Device, method, apparatus and medium for secure connection release and network redirection

Abstract

The present invention is entitled "Apparatus, methods, devices and media for secure connection release and network redirection". The present disclosure relates to technology for securely performing connection release and network redirection in a wireless communication system. A wireless device may establish a radio resource control (RRC) connection with a first cell. The wireless device may receive an RRC connection release message from the first cell. The RRC connection release message may include an indication for redirecting the wireless device to a second cell. The RRC connection with the first cell may be released. It may be determined whether security with the first cell has been established when the indication for redirecting the wireless device to the second cell is received. A new serving cell may be selected based at least in part on whether security with the first cell has been established when the indication for redirecting the wireless device to the second cell is received.

Description

[0001] This application is a divisional application of invention patent application 201710682922.9, filed on August 11, 2017, entitled "Apparatus, methods, devices and media for secure connection release and network redirection".

[0002] Priority information

[0003] This patent application claims priority to U.S. Provisional Patent Application Serial No. 62 / 374,257, filed on August 12, 2016, entitled “Secure Connection Release and Network Redirection,” which is hereby incorporated by reference in its entirety as if fully and completely described herein. Technical Field

[0004] The present patent application relates to wireless devices, including apparatus, systems and methods for securely performing connection release and network redirection in a wireless communication system. Background Art

[0005] The use of wireless communication systems is growing rapidly. In addition, there are many different wireless communication technologies and standards. Some examples of wireless communication standards include GSM, UMTS (e.g., associated with WCDMA or TD-SCDMA air interfaces), LTE, Advanced LTE (LTE-A), HSPA, 3GPP2 CDMA2000 (e.g., 1xRTT, 1xEV-DO, HRPD, eHRPD), IEEE 802.11 (WLAN or Wi-Fi), IEEE 802.16 (WiMAX), Bluetooth, etc. Summary of the invention

[0006] Provided herein are embodiments of an apparatus, system, and method for securely performing connection release and network redirection in a wireless communication system.

[0007] As wireless communication technologies have evolved, so have security and authentication technologies. In some cases, less stringent / less effective authentication mechanisms used by older / legacy wireless communication technologies may be employed by unauthorized parties, such as for eavesdropping or for other purposes that may violate privacy. Additionally, if the redirection policy of a wireless network is not carefully developed, it may be possible for an unauthorized party to redirect a user's wireless device to use such less secure wireless communication technologies, such as even when more secure wireless communication technology options are available for those devices.

[0008] Therefore, it may be desirable (at least in some cases) to configure network redirection policies in a manner that avoids such unauthorized redirections, and / or to configure wireless devices to avoid or discard potential unauthorized redirections.

[0009] For example, according to some of the techniques described herein, a wireless device that receives an indication (e.g., in an RRC Connection Release message, in an RRC Connection Reject message, etc.) to redirect it to a cell operating according to a wireless communication technology that is deemed not sufficiently secure when it has not yet performed authentication with its current cell may choose not to comply with the redirection indication. Instead, the wireless device may perform a cell reselection procedure to determine a new serving cell for the wireless device. This may help the wireless device avoid complying with a redirection indication received from an unauthorized party.

[0010] As another possibility, the cellular base station may be configured to not redirect the wireless device to a cell operating according to a wireless communication technology that is considered not sufficiently secure unless authentication with the wireless device has been performed / not redirect the wireless device to a cell operating according to a wireless communication technology that is considered not sufficiently secure until authentication with the wireless device has been performed. Thus, if the cellular base station wants to provide a redirection indication to the wireless device when authentication with the wireless device has not yet been performed, the cellular base station may choose to instruct the wireless device to redirect to a cell operating according to a wireless communication technology that is considered sufficiently secure. Alternatively, if the cellular base station wants to provide a redirection indication to the wireless device when authentication with the wireless device has not yet been performed and the cellular base station chooses to instruct the wireless device to redirect to a cell operating according to a wireless communication technology that is considered not sufficiently secure, the cellular base station may perform authentication with the wireless device before providing the redirection indication, for example so that the wireless device can be more confident that the redirection indication is being received from an authorized party.

[0011] The techniques described herein may be implemented in and / or used with a number of different types of devices, including, but not limited to, cellular telephones, cellular base stations, tablet computers, wearable computing devices, portable media players, and any of a variety of other computing devices.

[0012] This summary is intended to provide a brief overview of some of the topics described in this document. Therefore, it should be understood that the features described above are only examples and should not be construed as narrowing the scope or essence of the topics described herein in any way. Other features, aspects, and advantages of the topics described herein will become apparent from the following detailed description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] A better understanding of the present subject matter may be obtained when the following detailed description of the embodiments is considered in conjunction with the following drawings, in which:

[0014] Figure 1 An exemplary (and simplified) wireless communication system according to some embodiments is shown;

[0015] Figure 2 A base station (BS) in communication with a user equipment (UE) device is shown according to some embodiments;

[0016] Figure 3 shows an exemplary block diagram of a UE according to some embodiments;

[0017] Figure 4 shows an exemplary block diagram of a BS according to some embodiments; and

[0018] Figure 5 is a communication flow diagram illustrating an exemplary method for securely performing RRC connection release and network redirection according to some embodiments.

[0019] Although the features described herein are susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and described in detail herein. However, it should be understood that the drawings and detailed description thereof are not intended to limit the invention to the particular forms disclosed, but on the contrary, the intention is to cover all modifications, equivalents and alternatives falling within the spirit and scope of the subject matter defined by the appended claims. DETAILED DESCRIPTION

[0020] Acronyms

[0021] The following acronyms are used in this disclosure.

