DE112017007823T5 - SYSTEMS AND METHODS FOR PREVENTING DOWNGRADE ATTACKS IN A TELECOMMUNICATIONS NETWORK - Google Patents

Abstract

User equipment (UE) can determine whether a base station that is an enhanced node B (eNB) is real or false. After connecting to an eNB and registering with the network, the UE can receive a hash function and / or a hash value from the network. The UE can periodically perform tracking area (TA) operations and can store a copy of the resulting information locally and transmit another copy to the network. Before connecting to another of the eNB, the UE can cause the network to apply a hash function to the hash value and the TA information and to transmit the result to the UE. The UE can also apply the hash function to local copies of the hash value and the TA information and compare the two results with one another. If the results match, the UE can conclude that the eNB is genuine and can connect to the eNB.

Description

BACKGROUND

Wireless telecommunications networks can include user equipment (UE) (e.g., smartphones, tablet computers, laptop computers, etc.), radio access networks (RANs) (which often include one or more base stations) and a core network. A UE can connect to the core network by communicating with a base station and registering with the core network. After a UE is connected to the network, the UE may be in an operating mode referred to as a "Radio Resource Control" (RRC) connection state in which the base station has assigned certain resources (e.g., radio bearer) to the UE .

If the UE is less active with the network, the UE can change to another operating state. An example of such a state can be an RRC idle mode in which the radio bearers are no longer assigned to the UE. During the RRC idle mode, the UE can remain registered with the core network, but the connection specifically between the base station and the UE can be terminated so that the base station can use these radio resources to another UE. That is, in the RRC idle mode, the UE may be "known" to the core network, but not to the base station.

The UE can transition from the RRC idle mode to the RRC connection mode by reconnecting to a base station (the same base station or another base station) of the wireless telecommunications network. This may include performing an RRC connection establishment process. The UE can initiate the process by sending an RRC connection request to the network. The base station can respond to the request by sending an RRC connection establishment message to the UE, and the process can be completed by the UE sending an RRC connection establishment completion message back to the base station. By completing the RRC connection establishment process, the UE can again be assigned radio bearers for communication with the base station.

Figure list

• 1 veranschaulicht eine beispielhafte Umgebung, in der im vorliegenden Text beschriebene Systeme und/oder Verfahren implementiert werden können;
• 2 ist ein Flussdiagramm eines beispielhaften Prozesses zum Bestimmen, ob ein bestimmter enhanced Node B (eNB) ein echter eNB oder ein falscher eNB ist;
• 3 ist ein Beispiel für eNB-Verifizierungsinformationen, die durch die Benutzerausrüstung (UE) erhalten und gespeichert werden können;
• 4 ist ein Beispiel für eNB-Verifizierungsinformationen, die durch eine Mobilitätsmanagemententität (Mobility Management Entity, MME) verwaltet werden können;
• 5 ist ein Beispiel für die Bereitstellung eines Netzes zum Authentifizieren von eNBs;
• 6 ist ein Beispiel zum Bestimmen, ob ein eNB authentisch ist;
• 7 veranschaulicht beispielhafte Komponenten einer Vorrichtung gemäß einigen Ausführungsformen;
• 8 veranschaulicht beispielhafte Schnittstellen von Basisbandschaltungen gemäß einigen Ausführungsformen; und
• 9 ist ein Blockdiagramm, das Komponenten gemäß einigen beispielhaften Ausführungen veranschaulicht, die in der Lage sind, Instruktionen von einem maschinenlesbaren oder computerlesbaren Medium (zum Beispiel einem nicht-transitorischen maschinenlesbaren Speichermedium) zu lesen und eine oder mehrere der im vorliegenden Text besprochenen Methodologien auszuführen.

The embodiments described herein are readily understood based on the following detailed description in conjunction with the accompanying drawings. In order to facilitate this description, the same reference numbers can denote the same structural elements. The embodiments are exemplary in the figures of the accompanying drawings and are not illustrated for the purpose of limitation.

• 1 illustrates an exemplary environment in which systems and / or methods described herein can be implemented;
• 2nd FIG. 4 is a flow diagram of an example process for determining whether a particular enhanced node B (eNB) is a real eNB or a false eNB;
• 3rd is an example of eNB verification information provided by user equipment ( UE ) can be preserved and saved;
• 4th is an example of eNB verification information provided by a Mobility Management Entity, MME ) can be managed;
• 5 is an example of providing a network to authenticate eNBs;
• 6 is an example of determining whether an eNB is authentic;
• 7 illustrates exemplary components of a device according to some embodiments;
• 8th illustrates exemplary interfaces of baseband circuits according to some embodiments; and
• 9 FIG. 12 is a block diagram illustrating components, in accordance with some example implementations, capable of reading instructions from a machine readable or computer readable medium (e.g., a non-transitory machine readable storage medium) and executing one or more of the methodologies discussed herein.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

The following detailed description refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements. It is understood that other embodiments may be used and structural or logical changes may be made without departing from the scope of the present disclosure. Therefore, the following detailed description is not to be taken in a limiting sense, and the scope of the embodiments is defined by the appended claims and their equivalents.

In a wireless telecommunications network, user equipment (user Equipment, ( UE ) (for example a smartphone, a tablet computer, a laptop computer etc.) via enhanced node Bs (eNBs) of a radio access network (RAN) with a core network. After a UE is connected, the UE are in a "Radio Resource Control (RRC)" connection mode. Later (for example, if the UE no longer communicates with the network), the UEs can go into an RRC idle mode, in which the UE is still registered with the core network, but the wireless connection between the eNB and the UE is finished. The UE can transition from the RRC idle mode to the RRC connection mode by initiating an RRC connection establishment process involving an eNB of the network. However, the RRC connection establishment process can contain certain weaknesses with regard to network security.

For example, the UE are within a signal range of a wireless access point operated by a third party (sometimes referred to as a “false eNB”). The wrong eNB can receive the RRC connection request from the UE and start with the UE Communicate in a way that mimics a real, genuine, or otherwise authentic eNB of the wireless telecommunications network. For example, the wrong eNB can send an RRC connection message to the UE send back with the specific intent of causing the UE to connect through a downgraded service (e.g., 2nd generation (2G) quality of service instead of long-term evolution (LTE) or 5th generation (5G) quality of service ). As a result, the UE complete the RRC connection process by connecting to the network through the downgraded service.

This allows the UE not only face security gaps in the downgraded service (which may not exist for a higher quality service), but the UE can also be exposed to other types of attacks. For example, the wrong eNB can UE send a redirect message (e.g., an RRC disconnect message) that causes the UE to connect to another core network (e.g., a Global System for Mobile Communications (GSM) network) that may be operated by the third party or could otherwise pose a danger from a security perspective. In the examples discussed above, the wrong eNB can sometimes be called a man-in-the-middle, and causing the UE referred to a vulnerable or downgraded service can sometimes be referred to as a "bidding down attack".

Some approaches to combating false eNBs have already been proposed. In one approach, the UE determine whether an eNB is genuine (i.e., authentic and not false) by determining whether information is transmitted wirelessly in the uplink (UL) direction. However, this proposal assumes that the UL traffic comes from other UEs. In this respect, a false eNB can circumvent this approach by broadcasting fictitious UL traffic throughout the entire coverage area. The UE could intercept fake UL traffic, incorrectly conclude that the wrong eNB is real, and then fall victim to a downgrade attack by the wrong eNB.

The techniques described in this text can be one UE enable false eNBs to be identified and to connect to real eNBs by verifying the authenticity of the eNBs during cell selection and reselection. A UE can initially connect to a network by connecting to an eNB and registering with the core network. In response, the network of UE assign a hash value and the UE provide a copy of the hash value and a corresponding hash function.

The UE may then transition to an RRC idle state, which may include the radio resources that the UE assigned (and may be reassigned to another UE). The UE can, however, remain registered with the core network and the network (e.g. a mobility management entity ( MME )) can the location of the UE via UE-to-eNB communications (in the uplink (UL) direction) and / or via the UE Follow up on the tracking area (TA). If the UE initially registered with the core network, for example the MME the location of the UE based on the eNB through which the UE communicates with the core network, and / or that of the UE know received TA information. After that, the UE periodically, and / or if the UE into a new one TA occurs, updated TA information to the MME (for example, according to a schedule). Every time the UE Can send TA information to the MME UE and the MME Save copies of the TA information for later use. The through the UE and the MME TA information stored can be a historical list of TA identifiers corresponding to TAs in which the UE has stopped.

