WO2013097504A1

WO2013097504A1 - Decryption device and method for nas signalling in lte protocol monitoring and analysis

Info

Publication number: WO2013097504A1
Application number: PCT/CN2012/082089
Authority: WO
Inventors: 贾林; 刘元凯; 李春林; 朱明新; 张立; 王升平; 刘继秋
Original assignee: 北京中创信测科技股份有限公司
Priority date: 2011-12-30
Filing date: 2012-09-26
Publication date: 2013-07-04
Also published as: CN102438241A; CN102438241B

Abstract

The present invention provides a decryption device for an NAS signalling in LTE protocol monitoring and analysis, comprised of three parts: a decryption parameter extracting module for an NAS message, a decryption parameter storage and maintenance module for the NAS message, and a decryption executing module for the NAS message. By means of the technical solution in the present invention, information about the security of UE is extracted from certain messages at the S1-MME, S10 or S6a interface, and is used to establish, derive, and maintain the associated parameters required for decrypting the NAS message. The decryption operations can be performed by a protocol monitoring and analysis system on the encrypted NAS messages captured, without changing the related configuration of the LTE network or configurations of the data related to UE decryption beforehand on the LTE network protocol monitoring and analysis system.

Description

NAS signaling decryption device and method in LTE protocol monitoring and analysis

The invention belongs to the application field of communication network protocol monitoring and analysis technology. Background vein

As an evolution technology of 3G (Third Generation), LTE can not only provide higher data rate and capacity, but also provide greater coverage. It can also reduce service delay and system operation cost, which helps operators to introduce more real-time performance. High-speed business, which attracts more high-end users. Compared with the UMTS system, the network structure and protocol of the LTE system have also undergone great changes. The schematic diagram of the LTE network structure is shown in Figure 1.

The radio access part of the LTE system is composed of a node of the enhanced Node B (Enhanced Node B), and the core network part is mainly composed of a Mobi Management Management (MME), an S-GW (ServingGateway) entity, and a packet data network. The Packet Data Network Gateway (PDNGateway) entity and the Policy and Charging Rules Function (PCRF) entity are configured. The Home Subscriber Server (HSS) is a shared entity of all mobile networks. The interfaces and protocols involved in the technical solution of the present invention are as follows:

The S1-MME interface, the interface between the eNodeB entity and the 匪E entity, which transmits the S1 interface application protocol protocol (S1AP) protocol and is nested in the S1AP message. The Non-Access-Stratume (NAS) protocol message is transmitted, and the purpose of the present invention is to decrypt the NAS message transmitted on the interface.

The S10 interface is the interface between the E entities. The GTP Control Plane version 2 (GTPv2-C) protocol message is transmitted on the interface.

The S6a interface is an interface between the E entity and the HSS entity, and the Diameter protocol message is transmitted on the interface. In the LTE network system, the main function of the non-access stratum protocol NAS between the UE and the E entity is to implement mobility management, session management, and security control of the UE. Therefore, in the technical application of monitoring and analyzing the LTE network protocol, Monitoring analysis of the NAS protocol is critical. However, in the LTE network, after the UE and the E entity are securely controlled and activated and encrypted, the NAS message is encrypted and transmitted. If the monitored NAS message is not decrypted, the LTE protocol monitoring and analysis system cannot implement the NAS. The correct decoding and analysis of the message, so the main purpose of the present invention is to: capture the monitoring message from the relevant network interface, extract relevant information, and implement in the LTE network protocol monitoring and analysis system without changing the deployment and configuration of the LTE network. The captured NAS message is decrypted, so that the monitoring system correctly decodes and analyzes the NAS protocol.

Universal Mobi le Telecommunication

System, UMTS) In the network protocol monitoring and analysis system, the non-access layer protocol (GPRS Mobility Management, GMM, GPRS Session Management. GSM) message on the lub interface can be decrypted. 2 is a simplified schematic diagram of a UMTS network structure, in which a non-access stratum protocol message on a Uu interface and a lub interface is encrypted, and a non-access stratum protocol message transmitted on the Iu interface is not encrypted, in a lub interface. When the monitoring and analysis protocol is performed, the key can be directly extracted from the message on the Iu interface to decrypt the encrypted message.

Such a technical solution cannot be applied to the LTE network protocol monitoring and analysis, because the following defects exist: Since the LTE network system has a great change with respect to the UMTS network system, its network structure, interface, and protocol cannot be simply from one interface. By extracting the information, the message can be decrypted, and the LTE network system is more complete than the UMTS network system. Therefore, the existing approximation scheme cannot decrypt the encrypted message when the LTE network protocol is monitored and analyzed.

In order to overcome the above drawbacks, it is necessary to solve the following technical problems: acquisition, calculation derivation and maintenance of relevant security parameters required for decrypting NAS messages. All the security parameters needed to decrypt the NAS message are obtained from different protocol messages on multiple interfaces of the LTE network, and the necessary keys are calculated according to the relevant parameters, and some parameters are dynamically changed, so the NAS is The acquisition, calculation and maintenance of the security parameters of the message decryption are consistent with the security context (Security Context) in the UE and the MME in the LTE network.