[0022] 3GPP: Third Generation Partnership Project

[0023] 3GPP2: Third Generation Partnership Project 2

[0024] RAN: Radio Access Network

[0025] GSM: Global System for Mobile Communications

[0026] GERAN: GSM Edge Radio Access Network

[0027] UMTS: Universal Mobile Telecommunications System

[0028] UTRAN: UMTS Terrestrial Radio Access Network or Universal Terrestrial Radio Access Network

[0029] LTE: Long Term Evolution

[0030] E-UTRAN: Evolved UMTS Radio Access Network or Evolved Universal Radio Access Network

[0031] RRC: Radio Resource Control

[0032] NW: Network

[0033] the term

[0034] The following is a glossary of terms used in this disclosure:

[0035] Memory medium - any of various types of non-transitory memory devices or storage devices. The term "memory medium" is intended to include installation media, such as CD-ROM, floppy disk or tape devices; computer system memory or random access memory, such as DRAM, DDR RAM, SRAM, EDO RAM, Rambus RAM, etc.; non-volatile memory, such as flash memory, magnetic media, such as hard disk or optical storage device; registers, or other similar types of memory elements, etc. The memory medium may also include other types of non-transitory memory, or a combination thereof. In addition, the memory medium may be located in a first computer system that executes a program, or may be located in a different second computer system that is connected to the first computer system through a network such as the Internet. In the latter case, the second computer system may provide program instructions to the first computer for execution. The term "memory medium" may include two or more memory media that may reside in different locations, such as different computer systems connected through a network. The memory medium may store program instructions (e.g., embodied as a computer program) that may be executed by one or more processors.

[0036] Carrier Medium—storage media as described above and physical transmission media such as a bus, network, and / or other physical transmission media that transport signals such as electrical, electromagnetic, or digital signals.

[0037] Programmable hardware element - includes various hardware devices having multiple programmable function blocks connected via programmable interconnects. Examples include FPGAs (field programmable gate arrays), PLDs (programmable logic devices), FPOAs (field programmable object arrays), and CPLDs (complex PLDs). Programmable function blocks can range from fine-grained (combinational logic units or lookup tables) to coarse-grained (arithmetic logic units or processor cores). Programmable hardware elements may also be referred to as "reconfigurable logic units".

[0038] Computer system - any of various types of computing or processing systems, including a personal computer system (PC), a mainframe computer system, a workstation, a network appliance, an Internet appliance, a personal digital assistant (PDA), a television system, a grid computing system, or other devices, or combinations of devices. In general, the term "computer system" can be broadly defined to include any device (or combination of devices) having at least one processor that executes instructions from a memory medium.

[0039] User Equipment (UE) (or "UE device") - any of various types of computer system devices that are mobile or portable and perform wireless communications. Examples of UE devices include mobile phones or smart phones (e.g., iPhones). TM , based on Android TM phones), portable gaming devices (e.g., Nintendo DS TM , PlayStation Portable TM 、Gameboy Advance TM , iPhone TM ), wearable devices (e.g., smart watches, smart glasses), laptops, PDAs, portable Internet devices, music players, data storage devices, or other handheld devices, etc. In general, the term "UE" or "UE device" may be broadly defined to include any electronic device, computing device, and / or telecommunication device (or combination of devices) that is convenient for a user to transport and capable of wireless communication.

[0040] Wireless device - any of several types of computer system devices that perform wireless communications. A wireless device may be portable (or mobile), or may be stationary or fixed to a particular location. A UE is an example of a wireless device.

[0041] Communication device – Any of several types of computer systems or devices that perform communications, where the communications may be wired or wireless. A communication device may be portable (or mobile), or may be fixed or secured to a particular location. A wireless device is one example of a communication device. A UE is another example of a communication device.

[0042] Base Station - The term "base station" has the full breadth of its ordinary meaning and includes at least a wireless communication station that is installed at a fixed location and used to communicate as part of a wireless telephone system or radio system.

[0043] Processing Element – ​​refers to various elements or combinations of elements. Processing elements include, for example, circuits such as ASICs (application specific integrated circuits), portions or circuits of individual processor cores, entire processor cores, individual processors, programmable hardware devices such as field programmable gate arrays (FPGAs), and / or larger portions of systems including multiple processors.

[0044] Channel - a medium used to transmit information from a transmitter to a receiver. It should be noted that since the characteristics of the term "channel" may vary according to different wireless protocols, the term "channel" used herein should be considered to be used in a manner that conforms to the standards of the type of device in which the term is used. In some standards, the channel width may be variable (e.g., depending on device capabilities, frequency band conditions, etc.). For example, LTE may support scalable channel bandwidths of 1.4MHz to 20MHz. In contrast, a WLAN channel may be 22MHz wide, while a Bluetooth channel may be 1MHz wide. Other protocols and standards may include different definitions of channels. In addition, some standards may define and use multiple types of channels, such as different channels for uplink or downlink and / or different channels for different purposes such as data, control information, etc.

[0045] Frequency band - The term "frequency band" has the full breadth of its ordinary meaning and includes at least a segment of spectrum (eg, radio frequency spectrum) in which channels are used or reserved for the same purpose.

[0046] Automatic – refers to an action or operation performed by a computer system (e.g., software executed by a computer system) or device (e.g., circuit, programmable hardware element, ASIC, etc.) without user input directly specifying or executing the action or operation. Thus, the term “automatic” is in contrast to manual user execution or specification, where the user provides input to directly execute the action. An automatic process may be initiated by input provided by a user, but the subsequent “automatic” execution of the action is not specified by the user, i.e., is not a “manual” execution, where the user specifies each action to be performed. For example, a user filling out an electronic form (e.g., by typing in information, selecting checkboxes, radio selections, etc.) by selecting each field and providing input to specify information is manually filling out the form, even though the computer system must update the form in response to the user action. The form may be automatically filled out by a computer system, where the computer system (e.g., software executing on the computer system) analyzes the fields of the form and fills out the form without any user input specifying the answers to the fields. As shown above, a user may invoke automatic filling of a form but not participate in the actual filling of the form (eg, the user does not manually specify answers to fields but rather they are automatically completed). This specification provides various examples of operations that are automatically performed in response to actions taken by a user.

