Qualcomm Incorporated

Other

Anand Palanigounder

Soo Bum Lee

Adrian Edward Escott

Gavin Bernard Horn

Jun Wang

George Cherian

Peerapol Tinnakornsrisuphap

Stefano M Faccin

Lenaig Genevieve Chaponniere

Philip Michael Hawkes

John Nasielski

Jouni Kalevi Malinen

Brian Marc Rosenberg

Rajat Prakash

Santosh Paul Abraham

Srinivasan Balasubramanian

Miguel Griot

Yinian Mao

Olivier Jean Benoit

Fatih Ulupinar

Kalle Ahmavaara

Osok Song

Lakshminath Reddy Dondeti

Xiaoxia Zhang

Sanjiv Nanda

Rajarshi Gupta

Parag Arun Agashe

Haris Zisimopoulos

Gordon Kent Walker

Mungal Singh Dhanda

Gregory Gordon Rose

Manoj Madhukar Deshpande

Ranjith Subramanian Jayaram

Jen Mei Chen

Etan Gur Cohen

Arun Balakrishnan

Renwei Ge

Hongil Kim

Daniel Komaromy

Qing Li

Edward George Tiedemann, Jr

Arnaud Meylan

Xipeng Zhu

Keiichi Kubota

Sivaramakrishna Veerepalli

Gerardo Giaretta

Roozbeh Atarius

Sebastian Speicher

Alexander Gantman

Michele Berionne

David William Craig

Cogol Tina

Ozcan Ozturk

Karl Georg Hampel

Abhishek Pramod Patil

Maarten Menzo Wentink

Sai Yiu Duncan Ho

Mahmoud Watfa

Michaela Catalina Vanderveen

Bibhu P Mohanty

Young Cheul Yoon

Amer Catovic

Ajith Tom Payyappilly

Arungundram C Mahendran

Vinay Joseph

Luis Fernando Brisson Lopes

William Whyte

Rosario Cammarota

Peter Hans Rauber

Jangwon Lee

Chandrasekhar Therazhandur Sundarraman

Manu Sharma

James Alan Misener

Aram Perez

Alex Gantman

Faith Ulupinar

Lakshminath R Dondeti

Rishab Nithyanand

Bibhu Prasad Mohanty

Kalle Ilmari Ahmavaara

Jouni Malinen

Edward George Tiedemann Jr

Philip Hawkes

Brian M Rosenberg

Gupta Rajarshi

Methods, apparatuses, and computer-readable storage medium for encrypting discovery messages are provided. An example method at a first UE may include obtaining a discovery message that is ciphered based on at least one of a ciphering key, a ciphering algorithm, or a first set of time parameters, where the discovery message is scrambled based on at least one of a scrambling key, a scrambling algorithm, or a second set of time parameters. An example method may also include descrambling the discovery message based on at least one of the scrambling key, the scrambling algorithm, or the second set of time parameters. An example method may also include deciphering the discovery message based on at least one of the ciphering key, the ciphering algorithm, or the first set of time parameters.

Encrypting discovery messages

Disclosed are systems and techniques for wireless communications. For instance, a process may include generating an anchor key based on an authentication server function key; associating a count value with the anchor key; generating a temporary device identifier based on the authentication server function key; generating an enhanced key identifier based on the count value, wherein the enhanced key identifier includes a portion of the temporary device identifier, wherein the portion of the temporary device identifier is less in size than an entire temporary device identifier; and transmitting the enhanced key identifier to a remote application.

Authentication and key management for applications (AKMA) application key (K) refresh

Aspects relate to user equipment (UE) to user equipment (UE-to-UE) relaying in a communication system. At least two remote UEs and a UE-to-UE relay receive provisioned security information from the wireless communication network, where the security information includes discovery parameters and relay security information. The security information provisioned by the wireless communication network is used to establish a connection between the two UEs and the UE-to-UE relay device including discovery of the UE-to-UE relay by the remote UEs. Furthermore, the provisioned security information is used to establish a secure connection between the two remote UEs via the UE-to-UE relay device.

Secure communication link establishment for a UE-to-UE relay

Some aspects described herein relate to provisioning aerial vehicles with identifiers, certificates, or other credentials for communicating based on a mobile network. The UAV can transmit a request to register with the mobile network, where the request includes at least a hardware identifier of the UAV. The UAV may receive, from a component of the mobile network, a response to the request, where the response includes a unique UAV identifier, a UAV certificate, and a network certificate generated by at least one of the component of the mobile network or a unmanned aircraft system service supplier (USS).

Techniques for identifying aerial vehicles in mobile networks

The present disclosure provides techniques that may be applied, for example, for providing network policy information in a secure manner. In some cases, a UE may receive a first message for establishing a secure connection with a network, wherein the first message comprises network policy information, generate a first key based in part on the network policy information, and use the first key to verify the network policy information.

Incorporating network policies in key generation

One feature pertains to a method for secure wireless communication at an apparatus of a network. The method includes receiving a user equipment identifier identifying a user equipment and a cryptographic key from a wireless wide area network node, and using the cryptographic key as a pairwise master key (PMK). A PMK identifier (PKMID) is generated based on the PMK and the two are stored at the network. A PMK security association is initialized by associating the PMK with at least the PMKID and an access point identifier identifying an access point of the apparatus. An association request is received that includes a PMKID from the user equipment, and it's determined that the PMKID received from the user equipment matches the PMKID stored. A key exchange is initiated with the user equipment based on the PMK to establish a wireless local area network security association with the user equipment.

