Abstract: Integrity protection is activated for user plane data transferred between a network node and a terminal device of the cellular communications network. The activation can be initiated by the terminal device sending a request message to a second network node. Thus, a UE, such as a Cellular IoT UE, and a network node such as a SGSN are able to use LLC layer integrity protection for both control plane and user plane data.

Abstract: Integrity protection is activated for user plane data transferred between a network node and a terminal device of the cellular communications network. The activation can be initiated by the terminal device sending a request message to a second network node. Thus, a UE, such as a Cellular IoT UE, and a network node such as a SGSN are able to use LLC layer integrity protection for both control plane and user plane data.

Abstract: A method performed by a proximity service server. The method comprises generating a ProSe query code and a ProSe response code, sending at least the ProSe response code together with a first and a second discovery key to a first end device, and sending at least the first discovery key and the ProSe query code to a second end device, so that the second end device can securely discover the first end device over an air interface.

Abstract: A terminal device, for example a 3GPP Proximity Services (ProSe)-enabled user equipment, obtains imprecise location information relating to a location of the terminal device, and transmits a proximity service discovery message, wherein the discovery message includes the imprecise location information. A second terminal device, again for example a 3GPP Proximity Services (ProSe)-enabled user equipment, receives a proximity service discovery message containing location information. The second terminal device obtains location information relating to its location, and calculates a distance from the location indicated by the location information in the received discovery message to its location. The second terminal device acts on the received discovery message only if the calculated distance is less than a predetermined distance.

Abstract: Methods And Apparatus For Direct Communication Key Establishment Methods, apparatuses and system are disclosed for establishing a key for secure direct communication between a User Equipment device, UE, and a device. The system comprises a UE (20), a device (30) and a Direct Communication Element (40). The UE establishes a UE shared key with a Bootstrapping Server Function, BSF (50), using a Generic Bootstrapping Architecture, GBA, procedure. The device receives a transaction identifier associated with the UE shared key from the UE, and sends the transaction identifier to the Direct Communication Element. The Direct Communication Element receives the transaction identifier from the device, obtains a shared session key from the BSF, derives the UE delivery key, generates the direct communication key, encrypts the direct communication key with the UE delivery key, and sends the direct communication key and the encrypted direct communication key to the device.

Abstract: A terminal device obtains grid location information relating to a cell of a predetermined grid in which the terminal device is located. The terminal device then calculates a message integrity code based on the grid location information and transmits a proximity service discovery message. The discovery message includes the calculated message integrity code and does not include the grid location information. A second terminal device receives the proximity service discovery message. The second terminal device then obtains grid location information relating to at least one cell of a predetermined grid within a predetermined distance of a location of the second terminal device, calculates at least one message integrity code based on the grid location information, and determines whether a calculated message integrity code matches the message integrity code in the received discovery message. The second terminal device then acts on the received discovery message only if there is a match.

Abstract: A method performed by a proximity service server. The method comprises generating a ProSe query code and a ProSe response code, sending at least a the ProSe response code together with a first and a second discovery key to a first end device, and sending at least the first discovery key and the ProSe query code to a second end device, so that the second end device can securely discover the first end device over an air interface.

Abstract: A terminal device obtains grid location information relating to a cell of a predetermined grid in which the terminal device is located. The terminal device then calculates a message integrity code based on the grid location information and transmits a proximity service discovery message. The discovery message includes the calculated message integrity code and does not include the grid location information. A second terminal device receives the proximity service discovery message. The second terminal device then obtains grid location information relating to at least one cell of a predetermined grid within a predetermined distance of a location of the second terminal device, calculates at least one message integrity code based on the grid location information, and determines whether a calculated message integrity code matches the message integrity code in the received discovery message. The second terminal device then acts on the received discovery message only if there is a match.

Abstract: A terminal device obtains grid location information relating to a cell of a predetermined grid in which the terminal device is located. The terminal device then calculates a message integrity code based on the grid location information and transmits a proximity service discovery message. The discovery message includes the calculated message integrity code and does not include the grid location information. A second terminal device receives the proximity service discovery message. The second terminal device then obtains grid location information relating to at least one cell of a predetermined grid within a predetermined distance of a location of the second terminal device, calculates at least one message integrity code based on the grid location information, and determines whether a calculated message integrity code matches the message integrity code in the received discovery message. The second terminal device then acts on the received discovery message only if there is a match.

Abstract: A method performed by a proximity service server is disclosed. The method comprises generating a ProSe query code and a ProSe response code, sending at least a the ProSe response code together with a first and a second discovery key to a first end device, and sending at least the first discovery key and the ProSe query code to a second end device, so that the second end device can securely discover the first end device over an air interface.

Abstract: A terminal device obtains grid location information relating to a cell of a predetermined grid in which the terminal device is located. The terminal device then calculates a message integrity code based on the grid location information and transmits a proximity service discovery message. The discovery message includes the calculated message integrity code and does not include the grid location information. A second terminal device receives the proximity service discovery message. The second terminal device then obtains grid location information relating to at least one cell of a predetermined grid within a predetermined distance of a location of the second terminal device, calculates at least one message integrity code based on the grid location information, and determines whether a calculated message integrity code matches the message integrity code in the received discovery message. The second terminal device then acts on the received discovery message only if there is a match.