[0047] Configured to – Various components may be described as being “configured to” perform one or more tasks. In such contexts, “configured to” is a broad statement that generally means “having” a “structure” to perform the one or more tasks during operation. Thus, a component may be configured to perform a task even when the component is not currently performing the task (e.g., a set of electrical conductors may be configured to electrically connect a module to another module even if the two modules are not connected). In some contexts, “configured to” may be a broad statement that generally means “having” a “circuitry” to perform the one or more tasks during operation. Thus, a component may be configured to perform the task even when the component is not currently turned on. Typically, circuitry that forms a structure corresponding to “configured to” may include hardware circuitry.

[0048] For ease of description, various components may be described as performing one or more tasks. Such descriptions should be interpreted to include the phrase "configured to". The description of a component configured to perform one or more tasks is clearly intended not to invoke the interpretation of the sixth paragraph of 35 U.S.C. §112 for that component.

[0049] Figure 1 to Figure 2 -Communication system

[0050] Figure 1 An exemplary (and simplified) wireless communication system is shown in which various aspects of the present disclosure may be implemented according to some embodiments. Figure 1 Any or all of the wireless devices shown in the figure may be configured to be used, for example, according to Figure 5 The method of secure connection release and network redirection. Please note that Figure 1 The system is only one example of one possible system, and embodiments may be implemented in any of a variety of systems as desired.

[0051] As shown, the exemplary wireless communication system includes a base station 102A that communicates with one or more user devices 106A, 106B...106N via a transmission medium. Each user device may be referred to herein as a "user equipment" (UE). Therefore, user device 106 is referred to as a UE or UE device.

[0052] The base station 102A may be a base transceiver station (BTS) or a cell site and may include hardware and / or software to enable wireless communications with the UEs 106A to 106N. The base station 102A may also be equipped to communicate with a network 100 (e.g., a core network of a cellular service provider, a telecommunications network such as a public switched telephone network (PSTN), and / or the Internet, among other possibilities). Thus, the base station 102A may facilitate communications between user devices and / or between user devices and the network 100.

[0053] The communication area (or coverage area) of a base station may be referred to as a “cell”. The base station 102A and the UE 106 may be configured to communicate via a transmission medium using any of a variety of radio access technologies (RATs), which are also referred to as wireless communication technologies or telecommunication standards, such as GSM, UMTS (WCDMA, TD-SCDMA), LTE, Advanced LTE (LTE-A), NR, 3GPP2 CDMA2000 (e.g., 1xRTT, 1xEV-DO, HRPD, eHRPD), Wi-Fi, WiMAX, etc.

[0054] Base station 102A and other similar base stations (such as base stations 102B...102N) operating according to the same or different cellular communication standards can therefore be provided as a network of cells that can provide continuous or nearly continuous overlapping service to UE 106A-N and similar devices over a geographic area via one or more cellular communication standards.

[0055] Thus, although base station 102A may function as Figure 1 106A-N, but each UE 106 may also be able to receive signals from (and possibly within communication range of) one or more other cells (which may be provided by base stations 102B-N and / or any other base stations), which may be referred to as "neighboring cells." Such cells may also be able to facilitate communications between user devices and / or between user devices and network 100. Such cells may include "macro" cells, "micro" cells, "pico" cells, and / or cells of any of a variety of other granularities of service area size. For example, in Figure 1 The base stations 102A-B shown in FIG. 1 may be macro cells, while the base station 102N may be a micro cell. Other configurations are also possible.

[0056] Note that the UE 106 may be capable of communicating using multiple wireless communication standards. For example, the UE 106 may be configured to communicate using two or more of GSM, UMTS, CDMA2000, LTE, LTE-A, WLAN, Bluetooth, one or more global navigation satellite systems (GNSS, such as GPS or GLONASS), one and / or more mobile television broadcast standards (e.g., ATSC-M / H), etc. Other combinations of wireless communication standards (including more than two wireless communication standards) are also possible.

[0057] Figure 2A user equipment 106 (e.g., one of devices 106A-106N) is shown in communication with a base station 102 (e.g., one of base stations 102A-102N) according to some embodiments. UE 106 may be a device with cellular communication capabilities, such as a mobile phone, a handheld device, a wearable device, a computer or tablet, or virtually any type of wireless device.

[0058] UE 106 may include a processor configured to execute program instructions stored in a memory. UE 106 may perform any of the method implementations described herein by executing such stored instructions. Alternatively or in addition, UE 106 may include a programmable hardware element, such as an FPGA (field programmable gate array) configured to perform any of the method implementations described herein or any part of any of the method implementations described herein.

[0059] As described above, UE 106 can be configured to communicate using any of a variety of RATs. For example, UE 106 can be configured to communicate using two or more of GSM, CDMA2000, LTE, LTE-A, NR, WLAN, or GNSS. Other combinations of wireless communication technologies are also possible.

[0060] UE 106 may include one or more antennas for communicating using one or more wireless communication protocols or technologies. In one embodiment, UE 106 may be configured to use CDMA2000 (1xRTT / 1xEV-DO / HRPD / eHRPD) or LTE using a single shared radio component, and / or use GSM or LTE using the single radio component to communicate. The shared radio component may be coupled to a single antenna, or may be coupled to multiple antennas (e.g., for MIMO) for performing wireless communications. Typically, the radio component may include any combination of a baseband processor, an analog RF signal processing circuit (e.g., including filters, mixers, oscillators, amplifiers, etc.), or a digital processing circuit (e.g., for digital modulation and other digital processing). Similarly, the radio component may implement one or more receive chains and transmit chains using the aforementioned hardware. For example, UE 106 may share one or more portions of a receive chain and / or transmit chain between multiple wireless communication technologies (such as those described above).

