Systems, apparatus and methods to facilitate handover security
Systems, methods and apparatus for facilitating handover security are provided. In some embodiments, the method can include deriving a key value for handover from a GERAN/UTRAN system to an E-UTRAN system using a first input value. The method can also include deriving a key value for a connection establishment using a second input value, wherein the first input value is different from the second input value and is different from input values derived subsequent to the second input value, and wherein the first input value, the second input value and the input values derived subsequent to the second input value are configured to be input to a same key derivation function configured to output a key for use between a network entity and user equipment.
1. A method to facilitate handover security, the method comprising:
deriving a key value using a key derivation function (KDF) for handover from a Global System for Mobile Communications Enhanced Data rates for GSM Evolution Radio Access Network/Universal Terrestrial Radio Access Network (“GERAN/UTRAN”) to an Evolved Universal Terrestrial Radio Access Network (“E-UTRAN”) system using a first input value;
performing the handover using the key value derived using the first input value; and
deriving a key value using the KDF for a connection establishment using a second input value, wherein the first input value is different from the second input value and is different from input values derived subsequent to the second input value, and establishing the connection using the key value derived using the second input value;
wherein the first input value, the second input value and the input values derived subsequent to the second input value are input to a same key derivation function that outputs a key for use between a network entity and user equipment during the handover and connection establishment; and
wherein the first input value and the second input value are indicative of uplink non-access stratum count values, the second input value and the input values derived subsequent to the second input value are values within a range of [0,2 24 ], and the first input value is a value outside of the range of [0,2 24 ].
2. The method of claim 1 , wherein the first input value is used only as the value of an uplink non-access stratum count value for the purpose of deriving a key value for handover and is not used to actually set the uplink non-access stratum count.
3. The method of claim 1 , wherein the first input value is indicative of setting each bit of the first input value to one.
4. The method of claim 1 , wherein deriving the key value is performed at the user equipment.
5. The method of claim 1 , wherein deriving the key value is performed at a network comprising a mobility management entity and a base station, and wherein the mobility management entity performs deriving the key value and outputs a derived key value to the base station.
6. The method of claim 1 , wherein the connection establishment includes a non-access stratum service request.
7. The method of claim 1 , wherein the second input value is generated by initializing a non-access stratum count value to a value of one.
8. The method of claim 1 , wherein the second input value is generated by initializing an uplink non-access stratum count value to one based, at least, on the handover being from a GERAN/UTRAN system to an E-UTRAN system.
9. A computer program product, comprising:
a non-transitory computer-readable medium, comprising:
a first set of codes for causing a computer to derive a key value using a key derivation function (KDF) for handover from a Global System for Mobile Communications Enhanced Data rates for GSM Evolution Radio Access Network/Universal Terrestrial Radio Access Network (“GERAN/UTRAN”) to an Evolved Universal Terrestrial Radio Access Network (“E-UTRAN”) system using a first input value;
a second set of codes for causing the computer to derive a key value using the KDF for a connection establishment using a second input value, wherein the first input value is different from the second input value and is different from input values derived subsequent to the second input value, and establishing the connection using the key value derived using the second input value;
a third set of codes for performing the handover using the key value derived using the first input value; and
wherein the first input value, the second input value and the input values derived subsequent to the second input value are input to a same key derivation function that outputs a key for use between a network entity and user equipment during the handover and connection establishment; and
wherein the first input value and the second input value are indicative of uplink non-access stratum count values, the second input value and the input values derived subsequent to the second input value are values within a range of [0,2 24 ], and the first input value is a value outside of the range of [0,2 24 ].
10. The computer program product of claim 9 , wherein the first input value is used only as the value of an uplink non-access stratum count value for the purpose of deriving a key value for handover and is not used to actually set the uplink non-access stratum count.
11. The computer program product of claim 9 , wherein the first input value is indicative of setting each bit of the first input value to one.
12. The computer program product of claim 9 , wherein deriving the key value is performed at the user equipment.
13. The computer program product of claim 9 , wherein deriving the key value is performed at a network comprising a mobility management entity and a base station, and wherein the mobility management entity performs deriving the key value and outputs a derived key value to the base station.
