KR101578004B1 - Method of selective encrypting control signal using Flow Identifier - Google Patents

Abstract

The present invention discloses various methods for encrypting signals used in a wireless access system. The method of selectively encrypting a control signal according to an embodiment of the present invention includes transmitting a first message including a first security negotiation parameter supported by a mobile station to a base station and a second security negotiation parameter supported by the base station Receiving a second message from the base station and receiving a selectively encrypted control signal according to one of the first security negotiation parameter and the second security negotiation parameter from the base station. At this time, the flow identifier type field of the control signal may indicate whether the control signal is selectively encrypted.

Flow ID type, optional encryption, integrity, confidentiality, CMAC / HMAC

Description

[0001] The present invention relates to a method of selectively encrypting control signals using a flow identifier,

The present invention relates to various methods for encrypting signals used in a wireless access system.

Hereinafter, a security sublayer used in a broadband wireless access system will be briefly described.

Security services provide confidentiality (security) and integrity of network data. Integrity means that certain information in data and network security can only be accessed or changed by authorized personnel. That is, integrity ensures that the message is not arbitrarily changed by a third party or the like. Confidentiality refers to the disclosure of certain information only to authorized persons. In other words, confidentiality is to protect the content of the transmitted data completely and prevent unauthorized access to the contents of the information.

The security sublayer provides security, authentication and confidentiality in broadband wireless networks. The security sublayer may apply an encryption function to a Medium Access Control Protocol Data Unit (MAC PDU) transmitted between the mobile station and the base station. Accordingly, the base station and the mobile station can provide a strong defense capability against a service theft attack of an illegal user.

The base station performs encryption for the service flow throughout the network to prevent access to the data transmission service without any authorization. The security sublayer controls the distribution of information related to the key to the mobile station by the base station using the key management protocol of the authenticated client / server structure. At this time, the function of the basic security mechanism can be further enhanced by adding digital certificate-based mobile station device authentication to the key management protocol.

During the basic function negotiation between the base station and the mobile station, authentication and key exchange procedures are omitted if the mobile station does not provide the security function. In addition, even when a specific mobile station is registered as a mobile station that does not support the authentication function, the base station can regard the mobile station's authority as being verified. If the security function is not supported by a specific mobile station, no key exchange or data encryption function is performed because the mobile station is not provided with a service.

The security sublayer consists of an encapsulation protocol and a privacy key management (PKM) protocol. The encapsulation protocol is a protocol for securing packet data in a broadband wireless network, and provides a set representing a cryptographic suite such as data encryption and data authentication algorithms and a method for applying such an algorithm to a MAC PDU payload. The PKM protocol is a protocol that provides a method for securely distributing key-related data from a base station to a mobile station. The base station and the mobile station can provide a method for securely distributing key-related data using the PKM protocol. Using the key management protocol, key related data can be shared between the mobile station and the base station, and the base station can control the network access.

The present invention relates to a method for selectively protecting control signaling exchanged between a mobile station and a base station in a wireless access system. In a typical wireless access system, integrity of control signaling is supported, but confidentiality is not guaranteed.

However, forcing all the control signals between the mobile station and the base station to provide confidentiality at the same time may cause a load in terms of system performance or network efficiency. In addition, a general wireless access system includes a plurality of encryption algorithms that do not consider support for integrity, and an AES-CCM (Advanced Encryption Standard-Counter mode encryption mode with Cipher block chaninng message authentication code) Use is basically considered. Therefore, there is also a need for consideration of algorithms used for selective confidentiality protection of control signals.

Accordingly, embodiments of the present invention disclose various methods for supporting selective confidentiality for control signals.

It is an object of the present invention to provide a method for selectively protecting a control signal exchanged between a mobile station and a base station.

It is another object of the present invention to provide a method for selectively protecting a control signal using a flow ID and / or a flow ID type defined in a header.

Yet another object of the present invention is to define a new Management Flow ID for transmitting control signals to be additionally encrypted in addition to a general Management Flow ID.

It is another object of the present invention to provide a method for selectively protecting a management message using a flow identifier control field defined in a header included in a management message as one of control signals.

In order to solve the above-mentioned technical problems, the present invention discloses various methods of encrypting signals used in a wireless access system.

A method of selectively encrypting a control signal includes transmitting a first message including a first security negotiation parameter supported by a mobile station to a base station and a second security negotiation parameter supported by the base station Receiving a second message and receiving a selectively encrypted control signal according to one of the first security negotiation parameter and the second security negotiation parameter from the base station. At this time, the flow identifier type field of the control signal may indicate whether the control signal is selectively encrypted.

In one embodiment of the present invention, the flow identifier type field may indicate that the flow identifier of the control signal is a confidential management flow identifier. At this time, the selectively encrypted control signal is preferably a predetermined management message to which a CMAC (cipher MAC) tuple should be added. In addition, the first security negotiation parameter may include a first message confidentiality mode field supported by the mobile station, and the second security negotiation parameter may include a second message confidentiality mode field supported by the mobile station and the base station.

One aspect of the present invention may further include a step in which the mobile station and the base station perform the authentication procedure. At this time, the selectively encrypted control signal is preferably transmitted after the application procedure is performed. At this time, the selectively encrypted control signal is a control signal whose integrity is protected using at least one of ICV (Integrity Check Value), CMAC (Cipher MAC) and HMAC (Hashed MAC).

According to another aspect of the present invention, a method for selectively encrypting a control signal in a serving base station includes receiving from a mobile station a first message including a first security negotiation parameter supported by the mobile station, Selectively encrypting the control signal according to one of the first security negotiation parameter and the second security negotiation parameter, and transmitting the selectively encrypted control signal to the mobile station have. At this time, the flow identifier type field of the selectively encrypted control signal may indicate whether or not the control signal is selectively encrypted.

In another embodiment of the present invention, the flow identifier of the control signal is a confidential management flow identifier. At this time, the selectively encrypted control signal may be a predetermined management message to which a CMAC (cipher MAC) tuple should be added.

In another aspect of the present invention, the first security negotiation parameter includes a first message confidentiality mode field supported by the mobile station, and the second security negotiation parameter includes a second message confidentiality mode field supported by the mobile station and the serving base station .

