WO2024082963A1

WO2024082963A1 - Improved 5g message rcs access authentication ims-aka method capable of balancing security and efficiency

Info

Publication number: WO2024082963A1
Application number: PCT/CN2023/123172
Authority: WO
Inventors: 吴作顺; 刘梓淇; 吴芷静; 吴抒恒
Original assignee: 中电信数智科技有限公司
Priority date: 2022-10-19
Filing date: 2023-10-07
Publication date: 2024-04-25
Also published as: CN115767527A

Abstract

Disclosed in the present invention is an improved 5G message RCS access authentication IMS-AKA method capable of balancing security and efficiency. The method comprises: a UE and an HSS sharing key generation functions f3, f4 and f5 and a message authentication function H1; the UE and an S-CSCF sharing key generation functions f3' and f4' and a message authentication function H2; the HSS and the S-CSCF sharing a key KHS; the UE and the HSS respectively generating random numbers; synchronizing a system clock; the UE trusting its own HSS; and on the basis of the above content, implementing UE registration authentication and key negotiation, and service authentication and key negotiation. Accordingly, an attack from a false base station, access by a fake user, a replay attack, a man-in-the-middle attack, and leakage of a shared key can be avoided, and a fake user can be prevented from being entitled to encrypted communication, thereby saving on the network-end overheads.

Description

An improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency

Technical Field

The present invention belongs to the field of emerging information technology, and specifically relates to an improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency.

Background technique

The access security mechanism of IMS in 5G messaging services has two major tasks: one is to authenticate the access user; the other is to establish an IPSec security association (IPSecSA) between the UE and P-CSCF after the authentication is completed to provide security protection for subsequent SIP signaling interactions.

The IMS-AKA mechanism is mainly used for user authentication and session key distribution. During the IMS registration process, SIP signaling carrying AKA parameters interacts between the UE and the IMS network authentication entity. The AKA parameters are transmitted and negotiated according to the AKA mechanism, thereby realizing the access authentication and key negotiation process.

In actual applications, the security vulnerabilities exposed by the IMS-AKA mechanism include:

(1) Although the security key negotiated between the UE and the P-CSCF through the AKA mechanism can be used to encrypt and protect the integrity of SIP signaling, the initial registration request message is sent before the security key is negotiated. An attacker can easily obtain the user's registration information, thereby leaking the user's privacy.

(2) When registering with the IMS network, at least two registration requests need to be sent. The SIP interaction between the user and the network is too cumbersome, and the authentication header field carried by the SIP message contains many AKA parameters, which greatly increases the length of the SIP message. Due to the limitation of network bandwidth, the transmission delay will be very obvious, and it will take a long time for users to access the network through registration, which affects the user experience.

(3) During the AKA-based access authentication process, the UE does not authenticate the P-CSCF, the access point of the IMS core network, which provides attackers with an opportunity to impersonate a man-in-the-middle to launch an attack.

To address the above issues, it is necessary to study an improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency.

Summary of the invention

The technical problem to be solved by the present invention is to provide an improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency based on the system architecture of international standard 5G message terminal access authentication in response to the above-mentioned deficiencies in the prior art.

In order to achieve the above technical objectives, the technical solution adopted by the present invention is:

An improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency, in which:

(1) UE and HSS share key generation functions _f3 , _f4 and _f5 and message authentication function _H1 ; UE and S-CSCF share key generation functions _f3 ', _f4 ' and message authentication function _H2 ; HSS and S-CSCF share key _KHS ;

(2) The UE and HSS each generate a random number;

(3) System clock synchronization;

(4) The UE trusts its own HSS;

Wherein, _f3 is the key generation function for calculating the encryption key CK; _f4 is the key generation function for calculating the integrity protection key IK; _f5 is the key generation function for calculating the anonymous key AK;

_H1 is the authentication function of the UE for the registration message; _H2 is the authentication function of the S-CSCF for the response message;

f ₃ ' is a generation function of the iterative encryption key CK; f ₄ ' is a generation function of the iterative integrity protection key IK;

Based on the above (1)-(4), UE registration authentication and key negotiation as well as service authentication and key negotiation are implemented.

