Fast-accessing method and apparatus

• US 9,807,072 B2
• Filed: 02/06/2012
• Issued: 10/31/2017
• Est. Priority Date: 02/06/2012
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Technologies Oy (Nokia Corporation)
• Inventors: Liu, Yang, Li, Haitao, Lei, Yixue, Zhang, Da Jiang
• Primary Examiner(s): Abyaneh, Ali
• Application Number:
  US14/372,860
• Publication Number:
  US 20140337935A1
• Time in Patent Office: 2,094 Days
• Field of Search: 726 4
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 36/0038 of security context information
• CPC Class Codes: H04W 48/08 Access restriction or access information delivery, e.g. discovery data delivery signalling during connection H04W76/00

Abstract

A fast-accessing method may comprise: establishing a first security connection between a first network node and a user equipment; obtaining first information from a second network node, wherein the first information comprises at least one of system information of the second network node and an identifier of a security algorithm selected by the second network node for the user equipment; providing second information to the second network node, in response to an indication of the second network node from the user equipment, wherein the second information comprises security information related to the user equipment; and sending the first information to the user equipment for establishing a second security connection between the user equipment and the second network node.

Claims

1. A method, comprising:

establishing, over a first communication connection, a first security connection between a first network node and a user equipment;

obtaining, from a second network node, a first information, the first information comprising at least one of system information of the second network node and an identifier of a security algorithm selected by the second network node for the user equipment;

providing, by the first network node and to the second network node, a second information, the providing being in response to an indication received from the user equipment that the user equipment has detected the second network node, and the second information comprising security information related to the user equipment;

sending the first information to the user equipment; and

establishing, over a second communication connection separate from the first communication connection, a second security connection between the user equipment and the second network node, the establishing of the second security connection being in response to the user equipment deriving, based on the first information, a security key for encoding data over the second communication connection.

2. The method according to claim 1, wherein establishing the first security connection between the first network node and the user equipment comprises obtaining a first security key for the first security connection, and wherein the security information related to the user equipment comprises another identifier of the user equipment and a second security key generated based at least in part on the first security key.

3. The method according to claim 1, wherein the first information is obtained through a direct interface or an indirect interface between the first network node and the second network node.

4. The method according to claim 1, wherein the first security connection is still maintained when the second security connection is established.

5. The method of claim 1, wherein the second network node comprises a plurality of second network nodes.

6. An apparatus, comprising:

at least one processor; and

at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to at least;

establish, over a first communication connection, a first security connection between the apparatus and a user equipment;

obtain, from another apparatus, a first information, the first information comprising at least one of system information of the another apparatus, and an identifier of a security algorithm selected by the another apparatus for the user equipment;

provide, to the another apparatus, a second information, the second information provided in response to an indication received from the user equipment that the user equipment has detected the another apparatus, and the second information comprising security information related to the user equipment;

send, to the user equipment, the first information for establishing, between the user equipment and the another apparatus, a second security connection over a second communication connection separate from the first communication connection; and

establish the second security connection, the establishment of the second security connection being in response to the user equipment deriving, based on the first information, a security key for encoding data over the second communication connection.

7. The apparatus according to claim 6, wherein establishing the first security connection between the apparatus and the user equipment comprises a first security key being obtained for the first security connection, and wherein the security information related to the user equipment comprises another identifier of the user equipment and a second security key generated based at least in part on the first security key.

8. The apparatus according to claim 6, wherein the first information is obtained through a direct interface or an indirect interface between the apparatus and the another apparatus.

9. The apparatus according to claim 6, wherein the first security connection is still maintained when the second security connection is established.

10. A method, comprising:

establishing, over a first communication connection, a first security connection between a first network node and a user equipment;

sending, to the first network node, an indication that a second network node has been detected;

receiving, from the first network node, a first information, the first information comprising at least one of system information of the second network node and an identifier of a security algorithm selected by the second network node for the user equipment;

establishing, over a second communication connection separate from the first communication connection, a second security connection between the user equipment and the second network node; and

deriving, by the user equipment and based on the first information, a security key for encoding data over the second security connection.

11. The method according to claim 10, wherein establishing the second security connection between the user equipment and the second network node comprises:

performing an authentication procedure based at least in part on the first information and a second information comprising security information related to the user equipment.

12. The method according to claim 11, wherein establishing the first security connection between the first network node and the user equipment comprises obtaining a first security key for the first security connection, and wherein the security information related to the user equipment comprises another identifier of the user equipment, and a second security key generated based at least in part on the first security key.

13. The method according to claim 10, wherein the first security connection is still maintained when the second security connection is established.

14. An apparatus, comprising:

at least one processor; and

at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following;

establish, over a first communication connection, a first security connection between a first network node and the apparatus;

send, to the first network node, an indication that a second network node has been detected by the apparatus;

receive, from the first network node, a first information, the first information comprising at least one of system information of the second network node and an identifier of a security algorithm selected by the second network node for the apparatus;

derive, based on the first information, a security key for encoding data over a second communication connection between the apparatus and the second network node, the second communication connection separate from the first communication connection; and

establish, over the second communication connection, a second security connection between the apparatus and the second network node.

15. The apparatus according to claim 14, wherein the second security connection is established by at least:

an authentication procedure being performed based at least in part on the first information and a second information comprising security information related to the apparatus.

16. The apparatus according to claim 15, wherein the first security connection is established by at least a first security key being obtained for the first security connection, and wherein the security information related to the apparatus comprises another identifier of the apparatus and a second security key generated based at least in part on the first security key.

17. The apparatus according to claim 14, wherein the first security connection is still maintained when the second security connection is established.