first vulnerability, already during development of UMTS, higher security measures have been proposed which have been partially implemented in the <NUM> standard. Security of the SIB, however, has not been increased in any of the past mobile network generations including <NUM>.

The unprotected SIB of LTE may also be attacked by a so-called signal-overshadowing. In this context, the following articles have been published:.

In a signal-overshadowing attack, the invader manipulates the system broadcast message channel utilising a fake base station in order to redirect UEs camping or staying on a regular base station by a manipulated system broadcast messages to a fake base station (which ideally has a lower security level as LTE, i.e. UMTS or even GSM). There, an attack against the mobile communication user may be performed.

Is therefore an object of the present disclosure to improve security of the system broadcast messages and to prevent possible attacks on a mobile communication user. This object is achieved by the present disclosure. Dependent claims describe preferred embodiments.

In particular, the present disclosure comprises a method of ensuring integrity of system broadcast messages in a cellular mobile communications network. The method comprises receiving of a master information block (MIB) by a user equipment (UE) from a base station over a physical broadcast channel (PBCH). At least one system information Block (SIB) is received by the UE from the base station comprising configuration information. At least one additional SIB is received by the UE from the base station which comprises cell selection information and/or cell reselection information and/or neighbouring cell information. At least one of the additional SIBs is transmitted integrity proof.

The integrity may be obtained by performing a cryptographic hash function on at least one of the SIBs or groups of SIBs. The integrity is obtained by performing an integrity operation on at least one of the SIBs or groups of SIBs or by performing an encryption operation on at least one of the SIBs or groups of SIBs.

A key for the integrity operation and/or a key for the encryption operation is received at the UE during a connection establishment between the UE and the base station.

A key for the integrity operation and/or a key for the encryption operation may be preconfigured in a Subscriber Identity Module, SIM, and/or a Universal Integrated Circuit Card, UICC, and changed via SIM and/or UICC functions.

At least one of the additional SIB can contain mobility related configuration information.

MIB and/or SIB comprising configuration information may be transmitted integrity proof. Alternatively, MIB and/or SIB comprising configuration information may be transmitted without protection.

The integrity can be verified by the UE.

The disclosure further relates to a system for ensuring integrity of system broadcast messages in a cellular mobile network. The system comprises receiving means configured to receive a master information block (MIB) on a user equipment (UE) from a base station. The receiving means are also configured to receive at least one system information Block (SIB) on the UE from the base station comprising configuration information and to receive at least one additional SIB on the UE from the base station comprising cell selection information and/or cell reselection information and/or neighbouring cell information. Transmitting means are configured to transmit at least one of the additional SIBs integrity proof.

The disclosure further relates to a User equipment (UE) comprising means configured to receive a master information block (MIB) from a base station and configured to receive at least one system information Block (SIB) from the base station comprising configuration information. Said means are further configured to receive at least one additional SIB transmitted integrity proof from the base station, the at least one additional SIB comprising cell selection information and/or cell reselection information and/or neighbouring cell information.

The present disclosure also encompasses a base station comprising means configured to send a master information block (MIB) to a user equipment (UE) and configured to send at least one system information Block (SIB) to the UE comprising configuration information. Said means are further configured to send at least one additional SIB to the UE comprising cell selection information and/or cell reselection information and/or neighbouring cell information. The base station also comprises means configured to transmit at least one of the additional SIBs integrity proof.

The disclosure also relates to a computer program product configured to perform the method as described above and/or a computer-readable storage medium comprising said program product.

The disclosure is further described using the following figures.

The disclosure relates to a method of secure transmission of configuration information in a telecommunication network. In particular, the method may be employed for secure transmission of system broadcast messages. Secure transmission may particularly comprise manipulation-safe transmission.

<FIG> shows a basic configuration of a method according to an example of the present disclosure. The method comprises receiving (S1) of a master information block (MIB) by a user equipment (UE) from a base station over a physical broadcast channel (PBCH). At least one system information Block (SIB) is received (S2) by the UE from the base station comprising configuration information. At least one additional SIB is received (S3) by the UE from the base station which comprises cell selection information and/or cell reselection information and/or neighbouring cell information. At least one of the additional SIBs is transmitted integrity proof. The steps S1, S2, S3 may be performed subsequently or in groups or simultaneously.