14. The computer program product of claim 9 , wherein the connection establishment includes a non-access stratum service request.
15. The computer program product of claim 9 , wherein the second input value is generated by initializing a non-access stratum count value to a value of one.
16. The computer program product of claim 9 , wherein the second input value is generated by initializing an uplink non-access stratum count value to one based, at least, on the handover being from a GERAN/UTRAN system to an E-UTRAN system.
17. An apparatus, comprising:
means for deriving a key value using a key derivation function (KDF) for handover from a Global System for Mobile Communications Enhanced Data rates for GSM Evolution Radio Access Network/Universal Terrestrial Radio Access Network (“GERAN/UTRAN”) to an Evolved Universal Terrestrial Radio Access Network (“E-UTRAN”) system using a first input value;
means for performing the handover using the key value derived using the first input value; and
means for deriving a key value using the KDF for a connection establishment using a second input value, wherein the first input value is different from the second input value and is different from input values derived subsequent to the second input value, and establishing the connection using the key value derived using the second input value;
wherein the first input value, the second input value and the input values derived subsequent to the second input value input to a same key derivation function that outputs a key for use between a network entity and user equipment during the handover and connection establishment; and
wherein the first input value and the second input value are indicative of uplink non-access stratum count values, the second input value and the input values derived subsequent to the second input value are values within a range of [0,2 24 ], and the first input value is a value outside of the range of [0,2 24 ].
18. The apparatus of claim 17 , wherein the first input value is used only as the value of an uplink non-access stratum count value for the purpose of deriving a key value for handover and is not used to actually set the uplink non-access stratum count.
19. The apparatus of claim 17 , wherein the first input value is indicative of setting each bit of the first input value to one.
20. The apparatus of claim 17 , wherein deriving the key value is performed at the user equipment.
21. The apparatus of claim 17 , wherein deriving the key value is performed at a network comprising a mobility management entity and a base station, and wherein the mobility management entity performs deriving the key value and outputs a derived key value to the base station.
22. The apparatus of claim 17 , wherein the connection establishment includes a non-access stratum service request.
23. The apparatus of claim 17 , wherein the second input value is generated by initializing a non-access stratum count value to a value of one.
24. The apparatus of claim 17 , wherein the second input value is generated by initializing an uplink non-access stratum count value to one based, at least, on the handover being from a GERAN/UTRAN system to an E-UTRAN system.
25. An apparatus, comprising:
a mobility management module configured to:
derive a key value using a key derivation function (KDF) for handover from a Global System for Mobile Communications Enhanced Data rates for GSM Evolution Radio Access Network/Universal Terrestrial Radio Access Network (“GERAN/UTRAN”) to an Evolved Universal Terrestrial Radio Access Network (“E-UTRAN”) system using a first input value;
perform the handover using the key value derived using the first input value; and
derive a key value using the KDF for a connection establishment using a second input value, wherein the first input value is different from the second input value and is different from input values derived subsequent to the second input value, and establishing the connection using the key value derived using the second input value;
wherein the first input value, the second input value and the input values derived subsequent to the second input value input to a same key derivation function that outputs a key for use between a network entity and user equipment during the handover and connection establishment; and
wherein the first input value and the second input value are indicative of uplink non-access stratum count values, the second input value and the input values derived subsequent to the second input value are values within a range of [0,2 24 ], and the first input value is a value outside of the range of [0,2 24 ].
26. The apparatus of claim 25 , wherein the first input value is used only as the value of an uplink non-access stratum count value for the purpose of deriving a key value for handover and is not used to actually set the uplink non-access stratum count.
27. The apparatus of claim 25 , wherein the first input value is indicative of setting each bit of the first input value to one.
28. The apparatus of claim 25 , wherein the mobility management module is a user equipment mobility management module and deriving the key value is performed at the user equipment.
29. The apparatus of claim 25 , wherein the mobility management module is a mobility management entity and wherein the mobility management entity is configured to perform deriving the key value and to output a derived key value to a base station.
30. The apparatus of claim 25 , wherein the connection establishment includes a non-access stratum service request.
31. The apparatus of claim 25 , wherein the second input value is generated by initializing a non-access stratum count value to a value of one.
