Future Wei Technologies, Inc.

Samsung Electronics Co., Ltd.

Huawei Technologies Co., Limited

Marcus Wong

Ahmad Shawky Muhanna

Zhibi Wang

Baoling S Sheen

Zhixian Xiang

Peter J McCann

Sergey Bezzateev

This disclosure provides techniques for securely communicating user equipment (UE) specific information from a UE to a network-side device. In particular, the UE may either encrypt the UE specific information using an encryption key to form an encrypted portion, where the UE specific information includes subscriber identity information and the encryption key is calculated in accordance with a public key of a home network of the UE. The UE generates a message authentication code (MAC) signature based on the encrypted portion and a first integrity key, where the first integrity key is calculated in accordance with the public key of the home network. The UE sends, to a network-side device, a request message including the encrypted portion, the MAC signature and a network identifier of the home network.

Authentication mechanism for 5G technologies

Embodiments of this disclosure provide techniques for securely communicating an IMSI over the air from a UE to an SeAN, as well as for securely validating an unencrypted IMSI that the SeAN receives from the home network, during authentication protocols. In particular, the UE may either encrypt the IMSI assigned to the UE using an IMSI encryption key (K) or compute a hash of the IMSI assigned to the UE using an IMSI integrity key (K), and then send the encrypted IMSI or the hash of the IMSI to the serving network. The encrypted IMSI or hash of the encrypted IMSI may then be used by the SeAN to validate an unencrypted IMSI that was previously received from an HSS in the home network of the UE.

Serving network authentication and validation by a UE includes encrypting an identifier associated with the UE using a first instance of a public key associated with a serving network to which the UE is attempting to gain access; transmitting the identifier to the serving network; receiving from the serving network an authentication vector containing a second instance of the public key, the second instance of the public key having been encrypted using a key shared by the UE and a home network associated with the UE; decrypting the second instance of the public key using the key shared by the UE and the home network; comparing the first instance of the public key to the second instance of the public key; and when the first instance and the second instance are the same, determining that the home network has authenticated the serving network.

Access technology agnostic service network authentication

Embodiment mutual authentication and security agreement (MASA) protocols may use independently generated integrity and/or encryption keys to securely communicate private information exchanged between UEs and various network-side devices (e.g., base stations, MMEs, HSSs, etc.). In particular, embodiment MASA protocols may use an initial authentication request (IAR) encryption key (KIAR) to encrypt UE specific information (e.g., an IMSI, etc.) in an IAR message and/or an initial authentication response (IAS) encryption key (KIAS) to encrypt private information in an IAS message. Additionally, embodiment MASA protocols may use an IAR integrity protection key (KIAR) to verify the integrity of information in an IAR message and/or an IAS integrity protection key (KIAS) to verify the integrity of information in an IAS message. The KIAR, KIAR, KIAS, and/or KIASmay be independently computed by the UE and a home subscriber server (HSS).

The disclosure relates to technology for provisioning out-of-network user equipment with a network relay in a communications network. The network relay device receives an authentication key request message from user equipment including a user equipment identity and an authentication server identity, and communicates the authentication key request message to an authentication server having the authentication server identity. The network relay device communicates a relay authentication key response received from the authentication server to the user equipment such that a secure communication is established between the user equipment and the network. A relay authentication key is generated during establishment of the secure communication between the user equipment and authentication server, and a session with the user equipment is authenticated using a session key generated by the user equipment based on the relay authentication key. The user equipment is the authenticated with the network relay device and provisioned.

System and method for secure provisioning of out-of-network user equipment

A device for communicating with a plurality of user equipment in a cellular network comprises a non-transitory memory having instructions and one or more processors in communication with the memory. The one or more processors execute the instructions to receive information regarding a faked base station including an operating frequency, location area code and cell identification of the faked base station, prepare a first message to alert of the faked base station, select the plurality of user equipment that may receive a signal from the faked base station, transmit the first message to alert of the faked base station to the plurality of user equipment and transmit a second message to bar the plurality of user equipment from connecting to the faked base station.

Response mechanism for detection of a faked base station

A method for establishing a secure connection between a station and an access point includes transmitting a communications system management message to the station, the communications system management message including an access point nonce. The method also includes receiving a station nonce from the station, and determining a first security key according to the access point nonce and the station nonce. The method further includes securing a connection between the station and the access point using the first security key.

System and method for establishing a secure connection in communications systems

Embodiments are provided for enabling identity verification of messages originating from a radio station, such as a Femto cell, to a gateway, such as a Femto gateway. In an embodiment, a radio station establishes a first connection for authentication with a security gateway, sends authentication information on the first connection, and receives in return an Internet Protocol (IP) address assigned to the radio station. The security gateway updates a Domain Name System (DNS) to map between the IP address and a DNS name for the radio station. The radio station also establishes a second connection for control messages with a second gateway, and sends the IP address and an identity of the radio station on the second connection. The mapping between the IP address and the DNS name enables the second gateway to identify messages on the second connection between the radio station and the second gateway.

System and method for femto ID verification

A system and method for recovering from a failure is disclosed. A preferred embodiment comprises downloading a first patch into a base station, installing the first patch, loading the first patch, and validating the first patch. Once the first patch has been validated, a second patch may be downloaded, installed, loaded, and verified. This incremental remediation approach allows for the conservation of resources if the system is non-recoverable, as this will become evident prior to a complete download and install is performed.

System and method for transmitting data using incremental remediation

A system and method for name binding for multiple packet data network access is provided. A method for communications device operation includes attaching to a first packet data network through an access network, thereby creating an access point name, triggering a connection to a second packet data network through the access network, and receiving an acknowledgement to the trigger. The triggering occurs over the access point name, and the acknowledgement comprises an address for the communications device. The address is allocated by a gateway for the second packet data network, and the address is allocated based on a binding generated from an identifier of the communications device, an identifier of the access point name, and a parameter.

System and method for name binding for multiple packet data network access

A key handshake method in a wireless local area network (LAN) capable of performing authentication between two wirelessly connected stations by exchanging keys once is provided. Because the security key for authentication can be exchanged by one 4-way handshake between an authenticator and a supplicant in a wireless LAN, an authentication delay can be prevented.

Growing community of inventors

Green Brook, NJ, United States of America

Marcus Wong