# US 11,310,266 B2 · Mobile communication method, apparatus, and device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,266 B2 - Document ID: US11310266B2 - Status: Granted - Kind: B2 - Application number: 17/138,498 - Filed: 2020-12-30 - Published: 2021-06-24 - Granted: 2022-04-19 - Earliest claimed: 2016-01-05 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Jing Chen; Qi Li; Lin Shu - Web page: https://patentgrep.com/patent/US11310266B2 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 8/24: Transfer of terminal data - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/106: Packet or message integrity - H04W 12/12: Detection or prevention of fraud - H04W 12/125: Protection against power exhaustion attacks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The present disclosure relates to mobile communications technologies, and in particular, to a mobile communication method, apparatus, and device. The method includes: receiving, by user equipment UE, a non-access stratum NAS security mode command message from a mobility management entity MME, where the NAS security mode command message carries first verification matching information used to verify UE capability information received by the MME; determining, by the UE based on the first verification matching information, whether the UE capability information received by the MME is consistent with UE capability information sent by the UE to the MME; and if the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME, sending, by the UE, a NAS security mode complete message to the MME. ## Claims ### Claim 1 A mobile communication method, comprising: sending, by a user equipment (UE), a non-access stratum (NAS) message to a mobility management entity; receiving, by the UE, a NAS security mode command message from the mobility management entity, wherein the NAS security mode command message comprises verification matching information, a UE security capability, an integrity algorithm, a key identifier, and a NAS message authentication code (NAS-MAC); verifying, by the UE, the UE security capability and the NAS-MAC; and sending, by the UE according to the verification matching information, a security protected NAS security mode complete message including the NAS message to the mobility management entity after both the UE security capability and the NAS-MAC are verified successfully. ### Claim 2 (depends on 1) The method according to claim 1, wherein the verification matching information is a first hash value, and wherein sending, by the UE according to the verification matching information, the security protected NAS security mode complete message including the NAS message to the mobility management entity comprises: determining, by the UE, whether a second hash value is consistent with the first hash value, wherein the second hash value is a hash value of the NAS message; and sending, by the UE, the security protected NAS security mode complete message including the NAS message to the mobility management entity in response to determining that the second hash value is inconsistent with the first hash value. ### Claim 3 (depends on 1) The method according to claim 1, wherein the NAS-MAC is a first NAS-MAC, and the UE security capability is a first UE security capability, and wherein verifying the UE security capability and the NAS-MAC comprises: calculating, by the UE, a second NAS-MAC of the NAS security mode command message; and determining, by the UE, whether the first NAS-MAC is consistent with the second NAS-MAC and the first UE security capability is consistent with a second UE security capability, wherein the second UE security capability is sent by the UE to the mobility management entity. ### Claim 4 (depends on 1) The method according to claim 1, wherein the NAS security mode complete message comprises a third NAS-MAC of the NAS security mode complete message. ### Claim 5 (depends on 1) The method according to claim 1, wherein the NAS message is an attach request message. ### Claim 6 (depends on 5) The method according to claim 5, wherein the attach request message further comprises UE capability information. ### Claim 7 (depends on 6) The method according to claim 6, wherein the UE capability information is information of the UE subject to modification. ### Claim 8 (depends on 6) The method according to claim 6, wherein the UE capability information comprises at least one of: a mobile station (MS) network capability; a mobile station classmark 2; a mobile station classmark 3; supported codecs; an additional update type; voice domain preference and UE's usage setting; or mobile station network feature support. ### Claim 9 (depends on 1) The method according to claim 1, wherein the method further comprises: sending, by the UE, a NAS security mode reject message to the mobility management entity when determining that the UE security capability or the NAS-MAC is verified unsuccessfully. ### Claim 10 (depends on 1) The method according to claim 1, wherein the verification matching information is a first hash value of a received NAS message of the mobility management entity. ### Claim 11 A mobile communication method, comprising: receiving, by a mobility management entity, a non-access stratum (NAS) message from a user equipment (UE), wherein the NAS message comprises a UE security capability; and sending, by the mobility management