Another aspect of the present invention further includes performing an authorization procedure with the serving base station, wherein the selectively encrypted control signal is transmitted after the authorization procedure is performed. At this time, the selectively encrypted control signal is preferably a control signal whose integrity is protected using at least one of ICV, CMAC, and HMAC.

Another aspect of the present invention further includes transmitting a handover request message including a first security negotiation parameter to a target base station and receiving a handover response message including a second security negotiation parameter from the target base station . In this case, the second security negotiation parameter may include a message confidentiality mode that can be supported by the target BS.

At this time, the handover request message and the handover response message may be transmitted / received through a backbone network or a network control and management system (NCMS) between the serving base station and the target base station.

In another aspect of the present invention, the selectively encrypted control signal may be encrypted using an AES-CCM algorithm or an AES-Advanced Encryption Standard Encryption Standard (AES-CTR) algorithm. When using the AES-CTR algorithm, the base station can add integrity of the message by adding a message authentication code (MAC) to the control signal or control message.

According to the embodiments of the present invention, the following effects are obtained.

First, the base station and the mobile station can selectively use the encrypted control signal to protect the confidentiality of the control signal.

Second, the base station encrypts only the selected control signal, not all of the control signals, thereby reducing an excessive load added to the entire network, as compared to encrypting all control signals.

Third, it is possible to prevent security vulnerability that the control signals are transparently transmitted according to the selective control signal encryption, thereby deteriorating the security. In addition, selectively encrypted control signals can be transmitted securely.

Fourth, the base station and the mobile station selectively encrypt the control signal, thereby blocking the security threat that the control signal is exposed to the malicious third party.

Fifth, the base station and the mobile station can consider the efficiency of the network and the system in guaranteeing the selective confidentiality of the control signals by transmitting the control signals to which the selective encryption is applied.

The present invention relates to a wireless access system. In particular, embodiments of the present invention disclose various methods for encrypting signals used in a wireless access system.

The following embodiments are a combination of elements and features of the present invention in a predetermined form. Each component or characteristic may be considered optional unless otherwise expressly stated. Each component or feature may be implemented in a form that is not combined with other components or features. In addition, some of the elements and / or features may be combined to form an embodiment of the present invention. The order of the operations described in the embodiments of the present invention may be changed. Some configurations or features of certain embodiments may be included in other embodiments, or may be replaced with corresponding configurations or features of other embodiments.

In the description of the drawings, there is no description of procedures or steps that may obscure the gist of the present invention, nor is any description of steps or steps that can be understood by those skilled in the art.

The embodiments of the present invention have been described herein with reference to a data transmission / reception relationship between a base station and a mobile station. Here, the base station is meaningful as a terminal node of a network that directly communicates with a mobile station. The specific operation described herein as performed by the base station may be performed by an upper node of the base station, as the case may be.

That is, various operations performed for communication with a mobile station in a network consisting of a plurality of network nodes including a base station may be performed by a base station or other network nodes other than the base station. At this time, the 'base station' may be replaced by terms such as a fixed station, a Node B, an eNode B (eNB), an access point, and the like. The term 'mobile station' may be replaced by terms such as a UE (User Equipment), a Subscriber Station (SS), a Mobile Subscriber Station (MSS), a Mobile Terminal or a Terminal .

Also, the transmitting end refers to a node that transmits data or voice service, and the receiving end refers to a node that receives data or voice service. Therefore, in the uplink, the mobile station may be the transmitting end and the base station may be the receiving end. Similarly, in a downlink, a mobile station may be a receiving end and a base station may be a transmitting end.

The mobile station of the present invention may be a PDA (Personal Digital Assistant), a cellular phone, a PCS (Personal Communication Service) phone, a GSM (Global System for Mobile) phone, a WCDMA (Wideband CDMA) Can be used.

Embodiments of the present invention may be implemented by various means. For example, embodiments of the present invention may be implemented by hardware, firmware, software, or a combination thereof.

For a hardware implementation, the method according to embodiments of the present invention may be implemented in one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs) , Field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, and the like.

In the case of an implementation by firmware or software, the method according to embodiments of the present invention may be implemented in the form of a module, a procedure or a function for performing the functions or operations described above. The software code can be stored in a memory unit and driven by the processor. The memory unit may be located inside or outside the processor, and may exchange data with the processor by various well-known means.

Embodiments of the present invention may be supported by standard documents disclosed in at least one of the IEEE 802 systems, 3GPP systems, 3GPP LTE systems and 3GPP2 systems, which are wireless access systems. That is, the steps or portions of the embodiments of the present invention that are not described in order to clearly illustrate the technical idea of the present invention can be supported by the documents. In addition, all terms disclosed in this document may be described by the standard document. In particular, embodiments of the present invention may be supported by one or more of the documents P802.16-2004, P802.16e-2005 and P802.16Rev2, which are standard documents of the IEEE 802.16 system.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The following detailed description, together with the accompanying drawings, is intended to illustrate exemplary embodiments of the invention and is not intended to represent the only embodiments in which the invention may be practiced.

In addition, the specific terms used in the embodiments of the present invention are provided to facilitate understanding of the present invention, and the use of such specific terms can be changed to other forms without departing from the technical idea of the present invention .

For example, the control signals used in embodiments of the present invention include control signaling, a control message, a management message, a MAC control message, or a MAC management message MAC Management Message).

In the IEEE 802.16e system, a mobile station and a base station can generate a cipher based message authentication code (CMAC) key and a hashed message authentication code (HMAC) key for protecting a control signal through an authorization key shared with each other. Also, the mobile station and the base station can generate a message authentication code (MAC) using the CMAC key and the HMAC key. In addition, the mobile station and the base station exchange the message authentication code (MAC) in addition to the control signal, thereby ensuring the integrity of the corresponding control signal. On the other hand, when the base station and the mobile station use the AES-CCM, the mobile station and the base station exchange the integrity check value (ICV) in addition to the control signal, thereby ensuring the integrity of the control signal.

Even though the mobile station and the base station use the CMAC key and the HMAC key to protect the integrity of the message, the message authentication code provides a determination as to whether the message is forged or not, but does not provide the confidentiality of the message. Therefore, the CMAC / HMAC key does not provide a concealment function for the corresponding message.

In addition, the IEEE 802.16e system provides a concealment function for a general message, but does not provide a concealment function for control signals. That is, since only the CMAC / HMAC is added to the control signals, it can be a security threat and the system protection against malicious attackers may be weak.

