KR20220124940A - Digital sign-based system information block message transmission/reception method and apparatus - Google Patents

Abstract

Disclosed are a digital signature-based system information block (SIB) message transmission/reception method and apparatus for responding to a false base station. According to an embodiment, a digital signature-based SIB message transmission method for responding to a false base station includes the steps of: setting an SIB message to be broadcast; generating the SIB message with a digital signature added to the last part; and broadcasting the SIB message to which the digital signature is added.

Description

DIGITAL SIGN-BASED SYSTEM INFORMATION BLOCK MESSAGE TRANSMISSION/RECEPTION METHOD AND APPARATUS

The disclosure below relates to a method and apparatus for transmitting/receiving a digital signature-based SIB message for counteracting a false base station.

4G and 5G networks, which are current wireless network technologies, use MIB (Master Information Block) and SIB (System Information Block) messages for connection and communication between a base station and a terminal. Since the SIB message is information used for the terminal to connect to the base station, the base station transmits the SIB message through a broadcast method.

When the SIB message is transmitted in the broadcast method, it is transmitted to the terminal in plaintext without any security process such as integrity verification, so an attacker can collect the SIB message of a normal base station and use it to attack a false base station. The attacker collects the SIB message of the normal base station, creates the attacker's false base station, composes the same SIB message as the normal base station, and broadcasts the SIB message to disguise the victim terminal as a normal base station and perform a false base station attack.

Since the terminal cannot know whether the base station that has transmitted the SIB message is a normal base station or a false base station, there is a vulnerability that an attack using the SIB message is possible.

The background art described above is possessed or acquired by the inventor in the process of deriving the disclosure of the present application, and cannot necessarily be said to be a known technology disclosed to the general public prior to the present application.

Embodiments may provide a technology for transmitting by inserting a digital signature indicating that a normal base station is a normal base station in the last part of the SIB message without detracting from the nature of the SIB message transmitted in broadcast according to the 3GPP standard.

Embodiments may provide a technique for authenticating whether the SIB message received by the terminal is transmitted by a normal base station or transmitted by a false base station.

However, the technical problems are not limited to the above-described technical problems, and other technical problems may exist.

According to an embodiment, a method for transmitting a digital signature-based SIB (System Information Block) message for counteracting a false base station includes: setting an SIB message to be broadcast; generating the SIB message in which a digital signature is added to the last part; and broadcasting the SIB message to which the digital signature is added.

The generating may include calculating a message digest value of the SIB message; performing encryption on the message digest value; and adding the encrypted message digest value to the digital signature.

The calculating may include calculating the message digest value by hashing the SIB message through a hash function.

The performing of the encryption may include performing encryption on the message digest value through an encryption algorithm using a private key of a base station to broadcast the SIB message.

According to an embodiment, a method for receiving a digital signature-based system information block (SIB) message for counteracting a false base station includes: receiving a SIB message broadcast from a base station; separating the digital signature from the received SIB message and performing decoding on the digital signature; and determining whether or not to receive the message by determining whether the base station is a normal base station or a false base station based on the decoded digital signature.

The method may further include calculating a message digest value of the original SIB message by separating the original SIB message from the received SIB message.

The determining may include comparing a message digest value of the original SIB message and the decrypted digital signature to see if they are the same.

The operation of performing the decryption may include an operation of decrypting the digital signature through a decryption algorithm using the public key of the base station.

1 schematically shows a communication system for transmitting/receiving a SIM message based on a digital signature according to an embodiment.
2 is a flowchart illustrating an operation of transmitting/receiving a SIM message based on a digital signature according to an embodiment.
3 shows an SIB message received by the terminal from the base station.
4 is a flowchart for explaining in detail an operation of adding a digital signature in an SIB message.
5 is a flowchart for explaining in detail the operation of verifying the digital signature in the SIB message.
6 is a schematic block diagram of a base station in one embodiment;

Specific structural or functional descriptions of the embodiments are disclosed for purposes of illustration only, and may be changed and implemented in various forms. Accordingly, the actual implementation form is not limited to the specific embodiments disclosed, and the scope of the present specification includes changes, equivalents, or substitutes included in the technical spirit described in the embodiments.

Although terms such as first or second may be used to describe various elements, these terms should be interpreted only for the purpose of distinguishing one element from another. For example, a first component may be termed a second component, and similarly, a second component may also be termed a first component.

When a component is referred to as being “connected” to another component, it may be directly connected or connected to the other component, but it should be understood that another component may exist in between.

The singular expression includes the plural expression unless the context clearly dictates otherwise. In this specification, terms such as "comprise" or "have" are intended to designate that the described feature, number, step, operation, component, part, or combination thereof exists, and includes one or more other features or numbers, It should be understood that the possibility of the presence or addition of steps, operations, components, parts or combinations thereof is not precluded in advance.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present specification. does not

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. In the description with reference to the accompanying drawings, the same components are assigned the same reference numerals regardless of the reference numerals, and the overlapping description thereof will be omitted.

