Cross-interface correlation of traffic

Patent metadata

Field	Value
Publication number	US-2019166106-A1
Application number	US-201816035075-A
Country	US
Kind code	A1
Filing date	Jul 13, 2018
Priority date	Nov 28, 2017
Publication date	May 30, 2019
Grant date	—

Abstract

A device may monitor traffic associated with a user equipment (UE) on multiple interfaces of a network. The device may determine an identity associated with the UE or the traffic on the multiple interfaces by correlating identifiers associated with the UE or the traffic across the multiple interfaces. The identity may uniquely identify a subscriber associated with the UE or the traffic. The device may determine a set of elements to be used to decipher the traffic after determining the identity associated with the UE or the traffic. The device may decipher the traffic utilizing the set of elements after determining the set of elements.

First claim

What is claimed is:

1 . A method, comprising:
monitoring, by a device, traffic associated with a user equipment (UE) on multiple interfaces of a network; determining, by the device, an identity associated with the UE or the traffic on the multiple interfaces by correlating identifiers associated with the UE or the traffic across the multiple interfaces,
wherein the identity uniquely identifies a subscriber associated with the UE or the traffic;
determining, by the device, a set of elements to be used to decipher the traffic after determining the identity associated with the UE or the traffic; and deciphering, by the device, the traffic utilizing the set of elements after determining the set of elements.

2 . The method of claim 1 , wherein the multiple interfaces include:
a third generation partnership project (3GPP) F1 interface, a 3GPP S1 interface, a 3GPP S11 interface, or a 3GPP X2 interface.

3 . The method of claim 1 , wherein the set of elements includes:
an evolved packet system (EPS) encryption algorithm (EEA) or a 5G/New Radio (NR) encryption algorithm (NEA) used to encrypt the traffic, a cipher key associated with the traffic, a bearer associated with the traffic, a count associated with the traffic, a direction associated with the traffic, or a length associated with the traffic.

4 . The method of claim 1 , further comprising:
correlating an international mobile subscriber identity (IMSI) and a general packet radio service (GPRS) tunneling protocol user plane (GTP-U) tunnel endpoint identifier (TEID) (GTP-U TEID) on an interface of the multiple interfaces after monitoring the traffic; and wherein determining the identity associated with the UE or the traffic on the multiple interfaces comprises:
determining the identity associated with the UE or the traffic on the multiple interfaces based on correlating the IMSI and the GTP-U TEID on the interface.

5 . The method of claim 1 , further comprising:
correlating an international mobile subscriber identity (IMSI) and a master node key (KeNB) on an interface of the multiple interfaces; determining a secondary node key (S-KgNB), associated with the KeNB, on one or more other interfaces of the multiple interfaces after correlating the IMSI and the KeNB; and wherein determining the identity associated with the UE or the traffic on the multiple interfaces comprises:
determining the identity associated with the UE or the traffic on the multiple interfaces based on:
correlating the IMSI and the KeNB, or
determining the S-KgNB.

6 . The method of claim 1 , further comprising:
determining a cipher key associated with the identity after determining the identity,
wherein the cipher key is included in the set of elements; and
storing the cipher key in a memory resource of the device after determining the cipher key.

7 . The method of claim 1 , wherein determining the set of elements comprises:
determining an evolved packet system (EPS) encryption algorithm (EEA) or a 5G/New Radio (NR) encryption algorithm (NEA) used to encrypt the traffic after determining the identity associated with the UE or the traffic; determining a set of keys from a master node key (KeNB) or a secondary node key (S-KgNB) associated with the UE or the traffic after determining the EEA or the NEA used to encrypt the traffic; and determining a bearer, a count, a direction, or a length associated with the traffic after determining the set of keys.

8 . A device, comprising:
one or more memories; and one or more processors, communicatively coupled to the one or more memories, configured to:
monitor traffic associated with a user equipment (UE) on multiple interfaces of a network;
correlate identifiers associated with the UE or the traffic across the multiple interfaces after monitoring the traffic;
determine an identity associated with the UE or the traffic on the multiple interfaces based on correlating the identifiers,
wherein the identity uniquely identifies a subscriber associated with the UE or the traffic;

determine a set of elements to be used to decipher the traffic after determining the identity associated with the UE or the traffic; and
decipher the traffic utilizing the set of elements after determining the set of elements.

9 . The device of claim 8 , wherein the one or more processors, when correlating the identifiers, are configured to:
correlate an international mobile subscriber identity (IMSI) and a general packet radio service (GPRS) tunneling protocol user plane (GTP-U) tunnel endpoint identifier (TEID) across the multiple interfaces after monitoring the traffic.

10 . The device of claim 8 , wherein the one or more processors, when correlating the identifiers, are configured to:
correlate an international mobile subscriber identity (IMSI) and a master node key (KeNB) on an interface of the multiple interfaces; and correlate a secondary node key (S-KgNB) with the KeNB on one or more other interfaces, of the multiple interfaces, after correlating the IMSI and the KeNB.

11 . The device of claim 8 , wherein the one or more processors, when deciphering the traffic, are configured to:
decipher the traffic by inputting at least some of the set of elements into an evolved packet system (EPS) encryption algorithm (EEA) or a 5G/New Radio (NR) encryption algorithm (NEA) used to encrypt the traffic.

12 . The device of claim 8 , wherein the one or more processors, when determining the identity associated with the UE or the traffic, are configured to:
determine the identity based on a general packet radio service (GPRS) tunneling protocol user plane (GTP-U) tunnel endpoint identifier (TEID).

13 . The device of claim 8 , wherein the one or more processors, when determining the identity associated with the UE or the traffic, are configured to:
determine the identity based on at least one of:
a master node key (KeNB), or
a secondary node key (S-KgNB).

14 . The device of claim 8 , wherein the multiple interfaces include:
a first interface between a mobility management entity device (MME) and a serving gateway (SGW) associated with the network, a second interface between the MME and a first base station associated with the network, a third interface between the SGW and a second base station associated with the network, a fourth interface between the first base station and the second base station, or a fifth interface between the second base station and a third base station associated with the network.

15 . A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors, cause the one or more processors to:
monitor traffic associated with a user equipment (UE) on multiple interfaces of a network;
correlate identifiers associated with the UE or the traffic across the multiple interfaces after monitoring the traffic;
determine an identity associated with the UE or the traffic on the multiple interfaces based on correlating the identifiers,
wherein the identity uniquely identifies a subscriber associated with the UE or the traffic; and

determine a set of elements to be used to decipher the traffic after determining the identity associated with the UE or the traffic.

16 . The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, that cause the one or more processors to correlate the identifiers, further cause the one or more processors to:
correlate a first identifier and a second identifier on a third generation partne

Assignees

• Viavi Solutions Inc

Inventors

• Munro Andrew
• Fortune Gordon
• Liu Jun
• Zhou Xiang
• Koo Eng Wei

Classifications

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04W12/06

  Authentication · CPC title