In addition, the following technical issues need to be addressed: Specific GTPv2-C protocol on the S10 interface The security parameters in the message are analyzed and extracted, and the security parameters in the specific Diameter message on the S6a interface are analyzed and extracted, and the security parameters in the specific NAS message on the S1-MME interface are analyzed and extracted. Summary of the invention

In order to solve the above technical problem, the present invention provides a method for decrypting and processing NAS signaling in the LTE protocol monitoring and analysis, which includes the following steps:

The first step is to extract, from the S1-MME interface, the S6a interface, or the UE security related message, the decryption parameters and UE identification information required for NAS decryption;

In the second step, the NAS message decryption parameter data structure of the UE is searched or established in the NAS decryption parameter storage maintenance module by using the extracted UE identifier information, and the extracted decryption parameter is used.

The NAS message decryption parameter data structure member of the UE is assigned, and other member values of the decryption parameter data structure are derived according to the assigned parameters;

In the third step, the NAS message decryption parameter data structure of the UE is found in the NAS decryption parameter storage maintenance module by using the UE identifier corresponding to the NAS message that needs to be decrypted, and the encrypted NAS message is decrypted by using the member information in the structure.

According to one aspect of the invention, the NAS message decryption parameter data structure includes the following members: LENGTH: the length of the NAS message that needs to be decrypted, in bits;

DIRECTION: indicates the transmission direction of the decrypted NAS message, 1 bit, 0 indicates the uplink message, 1 indicates the downlink message, and specifies that the UE is in the uplink direction and 匪 E to the UE as the downlink direction;

BEARER: is a bearer ID, which is 5 bits in length. When decrypting a NAS message, the value is a constant 0;

COUNT: The count of NAS messages, which is 32 bits in length, which is divided into COUNT (UPLINK NAS COUNT) and Downstream NAS message COUNT (DOWNLINK NAS COUNT) of the uplink NAS message;

KEY: The key Knasenc used for encryption and decryption of NAS messages, which is 128 bits in length. This key needs to be calculated and derived in the context of NAS interaction.

EEA: The encryption and decryption algorithm for NAS messages is identified by the corresponding algorithm ID. The ID length is one byte, and the ID value is given in the corresponding message of the NAS interaction. According to an aspect of the present invention, a specific processing procedure for extracting a decryption parameter from a message related to UE security on an S6a interface is:

The first step is to input an Authentication Information Request message for a UE and an Authentication Information Response message pair;

In the second step, it is checked whether the E-UTRAN related authentication information of the UE is included in the Authentication Information Response of the message pair, and if not, the process ends, and the process continues;

In the third step, extracting E-UTRAN authentication information for the UE from the message, that is, extracting each authentication quaternary information;

The fourth step is to delete the content of the AuthVector array of the UE, and use the extracted

The E-UTRAN authentication vector reassigns the AuthVector array and ends the process.

According to an aspect of the present invention, the specific processing procedure for extracting decryption parameters from the UE security related message on the S10 interface is:

In the first step, enter the GTPv2-C protocol Identification Request and the Context Request and Context Response, or the Forward Relocation Request and the Forward Relocation Response message. Determining whether the message contains the UE's mobility management context information (匪Context). If not, the process ends. If yes, it determines whether the context contains the security context information (Security Context) of the UE, and if not, the process ends. Continue processing;

In the second step, the security parameters KSIASME, Number of Quadruplet, Used NAS Cipher, NAS Downl ink Count, NAS Upl ink Count, KASME parameters, and the applicable Authentication Quadruplet [0. . 4] are extracted from the current security context information. Parameter

The third step is to determine whether the UE's parameters contain a status of Current.

NAS—Decryption—Para data structure instance, if not, a new NAS-Decryption-Para data structure instance is generated. The State member in the instance is set to the Current state, and all member parameters in the instance are reset. The member is still set to the Current state; In the fourth step, the member of the Current state NAS_Decryption-Para data structure instance is assigned a parameter extracted from the current security context information, and the obtained encryption and decryption key Knasenc is calculated by using the obtained Kasme, EncryptionID and the corresponding formula;

In the fifth step, if the authentication quadruplet information of the UE is extracted from the 匪Context,

Reassigning the UE's AuthVector array instance;

In the sixth step, it is determined whether the MM Context information includes a security context whose state of the UE is Not Current, if not, the entire process is ended, and if yes, the execution continues;

In the seventh step, the old KSIASME and old KASME parameters are extracted from the MM Context information; and the eighth step is to determine whether the UE parameter has a status of Not Current.

NAS—Decryption—Para data structure instance, if no new data structure instance is generated, member state is set to Not Current state, and then all parameters in the instance are reset, and its state is still set to Not Current state;

In the ninth step, the NAS-Decryption-Para data structure instance with the status Not Current is assigned with the security context information of Not Current extracted from the MM Context, the KSI is equal to the old KSIASME, the Kasme is equal to the old KASME, and the other parameters are still Invalid value;

The tenth step ends the process.