Later that UE detect an eNB selection event that prompts the UE may include selecting an eNB and connecting to it. The eNB selection event can include a transition from the RRC idle state to an RRC connection mode or a redirect message from the eNB. In response, the UE Send a request for verification information regarding the eNB to the eNB. The request may include a hash function request to apply to some or all of the TA information that the UE sent to the core network. The eNB can meet the requirement for a MME forward the core network, and the MME can have the same hash function (previously the UE was made available) to the TA information described in the request and that of the UE Apply the hash value previously provided.

The result of the hash function (sometimes referred to as “TA hash” in the present text) can be sent to UE are sent, and the UE can verify whether the TA hash is authentic. Since the UE has previously received a copy of the hash function and the hash value and has saved local copies of the TA information sent to the MME, for example UE apply the hash function independently to the hash value and TA information. The UE can then get the TA hash from the MME with the TA hash of the UE Compare to verify that the results match. If the results match, the UE come to the conclusion that the eNB is genuine, authentic, etc., since a false eNB would not be able to use the MME to communicate and send back an authentic TA hash. If the results do not match, the UE conclude that the eNB is incorrect or otherwise untrustworthy and need not proceed to the eNB selection event (for example, it can ignore the cell redirection message, select another eNB to authenticate and connect, etc.).

1 illustrates an exemplary environment 100 , in which systems and / or methods described in the present text can be implemented. The environment 100 can UEs 110 (individually as UE 110 and together as UEs 110 referred to), a wireless telecommunications network and an external network. The wireless telecommunications network may consist of or contain radio access networks (RANs) which contain one or more base stations, some or all of which are in the form of enhanced NodeBs (eNBs) 120 (individually as eNB 120 and together as eNBs 120 referred to) via the UEs 110 can communicate with the EPC network.

The EPC network can be a serving gateway (SGW) 130 , a PDN gateway (PGW) 140 , a Mobility Management Entity (MME) 150 , a home subscriber server (HSS) 160 and a Policy and Charging Rules Function (PCRF) 170 contain. As shown, the EPC network can support the UEs 110 enable you to communicate with an external network, such as a public land mobile network (PLMN), a public switched telephone network (PSTN), and / or an Internet Protocol (IP) - Network (for example the Internet). The environment 100 can also have one or more false eNBs 180 included, which can be connected to one or more alternative core networks.

The number of devices and / or networks that are in 1 are used for illustrative purposes only. In practice, the environment 100 additional devices and / or networks, fewer devices and / or networks, different devices and / or networks, or differently arranged devices and / or networks than in 1 illustrated included. For example, the environment 100 Although not shown, contain devices that allow communication between various in the environment 100 shown components, such as routers, modems, gateways, switches, hubs, etc., facilitate or enable.

Alternatively or additionally, one or more of the devices may be in the vicinity 100 perform one or more functions than that of one or more other surrounding devices 100 be described. In addition, the devices can the environment 100 connected to one another and / or to other devices via wired connections, wireless connections or a combination of wired and wireless connections. In some embodiments, one or more devices may be environmental 100 physically into one or more other devices in the area 100 integrated and / or physically attached to it. Furthermore, "direct" connections between certain devices in 1 are shown, but in practice some of these devices may also communicate with one another through one or more additional devices and / or networks.

The UE 110 may include a portable computer and communication device, for example a personal digital assistant (PDA), a smartphone, a cell phone, a laptop computer connectable to the wireless telecommunications network, a tablet computer, etc. UE 110 can also be a non-portable computing device, such as a desktop computer, consumer or business device, or other device that can connect to a RAN of the wireless telecommunications network. The UE 110 may also include a computer and communication device that can be worn by a user (also referred to as a "wearable" device), such as a watch, a fitness band, a necklace, glasses, an eyeglass, a ring, belt, headset, or other type of wearable device. In some embodiments, the UE 110 also, or alternatively, include an Internet of Things (IoT) device that is connected via eNBs 120 can communicate with the EPC. Examples of an IoT device can be a home appliance, a vending machine, an automated teller machine (ATM), a consumption meter and an environmental measuring device (for measuring temperature, pressure, humidity, precipitation, seismic activity, etc.), etc.

The eNB 120 may include one or more network devices that receive, process, and / or send the data traffic for the UE 110 is determined and / or by the UE 110 is received (for example via an air interface). The eNB 120 may be connected to a network device, for example a location router, which acts as an intermediary for between the eNB 120 and the EPC transmitted information acts. The eNB 120 may be able to participate in an RRC build process for the UE 110 a connection with the eNB 120 and register with the EPC. Processes and operations that are described in this text so that they can be carried out by the eNB 120 be executed or otherwise the eNB 120 include, or alternatively, can be performed (or include) by one or more other types of access nodes, including base stations ( BS ), NodeBs, Next Generation NodeBs (gNBs), RAN nodes, etc., and which may include ground stations (e.g. terrestrial access points) or satellite stations that provide coverage within a geographic area (e.g. a cell).

The SGW 130 can be traffic from one or more eNBs 120 is received, aggregate and can aggregate the data traffic via the PGW 140 send to an external network or device. The SGW 130 can traffic from one or more PGWs 140 incoming, aggregate and aggregate data traffic to one or more eNBs 120 send. The SGW 130 can act as an anchor for the user level during transfers between eNBs and as an anchor for mobility between different telecommunication networks. The PGW 140 may include one or more network devices that carry traffic from one or more SGWs 130 incoming, aggregate and send the aggregated data traffic to an external network. The PGW 140 can also, or alternatively, receive data traffic from the external network and can receive the data traffic (via the SGW 130 and / or the eNB 120 ) to the UE 110 send.

The MME 150 may include one or more computing and communication devices that act as a control node for the eNB 120 and / or other devices that provide the air interface for the wireless telecommunications network function. For example, the MME 150 Operations to register the UE 110 in the wireless telecommunication network, for the establishment of carrier channels (for example traffic flows), with a session with the UE 110 are linked to the transfer of the UE 110 to another eNB, another MME or another network, and / or to perform other operations. The MME 150 can perform routing operations on traffic that is for the UE 110 determined and / or received from it.

The HSS 160 may include one or more devices stored in memory associated with the HSS 160 linked, manage, update and / or save profile information associated with a participant (for example a participant who is associated with the UE 110 is linked) are linked. The profile information may include applications and / or services that are permitted and / or accessible to the subscriber, a mobile directory number (MDN) assigned to the subscriber, bandwidth or data rate thresholds associated with the applications and / or services, and / or identify other information. The subscriber can use the UE 110 be linked. Additionally or alternatively, the HSS 160 Authentication, authorization and / or billing processes in connection with the participant and / or a communication session with the UE 110 carry out.

The PCRF 170 may receive information about policies and / or subscriptions from one or more sources, such as subscriber databases and / or from one or more users. The PCRF 170 can send these guidelines to the PGW 140 or submit another device so that policies can be enforced. As shown, in some embodiments, the PCRF 170 with the PGW 140 communicate to ensure that the charging guidelines are properly routed to locally Sessions within the telecommunications network can be applied.

The wrong eNB 180 may include one or more network devices that receive, process, and / or send traffic to the UE 110 is determined and / or by the UE 110 is received (for example via an air interface). The wrong eNB 180 may include a wireless access point (e.g., an eNB, a microcell device, a wireless router, etc.) owned and operated by a third party (i.e., an organization other than the wireless telecommunications network service provider). The wrong eNB 180 may be able to perform one or more functions of the eNB 120 , such as an RRC connection establishment process. The wrong eNB 180 may, or alternatively, be able to perform downgrading attacks that the UEs 110 can cause to communicate with the wireless telecommunications network via a downgraded service (e.g. 2G service) instead of an LTE or 5G service. Additionally or alternatively, the wrong eNB 180 cause UEs 110 to another core network, such as the alternative core network (which can be a 2G or GSM network). The wrong eNB 180 can use RRC connection establishment processes (for example, if the UE 110 from the RRC idle mode to the RRC connection mode) to perform downgrade attacks and / or to cause UE 110 to redirect to the alternative core network.

