SECURITY FOR SOFTWARE DEFINED RADIO TERMINALS

• US 20100146274A1
• Filed: 06/18/2007
• Published: 06/10/2010
• Est. Priority Date: 06/18/2007
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Selander, Goran, Naslund, Mats, Almgren, Magnus, Kallin, Harald
• Granted Patent: US 8,977,852 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/06 the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A module (2) for integrity protection of messages transmitted from a mobile software defined radio (SDR) terminal (1), the module provided with a confined cryptographic key K and arranged to receive loaded SDR-code. The module derives an integrity protecting key Rk from at least said cryptographic key K, and provides a periodic integrity protection on-line of generated messages using said key integrity protecting key Rk, and the integrity of said messages is verified by an integrity checking node (10) of the access network.

Claims

1. An SDR-protecting module (2) for an SDR terminal (1), said module provided with a confined cryptographic key K and arranged to receive loaded SDR-code, characterized in that the SDR-protecting module is further arranged to derive an integrity protecting key Rk from at least said cryptographic key K, and to provide a periodic integrity protection on-line of generated SDR-functionality messages using said key integrity protecting key Rk, the integrity of said messages to be verified by an integrity checking node (10) in the access network.

2. An SDR-protecting module (2) according to claim 1, wherein said integrity checking node (10) is arranged to receive the integrity protecting key Rk from a key generating server (7) of the home network by AAA signalling, said key generating server arranged to derive said integrity protecting key Rk from at least said cryptographic key K.

3. An SDR-protecting module (2) according to claim 1, wherein said integrity checking node (10) is arranged to derive the integrity protecting key Rk from input values received from the home network, at least one of said input values being dependent on said cryptographic key K.

4. An SDR-protecting module according to any of the preceding claims, wherein a copy of said cryptographic key K is stored in a terminal register unit (5) in the home network.

5. An SDR-protecting module (2) according to any of the preceding claims, wherein said SDR-functionality messages comprises radio signal measurement reports.

6. An SDR-protecting module (2) according to any of the preceding claims, wherein said integrity protection involves a control plane signalling unit (8) calculating a message authenticating checksum using said integrity protecting key Rk obtained from said module (2), said message authenticating checksum to be added to said message before transmission.

7. An SDR-protecting module according to any of the preceding claims, wherein said SDR functionality messages are associated with the RRC-layer.

8. An SDR-protecting module according to any of the preceding claims, wherein said SDR-functionality messages are associated with the MAC-layer.

9. An SDR protecting module according to any of the preceding claims, wherein the SDR protecting module is arranged to receive SDR-code loaded directly from an SDR code storage (3) and to verify the correctness of the loaded SDR-code.

10. An SDR protecting module according to claim 9, wherein the module is arranged to inactivate the control plane signalling generating unit (8) if the loaded SDR-code is incorrect.

11. An SDR protecting module according to claim 9 or 10, wherein the SDR protecting module is arranged to perform implicit verification of the loaded SDR code by calculating a checksum of the loaded SDR code, and including said checksum in the derivation of the integrity protection key Rk.

12. An SDR protecting module according to claim 11, wherein the calculation of the checksum of the loaded SDR code, and the derivation of the integrity protecting key Rk, is repeated periodically.

13. A SDR-protecting module according to claim 11 or 12, wherein loaded SDR-code associated with the RRC layer is included in said checksum.

14. A SDR-protecting module according to any of the claims 11-13, wherein loaded SDR-code associated with the MAC-layer is included in said checksum.

15. An SDR protecting module, according to any of the preceding claims, wherein the SDR protecting module is further arranged to include information derived from the security key of the SIM or USIM (4) of the SDR terminal in the calculation of the integrity protection key Rk.

16. An SDR protecting module, according to any of the preceding claims, wherein the SDR protecting module provides an execution environment (12) for at least a part of the RRC-signalling generation and processing.

17. An SDR protecting module, according to any of the preceding claims, wherein the module is implemented at least partly as a hardware module.

18. An SDR terminal (1), comprising at least one SDR protecting module (2), according to any of the preceding claims.

19. A method of integrity protecting SDR-functionality software using an SDR protecting module (2) provided with a confined cryptographic key K, the method characterized by the SDR-protecting module performing the following steps:

Receiving (31) loaded SDR code;

Deriving (32) an integrity protection key Rk from at least said cryptographic key K;

Providing a periodic on-line integrity protection (35) of SDR-functionality messages by the derived integrity protection key Rk, the integrity of the messages to be verified (36) by an integrity checking node in the access network.

