Method and arrangement for managing security reconfiguration in a cellular communication system
Methods are discussed of managing security reconfiguration and cell update procedures in a user equipment and in a node in a cellular communication system and a user equipment and a node in the cellular communication system. Methods in the user equipment may include detecting a cell update trigger event, and aborting any ongoing security reconfiguration procedure in the user equipment in response to the detected cell update trigger event. Subsequently, a security status indication in response to the aborted security reconfiguration may be provided, and a cell update message and the provided security status indication may be jointly transmitted to a node.
Latest Telefonaktiebolaget L M Ericsson (publ) Patents:
This application is a 35 U.S.C. §371 national stage application of PCT International Application No. PCT/EP2010/058294, filed on 14 Jun. 2010, which itself claims priority to U.S. Provisional Patent Application No. 61/298,934, filed 28 Jan. 2010, the disclosures and contents of both of which are incorporated by reference herein in their entireties. The above-referenced PCT International Application was published in the English language as International Publication No. WO 2011/091865 A1 on 4 Aug. 2011.
TECHNICAL FIELDThe present invention relates to telecommunication systems in general and specifically to management of security reconfigurations in such systems.
BACKGROUNDFor all telecommunication systems, there is a variety of reconfiguration procedures present. These procedures can be divided into two main groups, based on the nature of the parameters to be reconfigured, namely soft and physical reconfigurations. Physical reconfigurations deal with reconfigurations of a physical nature, such as radio bearer reconfiguration, transport channel reconfiguration, physical channel reconfiguration. Soft reconfigurations deal with non-physical reconfigurations, such as for example security parameter reconfiguration. For a typical scenario of 3GPP specifications, these two types of reconfigurations are treated somewhat different and consequently suffer from different and separate problems.
The present disclosure will focus on soft reconfigurations, in particular security reconfigurations in relation to 3 GPP specifications TS 25.331 V8.7.0 section 8.1.12.4b, “Cell Update Procedure During Security Reconfiguration”. One area of improvement concerns the case of dropped calls due to a mismatch of security configurations between the network and a user terminal such as a mobile phone, as a consequence of cell reselection procedure during the security reconfiguration.
For connected 3G users in the so called CELL_FACH state or mode trying to set up a multi-RAB speech call, call drop occurs if a Cell-Update cell reselection procedure coincides with the Security Mode procedure. To further clarify, the CELL_FACH state or mode is one of the radio resource control connected modes or states of operation. As such, for a user equipment in the CELL_FACH state the following is applicable.
-
- No dedicated physical channel is allocated to the UE.
- The UE continuously monitors a FACH in the downlink.
- The UE is assigned a default common or shared transport channel in the uplink (e.g. RACH) that it can use anytime according to the access procedure for that transport channel.
- The position of the UE is known by UTRAN on cell level according to the cell where the UE last made a cell update.
It should be noted that Security Mode procedure includes negotiating which ciphering and integrity protection scheme the concerned parties e.g. user equipment and network node are to use for communication. A mismatch or misalignment of security configuration between two parties e.g. user terminal and a network, will ultimately lead to a dropped call since the parties are unable to communicate with each other.
During UE mobility, two such scenarios are possible:
-
- 1) Security Reconfiguration during Cell Update procedures, i.e. Security Mode Command is received in a user equipment (UE) from a network just after a Cell Update message is sent from the UE to the network.
- 2) Cell Update procedure during Security Reconfiguration, i.e. a Cell Update message is sent from the UE while the Security Mode procedure is still ongoing.
Prior art, as represented by 3GPP specification TS 25.331 V8.7.0, section 8.1.12.4b, “Cell update procedure during security reconfiguration,” section 8.1.12.2.2, “Integrity protection configuration change,” and section 8.3.1.9b, “Security reconfiguration during Cell update procedure,” describe how a user equipment UE or mobile and network should handle these two cases; however, there is room for improvement to further reduce the risk of calls being dropped as a result of 3GPP specification limitations.