To optimize the above technical solutions, the specific measures taken also include:

The above-mentioned UE registration authentication and key agreement apply Hash function chain and timestamp to implement registration authentication and key agreement.

The above UE registration authentication and key negotiation process is:

(1) UE initiates registration, and ME sends a registration message MSG _U and a message authentication code MAC _U ;
MSG _U =E(K _i-1 , _RU )||TMPI _i-1 ||f ⁿ ( _RU )||A1{A1,A2,...,Ar}
MAC _U =H ₁ (K _i-1 , IMPI || MSG _U )

Where E is a single-key encryption function;

R _U is a random number encrypted with the old shared key K _i-1 ;

TMPI _i-1 is the old temporary user identity;

f ⁿ (R _U ) is an n-order Hash function, where n is the maximum number of times a service can be applied for after a successful registration;

{A1, A2, ..., Ar} and A1 are the set of r alternative encryption algorithms and the algorithm selected by the user respectively;

(2) The S-CSCF receives the UE's registration information, leaves f ⁿ (R _U ), adds a timestamp V1 to the end of MSG _U according to TMPI _i-1, and forwards it together with MAC _U to the UE's home network HSS;

(3) HSS receives MSG _U and MAC _U , obtains the stored IMPI according to TMPI _i-1 , and decrypts it to obtain R _U ;

Calculate XMAC _U , check whether XMAC _U and MAC _U are consistent, and then check whether timestampV1 is legal. If it is legal, HSS authenticates UE successfully. If it is not legal, resynchronize the system clock and re-initiate registration;

After successful registration, HSS selects a random number _RH to decide whether to agree with the encryption algorithm A1 selected by UE. If not, it selects an encryption algorithm _Ai from the given alternative encryption algorithms as the encryption algorithm Ai for this registration; generates a new _TMPIi , generates a new key _Ki = E( _Ki-1 , _RURH ), and uses _RH and _Ki to generate CK, IK and AK; encrypts the ciphertext with the shared key _KHS of HSS and S-CSCF _. E(Ki, R _U ); then send the registration response message MSG _H back to S-CSCF;
MSG _H = _RH ||AK||TMPI _i ||A _i ||E(K _HS , E(K _i , _RU ))||CK||IK||E(K _i , _RH ))

(4) S-CSCF receives the response information returned by HSS, decrypts it to obtain E( _Ki , _RU ), E( _Ki , _RH ), keeps AK, E( _Ki , _RH ), _TMPIi , generates a random number _RS , calculates ^fn ( _RS ); and sends _MSGs and _MACs to UE;
MSG _S = _RH || _TMPIi || _Ai || ^fn ( _RS )||E( _Ki , _RU )||CK||IK||timestampV2
MAC _S =H ₂ (AK, MSG _S )

(5) The S-CSCF sends the MSG _S and MAC _S in the SIP response to the I-CSCF, which forwards it to the P-CSCF.

After receiving the SIP response, the P-CSCF saves the CK and IK and forwards the rest to the UE;
MSG _P = _RH || _TMPIi || _Ai || ^fn ( _RS )||E( _Ki , _RU )timestampV2
MAC _P =H ₂ (AK, MSG _P )

(6) UE receives MSG _P and MAC _P , _generates CK, IK, AK using _RH and Ki, and calculates XMAC _S and E( _Ki , _RH );

Check whether it is consistent with MAC _S ; use _Ki to decrypt E( _Ki , _RH ) and check whether _RU is the random number selected at the beginning; check the legitimacy of the timestamp. If all pass, the UE successfully authenticates the S-CSCF. The UE leaves TMPI _i as the temporary user identity for this registration and accepts the algorithm _Ai selected by HSS as the encryption algorithm for service data transmission;

At the same time, RES is sent to S-CSCF;
RES＝E(K _i ， _RH )

(7) Check whether XRES=E(K _i , _RH ) is consistent with RES. If they are consistent, the S-CSCF successfully authenticates the UE.

