3GPP 33102 PDF

The present document has been developed within the 3rd Generation Partnership Project (3GPP TM) and may be further elaborated for the purposes of 3GPP. The present document has not been subject to any approval process by the 3GPP Organisational Partners and shall not be implemented. Retrieved from archive/33_series// zip 3rd Generation Partnership Project. (). Counteracting envisaged 3G.

Author: Shak Akigrel
Country: Peru
Language: English (Spanish)
Genre: Software
Published (Last): 11 April 2005
Pages: 258
PDF File Size: 5.49 Mb
ePub File Size: 14.64 Mb
ISBN: 822-7-74843-433-9
Downloads: 36226
Price: Free* [*Free Regsitration Required]
Uploader: Gom

USA1 – Communicating with a machine to machine device – Google Patents

Year of fee payment: A method comprises maintaining, in a first node serving a mobile 33gpp over a connection protected by at least one first key, said first key and information about the key management capabilities of the mobile terminal. Upon relocation of the mobile terminal to a second node the method includes: TECHNICAL FIELD The invention relates to methods that allow a node to maintain information about the capabilities, for example key management capabilities of a corresponding node for example a node serving a mobile terminal may maintain information about the key management capabilities of the mobile terminal.

It also relates to a node having this capability. It is known that wireless communications 33gpp as radio communications need to be secured 333102 encryption owing to the relative ease with which wireless communication can be compromised. Examples of the invention will be described 33012 reference to radio communication, which uses radio-frequency electromagnetic waves to carry the communication and which is one example of wireless communication, but the invention is not limited to radio communication.

In many cases, security is defined over a wireless link such as a radio 333102. However, distributing a key to multiple and easily accessible nodes poses a threat, as it increases the opportunities for an attacker to obtain a key. This means that it is necessary to protect the key s stored and used in the base station. One way of doing this is by improving the ways in which keys are managed.

The function f is a key derivation function, typically 3g;p on a 331002 cryptographic function, e. If more 331022 one key needs to be tweaked this can easily be accomplished by using a set of functions F, where f i is applied to obtain the i th key, for f i in F.

The key K eNB 2 is calculated by the first base station 2 and is transferred from the first base station 2 to the new base station 3 via a communication channel e.

Thus, after handover wireless communications 5 between the new base station 3 and 3gp ME are protected using the new key K eNB 2 rather than using the original key K eNB 1. It should be noted that in LTE there are also other mechanisms for changing keys at relocation and in conjunction with certain state-changes of the ME.

However, these mechanisms all require that the new key is generated by another network node, the so-called Mobility Management Entity MMEand will therefore not be discussed further. It will be understood that it is desirable that the computation of the new key K eNB 2 is done in the first base station 2as otherwise the original key K eNB 1 would, at least temporarily, be exposed also in the new base station 3.

It is within the scope to look at a solution to the problem of changing the 3pp at handover. It has been acknowledged that it should be possible to change the keys also at SRNS relocation i. These cases coincide with the mobility events that causes a change of RNC: In addition the problem of interoperability with legacy terminals and 3g;p equipment does not exist in LTE since it was designed from the beginning to support the above-described key-change mechanism. The issues with introducing such a key-change mechanism in networks that are already deployed, but which 3glp not have this functionality, will be apparent from the further discussion below.

This is illustrated in FIG. Hence, the ME is unaware of the change of RNC until it is completed, and this makes it difficult for the ME to determine which keys were used to protect certain messages to 33120 described in more detail later —any solution adopted for UTRAN must overcome this problem.

3gp relocation the ME 1 is, as shown in broken lines, served by another base station, which may be a base station served by the same RNC as the base station before relocation eg NodeB 3gpo or which may alternatively be a base station served by a different RNC to the base station before relocation e.

The existing approaches for providing key tweaking, independently on the ME and the network sides, have a number of problems in the procedures discussed above. This implies that ciphering and integrity protection is performed in a location 3tpp is in the periphery of the network possibly the radio equipment chassis is located in a hostile environment where hackers may physically attack it to get access to the ciphering keys.

This makes it necessary to investigate enhanced protection of the keys used in HSPA. Unlike the LTE standard however, the system was not designed from the outset to take the need to change keys at relocation into account. If a feature of changing keys at relocation is introduced, we need to provide for. Rather, 33102 only possibility to change keys at handover for these radio access technologies is based on a performing a full or in 3gop WLAN case, the optimized This is not acceptable in WCDMA as zero signalling overhead is desired from key management point of view; there will of course be mobility signalling taking place.

