Evolved Packet System Non Access Stratum Deciphering Using Real-Time LTE Monitoring

Abstract

A monitoring system is coupled to interfaces in an LTE network and passively captures packets from the network interfaces. First data packets associated with an authentication and key agreement procedure are captured on a first interface. Second data packets associated with the authentication and key agreement procedure are captured on a second interface. Individual ones of the first data packets are correlated to individual ones of the second data packets based upon a same parameter. An authentication vector table is created comprising information from the correlated first data packets and second data packets, wherein entries in the table comprise authentication data for a plurality of security contexts. A cipher key is identified to decipher additional packets for the user. The cipher key can also be identified in case of Inter Radio Access Technology Handover by the user equipment.

1 . A method for deciphering captured data packets, comprising:
 capturing, via a monitoring probe, data packets from a first network interface between a mobility management entity and a home subscriber service node and from a second network interface between a mobility management entity and a eNodeB node and;   identifying first data packets associated with an authentication and key agreement procedure on the first interface;   identifying second data packets associated with the authentication and key agreement procedure on the second interface;   correlating individual ones of the first data packets with individual ones of the second data packets that are associated with a same parameter; and   creating an authentication vector table comprising information from correlated first data packets and second data packets, wherein entries in the table comprise authentication data for a plurality of security contexts.   
     
     
         2 . The method of  claim 1 , further comprising:
 storing the authentication vector table in a memory on the monitoring probe.   
     
     
         3 . The method of  claim 1 , further comprising:
 capturing security mode procedure data packets from the second interface;   extracting an algorithm type and a security key index from the security mode data packets; and   appending the algorithm type and the security key index to the authentication vector table.   
     
     
         4 . The method of  claim 1 , further comprising:
 capturing, via the monitoring system, ciphered data packets from network interfaces;   identifying a security context for the ciphered data packets;   correlating the security context of the ciphered data packets to an entry in the authentication data table; and   deciphering the ciphered data packets using a cipher key stored in the authentication data table entry.   
     
     
         5 . The method of  claim 1 , wherein the first interface is an S6a interface and the second interface is a S1-MME interface. 
     
     
         6 . The method of  claim 1 , wherein all NAS Authentication Request messages are ciphered when captured via the monitoring system. 
     
     
         7 . The method of  claim 1 , further comprising:
 capturing CK and IK subkeys and KSI from an S3 interface.   
     
     
         8 . The method of  claim 1 , further comprising:
 extracting an algorithm type and a security key index from an S1AP HO Request or an S1AP TAU Request.   
     
     
         9 . The method of  claim 1 , further comprising:
 deriving a K′ ASME  value from CK and IK subkeys and one or two nonces as inputs; and   appending the algorithm type and the security key index to the authentication vector table.   
     
     
         10 . A method for deciphering data in an LTE network, comprising:
 capturing authentication response messages at a monitoring system coupled to an S6a interface;   identifying security keys (K ASME ) within the authentication info response messages;   generating a calculated eNodeB key (K alg   eNB ) from each of the security keys;   storing each calculated eNodeB key and a related security key in a memory at the monitoring system;   capturing a context request message from an S1-MME interface, the context request message related to a particular user equipment context;   identifying an assigned eNodeB key (K eNB-assign ) within the context request message;   comparing the assigned eNodeB key to the calculated eNodeB keys that are stored in the memory;   identifying a matching calculated eNodeB key that corresponds to the assigned eNodeB key; and   using a security key associated with the matching calculated eNodeB to decipher message traffic from the context.   
     
     
         11 . The method of  10 , further comprising:
 deriving an NAS deciphering key (L NASenc ) from the security key associated with the matching calculated eNodeB.   
     
     
         12 . The method of  10 , wherein the context request message is an S1AP Initial Context Setup Request message. 
     
     
         13 . The method of  10 , wherein the context request message is an S1AP UE Context Modification Request message. 
     
     
         14 . The method of  10 , further comprising:
 capturing security mode complete messages from an S1-MME interface;   identifying an uplink count parameter within each of the security mode complete messages; and   generating the calculated eNodeB keys (K alg   eNB ) from the security keys and corresponding uplink count parameters.   
     
     
         15 . A method for identifying deciphering data during a handover, comprising:
 capturing, at a monitoring system probe, a GTP-v2 forward relocation request message on an S3 interface;   extracting CK, IK and KSI parameters from the GTP-v2 forward relocation message;   capturing, at the monitoring system probe, a handover request message on an S1-MME interface;   extracting KSI, algorithm, and nonce parameters from the handover request message; and   calculating, at the monitoring system, a K′ ASME  parameter using the CK, IK and nonce parameters.   
     
     
         16 . A method for identifying deciphering data during idle mode mobility, comprising:
 capturing, at a monitoring system probe, a GTP-v2 context response message on an S3 interface;   extracting CK, IK and KSI parameters from the GTP-v2 context response message;   capturing, at the monitoring system probe, a security mode command message on an S1-MME interface;   extracting KSI and nonce parameters from the security mode command message; and   calculating, at the monitoring system, a K′ ASME  parameter using the CK, IK and nonce parameters.   
     
     
         17 . A method for correlating user equipment identifiers to captured messages, comprising:
 capturing, by a monitoring probe coupled to interfaces in an LTE network, S6a authentication procedure messages sent by an HSS;   capturing, by the monitoring probe, S1AP authentication procedure messages exchanged between and MME and a UE;   extracting authentication vectors within the captured messages;   extracting a UE identifier in the S6a authentication procedure messages;   identifying S6a authentication procedure messages that correspond to S1AP authentication procedure messages based upon the authentication vectors; and   creating a record stored in a memory device on the monitoring system, the record comprising authentication vectors from corresponding S6a and S1AP messages and the UE identifier.   
     
     
         18 . The method of  claim 17 , wherein the UE identifier is an IMSI. 
     
     
         19 . The method of  claim 17 , wherein the authentication vectors comprise one or more parameters selected from a RAND, an AUTN, and an XRES parameter. 
     
     
         20 . The method of  claim 17 , further comprising:
 extracting a GUTI parameter from the S1AP authentication procedure messages; and   adding the GUTI to the record.