1 schematically shows a communication system for transmitting/receiving a digital signature-based SIB message according to an embodiment, and FIG. 2 is for explaining an operation of transmitting/receiving a digital signature-based SIB message according to an embodiment It is a flow chart.

The communication system 10 may include a base station 100 and one or more terminals 200 . The communication system 10 may perform communication in a wireless network environment (eg, a wireless communication environment). The communication system 10 may perform a transmission/reception operation of a digital signature-based SIB message. The communication system 10 may be implemented in 3rd Generation Partnership Project (3GPP), Long-Term Evolution (LTE), LTE-Advanced (LTE-A), 3GPP2, World Interoperability for Microwave Access (WiMAX), 5G, and 6G. have.

The base station 100 may have a coverage for communicating with the terminal 200 (eg, a range for transmitting and receiving data to and from the terminal 200 ). The base station 100 may provide a communication service to the terminal 200 located within the coverage area. The base station 100 is a mobile station, a fixed station, a Node-B (Node-B), an eNode-B (eNode-B), a BTS (Base Transceiver System), an access point, etc. can be called That is, the base station 200 may refer to all devices used to serve the terminal 200 .

At the base station 100 side, operations 110 to 130 related to transmission of the SIB message may be performed. In operation 110 , the base station 100 may perform basic configuration of the base station 100 . In operation 120, the base station 100 may set a digital signature-based SIB message. For example, the base station 100 may set the SIB message so that a digital signature (eg, digital signature value, certificate) is inserted (eg, added) to the last part of the SIB message. In operation 130, the base station 100 may transmit the SIB message to the terminal 200 for connection and communication by generating an SIB message in which the digital signature is inserted. The base station 100 may broadcast the SIB message.

The terminal 200 may be a communication device capable of communicating with the base station 100 . Communication devices include User Equipment (UE), Mobile Station (MS), Mobile Terminal (MT), User Terminal (UT), Wireless Terminal, and Access Terminal (AT). , a Subscriber Unit, a Subscriber Station (SS), a wireless device, a wireless communication device, a wireless transmit/receive unit (WTRU), a mobile node, or a mobile, etc. can be called

The terminal 200 may be implemented as a portable electronic device. Portable electronic devices include a laptop computer, a mobile phone, a smart phone, a tablet PC, a mobile internet device (MID), a personal digital assistant (PDA), an enterprise digital assistant (EDA). ), digital still camera, digital video camera, PMP (portable multimedia player), PND (personal navigation device or portable navigation device), handheld game console, e-book (e-book), may be implemented as a smart device. For example, the smart device may be implemented as a smart watch or a smart band.

At the terminal 200 side, operations 210 to 230 related to reception of the SIB message may be performed. In operation 210 , the terminal 200 may receive an SIB message from the base station 100 . In operation 220, the terminal 200 may verify the digital signature in the SIB message. In operation 230 , the terminal 200 may connect and communicate with the base station 100 when the base station 100 is a normal base station as a result of verification.

3 shows an SIB message received by the terminal from the base station.

The SIB message may include information required for connection and communication between a base station and a terminal that is not provided by the MIB message in a wireless network environment. The SIB message can be used for spurious base station attacks.

For example, among the SIB messages, the SIB 3/4/5 message is related to cell reselection in a wireless network environment, so that an attacker can use it to attack a false base station. In addition, the SIB 10/11/12 message is related to disaster text in a wireless network environment, so an attacker can use it for a fake disaster text attack.

That is, the SIB message provides information necessary for connection and communication between the base station and the terminal, but there is also a vulnerability that it can be utilized by an attacker at the same time. By inserting a digital signature into the SIB message in order to cope with the vulnerability in the SIB message delivery process, it is possible to counteract a false base station attack.

4 is a flowchart for explaining in detail an operation of adding a digital signature in an SIB message.

In the SIB message setting operation 120 performed by the base station 100 of FIG. 2, when the digital signature of the base station 100 is added to the end of the SIB message and set, the base station 100 broadcasting the SIB message in a wireless network environment. Integrity verification can be added. In order to add the digital signature of the base station 100 to the last part of the SIB message, the base station 100 may perform the following operation.

In operation 410, the base station 100 calculates a message digest value of the SIB message (eg, one or more of the SIB messages shown in FIG. 3 ) to be broadcast by the base station 100 using a message digest algorithm. have. For example, the base station 100 may calculate a message digest value by hashing the SIB message to be broadcast by the base station 100 through a hash function.

In operation 420 , the base station 100 may perform encryption on the message digest value through an encryption algorithm using the private key of the base station 100 (eg, a normal base station).

In operation 430, the base station 100 may insert (eg, add) the encrypted message digest value to the last part of the SIB message to be broadcast by the base station 100 as a transcription signature.

In operation 440 , the base station 100 may transmit the SIB message to which the digital signature is added to the terminal 200 .

5 is a flowchart for explaining in detail the operation of verifying the digital signature in the SIB message.

In operation 510 , the terminal 200 may receive the SIB message in which the digital signature is inserted, transmitted from the base station 100 .