The method of secure transmission of system broadcast messages according to one example is employed in a cellular mobile communication network. In order to establish a connection between a User Equipment (UE) and a base station a Radio Resource Control (RRC) connection message may be sent by the UE. The UE may be a mobile terminal such as a mobile phone or a smart phone.

The UE receives system broadcast messages from the base station which may be arranged as blocks (System Information Block, SIB). These messages provide an overview of available mobile networks. Furthermore, information indicating which mobile communication networks are available and can be chosen for communication are transmitted (Public Land Mobile Network (PLMN) selection). Preferably, system broadcast messages may be transmitted via a system broadcast message channel of a mobile communication network.

However, these system broadcast messages are often insufficiently protected against attacks from the outside.

It is therefore advantageous to protect the system broadcast messages and the system broadcast channel of a mobile communication network, respectively via encryption functions or, in addition or alternatively, via integrity functions from manipulation. Thereby it can be ensured that the system broadcast messages of a cell of a PLMN originate from this PLMN and have not been manipulated by an invader.

In particular, it has to be ensured that the first access to a PLMN, e.g. in the case of roaming, is possible.

The system broadcast messages are logically grouped on the system broadcast channel in so-called system information blocks (SIB). For further details it is referred to the Third Generation Partnership Project (3GPP) standards TS36. <NUM> and TS38.

Table <NUM> shows a configuration of the system information structured in system information blocks (SIB) according to Release <NUM> as well as a respective interval and applicability in idle and connected state.

Therein, MIB denotes a Master Information Block with parameters essential for the communication between UE and a base station and SIB1 to SIB7 denote the respective system information blocks (SIB). Also, more or fewer blocks and/or blocks with a different configuration may be used. Table <NUM> depicts the configuration according to the above-mentioned telecommunication standards.

According to the present example, MIB, SIB1 and SIB2 are necessary for the (first) access to a LTE mobile communication network. The remaining SIBs mentioned in the example above are configurations for mobility of the UE in idle mode. Those are the SIB which may be manipulated by signal overshadowing. In order to prevent unwanted access to the configuration or a manipulation of the parameters, all blocks may be protected together, in groups or individually. In the present example, the blocks are grouped in {MIB, SIB1, SIB2} and {SIB3, <NUM>, <NUM>, <NUM>, <NUM>}. Preferably, at least one of the SIB of the second group contains mobility configuration information. However, other groupings or configurations may also be advantageous.

The present direction is specifically, but not exclusively, directed towards protecting the SIBs transmitted during mobility of the UE. Hence, {SIB3, <NUM>, <NUM>, <NUM>, <NUM>} may be protected in order to prevent a signal overshadowing attack, while the SIB necessary for connection establishment, i.e. {MIB, SIB1, SIB2} containing configuration information, may be transmitted unprotected. In other words, the integrity of particular system broadcast messages or SIBs may be ensured.

In this example, where group {SIB3, <NUM>, <NUM>, <NUM>, <NUM>} shall be protected, an access to the mobile communication network is possible as usual taking into account {MIB, SIB1, SIB2} to then communicate information relating to protection of the group {SIB3, <NUM>, <NUM>, <NUM>, <NUM>} (and further SIBs where applicable) to the UE during setup of the individual RRC connection. The respective SIBs may be protected using at least one of the following methods. In particular, an integrity proof or manipulation-safe transmission may be provided.

{SIB3, <NUM>, <NUM>, <NUM>, <NUM>} (and further SIBs where applicable) may be protected using a hash function, wherein the hash value enables a simple integrity verification of the sent SIBs. In particular, a cryptographic hash function such as the Message-Digest Algorithm <NUM> (MD5) may be employed.

A deviation of an identification sent by a hash function or a key may therefore be an indication of an attack.

Furthermore, an SIB integrity key may be employed which is used to verify the integrity of protected SIBs once being received. Therefore, a suitable integrity operation may be performed on the {SIB3, <NUM>, <NUM>, <NUM>, <NUM>} (and further SIBs where applicable). This may be done group-wise or individually for specific SIBs. Preferably, an integrity key is used for verification of the received and protected SIBs which is transmitted once a secure RRC connection is established based on the connection setup with the network to the UE. Establishment of a secure RRC connection between the network and UE for a signalling radio bearer (SRB) is a standard procedure described in 3GPP TS36. <NUM> for LTE and 3GPP TS <NUM> for NR (<NUM>).