According to an aspect of the invention, the specific processing procedure for extracting the decryption parameter from the Authentication request/response message on the S1-MME interface is:

In the first step, the authentication request and the authentication response message pair for a certain UE are input, and the RAND, AUTN, and KSIasme parameter information are extracted from the Authentication request message, and the RES parameter (Response) is extracted from the Authentication response message;

In the second step, using the extracted three parameters RAND, AUTN, and RES as key values, the corresponding authentication vector AV is searched in the AuthVector array structure of the UE, and RAND, AUTN, XRES and extracted RAND in the authentication vector. The three parameters of AUTN and RES are equal respectively; the third step is to determine whether the corresponding authentication vector AV is found, and if not found, the process ends; if found, the Kasme is extracted from the authentication vector; The fourth step is to determine whether there is a NAS-Decryption-Para data structure instance with a current status of Not Current in the current UE parameter, and no new NAS-Decryption-Para data structure instance is generated, and the State member is set to the Not Current state; Then, all members in the NAS-Decryption-Para data structure instance are recharged, and the State member is still set to the Not Current state;

In the fifth step, the NAS-Decryption-Para data structure instance of Not Current state is assigned by using the parameters extracted above, KSI is equal to the extracted KSIasme, Kasme is equal to the extracted Kasme, Upl inkNasOverf low, Upl inkNasSQN, Downl inkNasOverflow, Downl inkNasSQN Equal to 0, other members are invalid values; Step 6, end the process.

According to an aspect of the present invention, the specific processing procedure for extracting the decryption parameter from the Security mode command/complete message on the S1-MME interface is:

The first step is to input a Security mode command and a Security modecomplete message for a certain UE, and extract the NAS KSI and Type of chipering algorithm parameters from the Security mode command message, and the downlink NAS message counts Downl ink NAS SN, from Security mode complete The uplink NAS message count is extracted from the message message, and the Security modecomplete message is used to determine that the SMC process between the UE and the MME entity is successfully executed.

In the second step, the extracted NAS KSI is used to search for the corresponding NAS-Decryption-Para data structure instance in the parameters of the UE; determine whether the corresponding instance is found, and if not found, the process ends; if found, the execution continues;

The third step is to check the status of the found NAS-Decryption-Para data structure instance, and determine whether it is Current. Then, the extracted Type of chipering algorithm information is used to update the EncryptionID member in the NAS-Decryption-Para data structure instance. The extracted upl ink Nas SN updates the Upl inkNasOverf low, Upl inkNasSQN member, updates the Downl inkNasOverflow, Downl inkNasSQN member with the extracted downl ink Nas SN, and recalculates the NAS encryption/decryption key Knasenc with the corresponding formula, and ends the process; the fourth step;

The fourth step, when the NAS-Decryption-Para data structure instance found in the third step When the status is Not Current, it is determined whether the UE parameter has another NAS-Decryption-Para data structure instance whose status is Current. If there is one, the instance is deleted, and if it does not exist, the fifth step is continued;

In the fifth step, Wo II uses the Type of chipering algorithm information of the Tier to set the NAS-Decryption-Para data structure instance member EncryptionID whose status is Not Current, and calculates the member Knasenc with the corresponding formula, and the instance is State state is set to Current;

The sixth step is to end the process.

According to an aspect of the present invention, the encrypted NAS message is decrypted in the following manner: In the first step, an encrypted NAS message for a certain UE is input, that is, in the NAS message header.

The Security header type field is equal to 0010 or 0100, and the direction of the upstream and downstream of the NAS message;

In the second step, it is determined whether the current UE parameter contains a NAS-Decryption-Para data structure instance with a status of Current. If it does not exist, the process ends directly; if yes, the process continues.

The third step is to calculate the length of the encrypted portion of the input NAS message; extract the SN parameter in the NAS message header, and use the input NAS message uplink and downlink information to the Current state of the NAS-Decryption-Para data structure instance. The message count is related to the member assignment; the NAS Count is calculated using the corresponding formula;

The fourth step is to use the NAS_Decryption-Para data structure instance in the Current state, Knasenc, the length of the NAS message encryption part, the calculated NAS Count, the input NAS message uplink and downlink information, and the current state of the NAS-Decryption-Para data. The algorithm specified by EncryptionID in the structure instance calculates the key stream KEY STREAM;

In the fifth step, the calculated key stream KEY STREAM and the encrypted portion of the NAS message are subjected to a bitwise exclusive OR operation to complete the decryption of the encrypted portion of the NAS message, and input the decrypted NAS message plaintext;

The sixth step ends the decryption process.

