TECHNICAL FIELD

The present disclosure relates to wireless communications technologies, in particular, to a method and device for obtaining user equipment (UE) security capabilities.

BACKGROUND

With the development of communications technologies and due to the variety of services, the service traffic of users become higher and the requirement of network speed is more strictly. To provide a better user experience, operators are keeping improving the abilities and functions of network devices and network solutions. A long term evolution (LTE) network has led to the development of the next generation radio network, also known as fifth generation (5G) network. However, the network operators may not change which technology they work in all at once. Therefore, the network equipment supporting different radio access technologies (RATs) may coexist in the same network.

SUMMARY

In one aspect, a method for obtaining UE new radio access technology (NR) security capabilities is provided. In the method, a target base station of an X2 handover sends an indication to source base station, the indication indicates a UE to send the UE NR security capabilities. The source base station sends the indication to the UE in a radio resource control connection reconfiguration message. The UE sends the UE NR security capabilities. For purpose of clarity, NR also may refer to “new radio” or “next generation radio.”

In another aspect, a method for obtaining UE next generation radio (NR) security capabilities is provided. In this method, in an X2 handover from a legacy evolved Node B (eNB) to a master evolved Node B (MeNB), the MeNB sends path switch request message to an enhanced mobility management entity (MME) to request the UE NR security capabilities. The enhanced MME sends the UE NR security capabilities to the MeNB in the path switch acknowledge message.

In one other aspect, a method for obtaining UE NR security capabilities is provided. In this method, a UE may trigger a tracking area update (TAU) to send the UE NR security capabilities to a MeNB. The UE may receive an indication in an X2 handover or in S1 handover, the indication indicates that a TAU is required to send the UE NR security capabilities. The X2 and S1 are interfaces between network infrastructure devices.

In one other aspect, a method for obtaining security capabilities in a handover is provided. In the method, a target base station receives a handover request message from a source base station, and sends a handover request acknowledge message to the source base station, the handover request acknowledge message includes an indication indicating a user equipment (UE) to send UE next generation radio (NR) security capabilities. The target base station receives the UE NR security capabilities from the UE.

In an implementation, the target base station receives the UE NR radio capabilities in the handover request message. The UE NR security capabilities from the UE may be included in a radio resource control connection reconfiguration complete message.

Optionally, the UE NR security capabilities from the UE is included in a handover confirm message.

In another implementation according to the above aspect and implementation, the target base station sends a secondary next generation Node B (SgNB) addition request message to a SgNB, wherein the secondary addition request message includes the UE NR security capabilities.

In one aspect, a method for obtaining security capabilities is provided. In the method, a UE receives an indication in a handover, wherein the indication indicating to send UE next generation radio (NR) security capabilities in a tracking area update procedure. The UE sends a tracking area update request message to a target base station of the handover, wherein the tracking area update request message comprising the UE NR security capabilities.

In an implementation, the indication is received in a handover command message in an S1 handover. Alternatively, the indication is received in a radio resource control connection reconfiguration message in an X2 handover.

In one aspect of the present disclosure, a base station is provided. The base station comprises a receiver configured to receive a handover request message from a source base station; and a transmitter configured to send a handover request acknowledge message to the source base station, the handover request acknowledge message includes an indication indicating a use equipment (UE) to send UE next generation radio (NR) security capabilities. The receiver is further configured to receive the UE NR security capabilities from the UE.

In an implementation, the UE NR security capabilities from the UE is included in a radio resource control connection reconfiguration complete message.

In another implementation, the transmitter is further configured to send a secondary next generation Node B (SgNB) addition request message to a SgNB, wherein the secondary addition request message includes the UE NR security capabilities.

In an aspect, a method is provided. In the method, a MME receives an attach request message sent from a UE, wherein the attach request message comprising UE security capabilities including UE next generation radio (NR) security capabilities. The MME recovers the UE security capabilities except the UE NR security capabilities, and sends a non-access stratum (NAS) security mode command message comprising the UE security capabilities except the UE NR security capabilities. The UE receives the NAS security mode command message and while UE is attached to LTE network, and accepts the UE security capabilities. The UE continues the attach procedure.

In an aspect, a base station is provided. The base station comprises a receiver for receiving a handover request message from a source base station, and a transmitter for transmitting a handover request acknowledge message to the source base station, the handover request acknowledge message includes an indication indicating a user equipment (UE) to send UE next generation radio (NR) security capabilities, wherein the base station further receives UE NR security capabilities from the UE.

In an implementation, the base station receives the UE NR radio capabilities in the handover request message. Optionally, the UE NR security capabilities from the UE is included in a radio resource control connection reconfiguration complete message. Alternatively, the UE NR security capabilities from the UE is included in a handover confirm message.