Abstract: A method of operation of a terminal device in a cellular communications network is disclosed. The method comprises sending a GMM Attach Request message to the network, the GMM Attach Request message identifying security capabilities of the terminal device. The terminal device receiving from the network an echo message in the GMM layer including information identifying the security capabilities of the terminal device, wherein the echo message is received with integrity protection.

Abstract: Methods (100, 200, 300) and apparatus (400, 500, 600, 700, 800, 900) are disclosed for establishing a key for direct communication between a User Equipment device, UE, and a device. The methods and apparatus cooperate to form a system for securing direct communication between a UE and a device over an interface. The system comprises a UE (20), a device (30) and a Direct Communication Element (40). The Direct Communication Element (40) is configured to obtain a shared session key and Generic Bootstrapping Architecture Push Information, GPI, to derive a UE delivery key from at least the shared session key, to generate a direct communication key, to encrypt the direct communication key with the UE delivery key, and to send the direct communication key, the encrypted direct communication key and the GPI to the device (30). The device (30) is configured to send the encrypted direct communication key and the GPI to the UE (20).

Abstract: A method of operation of a terminal device in a cellular communications network is disclosed. The method comprises sending a GMM Attach Request message to the network, the GMM Attach Request message identifying security capabilities of the terminal device. The terminal device receiving from the network an echo message in the GMM layer including information identifying the security capabilities of the terminal device, wherein the echo message is received with integrity protection.

Abstract: A terminal device, for example a 3GPP Proximity Services (ProSe)-enabled user equipment, obtains grid location information relating to a cell of a predetermined grid in which the terminal device is located. The terminal device then calculates a message integrity code based on the grid location information and transmits a proximity service discovery message. The discovery message includes the calculated message integrity code and does not include the grid location information. A second terminal device, for example a 3GPP Proximity Services (ProSe)-enabled user equipment, receives a proximity service discovery message containing a message integrity code.

Abstract: A terminal device, for example a 3GPP Proximity Services (ProSe)-enabled user equipment, obtains imprecise location information relating to a location of the terminal device, and transmits a proximity service discovery message, wherein the discovery message includes the imprecise location information. A second terminal device, again for example a 3GPP Proximity Services (ProSe)-enabled user equipment, receives a proximity service discovery message containing location information. The second terminal device obtains location information relating to its location, and calculates a distance from the location indicated by the location information in the received discovery message to its location. The second terminal device acts on the received discovery message only if the calculated distance is less than a predetermined distance.

Abstract: This relates to wireless communications, and in particular to the generation of keying material for security purposes. In particular, A method of performing authentication for a user terminal. The method comprises performing an Authentication and Key Agreement procedure for authenticating the user terminal in a cellular access network, wherein a core network of the cellular network comprises a Home Subscriber Server; determining in a Bootstrapping Server Function that the user terminal requires keying material for use outside the cellular access network. The method also comprises transferring authentication information directly from the Home Subscriber Server to the Bootstrapping Server Function; and generating session keys in the Bootstrapping Server Function using said authentication information, wherein said session keys are also generated in the user terminal.

Abstract: Integrity protection is activated for user plane data transferred between a network node and a terminal device of the cellular communications network. The activation can be initiated by the terminal device sending a request message to a second network node. Thus, a UE, such as a Cellular IoT UE, and a network node such as a SGSN are able to use LLC layer integrity protection for both control plane and user plane data.

Abstract: Methods And Apparatus For Direct Communication Key Establishment Methods, apparatuses and system are disclosed for establishing a key for secure direct communication between a User Equipment device, UE, and a device. The system comprises a UE (20), a device (30) and a Direct Communication Element (40). The UE establishes a UE shared key with a Bootstrapping Server Function, BSF (50), using a Generic Bootstrapping Architecture, GBA, procedure. The device receives a transaction identifier associated with the UE shared key from the UE, and sends the transaction identifier to the Direct Communication Element. The Direct Communication Element receives the transaction identifier from the device, obtains a shared session key from the BSF, derives the UE delivery key, generates the direct communication key, encrypts the direct communication key with the UE delivery key, and sends the direct communication key and the encrypted direct communication key to the device.

Abstract: A method, performed by a User Equipment device, UE, for obtaining a key for direct communication with a device over an air interface, wherein the UE has previously acquired a transaction identifier received from a Bootstrapping Server Function, BSF, in a Generic Bootstrapping Architecture, GBA, procedure, is provided. The method comprises storing the transaction identifier, sending the transaction identifier to the device and requesting key generation for direct communication with the device. If the transaction identifier is invalid, the method further comprises receiving from the device a device identifier and key generation information, deriving a session shared key from at least the key generation information, and deriving a direct communication key from at least the session shared key and the device identifier.