In operation 520, the corresponding digital signature inserted in the SIB message may be verified. Specifically, the terminal 200 may separate the original SIB message and the electronic signature (eg, an encrypted message digest value) from the SIB message in which the electronic signature is inserted. The terminal 200 may calculate the message digest value of the original SIB message by using the message digest algorithm. The terminal 200 may decrypt the digital signature through a decryption algorithm using the public key of the base station 100 . The terminal 200 may verify by comparing the message digest value of the original SIB message with the decoded digital signature (eg, message digest value).

In operation 530, the terminal 200 may determine whether to receive the SIB message based on the verification result. For example, when the verification result verification is not normally performed (eg, when the message digest value is different from the decoded digital signature), the terminal 200 transmits the SIB message because the integrity of the SIB message is damaged. You can reject (e.g. block) the receipt of the message. When the verification result verification is normally performed (eg, when the message digest value is the same as the decoded digital signature), since the integrity of the SIB message is maintained, the terminal 200 determines that the message is transmitted by a normal base station and receives the message can allow

In operation 540, when the message reception is allowed, the terminal 200 may communicate with the base station 100 that has transmitted the SIB message.

The terminal 200 may determine and respond to a normal/false base station with respect to a base station transmitting an SIB message through the above-described operations.

As described with reference to FIGS. 1 to 5 , the embodiments may provide a technique for countering a false base station attack using an SIB message in a wireless network environment. By attaching the digital signature value promised in advance between the terminal 200 and the base station 100 to the end of the SIB message and transmitting/receiving and verifying it, the base station 100 that transmitted the SIB message received by the terminal 200 is a normal base station cognition can be identified. When applied to an actual wireless network environment, the embodiments may respond to a false base station attacking by using a SIB message broadcast in plaintext without a security device such as integrity.

6 is a schematic block diagram of a base station in one embodiment;

The base station 600 may be the base station 100 described with reference to FIGS. 1 to 5 . Also, the base station 600 may perform the operations of the base station 100 described with reference to FIGS. 1 to 5 . The base station 600 may include a memory 610 and a processor 630 .

The memory 610 may store instructions (or programs) executable by the processor 630 . For example, the instructions may include instructions for executing an operation of the processor 630 and/or an operation of each component of the processor 630 .

The processor 630 may process data stored in the memory 610 . The processor 630 may execute computer readable code (eg, software) stored in the memory 610 and instructions induced by the processor 630 .

The processor 630 may be a hardware-implemented data processing device having a circuit having a physical structure for executing desired operations. For example, desired operations may include code or instructions included in a program.

For example, a data processing device implemented as hardware includes a microprocessor, a central processing unit, a processor core, a multi-core processor, and a multiprocessor. , an Application-Specific Integrated Circuit (ASIC), and a Field Programmable Gate Array (FPGA).

The operation performed by the processor 630 may be substantially the same as the operation of the base station 100 described with reference to FIGS. 1 to 5 . Accordingly, a detailed description will be omitted.

7 is a schematic block diagram of a terminal.

The terminal 700 may be the terminal 200 described with reference to FIGS. 1 to 5 . Also, the terminal 700 may perform the operation of the terminal 200 described with reference to FIGS. 1 to 5 . The terminal 700 may include a memory 710 and a processor 730 .

The memory 710 may store instructions (or programs) executable by the processor 730 . For example, the instructions may include instructions for executing an operation of the processor 730 and/or an operation of each component of the processor 730 .

The processor 730 may process data stored in the memory 710 . The processor 730 may execute computer readable code (eg, software) stored in the memory 710 and instructions induced by the processor 730 .

The processor 730 may be a hardware-implemented data processing device having a circuit having a physical structure for executing desired operations. For example, desired operations may include code or instructions included in a program.

For example, a data processing device implemented as hardware includes a microprocessor, a central processing unit, a processor core, a multi-core processor, and a multiprocessor. , an Application-Specific Integrated Circuit (ASIC), and a Field Programmable Gate Array (FPGA).

The operation performed by the processor 730 may be substantially the same as the operation of the terminal 200 described with reference to FIGS. 1 to 5 . Accordingly, a detailed description will be omitted.

The embodiments described above may be implemented by a hardware component, a software component, and/or a combination of a hardware component and a software component. For example, the apparatus, methods and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate (FPGA). array), a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions, may be implemented using a general purpose computer or special purpose computer. The processing device may execute an operating system (OS) and a software application running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that may include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

The software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or device, to be interpreted by or to provide instructions or data to the processing device. , or may be permanently or temporarily embody in a transmitted signal wave. The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored in a computer-readable recording medium.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer readable medium may store program instructions, data files, data structures, etc. alone or in combination, and the program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. have. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

The hardware devices described above may be configured to operate as one or a plurality of software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with reference to the limited drawings, a person skilled in the art may apply various technical modifications and variations based thereon. For example, the described techniques are performed in a different order than the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (1)

A method for transmitting a digital signature-based SIB (System Information Block) message for counteracting a false base station, the method comprising:
setting an SIB message to be broadcast;
generating the SIB message in which a digital signature is added to the last part; and
Broadcasting the SIB message to which the digital signature is added
A method comprising

Images