MOBILE COMMUNICATION METHOD, APPARATUS, AND DEVICE

• US 20180324594A1
• Filed: 07/03/2018
• Published: 11/08/2018
• Est. Priority Date: 01/05/2016
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: CHEN, Jing, LI, Qi, SHU, Lin
• Granted Patent: US 10,419,938 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/125 Protection against power exhaustion attacks
• CPC Class Codes: H04W 8/24 Transfer of terminal data

Abstract

The present disclosure relates to mobile communications technologies, and in particular, to a mobile communication method, apparatus, and device. The method includes receiving, by a user equipment UE, a non-access stratum NAS security mode command message from a mobility management entity MME, where the NAS security mode command message carries first verification matching information used to verify UE capability information received by the MME. Based on the first verification matching information, the UE determines whether the UE capability information received by the MME is consistent with UE capability information sent by the UE to the MME. In response to determining that the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME, the UE sends a NAS security mode complete message to the MME.

Claims

1. A mobile communication method, comprising:

receiving, by a user equipment (UE), a non-access stratum (NAS) security mode command message from a mobility management entity (MME), wherein the NAS security mode command message carries first verification matching information used to verify UE capability information received by the MME; and

in response to determining that the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME based on the first verification matching information, sending, by the UE, a NAS security mode complete message to the MME.

2. The method according to claim 1, wherein the first verification matching information includes a first hash value of an attach request message that is received by the MME before the MME sends the NAS security mode command message to the UE, and the NAS security mode command message further comprises an integrity algorithm used by the MME, a key identifier, and a first non-access stratum message authentication code (NAS-MAC) of the NAS security mode command message;

and wherein the method further comprises;

calculating, by the UE, a second NAS-MAC of the NAS security mode command message received by the UE;

determining whether the second NAS-MAC is consistent with the first NAS-MAC;

in response to determining that the second NAS-MAC is consistent with the first NAS-MAC, calculating, according to a Hash algorithm, a second hash value of the attach request message sent by the UE to the MME;

determining whether the second hash value is consistent with the first hash value; and

in response to determining that the second hash value is consistent with the first hash value, sending the NAS security mode complete message to the MME.

3. The method according to claim 2, wherein the NAS security mode command message further comprises a UE security capability sent back by the MME;

and wherein the method further comprises;

determining, by the UE, whether the UE security capability sent back by the MME is consistent with a UE security capability sent by the UE to the MME; and

in response to determining that the second hash value is consistent with the first hash value, that the second NAS-MAC is consistent with the first NAS-MAC, and that the UE security capability sent back by the MME is consistent with the UE security capability sent by the UE to the MME, sending, by the UE, the NAS security mode complete message to the MME.

4. The method according to claim 3, wherein the method further comprises at least one of:

in response to determining that at least one of the second hash value, the second NAS-MAC, or the UE security capability sent back by the MME is verified unsuccessfully, sending, by the UE, a NAS security mode reject message to the MME;

or

in response to determining that the second NAS-MAC is consistent with the first NAS-MAC, that the UE security capability sent back by the MME is consistent with the UE security capability sent by the UE to the MME, and that the second hash value is inconsistent with the first hash value, sending, by the UE, the NAS security mode complete message to the MME, wherein the NAS security mode complete message carries the attach request message.

5. A mobile communications apparatus, wherein the apparatus is deployed in a user equipment (UE) and comprises:

a receiver, configured to receive a non-access stratum (NAS) security mode command message from a mobility management entity (MME), wherein the NAS security mode command message carries first verification matching information used to verify UE capability information received by the MME;

at least one processor, configured to determine, based on the first verification matching information, the UE capability information received by the MME is consistent with UE capability information sent by the UE to the MME; and

a transmitter, configured to send a NAS security mode complete message to the MME in response to determining that the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME.

