SECURE SIGNALING BEFORE PERFORMING AN AUTHENTICATION AND KEY AGREEMENT

• US 20170325094A1
• Filed: 11/07/2016
• Published: 11/09/2017
• Est. Priority Date: 05/05/2016
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Lee, Soo Bum, Chaponniere, Lenaig Genevieve, Palanigounder, Anand, Escott, Adrian Edward, Horn, Gavin Bernard
• Granted Patent: US 10,588,019 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

Techniques are described for wireless communication. A method of wireless communication at a wireless communication device includes generating a secured query message based at least in part on a security credential of the wireless communication device, where the secured query message is generated prior to performing an authentication and key agreement (AKA) with a network; transmitting the secured query message to the network; receiving a response to the secured query message; and determining whether to perform the AKA with the network based at least in part on the received response.

Claims

1. A method of wireless communication at a wireless communication device, comprising:

generating a secured query message based at least in part on a security credential of the wireless communication device, the secured query message generated prior to performing an authentication and key agreement (AKA) with a network;

transmitting the secured query message to the network;

receiving a response to the secured query message; and

determining whether to perform the AKA with the network based at least in part on the received response.

2. The method of claim 1, further comprising:

establishing a secure connection with the network based at least in part on the security credential of the wireless communication device and a network security credential of the network;

wherein the secured query message is transmitted to the network using the secure connection.

3. The method of claim 2, wherein establishing the secure connection comprises:

establishing the secure connection with a core network.

4. The method of claim 2, wherein establishing the secure connection comprises:

performing a transport layer security (TLS) handshake over a non-access stratum (NAS).

5. The method of claim 2, wherein establishing the secure connection comprises:

establishing the secure connection with a network access device.

6. The method of claim 2, wherein establishing the secure connection comprises:

performing a TLS handshake over a radio resource control (RRC) connection.

7. The method of claim 2, further comprising:

performing the AKA using the secure connection.

8. The method of claim 2, wherein the wireless communication device is associated with a first mobile network of a home mobile network operator (MNO), the method further comprising obtaining at least one of:

a first security credential of a roaming MNO from the first mobile network;

or a second security credential of the roaming MNO from a second mobile network of the roaming MNO, the second security credential signed by the home MNO;

or a third security credential of the roaming MNO from a certificate authority common to the home MNO and the roaming MNO;

or a combination thereof

9. The method of claim 1, further comprising:

determining the response is not associated with;

the security credential of the wireless communication device, a network security credential of the network, or a combination thereof; and

refraining from considering the response when determining whether to perform the AKA with the network.

10. The method of claim 1, further comprising:

determining a network supports receipt of a secured query message.

11. The method of claim 10, wherein the determining is based at least in part on a network advertisement.

12. The method of claim 1, further comprising:

receiving a non-secured message from the network;

wherein the secured query message is generated in response to the non-secured message.

13. The method of claim 1, wherein the secured query message is further generated based at least in part on a network security credential of the network.

14. The method of claim 1, wherein the secured query message is secured based at least in part on pairing-based cryptography.

15. The method of claim 14, wherein the pairing-based cryptography comprises at least one of:

an identity-based encryption, an identity-based signature, or a combination thereof.

16. The method of claim 1, further comprising:

determining the response is associated with the security credential of the wireless communication device and a network security credential of the network; and

determining whether to perform the AKA with the network based at least in part on the response.

17. The method of claim 1, wherein the secured query message comprises:

an access request, a network capability query, a service query, or a combination thereof

18. The method of claim 1, wherein the response comprises a message that causes the wireless communication device a denial of service.

19. A method for wireless communication at a network device, comprising:

receiving a secured query message over a network, from a wireless communication device, prior to performing an authentication and key agreement (AKA) with the wireless communication device, the secured query message based at least in part on a security credential of the wireless communication device;

generating, in response to receiving the secured query message, a secured response message based at least in part on a network security credential of the network device; and

transmitting the secured response message to the wireless communication device.

20. The method of claim 19, further comprising:

establishing a secure connection with the wireless communication device based at least in part on the security credential of the wireless communication device and the network security credential of the network device;

wherein the secured query message is received over the network using the secure connection.

21. The method of claim 20, wherein the network device comprises at least one of:

a network access device, a core network device, or a combination thereof

22. The method of claim 20, wherein the secure connection comprises a transport layer security (TLS) handshake over a non-access stratum (NAS).

23. The method of claim 20, wherein the secure connection comprises a TLS handshake over a radio resource control (RRC) connection.

24. The method of claim 20, further comprising:

performing the AKA with the wireless communication device using the secure connection.

25. The method of claim 20, wherein the wireless communication device and the network device are associated with a first mobile network of a home mobile network operator (MNO), the method further comprising:

transmitting to the wireless communication device, over the first mobile network, a security credential of a roaming MNO.

26. The method of claim 19, wherein the secured query message is further based at least in part on the network security credential of the network device.

27. The method of claim 19, wherein the secured query message is secured based at least in part on pairing-based cryptography.

28. The method of claim 19, wherein the secured query message comprises:

an access request, a network capability query, a service query, or a combination thereof.

29. An apparatus for wireless communication, comprising:

a processor;

memory in electronic communication with the processor; and

the processor and memory configured to;

generate a secured query message based at least in part on a security credential of the wireless communication device, the secured query message generated prior to performing an authentication and key agreement (AKA) with a network;

transmit the secured query message to the network;

receive a response to the secured query message; and

determine whether to perform the AKA with the network based at least in part on the received response.

30. A non-transitory computer-readable medium storing computer-executable code for wireless communication, the code comprising instructions executable to:

generate a secured query message based at least in part on a security credential of the wireless communication device, the secured query message generated prior to performing an authentication and key agreement (AKA) with a network;

transmit the secured query message to the network;

receive a response to the secured query message; and

determine whether to perform the AKA with the network based at least in part on the received response.