2nd Figure 14 is a flow diagram of an example process 200 to determine whether a particular eNB 120 is a real eNB or a false eNB. The process 200 can through the UE 110 be implemented. Below is 2nd with respect to the 3rd and 4th described.

The process 200 can monitor a current one during RRC idle mode TA of the UE 110 and the transmission of TA information to the MME 150 included (block 210 ). TA information, as described herein, may include information that has a geographic location or geographic area, such as a TA the wireless telecommunications network, a coverage area of a particular eNB, a geographic location where coverage areas of multiple eNBs overlap, etc. In some embodiments, TA information may include a tracking area identifier (TAI), which may consist of or corresponds to a public land mobile network (PLMN) and a tracking area code (TAC). In some embodiments, TA information may include a TAI, a PLMN, a TAC, and / or some other form of information that identifies a geographic location or geographic area. For example, the UE 110 First, connect to a wireless telecommunications network by doing an RRC connection process with a particular eNB 120 of the network. The RRC connection establishment process may include that the eNB 120 Allocates wireless resources (for example, Access Spectrum (AS) resources) that the UE 110 to be assigned, which the UE 110 and the eNB 120 can use to communicate with each other. After the RRC connection establishment process, the UE 110 be in RRC connection mode and can be with the EPC of the eNB 120 be registered.

At some point after that UE 110 enter an RRC idle mode, which may include a release of the wireless resources (e.g., radio bearer) that the UE 110 assigned. During the RRC idle mode, the UE 110 remain registered with the EPC, but the eNB 120 none of that UE 110 White. In addition, the UE 110 periodically carry out a TA operation through which the UE 110 one or more eNBs 120 can determine the wireless telecommunications with which the UE 110 can communicate. The eNBs 120 of the TA update process may change over time as the UE 110 TA updates can perform while the UE 110 moved around in the coverage area of the network. The UE 110 can keep a local record of TA information and TA information to the MME 150 to transfer. The TA information stored by the UE and the MME can be a historical list of TA identifiers that correspond to TAs in which the UE has stopped.

The TA information can be the one or more eNBs 120 included with which the UE 110 can communicate at the location where the UE 110 performs the TA process. The TA information can also contain a point in time and / or can be obtained in combination with a point in time at which the TA information by the UE 110 were caught up. Additionally or alternatively, the UE can 110 - since the UE 110 can collect multiple sets of TA information over a period of time - each set of TA information at a time when the TA information is through the UE 110 and / or link to chronological identifiers (e.g., 1, 2, 3, etc., or first, second, third, etc.) that define a chronology with which the sets of TA information were obtained. While the UE 110 Obtain TA information and TA information periodically (for example, according to a preselected timer, schedule, etc.) to the MME 150 the UE can report 110 additionally, or alternatively, obtain TA information, save a copy of the TA information locally, and every time the UE 110 into another TA moved another copy of the TA information to the MME 150 send.

3rd is an example of eNB verification information provided by the UE 110 can be preserved and saved. The information (and their arrangement) from 3rd are shown as a non-limiting example. In practice, the UE 110 150 manage less, additional and / or alternative information than in 3rd shown. In addition, through the UE 110 stored information is arranged in a certain way, which may include certain types of data structures and storage techniques.

As shown, through the UE 110 managed eNB verification information records of TA information by the UE 110 received over a period of time, and / or contain a key or hash value. Each record of TA information can contain TA information ( TA1 , TA2 etc.) by the UE 110 were obtained, and a time or chronological indicator (for example T1 , ..., Tn ) indicating the time or order in which each set of TA information was received. In some embodiments, the number of records of TA information determined by the UE 110 stored, limited or otherwise restricted (for example, to a certain amount or storage period, as long as the UE 110 remains registered with the EPC, etc.) so that, for example, the UE 110 does not need to manage excessive, unnecessary, or otherwise undesirable amounts of TA information.

The hash value can contain a sequence or chain of information that the UE 110 later (in combination with TA information) can be used to verify whether a particular eNB 120 is false or real. In some embodiments, the UE 110 from the wireless telecommunications network (for example the eNB 120 , of the MME 150 and / or the HSS 160 ) receive the hash value as part or as a result of the initial connection to the wireless telecommunications network. In some embodiments, the wireless telecommunications network (e.g., the eNB 120 , the MME 150 and / or the HSS 160 ) update the hash value (for example change) and the hash value to UEs connected to the network 110 to distribute. In some embodiments, the wireless telecommunications network (e.g., the eNB 120 who have favourited MME 150 and / or the HSS 160 ) Determine hash values dynamically and hash values to the UEs 110 distribute such that the hash value for each UE 110 or different groups of UEs 110 a unique hash value can be assigned. In some embodiments, the UE 110 also, or alternatively, manage other types of information, such as information that identifies a particular hash function that the UE 110 can later use it to verify whether a particular eNB 120 is authentic. In some embodiments, the UE 110 negotiate with the network to receive or identify a hash function to be used to authenticate eNBs. In some embodiments, the UE 110 receive several hash functions from the network and then receive an indication of which hash function is to be used at a specific time, for a specific eNB authentication, etc. For example, the UE 110 store local copies of certain hash functions that can be applied to the authentication of an eNB and the UE 110 can from the eNB 120 , the MME 150 etc. (for example, together with the hash value) receive an indication of which hash function on the authentication of a particular eNB 120 should be applied.

We are going to 2nd back where the process 200 can also include the detection of an eNB selection event (block 220 ). For example, the UE 110 detect a message, an operation, an event, etc., which the UE 110 involved or requests the eNB 120 to select or connect with it. An eNB selection event can be, or can be part of, the UE 110 performs an RRC connection establishment process, the UE 110 a connection with the eNB 120 select and / or establish (for example, the transition from an RRC idle mode to an RRC connection mode). Additionally or alternatively, an eNB selection event may include that the UE 110 a redirect message (for example from the eNB 120 , the wrong eNB 180 etc.) received by the UE 110 requests to connect to another access point (for example the eNB 120 , the wrong eNB 180 etc.) to connect. The redirect message can be received during the RRC connection establishment process. In some embodiments, an eNB selection event may include another type of operation in which the UE 110 selects (for example connects to) the wireless telecommunications network access point.

The process 200 can also contain from the MME 150 and based on the TA of the UE 110 verification of the selection event of the eNB 120 to be requested (block 230 ). For example, the UE 110 in response to detecting the eNB selection event, a request to the MME 150 submit to receive information that the UE 110 can be used to verify whether a particular eNB 120 is real. The request can identify the information UE 110 (for example, a phone number, the International Mobile Subscriber Identity (IMSI), etc.), a request to the MME 150 for performing a hash function, as well as information for identifying one or more types of information on the basis of which the hash function is to be carried out. Examples of such information may be information that identifies one or more TA records that the UE 110 correspond (for example, the most recent TA record, a TA record associated with a certain time, a set of TA records (for example, the last X number of TA records, TA records that correspond to a time interval (in the present text (also known as interval parameters) (for example, the last 30 minutes), etc.) A TA record, as described in this text, can sometimes be referred to as a “set of TA information”.

In some embodiments, the UE 110 Provide additional or alternative information, such as information that identifies a certain hash function and / or a certain value (for example, a unique identifier that is linked to a certain hash function and / or a certain value, a time stamp, that is linked to a specific hash function and / or a specific value (for example, a point in time at which the hash function or the value is triggered by the MME 150 created and / or to the UE 110 was transmitted) etc.). Since the UE 110 can submit the request while the UE 110 is in RRC idle mode and therefore no RRC connection to the eNB 120 the UE can 110 in some embodiments, the request to the MME 150 send via a Common Control Network Function (CCNF) where a non-access stratum (NAS) context of UE 110 can be held. In response to the request, the MME 150 perform the hash function using the information provided by the UE 110 can be specified and the result of the hash function to the UE 110 send back.

