Analysis And Enhancements For Security Aspects Of LTE And LTE-A Networks

High demands for broadband mobile wireless communications and the emergence of new wireless multimedia applications constitute the motivation to the development of broadband wireless access technologies in recent years. The Long Term Evolution/System Architecture Evolution (LTE/SAE) system has been specified by the Third Generation Partnership Project (3GPP) on the way towards fourth-generation (4G) mobile to ensure 3GPP keeping the dominance of the cellular communication technologies. Through the design and optimization of new radio access techniques and a further evolution of the LTE systems, the 3 GPP is developing the future LTE-Advanced (LTE-A) wireless networks as the 4G standard of the 3GPP. Since the 3GPP LTE and LTE-A architecture are designed to support flat Internet Protocol (IP) connectivity and full interworking with heterogeneous wireless access networks, the new unique features bring some new challenges in the design of the security mechanisms.To avoid the security problems existing in Universal Mobile Telecommunications System (UMTS), the LTE/SAE architecture enhances the UMTS-Authentication and Key Agreement (UMTS-AKA) and presents the new access security approach, Evolved Packet System AKA (EPS AKA). In addition, a new key hierarchy and handover key management mechanism has been introduced in order to ensure the security of the access and the mobility process in the LTE architecture. In addition to maintain the secure strength of the LTE systems, a LTE-A system has introduced some new entities and applications such as Machine Type Communication (MTC), Home eNodeB (HeNB), Relay nodes and specified the corresponding security vulnerabilities, requirements and solutions. However, there are still some security vulnerabilities in the current LTE/LTE-A networks, which need to be further analyzed.This dissertation has analyzed systematically the security problems and vulnerabilities existed in current LTE and LTE-A networks, and designed some solutions for the corresponding security vulnerabilities.The authors’ main contributions can be summarized as follows.1) There are two types of base stations in the LTE/LTE-A wireless networks, HeNB and eNodeB (eNB). To achieve seamless handovers between the HeNB and the eNB is critical to support mobility in the LTE/LTE-A networks. A handover from an eNB/HeNB to a new eNB/HeNB, suggested by 3 GPP, requires distinct procedures for different mobility scenarios with a complex key management mechanism, which will increase the system complexity. Besides, it cannot achieve backward security in handover procedures. Furthermore, the existing handover schemes for other wireless networks are not suitable for the mobility scenarios in the LTE/LTE-A networks due to their inherent features. To avoid the above problems, we propose a fast and secure handover authentication scheme, which is to fit in with all of the mobility scenarios in the LTE/LTE-A networks. Compared with other handover schemes, our scheme cannot only achieve a simple authentication process with desirable efficiency, but also provide several security features including Perfect Forward/Backward Secrecy (PBS/PFS), which has never been achieved by previous works. The experimental results and formal verification by using the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool and Security Protocol ANimator for AVISPA (SPAN) tool show that the proposed scheme is efficient and secure against various malicious attacks.2) To achieve seamless handovers between the Evolved Universal Terrestrial Radio Access Network (E-UTRAN) and other access networks is a challenging task as it requires comprehensive real-time interconnectivity in the LTE/LTE-A networks. 3 GPP has suggested support the mobility between the E-UTRAN and non-3GPP access networks, which requires full access authentication procedures and distinct procedures for different mobility scenarios, which will bring a lot of message exchanges and increase the system complexity. To solve this problem, we propose a fast and secure handover authentication scheme to fit in with all of the mobility scenarios in the LTE/LTE-A networks. Compared with other handover schemes, our scheme cannot only provide strong security guarantees including PFS and Master Key Forward Secrecy (MKFS) and user anonymity, but also achieve a simple authentication process with robust efficiency in terms of communication cost, storage cost and computational cost. The experimental results and formal verification by using the Temporal Logic Actions (TLA+) and its model checker Temporal Logic Checker (TLC) show that the proposed scheme is secure against various malicious attacks.3) Machine Type Communication (MTC), called Machine to Machine (M2M) communication as one of next sophisticated techniques for future wireless communications, is gaining a tremendous interest in standardization organizations such as 3GPP. To accomodate data and signaling traffic from massive MTC devices is a challenging task to ensure the security of MTC applications in the LTE/LTE-A networks as the number of MTC devices continue to increase quickly. Since each MTC device has to implement an independent access authentication procedure specified by the current 3 GPP standard, it will incur severe signaling congestions in the LTE/LTE-A networks when a large number of MTC devices simultaneously connect to the network. To avoid signaling overloads to the LTE/LTE-A network elements, we propose a group-based access authentication and key agreement scheme, by which a good deal of MTC devices can be simultaneously authenticated by the network and establish an independent session key with the network respectively. Our scheme cannot only greatly reduce the signal transmission for mass of devices to the network and thus avoid the signaling overload over LTE/LTE-A network, but also achieve robust security and desirable efficiency. The experimental results and formal verification by using the TLA+ and TLC show that the proposed scheme is secure against various malicious attacks.