Techniques for secure channelization between UICC and a terminal
The present invention is related to a wireless communication system. 3G UMTS mobile phone systems rely on a protected smart card called the UMTS integrated circuit card (UICC) that provides UMTS subscriber identity module (USIM) applications as a basis or root of various security measures protecting the communication path between the 3G mobile terminal and the UMTS wireless network (or UTRAN). Disclosed is a method by which the UICC exchanges information with a terminal, such as an Internal Key Center (IKC 1250 ) and a Bootstrapping Server Function (BSF 1270 ) enables a procedure where multiple local keys specific to applications and Network Application Functions (NAFs) (Ks_local) are used for authentication and to encrypt and decrypt messages.
1. A method for use by a wireless transmit/receive unit (WTRU) for establishing secure communication, the method comprising:
establishing a secure tunnel, configured to enable a secure communication during a GBA_U process and a local-key set-up process, between an internal key center (IKC) and a UMTS Integrated Circuit Card (UICC), wherein the IKC is a trusted local entity residing on the WTRU, wherein the secure tunnel between the IKC and the UICC is a transport layer security-pre-shared key (TLS-PSK) tunnel established using a successfully authenticated pre-shared key set; and
establishing a secure channel between the UICC and the IKC by performing the GBA_U process and the local-key set-up process over the established secure tunnel between the IKC and the UICC.
2. The method of claim 1 wherein establishing the secure tunnel between the IKC and the UICC includes:
establishing another secure tunnel between the IKC and a bootstrapping server function (BSF); and
receiving a first key over the secure tunnel between the IKC and the BSF, wherein the secure tunnel between the IKC and the UICC is established using the first key.
3. The method of claim 2 wherein the secure tunnel between the IKC and the BSF is a transport layer security-pre-shared key (TLS-PSK) tunnel.
4. The method of claim 1 wherein the secure tunnel between the IKC and the UICC is established using shared secrets.
5. The method of claim 4 wherein the shared secrets are pre-provisioned in the IKC and the UICC.
6. A wireless transmit/receive unit (WTRU) configured to establish secure communication, the WTRU comprising:
an internal key center (IKC), residing on the WTRU as a trusted local entity, configured to:
establish a secure tunnel, configured to enable a secure communication during a GBA_U process and a local-key set-up process, between the IKC and a UMTS Integrated Circuit Card (UICC), wherein the secure tunnel between the IKC and the UICC is a transport layer security-pre-shared key (TLS-PSK) tunnel established using a successfully authenticated pre-shared key set, and
establish a secure channel between the UICC and a bootstrap server function (BSF) by performing the GBA_U process and the local-key set-up process over the established secure tunnel between the IKC and the UICC.
7. The WTRU of claim 6 wherein the IKC is further configured to:
establish a secure tunnel between the IKC and the BSF; and
receive a first key over the secure tunnel between the IKC and the BSF, wherein the secure tunnel between the IKC and the UICC is established using the first key.
8. The WTRU of claim 7 wherein the secure tunnel between the IKC and the BSF is a transport layer security-pre-shared key (TLS-PSK) tunnel.
9. The WTRU of claim 6 wherein the secure tunnel between the IKC and the UICC is established using shared secrets.
10. The WTRU of claim 9 wherein the shared secrets are pre-provisioned in the IKC and the UICC.
11. A method employed by an Internal Key Center (IKC) for a secure communication, the method comprising:
establishing a first secured tunnel between the IKC and a UMTS Integrated Circuit Card (UICC), wherein the IKC is a trusted local entity residing on a wireless transmit/receive unit (WTRU), wherein the first secured tunnel is a transport layer security-pre-shared key (TLS-PSK) tunnel established using a successfully authenticated pre-shared key set;
establishing a second secured tunnel between the IKC and a bootstrap server function (BSF); and
providing security association information for at least two network applications functions to the UICC using said first and second tunnels.
12. The method of claim 11 , further comprising: transferring a security association response from the UICC to the BSF using said first and second tunnels.
13. A method, for use by a wireless transmit/receive unit (WTRU) including an internal key center (IKC) for establishing secure local keys, the method comprising:
determining whether a valid key exists on a UMTS Integrated Circuit Card (UICC), and if so:
retrieving, via a secure tunnel between the IKC and the UICC, a bootstrapping transaction identifier (B-TID) and at least one network application function identifier (NAF-ID) from the UICC, wherein the IKC is a trusted local entity residing on the WTRU, and wherein the secure tunnel between the IKC and UICC is a transport layer security-pre-shared key (TLS-PSK) tunnel established using a successfully authenticated pre-shared key set;
sending an application request for keys to a bootstrap server function (BSF);
receiving an application response including at least one key;
generating a counter limit and deriving local keys from related parameters for the at least one NAF;
sending an application request for key establishment to the UICC;
receiving a local deviation response indicating successful verification of the local keys; and
storing the local keys and the related parameters in the IKC.
14. The method of claim 13 wherein retrieving the bootstrapping transaction identifier (B-TID) and the at least one network application function identifier (NAF-ID) from the UICC is done over the secure tunnel between the IKC and UICC.
15. The method of claim 13 wherein sending the application request for keys to the bootstrap server function (BSF) is done over a second secure tunnel.
16. The method of claim 15 wherein receiving the application response including the at least one key is done over the second secure tunnel.
17. The method of claim 16 wherein the second tunnel is a transport layer security-pre-shared key (TLS-PSK) tunnel established using a second successfully authenticated pre-shared key set.