Method, System and Device for Negotiating Security Capability when Terminal Moves

• US 20140120879A1
• Filed: 01/03/2014
• Published: 05/01/2014
• Est. Priority Date: 08/31/2007
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: He, Chengdong
• Granted Patent: US 8,812,848 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 69/24 Negotiation of communication capabilities
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 36/0038 of security context information
• CPC Class Codes: H04W 8/02 Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks

Abstract

A method, user equipment (UE) and system are provided for negotiating a security capability during idle state mobility of the UE from a non-long term evolution (non-LTE) network to a long term evolution (LTE) network. The UE sends UE security capabilities supported by the UE to the LTE network for a non-access stratum (NAS) security algorithm selection use. The UE then receives from the LTE network selected NAS security algorithm. The UE further generates a root key from an authentication vector-related key stored at the UE and then derives, from the generated root key, a NAS protection key for security communication with the LTE network.

Claims

1. A user equipment (UE) comprising:

a transmitter configured to send, in situations where the UE moves in idle state from a non-long term evolution (non-LTE) network to a long term evolution (LTE) network, UE security capabilities supported by the UE to the LTE network for a non-access stratum (NAS) security algorithm selection use;

a receiver configured to receive a selected NAS security algorithm from the LTE network; and

a processor configured to generate a root key from an authentication vector-related key available at the UE and to derive, from the generated root key, a NAS protection key for communicating with the LTE network.

2. The UE of claim 1, wherein, in a situation where the moving of the UE is from a second generation (2G) network to the LTE network, the authentication vector-related key for generating the root key includes an encryption key (Kc).

3. The UE of claim 1, wherein, in a situation where the moving of the UE is from a third generation (3G) network to the LTE network, the authentication vector-related key for generating the root key includes an integrity key (IK) and an encryption key (KC).

4. The UE of claim 1, wherein the transmitter is configured to send the UE security capabilities through a tracking area update (TAU) request message.

5. The UE of claim 1, wherein the receiver is configured to receive the selected NAS security algorithm through a NAS security mode command message.

6. The UE of claim 1, wherein the receiver is configured to receive the selected NAS security algorithm through a tracking area update (TAU) accept message.

7. The UE of claim 1, wherein the receiver is further configured to receive UE security capability information from the LTE network.

8. The UE of claim 7, wherein the processor is further configured to compare whether the UE security capability information received from the LTE network is consistent with UE security capabilities information stored in the UE, and to determine that a security capability negotiation fails if the UE security capability information received from the LTE network is inconsistent with the UE security capabilities information stored in the UE.

9. A method for security capability negotiation during idle state mobility of a user equipment (UE), in a situation where the UE moves from a non-long term evolution (non-LTE) network to a long term evolution (LTE) network, the method comprising:

sending, by the UE, UE security capabilities supported by the UE to the LTE network for a non-access stratum (NAS) security algorithm selection use;

receiving, by the UE, a selected NAS security algorithm from the LTE network;

generating, by the UE, a root key from an authentication vector-related key available at the UE; and

deriving, by the UE, a NAS protection key according to the generated root key.

10. The method of claim 9, wherein in a situation where the moving of the UE is from a second generation (2G) network, the authentication vector-related key includes an encryption key (Kc).

11. The method of claim 9, wherein in a situation where the moving of the UE is from a third generation (3G) network, the authentication vector-related key includes an integrity key (1K) and an encryption key (KC).

12. The method of claim 9, wherein in the sending step, the UE security capabilities is sent by being included in a tracking area update (TAU) request message.

13. The method of claim 9, wherein the receiving the selected NAS security algorithm comprises:

receiving, by the UE, a NAS security mode command message including the selected NAS security algorithm.

14. The method of claim 9, wherein the selected NAS security algorithm is received by the UE through a tracking area update (TAU) accept message.

15. The method of claim 9, further comprising:

receiving, by the UE, UE security capability information from the LTE network.

16. The method of claim 15, further comprising:

comparing, by the UE, whether the UE security capability information received from the LTE network is consistent with UE security capabilities information stored in the UE; and

determining, by the UE, the security capability negotiation fails if the UE security capability information received from the LTE network is inconsistent with the UE security capabilities information stored in the UE.

17. A system for security capability negotiation during idle state mobility, the system comprising:

a user equipment (UE) configured to communicatively connect with a non-long term evolution (non-LTE) network or a long term evolution (LTE) network,

wherein in situations where the UE in idle state moves from the non-LTE network to the LTE network, the UE is further configured to;

send UE security capabilities supported by the UE to the LTE network for a non-access stratum (NAS) security algorithm selection use;

receive a selected NAS security algorithm from the LTE network; and

generate a root key from an authentication vector-related key available at the UE; and

derive from with the generated root key a NAS protection key for communicating with the LTE network.

18. The system of claim 17, wherein, in a situation where UE moves from a second generation (2G) network to the LTE network, the authentication vector-related key for generating the root key includes an encryption key (Kc).

19. The system of claim 17, wherein, in a situation where the UE moves from a third generation (3G) network to the LTE network, the authentication vector-related key for generating the root key includes an integrity key (IK) and an encryption key (KC).

20. The system of claim 17, wherein the UE security capabilities is sent to the LTE network by being included in a tracking area update (TAU) request message.

21. The system of claim 17, wherein the UE is configured to receive the selected NAS security algorithm through a NAS security mode command message.

22. The system of claim 17, wherein the UE is configured to receive the selected NAS security algorithm through a tracking area update (TAU) accept message.

23. The system of claim 17, wherein the UE is further configured to receive UE security capability information from the LTE network.

24. The system of claim 23, wherein the UE is further configured to compare whether the UE security capability information received from the LTE network is consistent with UE security capabilities information stored in the UE, and to determine that the security capability negotiation fails if the UE security capability information received from the LTE network is inconsistent with the UE security capabilities information stored in the UE.