JP2013255239A - Nas security processing apparatus, nas security processing method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To handle a NAS security context depending on whether handover between different types of networks is successful or not.SOLUTION: If UE 1 has succeeded in the handover between different types of networks, a processing unit 13 records a NAS security context generated by a generating unit 12 in a storage unit 11. If the UE 1 has failed in the handover between the different types of networks, the processing unit 13 discards the NAS security context generated by the generating unit 12. A message protecting unit 14 executes a security protecting process of a NAS message using the NAS security context stored in the storage unit 11.

Description

  The present invention relates to a NAS security processing device, a NAS security processing method, and a program that are provided in a mobile terminal and process security in communication in a non-access stratum (NAS).

  In 3GPP (Third Generation Partnership Project), as a standard of LTE (Long Term Evolution), a new technology, structure, and method for improving frequency efficiency, speeding up, and cost reduction of services are examined. As one of the processes, LTE is considering using a different security structure from conventional networks (for example, UMTS (Universal Mobile Telecommunications System), GSM (Global System for Mobile Communications) (registered trademark)).

Specifically, in LTE, NAS in communication between MME (core network node: Mobile Management Entity) and UE (mobile terminal: User Equipment), and eNB (radio base station: eNode B) and UE It has been studied to use different security contexts for the AS that handles communication between them. That is, NAS security is terminated at the MME, and AS security is terminated at the eNB.

In LTE, it is considered to hierarchize security contexts. Specifically, the security context is hierarchized according to the following procedure.
The UE and AuC (Authentication Center) share key information in advance and perform AKA (Authentication Key Agreement), whereby the key is shared between the UE and the MME. And UE and MME generate | occur | produce the NAS security context used for NAS security from the shared key. Next, UE and eNB generate | occur | produce AS security context used for AS security using NAS security context which UE and MME hold | maintain. Note that since a one-way function is used to generate the NAS security context and the AS security context, the key information cannot be reproduced from the NAS security context, and the NAS security context cannot be reproduced from the AS security context. Can not.

  Thereby, even if the attacker acquires the AS security context from the eNB, the attacker cannot identify the NAS security context, and thus can prevent the attacker from intercepting the NAS communication. This is because there is a high possibility that the eNB that holds the AS security context exists in a place that is susceptible to damage (for example, Home BS), which is considered to be a security risk.

  Further, Non-Patent Document 1 describes a NAS security linkage process in a handover between different networks (inter RAT change). The handover between different networks is a process of performing handover between networks using different RATs (Radio Access Technology). For example, handover is performed between UTRAN (UMTS Terrestrial Radio Access Network) and E-UTRAN (Evolved UTRAN). It is.

3GPP TS 33.401 V9.1.0 “3GPP System Architecture Evolution; Security Architecture”

  However, in LTE, handling of a NAS security context when handover between different networks fails is not stipulated.

  The present invention has been made to solve the above problems. According to an aspect of the present invention, there is provided a NAS security processing apparatus that is provided in a mobile terminal and processes security in non-access layer (NAS) communication. The NAS security processing device includes a storage unit that stores a security context used for security protection in a network to which the mobile terminal is connected, and a handover destination network when the mobile terminal performs a handover between different networks. A generating unit that generates a new security context to be used in the network, and when the mobile terminal has succeeded in handover between different networks, the security context generated by the generating unit is recorded in the storage unit, and the mobile unit When a terminal fails in handover between different networks, a processing unit that discards the security context generated by the generation unit, and a security context that the storage unit stores There are a message protection unit that performs secure processing to the NAS message, the message protection unit characterized in that it comprises a transmitter which transmits the NAS message was security processing.