32. The apparatus of claim 25 , wherein the second input value is generated by initializing an uplink non-access stratum count value to one based, at least, on the handover being from a GERAN/UTRAN system to an E-UTRAN system.
33. A method to facilitate handover security, the method comprising:
deriving a key value using a key derivation function (KDF) for handover from a Global System for Mobile Communications Enhanced Data rates for GSM Evolution Radio Access Network/Universal Terrestrial Radio Access Network (“GERAN/UTRAN”) to an Evolved Universal Terrestrial Radio Access Network (“E-UTRAN”) system using a first input value;
performing the handover using the key value derived using the first input value; and
deriving a key value using the KDF for a connection establishment using a second input value, wherein the first input value is different from the second input value, and wherein the first input value and the second input value are values indicative of instances of deriving a key for use between a network entity and user equipment, and establishing the connection using the key value derived using the second input value; and
wherein the first input value and the second input value are indicative of uplink non-access stratum count values, the second input value and the input values derived subsequent to the second input value are values within a range of [0,2 24 ], and the first input value is a value outside of the range of [0,2 24 ].
34. The method of claim 33 , wherein the first input value is a value other than 0x11.
35. A computer program product, comprising:
a non-transitory computer-readable medium, comprising:
a first set of codes for causing a computer to derive a key value using a key derivation function (KDF) for handover from a Global System for Mobile Communications Enhanced Data rates for GSM Evolution Radio Access Network/Universal Terrestrial Radio Access Network (“GERAN/UTRAN”) to an Evolved Universal Terrestrial Radio Access Network (“E-UTRAN”) system using a first input value;
a second set of codes for causing the computer to derive a key value using the KDF for a connection establishment using a second input value, wherein the first input value is different from the second input value, and wherein the first input value and the second input value are values indicative of instances of deriving a key for use between a network entity and user equipment, and establishing the connection using the key value derived using the second input value;
a third set of codes for performing the handover using the key value derived using the first input value; and
wherein the first input value and the second input value are indicative of uplink non-access stratum count values, the second input value and the input values derived subsequent to the second input value are values within a range of [0,2 24 ], and the first input value is a value outside of the range of [0,2 24 ].
36. The computer program product of claim 35 , wherein the first input value is a value other than 0x11.
37. An apparatus, comprising:
means for deriving a key value using a key derivation function (KDF) for handover from a Global System for Mobile Communications Enhanced Data rates for GSM Evolution Radio Access Network/Universal Terrestrial Radio Access Network (“GERAN/UTRAN”) to an Evolved Universal Terrestrial Radio Access Network (“E-UTRAN”) system using a first input value;
means for performing the handover using the key value derived using the first input value; and
means for deriving a key value using the KDF for a connection establishment using a second input value, wherein the first input value is different from the second input value, and wherein the first input value and the second input value are values indicative of instances of deriving a key for use between a network entity and user equipment, and establishing the connection using the key value derived using the second input value;
wherein the first input value and the second input value are indicative of uplink non-access stratum count values, the second input value and the input values derived subsequent to the second input value are values within a range of [0,2 24 ], and the first input value is a value outside of the range of [0,2 24 ].
38. The apparatus of claim 37 , wherein the first input value is a value other than 0x11.
39. An apparatus, comprising:
a mobility management module configured to:
derive a key value using a key derivation function (KDF) for handover from a Global System for Mobile Communications Enhanced Data rates for GSM Evolution Radio Access Network/Universal Terrestrial Radio Access Network (“GERAN/UTRAN”) to an Evolved Universal Terrestrial Radio Access Network (“E-UTRAN”) system using a first input value;
perform the handover using the key value derived using the first input value; and
derive a key value for a connection establishment using a second input value,
wherein the first input value is different from the second input value, and wherein the first input value and the second input value are values indicative of instances of deriving a key for use between a network entity and user equipment, and establishing the connection using the key value derived using the second input value; and
wherein the first input value and the second input value are indicative of uplink non-access stratum count values, the second input value and the input values derived subsequent to the second input value are values within a range of [0,2 24 ], and the first input value is a value outside of the range of [0,2 24 ].
40. The apparatus of claim 39 , wherein the first input value is a value other than 0x11.