Deriving a WLAN security context from a WWAN security context
Techniques for deriving a WLAN security context from an existing WWAN security context are provided. According to certain aspects, a user equipment (UE) establishes a secure connection with a wireless wide area network (WWAN). The UE may receive from the WWAN an indication of a wireless local area network (WLAN) for which to derive a security context. The UE then derives the security context for the WLAN, based on a security context for the WWAN obtained while establishing the secure connection with the WWAN and establishes a secure connection with the WLAN using the derived security context for the WLAN. This permits the UE to establish a Robust Security Network Association (RSNA) with the WLAN while avoiding lengthy authentication procedures with an AAA server, thus speeding up the association process.
1. A method for secure wireless communications by a user equipment (UE), comprising:
establishing a secure connection with a wireless wide area network (WWAN) via an eNode B (eNB) that shares a secure network with a wireless local area network (WLAN) access point (AP);
deriving a security context for the WLAN, based on a security context for the WWAN, wherein the security context for the WLAN comprises a first Pairwise Master Key (PMK) that matches a second PMK derived at the eNB and passed from the eNB to the WLAN AP; and
establishing a secure association with the WLAN using the first PMK.
2. The method of claim 1 , further comprising receiving from the WWAN an indication of the WLAN for which to derive the security context.
3. The method of claim 1 , wherein:
the security context for the WWAN comprises an eNB key or an Access Security Management Entity (ASME) key, and
a Key Derivation Function (KDF) is used to derive the first PMK.
4. The method of claim 1 , further comprising receiving a message from eNB comprising an indication to establish the secure association with the WLAN.
5. The method of claim 1 , further comprising receiving a message from the eNB comprising an indication that the security context for the WLAN should be derived from the security context for the WWAN.
6. The method of claim 4 , wherein the message comprises an indication that the security context for the WLAN should be derived from the security context for the WWAN.
7. The method of claim 5 , wherein the indication comprises a vendor specific extension.
8. The method of claim 1 , further comprising:
receiving a changed security context for the WWAN from the eNB,
deriving a third PMK for the WLAN if the security context for the WWAN changes while the UE is associated with the WLAN, wherein the third PMK is derived based on the changed security context for the WWAN; and
sending an indication to the eNB to derive a fourth PMK based on the changed security context for the WWAN and to provide the fourth PMK to the WLAN.
9. The method of claim 8 , wherein the third and fourth PMKs are derived from the changed security context for WWAN by using a KDF, and wherein the third PMK matches the fourth PMK.
10. The method of claim 1 , further comprising using Wireless Protected Access (WPA) for securing traffic using the derived PMK as a root for deriving temporal keys.
11. The method of claim 1 , wherein the secure association comprises a Robust Security Network Association (RSNA).
12. The method of claim 1 , wherein the security context for the WLAN is derived prior to the UE sending an association request message to the WLAN AP.
13. An apparatus for secure wireless communications by a user equipment (UE), comprising:
means for establishing a secure connection with a wireless wide area network (WWAN) via an eNode B (eNB) that shares a secure network with a wireless local area network (WLAN) access point (AP);
means for deriving a security context for the WLAN, based on a security context for the WWAN, wherein the security context for the WLAN comprises a first Pairwise Master Key (PMK) that matches a second PMK derived at the eNB and passed from the eNB to the WLAN AP; and
means for establishing a secure association with the WLAN using the first PMK.
14. The apparatus of claim 13 , further comprising means for receiving from the WWAN an indication of the WLAN for which to derive the security context.
15. The apparatus of claim 13 , wherein:
the security context for the WWAN comprises an eNB key or an Access Security Management Entity (ASME) key, and
a Key Derivation Function (KDF) is used to derive the first PMK.
16. The apparatus of claim 13 , further comprising means for receiving a message from the eNB comprising an indication to establish the secure association with the WLAN.
17. The apparatus of claim 13 , further comprising means for receiving a message from the eNB comprising an indication that the security context for the WLAN should be derived from the security context for the WWAN.
18. The apparatus of claim 16 , wherein the message comprises an indication that the security context for the WLAN should be derived from the security context for the WWAN.
19. The apparatus of claim 17 , wherein the indication comprises a vendor specific extension.
20. The apparatus of claim 13 , wherein the security context for the WLAN is derived prior to the UE sending an association request message to the WLAN AP.
21. The apparatus of claim 13 , further comprising:
means for receiving a changed security context for the WWAN from the eNB,
means for deriving a third PMK for the WLAN if the security context for the WWAN changes while the UE is associated with the WLAN, wherein the third PMK is derived based on the changed security context for the WWAN; and
means for sending an indication to the eNB to derive a fourth PMK based on the changed security context for the WWAN and to provide the fourth PMK to the WLAN.
22. The apparatus of claim 21 , wherein the third and fourth PMKs are derived from the changed security context for WWAN by using a KDF, and wherein the third PMK matches the fourth PMK.
23. The apparatus of claim 13 , further comprising means for using Wireless Protected Access (WPA) for securing traffic using the derived PMK as a root for deriving temporal keys.
24. The apparatus of claim 13 , wherein the secure association comprises a Robust Security Network Association (RSNA).
25. An apparatus for secure wireless communications by a user equipment (UE), comprising:
at least one processor configured to:
establish a secure connection with a wireless wide area network (WWAN) via an eNode B (eNB) that shares a secure network with a wireless local area network (WLAN) access point (AP);
derive a security context for the WLAN, based on a security context for the WWAN, wherein the security context for the WLAN comprises a first Pairwise Master Key (PMK) that matches a second PMK derived at the eNB and passed from the eNB to the WLAN AP; and
establish a secure association with the WLAN using the first PMK; and
a memory coupled with the at least one processor.
26. The apparatus of claim 25 , wherein the at least one processor is further configured to receive from the WWAN an indication of the WLAN for which to derive the security context.
27. The apparatus of claim 25 , wherein:
the security context for the WWAN comprises an eNB key or an Access Security Management Entity (ASME) key, and
a Key Derivation Function (KDF) is used to derive the first PMK.
28. A non-transitory computer readable medium having computer executable instructions stored thereon for:
establishing a secure connection with a wireless wide area network (WWAN) via an eNode B (eNB) that shares a secure network with a wireless local area network (WLAN) access point (AP);
deriving a security context for the WLAN, based on a security context for the WW AN, wherein the security context for the WLAN comprises a first Pairwise Master Key (PMK) that matches a second PMK derived at the eNB and passed from the eNB to the WLAN AP; and
establishing a secure association with the WLAN using the first PMK.
29. The non-transitory computer readable medium of claim 28 , wherein the computer readable medium further has instructions stored thereon for receiving from the WWAN an indication of the WLAN for which to derive the security context.
30. The non-transitory computer readable medium of claim 28 , wherein:
the security context for the WWAN comprises an eNB key or an Access Security Management Entity (ASME) key, and
a Key Derivation Function (KDF) is used to derive the first PMK.