In general, all above mentioned problems are related to misalignment or mismatch in security (ciphering/integrity) settings when an ongoing Security Mode procedure is aborted, primarily due to Cell Update cell-reselection. If both UE and radio network controller (RNC) abort the security reconfiguration or if neither aborts, a network solution could easily handle this case. However, due to different race conditions occurring between cell update and security mode procedures, UE may abort reconfiguration but not the RNC, and vice versa. The result is an Integrity Protection (and/or ciphering) misalignment resulting in call drop.
With reference to
a) re-selection to a new cell
b) re-entering service area
c) periodical cell-update
d) to inform the network of a UE failure (“physical channel failure” or “RLC unrecoverable error”)
For the present disclosure, the case of a user equipment aborting an ongoing security reconfiguration procedure due to reselection to a new cell will be exploited.
When it comes to the time span designated “B” above, 3GPP specifications are somewhat unclear and also limited regarding UE security configuration behavior. If a CellUpdate message is sent during the security procedure, after securityModeComplete, but before the L2ACK received, then as above, the UE shall abort the ongoing Security Mode procedure (3GPP specification TS 25.331 V8.7.0 section 8.1.12.4b, “Cell Update Procedure During Security Reconfiguration”) with special handling for integrity parameter COUNT-I. Some other vague guidance is given by a statement targeting the RNC [2] (3GPP specification TS 25.331 V8.7.0 section 8.1.12.2.2, “Integrity protection configuration change”), in which it is stated that the network (NW) should be aware that the UE “may” abort the security procedure.
Aborting the security procedure in the UE at this point however is not favorable, since the UE has just acknowledged to the RNC (in Security Mode Complete message) that the security reconfiguration is already performed even though the security reconfiguration is not yet fully applied in the UE until the L2ACK for securityModeComplete is received from the RNC (i.e. it is a grey area limitation in the prior art as represented by 3GPP specification TS 25.331 V8.7.0 section 8.1.12.4b, “Cell Update Procedure During Security Reconfiguration”).
If the UE aborts the security reconfiguration after RNC has received the Security Mode Complete, the new security reconfiguration will be applied by the RNC. Hence there is a security mismatch, leading to call drop (as evidenced from live network analysis). The dropped call is due to the fact that the UE and the network at this point in time are using different security configurations and are unable to communicate.
SUMMARYThe present invention relates to methods and arrangements for improved security reconfiguration management in a cellular communication system. It is the object of the present invention to reduce the risk of dropped calls due to cell update procedures.
In a method of managing security reconfiguration and cell update procedures in a user equipment in a cellular communication system the following procedure is performed. A user equipment receives a security reconfiguration request from a node, and subsequently initiates and confirms the requested security reconfiguration to the node. At some point in time before node acknowledgement received, the user equipment detects a cell update trigger and aborts the already confirmed security reconfiguration in response to the detected cell update trigger. Subsequently, the user equipment provides a security status indication in response to the aborted security reconfiguration, then jointly transmits, to the node, a cell update message and the provided security status indication informing about the previously confirmed security reconfiguration being aborted.
By these features, a mismatch between the security configurations between a UE and a node in the cellular communication system is avoided. As a result, the call drop rate is reduced and the call setup rate can be improved.
According to a further aspect of the present invention, an embodiment of a user equipment in a cellular communication system includes means for detecting a cell update trigger event, and means for aborting any ongoing security reconfiguration procedure in the user equipment in response to the detected cell update trigger event. In addition, the user equipment includes means for providing a security status indication in response to the aborted security reconfiguration, and means for jointly transmitting a cell update message and the provided security status indication to a node.
According to yet a further aspect, an embodiment of a method of managing security reconfiguration and cell update procedures in a node in a cellular communication system according to the present invention includes the steps of transmitting a security reconfiguration request to a user equipment, and receiving a security reconfiguration confirmation. The node acknowledges and performs the confirmed security reconfiguration. Subsequently, the node jointly receives a cell update message and a security status indication informing about the confirmed security reconfiguration being aborted in the user equipment. Finally, the node manages the requested security reconfiguration based on the received security status indication.