The above service authentication and key negotiation process is as follows:

After successful registration and authentication, when the UE needs to perform the i-th service communication, the S-CSCF sends f ⁿⁱ ( _RS ) to the ME. The ME checks whether f(f ⁿⁱ ( _RS )) is the same as the previously stored f ^n-(i-1) ( _RS ). If they are the same, the identity of the S-CSCF is confirmed. The S-CSCF is legitimate and sends f ⁿⁱ (R _U ) to the S-CSCF.

S-CSCF also verifies the legitimacy of the UE. If it is legitimate, two-way authentication is achieved, and a success flag is sent to the UE to start generating the encryption and integrity keys CK _i and IK _i required for this service communication.

After receiving the success flag, the UE also starts to generate CK _i and IK _i and prepares for service communication.
CK _i = f ₃ ′(CK, f ⁿⁱ (R _U ));
IK _i =f ₄ ′(IK,f ⁿⁱ (R _U )).

When the number of services reaches the upper limit n of the Hash function chain, the user needs to re-register and authenticate with the S-CSCF and HSS when applying for services, and update the key shared with the HSS.

The present invention has the following beneficial effects:

(1) Implement HSS authentication of UE and bidirectional authentication of UE and S-CSCF, avoiding attacks by fake base stations and fake users. Hash function chain and timestamp are applied in the authentication process to avoid replay attacks; IMPI and random number _RU used to generate encryption key are not transmitted in plain text to avoid man-in-the-middle attacks.

(2) The shared key between UE and HSS is updated each time the user registers, which avoids the leakage of the shared key. The encryption algorithm is determined by free negotiation, which covers the encryption algorithm selection function.

(3) CK and IK are not transmitted in plain text to prevent fake users from enjoying encrypted communications.

(4) After each user successfully registers and authenticates, service authentication does not require the participation of the HSS, saving network overhead.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of registration and authentication of the present invention;

FIG. 2 is a flow chart of service authentication and key negotiation according to the present invention.

Detailed ways

The embodiments of the present invention are further described in detail below with reference to the accompanying drawings.

The present invention provides an improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency, and its prerequisites include:

(1) UE and HSS share key generation functions f ₃ , f ₄ and f ₅ , and message authentication function H ₁ ;

UE and S-CSCF share key generation functions f ₃ ', f ₄ ' and message authentication function H ₂ ;

The HSS shares a key K _HS with the S-CSCF.

(2) The UE and HSS each generate a random number.

(3) System clock synchronization;

(4) The UE trusts its own HSS.

Based on the above (1)-(4), UE registration authentication and key negotiation as well as service authentication and key negotiation can be realized.

UE registration authentication and key negotiation:

The introduced f is an iterable Hash function with a maximum number of iterations of n; E is a single-key encryption function.

The specific process is shown in Figure 1:

(1) UE initiates registration and generates a registration message MSG _U ,

MSG _U includes:

The random number R _U encrypted with the old shared key K _i-1 , the old temporary user identity TMPI _i-1 ;

n-times Hash function f ⁿ (R _U ), where n is the maximum number of times a service can be applied for after a successful registration, which can be determined according to the specific situation of the system;

A set of r alternative encryption algorithms {A1, A2, ..., Ar} and the algorithm A1 selected by the user.

specific:

ME sends MSG _U and message authentication code MAC _U.

Wherein, MSG _U =E(K _i-1 , _RU )||TMPI _i-1 ||f ⁿ ( _RU )||A1{A1,A2,...,Ar}
MAC _U =H ₁ (K _i-1 , IMPI || MSG _U )

(2) The S-CSCF receives the UE's registration information, leaves f ⁿ (R _U ), adds a timestamp V1 to the end of MSG _U according to TMPI _i-1 , and forwards it together with MAC _U to its home network HSS;

Calculate XMAC _U , check whether XMAC _U and MAC _U are consistent, and then check whether timestampV1 is legal. If it is legal, HSS authenticates UE successfully. If it is illegal, resynchronize the system clock and re-initiate registration.