The present invention also provides a device for decrypting and processing NAS signaling in the LTE protocol monitoring and analysis, including: The NAS message decryption parameter extraction module is configured to extract parameters and UE identification information required for NAS decryption from the NAS message related to the UE security on the S1-匪E interface, and extract the NAS from the diameter message related to the UE security on the S6a interface. Decrypting required parameters and UE identification information, or extracting parameters and UE identification information required for NAS decryption from a GTPv2-C message related to UE security on the S10 interface;

The NAS message decryption parameter storage maintenance module is configured to perform storage and maintenance on the input NAS message decryption parameter, and derivate and calculate other NAS decryption parameters according to relevant parameters;

The NAS message decryption execution module is configured to implement decryption of the input encrypted NAS message according to the parameter output from the NAS decryption parameter storage maintenance module and the parameter information of the encrypted NAS message itself.

Through the technical solution of the present invention, information related to UE security is extracted from a specific message on the S1_MME, S10, or S6a interface, and used to establish, derive, and maintain related parameters such as a key necessary for decrypting the NAS message. The protocol monitoring and analysis system can decrypt the captured encrypted NAS message without changing the relevant configuration of the LTE network and pre-configuring the LTE network protocol monitoring and analysis system with the UE decryption-related data. In addition, in the present invention, the data structure of the UE decryption parameter is also designed, and there are at most two instances of the data structure corresponding to each UE, which are divided into two states. The operation of the decryption parameter in the solution and the operation of the NAS message decryption process to decrypt the parameter data structure of the UE can realize the synchronization of the information in the decryption parameter data structure with the security context information in the UE and the E entity in the LTE network, thereby ensuring The protocol monitors and analyzes the correct decryption of NAS messages. DRAWINGS

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. FIG. 1 is a structural diagram of an LTE network;

Figure 2 is a schematic diagram showing the structure of a UMTS network;

Figure 3 is a block diagram showing the structure of the NAS message decryption device;

Figure 4 shows the processing steps of the NAS message decryption method;

Figure 5 shows the process of processing the Authentication Information Request/Response message; Figure 6 shows the process of related GTPv2-C message processing;

Figure 7 shows the Authentication request/response message processing; Figure 8 shows the Security mode command/complete message processing; Figure 9 shows the NAS message decryption process. With ^ TOfcW

In the LTE protocol monitoring and analysis, the technical solution can implement the decryption function of the NAS message exchanged between the captured mobile terminal UE and the 匪E entity, and the NAS message includes all encrypted NAS messages in the uplink and downlink directions.

As shown in Fig. 3, the portion in the block is a structural diagram of the device of the present invention. The block part describes the block diagram of the NAS message decryption device, and the part outside the block is the LTE network structure diagram. The arrows in the figure describe the input and output of the device and the component modules of the present invention.

The NAS message decryption device is composed of three parts: a NAS message decryption parameter extraction module, a NAS message decryption parameter storage maintenance module, and a NAS message decryption execution module. Among them, the functions realized by each component are as follows:

The NAS message decryption parameter extraction module is configured to extract parameters and UE identification information required for NAS decryption from the NAS message related to UE security on the S1-匪E interface, and extract the NAS from the diameter message related to the UE security on the S6a interface. Decrypting required parameters and UE identification information, or extracting parameters and UE identification information required for NAS decryption from the GTPv2-C message related to UE security on the S10 interface.

The NAS message decryption parameter storage maintenance module is configured to store and maintain the input NAS message decryption parameters, and derive other NAS decryption parameters according to relevant parameters.

The NAS message decryption execution module: decrypts the input encrypted NAS message according to the parameter output from the NAS decryption parameter storage maintenance module and the parameter information of the encrypted NAS message itself.

Figure 4 shows the method of decrypting an encrypted NAS message, which mainly includes three major steps:

1) Extract parameters and UE identification information required for NAS decryption from the UE-related security messages on the S1-MME interface, the S6a interface, or the S10 interface.

2) Using the UE identification information outputted in step 1 in the NAS decryption parameter storage maintenance module The NAS message decryption parameter data structure of the UE is found or established, and the NAS message decryption parameter data structure member of the UE is assigned with the decryption parameter outputted in step 1, and other member values of the decryption parameter data structure are derived according to the relevant parameters.

3) Using the UE identifier corresponding to the NAS message that needs to be decrypted, the NAS message decryption parameter data structure of the UE is found in the NAS decryption parameter storage maintenance module, and the encrypted NAS message is decrypted by using the member information in the structure.

The parameters for decrypting the NAS protocol message in the LTE system are not fixed, but dynamically change with the interaction of the NAS signaling. Therefore, the corresponding data structure is required to record the parameters required for the NAS protocol decryption in real time.

The parameters required to decrypt the NAS protocol and the corresponding data structures to be stored are as follows:

LENGTH: the length of the NAS message that needs to be decrypted, in bits;

EEA: The encryption and decryption algorithm for NAS messages is identified by the corresponding algorithm ID. The ID length is one byte. The ID value is given in the corresponding message of the NAS interaction.