  According to another aspect of the present invention, the mobile terminal is provided with a storage unit for storing a security context used for security protection in a network to which the mobile terminal is connected, and security in non-access layer (NAS) communication is provided. There is provided a NAS security processing method using a security processing device for processing the above. The NAS security processing method includes: a step of generating a new security context to be used in a handover destination network when the mobile terminal performs handover between different types of networks by the generation unit; When handover between different networks is successful, the security context generated by the generation unit is recorded in the storage unit, and when the mobile terminal fails in handover between different networks, the security context generated by the generation unit is discarded. The message protection unit performs security processing on the NAS message using the security context stored in the storage unit, and the message protection unit performs security processing on the transmission unit. NAS message There and having a step to be transmitted.

  According to still another aspect of the present invention, a NAS security processing device that is provided in a mobile terminal and processes security in non-access layer (NAS) communication is used for security protection in a network to which the mobile terminal is connected. A storage unit that stores a security context, a generation unit that generates a new security context used in a handover destination network when the mobile terminal performs a handover between different networks, and a case where the mobile terminal succeeds in a handover between different networks A processing unit that records the security context generated by the generation unit in the storage unit, and discards the security context generated by the generation unit when the mobile terminal fails in handover between different types of networks, and the storage unit Memorize A message protection unit that performs security processing on a NAS message using a utility context and a program for causing the message protection unit to function as a transmission unit that transmits a NAS message subjected to security processing are provided. .

According to each aspect of the present invention, the processing unit records the NAS security context generated by the generation unit in the storage unit when the mobile terminal succeeds in the handover between different networks.
Further, the processing unit discards the NAS security context generated by the generation unit when the mobile terminal fails in the handover between different networks. In addition, the message protection unit performs security protection processing on the NAS message using the NAS security context stored in the storage unit. Thereby, the NAS security processing device can handle the NAS security context according to the success or failure of the handover between different networks.

It is a schematic block diagram which shows the structure of UE provided with the NAS security processing apparatus by one Embodiment of this invention. It is a flowchart which shows operation | movement of a NAS security processing apparatus.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a schematic block diagram illustrating a configuration of a UE including a NAS security processing device according to an embodiment of the present invention.
The UE 1 includes a NAS security processing device 10, an EMM (EPS Mobility Management) 20, and an ESM (EPS Session Management) 30.
The NAS security processing device 10 is provided in the UE and performs security processing in NAS communication.
The EMM 20 and the ESM 30 generate a NAS message and perform processing on the NAS message received by the UE1.

  The NAS security processing device 10 includes a storage unit 11, a generation unit 12, a processing unit 13, a message protection unit 14, and a communication unit 15 (transmission unit).

The storage unit 11 stores a security context table that stores the NAS security context, protection type information (security type IE (Information Element)), and protection state information (security state IE). Here, the security context table stores a NAS security context, which is key information used for security protection in the connected NAS network, and a current flag indicating whether or not the NAS security context is current. It is a table. The protection type information is information indicating the type of security protection (whether encryption is performed or integrity is guaranteed) applied in the connection destination network. The protection state information is information indicating a currently activated state (current activated state).
The generation unit 12 generates a new NAS security context to be used in the handover destination network when the UE 1 executes handover between different networks.
The processing unit 13 processes the NAS security context generated by the generating unit 12 based on the success / failure of the handover between different networks. The processing unit 13 processes the protection type information and the protection state information stored in the storage unit 11.
The message protection unit 14 acquires all NAS messages from the EMM 20 and the ESM 30, and performs security processing on the NAS message using the NAS security context stored in the storage unit 11.
The communication unit 15 connects to an EPS (Evolved Packet System) AS and receives an AS message. In addition, the communication unit 15 transmits the NAS message that has been subjected to the security protection process by the message protection unit 14 to the core network.

With such a configuration, the processing unit 13 of the NAS security processing device 10 validates the NAS security context generated by the generating unit 12 when the UE 1 succeeds in the handover between different networks. In addition, the NAS security processing device 10 handles the NAS security context used before the handover between different networks and during the handover between different networks.
The message protection unit 14 determines whether or not it is necessary to guarantee the integrity and / or encrypt the NAS message. The message protection unit 14 performs protection settings related to the parameters of the NAS message.
Further, the NAS security processing device 10 handles a process when a potential failure in the AS, that is, a failure of handover between different networks occurs.