After successful registration, HSS selects a random number _RH to decide whether to agree with the encryption algorithm A1 selected by UE. If not, it selects an encryption algorithm _Ai from the given alternative encryption algorithms as the encryption algorithm Ai for this registration; generates a new _TMPIi , generates a new key _Ki = E( _Ki-1 , _RURH ), and generates CK, IK and AK with _RH and _Ki ; encrypts E(Ki, _RU ) with the shared key _KHS _of HSS and S-CSCF; then sends the registration response message _MSGH back to S-CSCF;
MSG _H = _RH ||AK||TMPI _i ||A _i ||E(K _HS , E(K _i , _RU ))||CK||IK||E(K _i , _RH ))

Check whether it is consistent with MAC _S ; use _Ki to decrypt E( _Ki , _RH ) and check whether _RU is the random number selected at the beginning; check the legitimacy of the timestamp. If all pass, the UE successfully authenticates the S-CSCF. The UE leaves _TMPIi as the temporary user identity for this registration and accepts the algorithm _Ai selected by the HSS as the encryption algorithm for business data transmission.

At the same time, RES is sent to S-CSCF.
RES＝E(K _i ， _RH )

Service authentication and key negotiation:

After successful registration and authentication, when the UE needs to conduct the i-th service communication, the S-CSCF will send f ⁿⁱ (R _S ) to the ME; the ME needs to check whether f(f ⁿⁱ (R _S )) is the same as the previously stored f ^n-(i-1) (R _S ). If they are the same, the identity of the S-CSCF is confirmed and f ⁿⁱ (R _U ) is sent to the S-CSCF.

After receiving the success flag, the UE also starts to generate CK _i and IK _i and prepares for service communication, as shown in Figure 2.
CK _i = f ₃ ′(CK, f ⁿⁱ (R _U ));
IK _i =f ₄ ′(IK,f ⁿⁱ (R _U )).

Some abbreviations in the present invention are explained as follows:

UE: user;

P-CSCF: unified entry point for IMS visited networks;

I-CSCF: entry point to the IMS home network;

S-CSCF: IMS signaling plane core node location;

HSS: Home Subscriber Server, belonging to the contracted user server;

ME: Mobile device.

The above are only preferred embodiments of the present invention. The protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

An improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency, characterized in that, in this method,

(1) UE and HSS share key generation functions f3 , f4 and f5 and message authentication function H1 ; UE and S-CSCF share key generation functions f3 ', f4 ' and message authentication function H2 ; HSS and S-CSCF share key KHS ;

(2) The UE and HSS each generate a random number;

(3) System clock synchronization;

(4) The UE trusts its own HSS;

Wherein, f3 is the key generation function for calculating the encryption key CK; f4 is the key generation function for calculating the integrity protection key IK; f5 is the key generation function for calculating the anonymous key AK;

H1 is the authentication function of the UE for the registration message; H2 is the authentication function of the S-CSCF for the response message;

f 3 ' is a generation function of the iterative encryption key CK; f 4 ' is a generation function of the iterative integrity protection key IK;

Based on the above (1)-(4), UE registration authentication and key negotiation as well as service authentication and key negotiation are implemented.
According to an improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency according to claim 1, it is characterized in that the UE registration authentication and key negotiation apply hash function chain and timestamp to implement registration authentication and key negotiation.
According to an improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency according to claim 2, it is characterized in that the UE registration authentication and key negotiation process is:

(1) UE initiates registration, and ME sends a registration message MSG U and a message authentication code MAC U ;
MSG U =E(K i-1 , RU )||TMPI i-1 ||f n ( RU )||A1{A1,A2,...,Ar}
MAC U =H 1 (K i-1 , IMPI || MSG U )

Where E is a single-key encryption function;

R U is a random number encrypted with the old shared key K i-1 ;

TMPI i-1 is the old temporary user identity;

f n (R U ) is an n-order Hash function, where n is the maximum number of times a service can be applied for after a successful registration;