4th is an example of eNB verification information provided by the MME 150 can be managed. The information (and their arrangement) from 4th are shown as a non-limiting example. In practice, the MME 150 manage less, additional and / or alternative information than in 4th shown. In addition, the through the MME 150 stored information is arranged in a certain way, which may include certain types of data structures and storage techniques.

As shown, the MME 150 managed eNB verification information contain records of TA information related to various UE 110 and / or a key or hash value for each UE 110 are linked. Each record of TA information can contain TA information ( TA1 , TA2 etc.) by the corresponding UE 110 were obtained, and a time or chronological indicator (for example T1 , ..., Tn ) indicating the time or order in which each set of TA information is given by the UE 110 was obtained. As shown, the number of each UE 110 linked TA records vary (for example TAx , TAy etc.). In some embodiments, the number of records of TA information maintained by the MME 150 be saved (for example, to a certain amount or storage duration, as long as the UE remains registered with the network, etc.) so that, for example, the techniques described in this text do not MME cause an excessive, unnecessary, or otherwise undesirable amount of TA information to be managed.

In addition, everyone can UE 110 assigned hash values vary (e.g. 76as76 ..., 786sdgf7 ..., etc.) such that each UE 110 or group of UEs 110 (for example UEs 110 that have a hash value at a certain point in time or within a certain period of time) can have a unique hash value. The through the MME 110 Stored hash values can contain a sequence or chain of information that the MME 150 can later use (in combination with TA information) to apply it to a hash function, the result of which the UE 110 can be sent to verify whether a particular eNB 120 is real. In some embodiments, the MME 150 the hash value for each UE 110 determine, assign and deploy after the UE 110 has registered with the network for the first time (or can do so as part of this initial registration). In some embodiments, the MME 150 periodically update hash values (for example change) and send them to UEs 110 to distribute. In some embodiments, the MME 150 also, or alternatively, manage other types of information, such as information that identifies a particular hash function associated with each UE 110 is linked.

We are going to 2nd back where the process 200 can also contain from the MME 150 Verification information for the eNB 120 to receive (block 240 ). For example, the UE 110 - in response to sending verification information to the MME 150 - Receive information that the UE 110 can be used to determine whether the eNB 120 a real eNB 120 or a wrong eNB 180 is. The verification information described in this text may be the product of the application by the MME 150 , TA information and a hash key to a preselected hash function (a copy of which can be the UE 110 as part of, or as a result of, the initial registration with the network).

The process 200 can also contain, based on the verification information from the MME 150 to determine whether the eNB 120 is a real eNB or a false eNB (block 250 ). Since the UE 110 can have a copy of the TA information, hash value and hash function that the MME 150 used to generate the verification information, the UE 110 for example, independently compute verification information by applying the same TA information and hash value to the hash function. In this respect, the UE 110 have two sets of verification information: one set by the MME 150 was received, and the other sentence independently by the UE 110 was created. Thus, the UE 110 by comparing the two sets of verification information, determine whether the eNB 120 is real. If the verification information matches, the UE 110 determine that the eNB 120 is a real eNB because a false eNB has no access to the MME 150 and would therefore not be able to return verification information that matches the verification information that is independent of the UE 110 were created. That is, even if a wrong eNB 180 tried that UE 110 to deceive by providing some kind of verification information would be by the wrong eNB 180 transmitted verification information does not match because a wrong eNB 180 would not have copies of the hash function, the hash value and / or the TA information.

If the UE 110 determines that the eNB 120 is wrong (block 260 - No), so can the process 200 include the completion of the eNB selection process (block 270 ). The eNB selection process can be part of a transition from UE 110 from the RRC idle mode to the RRC connection mode, a cell redirection process, etc.; if the UE 110 however, determines that the eNB 120 with which the UE 110 communicated, not authentic or genuine, so the UE 110 End the process or otherwise ignore it, thereby avoiding a "man in the middle" attack, a downgrading attack, etc. If the UE 110 determines that the eNB 120 is real (block 260 - Yes), so can the process 200 contain the transition to the eNB selection process (block 280 ). If, for example, the UE 110 determines that the eNB 120 with which the UE 110 communicated, authentic or genuine, so that can UE 110 Continue with the process as the process is not part of a "man in the middle" attack, a downgrade attack, etc., regardless of whether the eNB selection process is part of a transition that UE 110 , from the RRC idle mode to the RRC connection mode, a cell redirection process, etc.

5 is an example of providing a network to authenticate eNBs. As shown, the example of 5 the UE 110 , the eNB 120 and the MME 150 contain. The example of 5 is presented as a non-limiting example. In practice, the example of 5 contain fewer, additional or alternative operations or functions. In addition, one or more of the operations or functions of 5 may be performed by fewer, additional, or alternative devices that refer to one or more of the above 1 described devices may contain.

As shown, the UE 110 First connect to a wireless telecommunications network by connecting to the eNB 150 (via an RRC connection process) connects and connects to the core network (e.g. the MME 150 ) registered (at 505 ). During or after the initial connection process, the UE 110 a request to the MME 150 for a hash function and / or a hash value that are intended for eNB verification (at 510 ), and the MME 150 can answer accordingly (at 515 ). In some embodiments, the MME 150 the hash function and / or the hash value automatically to the UE 505 instead of sending a response from the UE 505 waiting.

Let’s say that UE 110 at some point transitions from an RRC connection state to an RRC idle state (at 520 ). In this respect, the eNB 150 release the radio resources needed to communicate with the UE 110 were used (at 525 ), but the UE 110 stays with the MME 150 registered (at 530 ). While the UE 110 is in the RRC idle state, it can perform one or more TAU operations (at 535 ) and the TA information resulting from the TAU process to the MME 150 submit (at 540 ). Copies of the TA information can be obtained from both UE 110 as well as through the MME 150 saved for later use (at 545 and 550 ).

6 is an example of determining whether an eNB is authentic. As shown, the example of 6 the UE 110 , the eNB 120 and the MME 150 contain. The example of 5 is presented as a non-limiting example. In practice can the example of 5 contain fewer, additional or alternative operations or functions. In addition, one or more of the operations or functions of 5 may be performed by fewer, additional, or alternative devices that refer to one or more of the above 1 described devices may contain. For the purpose of explaining 6 it is believed that the UE 110 and the MME 150 have each saved TA information that the UE 110 correspond (as above with reference to 5 described).

As shown, the UE 110 detect an eNB selection event (at 610 ). As described herein, the eNB selection event may be part of the transition from UE 110 from an RRC idle mode to an RRC connection mode, a response to receiving a redirect message from an eNB (e.g., the eNB 120 or the wrong eNB 180 ), or another scenario in which the UE 110 select a new or different eNB. In response, the UE 110 a request (for example, a verification request message) to the eNB 120 submit (at 620 ). The request may include information (e.g. UE-dT) that describes TA information that the MME 150 should apply to the hash function to generate eNB verification information. As described in the present text, the UE 110 specified TA information (i.e. UE-dT) the most recent TA record from the UE 110 , a TA record associated with a specific timestamp, a set of TA records (for example the last X number of TA records, TA records that correspond to a time interval (also referred to as interval parameter in the present text) (for example the last 30 minutes), etc.). For example, UE-dT can represent TA information that was generated over a period of time (dT) and with a specific one UE 110 are linked. The requirement of the UE 110 can also, or alternatively, an identifier of the UE 110 , a specific hash value, an identifier of a specific hash function, etc.

The eNB 120 can respond to the request by contacting the MME 150 a message (for example, a GET message) related to that by the UE 110 sends requested hash information (at 630 ). In some embodiments, the message from the eNB 120 the TA information (UE-dT) from the UE 110 contain. The message may also, or alternatively, be an identifier of the UE 110 , one through the UE 110 provided hash value, an identifier of a particular hash function, etc.

The MME 150 can respond to the message from the eNB 120 respond by generating eNB verification information according to the message. For example, the MME 150 identify local copies of TA information specified in the message, one with the UE 110 determine the linked specific hash value and use a hash function of the TA information and the hash value to generate eNB verification information (also referred to in the present text as “TA hash”). The MME 150 can send the TA hash to the eNB 120 submit (at 640 ), and the eNB 120 can send the TA hash to the UE 110 submit (at 650 ). For this purpose, the eNB 120 include the hash result in a verification acceptance message.

