A Security Extension Providing User Anonymity and Relaxed Trust Requirement in Non-3GPP Access to The EPS

Transcription

1 A Security Extension Providing User Anonymity and Relaxed Trust Requirement in Non-3GPP Access to The EPS Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. Basav Roychoudhury - IIM Shillong, Shillong, India Prof. Dilip Kr. Saikia - NIT Meghalaya, Shillong, India 19th Dec 2014 (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19th Saikia Dec NIT Meghalaya, 1 / 13 Sh

2 Evolved Packet System (EPS) 3GPP has standardized the EPS as part of its LTE/SAE initiative. EPS supports multiple access technologies though a common all-ip core called EPC. EPC allows access through 3GPP as well as non-3gpp access networks like WLAN, WiMAx, etc. Non-3GPP access is classified into two categories, viz., trusted and untrusted. (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19th Saikia Dec NIT Meghalaya, 2 / 13 Sh

3 Security architecture for non-3gpp access to the EPS HSS PDN Gateway Operators IP Services (e.g. IMS, etc.) 3GPP AAA Server HPLMN VPLMN 3GPP Access (GSM, EDGE, UMTS, etc.) Serving Gateway epdg 3GPP AAA Proxy Non 3GPP Access Trusted Non 3GPP AN Untrusted Non 3GPP AN UE (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19th Saikia Dec NIT Meghalaya, 3 / 13 Sh

4 Message flow during trusted non-3gpp access to EPC UE Non 3GPP AN 3GPP AAA Server HSS Wireless Non 3GPP Techonology Specific Procedure for Establishing Connection 1. EAP Request / Identity 2. EAP Response / Identity (Contains Temporary Identity or IMSI in NAI format) 7. EAP Request/AKA Challenge UE Runs AKA algorithm, Verifies AUTN and MAC, Derives RES, Session Keys and MSK, Stores Temporary Identities 3. EAP Response / Identity (3GPP AAA Server is identified via realm part of NAI) 6. EAP Request/AKA Challenge (Contains RAND, AUTN, MAC, Temporary Identities) 8. EAP Response/AKA Challenge 9. EAP Response/AKA Challenge (Contains MAC, RES) 10. EAP Success (Contains MSK) 11. EAP Success Non 3GPP AN stores MSK 4. AV Request, IMSI (If Response/Identity contained a Temporary Identity the corresponnding IMSI is extracted at the 3GPP AAA Server) HSS generates AV for the received IMSI 5. AV(RAND, AUTN, XRES, IK, CK) 3GPP AAA Server checks MAC, Matches RES with XRES (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19th Saikia Dec NIT Meghalaya, 4 / 13 Sh

5 Message flow during un-trusted non-3gpp access to EPC UE Non 3GPP AN epdg 3GPP AAA Server HSS Wireless IKE SA INIT (Negotiate cryptographic algorithm, Exchange nonces, Perform Deffie Hellman exchange) 1. IKE AUTH Request (Contains IMSI/Temporary Identity) 6. IKE AUTH Response (EAP Request/AKA Challenge Contains RAND, AUTN, MAC, Encrypted Temporary Identities) 2. AAA Message (Contains IMSI/Temporary Identity) 5. AAA Message (EAP Request/AKA Challenge, Contains RAND, AUTN, MAC, Temporary Identities) 3. AV Request, IMSI (If AAA Message contained a Temporary Identity the corresponnding IMSI is extracted at the 3GPP AAA Server) HSS generates AV for the received IMSI 4. AV(RAND, AUTN, XRES, IK, CK) UE Runs AKA algorithm, Verifies AUTN and MAC, Derives RES snd Session Keys, Stores Temporary Identities 7. IKE AUTH Request (EAP Response/AKA Challenge, Contains MAC, RES) epdg stores MSK 10. IKE AUTH Response (EAP Success) 8. AAA Message (EAP Response/AKA Challenge, Contains MAC, RES) 9. AAA Success (EAP Success, MSK) 3GPP AAA Server Checks MAC, Matches RES with XRES (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19th Saikia Dec NIT Meghalaya, 5 / 13 Sh

6 Identity privacy vulnerability during trusted non-3gpp access IMSI is transmitted in clear text during the first authentication. 3GPP-AAA Server requests UE to send its IMSI, in cases when pseudonym is not recognized. A corrupt Non-3GPP AN may utilize the received IMSI for various kind of malicious activities. A malicious/fake Non-3GPP AN may also take advantage. (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19th Saikia Dec NIT Meghalaya, 6 / 13 Sh

7 Identity privacy vulnerability during untrusted non-3gpp access The protected channel is encrypted but not authenticated at the time of receiving the user identity (IMSI) So an attacker may pose as a genuine epdg and may request the UE for the IMSI. The IMSI would be visible to the epdg, which in roaming situations may be in the VPLMN. Such a vulnerability limits the home operator in interoperating with a VPLMN that belongs to an untrusted third party operator. (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19th Saikia Dec NIT Meghalaya, 7 / 13 Sh