However, providing uniformly confidentiality to all control signals can increase the load on the network and degrade the overall efficiency of the system. A flow ID for transmission of currently defined control signals is a primary flow identifier (PF_ID) and a secondary flow identifier (SF_ID). However, encryption is not applied to control signals transmitted through PF_ID and SF_ID, and only ICV (Integrity Check Value) such as CMAC or HMAC is added to protect message integrity. That is, PF_ID and SF_IDs can not be used to indicate whether control signals are selectively encrypted within the management flow identifier.

Thus, embodiments of the present invention define additional flow identifiers that indicate whether the control signals are selectively encrypted. For example, in embodiments of the present invention, a new flow identifier for indicating encryption of an optional optional control signal in addition to commonly used PF_ID and SF_ID is defined as a Confidential Management Flow ID (CMF_ID) .

However, the term confidential management flow identifier is only for explaining an embodiment of the present invention, and may be changed to another term referring to an identifier performing the same function.

In the case of a Transport Flow ID (TF_ID), a Security Association (SA) is mapped to TF_ID, and all SAs are applied to the data identified by the corresponding TF_ID. However, in the case of a management flow identifier (MF_ID), encryption is not applied to all control signals to which the MF_ID corresponds, and encryption can be selectively applied according to the type of the MF_ID.

That is, according to the flow identifier type of the management messages according to the classification of the control signals disclosed in the embodiments of the present invention, selective encryption can be applied to the control signals. For example, the base station may selectively encrypt the management control signal using the CMF_ID, and may encrypt the general control signal that does not require encryption using PF_ID or SF_ID. At this time, the flow identifier type field of the selectively encrypted control signal indicates the CMF_ID. In addition, the mobile station can confirm whether the corresponding control signal is encrypted by checking the flow identifier type contained in the control signal selectively encrypted by the base station.

Embodiments of the present invention can be used to selectively encrypt a control signal between a base station and a mobile station after an application procedure between a base station and a mobile station is completed. That is, the selective encryption of the control signal is effective after the application procedure ends. At this time, the base station and the mobile station can encrypt the control signal using an encryption key negotiated with each other (for example, TEK) to protect the control signal.

In addition, the base station and the mobile station can further ensure message integrity by adding a message authentication code to the control signal. However, when the AES-CCM is applied to the embodiments of the present invention, the AES-CCM does not need to include a separate message authentication code because its own message integrity protection is provided.

Of the encryption algorithms adopted by the IEEE 802.16e standard, wireless access technology, AES-CCM basically has its own message authentication function. However, AES-CCM is not a common denominator for the overall encryption algorithm. In the currently developed IEEE 802.16m system, it is desirable that the mobile station and the base station support a function for ensuring confidentiality so that the mobile station and the base station can securely exchange control signals after the application procedure.

That is, there is a need for a solution that can prevent the control signal transmitted / received between the mobile station and the base station from being exposed, without causing much load on the network. Accordingly, embodiments of the present invention allow a mobile station and a base station to encrypt and then exchange a control signal using an encryption key (e.g., a traffic encryption key (TEK) Various methods for preventing such damage are disclosed.

Embodiments of the present invention are preferably aimed at applications in the IEEE 802.16m system. For example, when an IEEE 802.16e mobile station accesses an IEEE 802.16e base station, only a message authentication code may be added to the control signaling after the application procedure, and the mobile station and the base station may be exchanged. However, the technical idea of the present invention can also be applied to the IEEE 802.16e system.

On the other hand, when the IEEE 802.16m terminal accesses the IEEE 802.16m base station, as described in the present invention, the base station can selectively prevent the control signaling from being exposed by encrypting and exchanging control signaling with the mobile station. The exchange of control signaling via encryption may optionally be applied to the control signals after the authorization procedure. Therefore, by using the selective encryption method, it is possible to ensure the confidentiality of the control signaling considering the efficiency of the network and the system efficiency. In addition, the MAC management message can be securely transmitted through the selective encryption method.

In the embodiments of the present invention, there is no need to newly define a type field and an attribute field for a keying parameter in addition to the PKM Attribute Type parameter defined in the IEEE 802.16e standard. Also, the encryption algorithm used to protect the control signal basically uses the data encryption algorithms defined in the IEEE 802.16e standard.

That is, the CBC-IV attribute field is required when the control signal encryption algorithm identifier of 'SA Ciphersuite' is 0x01 (for example, DES in CBC mode). The CBC-IV is not necessary when the control signal encryption algorithm identifier of the SA encryption is 0x02 (for example, AES), but is required when it is 0x03 (for example, AES of the CBC mode).

The following Table 1 shows a Cryptographic Suite that can be used in embodiments of the present invention.

Type Length Value 20 3 A 24-bits integer identifying the cryptographic suite properties. The most significant byte, as defined in table 590, indicates the encryption algorithm and key length. The middle byte, as defined in Table 591, indicates the data authentication Algorithm. The least significant byte, as defined in Table 592, indicates the TEK Encryption Algorithm.

Referring to Table 1, the TEK encryption suite has a size of 24 bits, and the most significant byte indicates the encryption algorithm and key length. The middle byte of the TEK notation suit represents the data authentication algorithm, and the least significant byte represents the TEK authentication algorithm.

Table 2 below shows the allowed cryptographic suites that can be used in the present invention.

Value Description 0x000000
0x010001
0x000002
0x010002
0x020003
0x020103
0x020104
0x030003

0x800003

0x800004

All remaining values No data encryption, no data encryption, no key encryption
CBC Mode 56 bits DES, no data authentication and 3-DES, 128
No data encryption, no data authentication and RSA, 1024
CBC mode 56 bits DES, no data authentication and RSA, 1024
CCM mode AES, no data authentication and AES, 128
CCM mode 128 bit AES, CCM mode, 128 bit, ECB Mode AES with 128 bit key
CCM mode 128 bit AES, CCM mode, AES key Wrap with 128 bit key
CBC mode 128 bits AES, no data authentication, AES ECB mode with 128 bit key
MBS CTR mode 128 bits AES, no data authentication, AES ECB mode with 128 bit key
MBS CTR mode 128 bits AES, no data authentication, AES key Wrap with 128 bit key
reserved

Table 1 shows 'Cryptographic Suites' of IEEE 802.16 including TEK related contents, and Table 2 shows allowed 'Cryptographic Suites'.