[0061] In some embodiments, the UE 106 may include independent transmit chains and / or receive chains (e.g., including independent RF and / or digital radio components) for each wireless communication protocol that it is configured to communicate. As another possibility, the UE 106 may include one or more radio components shared between multiple wireless communication protocols, and one or more radio components used uniquely by a single wireless communication protocol. For example, the UE 106 may include a shared radio component for communicating using either LTE or 1xRTT (or LTE or GSM), and an independent radio component for communicating using each of Wi-Fi and Bluetooth. Other configurations are also possible.

[0062] Figure 3 -Block diagram of UE device

[0063] Figure 3 A possible block diagram of a UE device 106 is shown. As shown, the UE device 106 may include a system on chip (SOC) 300 that may have parts for various purposes. For example, as shown, the SOC 300 may include one or more processors 302 that can execute program instructions of the UE device 106 and a display circuit 304 that can perform graphics processing and provide display signals to a display 360. The SOC 300 may also include a motion sensing circuit 370 that can detect the motion of the UE 106, for example, using a gyroscope, an accelerometer, and / or any of various other motion sensing components. The one or more processors 302 may also be coupled to a memory management unit (MMU) 340, which may be configured to receive addresses from the processor 302 and convert those addresses to locations in a memory (e.g., memory 306, read-only memory (ROM) 350, flash memory 310). The MMU 340 may be configured to perform memory protection and page table translation or setup. In some embodiments, the MMU 340 may be included as part of the one or more processors 302.

[0064] As shown, SOC 300 may be coupled to various other circuits of UE 106. For example, UE 106 may include various types of memory (e.g., including NAND flash memory 310), a connector interface 320 (e.g., for coupling to a computer system, a docking station, a charging station, etc.), a display 360, and wireless communication circuitry 330 (e.g., for GSM, UMTS, LTE, LTE-A, NR, CDMA2000, Bluetooth, WiFi, NFC, GPS, etc.).

[0065] The UE device 106 may include at least one antenna, and in some embodiments may include multiple antennas 335a and 335b, for performing wireless communications with a base station and / or other devices. For example, the UE device 106 may use antennas 335a and 335b to perform wireless communications. As described above, the UE device 106 may be configured in some embodiments to perform wireless communications using multiple wireless communication standards or radio access technologies (RATs).

[0066] The wireless communication circuitry 330 may include a Wi-Fi logic component 332, a cellular modem 334, and a Bluetooth logic component 336. The Wi-Fi logic component 332 is used to enable the UE device 106 to perform Wi-Fi communications on an 802.11 network. The Bluetooth logic component 336 is used to enable the UE device 106 to perform Bluetooth communications. The cellular modem 334 may be a lower power cellular modem capable of performing cellular communications according to one or more cellular communication technologies.

[0067] As described herein, the UE 106 may include hardware components and software components for implementing embodiments of the present disclosure. For example, one or more components of the wireless communication circuitry 330 of the UE device 106 (e.g., the cellular modem 334) may be configured to implement some or all of the methods described herein, such as by executing a processor of program instructions stored on a memory medium (e.g., a non-transitory computer-readable memory medium), a processor configured as an FPGA (field programmable gate array), and / or using dedicated hardware components that may include an ASIC (application-specific integrated circuit).

[0068] Figure 4 -Block diagram of a base station

[0069] Figure 4 An exemplary block diagram of a base station 102 according to some embodiments is shown. Note that Figure 4 The base station of is only one example of a possible base station. As shown, the base station 102 may include one or more processors 404 that may execute program instructions for the base station 102. The one or more processors 404 may also be coupled to a memory management unit (MMU) 440, which may be configured to receive addresses from the processor 404 and convert those addresses to locations in memory (e.g., memory 460 and read-only memory (ROM) 450) or to other circuits or devices.

[0070] The base station 102 may include at least one network port 470. Figure 1 and Figure 2 As described in , the network port 470 can be configured to couple to a telephone network and provide multiple devices such as the UE device 106 with access to the telephone network.

[0071] The network port 470 (or an additional network port) may also or alternatively be configured to couple to a cellular network, such as a core network of a cellular service provider. The core network may provide mobile-related services and / or other services to multiple devices, such as the UE device 106. In some cases, the network port 470 may be coupled to a telephone network via the core network, and / or the core network may provide a telephone network (e.g., in other UE devices served by the cellular service provider).

[0072] The base station 102 may include at least one antenna 434 and possibly multiple antennas. The antenna 434 may be configured to operate as a wireless transceiver and may be further configured to communicate with the UE device 106 via the radio component 430. The antenna 434 communicates with the radio component 430 via a communication chain 432. The communication chain 432 may be a receive chain, a transmit chain, or both. The radio component 430 may be configured to communicate via various wireless communication standards, including but not limited to LTE, LTE-A, NR, GSM, UMTS, CDMA2000, Wi-Fi, etc.

[0073] Base station 102 may be configured to communicate wirelessly using multiple wireless communication standards. In some cases, base station 102 may include multiple radio components that enable base station 102 to communicate according to multiple wireless communication technologies. For example, as one possibility, base station 102 may include an LTE radio component for performing communications according to LTE, and a Wi-Fi radio component for performing communications according to Wi-Fi. In this case, base station 102 may be able to operate as both an LTE base station and a Wi-Fi access point. As another possibility, base station 102 may include a multi-mode radio component capable of performing communications according to any of multiple wireless communication technologies (e.g., LTE and Wi-Fi, LTE and UMTS, LTE and CDMA2000, UMTS and GSM, etc.).

[0074] As further described later herein, BS 102 may include hardware components and software components for implementing the features described herein or supporting the implementation of the features described herein. The processor 404 of base station 102 may be configured to implement or support a specific implementation of some or all of the methods described herein, for example by executing program instructions stored on a memory medium (e.g., a non-transitory computer-readable memory medium). Alternatively, processor 404 may be configured as a programmable hardware element, such as an FPGA (field programmable gate array), or an ASIC (application-specific integrated circuit), or a combination thereof. Alternatively (or in addition), in combination with one or more of the other components 430, 432, 434, 440, 450, 460, 470, the processor 404 of BS 102 may be configured to implement or support some or all of the features described herein.

