Huawei Technologies Co., Limited

Apple Inc.

Chinese Academy of Sciences

Nokia Technologies Oy

Rainbow Source Laser

Lijia Zhang

Dawei Zhang

Huarui Liang

Xiangying Yang

Jing Lan Chen

Shu Guo

Yixian Xu

Fangli Xu

Yuqin Chen

Haijing Hu

Dongmei Zhang

Xiaohan Liu

Yu Wang

Li Li

Yingxin Huang

Zhuo Chen

Yannick L Sierra

Jing Chen

Yali Guo

Samuel David Post

Yi Zhou

Lanpeng Chen

Krisztian Kiss

Rohan C Malthankar

Jiangwei Ying

Cuili Ge

Qian Sun

Ke Wang

Hao Duo

Yuanda Huang

Elliot S Briggs

Jiangshan Zhao

Robert K Kitchens

Pengfei Sha

Xinyi Chen

Xiaobin Wu

Jinbin Ding

Yan Luo

Kuibo Wang

Yaoying Shan

Yuanyuan Fan

Xingliang Song

Huirong Cui

Meriau Laurence

Wanlu Xie

Luosha Zhang

Jingjing Guo

A method, and related apparatuses are provided. The method comprises receiving an initial layer-3 message, wherein the initial layer-3 message comprises an indication indicating that a part of the initial layer-3 message is encrypted, and generating a keystream, wherein the keystream is used to decrypt the encrypted part of the initial layer-3 message.

Encryption method, decryption method, and related apparatus

This disclosure relates to techniques, base stations, and user equipment devices (UEs) for performing base station authentication through access stratum signaling transmissions. The UE may operate in idle mode and may receive an authentication message from a base station through the wireless interface while operating in idle mode. The UE may determine whether a signature comprised within the authentication message is valid, and the UE may continue a connection procedure with the base station based on a determination that the signature is valid. If it is determined that the signature is invalid, the UE may designate the base station as a barred base station and may perform cell re-selection. The authentication message may be one of a radio resource control (RRC) connection setup message, a special RRC message, a media access control (MAC) message, or a random access channel (RACH) message comprising a random access response (RAR) message.

Enhanced security for access stratum transmission

Techniques to protect a subscriber identity, by encrypting a subscription permanent identifier (SUPI) to form one-time use subscription concealed identifiers (SUCIs) using a set of one-time ephemeral asymmetric keys, generated by a user equipment (UE), and network provided keys are disclosed. Encryption of the SUPI to form the SUCIs can mitigate snooping by rogue network entities, such as fake base stations. The UE is restricted from providing the unencrypted SUPI over an unauthenticated connection to a network entity. In some instances, the UE uses a trusted symmetric fallback encryption key Kor trusted asymmetric fallback public key PKto verify messages from an unauthenticated network entity and/or to encrypt the SUPI to form a fallback SUCIfor communication of messages with the unauthenticated network entity.

Subscriber identity privacy protection against fake base stations

Techniques for identity-based message integrity protection and verification between a user equipment (UE) and a wireless network entity, include use of signatures derived from identity-based keys. To protect against attacks from rogue network entities before activation of a security context with a network entity, the UE verifies integrity of messages by checking a signature using an identity-based public key PKderived by the UE based on (i) an identity value (ID) of the network entity and (ii) a separate public key PKof a private key generator (PKG) server. The network entity generates signatures for messages using an identity-based private key SKobtained from the PKG server, which generates the identity-based private key SKusing (i) the ID value of the network entity and (ii) a private key SKthat is known only by the PKG server and corresponds to the public key PK.

Identity-based message integrity protection and verification for wireless communication

This application pertains to encryption/decryption methods and related apparatuses. A communication device receives an initial layer-3 message. The initial layer-3 message includes an indication indicating that a part of the initial layer-3 message is encrypted. The communication device generates a keystream, and decrypts the encrypted part of the initial layer-3 message by performing an exclusive OR operation on the keystream and the initial layer-3 message.

A device level lock policy, which applies to all smart secure platform (SSP) applications of a mobile device, is used to determine whether a particular SSP application can be activated. A tamper resistant hardware secure element (SE) includes a primary platform with a low level operating system (OS) and one or more SSP applications within one or more secondary platform bundles that include secondary platforms with high level OSs specific to the secondary platform bundles. The low level OS enforces the device level lock policy for all secondary platform bundles by verifying whether a lock policy for the SSP application is consistent with the device level lock policy. When verification succeeds, activation is allowed, and when verification fails, activation is disallowed. Subscription identifiers are not provided in unencrypted form to processing circuitry of the mobile device external to the tamper resistant hardware SE to provide subscriber identity privacy protection.

