Method and apparatus to implement security in a long term evolution wireless device
A wireless transmit receive unit (WTRU) is configured to receive unciphered and ciphered messages. The unciphered messages include identity requests, authentication requests, non-access stratum (NAS) security mode commands and tracking area update responses. The ciphered messages may come from the NAS and a Radio Resource Controller (RRC). The messages are ciphered using security keys.
1. A wireless transmit/receive unit (WTRU) configured to implement security in Long Term Evolution (LTE) wireless communications, the WTRU comprising:
a receiver configured to receive a non-access stratum (NAS) message that includes a NAS sequence number (NAS SN); and
a processor configured to:
perform an integrity check on the NAS message by using a count value as an input to an integrity algorithm, wherein the count value comprises the NAS SN and a NAS counter that increments based on the value of the NAS SN;
handle the received NAS message based on the integrity check, wherein when the received NAS message fails the integrity check, the NAS message is discarded, and when the received NAS message passes the integrity check, the NAS message is processed.
2. The WTRU of claim 1 , wherein the processor comprises:
a ciphering radio resource controller (RRC) engine; and
a ciphering NAS engine.
3. The WTRU of claim 1 , wherein the processor comprises:
a ciphering engine configured to operate with both RRC and NAS parameters.
4. The WTRU of claim 1 , wherein the security procedure includes at least one of the following: reporting a failure to another protocol layer, initiating a re-authentication, moving to Evolved Packet System (EPS) Mobility Management (EMM_Idle) mode, moving to EMM_Deregistered state, maintaining count of number of failures, proceeding to re-attach to a network, or deleting the security parameters.
5. A method for implementing security in a wireless device, the method comprising:
receiving a non-access stratum (NAS) message that includes a NAS sequence number (NAS SN);
performing an integrity check on the NAS message by using a count value as an input to an integrity algorithm, wherein the count value comprises the NAS SN and a NAS counter that increments based on the value of the NAS SN;
handling the received NAS message based on the integrity check, wherein when the received NAS message fails the integrity check, the NAS message is discarded, and when the received NAS message passes the integrity check, the NAS message is processed.
6. The method of claim 5 , wherein the security procedure includes at least one of the following: reporting a failure to another protocol layer, initiating a re-authentication, moving to Evolved Packet System (EPS) Mobility Management (EMM_Idle) mode, moving to EMM_Deregistered state, maintaining count of number of failures, proceeding to re-attach to a network, or deleting the security parameters.
7. The method of claim 1 , further comprising:
performing duplicate detection based on the NAS sequence number.
8. The method of claim 7 , wherein the NAS sequence number functions as a transaction identifier.
9. The method of claim 7 , wherein the NAS sequence number contains a pre-defined incrementing period.
10. The method of claim 7 , wherein the NAS sequence number contains a negotiated incrementing period.
11. The method of claim 5 , wherein the NAS message is correlated with count value.
12. The method of claim 5 , wherein the count value is for ciphering (COUNT-C).
13. The method of claim 5 , wherein the count value is for integrity protection (COUNT-I).
14. The method of claim 5 , wherein the count value is a combination of a COUNT-C and a COUNT-I.
15. The method of claim 5 , wherein the count value is used as an input to a ciphering integrity protection algorithm.
16. The method of claim 5 , wherein the count value is used as an input to a de-ciphering integrity protection algorithm.
17. The method of claim 5 , wherein the count value is configured before NAS security activation.
18. The method of claim 5 , wherein the count value is 32 bits or less.
19. The method of claim 5 , wherein the NAS SN and the NAS counter are configurable.
20. The method of claim 5 , wherein duplicate detection is performed using the count value.
21. The method of claim 5 , wherein the NAS message indicates wireless transmit/receive unit (WTRU) capability information.
22. The method of claim 21 , wherein the WTRU capability information indicates support for NAS level ciphering.