Among the above input parameters, BEARER is a constant, LENGTH, DIRECTION are directly obtained from the corresponding encrypted NAS message, the EEA ID is given by the corresponding NAS message, and COUNT and KEY need to be derived from the corresponding data, and the derivation is calculated as follows:

COUNT : = 0x00 I NAS OVERFLOW | | NAS SQN (1) In the formula (1), NAS SQN is the last 8 bits of COUNT, and this value is transmitted in each NAS message; NAS OVERFLOW is COUNT intermediate 16 bits, when NAS When the SQN value accumulates overflow, NAS OVERFLOW is incremented by 1. Knasenc=f (Kasme, 0x15 | 0x01 1 0x0001 1 algorithmic! (AES/SNOW) | 0x0 001) (2)

In the formula (2), f is a key derivation function KDF (KEY DERIVED FUNCTION), Kasme is a derived key of Knasenc, and the length is 256 bits, which is generated by the HSS entity and transmitted in the authentication vector AV (AUTHENTICATION VECTOR); Algorithmic! is the ID of the encryption and decryption algorithm EEA used.

The above parameters for decrypting the NAS message, the NAS message decryption parameter storage structure in the present invention is described in C++ as follows:

Struct NAS—Decryption—Para {

Int KSI;

Int State;

Unsigned char Kasme [32];

Int EncryptionlD;

Unsigned char Knasenc [16];

Int Up 1 i nkNasOver f 1 ow;

Int UplinkNasSQN;

Int Down 1 i nkNasOver f 1 ow;

Int Downl inkNasSQN;

};

The KSI is a security context identifier associated with the UE in the LTE. Each Kasme is uniquely associated by a KSI. The value is allocated by 匪E and transmitted in the NAS message. The state is the state of the UE security context. Status, CURRENT and NOT CURRENT; EncryptionlD is the ID of the port decryption algorithm; UplinkNasOverf low, UplinkNasSQN, DownlinkNasOverf low, DownlinkNasSQN are the components of the uplink and downlink NAS COUNT respectively.

In use, the parameter data structure corresponds to the security context of the UE in LTE, and is also uniquely identified by the KSI. For each UE, there are two instances of the data structure, one corresponding to the security context of the CURRENT state, and one corresponding to the NOT CURRENT. The security context of the state.

An authentication vector AV (AUTHENTICATION) for authenticating the UE for record keeping VECTOR), its data storage structure is as follows (C++ language description):

Struct NAS—AV {

Unsigned char Kasme [32];

Unsigned char RAND port;

Unsigned char AUTN [];

Unsigned char XRES [];

};

NAS—AV AuthVector [];

The AuthVector is an array of multiple authentication vectors AV.

In use, there is one AuthVector array structure corresponding to each UE, and the authentication vector information extracted from the diameter and GTPv2_C messages for the UE is stored.

The process of extracting and maintaining the NAS message decryption parameters is mainly: extracting the decryption parameter information from the UE security related messages on the S1_MME, S10, and S6a interfaces, and completing the storage, derivation, and maintenance operations of the NAS decryption parameters. The extraction and maintenance processing of the decryption parameters are different for different messages on different interfaces. The following describes the interface as a unit.

1. Extract the decryption parameters from the UE security-related messages on the S6a interface.

The process extracts the authentication vector information for the UE from the diameter message. The message related to the UE security on the S6a interface is the Authentication Information Request and the Authentication Information Response message of the Diameter protocol.

The specific process is shown in Figure 5:

In the third step, extracting E-UTRAN authentication information for the UE from the message, that is, extracting each authentication quaternary information; In the fourth step, the content of the AuthVector array of the UE is deleted, and the AuthVector array is re-assigned with the extracted E-UTRAN authentication vector, and the process ends.

2. Extract the decryption parameters from the UE security related message on the S10 interface.

The process extracts the security context information (Security Context) about the UE from the GTPv2-C protocol message. The GTPv2_C protocol messages related to UE security on the S10 interface are the Identification Request and the Identification Response message, the Context Request and the Context Response message, the Forward Relocation Request, and the Forward Relocation Response message.

The specific process is shown in Figure 6:

In the third step, it is determined whether the parameter of the UE contains a NAS-Decryption-Para data structure instance with a status of Current. If not, a new NAS-Decryption-Para data structure instance is generated, and the State member in the instance is set to the Current state. Then all the member parameters in the instance are reset, and the State member is still set to the Current state;

In the fourth step, the current state NAS_Decryption-Para data structure instance is assigned a member by using parameters extracted from the current security context information, and the obtained encryption and decryption key Knasenc is calculated by using the obtained Kasme, EncryptionID and formula 2;

In the fifth step, if the authentication quadruplet information of the UE is extracted from the 匪Context, Reassign the UE's AuthVector array instance;

In the seventh step, the old KSIASME, old KASME parameter is extracted from the MM Context information; and the eighth step is to determine whether the UE parameter contains a NAS-Decryption-Para data structure instance with a status of Not Current, and no new data structure instance is generated. , the member State is set to the Not Current state, and then all the parameters in the instance are reset, and the State is still set to the Not Current state;

The tenth step ends the process;

3. Extracting the decryption parameters from the UE security related messages on the S1-MME interface. The process extracts the UE security parameters from the NAS messages. The NAS messages related to the UE security information on the S1-MME interface include an Authentication request and an Authentication response message, a Security mode command, and a Security mode complete message. The two pairs of messages contain different security information and roles, and the following describes their processing.

