Apple Inc.

Future Wei Technologies, Inc.

Telefonaktiebolaget Lm Ericsson (Publ)

Microsoft Technology Licensing, LLC

Nortel Networks Corporation

Rockstar Bidco, LP

Mavenir Networks, Inc.

Huawei Technologies Co., Limited

Blackberry Corporation

Research in Motion Corporation

Ahmad Shawky Muhanna

Mohamed Khalil

Barnaba Barnowski

Eric W Parsons

Khosrow Tony Saboorian

Haseeb Akhtar

Marcus Wong

Essam El-Beik

Hachem Moussa

Ricardo Serrano

Kory Keith

George Foti

Mazin Ali Al-Shalash

Octavio Jose De Franca Lima

Dinand Roeland

Zu Qiang

Zhibi Wang

Peter Hedman

Tingting Geng

He Li

Jing Chen

Xin Zeng

Peter J McCann

Ke-Chi Jang

Li Hu

Jiangsheng Wang

Rikard Eriksson

Michael Anthony Brown

Marvin Bienn

Pierre Boulos

Jianying Qian

Pete Wenzel

Xiang Xie

Martin Staron

Michael Brown

Zu Qiang Qiang

A method and an architecture for the Roaming Hub that can be configured to establish interconnectivity between any visiting Public Line Mobile Network (PLMN) and home PLMN as long as the visiting PLMN and the Home PLMN has a roaming agreement with the Roaming Hub.

Roaming hub 5G interconnect for public line mobile networks

A method of performing authentication of a client for wireless communication includes: sending, by the client, a request to an authorization server via a proxy node, to obtain an access token, wherein the request to obtain the access token contains a client signature of the client; authenticating, by the authorization server, the client as a valid recipient of the access token; and authorizing, by the authorization server, the access token to the client after authenticating the client, wherein the authorization is based on at least the client signature contained in the request to obtain the access token.

Client authentication and access token ownership validation

This disclosure provides techniques for securely communicating user equipment (UE) specific information from a UE to a network-side device. In particular, the UE may either encrypt the UE specific information using an encryption key to form an encrypted portion, where the UE specific information includes subscriber identity information and the encryption key is calculated in accordance with a public key of a home network of the UE. The UE generates a message authentication code (MAC) signature based on the encrypted portion and a first integrity key, where the first integrity key is calculated in accordance with the public key of the home network. The UE sends, to a network-side device, a request message including the encrypted portion, the MAC signature and a network identifier of the home network.

Authentication mechanism for 5G technologies

A method and apparatus are provided for delivering user equipment (UE) new radio (NR) security capabilities and mobility management entity interworking. In the embodiments, adding the UE NR security capabilities in a new information element over a non-access stratum (NAS) is compatible with a legacy mobility management entity and eliminate any potential of bidding-down attack and is more advantageous and serves the security solution better. As long as the UE is connected to the long term evolution (LTE) and all UE security capabilities including LTE security capabilities have been replayed correctly and successfully in the NAS security mode command (SMC) message, the UE may not consider the absence of the UE NR security capabilities in the NAS SMC as a security vulnerability.

Method and device for obtaining UE security capabilities

Embodiments of this disclosure provide techniques for communicating in a wireless communication system. In particular, a user equipment (UE) may receiving a security command message from a base station comprising an indication of an integrity protection algorithm and an indication of an encryption algorithm. The first security command message may trigger a radio resource control (RRC) traffic signaling protection procedure between the UE and the base station. The UE transmits a security command complete message to the base station. The security command complete message may trigger a packet data unit (PDU) session establishment procedure to establish a PDU session between the UE and the base station.

Method and device for negotiating security and integrity algorithms

A method of performing validation of an access token under OAuth 2.0 protocol includes: providing, by an authorization server, the access token for service to a client in response to a request for the access token; adding, by the client, a client signature to at least the access token; forwarding, by the client, the access token as part of a service request to a resource server; and validating, by the resource server, whether the client is a valid owner of the access token, wherein the validation is based on at least the client signature of the access token. The validation is based on a hash of a combination of the service request, the access token and a shared secret key common to the client and the resource server, the output of which hash is added to the service request, and the resource server validates the hash.