A first aspect of the invention provides a method comprising maintaining, in a first node serving a mobile terminal over a connection protected by at least one first key, said first key and information about key management capabilities of the mobile terminal.

When the mobile terminal is relocated to a second node, if, and only if, said key management capabilities indicate an enhanced key management capability supported by the mobile terminal, the first node modifies the first key, thereby creating a second 3pp which is sent from the first node to the 3tpp node. Information about the key management capabilities of the mobile terminal is transmitted to the second node.

  6ES7 216-2BD00-0XB0 PDF

The invention makes it possible for a node in this case the first node to maintain 3310 about the key management capabilities of a corresponding node in this case the mobile terminal. At relocation 3fpp the mobile terminal to a second node, the first node modifies the first key to create a second key if, and only if, the information maintained about the key management capabilities of the mobile terminal indicates that the mobile terminal supports an enhanced key management capability—otherwise, the first node does not modify the first key.

Thus, if the first node knows, from the maintained information, that the mobile terminal is able to tweak the key sit is safe for the first node to tweak the key s at relocation since the second node and the mobile terminal will be able to communicate using the tweaked key s after relocation. The invention thus ensures that either 1 both the first node and the mobile terminal modify the first key or 2 neither the first node and the mobile terminal modify the first key, so that the key used at the network side after relocation will be the same as the key used at the mobile side after relocation.

3pgp, information as to whether 333102 not the mobile terminal is updated is sent to the target RNC so that the target RNC is made aware of whether the 333102 terminal is updated assuming 3gppp target RNC is updated; if the target RNC is not updated it will ignore the information received from the source RNC.

3fpp the connection is protected by two or more keys, it would in principle be possible for only some of the keys to be changed tweakedso that not all keys would be changed. In practice however it will usually be desirable to change all keys when enhanced key management capabilities are supported for greatest security. Furthermore, transmitting information about the key management capabilities of the 3302 terminal to the second node means that, when the second node subsequently hands the mobile terminal 3102 a further node, the second node will be aware whether or not the mobile terminal is an updated mobile terminal that is able to tweak the key s at relocation.

The second node thus knows whether it is able to tweak the key s upon the subsequent relocation of the mobile terminal again assuming the target RNC second node is updated; if the target RNC is not updated it will as already stated ignore the information 3ypp from the source RNC. The method may further comprise, prior to the first node modifying said first key, the first node instructing said mobile terminal to perform an intra-node relocation to said first node.

The information about the key management capabilities of the mobile terminal may be transmitted to the second node by the mobile terminal or the first node. The information may be transmitted in one or more signalling messages relating to completion of the relocation. This 33102 the invention to be implemented without the need for any additional messages to be exchanged at relocation.

The first node may determine at a relocation preparation phase, based on the information, whether the enhanced key management capability is supported by the mobile terminal. A relocation in general consists of two phases: In this embodiment when the source RNC decides that it is time to relocate the terminal to the target RNC, 3310 source RNC starts the preparation phase and can then determine if the mobile terminal supports enhanced key handling.

After this, the source RNC may chose to complete the relocation by running also the execution phase. Modifying the first key may 3gp modifying the first key using the first key and optionally but preferably also using information relating to the second node.

The method may comprise, when the mobile terminal is handed over from a third node to the first node, the first node sending information about its key management capabilities to the mobile terminal.

At relocation, information that the target RNC the first node is an updated RNC is sent to the mobile terminal, so that the mobile terminal is made aware that it is being served after the relocation by an updated RNC assuming the mobile terminal is updated; if the mobile terminal is 33102 updated it will ignore the information received from the target RNC.

The method may further comprise receiving at the first node, after relocation of the mobile terminal from the third node to the first node, information from the mobile terminal about the key management capabilities of the mobile terminal. For example, if the mobile terminal is updated it informs the target RNC of this. The target RNC in this earlier relocation ie the first node stores 3glp information it receives about the key management capabilities of the mobile terminal.

The information about the key g3pp capabilities of the first node sent by the first node to the mobile terminal may comprise information that the first node supports an enhanced key management capability. A second aspect of the invention provides a method comprising: Upon relocation 3302 the mobile terminal from the first node to a second node, the mobile terminal modifies the first key to create a second key if, and 331002 if, the key 33012 capabilities indicate that the first node supports an enhanced key management capability.

