Security methods and processes relating to wireless communications are evolving. For example, the 3rd Generation Partnership Project (3GPP), which is a collaboration between various groups of telecommunications associations, is currently working on developing security protocols applicable to wireless communications within an enhanced packet system (EPS).
FIG. 1 illustrates an example of an EPS environment for wireless communications. The EPS of FIG. 1 illustrates a user equipment (UE), evolved NodeBs (eNBs) and a mobility management entity (MME). FIG. 1 also illustrates that the eNBs and the MMEs are part of the evolved UMTS terrestrial radio access network (eUTRAN) indicated by the solid-line oval, while the UE is outside of the eUTRAN. Further, the MME is included in the evolved packet core (EPC) of the EPS environment shown in FIG. 1. The EPC is identified by the thin dashed-line oval.
Generally, an EPS has two layers of protection instead of one layer perimeter security as is used in universal mobile telecommunications system (UMTS). The first security layer is the evolved UMTS Terrestrial Radio Access Network (eUTRAN), and the second security layer is evolved Packet Core (EPC) network security. Evolved Packet Core security involves the use of non-access stratum (NAS) signaling security.
A conventional example of security of an EPS environment is now discussed with respect to the signaling diagram illustrated in FIG. 2.
The signaling diagram of FIG. 2 illustrates messages communicated between and operations of a user equipment (UE), first evolved NodeB (source eNB), second evolved NodeB (target eNB), and an evolved packet core (EPC). The EPC includes a Mobility Management Entity (MME) and system architecture evolution gateway (SAE GW). Specifically, the conventional signaling diagram of FIG. 2 illustrates communication between these various components during an intra-MME handover. An intra-MME handover refers to a handover of a UE from a source eNB to a target eNB, in which both the source eNB and target eNB are supported by the same MME.
Referring to FIG. 2, the UE sends a measurement report to the source eNB in message 1. The contents of the measurement report are well-known in the art and thus, are not discussed herein for the sake of brevity.
In response to receiving the measurement report, the source eNB determines which target eNB to conduct the handover procedure with. To begin this conventional handover, the source eNB derives a second key KeNB* from a first key KeNB that is known at the source eNB as shown by operation 1A. Once the second key KeNB* is derived by the source eNB, the source eNB sends a handover request to the target eNB along with the second key KeNB* in message 2.
In response to receiving the handover request, the target eNB provides a handover response to the source eNB along with a Cell Radio Temporary Identity (C-RNTI) in message 3. Conventionally, this C-RNTI is a 16 bit or 32 bit number. Further, this C-RNTI may simply be an identifier related to the target eNB. In the conventional signal diagram of FIG. 2, the second key KeNB* and C-RNTI are being relied on for security. As shown by operation 3A, the target eNB also derives a third key KeNB** from the KeNB* and the C-RNTI. Further, Radio Resource Control and User Plane (RRC/UP) keys are derived from the third key keNB** by the target eNB in operation 3B as is well known in the art.
Still referring to FIG. 2, the source eNB in response to receiving the handover response in message 3, transmits a handover command to the UE. The handover command instructs the UE to perform a handover with the target eNB as shown by Message 4.
Once the UE receive the handover command of message 4, the UE derives a third key KeNB** from the KeNB* and the C-RNTI in operation 4A, which is the same as the key derived in operation 3A by the target eNB. From the third key KeNB**, the UE derives RRC/UP keys as is well-known in the art as shown by operation 4B. As such, both the UE and target eNB have the RRC/UP keys. The UE then sends a handover confirm message to the target eNB as indicated by message 5.
In response to receiving the handover confirm message from the UE, the target eNB sends a handover complete message to the source eNB indicating the intra-MME handover is complete in message 6. Lastly, as indicated by message 7, the target eNB, which is now the source eNB sends a UE location update message to the EPC.