# US 12,003,533 B2 · Mobile communication method, apparatus, and device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,533 B2 - Document ID: US12003533B2 - Status: Granted - Kind: B2 - Application number: 18/355,671 - Filed: 2023-07-20 - Published: 2024-03-21 - Granted: 2024-06-04 - Earliest claimed: 2016-01-05 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Jing Chen; Qi Li; Lin Shu - Web page: https://patentgrep.com/patent/US12003533B2 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 8/24: Transfer of terminal data - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/106: Packet or message integrity - H04W 12/12: Detection or prevention of fraud - H04W 12/125: Protection against power exhaustion attacks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The present disclosure relates to mobile communications technologies, and in particular, to a mobile communication method, apparatus, and device. The method includes: receiving, by user equipment UE, a non-access stratum NAS security mode command message from a mobility management entity MME, where the NAS security mode command message carries first verification matching information used to verify UE capability information received by the MIME; determining, by the UE based on the first verification matching information, whether the UE capability information received by the MME is consistent with UE capability information sent by the UE to the MIME; and if the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME, sending, by the UE, a NAS security mode complete message to the MME. ## Claims ### Claim 1 A mobile communication method, comprising: sending a first user equipment (UE) security capability of a UE to a mobility management entity; receiving a non-access stratum (NAS) security mode command message from the mobility management entity, wherein the NAS security mode command message carries a second UE security capability; verifying integrity of the NAS security mode command message and whether the second UE security capability is consistent with the first UE security capability; and after successfully verifying both the integrity of the NAS security mode command message and the second UE security capability is consistent with the first UE security capability, sending UE capability information in a security protected NAS message to the mobility management entity, wherein the UE capability information indicates a service that can be used by the UE. ### Claim 2 (depends on 1) The method according to claim 1, wherein the UE capability information comprises the first UE security capability and a capability other than the first UE security capability and wherein the capability other than the first UE security capability indicates the service that can be used by the UE. ### Claim 3 (depends on 1) The method according to claim 1, wherein the UE capability information comprises the first UE security capability and at least one of: a mobile station (MS) network capability; a mobile station classmark 2; a mobile station classmark 3; supported codecs; an additional update type; a capability indicating whether the UE is capable of using a voice call service; or mobile station network feature support. ### Claim 4 (depends on 3) The method according to claim 3, wherein the capability indicating whether the UE is capable of using the voice call service is a voice domain preference and UE's usage setting. ### Claim 5 (depends on 1) The method according to claim 1, wherein the NAS security mode command message further comprises a first non-access stratum message authentication code (NAS-MAC) of the NAS security mode command message, and the verifying integrity of the NAS security mode command message comprises: calculating a second NAS-MAC of the NAS security mode command message; and determining whether the second NAS-MAC is consistent with the first NAS-MAC. ### Claim 6 (depends on 5) The method according to claim 5, wherein the NAS security mode command message further comprises an integrity algorithm used by the mobility management entity and a key identifier. ### Claim 7 (depends on 1) The method according to claim 1, wherein the security protected NAS message is a NAS security mode complete message, wherein the NAS security mode complete message comprises a NAS-MAC of the NAS security mode complete message for performing security protection on the NAS security mode complete message. ### Claim 8 (depends on 1) The method according to claim 1, wherein the sending the UE capability information comprises: sending the UE capability information in response to a request from the mobility management entity. ### Claim 9 (depends on 1) The method according to claim 1, wherein the sending the first UE security capability to the mobility management entity comprises: sending a NAS message including the first UE security capability to the mobility management entity, wherein the NAS message is unprotected by a NAS security context. ### Claim 10 (depends on 9) The method according to claim 9, wherein the NAS message is an attach request message. ### Claim 11 (depends on 1) The method according to claim 1, wherein the method is implemented by an apparatus deployed in the UE. ### Claim 12 An apparatus, comprising: at least one processor coupled to a memory storing programming instructions for execution by the at least one processor to cause the apparatus to: send a first user equipment (UE) security capability of a UE to a mobility management entity; receive a non-access stratum (NAS) security mode command message from the mobility management entity, wherein the NAS security mode command message carries a second UE security capability; verify integrity the NAS security mode command message and whether the second UE security capability is consistent with the first UE security capability; and after successfully verifying both the integrity of the NAS security mode command message and the second UE security capability is consistent with the first UE security capability, send UE capability information in a security protected NAS message to the mobility management entity, wherein the UE capability information indicates a service that can be used by the UE. ### Claim 13 (depends on 12) The apparatus according to claim 12, wherein the UE capability information comprises the first UE security capability and a capability other than the first UE security capability, and wherein the capability other than the first UE security capability indicates the service that can be used by the UE. ### Claim 14 (depends on 12) The apparatus according to claim 12, wherein the UE capability information comprises the first UE security capability and at least one of: a mobile station (MS) network capability; a mobile station classmark 2; a mobile station classmark 3; supported codecs; an additional update type; a capability indicating whether the UE is capable of using a voice call service; or mobile station network feature support. ### Claim 15 (depends on 14) The apparatus according to claim 14, wherein the capability indicating whether the UE is capable of using the voice call service is a voice domain preference and UE's usage setting. ### Claim 16 (depends on 12) The apparatus according to claim 12, wherein the NAS security mode command message further comprises a first non-access stratum message authentication code (NAS-MAC) of the NAS security mode command message and wherein the programming instructions are for execution by the at least one processor to cause the apparatus to verify the integrity of the NAS security mode command message by: calculating a second NAS-MAC of the NAS security mode command message; and determining whether the second NAS-MAC is consistent with the first NAS-MAC. ### Claim 17 (depends on 12) The apparatus according to claim 12, wherein the security protected NAS message is a NAS security mode complete message, wherein the NAS security mode complete message comprises a NAS-MAC of the NAS security mode complete message for performing security protection on the NAS security mode complete message. ### Claim 18 (depends on 12) The apparatus according to claim 12, wherein the programming instructions are for execution by the at least one processor to cause the apparatus to send the UE capability information by: sending the UE capability information in response to a request from the mobility management entity. ### Claim 19 (depends on 12) The apparatus according to claim 12, wherein the programming instructions are for execution by the at least one processor to cause the apparatus to send the first UE security capability to the mobility management entity by: sending a NAS message including the first UE security capability to the mobility management entity, wherein the NAS message is unprotected by a NAS security context. ### Claim 20 (depends on 12) The apparatus according to claim 12, wherein the apparatus is deployed in the UE.