# US 2014/0157395 A1 · Method and apparatus for establishing tunnel data security channel > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157395 A1 - Document ID: US20140157395A1 - Status: Published application - Kind: A1 - Application number: 14/173,073 - Filed: 2014-02-05 - Published: 2014-06-05 - Earliest claimed: 2011-08-05 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Huan LI; CHRISTIAN HERRERO; LIN SHU - Web page: https://patentgrep.com/patent/US20140157395A1 ## CPC - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/50: Secure pairing of devices - H04W 92/14: between access point controllers and backbone network device - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Sending an authentication request message to an authentication device, receiving an authentication response message sent by the authentication device, where the authentication response message includes a trust relationship information element which is used for indicating a trust relationship of a current access, and establishing an S2c tunnel security association according to the trust relationship of the current access. The trust relationship when the non-3GPP access side accesses the EPS network may be obtained, thereby ensuring establishment of a correct S2c tunnel security data channel. ## Claims ### Claim 1 A method for establishing a data security channel, comprising: sending, by a gateway device, an authentication request message to an authentication device; receiving, by the gateway device, an authentication response message sent by the authentication device, wherein the authentication response message comprises a trust relationship information element indicating whether a user equipment (UE) accesses an Evolved Packet Core (EPC) network via a trusted non-3GPP access network or not; and determining, by the gateway device, whether to establish a child security association (Child SA) with the UE based on the trust relationship information element. ### Claim 2 (depends on 1) The method according to claim 1, wherein the trust relationship information element indicates that the UE accesses the EPC network via a trusted non-3GPP access network, the step of determining comprises: determining to establish the Child SA with the UE based on the trust relationship information element. ### Claim 3 (depends on 2) The method according to claim 2, further comprising: initiating, by the gateway device, a Child SA establishing process with the UE. ### Claim 4 (depends on 2) The method according to claim 2, further comprising: accepting, by the gateway device, a Child SA establishing request initiated by the UE. ### Claim 5 (depends on 2) The method according to claim 2, wherein the trust relationship information element has a value of “trusted” which indicates that the UE accesses the EPC network via a trusted non-3GPP access network. ### Claim 6 (depends on 1) The method according to claim 1, wherein the trust relationship information element indicates that the UE accesses the EPC network via a non-trusted 3GPP access network, the step of determining comprises: determining not to establish the Child SA with the UE based on the trust relationship information element. ### Claim 7 (depends on 6) The method according to claim 6, further comprising: rejecting, by the gateway device, a Child SA establishing request sent by the UE. ### Claim 8 (depends on 7) The method according to claim 7, wherein the step of rejecting the Child SA establishing request comprises: sending a response message in response to the Child SA establishing request to the UE, wherein the response message includes information of rejecting the Child SA establishing request sent by the UE. ### Claim 9 (depends on 6) The method according to claim 6, wherein the trust relationship information element has a value of “untrusted” which indicates that the UE accesses the EPC network via an untrusted non-3GPP access network. ### Claim 10 (depends on 1) The method according to claim 1, wherein the gateway device is a Packet Data Network Gateway (PDN-GW) in the EPC network, the authentication device is an authentication authorization accounting (AAA) server or a Home Subscriber Server (HSS). ### Claim 11 A gateway device, comprising: a transmitter configured to send an authentication request message to an authentication device; a receiver configured to receive an authentication request response message sent by the authentication device, wherein the authentication request response message comprises a trust relationship information element indicating whether a user equipment (UE) accesses an Evolved Packet Core (EPC) network via a trusted non-3GPP access network or not; and a processor coupled to the transmitter and the receiver and configured to: determine whether to establish a child security association (Child SA) with the UE based on the trust relationship information element comprised in the authentication request response message received by the receiver. ### Claim 12 (depends on 11) The gateway device according to claim 11, wherein trust relationship information element indicates that the UE accesses the EPC network via a trusted non-3GPP access network, the processor is configured to determine to establish the Child SA with the UE based on the trust relationship information element. ### Claim 13 (depends on 12) The gateway device according to claim 12, wherein the processor is further configured to initiate a Child SA establishing process with the UE. ### Claim 14 (depends on 12) The gateway device according to claim 12, wherein the processor is further configured to accept a Child SA establishing request initiated by the UE. ### Claim 15 (depends on 12) The gateway device according to claim 12, wherein the trust relationship information element has a value of “trusted” which indicates that the UE accesses the EPC network via a trusted non-3GPP access network. ### Claim 16 (depends on 11) The gateway device according to claim 11, wherein the trust relationship information element indicates that the UE accesses the EPC network via a non-trusted 3GPP access network, the processor is configured to determine not to establish the Child SA with the UE based on the trust relationship information element. ### Claim 17 (depends on 16) The gateway device according to claim 16, wherein the processor is further configured to reject a Child SA establishing request sent by the UE. ### Claim 18 (depends on 16) The gateway device according to claim 16, wherein the transmitter is further configured to send a response message in response to the Child SA establishing request to the UE, wherein the response message including information of rejecting the Child SA establishing request sent by the UE. ### Claim 19 (depends on 16) The gateway device according to claim 16, wherein the trust relationship information element has a value of “untrusted” which indicates that the UE accesses the EPC network via an untrusted non-3GPP access network. ### Claim 20 (depends on 11) The gateway device according to claim 11, wherein the gateway device is a Packet Data Network Gateway (PDN-GW) in the EPC network, the authentication device is an authentication authorization accounting (AAA) server or a Home Subscriber Server (HSS).