According to an additional aspect, an embodiment of a node in a cellular communication system includes means for transmitting a security reconfiguration request to a user equipment, and means for receiving a security reconfiguration confirmation. In addition, the node includes means for acknowledging and performing the confirmed security reconfiguration, and means for jointly receiving a cell update message and a security status indication informing about the confirmed security reconfiguration being aborted in the user equipment. Finally, the node includes means for managing the requested security reconfiguration based on the received security status indication.
The present invention, furthermore, coordinates advantageously cell update and security reconfiguration procedures and overcomes 3GPP specification limitations as already described.
The invention, together with further objects and advantages thereof, may best be understood by referring to the following description taken together with the accompanying drawings, in which:
- ACK ACKnowledgement
- AM Acknowledgement Mode
- CU Cell Update
- CCCH Common Control Channel
- CR Change Request
- DCCG Dedicated Control Channel
- FACH Forward Access Channel
- IE Information Element
- KPI Key Performance Indicators
- L2 Layer 2
- MP Mandatory present
- OP Optionally Present
- NW NetWork
- RAB Radio Access Bearer
- RIM Research in motion (specific UE vendor)
- RLC Radio Link Control (L2 Protocol)
- RNC Radio Network Controller
- SRB Signalling Radio Bearer
- TM Transparent Mode
- UM Unacknowledged Mode
- 3GPP 3rd Generation Partnership Project
The present disclosure will be described in the context of a 3GPP system; however it is equally applicable to similar systems with a similar structure.
In order to fully comprehend the benefits of the present invention, a more in-depth description of prior art solutions and their potential drawbacks is provided below.
The two previously mentioned main race scenarios observed (during multi-RAB speech call from CELL-FACH) that lead to the various dropped call symptoms are further described below and with reference to
In the first race scenario, with reference to
1 Cell Update message sent from UE to RNC
2 Security Mode Command (security reconfiguration request) sent from RNC to UE.
As is clearly seen in
In the second race scenario, with reference to
With reference to
1. Security Mode Command
2. L2 ACK for (1)
3. Security Mode Complete
4. L2 ACK for (3)
5. Cell Update
At time instance A the UE selects a new cell, and aborts the ongoing security reconfiguration, and rolls back to the old security reconfiguration. At time instance B, the RNC activates the new security configuration. Consequently, from time instance B the UE and the RNC are operating with different security configurations and are unable to maintain the existing call. In this case, there is a security mismatch since the UE is on “old” security settings while RNC is now on “new” security settings, and thus ultimately leads to call drop.
Basically, the present invention aims at enabling means and arrangements for avoiding a mismatch in security configuration between a network node and a user equipment due to the second race scenario above between cell update and security reconfiguration procedures.
According to a preferred embodiment of the present invention, the UE is adapted to include a security status indication e.g. information element in the Cell Update message sent from the UE to the RNC. This IE should clearly inform the RNC whether an ongoing security procedure in the UE has been aborted or not, and so the RNC can easily decide whether it is necessary also to abort and revert to old security settings or not, or take other suitable action.
Today, as described previously, it is possible for the UE to abort an ongoing security reconfiguration procedure just before the procedure completion, in order to send a Cell Update to the RNC. If the RNC however has already completed this security reconfiguration procedure at the time of reception of this cell update, then the RNC has no way of knowing for certain that the preceding security procedure has just been aborted in the UE. This is currently a limitation in the 3GPP specifications. The new proposed status indication e.g. information element IE can easily overcome the 3GPP limitation.
With reference to
With reference to
In response to the detected cell update trigger event, the user equipment aborts S40 any ongoing security reconfiguration procedure. By aborting the security reconfiguration procedure, the user equipment reverts to or rolls back to a previous e.g. already existing security configuration. Subsequently, the user equipment provides S50 a security status indication in response to the aborted security reconfiguration. Finally, the security status indication and a cell update message are jointly transmitted S60 to a node in the cellular communication system, typically a radio network controller node or similar control node.
