# US 12,192,765 B2 · Management of user equipment security capabilities in communication system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,765 B2 - Document ID: US12192765B2 - Status: Granted - Kind: B2 - Application number: 17/430,690 - Filed: 2020-01-29 - Published: 2022-06-23 - Granted: 2025-01-07 - Earliest claimed: 2019-02-15 - Assignees: Nokia Technologies Oy - Applicants: Nokia Technologies Oy - Inventors: Jennifer Liu - Web page: https://patentgrep.com/patent/US12192765B2 ## CPC - H04W 12/106: Packet or message integrity - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 67/303: Terminal profiles - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04W 36/0038: {of security context information} - H04L 69/28: Timers or timing mechanisms used in protocols - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for security management in communication systems are provided. For example, a method includes receiving, from user equipment, a request indicating one or more security capabilities of the user equipment. The method also includes determining whether the indicated one or more security capabilities meet one or more designated criteria of a communication network, and rejecting the request by the user equipment responsive to determining that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network. For example, the request is rejected when it is determined that the user equipment does not support any encryption and/or integrity algorithms, or fails to support mandatory encryption and/or integrity algorithms. This serves to prevent malicious user equipment from gaining access to the communication network. ## Claims ### Claim 1 An apparatus comprising: at least one processor; at least one memory including computer program code; the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to: receive, from user equipment, a request indicating one or more security capabilities of the user equipment; determine whether the indicated one or more security capabilities meet one or more designated criteria of a communication network; reject the request by the user equipment responsive to determining that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network; and send a rejection notification to the user equipment, the rejection notification comprising a failure cause indication based at least in part on the determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network; wherein the failure cause indication comprises a cause code indicating to the user equipment that an initial access request or a mobility request has failed due to the one or more security capabilities of the user equipment not being acceptable to the communication network. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the rejection notification further comprises a back-off timer value. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the initial access request comprises an initial registration request or an initial attach request and the mobility request comprises a mobility registration request or a mobility tracking area update request. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the indicated one or more security capabilities comprise an indication of one or more encryption algorithms supported by the user equipment, and further wherein the determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network comprises determining that the user equipment (i) does not support any encryption algorithm or (ii) fails to support a mandatory encryption algorithm. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the indicated one or more security capabilities comprise an indication of one or more integrity algorithms supported by the user equipment, and further wherein the determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network comprises determining that the user equipment (i) does not support any integrity algorithm or (ii) fails to support a mandatory integrity algorithm. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the communication network comprises a 5G network and the apparatus comprises an access and mobility management function (AMF) of the 5G network. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the communication network comprises a 4G network and the apparatus comprises mobility management entity (MME) of the 4G network. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the failure cause indication comprises a 5G System (5GS) mobility management (5GMM) cause value. ### Claim 9 (depends on 1) The apparatus of claim 1, wherein the failure cause indication comprises an Evolved Packet System (EPS) mobility management (EMM) cause value. ### Claim 10 (depends on 1) The apparatus of claim 1, wherein the failure cause indication signals the user equipment to (i) abort a registration procedure with the communication network and (ii) reset a registration attempt counter. ### Claim 11 A method comprising: receiving, from user equipment, a request indicating one or more security capabilities of the user equipment; determining whether the indicated one or more security capabilities meet one or more designated criteria of a communication network; rejecting the request by the user equipment responsive to determining that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network; and sending a rejection notification to the user equipment, the rejection notification comprising a failure cause indication based at least in part on the determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network; wherein the failure cause indication comprises a cause code indicating to the user equipment that an initial access request or a mobility request has failed due to the one or more security capabilities of the user equipment not being acceptable to the communication network. ### Claim 12 (depends on 11) An article of manufacture comprising a non-transitory computer-readable storage medium having embodied therein executable program code that when executed by a processor causes the processor to perform the steps of claim 11. ### Claim 13 An apparatus comprising: at least one processor; at least one memory including computer program code; the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to: send, to a security management node in a communication network, a request indicating one or more security capabilities of the apparatus; and receive, from the security management node, a rejection notification responsive to the indicated one or more security capabilities not meeting one or more designated criteria of the communication network; wherein the rejection notification comprises a failure cause indication based at least in part on a determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network; and wherein the failure cause indication comprises a cause code indicating to the apparatus that an initial access request or a mobility request has failed due to the one or more security capabilities of the apparatus not being acceptable to the communication network. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the initial access request comprises an initial registration request or an initial attach request and the mobility request comprises a mobility registration request or a mobility tracking area update request. ### Claim 15 (depends on 13) The apparatus of claim 13, the indicated one or more security capabilities comprise an indication of one or more encryption algorithms supported by the apparatus, and further wherein the rejection notification is received responsive to a determination that the apparatus (i) does not support any encryption algorithm or (ii) fails to support a mandatory encryption algorithm. ### Claim 16 (depends on 13) The apparatus of claim 13, the indicated one or more security capabilities comprise an indication of one or more integrity algorithms supported by the apparatus, and further wherein the rejection notification is received responsive to a determination that the apparatus (i) does not support any integrity algorithm or (ii) fails to support a mandatory integrity algorithm. ### Claim 17 (depends on 13) The apparatus of claim 13, wherein in response to receiving the rejection notification the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus to: abort an attempt to access the communication network; and reset an access attempt counter. ### Claim 18 (depends on 13) The apparatus of claim 13, wherein in response to receiving the rejection notification the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus to refrain from attempting to access the communication network based at least in part on a timer value included in the rejection notification. ### Claim 19 A method comprising: sending, to a security management node in a communication network, a request indicating one or more security capabilities of an apparatus; and receiving, from the security management node, a rejection notification responsive to the indicated one or more security capabilities not meeting one or more designated criteria of the communication network; wherein the rejection notification comprises a failure cause indication based at least in part on a determination that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network; and wherein the failure cause indication comprises a cause code indicating to the apparatus that an initial access request or a mobility request has failed due to the one or more security capabilities of the apparatus not being acceptable to the communication network. ### Claim 20 (depends on 19) An article of manufacture comprising a non-transitory computer-readable storage medium having embodied therein executable program code that when executed by a processor causes the processor to perform the steps of claim 19.