Nokia Corporation

Nokia Technologies Oy

Intellectual Ventures I LLC

Nokia Siemens Networks Oy

Nokia Solutions and Networks Gmbh & Co. Kg

Vringo Infrastructure Inc.

Dan Forsberg

Valtteri Niemi

Silke Holtmanns

Lauri Tarkkala

Lars Dalsgaard

Hui Li

Seppo Ilmari Vesterinen

Seppo M Alanara

Guenther Horn

Timo Rantalainen

Leping Huang

Frank Mademann

Günther Horn

Marc Blommaert

Haitao Tang

Fan Yang

Ulrike Meyer

Yanqun Le

John Loughney

A method and apparatus including units configured to send a request from a first network entity to a user equipment for an identifier and receive a message indicating that a public key is required from the user equipment by the first network entity. The method and apparatus also includes units configured to send, by the first network entity, the public key to the user equipment and receive an encrypted identifier by the first network entity, wherein upon authenticating the public key, the user equipment encrypts at least part of the identifier using the public key, thereby enabling further processing between the network entity and the user equipment.

Encrypted indentifiers in a wireless communication system

A method and apparatus for intersystem mobility security context handling between different radio access networks which can include a receiver configured to receive a tracking area update message from a user terminal. The message can include a first key identifier configured to identify a mapped security context and a second key identifier configured to identify a cached security context. A verifier can be configured to verify the tracking area update message with a key identified by the first or second key identifier.

Intersystem mobility security context handling between different radio access networks

An identifier containing at least one encrypted part is received at a first network entity. A second network entity may then be determined based on the identifier. A request for assistance in decryption of the identifier from the second network entity may be sent from the first entity to the second network entity. The second network entity may then assist the first networks entity in an appropriate manner.

Identifiers in a communication system

In a method for key handling in mobile communication systems, first and second numbers are exchanged between entities of the mobile communication system. The first and second numbers are respectively used only once with respect to the respective system parameters of the communication system and therefore allowing greater security in the communication system.

Key handling in communication systems

The user equipment (UE) and the Mobility Management Entity (MME) in an evolved 3GPP system generate authentication material that can be carried inside a packet switched network temporary mobile station identifier (P-TMSI) signature field of a Universal Mobile Telecommunications System (UMTS) signaling message from the UE to a UMTS/GPRS serving GPRS support node (SGSN) in a UMTS or GPRS Terrestrial Radio Access Network (UTRAN) or in a GSM/Edge Radio Access Network (GERAN), as well as from the SGSN to the MME of the evolved 3GPP system. The MME authenticates a context transfer request from the UTRAN/GERAN system based on the transferred authentication material and knowledge of how to create or to verify the authentication material. Additionally, the MME and the UE derive or verify authentication material, based on at least one user-specific key, for embedding in the P-TMSI signature field in legacy 3GPP signalling.

System and method for authenticating a context transfer

A communication network manages key material. A method generates and provides session keys from a security node to an access node for further propagation during handoff procedures, without requiring the security node to take part in the handoff procedures.

Exchange of key material

An auxiliary handover message is sent from a target eNB to a UE being handed over from a source eNB. The auxiliary handover message includes a context identifier that is established between the source eNB and the UE, which the source eNB provides to the target eNB during context data exchange when preparing for the handover. The UE uses the context identifier to verify that the auxiliary handover message is valid. Various approaches are detailed for minimizing signaling overhead and minimizing the time the UE must monitor the separate channel for the auxiliary handover message in the event the UE does not properly receive the original handover message from the source eNB. The context identifier may be a random number, a C-RNTI, an eNB-ID, or a token. The auxiliary handover command sent from the target eNB may be the context identifier with or without a copy of the handover command.

Apparatus, method and computer program product providing auxiliary handover command

Encryption of identifiers in a communication system

The invention allows changing a Radio Access Network security algorithm during handover in a manner that is efficient and secure. A security message is received at a mobile station previously using a first security algorithm in communication with a first access point, which message instructs to use a second security algorithm required by a second access point. In response, the mobile station is changed to use the second security algorithm.

Changing radio access network security algorithm during handover

The present invention performs a Binding Update or a Location Update message authentication independently and terminal-specifically in a home SAE gateway. A key, which is derived in a home AAA server from an initially set long term key, is given to a visited network for encrypting the update messages in Proxy Mobile IP. In Client Mobile IP, the key is transmitted to a mobile node for update message encryption. When the update message is received in the home SAE gateway, the key can be derived independently in the home SAE gateway without any key requests between the gateway and the home AAA server. Thus, it is possible to authenticate the binding or location update messages by verifying the two signatures. The present invention can also be implemented on a lower hierarchy of the system. The invention can be implemented in 3GPP standard releases enhanced with LTE technology, for instance.

Fast update message authentication with key derivation in mobile IP systems

Handoffs must be fast for wireless mobile nodes without sacrificing the security between a mobile node and wireless access points in an access network. A secure session keys context approach is shown having all the good features, like mobility and security optimization, of the currently existing proposals of key-request, pre-authentication, and pre-distribution but also providing improved scalability for the access network and for the mobile node. The new approach is compared to the existing proposals including memory requirements and especially how to reduce memory usage using a 'just-in-time' transfer of security information between access points and a mobile node during a handover.

Secure session keys context

Provided are apparatuses and methods for providing security measures for a handover execution procedure in a communication network. In one example, the handover procedure is initiated by more than one base station. In another example, a base station may not launch a Denial or Service (DoS) attack towards other base stations or towards a core network using handover signaling messages. For example, a user device may send at least one encryption parameter, such as a Nonce associated with the user device to a source base station. Handover of the user device from the source base station to a target base station may be accomplished based on the at least one encryption parameter to avoid the DoS attack.

Secure distributed handover signaling

Sequence numbers for data packets to be transmitted using bearers having bearer identifiers in a communications system are generated, wherein the sequence numbers are generated independently for each of the bearers used for transmitting the data packets. Last generated sequence numbers for each of the bearers identifiers are stored and held in a memory. When a sequence number for a data packet to be transmitted using a bearer out of the bearers which has been used before is to be generated the memory is checked on a last generated sequence number for the bearer with a previously used bearer identifier and the sequence number is generated in accordance therewith.

Sequence number synchronization for ciphering

Systems, devices and methods for providing user access to broadcast content in combination with user access to short-range communication content, such as RFID tag content or the like. A broadcast medium, such as Radio Data Broadcast, that provides for broadcast frequency transmission in unison with other content being carried on alternative frequencies is used to transmit digital broadcast signals that include both broadcast content and short-range communication content. A digital broadcast receiver that is equipped to receive the digital signals will additionally include a short-range communication transponder, such as an RFID tag or the like. The transponder, i.e., tag, will include dynamic updateable memory, such that as digital signals are received with new short-range communication content the information associated with the tag will be updated. The tag allows a reader device to capture and, in many instances, store the tag information for later use.

Methods, systems, devices and computer program products for providing user-access to broadcast content in combination with short-range communication content

Growing community of inventors

Helsinki, Finland

Dan Forsberg