Embodiments of this disclosure provide techniques for securely communicating an IMSI over the air from a UE to an SeAN, as well as for securely validating an unencrypted IMSI that the SeAN receives from the home network, during authentication protocols. In particular, the UE may either encrypt the IMSI assigned to the UE using an IMSI encryption key (K) or compute a hash of the IMSI assigned to the UE using an IMSI integrity key (K), and then send the encrypted IMSI or the hash of the IMSI to the serving network. The encrypted IMSI or hash of the encrypted IMSI may then be used by the SeAN to validate an unencrypted IMSI that was previously received from an HSS in the home network of the UE.

Method and Device for Obtaining UE Security Capabilities

It is possible to reduce singling overhead in a radio access network by coordinating authentication of a group of UEs (e.g., IoT devices, etc.) via a master device. In particular, the master device may aggregate UE identifiers (UE_IDs) for UEs in the group, and send an identity message carrying the UE_IDs and a master device identifier (MD_ID) to a base station, which may then relay the identity message to a Security Anchor Node (SeAN). The SeAN may send an authentication data request carrying the UE_IDs and MD_ID to a Home Subscriber Server (HSS), which may return an authentication data response that includes a group authentication information. The group authentication information may then be used to achieve mutual authentication between the SeAN and each of the master device, group of UEs, and individual UEs.

System and method for massive IoT group authentication

A method for establishing a trust relationship in an ultra dense network is provided. The method comprises receiving, by a user equipment (UE), a reconfiguration request from a macrocell; deriving, by the UE, a user plane encryption key according to information in the reconfiguration request; transmitting, by the UE, a first user plane signaling message to a first microcell in a group of microcells when the UE is attached to the first microcell; and transmitting, by the UE, a second user plane signaling message to a second microcell in the group of microcells when the UE is attached to the second microcell, wherein the first user plane signaling message and the second user plane signaling message are both encrypted according to the user plane encryption key.

Ultra dense network security architecture method

Embodiment mutual authentication and security agreement (MASA) protocols may use independently generated integrity and/or encryption keys to securely communicate private information exchanged between UEs and various network-side devices (e.g., base stations, MMEs, HSSs, etc.). In particular, embodiment MASA protocols may use an initial authentication request (IAR) encryption key (KIAR) to encrypt UE specific information (e.g., an IMSI, etc.) in an IAR message and/or an initial authentication response (IAS) encryption key (KIAS) to encrypt private information in an IAS message. Additionally, embodiment MASA protocols may use an IAR integrity protection key (KIAR) to verify the integrity of information in an IAR message and/or an IAS integrity protection key (KIAS) to verify the integrity of information in an IAS message. The KIAR, KIAR, KIAS, and/or KIASmay be independently computed by the UE and a home subscriber server (HSS).

A method of establishing a group trust relationship in an Internet of Things (IoT) system using a first IoT device within a group of IoT devices is provided. The method includes generating, by the first IoT device, a first set of keys corresponding to the first IoT device, deriving, by the first IoT device, a group set of keys corresponding the group of IoT devices, and discarding the first set of keys and storing the group set of keys after the first IoT device transmits data toward a base station and goes idle, wherein the group set of keys is used by each IoT device within the group of IoT devices for subsequent transmissions of data to the base station.

Security architecture and solution for handling internet of things devices in a fifth generation system

A method of obtaining addressing information may include establishing a communication path through a network between first and second peer devices with a router coupled between the first peer device and the communication path through the network. A communication may be received at the first peer device from the second peer device through the communication path and the router. Moreover, a payload of the communication received at the first peer device from the second peer device may include a public reachability address used by the second peer device to transmit the communication through the network and the router to the first peer device. Related methods of providing such addressing information and related devices are also discussed.

Methods providing public reachability and related systems and devices

Growing community of inventors

Richardson, TX, United States of America

Ahmad Shawky Muhanna