6. The apparatus according to claim 5, wherein the first verification matching information includes a first hash value of an attach request message that is received by the MME before the MME sends the NAS security mode command message to the UE, and the NAS security mode command message further comprises an integrity algorithm used by the MME, a key identifier, and a first non-access stratum message authentication code (NAS-MAC) of the NAS security mode command message;

and wherein;

the at least one processor is further configured to;

calculate a second NAS-MAC of the NAS security mode command message received by the UE;

determine whether the second NAS-MAC is consistent with the first NAS-MAC;

in response to determining that the second NAS-MAC is consistent with the first NAS-MAC, calculate, according to a Hash algorithm, a second hash value of the attach request message sent by the UE to the MME; and

determine whether the second hash value is consistent with the first hash value; and

the transmitter is further configured to;

in response to determining that the second hash value is consistent with the first hash value and the second NAS-MAC is consistent with the first NAS-MAC, send the NAS security mode complete message to the MME.

7. The apparatus according to claim 6, wherein the NAS security mode command message further comprises a UE security capability sent back by the MME;

and wherein;

the at least one processor is further configured to;

determine whether the UE security capability sent back by the MME is consistent with a UE security capability sent by the UE to the MME; and

the transmitter is further configured to;

in response to determining that the second hash value is consistent with the first hash value, that the second NAS-MAC is consistent with the first NAS-MAC, and that the UE security capability sent back by the MME is consistent with the UE security capability sent by the UE to the MME, send the NAS security mode complete message to the MME.

8. The apparatus according to claim 7, wherein the transmitter is further configured to perform at least one of:

in response to determining that at least one of the second hash value, the second NAS-MAC, or the UE security capability sent back by the MME is verified unsuccessfully, send a NAS security mode reject message to the MME;

or

in response to determining that the second NAS-MAC is consistent with the first NAS-MAC, that the UE security capability sent back by the MME is consistent with the UE security capability sent by the UE to the MME, and that the second hash value is inconsistent with the first hash value, send the NAS security mode complete message to the MME, wherein the NAS security mode complete message carries the attach request message.

9. The apparatus according to claim 5, wherein the first verification matching information includes a third hash value of the UE capability information received by the MME, and the NAS security mode command message further comprises a Hash algorithm used by the MME to perform Hash calculation on the received UE capability information, an integrity algorithm used by the MME, a key identifier, and a third NAS-MAC of the NAS security mode command message;

and wherein;

the at least one processor is further configured to;

calculate a fourth NAS-MAC of the NAS security mode command message received by the UE;

determine whether the fourth NAS-MAC is consistent with the third NAS-MAC;

in response to determining that the fourth NAS-MAC is consistent with the third NAS-MAC, calculate, according to the Hash algorithm, a fourth hash value of the UE capability information sent by the UE to the MME; and

determine whether the fourth hash value is consistent with the third hash value; and

the transmitter is further configured to;

in response to determining that the fourth hash value is consistent with the third hash value, send the NAS security mode complete message to the MME.

10. The apparatus according to claim 9, wherein the NAS security mode command message further comprises a UE security capability sent back by the MME;

and wherein;

the at least one processor is further configured to;

determine whether the UE security capability sent back by the MME is consistent with a UE security capability sent by the UE to the MME; and

the transmitter is further configured to;

in response to determining that the fourth hash value is consistent with the third hash value, that the fourth NAS-MAC is consistent with the third NAS-MAC, and that the UE security capability sent back by the MME is consistent with the UE security capability sent by the UE to the MME, send the NAS security mode complete message to the MME.

11. The apparatus according to claim 10, wherein the transmitter is further configured to perform at least one of:

in response to determining that at least one of the fourth hash value, the fourth NAS-MAC, or the UE security capability sent back by the MME is verified unsuccessfully, send a NAS security mode reject message to the MME;

or

in response to determining that the fourth NAS-MAC is consistent with the third NAS-MAC, that the UE security capability sent back by the MME is consistent with the UE security capability sent by the UE to the MME, and that the fourth hash value is inconsistent with the third hash value, send the NAS security mode complete message to the MME, wherein the NAS security mode complete message carries the UE capability information.