The UE 110 can on the TA hash information from the MME 150 respond by verifying the authenticity of the TA hash information (at 660 ). For example, the UE 110 , as described above, independently a hash function based on the same inputs (for example, the same hash value and the same TA information) as that MME 150 and then compare the results of both hash functions. If the results do not match and / or if the eNB 120 not appropriate to the verification request message from the UE 110 reacts, so the UE 110 conclude that the eNB is incorrect or otherwise untrustworthy and may end or ignore the eNB selection event. If the results match, the UE 110 come to the conclusion that the eNB 120 is a true eNB of the wireless telecommunications network, and can act on (according to the eNB selection event (e.g., an RRC connection process, a cell redirection process, etc.) 670 ).

For the purposes of this text, the terms "circuit", "processing circuit" or "logic" may refer to, may be part of, or may include: an application specific integrated circuit (ASIC), an electronic circuit, a processor (shared, dedicated, or group) and / or memory) shared, dedicated, or group (executing one or more software or firmware programs, a combinatorial logic circuit, and / or other suitable hardware components that provide the described functionality In some embodiments, the circuitry may be implemented by one or more software or firmware modules or functions associated with the circuitry may be implemented by one or more software or firmware module In some embodiments circuits may contain logic that is at least can partially run in hardware.

Embodiments described herein can be implemented into a system using any suitably configured hardware and / or software. 7 illustrates exemplary components of a device 700 according to some embodiments. In some embodiments, the device 700 an application circuit 702 , a baseband circuit 704 , a radio frequency (RF) circuit 706 , a front-end module (FEM) circuit 708 , one or more antennas 710 and a power management circuitry (PMC) 712 included, which are coupled together at least in the manner shown. The components of the illustrated device 700 can be contained in a UE or a RAN node. In some embodiments, the device 700 contain fewer elements (for example, a RAN node does not need the application circuitry 702 and may instead include a processor / controller to process the IP data received from an EPC). In some embodiments, the device 700 contain additional elements such as memory or mass storage, a display, a camera, a sensor or an input / output (I / O) interface. In other embodiments, the components described below may be included in more than one device (for example, these circuits may be included separately in more than one device for cloud RAN (C-RAN) implementations).

The application circuit 702 can contain one or more application processors. For example, the application circuit 702 Contain circuits such as one or more single or multi-core processors. The one or more processors can include any combination of general-purpose processors and dedicated processors (e.g., graphics processors, application processors, etc.). The processors can be coupled to or can include the memory or mass storage and can be configured to execute instructions stored in the memory or mass storage for various applications or operating systems on the device 700 can expire. In some embodiments, processors of the application circuit 702 Process IP data packets that are received from an EPC.

The baseband circuit 704 may include circuits such as one or more single-core or multi-core processors. The baseband circuit 704 may include one or more baseband processors or control logic to get from a received signal path of the RF circuit 706 process received baseband signals and baseband signals for a transmission signal path of the RF circuit 706 to generate. The baseband processing circuit 704 can with the application circuit 702 be connected to generate and process the baseband signals and operations of the RF circuit 706 to control. For example, in some embodiments, the baseband circuit 704 a baseband processor 704A the third generation (3G), a baseband processor 704B fourth generation (4G), a baseband processor 704C fifth generation (5G) or one or more other baseband processors 704D for other existing, developing or future generations (e.g. second generation (2G), sixth generation (6G), etc.). The baseband circuit 704 (for example one or more of the baseband processors 704A-D ) can take over various radio control functions that enable communication with one or more radio networks via the HF circuit 706 enable. In other embodiments, some or all of the functions of the baseband processors can 704A-D be contained in modules that are in memory 704G are stored and via a central processing unit (CPU) 704E be carried out. The radio control functions can include, for example, signal modulation / demodulation, coding / decoding, high frequency shift, etc. In some embodiments, the modulation / demodulation circuit of the baseband circuit 704 Fast Fourier Transform (FFT), precoding or constellation mapping / demapping functionality included. In some embodiments, the encoding / decoding circuit of the baseband circuit 704 Folding, tail-biting-folding, turbo, Viterbi or low density parity check (LDPC) encoding / decoding functionality included. Embodiments of modulation / demodulation and encoder / decoder functionality are not limited to these examples and may include other suitable functions in other embodiments.

In some embodiments, the baseband circuit 704 one or more digital audio signal processors (DSP) 704F contain. The one or more audio DSPs 704F may include compression / decompression and echo cancellation elements, and in other embodiments may include other suitable processing elements. In some embodiments, components of the baseband circuit can be conveniently arranged in a single chip, a single chipset or on the same circuit board. In some embodiments, some or all of the components of the baseband circuit may be 704 and the Application circuit 702 implemented together, such as on a System on Chip (SOC).

In some embodiments, the baseband circuit 704 enable communication that is compatible with one or more radio technologies. For example, in some embodiments, the baseband circuit 704 support communication with an Evolved Universal Terrestrial Radio Access Network (EUTRAN) or other Wireless Metropolitan Area Networks (WMAN), a Wireless Local Area Network (WLAN) or a Wireless Personal Area Network (WPAN). Embodiments in which the baseband circuit 704 Configured to support radio communications from more than one wireless protocol may be referred to as a multi-mode baseband circuit.

The RF circuit 706 can enable communication with wireless networks using modulated electromagnetic radiation through a non-solid medium. In various embodiments, the RF circuit 706 Switches, filters, amplifiers, etc. included to enable communication with the wireless network. The RF circuit 706 may include a receive signal path that includes a circuit for downconverting that from the FEM circuit 708 received RF signals and for transmitting baseband signals to the baseband circuit 704 may contain. The RF circuit 706 may also include a transmit signal path, which is a circuit for upconverting that through the baseband circuit 704 output baseband signals and for transmitting RF output signals to the FEM circuit 708 may include for sending.

In some embodiments, the receive signal path of the RF circuit 706 a mixer circuit 706a , an amplifier circuit 706b and a filter circuit 706c contain. In some embodiments, the transmit signal path of the RF circuit 706 a filter circuit 706c and a mixer circuit 706a contain. The RF circuit 706 can also use a synthesizer circuit 706d for synthesizing a frequency for use by the mixer circuit 706a of the received signal path and the transmitted signal path. In some embodiments, the mixer circuit 706a of the received signal path may be configured to be that of the FEM circuit 708 received RF signals based on that by the synthesizer circuit 706d transmitted synthesized frequency downconverted. The amplifier circuit 706b can be configured to amplify the down-converted signals and the filter circuit 706c can be a low-pass filter (LPF) or a band-pass filter (BPF) configured to remove unwanted signals from the down-converted signals to generate output baseband signals. The output baseband signals can be sent to the baseband circuit 704 be transmitted for further processing. In some embodiments, the output baseband signals may be zero frequency baseband signals, although this is not a requirement. In some embodiments, the mixer circuit 706a of the received signal path include passive mixers, the scope of the embodiments being not limited in this regard.

In some embodiments, the mixer circuit 706a of the transmit signal path may be configured to receive input baseband signals based on that through the synthesizer circuit 706d transmitted synthesized frequency upconverts to RF output signals for the FEM circuit 708 to generate. The baseband signals can be through the baseband circuit 704 and can be provided by the filter circuit 706c be filtered.

In some embodiments, the mixer circuit 706a of the received signal path and the mixer circuit 706a of the transmission signal path contain two or more mixers and can be designed for a quadrature downconversion or upconversion. In some embodiments, the mixer circuit 706a of the received signal path and the mixer circuit 706a of the transmission signal path contain two or more mixers and can be designed for an image rejection (for example a Hartley image rejection). In some embodiments, the mixer circuit 706a of the received signal path and the mixer circuit 706a be designed for a direct downward conversion or upward conversion. In some embodiments, the mixer circuit 706a of the received signal path and the mixer circuit 706a of the transmission signal path can be configured for super heterodyne operation.

In some embodiments, the output baseband signals and the input baseband signals may be analog baseband signals, although the scope of the embodiments is not limited in this regard. In some alternative embodiments, the output baseband signals and the input baseband signals may be digital baseband signals. In these alternative embodiments, the RF circuit 706 Analog-to-digital converter (ADC) and digital-to-analog converter (DAC) circuits included, and the baseband circuit 704 can use a digital baseband interface to communicate with the RF circuit 706 contain.