Hereinafter, the control signal encryption algorithm identifier for encrypting the control signal, the control signal authentication algorithm identifier used for authenticating the control signal, and the TEK encryption algorithm identifier will be described in the embodiments of the present invention.

Table 3 below shows an example of a control signal encryption algorithm identifier (ID) format that can be used in embodiments of the present invention.

Value Description 0
One
2
3
4-127
128
129-255 No control signaling protection
CBC mode, 56-bit DES
CCM mode, 128 bit AES
CBC mode, 128 bit AES
reserved
CTR mode, 128 bit AES for MBS with 8 bit ROC
Reserved

If the encryption algorithm identifier of the control signal is '0', it indicates that no control signal is protected. If it is '1', it indicates that the CBC (Cipher Block Chaining) mode is 56 bits. Indicates a CBC mode (CCM mode), and if it is '3', indicates a CBC mode of 128 bits. If the encryption algorithm identifier is '4' to '127', it is a reserved value. If it is '128', it indicates a Counter Mode Encryption (CTR) mode. In addition, the remaining 129-255 represents the reserved value.

Table 4 below shows an example of a Control Signaling Authentication Algorithm Identifier (ID) format that can be used in embodiments of the present invention.

Value Description 0
One
2-255 No control signaling authentication
CBC mode, 128 bit AES
Reserved

Referring to Table 4, if the control signal authentication algorithm identifier indicates '0', it means that authentication for a predetermined control signal is not supported. If it is '1', it indicates a 128-bit CBC mode for a predetermined control signal. It can be used as a reserved value.

Table 5 below shows an example of a TEK Encryption Algorithm Identifier (TEK) format that can be used in embodiments of the present invention.

Value Description 0
One
2
3
4
5-255 Reserved
3-DES EDE with 128 bit key
RSA with 1024-bit key
ECB mode AES with 128 bits
AES key wrap with 128 bit key
reserved

Referring to Table 5, '0' and '5-255' among the TEK authentication algorithm identifier values represent reserved values, '1' denotes a 3-DES EDE (3-Data Encryption Standard Encrypt-Decrypt-Encrypt) '2' denotes an RSA of 1024 bits, '3' denotes an AES mode ECB (Electronic Code Book) of 128 bits, and '4' denotes an AES key wrap of 128 bits.

< Flow  How to selectively negotiate support for control signal encryption using identifiers>

Hereinafter, negotiation methods for selectively encrypting a control signal in a mobile station and a base station will be described.

1 is a diagram showing one of the selective control signal encryption methods as an embodiment of the present invention.

A mobile station (MS) may transmit a subscribe station basic capability request (SBC-REQ) message in order to negotiate a basic capability to a base station (BS) in an initial procedure (S110).

In step S110, a security negotiation parameter may be included in the SBC-REQ message. In this case, the security negotiation parameter may include a message confidentiality mode field for specifying a confidentiality protection mode for a control signal that can be supported by the mobile station.

Hereinafter, security negotiation parameters that can be used in embodiments of the present invention will be described. Table 6 below shows an example of a security negotiation parameter.

Type Length Value Scope 25 variable The compound field contains the sub-attributes as defined in the table below SBC-REQ,
SBC-RSP

The security negotiation parameter may include a sub-attribute field as a compound field. Table 7 below shows the sub-attributes of the security negotiation parameters.

Attribute Contents PKM Version Support Version of privacy Sub-layer supported Authorization Policy Support Authorization Policy to Support Message Authentication Code Mode Message Authentication Code to support Message Confidentiality Mode Message Confidentiality to support PN Window Size Size of capability of the receiver PN window per SAID PKM Flow Control Maximum number of concurrent PKM transactions Maximum Number of Supported Security Association Maximum number of supported SA

Referring to Table 7, the security negotiation parameters include a PKM version support parameter, an authorization policy support parameter, a message authentication code mode parameter, a message confidentiality mode parameter A PN window size parameter, a PKM flow control parameter, and a maximum number of supported security association parameters. At this time, the message confidential mode parameter indicates the confidentiality of the control message that can be supported in the current wireless access system.

Table 8 below shows an example of the PKM version supporting parameter format.

Type Length Value 25.1 One Bit 0: PKM version 1
Bit 1: PKM version 2
Bit 2: PKM version 3
Bits 3-7: Reserved, shall be set to zero

Referring to Table 8, it is assumed that the embodiments of the present invention support PKM version 3 (PKM version 3). However, you can use PKM version 2 or PKM version 1 in addition to PKM version 3.

Table 9 below shows an example of a message confidentiality mode field format used in step S110.

Type Length Value 25.7 One Bit 0: No Message Confidentiality
Bit 1: Selective Message Confidentiality
Bits 2-7: Reserved. Shall be set to zero

Referring to Table 9, if the message confidential mode parameter is set to '0', it indicates that the message confidential mode is not supported, and if it is set to '1', it indicates that the message confidential mode is selectively supported. The mobile station may support one or more confidentiality protection modes, and may transmit an SBC-REQ message to the base station as in step S110 to inform the mobile station of a message confidentiality mode that can be supported by the mobile station.

Referring back to FIG. 1, a base station that has received an SBC-REQ message can negotiate security negotiation capability with a mobile station by transmitting an SBC-RSP message including security negotiation parameters that the base station can support. That is, in step S120, the base station can negotiate the message confidential mode with the mobile station by transmitting a security negotiation parameter including the message confidential mode field to the mobile station (S120).

In FIG. 1, the mobile station and the base station can perform the authorization procedure after completing the basic capability negotiation through steps S110 to S120 (S130).

The base station can selectively encrypt the control message based on the message confidential mode negotiated with the mobile station. In addition, the base station may selectively transmit the encrypted control message to the mobile station (S140).

The MAC header of the selectively encrypted control signal in step 140 may include a flow identifier. At this time, the confidential management flow identifier (CMF_ID) is used as the flow identifier, and the mobile station can recognize that the corresponding control signal is encrypted by checking the flow identifier type indicating the CMF_ID.

FIG. 2 is a diagram showing another of the selective control signal encryption methods as an embodiment of the present invention.

2 shows an access state of a mobile station during negotiation for selectively protecting a control signal. Referring to FIG. 2, a mobile station may enter an access state in an initialization state or an idle state. At this time, the mobile station performs a ranging procedure with the base station and acquires uplink synchronization (210).