Basically, the cell update message of prior art is amended to include a security status indication, such as a boolean information element that is set to TRUE in case of an ongoing security reconfiguration procedure being aborted in the user equipment, and set to FALSE otherwise.
With reference to
Initially, the user equipment receives S10 a request for a security reconfiguration from a node, e.g. radio network controller. The user equipment initiates and confirms S20 the requested security reconfiguration. At some point in time before node acknowledgment received the user equipment detects S30 a cell update trigger, and is consequently forced to change or reselect a cell. In response to the detected cell update trigger, the user equipment aborts S40 the already confirmed security reconfiguration. The user equipment then provides S50 a security status indication in response to the aborted security reconfiguration. Finally, the user equipment jointly transmits S60, to the node, a cell update message, and the provided security status indication informing about the confirmed security reconfiguration being aborted.
The security status indication is preferably set to a predetermined value in response to an aborted security reconfiguration, according to a particular embodiment of the invention the status indication is provided as a boolean information element. According to a particular embodiment, the security status indication is set to TRUE only in the case of an aborted security reconfiguration and a cell update message is triggered to be sent during an ongoing security reconfiguration. Otherwise, the security status indication should be cleared/set to FALSE. The security status indication should not be set in the case where a security reconfiguration has been aborted but a cell update message is not sent until some later time after the completed security procedure.
With reference to
At some point in time the node e.g. radio network controller, transmits S100 a security reconfiguration request to a user equipment. Upon receiving S200 a confirmation for the security reconfiguration, the node acknowledges S300 and performs the security reconfiguration. Subsequently, the radio network controller jointly receives S400 a cell update message and a security status indication in the cell update message, the indication informing about the confirmed security reconfiguration being aborted. Finally, the radio network controller manages its security configuration based on the received security status indication. One possible action would be to revert to a previous security configuration in response to the received status indication. Another possible action would be to reattempt the aborted security reconfiguration. In addition, other actions are possible, under the condition that the radio network controller recognizes the included security status indication.
With reference to
According to a particular embodiment, also with reference to
With reference to
It is understood that the functional parts of the embodiments can be implemented as hardware e.g. processors within or as software elements e.g. algorithms executable on a computer. It is also understood that some parts of the functionality can be provided outside the user equipment and/or node and communicated to the user equipment and node using other means of communication.
Advantages of the Present Invention Include:
The main benefit of the proposed new IE is to overcome the 3GPP limitations and thus avoid unnecessary dropped calls at security reconfiguration on CELL_FACH (e.g. typically at speech call setup from CELL_FACH), hence improved KPIs and thus increased revenue and end-user satisfaction.
This new “Security Status Indicator” IE ensures there is no security mismatch between UE and RNC, as the RNC also rolls back to “old” security settings if cellUpdate received from UE with IE=“TRUE”, indicating the UE has aborted security procedure due to cellUpdate cell re-selection. As RNC and UE are using the same “old” security keys after the security procedure is aborted, then no abnormal call drop should occur.
In case of any unforeseen scenarios, this IE will allow the network to consider other alternative corrective actions rather than drop the call as occurs today.
Claims
1. A method of managing security reconfiguration and cell update procedures in a user equipment in a cellular communication system, the method comprising:
- receiving a security reconfiguration request from a node of the cellular communication system at the user equipment, wherein the security reconfiguration request is to request a security reconfiguration for the user equipment;
- initiating and confirming a security reconfiguration procedure responsive to receiving the security reconfiguration request from the node;
- after receiving the security reconfiguration request and after initiating and confirming the security reconfiguration procedure, detecting a cell update trigger event;
- aborting the security reconfiguration procedure in said user equipment in response to detecting the cell update trigger event without previously receiving a security mode complete acknowledge for the security reconfiguration procedure while the security reconfiguration procedure is ongoing;
- providing a security status indication at the user equipment in response to aborting the security reconfiguration procedure; and
- jointly transmitting a cell update message and the security status indication from the user equipment to the node of the cellular communication system wherein the security status indication informs about the security reconfiguration procedure being aborted in the user equipment.