1) The Authentication request/response message has been processed

The specific process description is shown in Figure 7:

In the first step, enter the Authentication request and Authentication response message pairs for a certain UE. The RAND, AUTN, and KSIasme parameter information is extracted from the Authentication request message, and the RES parameter (Response) is extracted from the Authentication response message.

In the second step, using the extracted three parameters RAND, AUTN, and RES as key values, the corresponding authentication vector AV is searched in the AuthVector array structure of the UE, and RAND, AUTN, XRES and extracted RAND in the authentication vector. , AUTN, RES three parameters are equal. In the third step, it is judged whether the corresponding authentication vector AV is found, and if it is not found, the process ends, and when found, the Kasme is extracted from the authentication vector.

The fourth step is to determine whether there is a NAS-Decryption-Para data structure instance with a current status of Not Current in the current UE parameter, and no new NAS-Decryption-Para data structure instance is generated, and the State member is set to the Not Current state; Then, all members in the NAS-Decryption-Para data structure instance are recharged, and the State member is still set to the Not Current state;

In the fifth step, the NAS-Decryption-Para data structure instance of Not Current state is assigned by using the parameters extracted above, KSI is equal to the extracted KSIasme, Kasme is equal to the extracted Kasme, Upl inkNasOverf low, Upl inkNasSQN, Downl inkNasOverflow, Downl inkNasSQN Equal to 0, other members are invalid.

The sixth step, the end process;

2) Processed the Security mode command/complete message

The specific process description is shown in Figure 8:

The first step is to input the Security mode command and the Security modecomplete message for a certain UE, and the NAS KSI and Type of chipering algorithm parameters are extracted from the Security mode command message, and the downlink NAS message counts Downl ink NAS SN, from Security. The modecomplete message message extracts the uplink NAS message count Upl ink NAS SN, and the Security modecomplete message determines that the SMC process between the UE and the MME entity is successfully executed.

In the second step, the extracted NAS KSI is used to search for the corresponding NAS-Decryption-Para data structure instance in the UE parameters; determine whether the corresponding instance is found, and if not found, the process ends, and the process continues to be found.

The third step is to check the status of the found NAS-Decryption-Para data structure instance, and determine whether it is Current. Then, the extracted Type of chipering algorithm information is used to update the EncryptionID member in the NAS-Decryption-Para data structure instance. The extracted upl ink Nas SN updates the Upl inkNasOverf low, Upl inkNasSQN member, updates the Downl inkNasOverflow, Downl inkNasSQN member with the extracted downl ink Nas SN, and recalculates the NAS encryption/decryption key Knasenc with the formula 2, ending the process; Then proceed to the fourth step.

In the fourth step, when the state of the NAS-Decryption-Para data structure instance found in the third step is Not Current, it is determined whether the UE parameter has another NAS-Decryption-Para data structure instance whose status is Current, and the existence is deleted. Example, if it does not exist, continue to the fifth step.

In the fifth step, Wo II uses the Type of chipering algorithm information of the ear to set the NAS-Decryption-Para data structure instance member EncryptionID whose status is Not Current, and calculates the member Knasenc by using Equation 2, and will State State is set to Current

The sixth step is to end the process.

The process of decrypting the encrypted NAS message is mainly to calculate the key code stream by using the information extracted from the NAS message and the member information in the NAS-Decryption-Para data structure instance of the current state to decrypt the encrypted NAS message.

The specific process description is shown in Figure 9:

The first step is to input an encrypted NAS message for a certain UE, that is, in the NAS header.

The Security header type field is equal to 0010 or 0100, and the direction of the upstream and downstream of the NAS message.

The third step is to calculate the length of the encrypted portion of the input NAS message; extract the SN parameter in the NAS message header, and use the input NAS message uplink and downlink information to the Current state of the NAS-Decryption-Para data structure instance. Message count related member assignment; Calculate NAS Count using Equation 1;

The fourth step is to use the NAS_Decryption-Para data structure instance in the Current state, Knasenc, the length of the NAS message encryption part, the calculated NAS Count, the input NAS message uplink and downlink information, and the current state of the NAS-Decryption-Para data. The algorithm specified by EncryptionID in the structure instance calculates the key stream KEY STREAM.

The fifth step is to use the calculated key stream KEY STREAM and the encrypted part of the NAS message. The row is XORed to complete the decryption of the encrypted portion of the NAS message, and the plaintext of the decrypted NAS message is input.

The sixth step ends the decryption process.

