Formal Analysis and Enhancement on 3GPP AKA protocol with KG Logic

3GPPAKA协议的设计者使用BAN逻辑对协议进行形式化的分析,并生成所有的安全目标已经达到。但是由于BAN逻辑的局限性,设计者并没有找到协议对于重定向攻击和重放攻击的脆弱性。本文给出基于信仰变化的KG逻辑方法,指出脆弱性所在,并对改进后的协议方案进行验证。

一种改进的高效鲁棒的3GPP AKA协议

针对3G鉴权与密钥协商协议(3GPP AKA)中存在的安全缺陷,结合攻击者可能发起的攻击提出了一种可以防止重定向攻击,利用存在安全漏洞的网络发起的主动攻击,SQN同步缺陷和用户身份信息泄露的改进协议(ER AKA,Efficient and Robust Authentication and Key Agreement),并对其安全性和效率进行了分析,分析表明通过该协议可以以较少的存储资源和计算资源为代价有效的解决上述安全性问题并减少3G系统中安全性处理的信令交互次数。

基于PCL的3GPP-AKA协议的形式化分析与证明

3GPP-AKA协议在第三代移动通信的安全性方面起着至关重要的作用,它保证了移动用户MS与VLR/HLR之间的双向认证及密钥协商。文中通过协议组合逻辑(PCL)对3GPP-AKA协议进行了形式化分析及安全性证明。分析表明3GPP-AKA协议可以满足它的安全目标,因此该协议可以安全的作为第三代移动通信中的认证和密钥分配协议。

Fast Handover Pre-Authentication Protocol in 3GPP-WLAN Heterogeneous Mobile Networks

The demand of ubiquitous communications drives the development of advanced mobile technologies. Meanwhile, recent increases in mobile data usage and the emergence of new IP service applications constitute the motivation to integrate 3GPP cellular mobile systems with broadband WLANs. Since 3GPP and WLAN systems complement each other in terms of infrastructure and network coverage and bandwidth, 3GPP-WLAN Heterogeneous Mobile Networks based on the 3GPP-based Home Network (3GHN) are proposed for meeting the growing demands in high-speed data access on any mobile devices. However, heterogeneous radio access technologies and architectures lead to many interworking issues, such as network transparency, security mechanism, seamless handover, and quality of service. Among of them, security and handover are the major motives to ensure the confidentiality, reliability and continuity of services in 3GPP-WLAN Heterogeneous Mobile Networks. This paper proposes fast handover pre-authentication protocol to reduce the handover authentication latency and authentication signaling overhead during the whole handover session. The proposed protocol supports Intra-Domain Handover Pre-Authentication (Intra-HO Pre-Auth) and Inter-Domain Handover Pre-Authentication (Inter-HO Pre-Auth) for preauthenticating the Mobile User (MS) prior to performing an Inter-domain Handover (Inter-domain HO)/Intra-domain Handover (Intra-domain HO) process. Meanwhile, the reduction in retrieving new Authentication Vector sand key sets from the Home Location Register/Home Subscriber Service/Authentication Center in 3GHN achieves for minimized redundant authentication signaling transactions between 3GPP domains and WLAN domains. In addition, this paper provides simulation results which show that the proposed Intra-HO Pre-Auth achieves 49% handover authentication performance improvement compared to EAP-AKA, and the proposed Inter-HO Pre-Auth achieves 26% handover authentication performance improvement as well.

3G-WLAN互连的安全协议的改进方案

第3代移动通讯系统(3G)与无线局域网(WLAN)的互连,已成为第三代移动通讯合作计划(3GPP)的研究重点。通过分析3G-WLAN互连面临的安全挑战,指出EAP-AKA认证协议在用户身份的暴露、未考虑3G网络端的认证和保密通讯、身份认证的效率不高、业务的不可否认性未得到保障等方面的不足,提出了一种基于公钥与私钥相结合的认证与密钥协商协议(Public And Private Key Based Authentication And Key Agreement,PPK-AKA),并进行了安全性能分析,其有效地解决了EAP-AKA协议存在的安全隐患,提高了系统的安全强度。

家庭基站设备的快速重认证方法

家庭基站是一种室内小型蜂窝基站,由于其设备部署在不可信的环境中,因此接入运营商的核心网时必须进行认证。3GPP组织已提出了使用IKEv2承载EAP-AKA/SIM的家庭基站设备的初始认证方法,该文基于3GPP标准提出一种家庭基站设备的快速重认证方法,在不降低原有安全级别的前提下,对初始认证进行优化,减少了通信开销,加快了认证的速度。对标准中的设施不做任何修改的情况下,使其在实际应用中便于实施。使用AVISPA对方案的安全性进行了分析,并在能量消耗和通信开销方面与初始认证进行了详细的比较,结果表明本方案性能良好。

基于EAP-TTLS的3G-WLAN融合网络认证方法

在3GPP提出的3G与WLAN融合方案的基础上,针对EAP-AKA认证方法中存在的虚假AP攻击,用户私密信息泄露等安全问题,提出了一种EAP-TTLS-AKA认证方法。此方法实现了UE对WLAN接入网的认证,在UE和WLAN接入网之间建立了安全认证隧道,并在安全认证隧道中实现UE和3GPP的AKA认证。分析结果表明,此方法有效解决了虚假AP攻击、IMSI信息泄露、中间人攻击等安全问题,具有较高的安全性,同时也保持较低的通信和计算开销。