# US 2019/0174313 A1 · Method and System for Providing Security From A Radio Access Network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0174313 A1
- Document ID: US20190174313A1
- Status: Published application
- Kind: A1
- Application number: 16/268,880
- Filed: 2019-02-06
- Published: 2019-06-06
- Earliest claimed: 2014-05-02
- Assignees: Koninklijke KPN N.V.; Nederlandse Organisatie voor toegepast-natuurwetenschappelijk onderzoek TNO
- Applicants: Koninklijke KPN N.V.; Nederlandse Organisatie voor Toegepast- Natuurwetenschappelijk Onderzoek TNO
- Inventors: Frank Fransen
- Web page: https://patentgrep.com/patent/US20190174313A1

## CPC

- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04W 12/0433: Key management protocols
- H04W 12/069: using certificates or pre-shared keys
- H04W 48/08: Access restriction or access information delivery, e.g. discovery data delivery (signalling during connection H04W76/00)
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
- H04W 4/90: Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

The disclosure relates to a security method in a radio access network system. A shared secret key is stored in both a user device and a core network system. A further secret key is received from the core network system, wherein the further secret key has been derived using the shared secret key stored in the core network system. One or more values are provided over the radio interface to the user device to derive the further secret key in the user device from at least the shared secret key stored in the user device and one or more of the one or more values provided over the radio interface. An authentication procedure and/or a key agreement procedure is performed for the user device over the wireless radio interface using the received further secret key in the radio access network system and the derived further secret key in the user device.

## Claims

### Claim 1

A user device configured for operating within a radio access network system, the radio access network system comprising one or more base stations providing a wireless radio interface for at least one user device, wherein a shared secret key is stored in both the user device and a core network system of a telecommunications network, wherein the user device comprises:
a receiver configured for receiving one or more values provided over the radio interface from the radio access system;
a storage storing the shared secret key; and
a computer system configured for:
processing an identifier of the radio access network system initiating and/or being used in deriving the further secret key; and
deriving the further secret key from the shared secret key and at least one of the one or more values received by the receiver, wherein the user device is configured to perform at least one of the local authentication procedure and the local key agreement procedure using the derived further secret key.

### Claim 2 (depends on 1)

The user device according to claim 1, wherein the user device is configured for processing a RAN_only indication indicating that the radio access network system is in a RAN-only mode, the RAN_only indication informing the user device that a further secret key should be derived.

### Claim 3 (depends on 1)

The user device according to claim 1, wherein the user device is further configured for generating or storing, and transmitting at least one of:
an indication indicating capability to derive the further secret key; or
an indication indicating a request to perform at least one of the local authentication procedure and the local key agreement procedure with the radio access network.

### Claim 4

A subscriber hardware module for use in a user device, wherein the user device is configured for operating within a radio access network system the radio access network system comprising one or more base stations providing a wireless radio interface for at least one user device, wherein a shared secret key is stored in both the user device and a core network system of a telecommunications network, wherein the subscriber module is configured to:
store the shared secret key and for deriving the further secret key;
receive a first authentication request causing the subscription module to derive the further secret key; and
receive a second authentication request, subsequent to the first authentication request, causing the subscription module to use the further secret key for at least one of a local authentication procedure or a local key agreement procedure,
and wherein the user device is configured to perform at least one of the local authentication procedure or the local key agreement procedure using the derived further secret key.

### Claim 5 (depends on 4)

The subscriber hardware module according to claim 4, wherein the subscriber hardware module is further configured to store the identifier of the radio access network.