It should be understood by those skilled in the art that the method and apparatus of the present invention may be implemented by hardware, software, or a combination of hardware and software, by a microprocessor, a digital signal processor, a field programmable logic unit, or a gate array. Ways to achieve.

In summary, although the invention has been disclosed above in the preferred embodiments, it is not intended to limit the invention. Various changes and modifications can be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, the scope of the invention is defined by the scope of the appended claims.

Claims

Claim

A method for decrypting a transmission non-access stratum (NAS) signaling in the LTE protocol monitoring and analysis, characterized in that the method comprises the following steps:

In the second step, the NAS message decryption parameter data structure of the UE is searched or established in the NAS decryption parameter storage maintenance module by using the extracted UE identification information, and the NAS decryption parameter data structure member of the UE is assigned with the extracted decryption parameter. And deriving other member values of the decryption parameter data structure according to the assigned parameters;

2. The method of claim 1 wherein the NAS message decryption parameter data structure comprises the following members:

Length (LENGTH): The length of the NAS message that needs to be decrypted, in bits; Direction (DIRECTION): Indicates the transmission direction of this decrypted NAS message, 1 bit, 0 means uplink message, 1 means downlink message, specifies UE to 匪E is the uplink direction, and 匪E to the UE is the downlink direction;

Bearer (BEARER): is a bearer ID, which is 5 bits in length. When decrypting a NAS message, the value is a constant 0;

Count (COUNT): The count of NAS messages, which is 32 bits in length, which is divided into COUNT for upstream NAS messages and COUNT for downstream NAS messages;

Key (KEY): The key Knasenc used for encryption and decryption of NAS messages, with a length of 128 bits. This key needs to be calculated and derived in the context of NAS interaction;

Encryption and Decryption Algorithm (EEA): The encryption and decryption algorithm for NAS messages, identified by the corresponding algorithm ID, with an ID length of one byte, which is given in the corresponding message of the NAS interaction.

3. The method according to claim 1, wherein the specific processing for extracting the decryption parameter from the UE security related message on the S6a interface is: The first step is to input an Authentication Information Request (Authentication Information Request) and an Authentication Information Response message pair for a certain UE;

In the second step, it is determined whether the E-UTRAN related authentication information of the UE is included in the authentication information response of the message pair, and if not, the process ends; otherwise, the execution continues;

In the third step, the E-UTRAN authentication information for the UE is extracted from the message, that is, each authentication quaternary information is extracted;

In the fourth step, the content of the authentication vector array of the UE is deleted, and the extracted E-UTRAN authentication vector is used to re-assign the authentication vector array, and the process ends.

The method according to claim 1, wherein the specific processing for extracting the decryption parameter from the UE security related message on the S10 interface is:

The first step is to input the GTPv2-C protocol identification request related to the UE security, and identify the Identification Response, or the context request (Context Request) and the context response (Context Response), or Forwarding a Relocation Request (Forward Relocation Request) and forwarding a Forward Relocation Response message, determining whether the message contains the UE's mobility management context information (匪Context), and if not, ending the process, otherwise further determining the mobile Whether the management context information contains the security context information (Security Context) of the state of the UE, and if not, the process ends; otherwise, the processing continues;

The second step is to extract the security parameter KSIASME from the current security context information.

Number of Quadruplet, Used NAS Cipher, NAS Downl ink Count, NAS Upl ink Count, KASME parameters, and optional Authentication Quadruplet [0. . 4] parameters;

In the third step, it is determined whether the parameter of the UE contains a NAS-Decryption-Para data structure instance with a status of Current. If not, a new NAS-Decryption-Para data structure instance is generated, where the state member of the instance is set. The Current state, if any, resets all member parameters in the instance, where the state member is still set to the Current state;

The fourth step is to use the parameters extracted from Current's security context information for the Current. State NAS - Decryption - Para data structure instance for member assignment, and use the resulting Kasme, EncryptionID, Wo lj formula

Knasenc=f (Kasme, 0x15 | 0x01 1 0x0001 1 algorithmic! (AES/SN0W) | 0x0

001)

Calculate the encryption and decryption key Knasenc , where f is the key derivation function KDF (KEY

DERIVED FUNCTION), Kasme is Knasenc's derived key, which is 256 bits long, generated by the HSS entity, transmitted in the authentication vector AV (AUTHENTICATION VECTOR), and algorithmic! is the ID of the used encryption and decryption algorithm EEA;

In the fifth step, if the authentication quaternary letter of the UE is extracted from the mobility management context information

[0. . 4] Re-assigning an instance of the UE's authentication vector array;

In the sixth step, it is determined whether the mobility management context information includes a security context in which the UE status is Not Current, and if not, the entire process is terminated; otherwise, the next step is continued; Step 7: Extracting old KSIASME, old KASME from the mobility management context information Parameter

In the eighth step, determining whether the UE parameter includes a NAS-Decryption-Para data structure instance with a status of Not Current, if not, newly generating an instance of the data structure, and setting the State member to a Not Current state, if any, All parameters in the instance are reset, and their State members are still set to the Not Current state;

In the ninth step, the NAS-Decryption-Para data structure instance with the status Not Current is assigned with the security context information of Not Current extracted from the mobility management context information, the KSI is equal to the old KSIASME, the Kasme is equal to the old KASME, and the other parameters are Still invalid value;

The tenth step ends the process.

