Lawful intercept reporting in wireless networks using public safety relays

Patent metadata

Field	Value
Publication number	US-11394454-B2
Application number	US-202017001051-A
Country	US
Kind code	B2
Filing date	Aug 24, 2020
Priority date	May 8, 2014
Publication date	Jul 19, 2022
Grant date	Jul 19, 2022

Abstract

A relay device assists in enabling lawful intercept (LI) by reporting, to a LI entity associated with the cellular network, authenticated identities of remote UEs (such as remote UEs connected via proximity services) and identification information that may allow the LI entity to monitor traffic (and/or control statistics related to the traffic) associated with the remote UEs. The authentication of the remote UEs may be performed using a technique that does not require involvement of the cellular network.

First claim

What is claimed is:

1. A method for a relay device, comprising:
authenticating a remote User Equipment (UE) that is connected to the relay device via a direct radio connection; and
based on Internet Protocol version 6 (IPv6) addressing being used for the direct radio connection,
assigning an IPv6 address prefix to the remote UE using IP prefix delegation, and
reporting, to a mobility management entity (MME) associated with a cellular wireless network to which the relay device is connected, the IPv6 address prefix and information related to an authenticated identity of the remote UE, and
based on Internet Protocol version 4 (IPv4) addressing being used for the direct radio connection,
assigning a first IPv4 address to the remote UE, and
reporting a second IPv4 address to the MME, the second IPv4 address determined based on the first IPv4 address using a Network Address Translation (NAT) procedure and the information related to the authenticated identity of the remote UE.

2. The method of claim 1 , further comprising relaying traffic associated with the remote UE, to the cellular wireless network, using Layer-3 forwarding of Internet Protocol (IP) packets between the remote UE and the cellular wireless network.

3. The method of claim 1 , wherein the authentication of the remote UE is performed based on digital signature received from a second UE, without communicating with a key management server.

4. The method of claim 3 , wherein the authentication is performed using Elliptic Curve-Based Certificateless Signatures for Identity-Based Encryption (ECCSI) techniques or certificate based techniques.

5. The method of claim 1 , wherein the MME is configured to communicate with a lawful intercept entity that includes a device operating in a user plane of the cellular wireless network, the reporting further including:
reporting the IPv6 address prefix or the IPv4 address and a port number, and the authenticated identity of the remote UE, via a user plane protocol.

6. The method of claim 1 , wherein the reporting to the MME is performed via Non-Access Stratum (NAS) layer signaling.

7. The method of claim 1 , comprising authenticating the remote UE based on information previously received by the relay device and the remote UE from the cellular wireless network.

8. The method of claim 1 , comprising authenticating the remote UE using out of network communications.

9. A baseband processor for a relay device, comprising:
authenticating a remote User Equipment (UE) that is connected to the relay device via a direct radio connection; and
based on Internet Protocol version 6 (IPv6) addressing being used for the direct radio connection,
assigning an IPv6 address prefix to the remote UE using IP prefix delegation, and
reporting, to a mobility management entity (MME) associated with a cellular wireless network to which the relay device is connected, the IPv6 address prefix and information related to an authenticated identity of the remote UE, and
based on Internet Protocol version 4 (IPv4) addressing being used for the direct radio connection,
assigning a first IPv4 address to the remote UE, and
reporting a second IPv4 address to the MME, the second IPv4 address determined based on the first IPv4 address using a Network Address Translation (NAT) procedure and the information related to the authenticated identity of the remote UE.

10. The baseband processor of claim 9 , further comprising relaying traffic associated with the remote UE, to the cellular wireless network, using Layer-3 forwarding of Internet Protocol (IP) packets between the remote UE and the cellular wireless network.

11. The baseband processor of claim 9 , wherein the authentication of the remote UE is performed based on digital signature received from a second UE, without communicating with a key management server.

12. The baseband processor of claim 11 , wherein the authentication is performed using Elliptic Curve-Based Certificateless Signatures for Identity-Based Encryption (ECCSI) techniques or certificate based techniques.

13. The baseband processor of claim 9 , wherein the MME is configured to communicate with a lawful intercept entity that includes a device operating in a user plane of the cellular wireless network, the reporting further including:
reporting the IPv6 address prefix or the IPv4 address and a port number, and the authenticated identity of the remote UE, via a user plane protocol.

14. The baseband processor of claim 9 , wherein the reporting to the MME is performed via Non-Access Stratum (NAS) layer signaling.

15. The baseband processor of claim 9 further configured to perform operations comprising authenticating the remote UE based on information previously received by the relay device and the remote UE from the cellular wireless network.

16. The baseband processor of claim 9 further configured to perform operations comprising authenticating the remote UE using out of network communications.

17. A User Equipment (UE) comprising a processor configured to perform operations comprising:
authenticating a remote User Equipment (UE) that is connected to the UE via a direct radio connection; and
based on Internet Protocol version 6 (IPv6) addressing being used for the direct radio connection,
assigning an IPv6 address prefix to the remote UE using IP prefix delegation, and
reporting, to a mobility management entity (MME) associated with a cellular wireless network to which the relay device is connected, the IPv6 address prefix and information related to an authenticated identity of the remote UE, and
based on Internet Protocol version 4 (IPv4) addressing being used for the direct radio connection,
assigning a first IPv4 address to the remote UE, and
reporting a second IPv4 address to the MME, the second IPv4 address determined based on the first IPv4 address using a Network Address Translation (NAT) procedure and the information related to the authenticated identity of the remote UE.

18. The UE of claim 17 , further comprising relaying traffic associated with the remote UE, to the cellular wireless network, using Layer-3 forwarding of Internet Protocol (IP) packets between the remote UE and the cellular wireless network.

19. The UE of claim 17 , wherein the authentication of the remote UE is performed based on digital signature received from a second UE, without communicating with a key management server.

20. The UE of claim 19 , wherein the authentication is performed using Elliptic Curve-Based Certificateless Signatures for Identity-Based Encryption (ECCSI) techniques or certificate based techniques.

21. The UE of claim 17 , wherein the MME is configured to communicate with a lawful intercept entity that includes a device operating in a user plane of the cellular wireless network, the reporting further including:
reporting the IPv6 address prefix or the IPv4 address and a port number, and the authenticated identity of the remote UE, via a user plane protocol.

22. The UE of claim 17 , wherein the reporting to the MME is performed via Non-Access Stratum (NAS) layer signaling.

23. The UE of claim 17 , wherein the processor is further configured to perform operations comprising authenticating the remote UE based on information previously received by the UE and the remote UE from the cellular wireless network.

24. The UE of claim 17 , wherein the processor is further configured to perform operations comprising authenticating the remote UE using out o

Assignees

• Apple Inc

Inventors

• Stojanovski Alexandre
• Venkatachalam Muthaiah

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04W12/033

  of the user plane, e.g. user's traffic · CPC title

• H04L63/306

  intercepting packet switched data communications, e.g. Web, Internet or IMS communications · CPC title

• H04W12/069

  using certificates or pre-shared keys · CPC title

• H04W88/04

  adapted for relaying to or from another terminal or user · CPC title