Method, apparatus and computer program for operating a user equipment
Embodiments provide a method, apparatus and computer program for operating a user equipment (UE). The method begins by determining that a valid authentication for the UE, generated with a radio network operating with a first radio access technology (RAT), is not a mutual authentication between the UE and the network operating with the first RAT. In response, the UE unilaterally takes action to prevent the valid authentication that is not a mutual authentication from being used to authenticate with a radio network operating with a second RAT that utilizes mutual authentication.
1. A method for operating a user equipment (UE), the method comprising:
determining that a valid authentication for the UE, generated with a radio network operating with a first radio access technology (RAT), is not a mutual authentication between the UE and the network operating with the first RAT;
and in response, the UE unilaterally taking action to prevent the valid authentication that is not a mutual authentication from being used to authenticate with a radio network operating with a second RAT that utilizes mutual authentication.
2. The method according to claim 1 , in which the second RAT is Evolved Universal Terrestrial Access Radio Access (E-UTRA) and the first RAT is other than E-UTRA.
3. The method according to claim 1 , in which the action unilaterally taken by the UE comprises including in a tracking area update request sent to the radio network operating with the second RAT an indication that the UE does not have a valid security context, regardless of the valid authentication that is not a mutual authentication.
4. The method according to claim 1 , in which the action is unilaterally taken by the UE in response to the determining and further in response to the UE moving to the radio network operating with the second RAT, wherein the action comprises:
the UE deleting a security context associated with the valid authentication that is not a mutual authentication;
the UE performing a detach procedure to detach from the radio network operating with the first RAT; and
the UE initiating a new attach procedure with the radio network operating with the second RAT which results in establishing a new security context with the radio network operating with the second RAT.
5. The method according to claim 1 , in which the action unilaterally taken by the UE comprises:
disabling capability of the UE to perform an inter-radio access technology (RAT) procedure with radio networks operating with the second RAT.
6. The method according to claim 5 , the method comprising after the disabling:
the UE utilizing an authentication and key agreement (AKA) procedure to establish a new security context with an interim radio network operating with a third RAT;
and in response the UE automatically re-enabling the capability of the UE to perform the inter-radio access technology (RAT) procedure with radio networks operating with the second RAT.
7. The method according to claim 1 , wherein:
determining that the valid authentication is not a mutual authentication comprises the UE tracking that a ciphering key sequence number, included in a tracking area update message that the UE sends to the radio network operating with a second RAT, is related to a security context used in the first RAT which does not represent a mutual authentication; and
in response to the determining and further to receiving, from the radio network operating with a second RAT in response to the tracking area update message, a security mode command message having a security context flag set to indicate that the UE's security context is mapped, the action unilaterally taken by the UE comprises the UE sending a security mode reject message to the radio network operating with a second RAT.
8. The method according to claim 1 , wherein:
determining that the valid authentication is not a mutual authentication comprises the UE tracking that a ciphering key sequence number, included in a tracking area update message that the UE sends to the radio network operating with a second RAT, is related to a security context used in the first RAT which does not represent a mutual authentication; and
in response to the determining and further to receiving, from the radio network operating with a second RAT in response to the tracking area update message, a security mode command message, the action unilaterally taken by the UE comprises the UE ignoring the received security mode command message.
9. The method according to claim 1 , in which the method is executed by the UE or by one or more components thereof.
10. An apparatus for operating a user equipment (UE), the apparatus comprising a processing system, the processing system comprising at least one processor and at least one memory storing computer program code, wherein the at least one processor with the at least one memory and the computer program code are configured to cause the apparatus at least to:
determine that a valid authentication for the UE, generated with a radio network operating with a first radio access technology (RAT), is not a mutual authentication between the UE and the network operating with the first RAT;
and in response, cause the UE to unilaterally take action to prevent the valid authentication that is not a mutual authentication from being used to authenticate with a radio network operating with a second RAT that utilizes mutual authentication.
11. The apparatus according to claim 10 , in which the second RAT is Evolved Universal Terrestrial Access Radio Access (E-UTRA) and the first RAT is other than E-UTRA.
12. The apparatus according to claim 10 , in which the action unilaterally taken by the UE comprises including in a tracking area update request sent to the radio network operating with the second RAT an indication that the UE does not have a valid security context, regardless of the valid authentication that is not a mutual authentication.
13. The apparatus according to claim 10 , in which the action is unilaterally taken by the UE in response to the determining and further in response to the UE moving to the radio network operating with the second RAT, wherein the action comprises:
the UE deleting a security context associated with the valid authentication that is not a mutual authentication; and
the UE initiating a new attach procedure with the radio network operating with the second RAT which results in establishing a new security context with the radio network operating with the second RAT.
14. The apparatus according to claim 10 , in which the action unilaterally taken by the UE comprises:
disabling capability of the UE to perform an inter-radio access technology (RAT) procedure with radio networks operating with the second RAT.
15. The apparatus according to claim 14 , wherein the processing system is configured to cause the apparatus to cause the UE, after the disabling, to:
utilize an authentication and key agreement (AKA) procedure to establish a new security context with an interim radio network operating with a third RAT;
and in response automatically re-enable the capability of the UE to perform the inter-radio access technology (RAT) procedure with radio networks operating with the second RAT.
16. The apparatus according to claim 10 , wherein:
determining that the valid authentication is not a mutual authentication comprises the UE tracking that a ciphering key sequence number, included in a tracking area update message that the UE sends to the radio network operating with a second RAT, is related to a security context used in the first RAT which does not represent a mutual authentication; and
in response to the determining and further to receiving, from the radio network operating with a second RAT in response to the tracking area update message, a security mode command message having a security context flag set to indicate that the UE's security context is mapped, the action unilaterally taken by the UE comprises the UE sending a security mode reject message to the radio network operating with a second RAT.
17. The apparatue according to claim 10 , wherein:
determining that the valid authentication is not a mutual authentication comprises the UE tracking that a ciphering key sequence number, included in a tracking area update message that the UE sends to the radio network operating with a second RAT, is related to a security context used in the first RAT which does not represent a mutual authentication; and
in response to the determining and further to receiving, from the radio network operating with a second RAT in response to the tracking area update message, a security mode command message, the action unilaterally taken by the UE comprises the UE ignoring the received security mode command message.
18. A computer readable memory tangibly storing a set of computer instructions comprising code, comprising:
code for determining that a valid authentication for the UE, generated with a radio network operating with a first radio access technology (RAT), is not a mutual authentication between the UE and the network operating with the first RAT;
and code for, in response, causing the UE to unilaterally take action to prevent the valid authentication that is not a mutual authentication from being used to authenticate with a radio network operating with a second RAT that utilizes mutual authentication.
19. The computer readable memory according to claim 18 , in which the second RAT is Evolved Universal Terrestrial Access Radio Access (E-UTRA) and the first RAT is other than E-UTRA.
20. The computer readable memory according to claim 18 , in which the action unilaterally taken by the UE comprises including in a tracking area update request sent to the radio network operating with the second RAT an indication that the UE does not have a valid security context, regardless of the valid authentication that is not a mutual authentication.