8 Message flow in proposed extension during trusted non-3gpp access UE Non 3GPP AN 3GPP AAA Server HSS Wireless Non 3GPP Techonology Specific Procedure for Establishing Connection 1. EAP Request / Identity 2. EAP Response / Identity (Contains Temporary Identity or DMSI in NAI format) 3. EAP Response / Identity (3GPP AAA Server is identified via realm part of NAI) 4. AV Request, DMSI (If Response/Identity contained a Temporary Identity, the corresponnding DMSI is extracted at the 3GPP AAA Server) 7. EAP Request/AKA Challenge UE Runs AKA algorithm, Verifies AUTN and MAC, Derives RES, Session Keys and MSK, Stores Temporary Identities * 6. EAP Request/AKA Challenge (Contains ERAND, AUTN, MAC, Temporary Identities) 8. EAP Response/AKA Challenge 9. EAP Response/AKA Challenge (Contains MAC, RES) 10. EAP Success (Contains MSK) 11. EAP Success Non 3GPP AN stores MSK HSS extracts IMSI from DMSI and generates AV (Sec. 5.4, 5.2) 5. AV(ERAND, AUTN, XRES, IK, CK) 3GPP AAA Server checks MAC, Matches RES with XRES * UE also stores ERAND in its non volatile memory so that it can extract RIC and generate a DMSI whenever required (Section 5.4) (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19th Saikia Dec NIT Meghalaya, 8 / 13 Sh

9 Message flow in proposed extension during un-trusted non-3gpp access UE Non 3GPP AN epdg 3GPP AAA Server HSS Wireless IKE SA INIT (Negotiate cryptographic algorithm, Exchange nonces, Perform Deffie Hellman exchange) 1. IKE AUTH Request (Contains DMSI/Temporary Identity) 6. IKE AUTH Response (EAP Request/AKA Challenge Contains ERAND, AUTN, MAC, Encrypted Temporary Identities) 2. AAA Message (Contains DMSI/Temporary Identity) 5. AAA Message (EAP Request/AKA Challenge, Contains ERAND, AUTN, MAC, Temporary Identities) 3. AV Request, DMSI (If AAA Message contained a Temporary Identity the corresponnding DMSI is extracted at the 3GPP AAA Server) HSS extracts IMSI from DMSI and generates AV (Sec. 5.4,5.2) 4. AV(ERAND, AUTN, XRES, IK, CK) UE Runs AKA algorithm, Verifies AUTN and MAC, Derives RES snd Session Keys, Stores Temporary Identities * 7. IKE AUTH Request (EAP Response/AKA Challenge, Contains MAC, RES) epdg stores MSK 10. IKE AUTH Response (EAP Success) 8. AAA Message (EAP Response/AKA Challenge, Contains MAC, RES) 9. AAA Success (EAP Success, MSK) 3GPP AAA Server Checks MAC, Matches RES with XRES * UE stores ERAND in its non volatile memory so that it can extract RIC and generate a DMSI whenever required (Sec. 5.4). (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19th Saikia Dec NIT Meghalaya, 9 / 13 Sh

10 Dynamic Mobile Subscriber Identity DMSI = MCC MNC RIC ERIC ERIC=f EncryptAES Ki (RIC padded ) RIC padded = RIC SEQ UE R SEQ UE : 32 bit counter maintained at UE to ensure freshness of DMSI. R is a 128 (32 + b) bit random number. (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19thSaikia Dec NIT Meghalaya, 10 / 13 Sh

11 RIC Index with modified HSS database AV ERAND AUTH XRES IK CK RIC r0 Pointer RIC Fresh VCR r1 null r2 null r3 IMSI RIC New RIC Prev RIC Old RIC InUse Ki SEQ HN r4 r5 i0 r0 r4 r5 r3 k0 s0 r6 i1 r6 r7 r9 r10 k1 s1 r7 r8 r9 r10 null HSS Database RIC Index (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19thSaikia Dec NIT Meghalaya, 11 / 13 Sh

12 Conclusion End to end user identity privacy. Relaxed requirement of trusting the intermediary network elements like AN. It can be implemented with certain changes at the level of the operator. Can be adopted as an extension to EAP-AKA. (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19thSaikia Dec NIT Meghalaya, 12 / 13 Sh

13 THANK YOU (Dr. Hiten Choudhury - St. Edmund s College, Shillong, India Dr. ICISS Basav 2014, Roychoudhury IDRBT, Hyderabad - IIM Shillong, Shillong, India Prof. Dilip Kr. 19thSaikia Dec NIT Meghalaya, 13 / 13 Sh