20. A method of integrity protecting SDR-functionality software, according to claim 19, wherein said SDR protecting module (2) further includes information derived from the security key of the SIM or USIM in the derivation of the integrity protecting key Rk.

21. A method of integrity protecting SDR-functionality software, according claim 19 or 20, wherein the SDR protecting module receives SDR-code loaded directly from an SDR code storage (3) and verifies the correctness of said loaded SDR code.

22. A method of integrity protecting SDR-functionality software, according to claim 19 or 20, wherein the SDR protecting module performs implicit verification of the loaded SDR code by calculating (72, 82) a checksum of the loaded SDR code, and including said checksum in the derivation (73, 83) of the integrity protection key Rk.

23. A method according to claim 22, wherein said checksum of the loaded SDR coded is recalculated periodically, the recalculation followed by a derivation of the integrity protection key Rk.

24. A method of integrity protecting SDR-functionality software, according to claim 22 or 23, wherein loaded SDR-code associated with the RRC layer is included in the derivation of the integrity protection key Rk.

25. A method of integrity protecting SDR-functionality software, according to any of the claims 22-24, wherein loaded SDR-code associated with the MAC-layer is included in the derivation of the integrity protection key Rk.

26. A method of integrity protecting SDR functionality software, according to any of the claims 19-25, wherein the integrity checking node further determines the correlation between RRC bad reception-signal reports and TCP ACKNOWLEDGEMENTS relating to an SDR terminal.

27. A method of integrity protecting SDR-functionality software, according any of the claims 19-26, wherein said integrity checking node (10) receives said integrity protecting key Rk from a key generating server (7) in the home network by AAA signalling.

28. A method of integrity protecting SDR-functionality software, according to claim 27, wherein the key generating server (7) derives said integrity protecting key Rk from a copy of said cryptographic key K stored in a terminal register unit (5) in the home network.

29. A method of integrity protecting SDR-functionality software, according to claim 28, wherein the key generating server (7) further derives the integrity protecting key Rk from a copy of the loaded SDR code stored in said terminal register unit (5).

30. A method of integrity protecting SDR-functionality software, according to any of the claims 28-29, wherein the key generating server (7) further derives the integrity protecting key Rk from a copy of a key from the SIM or USIM stored in a HLR/AuC or a HSS of the home network.

31. A method of integrity protecting SDR-functionality software, according to any of the claims 19-26, wherein the integrity checking node derives the integrity protecting key Rk from input values received from the home network, at least one of said input values being dependent on the cryptographic key K.

32. A method of integrity protecting SDR-functionality software, according to any of the claims 19-31, wherein the home network transfers information indicating the SDR-code version to the access network.

33. A method of integrity protecting SDR-functionality software, according to any of the claims 19-32, the method comprising an SDR-module authenticating procedure (34) to verify the presence of the SDR-protecting module, said procedure using information dependent on a copy of the secret cryptographic key K obtained from a terminal register unit (5) of the home network.

34. A method of integrity protecting SDR-functionality software, according to any of the claims 19-33, wherein the integrity protected SDR-functionality messages comprise radio signal measurement reports.

35. A method of integrity protecting SDR-functionality software, according to any of the claims 19-34, wherein said integrity protection involves a control plane signal generating unit (8) computing a message authenticating checksum using said derived key Rk obtained from the SDR-protecting module, said authenticating checksum being added to the SDR-functionality message before transmission.

36. A method of integrity protecting SDR-functionality software, according to claim 35, wherein the integrity checking node (10) verifies a received SDR-functionality message by comparing the message authenticating checksum added to the message with a message authenticating checksum calculated from the integrity protecting key Rk.

37. A method of integrity protecting SDR-functionality software, according to claim 36, wherein the access network disconnects the mobile terminal if said compared message authenticating checksums do not correspond.

38. A method of integrity protecting SDR-functionality software, according to any of the claims 19-37, wherein said SDR functionality messages are associated with the RRC-layer.

39. A method of integrity protecting SDR-functionality software, according to any of the claims 19-38, wherein said SDR-functionality messages are associated with the MAC-layer.

40. A method of integrity protecting SDR-functionality software, according to claim 35-39, wherein the SDR protecting module inactivates said control plane signalling generating unit if said loaded SDR code is incorrect.