SECURITY HANDLING FOR RRC RESUME FROM INACTIVE STATE

• US 20190320316A1
• Filed: 04/16/2019
• Published: 10/17/2019
• Est. Priority Date: 04/16/2018
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Mildh, Gunnar, da Silva, Icaro L. J.
• Granted Patent: US 10,555,168 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/60 Context-dependent security
• CPC Class Codes: H04W 76/18 Management of setup rejection or failure
• CPC Class Codes: H04W 76/19 Connection re-establishment
• CPC Class Codes: H04W 76/27 Transitions between radio resource control [RRC] states
• CPC Class Codes: H04W 80/08 Upper layer protocols network arrangements or communication protocols for networked applications H04L67/00
• CPC Class Codes: H04W 92/10 between terminal device and access point, i.e. wireless air interface

Abstract

Methods are provided for a User Equipment, UE, in NR RRC to revert back to an old security context if an RRC Resume procedure from an inactive state fails. In this way, any subsequent Resume attempts by the UE will derive new security keys from the old keys, which means that the keys and security context will be the same for each attempt. In this way, the security context in the UE will remain synchronized with the network security context, regardless of how many attempts the UE has performed (assuming the network does not change the security context when the Resume procedure fails). Alternatively, the UE may store the new security context it derives during the first Resume attempt, and then ensure that it is reused at subsequent Resume attempts.

Claims

1. A method of updating a security context, performed by a wireless device operative in a wireless communication network employing a Radio Resource Control, RRC, protocol, wherein the wireless device in RRC CONNECTED state receives from the network an RRC Suspend message including a security update parameter, and in response to the RRC Suspend message enters an RRC INACTIVE state and stores a first security context, the method comprising, upon attempting to transition to an RRC CONNECTED state:

generating a second security context using the security update parameter received in the RRC Suspend message;

sending to the network an RRC Resume Request message; and

in response to one of the following events, discarding the second security context;

receiving from the network an RRC Reject message in response to the RRC Resume Request message;

expiration of a timer started upon sending the RRC Resume Request message, without receiving a responsive message from the network; and

performing a cell reselection prior to receiving a message from the network responsive to the RRC Resume Request message.

5. The method of claim 1 wherein the security update parameter contained in the RRC Suspend message comprises a chaining counter parameter used for next hop access key derivation.

7. The method of claim 1 further comprising, in the case of receiving from the network an RRC Reject message in response to the RRC Resume Request message, obtaining a wait time the wireless device should wait prior to sending another RRC Resume Request message, wherein the wait time is included in the RRC Reject message.

11. The method of claim 1, wherein the second security context is discarded in response to receiving 4064 from the network the RRC Reject message in response to the RRC Resume Request message, and the method further comprises:

in response to the receiving from the network the RRC Reject message in response to the RRC Resume Request message, restoring the first security context.

12. The method of claim 1, wherein the second security context is discarded in response to expiration of the timer started upon sending the RRC Resume Request message, without receiving the responsive message from the network.

13. The method of claim 1, wherein the second security context is discarded in response to performing the cell reselection prior to receiving the message from the network responsive to the RRC Resume Request message.

14. The method of claim 1, further comprising decoding a response to the RRC Resume Request message using one or more security parameters from the second security context.

2-4. -4. (canceled)

6. (canceled)

8-10. -10. (canceled)

15-36. -36. (canceled)

37. A wireless device operative in a wireless communication network employing a Radio Resource Control, RRC, protocol, wherein the wireless device in RRC CONNECTED state receives from the network an RRC Suspend message including a security update parameter, and in response to the RRC Suspend message enters an RRC INACTIVE state and stores a first security context, the wireless device comprising:

communication circuitry;

processing circuitry operatively connected to the communication circuitry, and adapted to, upon attempting to transition to an RRC CONNECTED state;

generate a second security context using the security update parameter received in the RRC Suspend message;

send to the network an RRC Resume Request message; and

in response to one of the following events, discard the second security context;

receiving from the network an RRC Reject message in response to the RRC Resume Request message;

expiration of a timer started upon sending the RRC Resume Request message, without receiving a responsive message from the network; and

performing a cell reselection prior to receiving a message from the network responsive to the RRC Resume Request message.

41. The wireless device of claim 37 wherein the security update parameter contained in the RRC Suspend message comprises a chaining counter parameter used for next hop access key derivation.

43. The wireless device of claim 37 wherein the processing circuitry is further adapted to, in the case of receiving from the network an RRC Reject message in response to the RRC Resume Request message, obtain a wait time the wireless device should wait prior to sending another RRC Resume Request message.

44. The wireless device of claim 43 wherein the wait time is included in the RRC Reject message.

47. The wireless device of claim 37, wherein the second security context is discarded in response to receiving from the network the RRC Reject message in response to the RRC Resume Request message, and wherein the processing circuitry is further adapted to, upon attempting to transition to an RRC CONNECTED state:

in response to the receiving from the network the RRC Reject message in response to the RRC Resume Request message, restore the first security context.

48. The wireless device of claim 37, wherein the second security context is discarded in response to expiration of the timer started upon sending the RRC Resume Request message, without receiving the responsive message from the network.

49. The wireless device of claim 37, wherein the second security context is discarded in response to performing the cell reselection prior to receiving the message from the network responsive to the RRC Resume Request message.

38-40. -40. (canceled)

42. (canceled)

45-46. -46. (canceled)

50-60. -60. (canceled)

61. A base station operative in a wireless communication network employing a Radio Resource Control, RRC, protocol, comprising:

communication circuitry;

processing circuitry operatively connected to the communication circuitry, and adapted to;

store a previously active security context for the wireless device;

receive from the wireless device an RRC Resume Request message including a security token;

generate a temporary security context for the wireless device;

use the temporary security context to verify the security token;

send an RRC message to the wireless device; and

if no response to the RRC message is received from the wireless device, discard the temporary security context and retrieve the previously active security context.

62. The base station of claim 61 wherein the wireless device is in an RRC INACTIVE state;

63. The base station of claim 61 wherein the processing circuitry is adapted to generate a temporary security context for the wireless device using a security update parameter sent to the wireless device in an RRC Suspend message.

64. The base station of claim 63 wherein the security update parameter sent to the wireless device in an RRC Suspend message comprises a chaining counter parameter used for next hop access key derivation.

65. The base station of claim 61 wherein the previously active security context and the temporary security context comprise one or more cryptographic keys.

66. The base station of claim 61 wherein the processing circuitry is adapted to send an RRC message to the wireless device by sending an RRC Resume message to the wireless device, wherein the RRC Resume message is encrypted or integrity protected using the temporary security context.

67-72. -72. (canceled)