In the aspects or implementations, during an X2 handover from an eNB to MeNB, if the MeNB receives the UE ENDC radio support capability, whether the UE is authorized for ENDC service as per the Restrictions list, but it does not receive the UE NR security capabilities and the UE NR radio capabilities, the MeNB may not add SgNB until X2 handover is complete. Having the UE to send its NR security capabilities in the RRC connection reconfiguration complete message to the target MeNB sounds straightforward. In order to avoid the UE sending its NR security capabilities during every X2 handover, the MeNB includes a flag to the UE to send its UE NR security capabilities. At the same time the MeNB does not receive the UE NR security capabilities nor the UE NR Radio capabilities, the MeNB shall include a flag to the UE to send its UE NR security capabilities in the RRC Connection reconfiguration Complete message. When the UE receives this flag, the UE includes its NR security capabilities in the RRC Connection reconfiguration complete sent to the target MeNB. After the target MeNB receives the UE NR security capabilities, it enquire the UE for its NR Radio capabilities and starts adding the SgNB. Therefore, it works with legacy MME without the requirement of any change to legacy MME. The handover procedure is changed limited and only impacts UE that support ENDC. It is applicable to the X2 handover, S1 handover, or the initial attachment.

In an aspect, a communications method is provided. In the method, a UE transmits an attach request message or a tracking area update request message to a mobility management entity, the attach request message or the TAU request message includes UE security capabilities comprising UE new radio (NR) security capabilities. If the mobility management entity does not understand the UE NR security capabilities, the mobility management entity may replay UE security capabilities without the UE NR security capabilities to the UE in a non-access stratum (NAS) security mode command (SMC) message. Optionally, the mobility management entity may drop the UE NR security capabilities and does not save the UE NR security capabilities in the UE context. When the UE receives the NAS SMC message and the UE NR security capabilities are not included in the replayed UE security capabilities, the UE may determine that it is not a security vulnerability, i.e., the UE may determine that no bidding down attack has happened even if there is a mismatch UE security capabilities comprised in the attach request message (or TAU request message) and the replayed UE security capabilities. Then, the UE may continue the attach procedure or the TAU procedure. Thus, the UE may attaching to the mobility management entity. According to the embodiment of the present disclosure, it is guaranteed that the legacy LTE network may exist with an enhanced LTE network or the NR network by without changing the legacy network elements. Meanwhile, the security requirements of the communication also can be guaranteed.

Optionally, if the mobility management entity understand the UE NR security capabilities, the mobility management entity may send the UE NR security capabilities to an eNB, in the S1 initial context setup message. The eNB is a base station to which the UE sends the attach request message or the TAU request message.

In an implementation, the UE may send the UE NR security capabilities in a new IE over NAS, e.g., in attach request message or the TAU request message. Namely, the UE NR security capabilities may be indicated to the network using a new IE so that the support of UMTS/EPS and NR algorithms can evolve independently. Thus, for example, the UE may send the UE NR security capabilities on a first IE and send the UMTS/LTE security capabilities on a second IE which is different from the first IE. Including the UE NR security capabilities in a new IE defeats bidding-down attack naturally. No extra requirements or features is required on legacy MME to defeat bidding down attack. No impact on S10 interface. It is possible that generating the same condition at a MeNB in an initial attach, X2 handover, or S1 handover which generates a single condition for MeNB to make a decision.

In an aspect, a communications method is provided. In the method, a MeNB establishes a RRC connection with a UE and the MeNB obtains UE NR security capabilities of the UE. The MeNB determines that the UE supports the NR capability. The MeNB may establish one or more DRBs for the UE at a SgNB. The MeNB may send the UE NR security capabilities associated with the UE in the SgNB addition procedure, and the MeNB receives a SgNB addition request acknowledge message from the SgNB. The SgNB may allocate resources and chooses the ciphering and integrity algorithms, and includes the chosen algorithms in the SgNB addition request acknowledge message. Thus, the UE can get faster transmission rate, the operator can provide better user experience to users after the UE attaches the network, X2 handover, or the S1 handover.

In an aspect, a user equipment is provided. The user equipment comprises a sending unit configured to transmit an attach request message or a TAU request message to a mobility management entity, wherein the attach request message includes UE security capabilities comprising UE NR security capabilities. The user equipment further comprises a receiving unit configured to receive a NAS SMC message from the mobility management entity, the NAS SMC message includes replayed UE security capabilities without including the UE NR security capabilities. The user equipment further comprises a processing unit configured to determine no bidding down attack has happened based on a mismatch of the UE security capabilities comprised in the attach request message or TAU request message and the replayed UE security capabilities, and attach to the mobility management entity.