[0075] Figure 5 - Secure connection release and network redirection

[0076] Radio access networks operating according to different generations of cellular communications continue to exist and provide services to user wireless devices for a variety of reasons, such as to provide larger wireless service coverage areas, to provide services to legacy devices, to provide bridging services as newer generation technologies are being deployed, etc. As cellular communication technologies evolve, security and authentication procedures also evolve, such that newer generation cellular communication technologies (e.g., LTE, UMTS) may be more secure than older generation cellular communication technologies (e.g., GSM). As a result, unauthorized parties may attempt to exploit the lower security level of a particular (e.g., older) cellular communication technology by redirecting wireless devices in an area to such less secure cellular communication technology and eavesdropping on communications performed using the less secure cellular communication technology.

[0077] For example, it may be possible for an unauthorized party to set up an LTE or UMTS base station that appears to provide a cell, and when a wireless device attaches to the cell, the base station may immediately release the connection and include an instruction to redirect the wireless device to a GSM cell, even though no security procedures have been performed between the cell and the wireless device (e.g., because the unauthorized party's cell may not be able to successfully perform mutual authentication with the wireless device). If the wireless device is redirected to the GSM cell as instructed, the unauthorized party may be able to access calls and / or data exchanges performed by the wireless device using the GSM cell.

[0078] Figure 5 is a communication / signal flow diagram illustrating one possible approach for securely performing a radio resource control (RRC) connection release with redirection between a wireless device and a base station that may help prevent such unauthorized redirection, according to at least some embodiments. Figure 5 The scheme shown can be used in conjunction with any of the computer systems or devices shown in the above figures. In various embodiments, some of the elements of the scheme shown can be executed simultaneously, can be executed in an order different from the order shown, can be replaced by other elements, or can be omitted. Additional elements can also be executed as needed. As shown in the figure, the scheme can be operated as follows.

[0079] In 502, UE 106 and BS 102 may establish an RRC connection. According to at least some embodiments, the RRC connection may be established using a communication technology based on or at least partially based on LTE. As another possibility, the RRC connection may be established using a communication technology based on or at least partially based on UMTS. In some embodiments, any of various other wireless communication technologies may be used additionally / alternatively. The RRC connection may be scheduled in advance or unscheduled. UE 106 may perform a random access channel (RACH) process to establish an RRC connection. Alternatively, BS 102 may page UE 106 at a predetermined time, and UE 106 may respond to the paging message and exchange RRC connection establishment parameters with BS 102 to establish a scheduled RRC connection. BS 102 may provide a first cell that may serve as a serving cell for UE 106.

[0080] Once the RRC connection is established, the UE 106 and the BS 102 may communicate data, which may include uplink data communications from the UE 106 to the BS 102, and / or downlink data communications from the BS 102 to the UE 106. The UE 106 and the BS 102 may also perform one or more security procedures (e.g., mutual authentication) to establish security between the UE 106 and the BS 102 (e.g., if the BS 102 is an authorized cell provided by the cellular service provider). Alternatively, it is also possible that the UE 106 and the BS 102 do not perform security procedures or exchange data (e.g., if the BS 102 is not an authorized cell provided by the cellular service provider, or even if the BS 102 is an authorized cell provided by the cellular service provider, it may be due to a variety of possible reasons).

[0081] At 504, the BS 102 may determine to release the RRC connection. The BS 102 may determine to release the RRC connection for any of a variety of possible reasons, which may include but are not limited to load balancing of the BS 102, expiration of an RRC connection release timer, subscription features of the wireless device, and the like.

[0082] In 506, the BS 102 may determine to redirect the UE 106 to a second cell when the RRC connection is released. The second cell may be another cell operating according to the same RAT as the BS 102 or operating according to another radio access technology (e.g., may be an intra-RAT or inter-RAT cell redirection), and may be selected as the cell to which the UE 106 is redirected for any of a variety of possible reasons (e.g., network load balancing, relative priority levels of available neighboring cells, RATs of available neighboring cells, subscription characteristics of the wireless device, etc.).

[0083] According to some embodiments, BS 102 may provide redirection to another cell only if security has been established between BS 102 and UE 106, and / or may determine to perform a security procedure for establishing security between BS 102 and UE 106 before providing an indication to redirect UE 106 to another cell. This may help prevent the possibility that UE 106 discards the redirection indication due to insecurity. As another possibility, BS 102 may require that security be established between BS 102 and UE 106 before providing a redirection indication to a particular RAT (e.g., only to GSM, to both GSM and UMTS, etc.), but not for other RATs (e.g., not required for NR cells, not required for LTE cells, not required for UMTS cells, not required for any of NR / LTE / UMTS cells, etc.). In other words, the requirement to establish security between BS 102 and UE 106 before providing a redirection indication may apply only to certain types of redirection indications, depending, for example, on the security / authentication procedures used by the cell (or more generally, the cell type) to which the redirection indication relates, as desired by the base station operator and / or as specified by specification documents (e.g., NR, LTE, UMTS, etc.).

[0084] At 508, BS 102 may provide an RRC connection release message to UE 106. The RRC connection release message may include an indication to redirect UE 106 to the second cell.

[0085] At 510, UE 106 may release the RRC connection with BS 102. According to at least some embodiments, this may include removing / deleting context information for the RRC connection, entering idle mode, and / or any of a variety of other possible actions.

[0086] In 512, UE 106 may determine whether security with BS 102 has been established when the indication to redirect UE 106 to the second cell is received. For example, UE 106 may determine whether UE 106 and BS 102 have performed mutual authentication, e.g., to confirm that BS 102 is an authorized base station provided by a cellular service provider and that UE 106 is allowed to access the network to which BS 102 belongs.