WWAN-WLAN aggregation security

Methods, systems, and devices are provided for supporting user plane integrity protection (UP IP) for communications with a radio access network (RAN). Various embodiments may include indicating whether or not a wireless device supports UP IP over Evolved Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access (eUTRA) by including UP IP support indications in user equipment (UE) security capability information elements (IEs).

User plane integrity protection (UP IP) capability signaling in 5G/4G systems

Aspects directed towards steering of roaming (SoR) are disclosed. In one example, a communication from a public land mobile network (PLMN) is received by a user equipment (UE) in which the communication indicates an acceptance of a UE registration with the PLMN. This example further includes performing a determination of whether an SoR indicator associated with a home PLMN (HPLMN) is embedded within the communication. The UE then manages PLMN selection according to the determination. In another example, a UE is configured to operate according to an SoR configuration in which the UE is configured to ascertain whether an SoR indicator is embedded within a communication from a PLMN. An SoR indicator associated with an HPLMN is then generated and subsequently transmitted from the HPLMN to the UE via the PLMN.

System and method that facilitate steering of roaming

Techniques and apparatus for protecting sequence numbers used in authentication procedures are described. One technique includes receiving, from a network, an authentication request comprising at least a random challenge. After receipt of the authentication request, a synchronization parameter is generated based at least in part on a key shared by the network and the UE, the random challenge, and a first message authentication code (MAC). The synchronization parameter and the first MAC are transmitted to the network in response to the authentication request.

Protection of sequence numbers in authentication and key agreement protocol

Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a user equipment (UE) may transmit, to a relay UE, a first message comprising a first freshness parameter, an identity of the UE, and authentication information, where the authentication information is used by a network node to authenticate the UE with security context information of the UE. The UE may derive a relay key for security establishment between the UE and the relay UE based on the first freshness parameter, a set of key generation parameters, and a shared key with the network node. The UE may derive a relay session key for security establishment between the UE and the relay UE based on the relay key, a first nonce of the UE, and a second nonce of the relay UE. Numerous other aspects are described.

PC5 link security setup using non-access stratum security context

In an aspect, the present disclosure includes a method, apparatus, and computer readable medium for wireless communications for configuring of a NAS COUNT value of a mapped EPS security context associated with an intersystem change of a UE from a 5G system to an EPS. The aspect includes generating, by a UE, a mapped EPS security context associated with an intersystem change of the UE from a 5G system to an EPS, wherein the mapped EPS security context comprises security parameters created based a 5G security context used for the 5G system, the security parameters enabling security-related communications between the UE and a network entity; determining an UL NAS COUNT value and the DL NAS COUNT value for the mapped EPS security context; and transmitting, by the UE, a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context.

Evolved packet system (EPS) mobility configuration from wireless system

A user device having a security context with a first network based on a first key may establish a security context with a second network. In a method, the user device may generate a key identifier based on the first key and a network identifier of the second network. The user device may forward the key identifier to the second network for forwarding to the first network by the second network to enable the first network to identify the first key at the first network. The user device may receive a key count from the second network. The key count may be associated with a second key forwarded to the second network from the first network. The user device may generate the second key based on the first key and the received key count thereby establishing a security context between the second network and the user device.

Method and apparatus for multiple registrations

The present disclosure provides techniques that may be applied, for example, in a multi-slice network for maintaining privacy when attempting to access the network. An exemplary method generally includes transmitting a registration request message to a serving network to register with the serving network; receiving a first confirmation message indicating a secure connection with the serving network has been established; transmitting, after receiving the first confirmation message, a secure message to the serving network comprising an indication of at least one configured network slice that the UE wants to communicate over, wherein the at least one configured network slice is associated with a privacy flag that is set; and receiving a second confirmation message from the serving network indicating that the UE is permitted to communicate over the at least one configured network slice.

Network access privacy

Techniques are described for wireless communication. A method for wireless communication at a user equipment (UE) includes performing an extensible authentication protocol (EAP) procedure with an authentication server via an authenticator. The EAP procedure is based at least in part on a set of authentication credentials exchanged between the UE and the authentication server. The method also includes deriving, as part of performing the EAP procedure, a master session key (MSK) and an extended master session key (EMSK) that are based at least in part on the authentication credentials and a first set of parameters; determining a network type associated with the authenticator; and performing, based at least in part on the determined network type, at least one authentication procedure with the authenticator. The at least one authentication procedure is based on an association of the MSK or the EMSK with the determined network type.

Techniques for deriving security keys for a cellular network based on performance of an extensible authentication protocol (EAP) procedure

In an aspect, a network supporting client devices includes one or more network nodes implementing network functions. Such network functions enable a client device to apply a security context to communications with the network when the client device is not in a connected mode. The client device obtains a user plane key shared with a user plane network function implemented at a first network node and/or a control plane key shared with a control plane network function implemented at a second network node. The client device protects a data packet with the user plane key or a control packet with the control plane key. The data packet includes first destination information indicating the first network node and the control packet includes second destination information indicating the second network node. The client device transmits the data packet or control packet.

Network security architecture

Growing community of inventors

San Diego, CA, United States of America

Anand Palanigounder