Next, the operation of the NAS security processing apparatus 10 will be described.
FIG. 2 is a flowchart showing the operation of the NAS security processing apparatus.
Here, a case where UE1 performs handover from UTRAN to E-UTRAN will be described as an example.
First, the generation unit 12 of the NAS security processing device 10 determines whether or not UE1 including the own device has started handover between different networks (step S1). When it is determined that the UE 1 has not started the handover between different types of networks (step S1: NO), the generation unit 12 waits until the UE 1 starts the handover between different types of networks.

When determining that the UE 1 has started handover between different networks (step S1: YES), the generation unit 12 generates a new NAS security context to be used in the handover destination network based on the UMTS security context (step S2). .
If the production | generation part 12 produces | generates NAS security context, the communication part 15 will receive the notification which shows the success or failure of inter-heterogeneous network handover from EPS AS (step S3). Next, the processing unit 13 determines whether or not the notification received by the communication unit 15 indicates that the handover between different types of networks is successful (step S4).

  When the processing unit 13 determines that the received notification indicates that the handover between different networks has succeeded (step S4: YES), the processing unit 13 records the NAS security context generated by the generation unit 12 in the storage unit 11 (step S5). . Next, the processing unit 13 reads a current flag indicating “current” from the storage unit 11, and rewrites the current flag to “non-current” (step S6). Next, the processing unit 13 records a current flag indicating “current” in the storage unit 11 in association with the NAS security context recorded in step S5 (step S7). Further, the processing unit 13 rewrites the protection status information in the storage unit 11 to “LTE-mapped-active” (step S8).

When the processing unit 13 records a new NAS security context in the storage unit 11, the processing unit 13 reads out the type of protection used in communication of subsequent NAS messages from the core network via the communication unit 15. Then, the processing unit 13 rewrites the protection type information in the storage unit 11 with information indicating the protection type (step S9).
As described above, when the UE 1 succeeds in handover between different networks, the NAS security processing device 10 changes the protection state information and protection type information stored in the storage unit 11 to the protection state information and protection type currently valid. Rewrite information.

  In the handover from UTRAN to E-UTRAN, the first NAS message transmitted from UE1 is a TAU (Track Area Update) request. The processing unit 13 sets all parameters of the TAU message. As a result, the message protection unit 14 stores the NAS security context stored in association with the current flag indicating “current” in the storage unit 11, the protection status information stored in the storage unit 11, and the protection type information stored in the storage unit 11. Based on this, the TAU request is protected, and the communication unit 15 transmits the TAU request.

  On the other hand, when the processing unit 13 determines that the notification received in step S3 indicates that the handover between different networks has failed (step S4: NO), the NA security context generated by the generation unit 12 is recorded in the storage unit 11. It discards without doing (step S10). That is, the NAS security context that was used before the handover between different networks is continuously used. At this time, neither the protection state information nor the protection type information is updated.

  Then, when the protection unit information is recorded in the storage unit 11 in step S9 or the NAS security context is discarded in step S10, the processing unit 13 performs processing from the outside by an operation of the UE 1 or interruption processing by a user or the like. It is determined whether an end request has been input (step S11). When determining that the termination request is not input from the outside (step S11: NO), the processing unit 13 returns to step S1 and starts detecting a handover between different types of networks. On the other hand, when it determines with the process part 13 having input the termination request | requirement from the outside (step S11: YES), a process is complete | finished.

  Thus, according to the present embodiment, the processing unit 13 records the NAS security context generated by the generation unit 12 in the storage unit 11 when the UE 1 succeeds in the handover between different networks. Further, the processing unit 13 discards the NAS security context generated by the generating unit 12 when the UE 1 fails in handover between different networks. Then, the message protection unit 14 performs security protection processing on the NAS message using the NAS security context stored in the storage unit 11. As a result, the NAS security processing device 10 can handle the NAS security context according to the success or failure of the handover between different networks. That is, it is possible to clarify how to handle the NAS security context when a handover between heterogeneous networks not specified by 3GPP fails.