{A1, A2, ..., Ar} and A1 are the set of r alternative encryption algorithms and the algorithm selected by the user respectively;

(2) The S-CSCF receives the UE's registration information, leaves f n (R U ), adds a timestamp V1 to the end of MSG U according to TMPI i-1, and forwards it together with MAC U to the UE's home network HSS;

(3) HSS receives MSG U and MAC U , obtains the stored IMPI according to TMPI i-1 , and decrypts it to obtain R U ;

Calculate XMAC U , check whether XMAC U and MAC U are consistent, and then check whether timestampV1 is legal. If it is legal, HSS authenticates UE successfully. If it is not legal, resynchronize the system clock and re-initiate registration;

After successful registration, HSS selects a random number RH to decide whether to agree with the encryption algorithm A1 selected by UE. If not, it selects an encryption algorithm Ai from the given alternative encryption algorithms as the encryption algorithm Ai for this registration; generates a new TMPIi , generates a new key Ki = E( Ki-1 , RURH ), and generates CK, IK and AK with RH and Ki ; encrypts E(Ki, RU ) with the shared key KHS of HSS and S-CSCF; then sends the registration response message MSGH back to S-CSCF;
MSG H = RH ||AK||TMPI i ||A i ||E(K HS , E(K i , RU ))||CK||IK||E(K i , RH ))

(4) S-CSCF receives the response information returned by HSS, decrypts it to obtain E( Ki , RU ), E( Ki , RH ), keeps AK, E( Ki , RH ), TMPIi , generates a random number RS , calculates fn ( RS ); and sends MSGs and MACs to UE;
MSG S = RH || TMPIi || Ai || fn ( RS )||E( Ki , RU )||CK||IK||timestampV2
MAC S =H 2 (AK, MSG S )

(5) The S-CSCF sends the MSG S and MAC S in the SIP response to the I-CSCF, which forwards it to the P-CSCF.

After receiving the SIP response, the P-CSCF saves the CK and IK and forwards the rest to the UE;
MSG P = RH || TMPIi || Ai || fn ( RS )||E( Ki , RU )timestampV2
MAC P =H 2 (AK, MSG P )

(6) UE receives MSG P and MAC P , generates CK, IK, AK using RH and Ki, and calculates XMAC S and E( Ki , RH );

Check whether it is consistent with MAC S ; use Ki to decrypt E( Ki , RH ) and check whether RU is the random number selected at the beginning; check the legitimacy of the timestamp. If all pass, the UE successfully authenticates the S-CSCF. The UE leaves TMPI i as the temporary user identity for this registration and accepts the algorithm Ai selected by HSS as the encryption algorithm for service data transmission;

At the same time, RES is sent to S-CSCF;
RES＝E(K i ， RH )

(7) Check whether XRES=E(K i , RH ) is consistent with RES. If they are consistent, the S-CSCF successfully authenticates the UE.
According to an improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency according to claim 1, it is characterized in that the service authentication and key negotiation process is:

After successful registration and authentication, when the UE needs to perform the i-th service communication, the S-CSCF sends f ni ( RS ) to the ME. The ME checks whether f(f ni ( RS )) is the same as the previously stored f n-(i-1) ( RS ). If they are the same, the identity of the S-CSCF is confirmed. The S-CSCF is legitimate and sends f ni (R U ) to the S-CSCF.

S-CSCF also verifies the legitimacy of the UE. If it is legitimate, two-way authentication is achieved, and a success flag is sent to the UE to start generating the encryption and integrity keys CK i and IK i required for this service communication.

After receiving the success flag, the UE also starts to generate CK i and IK i and prepares for service communication.
According to an improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency according to claim 4, it is characterized in that CK i =f 3 '(CK, f ni (R U ));
IK i =f 4 ′(IK,f ni (R U )).
According to an improved 5G message RCS access authentication IMS-AKA method that balances security and efficiency as described in claim 1, it is characterized in that when the number of services reaches the upper limit n of the Hash function chain, the user needs to re-register and authenticate with the S-CSCF and HSS when applying for the service, and update the key shared with the HSS.