12. The apparatus according to claim 5, wherein the first verification matching information includes the UE capability information received by the MME, and the NAS security mode command message further comprises an integrity algorithm used by the MME, a key identifier, and a fifth NAS-MAC of the NAS security mode command message;

and wherein;

the at least one processor is further configured to;

calculate a sixth NAS-MAC of the NAS security mode command message received by the UE;

determine whether the sixth NAS-MAC is consistent with the fifth NAS-MAC; and

determine whether the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME; and

the transmitter is further configured to;

in response to determining that the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME, send the NAS security mode complete message to the MME.

13. The apparatus according to claim 12, wherein the at least one processor is further configured to:

determine whether the sixth NAS-MAC is consistent with the fifth NAS-MAC;

in response to determining that the sixth NAS-MAC is consistent with the fifth NAS-MAC, determine whether a UE security capability comprised in the UE capability information received by the MME is consistent with a UE security capability sent by the UE to the MME; and

in response to determining that the UE security capability comprised in the UE capability information received by the MME is consistent with the UE security capability sent by the UE to the MME, determine whether capabilities other than the UE security capability in the UE capability information received by the MME are consistent with capabilities sent by the UE to the MME; and

the transmitter is further configured to;

in response to determining that the capabilities other than the UE security capability in the UE capability information received by the MME are consistent with the capabilities sent by the UE to the MME, send the NAS security mode complete message to the MME.

14. The apparatus according to claim 13, wherein the transmitter is further configured to:

in response to determining that the capabilities other than the UE security capability in the UE capability information received by the MME are inconsistent with the capabilities sent by the UE to the MME, send the NAS security mode complete message to the MME, wherein the NAS security mode complete message carries the UE capability information.

15. The apparatus according to claim 5, wherein the NAS security mode command message comprises:

a UE security capability received by the MME, an integrity algorithm used by the MME, a key identifier, and a seventh NAS-MAC of the NAS security mode command message; and

wherein;

the at least one processor is further configured to;

calculate an eighth NAS-MAC of the NAS security mode command message received by the UE; and

determine whether the eighth NAS-MAC is consistent with the seventh NAS-MAC; and

if the eighth NAS-MAC is consistent with the seventh NAS-MAC, determine whether the UE security capability received by the MME is consistent with a UE security capability sent by the UE to the MME; and

the transmitter is further configured to;

in response to determining that the UE security capability received by the MME is consistent with the UE security capability sent by the UE to the MME, send the NAS security mode complete message to the MME, wherein the NAS security mode complete message carries second verification matching information and a NAS-MAC of the NAS security mode complete message.

16. The apparatus according to claim 15, wherein the second verification matching information comprises at least one of:

a hash value of an attach request message sent by the UE to the MME;

or

a hash value of the UE capability information sent by the UE to the MME.

17. The apparatus according to claim 15, wherein the second verification matching information comprises the UE capability information of the UE.

18. The apparatus according to claim 15, wherein the receiver is further configured to:

after the transmitter sends the NAS security mode complete message to the MME, receive a downlink NAS transport message sent by the MME, wherein the downlink NAS transport message carries a UE capability information request message or a request message for requesting the UE to resend an attach request message; and

the transmitter is further configured to send an uplink information transfer message to the MME, wherein the uplink information transfer message carries the UE capability information or the attach request message.

19. The apparatus according to claim 15, wherein the receiver is further configured to:

after the transmitter sends the NAS security mode complete message to the MME, receive a UE information request message sent by the MME, wherein the UE information request message carries a UE capability information request message or a request message for requesting the UE to resend an attach request message; and

the transmitter is further configured to send a UE information response message to the MME, wherein the UE information response message carries the UE capability information or the attach request message.

20. A user equipment (UE), comprising:

at least one processor; and

a non-transitory computer-readable storage medium coupled to the at least one processor and storing programming instructions for execution by the at least one processor, the programming instructions instruct the at least one processor to;

receive a non-access stratum (NAS) security mode command message from a mobility management entity (MME), wherein the NAS security mode command message carries first verification matching information used to verify UE capability information received by the MME; and

in response to determining that the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME based on the first verification matching information, send, by the UE, a NAS security mode complete message to the MME.