Security solution for integrating a WiFi radio interface in LTE access network

Patent metadata

Field	Value
Publication number	US-9414223-B2
Application number	US-201213399293-A
Country	US
Kind code	B2
Filing date	Feb 17, 2012
Priority date	Feb 17, 2012
Publication date	Aug 9, 2016
Grant date	Aug 9, 2016

Abstract

A method for security for inter-RAT carrier aggregation is disclosed. The method includes encrypting a message using an encryption technique for a first RAT. The method also includes sending, to a UE, at least a portion of the encrypted message using a different, second RAT. Sending using the second RAT does not further encrypt the at least a portion of the encrypted message. The method further includes receiving the at least a portion of the message encrypted using the first RAT protocol. Receiving uses the second, different RAT. The method also includes decrypting the at least a portion of the message using the first RAT protocol. Apparatus and computer readable media are also described.

First claim

What is claimed is:

1. A method comprising:
encrypting a message using an encryption technique for a first radio access technology;
sending, to a user equipment, at least a portion of the encrypted message using a different, second radio access technology,
where sending using the second radio access technology does not further encrypt the at least a portion of the encrypted message; and
filtering incoming transmissions on the second radio access technology using a medium access control address of the second radio access technology;
wherein the method further comprises sending, to the user equipment using the first radio access technology, instructions for the user equipment to configure for operation on the second radio access technology, wherein the instructions include an identification of a second radio access technology access point, wherein the encrypted message is also integrity protected, and wherein the message is configured to discard a packet data unit and an integrity verification failure identification is indicated when an integrity verification fails;
where the first radio access technology is a Universal Terrestrial Radio Access Network (UTRAN) packet data convergence protocol and the second radio access technology is a wireless local area network, wherein the encryption of the message comprises only a single Long Term Evolution (LTE) encrypted and wherein the sending of the at least a portion of the LTE encrypted message using the wireless local area network does not further encrypt the at least a portion of the LTE encrypted message.

2. The method of claim 1 , where the at least a portion of the encrypted message is a first portion, the method further comprising:
splitting the encrypted message into the first portion and a second portion; and
sending the second portion of the encrypted message using the first radio access technology.

3. The method of claim 1 , where encrypting the message occurs at a first protocol layer, and sending the at least a portion of the encrypted message occurs at a lower second protocol layer.

4. The method of claim 1 , further comprising:
receiving, from the user equipment using the first radio access technology, a medium access control address of the user equipment on the second radio access technology;

adding the medium access control address to an access list for the second radio access technology access point; and
removing the medium access control address from the access list in response to a lack of activity for the user equipment on the second radio access technology.

5. A method comprising:
receiving at least a portion of a message encrypted using a first radio access technology protocol, where receiving uses a second, different radio access technology;
decrypting the at least a portion of the message using the first radio access technology protocol; and
filtering incoming transmissions on the second radio access technology using a medium access control address of the second radio access technology;
wherein the method further comprises receiving, using the first radio access technology protocol, instructions to configure a user equipment for operation on the second radio access technology, wherein the instructions include an identification of a second radio access technology access point, wherein the encrypted message is also integrity protected, and wherein the message is configured to discard a packet data unit and an integrity verification failure identification is indicated when an integrity verification fails;
where the first radio access technology is a Universal Terrestrial Radio Access Network (UTRAN) packet data convergence protocol and the second radio access technology is a wireless local area network, wherein the encryption of the message comprises only a single Long Term Evolution (LTE) encryption, and wherein the sending of the at least a portion of the LTE encrypted message using the wireless local area network does not further encrypt the at least a portion of the LTE encrypted message.

6. The method of claim 5 , further comprising:
binding medium access control address of the second radio access technology to a first radio access technology identity.

7. The method of claim 5 , where decrypting the message occurs at a first protocol layer, and the method further comprises sending the decrypted message to a higher, second protocol layer, wherein the first protocol layer comprises a packet data convergence protocol (PDCP) layer, wherein the method further comprises determining whether the decrypted message passes a cyclic redundancy check at the second protocol layer, and determining whether the decrypted message passes the integrity verification at the second protocol layer.

8. The method of claim 5 , where the at least a portion of the encrypted message is a first portion, the method further comprising:
receiving the second portion of the encrypted message using the first radio access technology;
decrypting the second portion of the message using the first radio access technology protocol; and
combining the decrypted first portion and the decrypted second portion to generate a decrypted message.

9. An apparatus, comprising at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following:
to encrypt a message using an encryption technique for a first radio access technology;
to send, to a user equipment, at least a portion of the encrypted message using a different, second radio access technology,
where sending using the second radio access technology does not further encrypt the at least a portion of the encrypted message; and
to filter incoming transmissions on the second radio access technology using a medium access control address of the second radio access technology;
wherein the at least one memory and the computer program code are further configured to cause the apparatus to send, to the user equipment using the first radio access technology, instructions for the user equipment to configure for operation on the second radio access technology, wherein the instructions include an identification of a second radio access technology access point, wherein the encrypted message is also integrity protected, and wherein the message is configured to discard a packet data unit and an integrity verification failure identification is indicated when an integrity verification fails;
where the first radio access technology is a Universal Terrestrial Radio Access Network (UTRAN) packet data convergence protocol and the second radio access technology is a wireless local area network, wherein the encryption of the message comprises only a single Long Term Evolution (LTE) encryption, and wherein the sending of the at least a portion of the LTE encrypted message using the wireless local area network does not further encrypt the at least a portion of the LTE encrypted message.

10. The apparatus of claim 9 , where the at least a portion of the encrypted message is a first portion, and the at least one memory and the computer program code are further configured to cause the apparatus:
to split the encrypted message into the first portion and a second portion; and
to send the second portion of the encrypted message using the first radio access technology.

11. The apparatus of claim 9 , where encrypting the message occurs at a first protocol layer, and sending the at least a portion of the encrypted message occurs at a lower second protocol layer.

12. The apparatus of claim 9 , where the at least one memory and the computer

Assignees

• Ginzboorg Philip
• Malkamaki Esa M
• Rantala Enrico
• Sorri Antti S
• Uusitalo Mikko A
• Nokia Technologies Oy

Inventors

• Ginzboorg Philip
• Malkamaki Esa M
• Rantala Enrico
• Sorri Antti S
• Uusitalo Mikko A

Classifications

• H04W80/02

  Data link layer protocols · CPC title

• H04L63/205 Primary

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04W84/12

  WLAN [Wireless Local Area Networks] · CPC title

• H04W12/02 Primary

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• H04W12/03

  Protecting confidentiality, e.g. by encryption · CPC title