Security Activation for Dual Connectivity

• US 20160277445A1
• Filed: 01/30/2014
• Published: 09/22/2016
• Est. Priority Date: 01/30/2013
• Status: Abandoned Application

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Wager, Stefan, Johansson, Niklas, Norrman, Karl, Teyeb, Oumer, Virkki, Vesa
• Application Number:
  US14/373,665
• Publication Number:
  US 20160277445A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 16/32 Hierarchical cell structures
• CPC Class Codes: H04W 76/15 Setup of multiple wireless link connections

Abstract

Methods and apparatus for determining a security algorithm to be used for secured communications between a wireless terminal and a second node while the wireless terminal is dually connected to a first node and to the second node. An example method, implemented in the first node, includes determining (610) a first set of security algorithms, the first set including those algorithms supported by the wireless terminal. A second set of security algorithms is also determined (620), where the second set includes those security algorithms that are supported by the second node. In some embodiments, this determining (620) includes receiving information from the second node, the information identifying which security algorithms are supported by the second node. At least one security algorithm is then indicated (630) to the second node, wherein the indicated security algorithm is chosen from the intersection of the first and second sets.

Claims

1. A method, in a first node, for determining a security algorithm to be used for secured communications between a wireless terminal and a second node while the wireless terminal is dually connected to the first node and to the second node, the method comprising:

determining a first set of security algorithms, wherein the first set is supported by the wireless terminal;

determining a second set of security algorithms, wherein the second set is supported by the second node; and

indicating a security algorithm to the second node, wherein the security algorithm is chosen from the intersection of the first and second sets.

2. The method of claim 1, further comprising indicating the security algorithm to the wireless terminal.

3. The method of claim 2, wherein indicating the security algorithm to the wireless terminal comprises indicating the security algorithm in a Radio Resource Control, RRC, Security Mode Command sent to the wireless terminal.

4. The method of claim 3, wherein the Security Mode Command further indicates to which physical cell identity, PCI, the security algorithm applies.

5. The method of claim 2, wherein indicating the security algorithm to the wireless terminal is performed at the same time as informing the wireless terminal of one or more security algorithms to be used for secured communications between the wireless terminal and the first node.

6. The method of claim 2, wherein indicating the security algorithm to the wireless terminal comprises indicating the security algorithm in a Radio Resource Control, RRC, Connection Reconfiguration procedure.

7. The method of claim 2, wherein indicating the security algorithm to the wireless terminal comprises indicating whether the security algorithm applies to the uplink direction or downlink direction of a data radio bearer.

8. The method of claim 1, wherein determining the first set of security of algorithms comprises receiving information from a core network node, the information identifying which security algorithms are supported by the wireless terminal.

9. The method of claim 1, wherein determining the second set of security algorithms comprises receiving information from the second node, the information identifying which security algorithms are supported by the second node.

10. A method, in a second node, for determining a security algorithm to be used for secured communications between a wireless terminal and the second node while the wireless terminal is dually connected to a first node and to the second node, the method comprising:

receiving, from the first node, an indication of the security algorithm to be used for secured communications between the wireless terminal and the second node; and

using the security algorithm for secured communications between the wireless terminal and the second node while the wireless terminal is dually connected to the first node and to the second node.

11. The method of claim 10, further comprising sending, to the wireless terminal, an indication of the security algorithm.

12. The method of claim 10, further comprising, prior to receiving the indication of the security algorithm from the first node, sending to the first node information identifying which security algorithms the second node supports.

13. A first network node arranged to determine a security algorithm to be used for secured communications between a wireless terminal and a second network node while the wireless terminal is dually connected to the first network node and to the second network node, the first network node comprising:

interface circuitry configured to communicate with the second network node; and

processing circuitry configured to;

determine a first set of security algorithms, wherein the first set is supported by the wireless terminal;

determine a second set of security algorithms, wherein the second set is supported by the second network node; and

indicate a security algorithm to the second network node, via the interface circuitry, wherein the security algorithm is chosen from the intersection of the first and second sets.

14. The first network node of claim 13, wherein the interface circuitry is further configured to communicate with the wireless terminal and wherein the processing circuitry is further configured to indicate the security algorithm to the wireless terminal.

15. The first network node of claim 14, wherein the processing circuitry is configured to indicate the security algorithm to the wireless terminal in a Radio Resource Control, RRC, Security Mode Command sent to the wireless terminal.

16. The first network node of claim 15, wherein the Security Mode Command indicates to which physical cell identity, PCI, the security algorithm applies.

17. The first network node of claim 14, wherein the processing circuitry is configured to indicate the security algorithm to the wireless terminal is performed at the same time as informing the wireless terminal of one or more security algorithms to be used for secured communications between the wireless terminal and the first network node.

18. The first network node of claim 14, wherein the processing circuitry is configured to indicate the security algorithm to the wireless terminal in a Radio Resource Control, RRC, Connection Reconfiguration procedure.

19. The first network node of claim 14, wherein the processing circuitry is configured to indicate to the wireless terminal whether the security algorithm applies to the uplink direction or downlink direction of a data radio bearer.

20. The first network node of claim 13, wherein the processing circuitry is configured to determine the first set of security of algorithms by receiving information from a core network node, the information identifying which security algorithms are supported by the wireless terminal supports.

21. The first network node of claim 13, wherein the processing circuitry is configured to determine the second set of security algorithms by receiving information from the second network node, the information identifying which security algorithms are supported by the second network node supports.

22. A second network node arranged to determine a security algorithm to be used for secured communications between a wireless terminal and a second network node while the wireless terminal is dually connected to the first network node and to the second network node, the second network node comprising:

interface circuitry configured to communicate with the first network node and the wireless terminal; and

processing circuitry configured to;

receive from the first network node, via the interface circuitry, an indication of the security algorithm to be used for secured communications between the wireless terminal and the second network node; and

use the security algorithm for secured communications between the wireless terminal and the second network node while the wireless terminal is dually connected to the first network node and to the second network node.

23. The second network node of claim 22, wherein the processing circuitry is further configured to send to the wireless terminal, via the interface circuitry, an indication of the security algorithm.

24. The second network node of claim 22, wherein the processing circuitry is further configured to, prior to receiving the indication of the security algorithm from the first network node, send to the first network node information identifying which security algorithms the second network node supports.

25. A first network node arranged to determine a security algorithm to be used for secured communications between a wireless terminal and a second network node while the wireless terminal is dually connected to the first network node and to the second network node, the first network node comprising:

interface circuitry configured to communicate with the second network node;

a determining module for determining a first set of security algorithms, wherein the first set is supported by the wireless terminal, and for determining a second set of security algorithms, wherein the second set is supported by the second network node; and

an indicating module for indicating the security algorithm to the second network node, via the interface circuitry, wherein the security algorithm is chosen from the intersection of the first and second sets.

26. A second network node arranged to determine a security algorithm to be used for secured communications between a wireless terminal and a second network node while the wireless terminal is dually connected to the first network node and to the second network node, the second network node comprising:

interface circuitry configured to communicate with the first network node and the wireless terminal;

a receiving module for receiving from the first network node, via the interface circuitry, an indication of the security algorithm to be used for secured communications between the wireless terminal and the second network node; and

a security module for applying the security algorithm to secured communications between the wireless terminal and the second network node while the wireless terminal is dually connected to the first network node and to the second network node.