In an aspect, a base station is provided. The base station comprises a processing unit configured to establish a RRC connection with a user equipment and determines that the UE supports an NR capability. The base station also comprises a receiving unit configured to obtain UE NR security capabilities of the UE. The base station further comprises a sending unit configured to transmit a SgNB addition request message to a SgNB, the SgNB addition request message comprises the UE NR security capabilities. The receiving unit is further configured to receive a SgNB addition request acknowledge message from the SgNB.

In an aspect, a mobility management entity is provided. The mobility management entity comprises a unit for receiving an attach request message or a TAU request message from a user equipment, the attach request message or the TAU request comprises UE security capabilities including UE new radio (NR) security capabilities. The mobility management entity further comprises a unit for replaying UE security capabilities included in the attach request message or the TAU request message to the UE, the replayed UE security capabilities being without comprising the UE NR security capabilities.

In an aspect, a mobility management entity is provided. The mobility management entity comprises a unit for receiving an attach request message or a TAU request message from a user equipment, wherein the attach request message comprises UE security capabilities that includes UE new radio (NR) security capabilities. The mobility management entity further comprises a unit for sending the UE NR security capabilities to a master evolved (eNB) in a S1 context setup message.

In an aspect, a base station is provided. The base station comprises a sending unit configured to send a path switch request message to an enhanced mobility management entity, wherein the path switch request message comprises an indication to request user equipment (UE) new radio (NR) security capabilities. The base station further comprises receiving unit configured to a path switch request acknowledge message from the enhanced mobility management entity, wherein the path switch request acknowledge message comprises the UE NR security capabilities.

In an aspect, a network device is provided. The network device comprises a non-transitory memory storing instructions; and one or more processors in communication with the non-transitory memory, wherein the one or more processors execute the instructions to perform the method according to the ninth aspect and corresponding possible implementations.

In an aspect, a non-transitory computer-readable media is provided. The non-transitory computer-readable media is configured to store computer instructions that when executed by one or more processors, cause the one or more processors to perform to the methods according to the first aspect, ninth aspect and above possible implementations.

In an aspect, a chipset system is provided. The chipset system includes at least one processor, used to implement the functionality of the above central device, the distributed device, or the RAN node. The chipset system may further includes a memory for storing program instructions and data. The chipset system may be comprised by chipsets, and may also be comprised by at least one of chipsets and other discrete device.

According to a second aspect, a method for attaching is provided. The method comprising: transmitting, by a UE, an attach request message to a mobility management entity, wherein the attach request message includes UE security capabilities comprising UE NR security capabilities; receiving, by the UE, a NAS SMC message from the mobility management entity, wherein the NAS SMC message includes replayed UE security capabilities without including the UE NR security capabilities; determining, by the UE, no bidding down attack has happened based on a mismatch of the UE security capabilities comprised in the attach request message and the replayed UE security capabilities; and attaching, by the UE, to the mobility management entity.

In a first implementation form of the method according to the second aspect as such, wherein the UE security capabilities comprise the UE NR security capabilities and UE LTE security capabilities, and the attach request message comprises a first information element for carrying the UE NR security capabilities and a second information element for carrying the UE LTE security capabilities.

In a second implementation form of the method according to the second aspect as such or any preceding implementation form of the second aspect, wherein the UE security capabilities further comprises UE UMTS security capabilities, the second information element further comprises the UE UMTS security capabilities.

According to a third aspect, a method of a dual connectivity is provided. The method comprising: establishing, by a MeNB, a RRC connection with a UE; determining, by the MeNB, that the UE supports a NR capability; obtaining, by the MeNB, UE NR security capabilities; transmitting, by the MeNB, a SgNB addition request message to a base station, wherein the SgNB addition request message comprises the UE NR security capabilities; and receiving, by the MeNB, a SgNB addition request acknowledge message from the base station.

In a first implementation form of the method according to the third aspect as such, wherein the SgNB addition request acknowledge message comprises NR algorithms selected by the base station.

In a second implementation form of the method according to the third aspect as such or any preceding implementation form of the third aspect, further comprising: sending, by the MeNB, a RRC connection reconfiguration message to the UE to instruct the UE to configure a DRB.

According to a fourth aspect, a communications method is provided. The method comprising: receiving, by a legacy mobility management entity, an attach request message from a user equipment, wherein the attach request message comprises UE security capabilities including UE NR security capabilities; and replaying, by the legacy MME, UE security capabilities included in the attach request message to the UE, the replayed UE security capabilities being without comprising the UE NR security capabilities.

In a first implementation form of the method according to the fourth aspect as such, further comprising: dropping, by the legacy MME, the UE NR security capabilities.

In a second implementation form of the method according to the fourth aspect as such or any preceding implementation form of the fourth aspect, wherein the UE security capabilities comprise the UE NR security capabilities and UE LTE security capabilities, and the attach request message comprises a first information element for carrying the UE NR security capabilities and a second information element for carrying the UE LTE security capabilities.