entity, a NAS security mode command message to the UE, wherein the NAS security mode command message comprises verification matching information, an integrity algorithm, a key identifier, a first NAS message authentication code (NAS-MAC), and the UE security capability, and wherein the verification matching information indicates sending a security protected NAS security mode complete message including the NAS message. ### Claim 12 (depends on 11) The method according to claim 11, wherein the verification matching information is a hash of the NAS message. ### Claim 13 (depends on 10) The method according to claim 10, wherein the NAS message is an attach request. ### Claim 14 An apparatus, comprising: at least one processor; and a memory coupled to the at least one processor and having program instructions stored thereon which, when executed by the at least one processor, cause the apparatus to: send a non-access stratum (NAS) message to a mobility management entity; receive a NAS security mode command message from the mobility management entity, wherein the NAS security mode command message comprises verification matching information, a user equipment (UE) security capability, an integrity algorithm, a key identifier, and a NAS message authentication code (NAS-MAC); verify the UE security capability and the NAS-MAC; and send, according to the verification matching information, a security protected NAS security mode complete message including the NAS message to the mobility management entity after both the UE security capability and the NAS-MAC are verified successfully. ### Claim 15 (depends on 14) The apparatus according to claim 14, wherein the verification matching information is a first hash value, and wherein the program instructions, when executed by the at least one processor, further cause the apparatus to: determine whether a second hash value is consistent with the first hash value, wherein the second hash value is a hash value of the NAS message; and send the security protected NAS security mode complete message including the NAS message to the mobility management entity in response to determining that the second hash value is inconsistent with the first hash value. ### Claim 16 (depends on 14) The apparatus according to claim 14, wherein the NAS-MAC is a first NAS-MAC, and the UE security capability is a first UE security capability, and wherein the program instructions, when executed by the at least one processor, further cause the apparatus to: calculate a second NAS-MAC of the NAS security mode command message; and determine whether the first NAS-MAC is consistent with the second NAS-MAC and the first UE security capability is consistent with a second UE security capability, wherein the second UE security capability is sent by a UE to the mobility management entity. ### Claim 17 (depends on 14) The apparatus according to claim 14, wherein the NAS security mode complete message comprises a third NAS-MAC of the NAS security mode complete message. ### Claim 18 (depends on 14) The apparatus according to claim 14, wherein the NAS message is an attach request message. ### Claim 19 (depends on 18) The apparatus according to claim 18, wherein the attach request message further comprises UE capability information. ### Claim 20 (depends on 19) The apparatus according to claim 19, wherein the UE capability information is information of the UE subject to modification. ### Claim 21 (depends on 19) The apparatus according to claim 19, wherein the UE capability information comprises at least one of: a mobile station (MS) network capability; a mobile station classmark 2; a mobile station classmark 3; supported codecs; an additional update type; voice domain preference and UE's usage setting; or mobile station network feature support. ### Claim 22 (depends on 14) The apparatus according to claim 14, wherein the program instructions, when executed by the at least one processor, further cause the apparatus to: send a NAS security mode reject message to the mobility management entity when determining that the UE security capability or the NAS-MAC is verified unsuccessfully. ### Claim 23 (depends on 14) The apparatus according to claim 14, wherein the verification matching information is a first hash value of a received NAS message of the mobility management entity. ### Claim 24 An apparatus comprising: at least one processor; and a memory coupled to the at least one processor and having program instructions stored thereon which, when executed by the at least one processor, cause the apparatus to: receive a non-access stratum (NAS) message from a user equipment (UE), wherein the NAS message comprises a UE security capability; and send a NAS security mode command message to the UE, wherein the NAS security mode command message comprises verification matching information, an integrity algorithm, a key identifier, a first NAS message authentication code (NAS-MAC), and the UE security capability, and wherein the verification matching information indicates sending a security protected NAS security mode complete message including the NAS message. ### Claim 25 (depends on 24) The apparatus according to claim 24, wherein wherein the verification matching information is a hash of the NAS message. ### Claim 26 (depends on 24) The apparatus according to claim 24, wherein the NAS message is an attach request.