US 10,455,414 B2 · User-plane security for next generation cellular networks

Abstract

Securing user-plane data traffic between a device and a packet data network gateway (P-GW) may be accomplished at the device (e.g., chip component, client device) by obtaining, at the device, a first shared key, and obtaining, at the device, a second shared key based on the first shared key. The second shared key may be for securing user-plane data traffic during transit between the device and the P-GW. The second shared key is shared by the device and the P-GW. The data traffic may be secured based on the second shared key to produce first secured data traffic. The first secured data traffic may be sent to the P-GW via an access node. The P-GW and the access node are distinct network entities. The second shared key is unknown to the access node. The P-GW obtains the second shared key from a network entity that is distinct from the device.

Claims26

Dependent claims

A method, operational at a device, comprising:

obtaining, at the device, a first shared key;
obtaining, at the device, a second shared key based on the first shared key, wherein the second shared key:
serves to secure data traffic during transit between the device and a second device configured to execute functions of a data network gateway via an access node, is shared by the device and the second device, is not shared with the access node, and
is not shared with a third device configured to execute functions related to setting up, maintaining, and releasing physical channels;
securing data traffic based on the second shared key to produce first secured data traffic;
and
sending the first secured data traffic to the second device via the access node, wherein the second device and the access node are distinct network entities;
and
wherein the second shared key secures at least some layers of user-plane communications while a different key secures control-plane communications.

6 more elements

A device, comprising:

a wireless communication circuit configured to communicate with an access node of a cellular network:
a processing circuit coupled to the wireless communication circuit, the processing circuit configured to:
obtain a first shared key;
obtain a second shared key based on the first shared key, wherein the second shared key:
serves to secure data traffic during transit between the device and a second device configured to execute functions of a data network gateway via the access node,
is shared by the device and the second device,
is not shared with the access node, and
is not shared with a third device configured to execute functions related to setting up, maintaining, and releasing physical channels;
secure data traffic based on the second shared key to produce first secured data traffic;
and
send the first secured data traffic to the second device via the access node, wherein the second device and the access node are distinct network entities;
and
wherein the second shared key secures at least some layers of user-plane communications while a different key secures control-plane communications.

10 more elements

A device, comprising:

means for obtaining a first shared key;
means for obtaining a second shared key based on the first shared key, wherein the second shared key:
serves to secure data traffic during transit between the device and a second device configured to execute functions of a data network gateway via an access node,
is shared by the device and the second device,
is not shared with the access node, and
is not shared with a third device configured to execute functions related to setting up, maintaining, and releasing physical channels;
means for securing data traffic based on the second shared key to produce first secured data traffic;
and
means for sending the first secured data traffic to the second device via the access node, wherein the second device and the access node are distinct network entities;
and
wherein the second shared key secures at least some layers of user-plane communications while a different key secures control-plane communications.

8 more elements

A non-transitory machine-readable storage medium having one or more instructions stored thereon, which when executed by at least one processor causes the at least one processor to:

obtain a first shared key;
obtain a second shared key based on the first shared key, wherein the second shared key:
serves to secure data traffic during transit between a device and a second device configured to execute functions of a data network gateway via an access node,
is shared by the device and the second device,
is not shared with the access node, and
is not shared with a third device configured to execute functions related to setting up, maintaining, and releasing physical channels;
secure data traffic based on the second shared key to produce first secured data traffic;
and
send the first secured data traffic to the second device via the access node, wherein the second device and the access node are distinct network entities;
and
wherein the second shared key secures at least some layers of user-plane communications while a different key secures control-plane communications.

8 more elements

Dependencies are inferred from the claim text.

User-plane security for next generation cellular networks

Life of this patent

User-plane security for next generation cellular networks

Life of this patent

Abstract

Claims26