The method according to claim 1, wherein the specific processing of extracting the decryption parameter from the authentication request/response message on the S1-MME interface is:

In the first step, an authentication request and an authentication response message pair for a certain UE are input, and the authentication request message is extracted from the authentication request message. RAND, AUTN, KSIasme parameter information, extracting the RES parameter (Response) from the authentication response message;

In the second step, using the extracted three parameters RAND, AUTN, and RES as key values, the corresponding authentication vector AV is searched in the authentication vector array structure of the UE, and RAND, AUTN, XRES and extraction in the authentication vector are extracted. The three parameters of RAND, AUTN, and RES are equal;

The third step is to determine whether the corresponding authentication vector AV is found, and if not, the process ends; otherwise, the Kasme is extracted from the authentication vector;

The fourth step is to determine whether there is a NAS-Decryption-Para data structure instance with a current status of Not Current in the current UE parameter. If not, a new NAS-Decryption-Para data structure instance is generated, and the State member is set to a Not Current state; Otherwise, all members in the NAS-Decryption-Para data structure instance are recharged, and the State member is set to the Not Current state;

The method according to claim 1, wherein the specific processing of extracting the decryption parameter from the security mode command/complete message on the S1-MME interface is:

The first step is to input a security mode command and a security mode complete message for a certain UE, and extract a NAS KSI, a Type of chipering algorithm parameter, and a downlink NAS message count from the security mode command message. The downlink NAS message SN is extracted from the security mode completion message, and the security mode completion message is used to determine that the SMC process between the UE and the 匪E entity is successfully executed.

In the second step, the extracted NAS KSI is used to search for the corresponding NAS-Decryption-Para data structure instance in the parameters of the UE; determine whether the corresponding instance is found, and if not, terminate the process; otherwise, continue to perform the next step; The third step is to check the status of the found NAS-Decryption-Para data structure instance, and determine whether it is Current. If yes, update the EncryptionID member in the NAS-Decryption-Para data structure instance with the extracted Type of chipering algorithm information. Update the Upl inkNasOverf low, Upl inkNasSQN member with the extracted upl ink Nas SN, and update the Downl inkNasOverf low, Downl inkNasSQN members with the extracted downl ink Nas SN, and use the formula

Knasenc=f (Kasme, 0x15 | 0x01 1 0x0001 1 algorithmic! (AES/SN0W) | 0x0

001)

Recalculating the NAS encryption/decryption key Knasenc, ending the process; otherwise, performing the fourth step; Fourth, when the state of the NAS-Decryption-Para data structure instance found in the third step is Not Current, determining whether the UE parameter exists The other state is the Current NAS-Decryption-Para data structure instance, if it exists, delete the instance, otherwise continue to the fifth step;

In the fifth step, Wo II uses the Type of chipering algorithm information of the Tier to set the NAS-Decryption-Para data structure instance member EncryptionID whose status is Not Current, and calculates the member Knasenc by the above formula, and will State State is set to Current;

The sixth step is to end the process.

7. The method according to claim 1, wherein the decrypting the encrypted NAS message is as follows:

The first step is to input an encrypted NAS message for a UE, that is, the Security header type field in the NAS header is equal to 0010 or 0100, and the uplink and downlink direction of the NAS message;

In the second step, it is determined whether the current parameter of the UE contains a NAS-Decryption-Para data structure instance with a status of Current, and if not, the process is directly terminated; otherwise, the next step is continued;

The third step is to calculate the length of the encrypted part (Length) for the input NAS message; extract the SN parameter in the NAS message header, and use the input NAS message uplink and downlink information to the Current state of the NAS-Decryption-Para data structure instance. The message count in the relevant member assignment; Using formula

COUNT : = 0x00 I I NAS OVERFLOW | | NAS SQN

Calculate the NAS Count, where NAS SQN is the last 8 bits of COUNT, the value is transmitted in each NAS message, and NAS OVERFLOW is the middle 16 bits of COUNT. When the NAS SQN value overflows, NAS OVERFLOW is incremented by 1;

The sixth step ends the decryption process.

8. A device for decrypting and processing NAS signaling in the LTE protocol monitoring and analysis, characterized in that:

The NAS message decryption parameter extraction module is configured to extract parameters and UE identification information required for NAS decryption from the NAS message related to the UE security on the S1-匪E interface, and extract the NAS from the diameter message related to the UE security on the S6a interface. Decrypting required parameters and UE identification information, or extracting parameters and UE identification information required for NAS decryption from a GTPv2-C message related to UE security on the S10 interface;