[0087] In 514, UE 106 may perform new serving cell selection based at least in part on whether security with BS 102 was established when the indication to redirect UE 106 to the second cell was received.

[0088] According to some embodiments, if security with BS 102 is already established when the indication to redirect UE 106 to the second cell is received, UE 106 may select the second cell as indicated. For example, in this case, UE 106 may be confident that the redirection is authorized because UE 106 may have successfully established security with BS 102.

[0089] At least in some cases, UE 106 may select the second cell as instructed even if security with BS 102 has not been established when the indication to redirect UE 106 to the second cell is received. For example, if the second cell operates according to a RAT that is considered secure, UE 106 may select the second cell as instructed even if security with BS 102 has not been established when the indication to redirect UE 106 to the second cell is received because it may be possible to establish reliable security with the second cell.

[0090] However, at least in some cases, if security with the first cell has not been established when the indication to redirect the wireless device to the second cell is received, the second cell may not be selected (i.e., the indication to redirect UE 106 to the second cell may be discarded). For example, if the second cell operates according to GSM or otherwise operates according to a RAT that is considered to be unsecure or insufficiently secure, the wireless device may determine not to select the second cell, for example because it may be uncertain whether UE 106 can trust BS 102 attempting to redirect UE 106 to the second cell and establishing reliable security with the second cell may be impossible. In this case, UE 106 may perform a cell reselection procedure to determine a new serving cell to which UE 106 will attach.

[0091] In addition, at least according to some embodiments, if the UE 106 determines to discard the indication to redirect to the second cell based on the fact that security with the first cell has not been established when the indication to redirect the UE 106 to the second cell is received and / or based on the security level and / or RAT of the second cell, the UE 106 may take one or more measures to prevent reselection to the first cell. For example, if the first cell is operated by an unauthorized party that intends to redirect the wireless device to a less secure radio access technology, it may be desirable to avoid reselecting to the same cell because the cell may not be used to actually obtain service. For example, the UE 106 may prohibit itself from camping on the first cell for a limited or indefinite period of time based on the fact that security with the first cell has not been established when the indication to redirect the UE 106 to the second cell is received and / or based on the security level and / or RAT of the second cell. As another possibility, UE 106 may prohibit itself from camping on a frequency on which the first cell operates for a limited or indefinite period of time based on not having established security with the first cell when the indication to redirect UE 106 to the second cell is received and / or based on the security level and / or RAT of the second cell. Such broader restrictions may be preferred, at least in some cases, if, for example, it is suspected or believed that multiple cells using the same frequency may be in the vicinity of UE 106 are being used for similar unauthorized purposes.

[0092] According to some embodiments, the UE 106 may also declare a radio link failure (RLF) based on the fact that security with the first cell has not been established when the indication to redirect the UE 106 to the second cell is received and / or based on the security level and / or RAT of the second cell. This may also result in cell barring and / or frequency barring for the first cell, at least while the UE 106 performs cell selection and connection reestablishment. In this case, the UE 106 may perform a tracking area update (TAU) procedure with its new serving cell after cell reselection, for example, based on having declared RLF. This may help ensure that the UE 106 is synchronized with the correct network (e.g., a network to which the UE 106 is subscribed or, in other words, has access rights according to the subscription features of the UE 106), rather than with an unauthorized network.

[0093] As yet another possibility, the UE 106 may additionally or alternatively prohibit itself from camping on the second cell (and / or the frequency at which the second cell is deployed) for a limited or indefinite period of time based on not having established security with the first cell when the indication to redirect the UE 106 to the second cell is received and / or based on the security level and / or RAT of the second cell. For example, if the UE 106 determines that the indication to redirect the UE 106 to the second cell may not be authentic, it may be advantageous to prevent the possibility that the UE 106 may reselect to the second cell as part of its cell reselection process even if the indication to redirect the UE 106 to the second cell is discarded.

[0094] Note that although Figure 5 The method of describes techniques for securely handling a connection release with network redirection, but similar considerations may also apply to RRC connection reject messages according to some embodiments. For example, in UMTS, when an RRC connection is rejected by a cell, an indication may be provided to redirect the UE to another cell. Such a redirection indication received when security procedures have not yet been performed and security has not yet been established may come from an unauthorized source. Therefore, for a wireless device that receives an RRC connection reject with a redirection to a RAT that is not considered sufficiently secure (e.g., GSM), the redirection may not be processed and the device may depart from the cell that provided the RRC connection reject to find a new cell.

[0095] For example, a wireless device receiving an RRC connection rejection message with a redirection to another cell may select a new serving cell based at least in part on the radio access technology of the cell to which the redirection is indicated and / or the security and authentication procedures associated with the indicated cell. If the indicated cell operates according to a radio access technology that is considered sufficiently secure, the wireless device may select the indicated cell, but if the indicated cell operates according to a radio access technology that is considered not sufficiently secure, the indication may be discarded and a cell reselection procedure may be performed.

[0096] In addition, at least in some embodiments, if necessary, in the case where the redirection to an insufficiently secure cell is indicated in the RRC connection rejection message, a temporary or indefinite cell barring may be enabled for the redirecting cell and / or the indicated cell. For example, if the indicated cell operates according to a specific radio access technology (e.g., which is considered unsafe), the redirecting cell (or the frequency at which the redirecting cell is deployed) may be barred, and / or the indicated cell may be barred.

[0097] To avoid such situations, the base station may additionally or alternatively be configured to determine the cell to which the wireless device is redirected in the RRC Connection Reject message based at least in part on the radio access technology of the cell. For example, the base station may choose to not indicate to the wireless device in conjunction with the RRC Connection Reject message a redirection to a cell operating according to a radio access technology that is not considered sufficiently secure, for example because the wireless device may not be able to confirm that the redirection is authorized if authentication with the wireless device has not yet been performed.

