25-07-2012, 04:33 PM
Building Femtocell More Secure with Improved Proxy Signature
CONCLUSION.pdf (Size: 403.71 KB / Downloads: 58)
Abstract
Demand for the femtocell is largely credited to the
surge in a more always best connected communication conscious
public. 3GPP define new architecture and security requirement
for Release 9 to deal with femtocell, Home eNode B referred as
HeNB. In this paper, we analyze the HeNB security with respect to
mutual authentication, access control, and secure key agreement.
Our analysis pointed out that a number of security vulnerabilities
have still not been addressed and solved by 3GPP technical
specification. These include eavesdropping, man-in-the-middle
attack, compromising subscriber access list, and masquerading as
valid HeNB. To the best of our knowledge, any related research
studying HeNB security was not published before.
INTRODUCTION
FEMTOCELL also known as an access point base station
enables small cellular communication. It is typically
designed for use in residential or small business environments.
Femtocell has become even more popular recently in response
to increased demand for always best connected in
fourth-generation networks. 3GPP defines a Home Node B
(HeNB) reference architecture to construct femtocell [1][2][3].
As the 3GPP completes the formal standard towards at the end
of 2008, network operators (e.g. global system for mobile
communications, universal mobile telecommunication system,
long term evolution) will migrate to support this new
architecture for 3GPP femtocell. Note the 3GPP refers to
femtocells as HeNB.
HENB SYSTEM ARCHITECTURE AND SECURITY
REQUIREMENT
Fig. 1 describes the system architecture of HeNB and use
case. Air interface between UE and HeNB should be backwards
compatible with air interface in evolved universal terrestrial
radio access (E-UTRAN) namely LTE-Uu. The backhaul
between HeNB and security gateway (SeGW) might be
insecure. SeGW represent operator’s core network to perform
mutual authentication with HeNB. A HeNB needs to be
configured and authorized by the operation, administration and
maintenance (OAM). In Fig. 1, UE-A and UE-B belongs to long
term evolution (LTE) core network-1 and core network-2,
respectively. UE-A connects her core network-1 via HeNB-A
and HeNB-B at home and enterprise, respectively. UE-B
connects his core network-2 via HeNB-B at enterprise. Both
HeNB-A and HeNB-B are under OAM whose license a HeNB
operates. In this circumstance, three contractual relationships
should have been established between (1) a HeNB owner
(typically be the lead user) and OAM, (2) UE and core network,
(3) UE’s core network and OAM.
PROPOSED SCHEME
In this proposed scheme, we present the vigorous mutual
authentication and key agreement protocol between (1) UE and
core network (CN), (2) HeNB and OAM, and finally (3) UE and
HeNB. As shown in Fig. 1, various CN and OAM are meshed
within system architecture. CN have a contractual relationship
with limited number of OAM. In this circumstance, UE must
confirm whether an associated HeNB belong to one of the
contracted OAM with UE’s CN operator. Note that UE-A
cannot connect to her CN (Core network-1) via HeNB-C
because her CN has no agreement with the HeNB-C’s OAM
while UE-B can do. OAM should convince UE to authenticate
HeNB in company with corresponding CN. Proxy-signature
scheme provides an outstanding way of delegating and verifying
among entities. In this paper, OAM issues the proxy signature
on behalf of CN to HeNB.
CONCLUSION
In this paper, we have analyzed HeNB architecture and
investigated the security that it provides. Although the 3GPP
HeNB introduces access control for the UE and HeNB, it is still
vulnerable to a variant of malicious attack (e.g. masquerading).
This vulnerability allows an adversary to redirect user traffic,
induce user to attach malicious HeNB. In order to eliminate
these security problems, we have presented a novel
authentication and key agreement mechanism. This proposed
mechanism improves authentication performance in three ways:
(1) enhanced mutual authentication between UE and HeNB, (2)
prevention of the rogue HeNB attack and its variants, and (3)
reduction of signaling load and computation delay. Finally,
several further aspects remain to be investigated to make our
system more suitable for real scenario. As many core network
operators rely on Internet connectivity for authentication of UE,
an interesting chicken and egg problem must be overcome to
adapt proxy-signature.