The mobile station performs a basic capability negotiation process (SBC-REQ / RSP) with the base station (220), and performs authentication and key exchange with the base station (230). When the authentication procedure with the base station ends, the mobile station can register with the serving base station (240). In addition, the mobile station can receive an Internet Protocol (IP) address from the base station (250). In FIG. 2, the selective negotiation of the control signal between the base station and the mobile station may be performed in step 210 or 220.

FIG. 3 is a diagram showing another one of the selective control signal encryption methods as an embodiment of the present invention.

The negotiation for the encryption method of the selective control signal can also be performed in the mobile station in the idle mode. When the mobile station in the idle mode moves to another base station and satisfies the predetermined location update condition, the mobile station can perform location update with the base station. At this time, the mobile station can perform selective confidentiality protection negotiation with respect to the control signal with the base station.

Referring to FIG. 3, a mobile station in an idle state can transmit a ranging request message including security negotiation parameters supported by a mobile station to a base station (S310).

Upon receiving the ranging request message including the security negotiation parameter, the base station can transmit a ranging response message including security negotiation parameters that can be supported by the base station to the mobile station in step S320.

The security negotiation parameters used in steps S310 and S320 may be referred to the description of Tables 6 to 9. Accordingly, the security negotiation parameter in step S310 may include a message confidentiality mode field indicating a confidentiality protection mode of a control signal that can be supported by the mobile station. The security negotiation parameter in step S320 may include confidentiality of a control signal A message confidentiality mode field indicating a protected mode may be included.

After performing the optional confidentiality protection negotiation with respect to the control signal in step S310 and step S320, the base station may transmit the selectively encrypted control message to the mobile station in step S330.

The mobile station decodes the header of the control signal received in step S330 to determine whether the corresponding control signal is encrypted. That is, the mobile station can confirm whether the corresponding control message is encrypted by checking the flow identifier type of the control signal header. For example, when the flow identifier type indicates the confidential management flow identifier, the mobile station can know that the corresponding control signal is encrypted.

FIG. 4 is a diagram illustrating a method of negotiating a control signal encryption option when the idle mode mobile station performs location update, according to an embodiment of the present invention.

Referring to FIG. 4, if the mobile station satisfies a predetermined condition in a connection state with a base station, the mobile station can enter an idle mode state. The idle state can be largely divided into a paging available mode and a paging unavailable mode. At this time, the paging enable mode indicates a paging listening interval for the mobile station to receive the paging message from the base station, and the paging disable mode indicates that the mobile station is in the idle mode or the sleep mode .

The mobile station in the idle mode can negotiate whether to selectively support the control signal protection by exchanging the ranging request message and the ranging response message at the time of location update with the base station (see FIG. 3). Also, as shown in FIG. 4, the idle mode mobile station can negotiate whether to selectively protect the base station and the control signal through a paging message (for example, MOB_PAG-ADV) transmitted periodically or at predetermined intervals in the pageable mode .

In the case of FIG. 4, however, the mobile station unilaterally receives information on whether or not the control signal that can be encrypted is protected from the base station.

In the embodiments of the present invention, if encryption is performed to uniformly provide confidentiality to all the control signals, the load of the entire network may be greatly increased, or the overall efficiency of the system may be degraded. Therefore, in the embodiments of the present invention, encryption can be applied only to predetermined control signals.

Among the Medium Access Control (MAC) header fields, information necessary for selective protection of a control signal is a flow identifier type field. The flow identifier type field may indicate whether the corresponding control signal is encrypted. That is, the flow identifier type field may indicate that the corresponding control signal is encrypted using the confidential management flow identifier.

For example, the mobile station can determine whether the corresponding control signal is encrypted by checking the flow identifier field included in the header of the control signal. In addition, the base station can indicate whether the corresponding control signal is encrypted using the flow identifier type field.

FIG. 5 is a diagram showing another alternative control signal encryption method as an embodiment of the present invention.

The message confidential mode negotiation method disclosed in the embodiments of the present invention can be performed even when the mobile station handover to the target base station. FIG. 5A shows a case where a mobile station starts a handover (MS initiate), and FIG. 5B shows a case where a base station starts a handover (BS initiate).

Referring to FIG. 5A, a mobile station (MS) can transmit a handover request message (MSHO-REQ) including a security negotiation parameter to a serving base station (SBS). At this time, the security negotiation parameter included in the handover request message may include a message confidentiality mode that can be supported by the mobile station (S501).

Upon receiving the MSHO-REQ message, the SBS generates a MAC request message or a handover request primitive (HO-REQ) including security-related information in a target base station (TBS) NCMS: Network Control and Management System). At this time, the NCMS may be included in each base station and the mobile station as an upper entity of each base station and / or mobile station, or may operate externally (S503).

In step S503, the security-related information may include information on security negotiation parameters (see Tables 6 to 9) that can be supported by the mobile station. That is, the negotiation state for the confidentiality protection of the selective control signal may be transmitted to the target base station via the MAC Request message or the HO-REQ primitive.

In addition, the handover request primitive includes a unique identifier (SBS_ID) of the SBS, a mobile station MAC address, a handover type (HO type), a recommended Number of Recommeded BSs (BSs) indicating the number of recommended BSs by the mobile station or SBS A Candidate TBS list indicating a list of BSs recommended for TBS, a service flow information, and the like.

Upon receiving the HO-REQ primitive or the MAC message, the TBS may generate a MAC response message or a handover response primitive (HO-RSP) including security-related information that can be supported by the TBS and transmit the handover response primitive to the serving BS through the backbone network or the NCMS (S505).

In step S505, the security-related information may include information on security negotiation parameters (see Tables 6 to 9) that can be supported by the TBS. That is, the negotiation state for the confidentiality protection of the TBS's selective control signal can be transmitted to the serving BS through the MAC response message or the HO-RSP primitive.

At this time, the handover response primitive corresponds to the mobile station MAC address, handover type (HO Type), number of recommended BSs (Number of Recommended BSs) parameter indicating the number of base stations recommended by the mobile station or SBS, and HO- (Recommended TBS List), which is a list of candidate target BSs.

The SBS receiving the MAC response message or the HO-RSP primitive from the TBS may transmit a handover response message (BSHO-RSP) including security negotiation parameters that can be supported by the TBS to the mobile station (S507).