Wireless network service access control with subscriber identity protection

Apparatuses, systems, and methods for generating and utilizing improved initialization vectors (IVs) when performing encryption and authentication in wireless communications. In some scenarios, a wireless communication device may generate one or more pseudorandom multi-bit values, e.g., using a respective plurality of key derivation functions (KDFs). A first portion of each value may be used as a respective key for encryption or authentication of traffic on the user plane or the control plane. A second portion of each value may be used as a nonce value in a respective IV for use with a respective key for encryption or authentication of traffic on the user plane or the control plane. In some scenarios, the nonce values may instead be generated as part of an additional pseudorandom value (e.g., by executing an additional KDF), from which all of the IVs may be drawn.

Initialization vector generation when performing encryption and authentication in wireless communications

Techniques to protect subscriber identity in messages communicated between a user equipment (UE) and a cellular wireless network entity by using multiple ephemeral asymmetric keys are disclosed. The UE determines multiple ephemeral UE public and secret key pairs, while the cellular wireless network entity provides a network public key to the UE. The network public key may be updated over time. Multiple encryption keys based on the multiple ephemeral UE secret keys and the public network key are derived and used to encrypt a subscription permanent identifier (SUPI) to generate multiple subscription concealed identifiers (SUCIs). Each SUCI is used only once for messages communicated to a cellular wireless network and discarded after use. New SUCI are generated when the network public key is updated.

Subscriber identity privacy protection and network key management

A preparation device has a chamber, molten metal containers, a rotatable base in the chamber and having a deposition substrate, laser sets generating a dual-pulse laser, a base controller and a data collection control unit. The containers communicate with the chamber and each has a pulse pressurization apparatus pressing the molten metal into the chamber. The laser sets correspond to the containers such that beams of an emitted dual-pulse laser bombard the pulsed droplets, plasmas are generated and are sputtered and deposited on the substrate forming a multi-element alloy thin film. The unit collects base temperature and displacement information, and controls the pressurization frequency of the pulse pressurization apparatus, and the emission frequency and energy of the dual-pulse laser of the laser sets controlling the frequency and energy of the dual-pulse laser bombarding the corresponding pulsed droplets. The base controller controls the base temperature, rotation and movement.

Apparatus and method for preparing multi-component alloy film

In order to provide confidentiality protection, an encryption method, a decryption method, and related apparatuses are provided. An encryption device generates a first initial layer-3 message. The first initial layer-3 message includes a first part and a second part. The device generates a keystream for encrypting the first initial layer-3 message. The device performs an exclusive OR operation on the keystream and the first initial layer-3 message to generate a second initial layer-3 message. The second initial layer-3 message includes an encrypted first part of the first initial layer-3 message, an unencrypted second part of the first initial layer-3 message, and an encryption indication indicating that the first part of the first initial layer-3 message is encrypted. The device transmits the second initial layer-3 message to a network device. Small data comprised in the second initial layer-3 message is protected by the encryption.

Embodiments of the present application provide an encryption method, a decryption method, and a related apparatus. The encryption method includes: generating a keystream, where the keystream is used to encrypt a part of data to be encrypted in an initial layer-3 message, and the part of data to be encrypted includes small data; generating, by performing an exclusive OR operation on the keystream and the initial layer-3 message, an initial layer-3 message in which the part of data is encrypted; and sending the initial layer-3 message in which the part of data is encrypted, where the initial layer-3 message includes an added encryption indication, and the encryption indication is used to indicate that the part of data to be encrypted in the initial layer-3 message is encrypted.

Embodiments provide an MTC device communication method, device, and system. A second network element receives, a query message sent by a first network element after the first network element identifies that a type of a received short message is a preset-type short message. The query message comprises an identifier of a receiver of the short message and an identifier of a sender of the short message. The second network element checks whether the sender is authorized to send the preset-type short message to the receiver. The second network element sends a message to the first network element indicating whether or not to send the short message to the receiver.

MTC device communication method, device, and system

Embodiments of the present invention provide a method and a related device for generating a group key. The method includes: obtaining a group ID of a group where a machine type communication MTC device is located; obtaining a group communication root key corresponding to the group ID; generating a group key corresponding to the group ID according to the group communication root key; and sending the group key encrypted by using an access stratum key of the MTC device to the MTC device, so that the MTC device obtains the group key through decryption according to the access stratum key of the MTC device. According to the foregoing technical solutions, a base station may allocate, to an MTC device, a group key corresponding to a group where the MTC device is located.

Method and related device for generating group key

Growing community of inventors

Beijing, China

Lijia Zhang