The first node may, for example, be an RNC. The mobile terminal which is updatedis aware whether or not the RNC serving the mobile terminal is updated and so will tweak the key s upon relocation to the target RNC second node.

The method may further comprise, before the mobile terminal modifies the first key, the mobile terminal performing an intra-node relocation to said first node upon receipt of an instruction from the first node to do so.

  ANDREW BASIAGO THE DISCOVERY OF LIFE ON MARS PDF

The method may also comprises, when the mobile terminal is handed over from the first node 3312 a second node, the mobile terminal transmitting, to the second node, information about the key management capabilities of the mobile terminal. The information may be included in one or more signalling messages relating to completion of the relocation.

A third aspect of 3pgp invention provides a node for serving a mobile terminal, the node comprising a module for maintaining information about the key management capabilities of a mobile terminal being served by the node over a connection protected by at least one first key, and said first key.

The node further has a module for, upon relocation of the mobile terminal to a second node, 3gp;, and only if, said key management capabilities indicate an enhanced key management capability supported by the mobile terminal, modifying the first key, thereby creating a second key, and also has a module for sending, from 3gp first node to the second node, the second key.

The node may further comprise a module for transmitting to the second node the information about the key management capabilities of the mobile terminal.

A fourth aspect of the invention provides a mobile terminal comprising a module for maintaining information about the key management capabilities of a first node serving the mobile terminal over a connection protected by at least one first key, and the first key. The mobile terminal may further have a module for, upon relocation of the mobile terminal from the first node to a second node, if, and only if, said key management capabilities indicate an enhanced key management capability supported by the first node, modifying, by said mobile terminal, the first key, thereby creating a second key.

The mobile terminal may further have a module for transmitting, from the mobile terminal to the second node, information about the key management capabilities of the mobile terminal.

In a node of the third aspect or a mobile terminal of the fourth aspect the modules may be implemented in hardware as separate hardware modules or combined in one hardware module, or they may be implemented as one or more software modules operating on a suitably-programmed processor, or they may be implemented as combination of hardware and software modules.

Preferred embodiments of the invention will be described, by way of example, with reference to the accompany figures in which:. If so, does the target or source RNC change the key s?

As explained earlier these problems do not occur in terminals and networks operating according to the current LTE standard since the mobile terminal and the network will always be able to tweak a key on relocation—so that both the network and the mobile terminal know at all times that the other entity is capable of changing the key s.

In addition, in the LTE standard, the change of key s is as mentioned always coupled with a hard handover as shown in FIG. Embodiments of the invention will be described with reference to the three possible relocation schemes shown in FIGS. As noted, the source and target RNC may communicate with each other via the core network to coordinate the relocation or, in later versions of the UTRAN standard, the RNCs may communicate directly with each other via the lur interface. For simplicity, the description below describes how the invention is effected when the RNCs may communicate directly with one another, but the invention may readily be applied to a case where the RNCs communicate with one another via the core network.

Thus, it is assumed that the key modifying function above denoted f is fixed so that the choice is only on whether to apply f or not to apply f. In general, however, there could also be different choices for which function f to apply. Other, more general security capabilities could also be handled in a similar manner. Moreover, the invention does not relate to the particular form of the key modifying function, and any suitable key modifying function may be used.

In all embodiments, the key modifying function, f, is preferably based on a suitable strong cryptographic function, e. In the description of the invention the following terminology will be used:.

Legacy entity An entity which is not aware of the enhanced key handling. Updated entity An entity that is updated and capable of dealing with the enhanced key handling. As used above, entities which are updated have a plus sign appended to their name, e. The invention makes use of the following property: As an example, 3GPP network protocols are designed in this way. There are several options for handling the ME’s enhanced key capabilities at the initial attach.

All that is needed is for the existing ME capability signalling with the core network to be amended to include information a new IE about the enhanced key capabilities of the ME, so that the core network is made aware that the attaching ME is an updated ME.

Another option is for the ME to inform the core network about its enhanced key capability with the core network and radio access network separately.

US20160226828A1 – Communicating with a machine to machine device – Google Patents

It should be understood that the exact procedure used at initial attach is outside the scope of the invention. To illustrate this, in a sequence of RNC relocations: For simplicity, 3g;p description makes no distinction whether we discuss PS or CS keys whose usage depend on the type of service usedsince the same principle apply to each type of key. Also, it should also be noted that the control plane key s may be different from the user plane keys.

Back to top