[0098] It is also noted that the wireless device may be configured to ignore unprotected redirection indications (e.g., an indication of redirection to an unsecured cell received with an RRC Connection Release message or an RRC Connection Reject message prior to authentication) internally (e.g., based on configuration information not stored in long-term / non-volatile memory), or may be so configured based on network signaling (e.g., non-access stratum signaling) from a cellular network with which the wireless device is communicating. For example, if a cellular network is configured not to provide unprotected redirection indications, the cellular network may also configure wireless devices within the network to ignore unprotected redirection indications, because in such cases, any unprotected redirection indications may be very likely to be unauthorized.

[0099] Additional Information

[0100] The additional descriptions provided herein below are for illustrative purposes only. Figure 5 Further considerations of the method and possible implementation details are provided and are not intended to be limiting of the present disclosure as a whole. Many variations and alternatives to the details provided herein below are possible and should be considered within the scope of the present disclosure.

[0101] Research has shown that LTE NWs may be potentially vulnerable to security threats; for example, it may be possible to exploit specific signaling vulnerabilities present in the system. An example of such a possible signaling vulnerability may occur when performing an LTE connection release using a redirection to GSM. In LTE, the RRC connection release message may carry information for redirection to other frequencies and RATs. Currently, such a release message with redirection may appear at any stage of the LTE connection. Therefore, such a message may appear before security is established, in which case the message may not be protected. This vulnerability in the LTE system may cause a third party to redirect the wireless device to a GSM network that does not have strict security and authentication. Once the device is in the GSM network, a third party may be able to eavesdrop on the user's calls and data. Similar problems may also be possible in the process from UMTS to GSM, such as when a connection release is performed when security activation has not yet been performed, or when a connection rejection occurs (which may also occur when security is not activated).

[0102] A possible solution to this problem may include not allowing LTE redirection and / or UMTS redirection to GMS before security is activated. With this approach, if a connection release message with redirection to GSM is received before security is activated, the UE may discard the redirection message and only follow the release message.

[0103] As another method, when an RRC Connection Release with LTE or UMTS redirection to GSM is received before security is activated, the device receiving the message will release the connection normally. However, the device will not redirect to GSM, but will stay in LTE or UMTS and perform the cell selection process. The cell / frequency on which the RRC Connection Release message is received may be prohibited. When the cell / frequency is prohibited, the device may perform the prohibition as if intraFreqReselection is set to notAllowed.

[0104] As yet another approach, when an RRC connection release with LTE or UMTS redirection to GSM is received before security is activated, the device receiving the message will declare a radio link failure (RLF) and treat it as an invalid configuration. With this approach, after declaring RLF, the device may perform cell selection for connection reestablishment. In order to not allow the same cell to be selected again, the device may prohibit the cell and perform the prohibition as if intraFreqReselection is set to notAllowed. In this case, the entire frequency may be prohibited from being pre-occupied. After selecting a new serving cell, the device may perform a tracking area update (TAU) procedure due to reestablishment and may reacquire synchronization with the correct network accordingly.

[0105] In conjunction with such possible solutions on the device side, it may also be possible to implement one or more modifications to the LTE and / or UMTS specification documents to help prevent an authorized network / cell from providing a redirection indication to a less secure cell when security has not yet been established. For example, as one possibility, 3GPP TS 36.331 may be modified to specify that the redirectedCarrierInfo field of the RRCConnectionRelease message including redirection information for redirecting the wireless device to GERAN (and / or one or more other types of RAN, if desired) is only allowed after successful security activation. As another (additional or alternative) possibility, as an exception to being more generally unprotected (e.g., allowed to be sent before security activation), if the redirectedCarrierInfo to GERAN (and / or one or more other types of RAN, if desired) is included, the RRCConnectionRelease message may be indicated as being protected for security and / or privacy purposes (e.g., cannot be sent before security activation).

[0106] Further exemplary embodiments are provided below.

[0107] A set of embodiments may include a method comprising: by a wireless device: establishing a radio resource control (RRC) connection with a first cell; receiving an RRC connection release message from the first cell, wherein the RRC connection release message includes an indication for redirecting the wireless device to a second cell; releasing the RRC connection with the first cell; determining whether security with the first cell was established when the indication for redirecting the wireless device to the second cell was received; and selecting a new serving cell based at least in part on whether security with the first cell was established when the indication for redirecting the wireless device to the second cell was received.

[0108] According to some embodiments, if security with the first cell has been established when the indication for redirecting the wireless device to the second cell is received, the second cell is selected, wherein if security with the first cell has not been established when the indication for redirecting the wireless device to the second cell is received, the second cell is not selected.

[0109] According to some embodiments, selecting the new serving cell is further based at least in part on a radio access technology of the second cell.

[0110] According to some embodiments, selecting the new serving cell is further based at least in part on security and authentication procedures associated with the second cell.

[0111] According to some embodiments, the first cell operates according to LTE or UMTS and the second cell operates according to GSM.

[0112] According to some embodiments, the method further includes: declaring a radio link failure of the first cell if security with the serving cell has not been established when an indication for redirecting the wireless device to the second cell is received; and performing a tracking area update with a new serving cell after selecting the new serving cell based at least in part on declaring a radio link failure of the first cell.

[0113] According to some embodiments, the method further comprises: if security with the first cell has not been established when the indication to redirect the wireless device to the second cell is received, barring the first cell.

[0114] According to some embodiments, the method further comprises: if security with the first cell has not been established when the indication to redirect the wireless device to the second cell is received, barring the second cell.

[0115] Another set of embodiments may include a method comprising: by a wireless device: attempting to establish a radio resource control (RRC) connection with a first cell; receiving an RRC connection reject message from the first cell, wherein the RRC connection reject message includes an indication for redirecting the wireless device to a second cell; and selecting a new serving cell based at least in part on a radio access technology of the second cell, wherein if the second cell operates according to GSM, the indication for redirecting the wireless device to the second cell is discarded.

