Telefonaktiebolaget Lm Ericsson (publ)

Rolf Blom

Karl Norrman

Mats Näslund

Fredrik Lindholm

Gunnar Mildh

Yi Cheng

Jari Arkko

John Mattsson

Stefan Rommer

Vesa Lehtovirta

Bernard Smeets

Göran Selander

Luis Barriga

Bengt Sahlin

Christian Gehrmann

Wassim Michel Haddad

Jari Tapio Vikberg

Magnus Stattin

David Castellanos Zamora

Oscar Ohlsson

Magnus Lindström

Steinar J Dahlin

Per-Olof Nerbrant

Jerker F Widmark

Esa Turtiainen

Karl Norman

Pasi Ahonen

Mats Nåslund

Elisabetta Carrara

Näslund Mats

Ilkka Uusitalo

Boman Krister

Steinar Dahlin

Mats NÄSLUND

A method in a User Equipment (UE) of an Evolved Packet System (EPS) establishes a security key (K_eNB) for protecting Radio Resource Control/User Plane (RRC/UP) traffic exchanged with a serving eNodeB. The method comprises sending a Non-Access Stratum (NAS) Service Request to a Mobility Management Entity (MME), the request indicating a NAS uplink sequence number (NAS_U_SEQ). The method further comprises receiving an indication of the NAS_U_SEQ of the NAS Service Request sent to the MME, back from the MME via the eNodeB. The method further comprises deriving the K_eNB from at least the received indication of the NAS_U_SEQ and from a stored Access Security Management Entity-key (K_ASME) shared with said MME.

Method and arrangement in a telecommunication system

A user equipment receives an Extensible Authentication Protocol Authentication and Key Agreement Prime (EAP AKA') message, from an authentication server related to the user equipment, in an authentication procedure being part of setting up a connection from the user equipment through an access network. The user equipment sets up an IP Security tunnel between the user equipment and an evolved Packet Data Gateway responsive to the EAP AKA&#x2032; message indicating that the access network is untrusted.

Access through non-3GPP access networks

A mobile device and an authentication server are configured to re-establish a security context that was previously established using an Authentication Key Agreement (AKA) procedure. The re-establishment advantageously uses re-use information saved from the preceding AKA procedure, including using synchronization information for each such re-establishment that occurs between AKA procedures. The synchronization information particularly identifies each instance of re-establishment and depends on a sequence number assigned to the preceding AKA procedure and on any previous instances of re-establishing the security context.

Authenticating a device in a network

When setting up communication from a user equipment UE (), such as for providing IP access for the UE in order to allow it to use some service, information or an indication of at least one network property relating to a first network, e.g. the current access network ('), is sent to the UE from a node () in a second network such as the home network () of the subscriber of the UE. The information or indication can be sent in a first stage of an authentication procedure being part of the setting up of a connection from the UE. In particular, the network property can indicate whether the access network (&#x2032;) is trusted or not.

A method and apparatus for key management in a communication network. A Key Management Server (KMS) receives from a first device a request for a token associated with a user identity, the user identity being associated with a second device. The KMS then sends the requested token and a user key associated with the user to the first device. The KMS subsequently receives the token from the second device. A second device key is generated using the user key and a modifying parameter associated with the second device. The modifying parameter is available to the first device for generating the second device key. The second device key is then sent from the KMS to the second device. The second device key can be used by the second device to authenticate itself to the first device, or for the first device to secure communications to the second device.

Key management in a communication network

A method for protecting a wireless communications device against unauthorized use of functionality provided by the wireless communications device, the method comprising: receiving a binding command to bind the wireless communications device to a subscription identification module operationally coupled to the wireless communications device and associated with a subscription to a communications service; responsive to the received command, storing a module identifier identifying the subscription identification module; and storing a device identifier identifying the wireless communications device; obtaining an unbind code and storing the obtained unbind code; performing a module verification verifying that a subscription identification module identified by a stored module identifier is operationally coupled to the wireless communications device, performing a device verification verifying whether a wireless communications device identified by a stored device identifier is operationally coupled to the subscription identification module; and preventing operation of at least a part of said functionality unless the module verification and the device verification have been performed successfully.

Protection of a wireless communications device against unauthorized use

A method and an arrangement for providing keys for protecting communication between a terminal () and service points in a communication network. A basic key (Ik) is first established with a service control node () when the terminal has entered the network. An initial modified key (Ik) is then created in both the service control node and the terminal, by applying a predetermined first function (f) to at least the basic key and an initial value of a key version parameter (v). The initial modified key is sent to a first service point (), such that it can be used to protect communication between the terminal and the first service point. When the terminal switches to a second service point (), the first service point and the terminal both create a second modified key (Ik) by applying a predetermined second function (g) to the initial modified key, and the first service point sends the second modified key to the second service point.

Method and apparatus for handling keys used for encryption and integrity

A method and arrangement is disclosed for managing session keys for secure communication between a first and at least a second user device in a communications network. The method is characterized being independent of what type of credential each user device implements for security operations. A first user receives from a first key management server keying information and a voucher and generates a first session key. The voucher is forwarded to at least a responding user device that, with support from a second key management server communicating with the first key management server, resolves the voucher and determines a second session keys. First and second session keys are, thereafter, used for secure communication. In one embodiment the communication traverses an intermediary whereby first and second session keys protect communication with respective leg to intermediary.

Key management for secure communication

A solution making it possible for one telecommunication network operator (') to act as intermediate distributor or administrator of a content provider () for a multitude of operators () is presented. The content provider () has a single relation to the central operator (&#x2032;), in turn having relations to other operators (). It is thus possible for the content provider () to reach all users () of all operators () through a single relation to that operator (&#x2032;). The content provider () provides service content, e.g. media content. A list of targeted users () or subscribers is compiled. The central operator (&#x2032;) collects necessary subscriber attributes (), such as position, device information and access properties, from the other operators (). The content is modified according to the collected attributes (), and the content is distributed to the subscribers () in the best possible way.

Multi-operator telecommunication distribution of service content

A method of delivering an application key or keys to an application server for use in securing data exchanged between the application server and a user equipment, the user equipment accessing a communications network via an access domain. The method comprises running an Authentication and Key Agreement procedure between the user equipment and a home domain in order to make keying material available to the user equipment and to an access enforcement point. At least a part of said keying material is used to secure a communication tunnel between the user equipment and the access enforcement point, and one or more application keys are derived within the home domain using at least part of said keying material. Said application key(s) is(are) provided to said application server, and the same application key(s) derived at the user equipment, wherein said access enforcement point is unable to derive or have access to said application key(s).

Method and apparatus for delivering keying information

There is disclosed a system for authentication of a device in a network by establishing a second security context between the device and a serving network node when a first security context has previously been established, assisted by an authentication server, based on a random value and a secret shared between an identity module associated with the device and the authentication server. First re-use information from the establishment of the first security context is stored at the authentication server and at the device, the first re-use information enabling secure generation of the second security context from the random value and the secret. Second re-use information may be generated or stored at the device. A context regeneration request is generated at the device, the context regeneration request authenticated at least partly based on the secret. The context regeneration request is sent to the serving network node. The context regeneration request is sent from the serving network node to the authentication server. The context regeneration request is verified at the authentication server. The second security context is generated at the authentication server based on at least the secret, the random value, and the first and second re-use information. The second security context is communicated from the authentication server to the serving network node.

Growing community of inventors

Järfälla, Sweden

Rolf Blom