In a third implementation form of the method according to the fourth aspect as such or any preceding implementation form of the fourth aspect, wherein the UE security capabilities further comprises UE UMTS security capabilities, the second information element further comprises the UE UMTS security capabilities.

According to a fifth aspect, a communications method is provided. The method comprising: receiving, by an enhanced mobility management entity, an attach request message from a user equipment, wherein the attach request message comprises UE security capabilities that includes UE NR security capabilities; and sending, by the enhanced mobility management entity, the UE NR security capabilities to a MeNB in a S1 context setup message.

In a first implementation form of the method according to the fifth aspect as such, wherein the UE security capabilities comprise the UE NR security capabilities and UE long term evolution (LTE) security capabilities, and the attach request message comprises a first information element for carrying the UE NR security capabilities and a second information element for carrying the UE LTE security capabilities.

In a second implementation form of the method according to the fifth aspect as such or any preceding implementation form of the fifth aspect, wherein the UE security capabilities further comprises UE UMTS security capabilities, the second information element further comprises the UE UMTS security capabilities.

According to a sixth aspect, a communications method is provided. The method comprising: sending, by a base station, a path switch request message to an enhanced mobility management entity, wherein the path switch request message comprises an indication to request UE NR security capabilities; and receiving, by the base station, a path switch request acknowledge message from the enhanced mobility management entity, wherein the path switch request acknowledge message comprises the UE NR security capabilities.

In a first implementation form of the method according to the sixth aspect as such, further comprising: establishing, by the base station, a DRB at a second base station by sending the UE NR security capabilities in a SgNB addition procedure.

According to a seventh aspect, a method for attaching is provided. The method comprising: transmitting, by a UE, a TAU request message to a mobility management entity, wherein the TAU request message includes UE security capabilities comprising UE NR security capabilities; receiving, by the UE, a NAS SMC message from the mobility management entity, wherein the NAS SMC message includes replayed UE security capabilities without including the UE NR security capabilities; determining, by the UE, no bidding down attack has happened based on a mismatch of the UE security capabilities comprised in the TAU request message and the replayed UE security capabilities; and attaching, by the UE, to the mobility management entity.

In a first implementation form of the method according to the seventh aspect as such, wherein the UE security capabilities comprise the UE NR security capabilities and UE LTE security capabilities, and the TAU request message comprises a first information element for carrying the UE NR security capabilities and a second information element for carrying the UE LTE security capabilities.

In a second implementation form of the method according to the seventh aspect as such or any preceding implementation form of the seventh aspect, wherein the UE security capabilities further comprises UE UMTS security capabilities, the second information element further comprises the UE UMTS security capabilities.

According to an eighth aspect, a communications method is provided. The method comprising: receiving, by a legacy mobility management entity, a TAU request message from a user equipment, wherein the TAU request message comprises UE security capabilities including UE NR security capabilities; and replaying, by the legacy MME, UE security capabilities included in the TAU request message to the UE, the replayed UE security capabilities being without comprising the UE NR security capabilities.

In a first implementation form of the method according to the eighth aspect as such, further comprising: dropping, by the legacy MME, the UE NR security capabilities.

In a second implementation form of the method according to the eighth aspect as such or any preceding implementation form of the eighth aspect, wherein the UE security capabilities comprise the UE NR security capabilities and UE LTE security capabilities, and the TAU request message comprises a first information element for carrying the UE NR security capabilities and a second information element for carrying the UE LTE security capabilities.

In a third implementation form of the method according to the eighth aspect as such or any preceding implementation form of the eighth aspect, wherein the UE security capabilities further comprises UE universal mobile telecommunications system (UMTS) security capabilities, the second information element further comprises the UE UMTS security capabilities.

According to a ninth aspect, a communications method is provided. The method comprising: receiving, by an enhanced mobility management entity, an a TAU request message from a user equipment, wherein the TAU request message comprises UE security capabilities that includes UE NR security capabilities; and sending, by the enhanced mobility management entity, the UE NR security capabilities to a eNB in a S1 context setup message.

In a first implementation form of the method according to the ninth aspect as such, wherein the UE security capabilities comprise the UE NR security capabilities and UE LTE security capabilities, and the TAU request message comprises a first information element for carrying the UE NR security capabilities and a second information element for carrying the UE LTE security capabilities.

In a second implementation form of the method according to the ninth aspect as such or any preceding implementation form of the ninth aspect, wherein the UE security capabilities further comprises UE UMTS security capabilities, the second information element further comprises the UE UMTS security capabilities.

According to a tenth aspect, a network device is provided. The network device comprising: a non-transitory memory storing instructions; and one or more processors in communication with the non-transitory memory, wherein the one or more processors execute the instructions to perform the method according to any one of the second to ninth aspects.