  As a special case, the communication unit 15 may receive a notification indicating the success of handover between different networks in step S3, and then lose the RRC (Radio Resource Control) connection. Assuming that the handover has succeeded, the NAS security context generated by the generation unit 12 in step S2 is used as the “current” one.

  Further, since the storage unit 11 stores the protection state information and the protection type information, it becomes easy to know what state the NAS of the UE 1 is in. When transmitting a NAS message, UE1 needs to determine whether the protection type is integrity guarantee only, integrity guarantee and encryption, and whether a plaintext NAS message should be sent. Thus, these determinations can be facilitated in LTE development.

As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to that described above, and various design changes and the like can be made without departing from the scope of the present invention. It is possible to
For example, in this embodiment, when the UE 1 succeeds in the handover between different networks, the processing unit 13 reads the current flag indicating “current” from the storage unit 11, rewrites the current flag to “non-current”, and Although the example in which the current flag indicating “current” is recorded in association with the NAS security context has been described, the present invention is not limited to this. For example, when the UE 1 succeeds in handover between different networks, the processing unit 13 discards all the NAS security contexts from the storage unit 11 and records a new NAS security context in association with a current flag indicating “current”. Anyway.
Further, for example, the rewriting of the current flag in step S6 may be performed only when the NAS security context is full native.

  The NAS security processing apparatus 10 described above has a computer system therein. The operation of each processing unit described above is stored in a computer-readable recording medium in the form of a program, and the above processing is performed by the computer reading and executing this program. Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, what is called a difference file (difference program) may be sufficient.

1 UE
DESCRIPTION OF SYMBOLS 10 NAS security processing apparatus 11 Memory | storage part 12 Generation | occurrence | production part 13 Processing part 14 Message protection part 15 Communication part 20 EMM
30 ESM

Claims (3)

A NAS security processing device that is provided in a mobile terminal and processes security in non-access stratum (NAS) communication,
A storage unit for storing a security context used for security protection in a network to which the mobile terminal is connected;
A generating unit for generating a new security context used in a handover destination network when the mobile terminal performs a handover between different networks;
When the mobile terminal succeeds in handover between different networks, the security context generated by the generation unit is recorded in the storage unit, and when the mobile terminal fails in handover between different networks, the generation unit generates A processing unit that destroys the security context;
A message protection unit that performs security processing on the NAS message using the security context stored in the storage unit;
A NAS security processing apparatus comprising: a transmission unit that transmits a NAS message on which the message protection unit has performed security processing. A security processing device that is provided in a mobile terminal, includes a storage unit that stores a security context used for security protection in a network to which the mobile terminal is connected, and processes security in non-access stratum (NAS) communication. The NAS security processing method used,
A step of generating a new security context to be used in a handover destination network by the generation unit when the mobile terminal performs handover between different types of networks;
When the processing unit succeeds in handover between different types of networks, the security context generated by the generation unit is recorded in the storage unit, and when the mobile terminal fails in handover between different types of networks, the generation is performed. The security context generated by the
A security protection process performed on the NAS message by the message protection unit using the security context stored in the storage unit;
A NAS security processing method, comprising: a step of transmitting a NAS message that has been subjected to security protection processing by the message protection unit. A NAS security processing device that is provided in a mobile terminal and processes security in communication in a non-access stratum (NAS),
A storage unit for storing a security context used for security protection in a network to which the mobile terminal is connected;
A generating unit that generates a new security context to be used in a handover destination network when the mobile terminal performs handover between different networks;
When the mobile terminal succeeds in handover between different networks, the security context generated by the generation unit is recorded in the storage unit, and when the mobile terminal fails in handover between different networks, the generation unit generates A processing unit that destroys the security context,
A message protection unit that performs security processing on the NAS message using the security context stored in the storage unit;
A program for causing the message protection unit to function as a transmission unit that transmits a NAS message subjected to security processing.

Images