Security for paging messages
Briefly, in accordance with one or more embodiments, an apparatus of a user equipment (UE), comprises one or more baseband processors to derive a dynamic scrambling key, and a memory to store the dynamic scrambling key and a temporary UE identifier (temporary UE ID) assigned to the UE. The one or more baseband processors monitor a paging request for a scrambled UE identifier (UE ID) to determine if the paging request is intended for the UE by unscrambling the scrambled UE ID with the dynamic scrambling key to produce the temporary UE ID. The paging request is intended for the UE if the temporary UE ID produced by unscrambling the scrambled UE ID matches the temporary UE ID stored in the memory. A new dynamic scrambling key may be derived each time the UE returns to a radio resource control idle (RRC_IDLE) state.
1. An apparatus of a user equipment (UE), comprising:
one or more baseband processors to derive a dynamic scrambling key in response to the UE releasing a radio resource control (RRC) connection and determine whether a non-access stratum (NAS) security mode control procedure is performed during the RRC connection, wherein, when the NAS security mode control procedure is performed during the RRC connection, the dynamic scrambling key is derived based on at least a cell identity and a NAS count value used to track a security mode complete message for the NAS security mode control procedure and, when the NAS security mode control procedure is not performed during the RRC connection, the dynamic scrambling key is derived based on at least the cell identity and a NAS count value used to track an initial uplink NAS message for RRC connection establishment; and
a memory to store the dynamic scrambling key and a temporary UE identifier (temporary UE ID) assigned to the UE;
wherein the one or more baseband processors are to monitor a paging request for a scrambled LIE identifier (UE ID) to determine if the paging request is intended for the UE by unscrambling the scrambled UE ID with the dynamic scrambling key to produce the temporary UE ID.
2. The apparatus of claim 1 , wherein the one or more baseband processors are to derive a new dynamic scrambling key each time the UE returns to a radio resource control idle (RRC_IDLE) state.
3. The apparatus of claim 1 , wherein the one or more baseband processors are to determine that the paging request is intended for the UE if the temporary UE ID produced by unscrambling the scrambled UE ID matches the temporary UE ID stored in the memory.
4. The apparatus of claim 1 , wherein the scrambled UE ID was generated via an exclusive OR operation on the dynamic scrambling key and the temporary UE ID.
5. The apparatus of claim 1 , wherein said unscrambling comprises performing an exclusive OR (XOR) operation on the dynamic scrambling key and the scrambled UE ID.
6. The apparatus of claim 1 , wherein the one or more baseband processors are to determine that the paging request is intended for the UE if the scrambled UE ID matches the temporary UE ID stored in the memory.
7. The apparatus of claim 1 , wherein the temporary UE ID comprises a Globally Unique Temporary Identity (GUTI), a System Architecture Evolution (SAE) Temporary Mobile Subscriber Identity (S-TMSI), or a Mobility Management Entity (MME) TMSI (M-TMSI).
8. The apparatus of claim 1 , wherein the dynamic scrambling key is further based on an Access Security Management Entity key (K ASME ).
9. The apparatus of claim 1 , further comprising a radio-frequency (RF) transceiver to receive the paging request from a mobility management entity (MME) via an evolved Node B (eNB).
10. An apparatus of a Mobility Management Entity (MME), comprising:
one or more processors to assign a temporary user equipment (UE) identifier to a UE, derive a dynamic scrambling key in response to the UE releasing a radio resource control (RRC) connection and determine whether a non-access stratum (NAS) security mode control procedure is performed by the UE during the RRC connection, wherein, when the NAS security mode control procedure is performed during the RRC connection, the dynamic scrambling key is derived based on at least a cell identity and a NAS count value used to track a security mode complete message for the NAS security mode control procedure and, when the NAS security mode control procedure is not performed during the RRC connection, the dynamic scrambling key is derived based on at least the cell identity and a NAS count value used to track an initial uplink NAS message for RRC connection establishment; and
a memory to store the dynamic scrambling key and a temporary UE identifier (temporary UE ID) assigned to the UE;
wherein the one or more processors are to generate a scrambled UE ID derived via scrambling the temporary UE ID with the dynamic scrambling key, and to generate a paging request intended for the UE using the scrambled UE ID.
11. The apparatus of claim 10 , wherein the one or more processors are to derive a new dynamic scrambling key each time the UE returns to a radio resource control idle (RRC_IDLE) state.
12. The apparatus of claim 10 , wherein the one or more processors are to generate a paging request intended for the UE using the temporary UE ID if the UE does not respond to the paging request intended for the UE using the scrambled UE ID.
13. The apparatus of claim 10 , wherein the scrambled UE ID was generated via an exclusive OR (XOR) operation on the dynamic scrambling key and the temporary UE ID.
14. The apparatus of claim 10 , wherein the temporary UE ID comprises a Globally Unique Temporary Identity (GUTI), a System Architecture Evolution (SAE) Temporary Mobile Subscriber Identity (S-TMSI), or a Mobility Management Entity (MME) TMSI (M-TMSI).
15. The apparatus of claim 10 , wherein the dynamic scrambling key is further based on an Access Security Management Entity key (K ASME ).
16. The apparatus of claim 10 , wherein the one or more processors are to use an existing NAS security context for the UE as obtained from a previous MME if the UE is registered with the MME after performing a tracking area update to the MME.
17. The apparatus of claim 10 , wherein the one or more processors are to generate a new NAS security context for the UE if the UE was registered with another MME before performing a tracking area update.
18. One or more non-transitory computer readable media having instructions stored thereon that, if executed by a user equipment (UE), result in:
deriving a dynamic scrambling key in response to the UE releasing a radio resource control (RRC) connection;
determining whether a non-access stratum (NAS) security mode control procedure is performed during the RRC connection, wherein, when the NAS security mode control procedure is performed during the RRC connection, the dynamic scrambling key is derived based on at least a cell identity and a NAS count value used to track a security mode complete message for the NAS security mode control procedure and, when the NAS security mode control procedure is not performed during the RRC connection, the dynamic scrambling key is derived based on at least the cell identity and a NAS count value used to track an initial uplink NAS message for RRC connection establishment;
storing the dynamic scrambling key and a temporary UE identifier (temporary UE ID) assigned to the UE;
monitoring a paging request for a scrambled UE identifier (UE ID); and
determining if the paging request is intended for the UE by unscrambling the scrambled UE ID with the dynamic scrambling key to produce the temporary UE.
19. The one or more non-transitory computer readable media of claim 18 , wherein the instructions, if executed, further result in deriving a new dynamic scrambling key each time the UE returns to a radio resource control idle (RRC_IDLE) state.
20. The one or more non-transitory computer readable media of claim 18 , wherein the instructions, if executed, further result in determining that the paging request is intended for the UE if the temporary UE ID produced by unscrambling the scrambled UE ID matches the temporary UE ID stored in the memory.