# US 10,375,609 B2 · Operation of a serving node in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,609 B2 - Document ID: US10375609B2 - Status: Granted - Kind: B2 - Application number: 16/047,271 - Filed: 2018-07-27 - Published: 2018-12-13 - Granted: 2019-08-06 - Earliest claimed: 2012-01-26 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget Lm Ericsson (Publ) - Inventors: Karl Norrman - Web page: https://patentgrep.com/patent/US10375609B2 ## CPC - H04W 36/0038: {of security context information} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 12/08: Access security - H04W 12/12: Detection or prevention of fraud - H04W 36/0083: {Determination of parameters used for hand-off, e.g. generation or modification of neighbour cell lists} - H04W 40/04: based on wireless node resources - H04W 36/08: Reselecting an access point - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The invention provides a system and method for repairing corrupt security information. At a serving node in a telecommunications network, security capabilities of a terminal are received when the terminal registers with the serving node. The received security capabilities are stored. A path switch request message is received from a target base station following an X2 handover request sent from a source base station to the target base station for handover of the terminal, the path switch request including the security capabilities of the terminal. The serving node determines whether the security capabilities of the terminal stored in the storage medium should be sent to the target base station. If so, the serving node sends the stored security capabilities of the terminal to the target base station for use in reselecting security algorithms to be used in communications between the target base station and terminal following the handover. ## Claims ### Claim 1 A first base station for use in a telecommunications network, comprising: a communications unit for sending and receiving data; a storage medium for storing data; and a control unit for controlling the operation of the communications unit and the storage medium; wherein the communications unit is configured to receive a handover request for handover of a terminal from a source base station, the handover request including security capabilities of the terminal; the control unit is configured to select security algorithms for use in communications between the first base station and the terminal following the handover, the selection of the security algorithms being based on the received security capabilities of the terminal; the communications unit is configured to send a path switch request to a serving node, the path switch request including the received security capabilities; the communications unit is configured to receive a first message comprising replacement security capabilities of the terminal; and the communications unit is configured to send a second message to a second base station, wherein the second message comprises the replacement security capabilities of the terminal. ### Claim 2 (depends on 1) The base station of claim 1, wherein the second base station is configured to select new security algorithms for use in communications between the second base station and the terminal based on at least the replacement security capabilities. ### Claim 3 (depends on 1) The base station of claim 1, wherein the control unit is configured to determine whether the replacement security capabilities received from the serving node are different to the security capabilities received in the handover request. ### Claim 4 (depends on 1) The base station of claim 1, wherein the communications unit is configured to receive the replacement security capabilities in a context modification request from the serving node. ### Claim 5 (depends on 1) The base station of claim 1, wherein the communications unit is configured to receive the replacement security capabilities in a path switch request acknowledgement message. ### Claim 6 (depends on 1) The base station of claim 1, wherein the communications unit is configured to send a handover command message to the terminal before sending a path switch request to the serving node, the handover command message including an indication of the selected security algorithms. ### Claim 7 (depends on 1) The base station of claim 1, wherein the network is an LTE network and the base station is an eNB. ### Claim 8 A method of operating a first base station in a telecommunications network, comprising: receiving a handover request for handover of a terminal from a source base station, the handover request including security capabilities of the terminal; selecting security algorithms for use in communications between the first base station and the terminal following the handover, the selection of the security algorithms being based on the received security capabilities of the terminal; sending a path switch request to a serving node, the path switch request including the security capabilities of the terminal; receiving a first message comprising replacement security capabilities of the terminal; and sending a second message to a second base station, wherein the second message comprises the replacement security capabilities of the terminal. ### Claim 9 (depends on 8) The method of claim 8, wherein the second base station is configured to select new security algorithms for use in communications between the second base station and the terminal based on at least the replacement security capabilities. ### Claim 10 (depends on 8) The method of claim 8, further comprising: determining whether the replacement security capabilities received from the serving node are different to the security capabilities received in the handover request. ### Claim 11 (depends on 8) The method of claim 8, wherein the replacement security capabilities are received in a context modification request from the serving node. ### Claim 12 (depends on 8) The method of claim 8, wherein the replacement security capabilities are received in a path switch request acknowledgement message. ### Claim 13 (depends on 8) The method of claim 8, further comprising: sending a handover command message to the terminal before sending a path switch request to the serving node, the handover command message including an indication of the selected security algorithms. ### Claim 14 (depends on 8) The method of claim 8, wherein the network is an LTE network and the base station is an eNB. ### Claim 15 A computer program product comprising a non-transitory computer readable medium storing a computer program for a first base station in a telecommunications network, said computer program comprises code which run by a processor causes said processor to: receive a handover request for handover of a terminal from a source base station, the handover request including security capabilities of the terminal; select security algorithms for use in communications between the first base station and the terminal following the handover, the selection of the security algorithms being based on the received security capabilities of the terminal; send a path switch request to a serving node, the path switch request including the security capabilities of the terminal; receive a first message comprising replacement security capabilities; and sending a second message to a second base station, wherein the second message comprises the replacement security capabilities of the terminal. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the second base station is configured to select new security algorithms for use in communications between the second base station and the terminal based on at least the replacement security capabilities.