In some dual mode implementations, separate radio IC circuitry may be provided for processing signals for each spectrum, although the scope of the embodiments is not limited in this regard.

In some embodiments, the synthesizer circuit 706d be a fractional-N synthesizer or a fractional N / N + 1 synthesizer, although the scope of the embodiments is not limited in this regard. For example, the synthesizer circuit 706d a delta-sigma synthesizer, a frequency multiplier or a synthesizer which comprises a phase-locked loop with a frequency divider.

The synthesizer circuit 706d can be configured to have an output frequency for use by the mixer circuit 706a the RF circuit 706 synthesize based on a frequency input and a divider control input. In some embodiments, the synthesizer circuit 706d be a fractional N / N + 1 synthesizer.

In some embodiments, frequency input may be provided by a voltage controlled oscillator (VCO), although this is not a requirement. A divider control input can either be through the baseband circuit 704 or the application processor 702 depending on a desired output frequency. In some embodiments, a divider control input (e.g., N) may be based on a lookup table based on one by the application processor 702 specified channel can be determined.

The synthesizer circuit 706d the RF circuit 706 may include a divider, a delay-locked loop (DLL), a multiplexer, and a phase accumulator. In some embodiments, the divider may be a dual module divider (DMD) and the phase accumulator may be a digital phase accumulator (DPA). In some embodiments, the DMD may be configured to divide the input signal by either N or N + 1 (for example, based on an implementation) to provide a fractional split ratio. In some example embodiments, the DLL may include a set of cascaded, tunable delay elements, a phase detector, a charge pump, and a D flip-flop. In these embodiments, the delay elements may be configured to break down a VCO period into Nd like phase packets, where Nd is the number of delay elements in the delay line. In this way, the DLL provides negative feedback to help ensure that the total delay through the delay line is a single VCO cycle.

In some embodiments, the synthesizer circuit 706d configured to generate a carrier frequency as the output frequency, while in other embodiments the output frequency can be a multiple of the carrier frequency (e.g., twice the carrier frequency, four times the carrier frequency) and used in conjunction with a quadrature generator and divider circuit, to generate multiple signals at the carrier frequency with multiple different phases related to each other. In some embodiments, the output frequency may be an LO frequency (fLO). In some embodiments, the RF circuit 706 contain an IQ / Polar converter.

The FEM circuit 708 may include a receive signal path, which may include circuitry configured to operate based on RF signals from one or more antennas 710 were received to amplify the received signals and the amplified versions of the received signals into the RF circuit 706 feed for further processing. The FEM circuit 708 may also include a transmit signal path that may include circuitry configured by the RF circuitry 706 provided transmission signals for transmission through one or more of the one or more antennas 710 to reinforce. In various embodiments, the gain via the transmit or receive signal paths can only be in the RF circuit 706 , only in the FEM 708 or both in the RF circuit 706 as well as in the FEM 708 respectively.

In some embodiments, the FEM circuit 708 include a TX / RX switch to switch between transmit mode and receive mode operation. The FEM circuit may include a receive signal path and a transmit signal path. The receive signal path of the FEM circuit may include an LNA to amplify received RF signals and the amplified received RF signals as an output (for example for the RF circuit 706 ) to provide. The transmit signal path of the FEM circuit 708 can be a power amplifier (PA) for amplifying input RF signals (for example by the RF circuit 706 ) and one or more filters for generating RF signals for subsequent transmission (for example by one or more of the one or more antennas 710 ) contain.

In some embodiments, the PMC 712 that of the baseband circuit 704 Manage supplied energy. In particular, the PMC 712 Control the selection of the power source, voltage scaling, battery charging or DC-DC conversion. The PMC 712 can often be included when the device 700 can be operated with a battery, for example if the device is contained in a UE. The PMC 712 can increase the efficiency of the power conversion and at the same time allow a suitable implementation size and suitable heat dissipation properties.

7 shows the PMC 712 only with the baseband circuit 704 coupled. In other embodiments, the PMC 712 however additionally or alternatively with other components such as the application circuit 702 , the RF circuit 706 or the FEM 708 coupled and can perform similar power management operations for them.

In some embodiments, the PMC 712 various power saving mechanisms of the device 700 control or otherwise be part of it. If the device 700 For example, if it is in an RRC_Connected state where it is still connected to the RAN node, since it is expecting to receive traffic shortly after a period of inactivity, it can enter a state that is called discontinuous receive mode ( Discontinuous Reception Mode, DRX) is called. During this condition, the device may turn off 700 switch off for short time intervals and thus save electricity.

If there is no traffic activity for an extended period of time, the device can 700 transition to an RRC idle state in which it disconnects from the network and does not perform any operations such as channel quality feedback, handover, etc. The device 700 goes into a very low power state and pages, periodically waking up to listen to the network and then turning itself off. The device 700 does not need to receive any data in this state. To receive data, it must return to the RRC_Connected state.

An additional power saving mode may allow a device to be unavailable to the network for periods longer than a paging interval (in the range of seconds to a few hours). During this time, the device is completely inaccessible to the network and can switch off completely. Any data sent during this time will cause a large delay and the delay is believed to be acceptable.

Application circuit processors 702 and processors of the baseband circuit 704 can be used to execute elements of one or more instances of a protocol stack. For example, the processors of the baseband circuit 704 used alone or in combination to perform a Layer 3, Layer 2 or Layer 1 functionality while the processors of the application circuit 704 can use the data received from these layers (for example packet data) and can also carry out a layer 4 functionality (for example Transmission Communication Protocol (TCP) and User Datagram Protocol (UDP) layers). As mentioned in the present text, the layer 3rd contain a radio resource control (RRC) layer, which will be described in more detail below. As mentioned in the present text, the layer 2nd a Medium Access Control (MAC) layer, a Radio Link Control (RLC) layer and a Packet Data Convergence Protocol (PDCP) layer, which will be described in more detail below. As mentioned in the present text, the layer 1 contain a physical (PHY) layer of a UE / RAN node, which is described in more detail below.

8th illustrates exemplary interfaces of baseband circuits according to some embodiments. As discussed above, the baseband circuit can 704 from 7 Processors 804A-804E and a memory used by these processors 804G include. Each of the processors 804A-804E can each have a memory interface for sending or receiving data to or from the memory 804G contain.

The baseband circuit 804 may further include one or more interfaces for communicative coupling with other circuits / devices, such as a memory interface 812 (For example, an interface for sending or receiving data to or from a memory outside the baseband circuit 704 ), an application circuit interface 814 (For example, an interface for sending or receiving data to or from the application circuit 702 from 7 ), an RF circuit interface 816 (For example, an interface for sending or receiving data to or from RF circuits 706 from 7 ), an interface for wireless hardware connectivity 818 (for example an interface for sending or receiving data to or from NFC (Near Field Communication) - Components, Bluetooth® components (for example, Bluetooth® Low Energy), Wi-Fi® components, and other communication components), and a power management interface 820 (For example, an interface for sending or receiving energy or control signals to and from the PMC 712 ).

9 FIG. 4 is a block diagram illustrating components, in accordance with some example implementations, capable of reading instructions from a machine readable or computer readable medium (e.g., a non-transitory machine readable storage medium) and executing one or more of the methodologies discussed herein. More specifically, shows 9 a schematic representation of hardware resources 900 including one or more processors (or processor cores) 910, one or more memory or mass storage devices 920 and one or more communication resources 930 each via a bus 940 can be communicatively coupled. For embodiments where node virtualization (e.g. NFV) is used, a hypervisor 902 be executed to provide an execution environment for one or more network slices / subslices to the hardware resources 900 to use.

The processors 910 (For example, a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), such as a baseband processor , an application specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), another processor or any suitable combination thereof) can be, for example, a processor 912 and a processor 914 contain.

The storage devices 920 may include main memory, disk storage, or any suitable combination thereof. The working or mass storage devices 920 For example, can include any type of volatile or non-volatile memory, such as dynamic random access memory (DRAM), static random access memory (SRAM), erasable programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), flash memory, solid state memory, etc.