The mobile station can know the security negotiation parameters that can be supported by the TBS through step S507. Therefore, when the mobile station performs the handover to the TBS area, it can reliably receive the selectively encrypted control signal in the TBS. That is, the mobile station can determine whether the corresponding control signal is encrypted by checking the flow identifier type field of the control signal in the TBS cell area (S509).

Referring to FIG. 5 (b), when the SBS desires to start a handover, it can exchange security related information with the TBS. That is, the SBS may transmit a MAC Request message or an HO-REQ primitive including security related information currently supported by the SBS to the TBS through the backbone network or the NCMS (S502).

Upon receiving the MAC request message or the HO-REQ primitive, the TBS may transmit a MAC Response message or HO-RSP primitive including security-related information that can be supported by the TBS to the SBS (S504).

In step S504, the security related information may include security negotiation parameters (see Tables 6 to 9) that can be supported by the TBS. That is, the negotiation state for the confidentiality protection of the selective control signal supported by the TBS can be transmitted to the serving BS through the MAC response message or the HO-RSP primitive.

The MAC response message or the HO-RSP primitive includes a MAC address of a mobile station, a handover type (HO Type), a Number of Recommended BSs parameter indicating the number of base stations recommended by the mobile station or the SBS, And a recommended TBS list that is a candidate target BS list corresponding to the -REQ message.

The SBS receiving the MAC response message or the HO-RSP primitive may transmit a handover response message (BSHO-RSP) including the security negotiation parameters that can be supported by the TBS to the mobile station (S506).

The mobile station can know the security negotiation parameters that can be supported by the TBS through step S506. Therefore, when the mobile station performs the handover to the TBS area, it can reliably receive the selectively encrypted control signal in the TBS. That is, the mobile station can determine whether the corresponding control signal is encrypted by checking the flow identifier type field of the control signal in the TBS cell area (S508).

That is, referring to FIG. 5, the mobile station and the target base station can negotiate whether to encrypt the control signal through the handover messages. In addition, message confidential mode related information for a particular terminal may be communicated from the serving base station to the target base station via a backbone message.

< Flow  Selective control signal encryption method using identifier>

Hereinafter, methods for selectively encrypting a control signal will be described. Methods for encrypting the control signal can be applied when the mobile station and the base station encrypt the control signal after negotiating selective encryption.

6 is a diagram showing an example of a method of encrypting a control signal according to another embodiment of the present invention.

FIG. 6 assumes that the AES-CCM is used as the encryption algorithm in the mobile station and the base station. When the AES-CCM is used in the mobile station and the base station, the AES-CCM algorithm itself can provide both the integrity and the confidentiality of the corresponding management control signals. In embodiments of the present invention, the classification of the MAC management messages may be based on whether the corresponding MAC management message includes the CMAC.

In Fig. 6, the base station indicates that it applies selective encryption to some MAC management messages or does not provide any protection. That is, the base station can indicate the protection level using the flow identifier type.

For example, when the type field of the flow identifier is Confidential Management Flow ID (CMF_ID), the confidentiality and integrity of the message are guaranteed at the same time. However, if the flow identifier type field is the main flow identifier (PF_ID) And indicates that no protection is performed if it indicates a flow identifier (SF_ID).

If the type field of the flow identifier is CMF_ID, the base station may first perform encryption for confidentiality protection, and then add an ICV for integrity protection to the encrypted result.

7 is a diagram showing another example of a method of encrypting a control signal as another embodiment of the present invention.

Fig. 7 is similar to the case of Fig. However, in the case where selective encryption is applied to the management message, there is a difference from FIG. 6 in the order of addition of ICV for encryption and integrity protection for confidentiality protection.

7, when the flow identifier type field indicates the CMF_ID, the BS adds the ICV to the payload of the management message first to protect the integrity of the management message, and adds the ICV to the payload of the management message to protect the confidentiality of the management message. Payload and ICV can be encrypted. That is, the base station may first add the ICV to the management message for integrity protection, and then encrypt the payload and the ICV for confidentiality protection.

6 and 7, the flow identifier type field is used as a method for indicating whether or not the control signal is encrypted. That is, the BS may indicate whether the corresponding control signal is encrypted using the flow identifier type field included in the MAC header.

8 is a diagram showing one of methods for encrypting a control signal as another embodiment of the present invention.

In the case of using the encryption method disclosed in FIG. 8, the base station may not use the AES-CCM when encrypting. In this case, the flow identifier type field may indicate three protection levels.

For example, if the flow identifier type field is CMF_ID, it may indicate that a message authentication code (MAC) for optional encryption and integrity protection for confidentiality protection is added. Also, when the flow identifier type field indicates PF_ID or SF_ID, only a message authentication code for integrity protection is added to the corresponding control signal. Also, if the flow identifier type field indicates a transmission type, it can indicate that no protection is applied to the corresponding control signal.

That is, the base station can protect integrity by selectively encrypting management messages to protect confidentiality or by adding a message authentication code (MAC). For example, when the F_ID type field of the header indicates the CMF_ID, the base station first adds the message authentication code to the management message to protect the integrity, and then encrypts the payload and the message authentication code of the management message, Can be protected.

If the F_ID type field of the header indicates PF_ID or SF_ID, the base station does not encrypt the management message, but can protect the integrity by adding a message authentication code to the management message. In this case, the specific management message can be exchanged through the main flow or subflow with only the message authentication code for integrity protection added. In the case of the control signal classified as not applying the selective encryption in FIG. 8, no protection may be performed.

9 is a diagram showing another method of encrypting a control signal as another embodiment of the present invention.

9 is similar to the case of Fig. However, in the case where selective encryption is applied to the management message, the order of addition of the message authentication code (MAC) for encryption and integrity protection for confidentiality protection differs from that of FIG.

9, if the F_ID type field indicates the CMF_ID, the base station first encrypts the payload of the management message to protect the confidentiality of the management message, and transmits a message to the payload of the management message in order to protect the integrity of the management message Authentication code (MAC) can be added. That is, the base station may encrypt a management message first for confidentiality protection, and then add a message authentication code (MAC) to the encrypted payload for integrity protection.

8 and 9, the BS may indicate whether the corresponding control signal is encrypted using the F_ID type field included in the MAC header.