2. The method according to claim 1, wherein providing the security status indication comprises setting the security status indication to a predetermined value.
3. The method according to claim 1, wherein jointly transmitting the cell update message and said security status indication comprises transmitting the cell update message and said security status indication in a same cell update message.
4. The method according to claim 3, wherein the security status indication is provided as a boolean information element in the cell update message.
5. The method of claim 1 wherein jointly transmitting the cell update message and the security status indication comprises transmitting the security status indication as an information element of the cell update message.
6. The method of claim 1 wherein the security reconfiguration procedure comprises a security reconfiguration procedure for the user equipment to reconfigure from a previous security configuration to a new configuration, and wherein aborting the security reconfiguration procedure comprises reverting back to the previous security configuration.
7. The method of claim 6 wherein receiving the security reconfiguration request comprises receiving a security mode command from the node of the cellular communication system, wherein confirming the security reconfiguration procedure comprises transmitting a security mode complete message to the node of the cellular communication system, and wherein jointly transmitting the cell update message and the security status indication comprise transmitting the cell update message and the security status indication in a same cell update message.
8. The method according to claim 1 wherein the node in the cellular communication system is a Radio Network Controller (RNC).
9. The method according to claim 1 wherein providing a security status indication comprises setting the security status indication to a predetermined value at the user equipment in response to aborting the security reconfiguration procedure and in response to the cell update message being triggered to be sent during an ongoing security reconfiguration procedure.
10. A method of managing security reconfiguration and cell update procedures in a node in a cellular communication system, the method comprising:
- transmitting a security reconfiguration request from the node in the cellular communication system to a user equipment wherein the security reconfiguration request is to request a security reconfiguration for the user equipment;
- receiving a security reconfiguration confirmation at the node in the cellular communication system from the user equipment for the security reconfiguration;
- acknowledging and performing the security reconfiguration for the user equipment, wherein acknowledging the security reconfiguration comprises transmitting an acknowledgment for the security reconfiguration to the user equipment;
- after transmitting the acknowledgment for the security reconfiguration to the user equipment, jointly receiving a cell update message and a security status indication at the node in the cellular communication system from the user equipment, wherein the security status indication informs about the security reconfiguration being aborted in the user equipment; and
- after transmitting the acknowledgment for the security reconfiguration to the user equipment, managing the security reconfiguration for the user equipment at the node in the cellular communication system based on the security status indication received from the user equipment wherein the security status indication informs about the security reconfiguration being aborted in the user equipment.
11. The method according to claim 10, wherein managing the security reconfiguration comprises retransmitting the aborted security reconfiguration request from the node in the cellular communication system to the user equipment in response to receiving the security status indication.
12. The method of claim 10 wherein jointly receiving the cell update message and the security status indication comprises receiving the security status indication as an information element of the cell update message that informs about the security reconfiguration being aborted in the user equipment after transmitting the acknowledgment for the security reconfiguration to the user equipment, and wherein managing the security reconfiguration comprises managing the security reconfiguration responsive to receiving the security status indication as the information element of the cell update message.
13. The method of claim 10 wherein the security reconfiguration request for the user equipment comprises a request to reconfigure from a previous security configuration to a new configuration, and wherein managing the security reconfiguration comprises reverting to the previous security configuration for the user equipment in response to receiving the security status indication at the node in the cellular communication system from the user equipment.
14. The method of claim 13 wherein transmitting the security reconfiguration request comprises transmitting a security mode command from the node of the cellular communication system to the user equipment, wherein receiving the security reconfiguration confirmation comprises receiving a security mode complete message at the node of the cellular communication system, and wherein jointly receiving the cell update message and the security status indication comprises receiving the cell update message and the security status indication in a same cell update message.