The communication resources 930 may include interconnect or network interface components, or other suitable devices for communicating with one or more peripheral devices 904 or one or more databases 906 over a network 908 contain. The communication resources 930 can contain, for example, wired communication components (e.g. for coupling via a Universal Serial Bus (USB)), cellular communication components, NFC components, Bluetooth® components (e.g. Bluetooth® Low Energy), Wi-Fi® components and other communication components .

Instructions 950 may include software, a program, an application, an applet, an app, or other executable code to at least one of the processors 910 to cause one or more of the methodologies discussed in this text to be implemented. The instructions 950 can be fully or partially in at least one of the processors 910 (e.g., within the processor's cache), memory, or mass storage devices 920 or any suitable combination thereof. Furthermore, any section of the instructions can 950 to the hardware resources 900 from any combination of peripheral devices 904 and / or the databases 906 be transmitted. Accordingly, the memory of the processors 910 , the working or mass storage devices 920 , the peripheral devices 904 and the databases 906 Examples of computer readable and machine readable media.

Next, some examples regarding the embodiment of the techniques described above will be described.

In a first example, a baseband device for user equipment (user equipment, UE ) Include: a radio frequency (RF) interface to RF circuits; and one or more processors for: sending, over the RF interface and to an enhanced Node B (eNB), a message requesting verification that the eNB is an authentic eNB; Receiving, in response to the message, a first value from the eNB; Calculate a second value based on multiple tracking areas ( TA ) Identifiers previously identified with the UE were linked; and authenticating the eNB if the first value matches the second value.

In Example 2, the subject of Example 1, or one of the examples given herein, the second value being determined based on a hash of the multiple TA identifiers.

In example 3, the subject of example 1, or one of the examples given in the present text, whereby the TA identifiers are obtained, while the UE is in a radio resource control (RRC) idle state.

In a fourth example, an enhanced node B (eNB) of a wireless telecommunications network may include: a non-transitory computer readable storage device that stores processor-executable instructions; and one or more processors configured to execute the processor-executable instructions, the execution of the processor-executable instructions by the one or more processors causing the one or more processors to: receive from one on the wireless telecommunications network registered user equipment ( UE ), a first message requesting verification that the eNB is an authentic eNB; Transmit a second message to a mobility management entity (in response to receiving the first message) ( MME ) the wireless telecommunications network requesting information to authenticate the eNB; Received in response to the second message and from the MME , of information based on multiple Tracking Area (TA) identifiers that were previously associated with the UE were linked; and forwarding the information to the UE.

In Example 5, the subject of Example 4, or one of the examples given herein, the second value being determined based on a hash of the multiple TA identifiers.

In example 6, the subject of example 4, or one of the examples given in the present text, the TA identifiers corresponding to the UE which is in a radio resource control (RRC) idle state.

In example 7, the subject of examples 1 or 4, or one of the examples given in the present text, the message containing an interval parameter which corresponds to a number of TA identifiers which are to be used to calculate the second value.

In Example 8, the subject of Example 7, or one of the examples given herein, the multiple TA identifiers corresponding to a historical list of TA identifiers with which the UE was linked.

In Example 9, the subject of Example 4, or one of the examples cited in the present text, the interval parameter being represented by the UE is selected so that at least some of the TA identifiers with which the UE connected to which the eNB is not aware.

In a tenth example, a computer readable medium that contains program instructions to one or more processors associated with user equipment ( UE ) are linked to cause: to have a message sent to an enhanced Node B (eNB) requesting verification that the eNB is an authentic eNB; Receiving, in response to the message, a first value from the eNB; Computing a second value based on multiple tracking area (TA) identifiers previously associated with the UE; and authenticating the eNB if the first value matches the second value.

In Example 11, the subject of Example 10, or one of the examples given herein, the second value being determined based on a hash of the multiple TA identifiers.

In Example 12, the subject of Example 10, or one of the examples given herein, wherein the TA identifiers are obtained while the UE is in a Radio Resource Control (RRC) idle state.

In example 13, the subject of example 10, or one of the examples given in the present text, the message containing an interval parameter which corresponds to a number of TA identifiers which are to be used to calculate the second value.

In Example 14, the subject of Example 13, or one of the examples given herein, where the multiple TA identifiers correspond to a historical list of TA identifiers with which the UE was associated.

Example 15 becomes the subject of Example 13, or one of the examples cited in the present text, the interval parameter being selected by the UE such that at least some of the TA identifiers to which the UE has connected are not known to the eNB .

In a sixteenth example, a computer readable medium that contains program instructions to one or more processors that are equipped with user equipment ( UE ) are linked to cause: registration with a core network of a wireless telecommunications network; Receiving an indication of a hash function to be used for the authentication of enhanced node Bs (eNBs) of the wireless telecommunications network; Obtain Tracking Area (TA) information related to the UE linked that is in a geographic area; local storage of a first copy of the TA Information; Delivering a second copy of the TA information to the core network; Detecting a request to connect to an eNB; Transmitting, to the eNB, a request for authentication information related to the eNB; Receiving, in response to the request, a first set of authentication information; Determining a second set of authentication information based on the hash function and the first copy of the TA information; if the first set of authentication information matches the second set of authentication information, connect to the eNB, and if the first set of authentication information does not match the second set of authentication information, ignore the prompt.

In Example 17, the subject of Example 16, or one of the examples given in the present text, wherein the TA information contains a TA identifier (TAI) of the wireless telecommunications network.

In Example 18, the subject of Example 16, or one of the examples given herein, wherein the TA information is received while the UE is in a radio resource control (RRC) idle state.

In Example 19, the subject of Example 16, or one of the examples given herein, where the request to connect to the eNB is a transition through which UE , from an RRC idle state to an RRC connection state.

In example 20, the subject of example 16, or one of the examples given herein, wherein the request to connect to the eNB includes receiving a redirect message that identifies the eNB.

In Example 21, the subject of Example 16, or one of the examples given herein, wherein: the authentication information request defines multiple TA records on which to base the authentication information; and the second set of authentication information is based on multiple corresponding TA records that are stored locally by the UE.

In a twenty-second example, a method may include: registering, through user equipment UE ), in a core network of a wireless telecommunications network; Receive through that UE , a reference to a hash function that is to be used for the authentication of enhanced node Bs (eNBs) of the wireless telecommunications network; Get through that UE , of Tracking Area (TA) information associated with the UE linked that is in a geographic area; local storage through which UE , a first copy of the TA information; Submit by UE , a second copy of the TA information to the core network; Detect by UE , a request to connect to an eNB; Submit by UE and to the eNB, a request for authentication information related to the eNB; Receive through that UE and in response to the request, a first set of authentication information; Determine by UE , a second set of authentication information based on the hash function and the first copy of the TA information; if the first set of authentication information matches the second set of authentication information, manufacture by UE , connect to the eNB, and if the first set of authentication information does not match the second set of authentication information, Ignore by UE , the prompt.

In Example 23, the subject of Example 22, or one of the examples given herein, wherein the TA information includes a TA identifier (TAI) of the wireless telecommunications network.

In Example 24, the subject of Example 22, or one of the examples given herein, wherein the TA information is received while the UE is in a radio resource control (RRC) idle state.

In Example 25, the subject of Example 22, or one of the examples given herein, where the request to connect to the eNB is a transition through which UE , from an RRC idle state to an RRC connection state.

In example 26, the subject of example 22, or one of the examples given herein, wherein the request to connect to the eNB includes receiving a redirect message identifying the eNB.

In Example 27, the subject of Example 22, or one of the examples given herein, wherein: the authentication information request defines multiple TA records on which to base the authentication information; and the second set of authentication information is based on multiple corresponding TA records that are local to the UE get saved.

In a twenty-eighth example, user equipment ( UE ) Comprise: means for registering with a core network of a wireless telecommunications network; means for receiving an indication of a hash function to be used for authentication of enhanced node Bs (eNBs) of the wireless telecommunications network; a means of obtaining tracking area (TA) information related to the UE linked that is in a geographic area; means for locally storing a first copy of the TA information; means for communicating a second copy of the TA information to the core network; means for detecting a request to connect to an enhanced Node B (eNB); means for communicating, to the eNB, a request for authentication information related to the eNB; means for receiving, in response to the request, a first set of authentication information; means for determining a second set of authentication information based on the hash function and the first copy of the TA information; if the first set of authentication information matches the second set of authentication information, a means of connecting to the eNB, and if the first set of authentication information does not match the second set of authentication information, a means of ignoring the prompt.

