US 10,567,964 B2 · Security for proxied devices

Abstract

A method includes establishing, by a mobile device in a wireless network, an indirect connection of a first device to a node of the wireless network using the mobile device as an intermediate node for wireless transport and transferring, by the mobile device, data over the indirect connection via a first wireless link comprising a direct device connection between the first device and the mobile device and a second wireless link comprising a direct 3GPP (3rd Generation Partnership Project) connection between the mobile device and the wireless network. The indirect connection supports security protection of communications between the node of the wireless network and the first device based at least in part on an active security context maintained within the wireless network for communication via at least one messaging protocol layer with at least the first device.

Claims20

Dependent claims

A method comprising:

operating, by a mobile device in a wireless network, as a proxy protocol entity comprising a proxy access stratum (AS) entity;
establishing, by the proxy AS entity, an indirect connection of a first device to a node of the wireless network using the mobile device as an intermediate node for wireless transport, the indirect connection comprising an AS protocol layer;
and
transferring, by the proxy AS entity, data over the indirect connection via a first wireless link comprising a direct device connection between the first device and the mobile device and a second wireless link comprising a direct 3GPP (3rd Generation Partnership Project) connection between the mobile device and the node of the wireless network;
wherein a security association for the AS protocol layer is between the first device and the node of the wireless network, such that signaling and data traffic through the mobile device are protected at the AS protocol layer.

2 more elements

A cellular communication device comprising:

at least one transceiver;
a non-transitory memory storage comprising instructions;
and
one or more processors in communication with the memory and the at least one transceiver,
wherein the one or more processors execute the instructions to:
operate as a proxy protocol entity comprising a proxy access stratum (AS) entity;
configure the at least one transceiver to receive and transmit cellular communications with a base station;
configure the at least one transceiver to receive and transmit signals with a remote device via a lower power communication link;
route, using the proxy AS entity, communications intended for the cellular communication device and the remote device;
and
provide secure communications with the remote device via at least one messaging protocol layer such that the cellular communication device operates as a secure relay between the remote device and the base station, multiplexing radio resource control (RRC) messages for both the cellular communication device and the remote device over a single wireless RRC connection to the base station;
and
wherein the remote device and the base station share at least one security key usable to protect data for the remote device, the at least one security key being associated by the base station with a data radio bearer (DRB) for the remote device, the DRB for the remote device being associated with a network bearer identified in the base station based at least in part on a tunnel endpoint identifier (TEID), and wherein data protected with the at least one security key is delivered by the cellular communication device between the remote device and the base station, protected at an AS protocol layer.

10 more elements

A base station comprising:

a non-transitory memory storage comprising instructions;
and
one or more processors in communication with the memory, wherein the one or more processors execute the instructions to:
establish a user equipment (UE) radio resource control (RRC) connection to a UE;
access security portions of a UE context and a remote device context for a remote device, each context comprising separate access stratum (AS);
and
perform encryption operations using separate encryption keys for the UE and the remote device such that communications for the UE are encrypted using a UE key and communications for the remote device are encrypted using a remote device key;
and
wherein the remote device and the base station share the remote device key to protect communications for the remote device, the remote device key being associated by the base station with a data radio bearer (DRB) for the remote device, the DRB for the remote device being associated with a network bearer identified in the base station based at least in part on a tunnel endpoint identifier (TEID), and wherein communications between the base station and the remote device are sent and received over the UE RRC connection to the UE operating as a proxy RRC entity.

6 more elements

Dependencies are inferred from the claim text.

Security for proxied devices

Life of this patent

Security for proxied devices

Life of this patent

Abstract

Claims20