The respective SIB may also be encrypted. In particular, {SIB3, <NUM>, <NUM>, <NUM>, <NUM>} (and further SIBs where applicable) may be encrypted using a suitable encryption operation. The key used for decryption of the received and protected SIBs is transmitted once a secure RRC connection is established based on the connection setup with the network to the UE. As above the establishment of a secure RRC connection between the network and UE for a signalling radio bearer (SRB) is a standard procedure described in 3GPP TS36. <NUM> for LTE and 3GPP TS <NUM> for NR (<NUM>).

Instead of using the secure RRC connection for transmission of the key for the above-mentioned integrity operation or encryption, the transmission may also be performed using Subscriber Identity Module (SIM) and/or Universal Integrated Circuit Card (UICC) functions.

Changes to the respective entries in SIM/UICC may e.g. be performed via Over-The-Air (OTA) functionality of said cards.

Furthermore, a pre-configuration of keys by roaming in a PLMN may be convenient.

<FIG> shows an example of the present disclosure. As described above, a group {MIB, SIB1, SIB2} is transmitted without protection. A second group {SIB3, <NUM>, <NUM>, <NUM>, <NUM>} is transmitted with integrity protection. For this purpose, a crypto function and/or a hash function may be employed to protect the respective SIB or group of SIBs. In case an integrity key and/or encryption key is used, the key may be sent by the base station (indicated by dotted lines). Furthermore, SIM or UICC functions may be employed as described above.

Preferably, at least one block comprising mobile communication network information and/or cell selection information and/or cell reselection information and/or neighbouring cell information is protected by at least one of the above-mentioned methods. This encompasses the secure, in particular manipulation-safe, transmission of configuration parameters. In other words, the integrity of system broadcast messages is ensured.

In this way, attacks on the communication may successfully be addressed. Particularly the unintended communication with fake base stations, the so-called signal overshadowing, may be prevented. Furthermore, inconsistencies may be detected and taken as an indication for an attack or manipulation.

The method may be employed for one or more SIBs and/or the MIB. Most preferably, the integrity of the SIB containing cell selection information and cell reselection information {SIB3, <NUM>, <NUM>, <NUM>, <NUM>} is ensured by the presented method.

The present disclosure also relates to a system corresponding to the method as described above. Thus, the disclosure also encompasses a system for ensuring integrity of system broadcast messages in a cellular mobile network. The system comprises receiving means configured to receive a master information block (MIB) on a user equipment (UE) from a base station. The receiving means are also configured to receive at least one system information Block (SIB) on the UE from the base station comprising configuration information and to receive at least one additional SIB on the UE from the base station comprising cell selection information and/or cell reselection information and/or neighbouring cell information. Transmitting means are configured to transmit at least one of the additional SIBs integrity proof.

The disclosure further encompasses a UE configured to perform the method described above and a base station configured to perform the method described above.

The disclosure also relates to a corresponding computer program product configured to perform the method described above and a computer-readable storage medium comprising the program product.

It will be understood that changes and modifications may be made by those of ordinary skill within the scope of the following claims.

Claim 1:
Method of ensuring integrity of system broadcast messages in a cellular mobile network, the method comprising:
receiving a master information block, MIB, by a user equipment, UE, from a base station over a physical broadcast channel, PBCH;
receiving at least one system information Block, SIB, by the UE from the base station comprising configuration information, and
receiving additional SIBs by the UE from the base station comprising cell selection information and/or cell reselection information and/or neighbouring cell information,
wherein at least one of the additional SIBs is transmitted integrity proof by the base station by performing a cryptographic hash function on at least one of the additional SIBs or groups of the additional SIBs using a key;
wherein the key is received at the UE from the base station during a establishment connection establishment between the UE and the base station; and
wherein the method further comprises using the key for verifying integrity, by the UE, of the at least one of the additional SIBs that is transmitted integrity proof.