In Example 29, the subject of Example 28, or one of the examples given herein, wherein the TA information contains a TA identifier (TAI) of the wireless telecommunications network.

In Example 30, the subject of Example 28, or one of the examples given herein, wherein the TA information is received while the UE is in a radio resource control (RRC) idle state.

In Example 31, the subject of Example 28, or one of the examples given herein, where the request to connect to the eNB is a transition through which UE , from an RRC idle state to an RRC connection state.

In example 32, the subject of example 28, or one of the examples given herein, wherein the request to connect to the eNB includes receiving a redirect message that identifies the eNB.

In Example 33, the subject of Example 28, or one of the examples given herein, wherein: the authentication information request defines multiple TA records on which to base the authentication information; and the second set of authentication information is based on multiple corresponding TA records that are local to the UE get saved.

In the above specification, various embodiments have been described with reference to the accompanying drawings. However, it is apparent that various modifications and changes may be made therein and that additional embodiments may be implemented without departing from the broad scope as set forth in the following claims. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense.

For example, although series of signals and / or operations related to the 2nd , 5 and 6 the order of the signals or operations may be modified in other implementations. Furthermore, non-dependent signals can be executed in parallel.

It can be seen that exemplary aspects, as described above, can be implemented in many different forms of software, firmware and hardware in the implementations shown in the figures. The actual software code or special control hardware used to implement these aspects should not be construed as a limitation. The functionality and behavior of the aspects have thus been described without reference to the specific software code, it being understood that software and control hardware could be designed so that the aspects can be implemented based on the description given herein.

Although certain combinations of features are set out in the claims and / or disclosed in the specification, these combinations are not intended to be limiting. In fact, many of these features can be combined in a manner that is not explicitly mentioned in the claims and / or disclosed in the specification.

No element, action or instruction used in this application may be construed as authoritative or material unless expressly described as such. A case of using the term “and” in the sense of the present text does not necessarily preclude the interpretation that the expression “and / or” was intended in this case. Similarly, a case of using the term "or" within the meaning of the present text does not necessarily preclude the interpretation that the term "and / or" was intended in this case. Furthermore, the article "one / one" in the sense of the present text should comprise one or more elements and can be used interchangeably with the expression "one or more". If only a single element is intended, the terms “a”, “individually”, “only” or similar formulations are used.

Claims (26)

IS STRESSED Baseband device for user equipment (UE), comprising: a radio frequency (RF) interface to RF circuits; and one or more processors for: Sending, via the HF interface and to an enhanced Node B (eNB), a message that requires verification that the eNB is an authentic eNB; Receiving, in response to the message, a first value from the eNB; Computing a second value based on multiple tracking area (TA) identifiers previously associated with the UE; Authenticating the eNB if the first value matches the second value; if the eNB is authentic, connect to the eNB; and if the eNB is not authentic, end communication with the eNB. Baseband device after Claim 1 , the second value being determined based on a hash of the plurality of TA identifiers. Baseband device after Claim 1 wherein the TA identifiers are obtained while the UE is in a radio resource control (RRC) idle state. enhanced node B (eNB) of a wireless telecommunications network, which includes: a non-transitory computer readable storage device that stores processor executable instructions; and one or more processors configured to execute the processor-executable instructions, the execution of the processor-executable instructions by the one or more processors causing the one or more processors to do the following: Receiving, from user equipment (UE) registered with the wireless telecommunications network, a first message requesting verification that the eNB is an authentic eNB; In response to receiving the first message, transmitting a second message to a mobility management entity (MME) of the wireless telecommunications network that requests information to authenticate the eNB; Receiving, in response to the second message and from the MME, the information based on multiple Tracking Area (TA) identifiers previously associated with the UE; and Forward the information to the UE. eNB after Claim 4 , the second value being determined based on a hash of the plurality of TA identifiers. eNB after Claim 4 , wherein the TA identifiers correspond to the UE which is in a radio resource control (RRC) idle state. Device according to one of the Claims 1 or 4th , the message containing an interval parameter which corresponds to a number of TA identifiers which are to be used to calculate the second value. Device after Claim 7 , wherein the multiple TA identifiers correspond to a historical list of TA identifiers with which the UE was linked. Device after Claim 7 , the interval parameter being selected by the UE such that at least some of the TA identifiers to which the UE has connected are not known to the eNB. Computer readable medium containing program instructions to cause one or more processors associated with user equipment (UE) to: Causing a message to be sent to an enhanced node B (eNB) requesting verification that the eNB is an authentic eNB; Receiving, in response to the message, a first value from the eNB; Computing a second value based on multiple tracking area (TA) identifiers previously associated with the UE; Authenticating the eNB if the first value matches the second value; if the eNB is authentic, connect to the eNB; and if the eNB is not authentic, end communication with the eNB. Computer-readable medium Claim 10 , the second value based on a hash of the multiple TA identifiers is determined. Computer-readable medium Claim 10 wherein the TA identifiers are obtained while the UE is in a radio resource control (RRC) idle state. Computer-readable medium Claim 10 , the message containing an interval parameter which corresponds to a number of TA identifiers which are to be used to calculate the second value. Computer-readable medium Claim 13 , wherein the multiple TA identifiers correspond to a historical list of TA identifiers with which the UE was linked. Computer-readable medium Claim 13 , the interval parameter being selected by the UE such that at least some of the TA identifiers to which the UE has connected are not known to the eNB. Computer readable medium containing program instructions to cause one or more processors associated with user equipment (UE) to: Registering with a core network of a wireless telecommunications network; Receiving an indication of a hash function to be used for the authentication of enhanced node Bs (eNBs) of the wireless telecommunications network; Obtaining tracking area (TA) information associated with the UE located in a geographic area; storing a first copy of the TA information locally; Delivering a second copy of the TA information to the core network; Detecting a request to connect to an eNB; Transmitting, to the eNB, a request for authentication information related to the eNB; Receiving, in response to the request, a first set of authentication information; Determining a second set of authentication information based on the hash function and the first copy of the TA information; if the first set of authentication information matches the second set of authentication information, connect to the eNB, and if the first set of authentication information does not match the second set of authentication information, ignore the prompt. Computer-readable medium Claim 16 , wherein the TA information contains a TA identifier (TAI) of the wireless telecommunications network. Computer-readable medium Claim 16 wherein the TA information is obtained while the UE is in a radio resource control (RRC) idle state. Computer-readable medium Claim 16 wherein the request to connect to the eNB includes a transition, by the UE, from an RRC idle state to an RRC connection state. Computer-readable medium Claim 16 , wherein the request to connect to the eNB includes receiving a redirect message that identifies the eNB. Computer-readable medium Claim 16 wherein: the request for authentication information defines multiple TA records on which to base the authentication information; and the second set of authentication information is based on multiple corresponding TA records that are stored locally by the UE. User equipment (UE), comprising: means for registering with a core network of a wireless telecommunications network; means for receiving an indication of a hash function to be used for authentication of enhanced node Bs (eNBs) of the wireless telecommunications network; means for obtaining tracking area (TA) information associated with the UE located in a geographic area; means for locally storing a first copy of the TA information; means for communicating a second copy of the TA information to the core network; means for detecting a request to connect to an enhanced Node B (eNB); means for communicating, to the eNB, a request for authentication information related to the eNB; means for receiving, in response to the request, a first set of authentication information; means for determining a second set of authentication information based on the hash function and the first copy of the TA information; if the first set of authentication information matches the second set of Authentication information matches, a means of connecting to the eNB, and if the first set of authentication information does not match the second set of authentication information, a means of ignoring the prompt. UE after Claim 22 , wherein the TA information contains a TA identifier (TAI) of the wireless telecommunications network. UE after Claim 22 wherein the TA information is obtained while the UE is in a radio resource control (RRC) idle state. UE after Claim 22 wherein the request to connect to the eNB includes a transition, by the UE, from an RRC idle state to an RRC connection state.

Images