System and method for wireless network access protection and security architecture
Wireless network specific (WN-specific) key can be used to provide access protection over the radio access link. A WN-specific key may be associated with (or assigned to) a wireless network, and distributed to access points of the wireless network, as well as to user equipments (UEs) following UE authentication. The WN-specific key is then used to encrypt/decrypt data transported over the radio access link. The WN-specific key can be used in conjunction with the UE-specific keys to provide multi-level access protection. In some embodiments, WN-specific keys are shared between neighboring wireless networks to reduce the frequency of key exchanges during handovers. Service-specific keys may be used to provide access protection to machine to machine (M2M) services. Group-specific keys may be used to provide access protection to traffic communicated between members of a private social network.
1. A method for wireless network access protection, the method comprising:
obtaining, by a base station, a wireless network specific key (WN-specific key) assigned to a wireless network to which the base station belongs;
receiving, by the base station, encrypted data from a user equipment (UE) over a wireless connection between the base station and the UE, the encrypted data having a first layer of encryption and a second layer of encryption, the base station being a network-side device configured to provide wireless access to the UE, the UE being a user-side device that is separate and distinct from the base station;
decrypting, by the base station, the first layer of encryption using the WN-specific key to obtain partially decrypted data, the partially decrypted data still having the second layer of encryption; and
forwarding, by the base station, the partially decrypted data to a gateway in the wireless network, the second layer of encryption of the partially decrypted data being decrypted by the gateway using a UE-specific key such that both the first layer of encryption and the second layer of encryption of the encrypted data are decrypted on the network-side of the wireless network using different keys.
2. The method of claim 1 , wherein the gateway comprises a user-specific serving gateway (SGW).
3. The method of claim 2 , wherein the UE-specific key is different than the WN-specific key.
4. The method of claim 2 , wherein the user-specific SGW and the base station are co-located on the same network-side device.
5. The method of claim 2 , wherein the user-specific SGW and the base station are located on different network-side devices.
6. The method of claim 2 , further comprising:
receiving a packet over the wireless connection;
attempting to partially decrypt the packet using the WN-specific key; and
dropping the packet when the attempt to partially decrypt the packet is unsuccessful.
7. The method of claim 6 , further comprising:
forwarding the packet to the user-specific SGW when the attempt to partially decrypt the packet is successful, wherein the user-specific SGW is adapted to attempt to further decrypt the packet using the UE-specific key, and to drop the packet when the attempt to further decrypt the packet using the UE-specific key is unsuccessful.
8. The method of claim 7 , wherein the first layer of encryption provides access protection to the wireless connection, and wherein the second layer of encryption provides access protection to a bearer channel extending between the UE and the user-specific SGW.
9. A base station comprising:
a processor; and
a non-transitory computer readable storage medium storing programming for execution by the processor, the programming including instructions to:
obtain a wireless network (WN) specific key assigned to a wireless network to which the base station belongs;
receive encrypted data from a user equipment (UE) over a wireless connection between the base station and the UE, the encrypted data having a first layer of encryption and a second layer of encryption, the base station being a network-side device configured to provide wireless access to the UE, the UE being a user-side device that is separate and distinct from the base station;
decrypt the first layer of encryption using the WN-specific key to obtain partially decrypted data, the partially decrypted data still having the second layer of encryption; and
forward the partially decrypted data to a gateway in the wireless network, the second layer of encryption of the partially decrypted data being decrypted by the gateway using a UE-specific key such that both the first layer of encryption and the second layer of encryption of the encrypted data are decrypted on the network-side of the wireless network using different keys.
10. The base station of claim 9 , wherein the gateway comprises a user-specific serving gateway (SGW).
11. The base station of claim 10 , wherein the UE-specific key is different than the WN-specific key.
12. The base station of claim 10 , wherein the user-specific SGW and the base station are co-located on the same network-side device.
13. The base station of claim 10 , wherein the user-specific SGW and the base station are located on different network-side devices.
14. The base station of claim 10 , wherein the programming further includes instructions to:
receive a packet over the wireless connection;
attempt to partially decrypt the packet using the WN-specific key; and
drop the packet when the attempt to partially decrypt the packet is unsuccessful.
15. The base station of claim 14 , wherein the programming further includes instructions to:
forward the packet to the user-specific SGW when the attempt to partially decrypt the packet is successful, wherein the user-specific SGW is adapted to attempt to further decrypt the packet using the UE-specific key, and to drop the packet when the attempt to further decrypt the packet using the UE-specific key is unsuccessful.
16. The base station of claim 15 , wherein the first layer of encryption provides access protection to the wireless connection, and wherein the second layer of encryption provides access protection to a bearer channel extending between the UE and the user-specific SGW.
17. The base station of claim 9 , wherein the WN-specific key is distributed to a set of base stations in the wireless network, and wherein handovers between base stations in the set of base stations occur without exchanging the WN-specific key during the handover.
18. The base station of claim 9 , wherein the WN-specific key is assigned to a group of wireless networks, and wherein handovers between wireless networks in the group of wireless networks occur without exchanging the WN-specific key during the handover.
19. The base station of claim 9 , wherein the encrypted data received over the wireless connection is encrypted symmetrically using the WN-specific key.
20. A computer program product comprising a non-transitory computer readable storage medium storing programming, the programming including instructions to:
obtain, by a base station, a wireless network (WN) specific key assigned to a wireless network to which the base station belongs;
receive, by the base station, encrypted data from a user equipment (UE) over a wireless connection between the base station and the UE, the encrypted data having a first layer of encryption and a second layer of encryption, the base station being a network-side device configured to provide wireless access to the UE, the UE being a user-side device that is separate and distinct from the base station;
decrypt, by the base station, the first layer of encryption using the WN-specific key to obtain partially decrypted data, the partially decrypted data still having the second layer of encryption; and
forward, by the base station, the partially decrypted data to a gateway in the wireless network, the second layer of encryption of the partially decrypted data being decrypted by the gateway using a UE-specific key such that both the first layer of encryption and the second layer of encryption of the encrypted data are decrypted on the network-side of the wireless network using different keys.