As described above, when the Flow ID Type is Trsansport, the encryption method of Figs. 6 to 9 is not required. That is, selective encryption for control signaling may be applied according to a separate flow identifier for encryption only when the flow identifier type is Management.

In the embodiments of the present invention, the type of the control signal to which the selective encryption is applied is classified according to whether the CMAC is included or not, and the type of the control signal may vary depending on the time when the corresponding control signals are used. In the case of providing its own message authentication function such as AES-CCM, encryption and message authentication are ensured at the same time, and therefore, there is no need to add CMAC / HMAC, as shown in FIGS.

However, other commonly used encryption algorithms do not include the message authentication function. Therefore, as shown in Figs. 8 and 9, it is desirable that the application of the encryption algorithm and the addition of the CMAC / HMAC are performed separately. On the other hand, if the flow identifier is a main flow identifier and a subflow identifier, the control message is a case where only the MAC is supported or no protection is supported when encryption classified based on whether CMAC is included is not required. If no protection is provided for a particular message, this indicates the case of control signals that do not include CMAC in commonly used communication technologies

&Lt; Control signal classification method >

In the embodiments of the present invention, not all control signals are encrypted, only certain control signals can be encrypted. For example, selective encryption may be applied according to a specific control signal type in the same flow identifier only when the type of the flow identifier (Flow ID Type) indicates a management message.

In embodiments of the present invention, the type of control signal to which the selective encryption is applied may be classified according to whether or not the CMAC is included. In addition, selective encryption may be applied depending on when the corresponding control signal is used. If the AES-CCM algorithm provides its own message authentication function, selective encryption and message authentication can be performed at the same time.

Therefore, the base station does not need to add CMAC / HMAC to a specific control signal. However, since other encryption algorithms specified in the standards of wireless access systems do not include the message authentication function, it is necessary that the application of the corresponding encryption algorithm and the addition of the CMAC / HMAC are performed separately.

Table 10 below shows the types of MAC management messages (or MAC control signals) to which a CMAC tuple (CMAC Tuple) should be added.

Type Length Value Scope 141 13 or 19 RSP / ACK, REG-REQ / RSP, RES-CMD, DREG-CMD / REQ,
REQ / RSP, MOB_BSHO-REQ / RSP, MOB_BSHO-REQ / RSP, MOB_MSHO-REQ, MOB_HO-IND, MOB_MIH-MSG, RNG-REQ / RSP,

Referring to Table 10, it is possible to know the types of MAC management messages to which a CMAC tuple can be added. That is, in the embodiments of the present invention, it is possible to identify MAC messages to which selective encryption of the control signal is applied. Therefore, the base station can selectively encrypt the control signals shown in Table 10.

Table 11 below shows CMAC Tuple Value Fields applied in embodiments of the present invention.

Field Length Notes reserved
Key Sequence Number
BSID
CMAC Packet Number Counter, CMAC_PN_ *
CMAC value 4 bits
4 bits
48 bits
32 bits

64 bits set to 0
AK sequence Number
Only used in MDHO zone-optional
This context is different UL, DL

CMAC wiht AES-128

Referring to Tables 10 and 11, the application of the Authentication Tuple is limited to several management control signals, of which the management control signals protected through the CMAC tuple may also be limited to several MAC messages.

For example, among the MAC management messages whose integrity is to be protected through CMAC-based authentication tuples, the MAC management messages that should be encrypted and not encrypted can be distinguished. In the embodiments of the present invention, whether encryption is applied or not may depend on the type of the control signal or the time point when the individual control signal is used.

Table 12 shows examples of control signals and non-applied control signals that are encrypted by applying the HMAC tuple.

Scope Encryption shall be supported Encryption shall be not supported RSP / ACK, REG-REQ / RSP, RES-CMD, DREG-CMD / REQ,
RSP, MOB_BSHO-REQ / RSP, MOB_MSHO-REQ, MOB_HO-IND, MOB_MIH-MSG, TFTP-CPLT, MOB_SLP-REQ / RSP, REQ / RSP, MOB_MSHO-REQ, MOB_HO-IND, REQ-REQ / RSP, REQ-REQ / RES-CMD, TFTP-CPLT, MOB_MIH-MSG

Referring to Table 12, it is possible to identify a control signal to be encrypted and a control signal that is not to be encrypted, among the MAC management messages whose integrity is protected according to whether the HMAC is included.

The following Table 13 shows examples of control signals and non-applied control signals to which the CMAC tuple is applied and encrypted.

Scope Encryption shall be supported Encryption shall be not supported RSP / ACK, REG-REQ / RSP, RES-CMD, DREG-CMD / REQ,
RSP, SBC-REQ / RSP, MOB_BSHO-REQ / RSP, MOB_MSHO-REQ, MOB_HO-IND, MOB_MIH-MSG, RNG-REQ / RSP, MOB_SLP-REQ / RSP, REQ / RSP / REQ / RSP / REQ / REQ / REQ / REQ / REQ / REQ / RSP / MOB_SLP- REQ / RSP / MOB_SCN-REQ / RSP / MOB_BSHO- REQ / RSP / MOB_MSHO- REQ / MOB_HO- RSP, SBC-REQ / RSP RES-CMD, TFTP-CPLT, MOB_MIH-MSG

Referring to Table 13, it is possible to identify a control signal to be encrypted and a control signal that is not to be encrypted, among the MAC management messages whose integrity is protected according to whether or not the CMAC is included.

Table 14 below shows examples of control signals and non-applied control signals that are encrypted by applying a short HMAC tuple.

Scope Encryption shall be supported Encryption shall be not supported RSP, MOB_SLP-REQ / RSP, MOB_SCN-REQ / RSP, MOB_BSHO-REQ / RSP, MOB_MSHO-REQ, MOB_HO-IND, RNG- MOB_SLP-REQ / RSP, MOB_SCN-REQ / RSP, MOB_BSHO-REQ / RSP, MOB_MSHO-REQ, MOB_HO- IND, RNG- PKM-REQ / RSP

Referring to Table 14, it is possible to identify a control signal to be encrypted and a control signal that is not to be encrypted, among the MAC management messages whose integrity is protected according to the presence or absence of the short HMAC.

As described above, in the embodiments of the present invention, only a predetermined control signal (or MAC management message) can be encrypted. That is, classification is required for the control signals to be encrypted. Accordingly, the base station and the mobile station can classify control signals (or MAC management messages) that need to be encrypted with reference to Tables 10 to 14.