15. The method according to claim 10, wherein managing the security reconfiguration comprises reverting to a previous security configuration for the user equipment in response to receiving the security status indication at the node in the cellular communication system from the user equipment.
16. The method according to claim 10 wherein the node in the cellular communication system is a Radio Network Controller (RNC).
17. The method according to claim 12, wherein managing the security reconfiguration comprises retransmitting the aborted security reconfiguration request from the node in the cellular communication system to the user equipment in response to receiving the security status indication as the information element of the cell update message after transmitting the acknowledgment for the security reconfiguration to the user equipment.
7801527 | September 21, 2010 | Putcha |
8811943 | August 19, 2014 | Funnell et al. |
20030035545 | February 20, 2003 | Jiang |
20030100291 | May 29, 2003 | Krishnarajah et al. |
20030236085 | December 25, 2003 | Ho |
20040224663 | November 11, 2004 | Funnell et al. |
20050276417 | December 15, 2005 | Funnell |
20070173228 | July 26, 2007 | Funnell et al. |
20070263871 | November 15, 2007 | Maheshwari et al. |
20090124212 | May 14, 2009 | Islam et al. |
20100035599 | February 11, 2010 | Chen |
20100130207 | May 27, 2010 | Wu |
20100166184 | July 1, 2010 | Wu |
20120142354 | June 7, 2012 | Ahluwalia |
20120142361 | June 7, 2012 | Zhao et al. |
20120201228 | August 9, 2012 | Wu |
20120308007 | December 6, 2012 | Li et al. |
1 895 798 | March 2008 | EP |
- 3GPP TSG-RAN2 Meeting #27, Orlando, USA, Feb. 18-22, 2002, RP-020205, pp. 1-18.
- 3GPP TSG-RAN WG2 Meeting #25 Makuhari, Japan, Nov. 26-30, 2001, Tdoc R2-012752.
- International Search Report, PCT Application No. PCT/EP2010/058294, Sep. 29, 2010, 3 pages.
- 3GPP-Standards; 3rd Generation Partnership Project; “Technical Specification Group Ran; Signalling enhancements for Circuit-Switched (CS) and Packet-Switched (PS) Connections; Analyses and Recommendations” (Release 7); 3GPP TR 25.815 v2.0.0, Technical Report; Sep. 2006, XP040292878, 43 pages.
- International Preliminary Report on Patentability and Written Opinion Corresponding to International Application No. PCT/EP2010/058294; Date of Issuance: Jul. 31, 2012; 6 Pages.
- ETSI TS 125 331 V8.7.0 (Jul. 2009); ,Universal Mobile Telecommunications System (UMTS); Radio Resource Control (RRC); Protocol specification (3GPP TS 25.331 version 8.7.0 Release 8), Sophia-Antipolis Valbonne, France, relevant pp. 1-32, 126-129, 134-136, and 229, Jul. 2009.
- NTT DoCoMo: “Unsuccessful security mode control procedure and Integrity Protection”: 3GPP TSG-RAN WG2 Meeting #38, Sophia Antipolis, France, Oct. 5-9, 2003;.Tdoc R2-032152; 7 pages.
- NTT DoCoMo: “Unsuccessful security mode control procedure and Integrity Protection”; Change Request; 25.331 CR 2075 Version 5.6.0; 3GPP TSG-RAN WG2 Meeting #38, Sophia Antipolis, France, Oct. 5-9, 2003;.Tdoc R2-032234; Oct. 6, 2003; 5 pages.
Type: Grant
Filed: Jun 14, 2010
Date of Patent: Feb 23, 2016
Patent Publication Number: 20120275340
Assignee: Telefonaktiebolaget L M Ericsson (publ) (Stockholm)
Inventor: Tom McGann (Enfield)
Primary Examiner: Gary Mui
Assistant Examiner: Michael Phillips
Application Number: 13/518,919
International Classification: H04W 12/04 (20090101); H04L 29/06 (20060101);