# US 11,121,862 B2 · System and method for wireless network access protection and security architecture > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,121,862 B2 - Document ID: US11121862B2 - Status: Granted - Kind: B2 - Application number: 16/704,410 - Filed: 2019-12-05 - Published: 2020-04-09 - Granted: 2021-09-14 - Earliest claimed: 2014-07-03 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Hang Zhang - Web page: https://patentgrep.com/patent/US11121862B2 ## CPC - H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/033: of the user plane, e.g. user's traffic - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04W 12/06: Authentication - H04W 12/08: Access security - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Wireless network specific (WN-specific) key can be used to provide access protection over the radio access link. A WN-specific key may be associated with (or assigned to) a wireless network, and distributed to access points of the wireless network, as well as to user equipments (UEs) following UE authentication. The WN-specific key is then used to encrypt/decrypt data transported over the radio access link. The WN-specific key can be used in conjunction with the UE-specific keys to provide multi-level access protection. In some embodiments, WN-specific kays are shared between neighboring wireless networks to reduce the frequency of key exchanges during handovers. Service-specific keys may be used to provide access protection to machine to machine (M2M) services. Group-specific keys may be used to provide access protection to traffic communicated between members of a private social network. ## Claims ### Claim 1 A method comprising: obtaining, by an apparatus, at least two keys of a wireless network (WN)-specific key, a user equipment (UE)-specific key, or a virtual network (VN)-specific key assigned to a wireless network; and transmitting, by the apparatus to a base station in the wireless network, encrypted data using the at least two keys over a wireless connection between the base station and the apparatus, wherein the WN-specific key provides a first level access protection over wireless connection between the base station and the apparatus, wherein the UE-specific key provides a second level access protection over a bearer path to a gateway, the bearer path including a bearer channel between the base station and the gateway, and wherein the VN-specific key provides a third level access protection over a virtual path extending through a VN. ### Claim 2 (depends on 1) The method of claim 1, wherein the base station is between the apparatus and the gateway, and the gateway is one of a serving gateway (SGW), or a packet data network (PDN) gateway (PGW) in an evolved packet core (EPC). ### Claim 3 (depends on 1) The method of claim 1, wherein the bearer path corresponds to the virtual path in the VN mapped from the wireless network. ### Claim 4 (depends on 1) The method of claim 1, wherein the apparatus is authorized and authenticated by a global authentication center, the global authentication center being independent from an operator of the wireless network. ### Claim 5 (depends on 4) The method of claim 4, wherein the obtaining comprises: obtaining, by the apparatus, the UE-specific key from a WN protection controller in the wireless network, wherein the WN protection controller provides the UE-specific key to the gateway. ### Claim 6 (depends on 5) The method of claim 5, further comprising: moving, by the apparatus, from a coverage area of the wireless network to a second coverage area of a second wireless network, wherein the UE-specific key is transferred from the WN protection controller in the wireless network to a second WN protection controller in the second wireless network, and wherein the second WN protection controller provides the UE-specific key to a second gateway in the second wireless network. ### Claim 7 (depends on 4) The method of claim 4, wherein the apparatus is a head apparatus of a group of apparatuses, the method further comprising: receiving, by the apparatus from a WN protection controller in the wireless network, a group-specific key after the apparatus is authorized and authenticated by the global authentication center, the group-specific key being used for encryption of group-related traffic in a private network. ### Claim 8 (depends on 7) The method of claim 7, further comprising: receiving, by the apparatus, a registration request sent by a second apparatus of the group of apparatuses, the registration request forwarded from the global authentication center to the apparatus, the registration request indicating that the second apparatus attempts to register as a participant of the private network; and sending, by the apparatus to the WN protection controller in the wireless network, an authentication confirmation, wherein the WN protection controller forwards the group-specific key to the second apparatus in response to the authentication confirmation. ### Claim 9 An apparatus comprising: one or more hardware processors; and a non-transitory computer-readable storage medium storing programming for execution by the one or more hardware processors to perform operations, the operations comprising: obtaining at least two keys of a wireless network (WN)-specific key, a user equipment (UE)-specific key, or a virtual network (VN)-specific key assigned to a wireless network; and transmitting, to a base station in the wireless network, encrypted data using the at least two keys over a wireless connection between the base station and the apparatus, wherein the WN-specific key provides a first level access protection over wireless connection between the base station and the apparatus, wherein the UE-specific key provides a second level access protection over a bearer path to a gateway, the bearer path including a bearer channel between the base station and the gateway, and wherein the VN-specific key provides a third level access protection over a virtual path extending through a VN. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the base station is between the apparatus and the gateway, and the gateway is one of a serving gateway (SGW), or a packet data network (PDN) gateway (PGW) in an evolved packet core (EPC). ### Claim 11 (depends on 9) The apparatus of claim 9, wherein the bearer path corresponds to the virtual path in the VN mapped from the wireless network. ### Claim 12 (depends on 9) The apparatus of claim 9, wherein the apparatus is authorized and authenticated by a global authentication center, the global authentication center being independent from an operator of the wireless network. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the obtaining comprises: obtaining the UE-specific key from a WN protection controller in the wireless network, wherein the WN protection controller provides the UE-specific key to the gateway. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the operations further comprise: moving from a coverage area of the wireless network to a second coverage area of a second wireless network, wherein the UE-specific key is transferred from the WN protection controller in the wireless network to a second WN protection controller in the second wireless network, and wherein the second WN protection controller provides the UE-specific key to a second gateway in the second wireless network. ### Claim 15 (depends on 12) The apparatus of claim 12, wherein the apparatus is a head apparatus of a group of apparatuses, the operations further comprising: receiving, by the apparatus from a WN protection controller in the wireless network, a group-specific key after the apparatus is authorized and authenticated by the global authentication center, the group-specific key being used for encryption of group-related traffic in a private network. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the operations further comprise: receiving a registration request sent by a second apparatus of the group of apparatuses, the registration request forwarded from the global authentication center to the apparatus, and the registration request indicating that the second apparatus attempts to register as a participant of the private network; and sending, to the WN protection controller in the wireless network, an authentication confirmation, wherein the WN protection controller forwards the group-specific key to the second apparatus in response to the authentication confirmation. ### Claim 17 A non-transitory computer-readable medium having instructions stored thereon that, when executed by an apparatus, cause the apparatus to perform operations, the operations comprising: obtaining at least two keys of a wireless network (WN)-specific key, a user equipment (UE)-specific key, or a virtual network (VN)-specific key assigned to a wireless network; and transmitting, to a base station in the wireless network, encrypted data using the at least two keys over a wireless connection between the base station and the apparatus, wherein the WN-specific key provides a first level access protection over wireless connection between the base station and the apparatus, wherein the UE-specific key provides a second level access protection over a bearer path to a gateway, the bearer path including a bearer channel between the base station and the gateway, and wherein the VN-specific key provides a third level access protection over a virtual path extending through a VN. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the apparatus is authorized and authenticated by a global authentication center, the global authentication center being independent from an operator of the wireless network. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the obtaining comprises: obtaining the UE-specific key from a WN protection controller in the wireless network, wherein the WN protection controller provides the UE-specific key to the gateway. ### Claim 20 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the apparatus is a head apparatus of a group of apparatuses, the operations further comprising: receiving, from a WN protection controller in the wireless network, a group-specific key after the apparatus is authorized and authenticated by the global authentication center, the group-specific key being used for encryption of group-related traffic in a private network.