Method and system for providing security from a radio access network

Patent metadata

Field	Value
Publication number	US-9986432-B2
Application number	US-201415105439-A
Country	US
Kind code	B2
Filing date	Dec 23, 2014
Priority date	Dec 23, 2013
Publication date	May 29, 2018
Grant date	May 29, 2018

Abstract

The disclosure relates to a security method and system in a telecommunications network comprising a radio access network system and a core network system. The radio access network system is configured to provide a wireless radio interface for at least one user device, wherein a shared secret key is stored in both the user device and the core network system. At least one vector is received from the core network system comprising one or more values derived from the shared secret key. At least one of an authentication procedure and a key agreement procedure is performed in the radio access network system for the user device over the wireless radio interface using the one or more values of the received vector for establishing a connection between the user device and the radio access network system.

First claim

The invention claimed is:

1. A security method in a telecommunications network comprising a radio access network (RAN) system and a core network system, wherein the radio access network system is configured to provide a wireless radio interface for at least one user device, wherein a shared secret key is stored in both the user device and the core network system, the method carried out in the radio access network system and comprising:
receiving from the core network system, at least one vector comprising one or more values derived from the shared secret key;
storing the at least one vector in the radio access network; and
after storing the at least one vector, performing at least one of an authentication procedure and a key agreement procedure for the user device over the wireless radio interface using the one or more values of the received vector for establishing a connection between the user device and the radio access network system,
wherein the core network system pre-stores a RAN only indication associated with the user device to transmit the vector to the radio access network system, the method further comprising only receiving the at least one vector in the radio access network system from the core network system for a user device for which the RAN only indication has been pre-stored.

2. The method according to claim 1 , further comprising the detecting an inability to handle the at least one of the authentication procedure and the key agreement procedure from the core network system, wherein receiving the vector is performed prior to detecting the inability and performing the authentication procedure and/or key agreement procedure using the one or more values of the received vector is performed after detecting the inability.

3. The method according to claim 1 , further comprising storing at least one communication identifier in the radio access network system, the communication identifier enabling a communication service to be established for the user device.

4. The method according claim 1 , further comprising:
periodically receiving the vector from the core network system.

5. The method according to claim 1 , wherein the radio access network system comprises at least a first node and a second node, communicatively connected to the first node, the method further comprising:
receiving a request for establishing a connection at the first node in the radio access network system; and
performing the at least one of the authentication procedure and the key agreement procedure at the second node in the radio access network system.

6. The method according to claim 5 , further comprising:
receiving a location indication at the first node in the request for establishing a connection, the location indication indicating that the vector is available at the second node.

7. The method according to claim 1 , further comprising:
receiving the vector in a trusted node in the radio access network system.

8. The method according to claim 1 , further comprising refreshing one or more vectors in the radio access network system for performing the at least one of the authentication procedure and the key agreement procedure.

9. The method according claim 1 , further comprising:
transmitting a RAN-only indication to the user device that the radio access network system performs the at least one of the authentication procedure and the key agreement procedure for obtaining one or more services from the radio access network system.

10. The method according to claim 5 , further comprising:
recording in a third node of the radio access network system that the vector is available at the second node and informing the first node by the third node that the vector is available at the second node.

11. The method according to claim 5 , further comprising:
broadcasting a request from the first node in the radio access network system, the request identifying the user device for which the vector is sought.

12. The method according to claim 5 , further comprising:
transmitting a location indication from the second node to the first node and further to the user device, the location indication indicating that the vector is available at the second node.

13. The method according to claim 1 , further comprising:
transmitting a signalling message to the user device indicating that one or more values of the vector are non-operable for performing the authentication procedure and/or the key agreement procedure when the core network system is able to perform the authentication procedure and the key agreement procedure.

14. A non-transitory computer readable medium having instructions stored thereon that, when executed by one or more processors of a radio access network system, cause the radio access network system to carry out operations for security in a telecommunications network, wherein the telecommunications network comprises the radio access network system and a core network system, wherein the radio access network system is configured to provide a wireless radio interface for at least one user device, wherein a shared secret key is stored in both the user device and the core network system, and wherein the operations include:
receiving from the core network system, at least one vector comprising one or more values derived from the shared secret key;
storing the at least one vector in the radio access network; and
after storing the at least one vector, performing at least one of an authentication procedure and a key agreement procedure for the user device over the wireless radio interface using the one or more values of the received vector for establishing a connection between the user device and the radio access network system,
wherein the core network system pre-stores a RAN only indication associated with the user device to transmit the vector to the radio access network system, the method further comprising only receiving the at least one vector in the radio access network system from the core network system for a user device for which the RAN only indication has been pre-stored.

15. A radio access network system comprising:
one or more network nodes providing a wireless radio interface for at least one user device and configured to connect to a core network system, wherein, in operation, a shared secret key is stored in both the user device and the core network system;
a receiver configured for receiving from the core network system at least one vector comprising one or more values derived from the shared secret key;
a processor configured for performing at least one of an authentication procedure and a key agreement procedure for the user device over the wireless radio interface using the one or more values of the received vector for establishing a connection between the user device and the radio access network system; and
one or more processors and memory storing instructions that, when executed by the one or more processors, cause the radio access network system to carry out operations including:
receiving from the core network system, at least one vector comprising one or more values derived from the shared secret key;
storing the at least one vector in the radio access network; and
after storing the at least one vector, performing at least one of an authentication procedure and a key agreement procedure for the user device over the wireless radio interface using the one or more values of the received vector for establishing a connection between the user device and the radio access network system,
wherein the core network system pre-stores a RAN only indication associated with the user device to transmit the vector

Assignees

• Koninklijke Kpn Nv
• TNO
• Nederlandse Organisatie Voor Toegepast Natuurwetenschappelijk Onderzgek Tno

Inventors

• Fransen Frank

Classifications

• H04W88/08

  Access point devices · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F16/22 Primary

  Indexing; Data structures therefor; Storage structures · CPC title