Method of providing telecommunications network security
View Patent ↗Disclosed is a method of providing network security within a mobile radio communications network and including creating a security context for communications between a mobile radio communications device and the network, the security context being created responsive to an input parameter such as the downlink NAS count, and the method further including, as part of each initial handover attempt, controlling the parameter so as to apply a version of the parameter different from a previous version, for example as incremented downlink NAS count, and preferably independently of network signaling messages.
1. A method of providing network security within a mobile radio communications network during each of a plurality of handover procedures, the network including a radio access part and a core part, the method comprising:
the core part creating a security context for communications between a mobile radio communications device and said network, said creation of the security context comprising generating a security key using a value of a Non-access stratum (NAS) count as
an input parameter;
as part of an initial handover attempt of said handover procedure, the core part of the network sending a handover command signal to the radio access part of the network, which sends the handover command signal to the mobile radio communications device, and controlling said value of the NAS count so as to ensure that a different respective value of the NAS count is employed during each successful initial handover attempt; and
when the radio access part determines that the handover command signal has not been received by the mobile communication device, the radio access part sending a non-delivery indication signal to the core part and the core part resending through the radio access part the handover command signal, including a same NAS count, in response to the non-delivery indication signal.
2. The method as claimed in claim 1 , wherein the step of controlling the value of the NAS count comprises incrementing the value of the NAS count for a respective initial handover attempt of each successful handover procedure.
3. A method as claimed in claim 2 , further comprising the network determining that the initial or a subsequent handover attempt was successful if the handover command signal is received by the mobile radio communications device.
4. The method as claimed in claim 1 , including the step of storing, for each handover procedure, the respective value of the NAS count as part of a security context for subsequent handover to a Universal Mobile Telephone System UMTS.
5. The method as claimed in claim 4 , including the step of detecting a same or older value of the NAS count by comparison of each stored value with a next expected value stored as part of a security context for the subsequent handover attempt to the UMTS.
6. The method as claimed in claim 5 , wherein said same or older value of the NAS count is detected by a mobile radio communications device within said network.
7. The method as claimed in claim 6 , including the step of performing at the mobile radio communications device, routing area update procedure including the provision of an identifier for indication that no UMTS key set is available for seeking initiation of a UMTS authentication procedure.
8. The method as claimed in claim 1 , further comprising controlling said value of the NAS count during periods of non NAS-signaling exchange between the mobile radio communication device and the network.
9. The method as claimed in claim 8 , further comprising controlling said value of the NAS count during periods of Idle Mode Signaling Reduction activation.
10. The method as claimed in claim 1 , further comprising controlling the parameter for each initial handover attempt.