As another embodiment of the present invention, a transmitter and a receiver in which the embodiments of the present invention described in Figs. 1 to 9 can be performed will be described.

The mobile station can operate as a transmitter in an uplink and as a receiver in a downlink. In addition, the base station can operate as a receiver in an uplink and operate as a transmitter in a downlink. That is, the mobile station and the base station may include a transmitter and a receiver for transmission of information or data.

The transmitter and receiver may comprise a processor, module, part and / or means, etc., for performing embodiments of the present invention. In particular, the transmitter and receiver may include a module (means) for encrypting the message, a module for interpreting the encrypted message, an antenna for transmitting and receiving the message, and the like.

A mobile station used in embodiments of the present invention may include a low power RF (Radio Frequency) / IF (Intermediate Frequency) module. In addition, the mobile station includes a controller function for performing the above-described embodiments of the present invention, a MAC (Medium Access Control) frame variable control function according to service characteristics and propagation environment, a handover function, A packet modulating / demodulating function for transmission, a fast packet channel coding function and a real-time modem controlling function, and the like.

The base station can transmit the data received from the upper layer to the mobile station by radio or wire. The base station may include a low power RF (Radio Frequency) / IF (Intermediate Frequency) module. In addition, the base station includes a controller function for performing the above-described embodiments of the present invention, orthogonal frequency division multiple access (OFDMA) packet scheduling, time division duplex (TDD) packet scheduling and channel multiplexing , MAC frame variable control function according to service characteristics and propagation environment, high speed traffic real time control function, hand over function, authentication and encryption function, packet modulation / demodulation function for data transmission, high speed packet channel coding function and real time modem control Functions or the like, modules or parts, or the like.

The present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Accordingly, the above description should not be construed in a limiting sense in all respects and should be considered illustrative. The scope of the present invention should be determined by rational interpretation of the appended claims, and all changes within the scope of equivalents of the present invention are included in the scope of the present invention. In addition, claims that do not have an explicit citation in the claims may be combined to form an embodiment or be included in a new claim by amendment after the filing.

1 is a diagram showing one of the selective control signal encryption methods as an embodiment of the present invention.

FIG. 2 is a diagram showing another of the selective control signal encryption methods as an embodiment of the present invention.

FIG. 3 is a diagram showing another one of the selective control signal encryption methods as an embodiment of the present invention.

FIG. 4 is a diagram illustrating a method of negotiating a control signal encryption option when the idle mode mobile station performs location update, according to an embodiment of the present invention.

FIG. 5 is a diagram showing another alternative control signal encryption method as an embodiment of the present invention.

6 is a diagram showing an example of a method of encrypting a control signal according to another embodiment of the present invention.

7 is a diagram showing another example of a method of encrypting a control signal as another embodiment of the present invention.

8 is a diagram showing one of methods for encrypting a control signal as another embodiment of the present invention.

9 is a diagram showing another method of encrypting a control signal as another embodiment of the present invention.

Claims (16)

A method for selectively protecting a MAC (Medium Access Control) control message in a wireless communication system, Receiving a MAC PDU (medium access control protocol data unit) including a header and a payload; Wherein the header includes a FID (flow identifier) indicating whether the payload including the MAC control message is encrypted; And if the FID indicates that the payload is encrypted, decoding the MAC PDU, Wherein the payload is protected using one of the methods for protecting the MAC control message, The methods for protecting the MAC control message include a first method for protecting the integrity and confidentiality of the MAC control message, a second method for protecting only the integrity of the MAC control message, and a third method for not protecting the MAC control message and, Wherein the MAC control message is protected using one of the first to third methods based on a message type of the MAC control message. The method according to claim 1, The MAC control message is protected by selecting the third method when an initial ranging procedure is performed, and when the registration procedure is performed after the initial ranging procedure, Wherein the protection message is protected by a protection layer. delete The method according to claim 1, Wherein the first method performs encryption after performing the integrity protection of the MAC control message. The method according to claim 1, Wherein the first method performs integrity protection of the MAC control message after performing encryption on a payload of the MAC control message. The method according to claim 1, Wherein the first method is performed through an Advanced Encryption Standard-Counter (AES-CCM) algorithm. The method according to claim 6, The integrity of the first method is performed by attaching an Integrity Check Value (ICV) to the payload, and the integrity of the second method is performed by attaching a Cipher based Message Authentication Code (CMAC) to the payload Wherein the method comprises the steps of: The method according to claim 1, Wherein the MAC control message is a control message used in a MAC (Medium Access Control) layer of the UE and the BS to perform functions of a control plane. An apparatus for selectively protecting a MAC control message in a wireless communication system, The apparatus comprising: a receiving unit for receiving the MAC control message; And And a processor for decoding the MAC control message, The processor receives a medium access control protocol data unit (MAC PDU) including a header and a payload, and the header includes a flow identifier (FID) indicating whether the payload including the MAC control message is encrypted And if the FID indicates that the payload is encrypted, decode the MAC PDU, Wherein the payload is protected using one of the methods for protecting the MAC control message, The methods for protecting the MAC control message include a first method for protecting the integrity and confidentiality of the MAC control message, a second method for protecting only the integrity of the MAC control message, and a third method for not protecting the MAC control message and, Wherein the MAC control message is protected using one of the first to third methods based on a message type of the MAC control message. 10. The method of claim 9, The MAC control message is protected by selecting the third method when an initial ranging procedure is performed, and when the registration procedure is performed after the initial ranging procedure, Wherein the protection device is protected by a protective layer. delete 10. The method of claim 9, Wherein the first method performs encryption after performing the integrity protection of the MAC control message. 10. The method of claim 9, Wherein the first method performs integrity protection of the MAC control message after performing encryption on a payload of the MAC control message. 10. The method of claim 9, Wherein the first method is performed through an Advanced Encryption Standard-Counter (AES-CCM) algorithm. 15. The method of claim 14, The integrity of the first method is performed by attaching an Integrity Check Value (ICV) to the payload, and the integrity of the second method is performed by attaching a Cipher based Message Authentication Code (CMAC) to the payload Lt; / RTI &gt; 10. The method of claim 9, Wherein the MAC control message is a control message used in a medium access control (MAC) layer of a terminal and a base station to perform functions of a control plane.

Images