[0116] Another set of embodiments may include a method comprising: by a cellular base station configured to provide a first cell: establishing a radio resource control (RRC) connection with a wireless device; determining to release the RRC connection with the wireless device; determining to redirect the wireless device to a second cell when the RRC connection is released; establishing security with the wireless device before releasing the RRC connection with the wireless device based at least in part on determining to redirect the wireless device to the second cell when the RRC connection is released; and providing an RRC connection release message to the wireless device, wherein the RRC connection release message includes an indication for redirecting the wireless device to the second cell.

[0117] According to some embodiments, the second cell operates in accordance with GSM, wherein establishing security with the wireless device prior to releasing the RRC connection with the wireless device is further based at least in part on the second cell operating in accordance with GSM.

[0118] Another set of exemplary embodiments may include an apparatus including a processing element configured to cause the apparatus to implement any or all of the foregoing examples.

[0119] Another set of exemplary embodiments may include a wireless device comprising: an antenna; a radio component coupled to the antenna; and a processing element operatively coupled to the radio component, wherein the device is configured to implement any or all portions of the foregoing examples.

[0120] Another set of exemplary embodiments may include a non-transitory computer-accessible storage medium including program instructions that, when executed at a device, cause the device to implement any or all portions of any of the foregoing examples.

[0121] Another set of exemplary embodiments may include a computer program including instructions for performing any or all portions of any of the foregoing examples.

[0122] Another set of exemplary embodiments may include an apparatus including means for performing any or all elements of any of the preceding examples.

[0123] The embodiments of the present disclosure may be implemented in any of a variety of forms. For example, some embodiments may be implemented as computer-implemented methods, computer-readable storage media, or computer systems. Other embodiments may be implemented using one or more custom-designed hardware devices such as ASICs. Other additional embodiments may be implemented using one or more programmable hardware elements such as FPGAs.

[0124] In some embodiments, a non-transitory computer-readable storage medium may be configured such that it stores program instructions and / or data, wherein the program instructions, if executed by a computer system, cause the computer system to perform a method, such as any of the method embodiments described herein, or any combination of the method embodiments described herein, or any subset of any of the method embodiments described herein, or any combination of such subsets.

[0125] In some embodiments, the device (e.g., UE 106) may be configured to include a processor (or a group of processors) and a memory medium, wherein the memory medium stores program instructions, wherein the processor is configured to read and execute the program instructions from the memory medium, wherein the program instructions are executable to implement any of the various method implementations described herein (or any combination of the method implementations described herein, or any subset of any of the method implementations described herein, or any combination of such subsets). The device may be implemented in any of various forms.

[0126] Although the above embodiments have been described in considerable detail, numerous variations and modifications will become apparent to those skilled in the art once the above disclosure is fully appreciated. It is intended that the following claims be interpreted to encompass all such variations and modifications.

Claims

1. A device for wireless communication, comprising: a processor configured to, when executing instructions stored in the memory, cause the wireless device to perform operations comprising: Establishing a radio resource control (RRC) connection with the first cell; receiving an RRC connection release message from the first cell, wherein the RRC connection release message includes an indication for redirecting the wireless device to a second cell; releasing the RRC connection with the first cell; determining whether security with the first cell has been established when the indication to redirect the wireless device to the second cell is received; determining whether the stored configuration indicates to ignore an indication to redirect to an unsecured cell received with an RRC connection release message before security is established; and Ignoring the redirection indication and selecting a new serving cell in response to determining: security with the first cell has not been established when the indication to redirect the wireless device to the second cell is received, and The stored configuration indicates to ignore the redirection to an unsecured cell indication received with the RRC Connection Release message before security is established.

2. The device according to claim 1, in, If security with the first cell has been established when the indication to redirect the wireless device to the second cell is received, the second cell is selected as the new serving cell.

3. The device according to claim 2, in, Selecting a new serving cell is further based at least in part on a radio access technology, RAT, of the second cell.

4. The device according to claim 2, in, Selecting the new serving cell is further based at least in part on security and authentication procedures associated with the second cell.

5. The device according to claim 1, wherein: The operations also include: declaring a radio link failure of the first cell when security has not been established with the first cell upon receiving the indication to redirect the wireless device to the second cell; and After selecting a new serving cell based at least in part on declaring a radio link failure with the first cell, a tracking area update is performed with the new serving cell.

6. The device according to claim 1, wherein: The operations also include: When security with the first cell has not been established when the indication to redirect the wireless device to the second cell is received, the first cell is barred.

7. The device according to claim 1, wherein: The operations also include: When security with the first cell has not been established when the indication to redirect the wireless device to the second cell is received, the second cell is inhibited.

8. A method for wireless communication, comprising: Perform the following operations via wireless device: Establishing a radio resource control RRC connection with the first cell; receiving an RRC connection release message from the first cell, wherein the RRC connection release message includes an indication for redirecting the wireless device to a second cell; releasing the RRC connection with the first cell; determining whether security with the first cell has been established when the indication to redirect the wireless device to the second cell is received; determining whether the stored configuration indicates to ignore an indication to redirect to an unsecured cell received with an RRC connection release message before security is established; and Ignoring the redirection indication and selecting a new serving cell in response to determining: security with the first cell has not been established when the indication to redirect the wireless device to the second cell is received, and The stored configuration indicates to ignore the redirection to an unsecured cell indication received with the RRC Connection Release message before security is established.

9. The method according to claim 8, further comprising: If security with the first cell has been established when the indication to redirect the wireless device to the second cell is received, the second cell is selected as a new serving cell.

10. The method according to claim 9, in, Selecting a new serving cell is further based at least in part on a radio access technology, RAT, of the second cell.

11. The method according to claim 9, in, Selecting the new serving cell is further based at least in part on security and authentication procedures associated with the second cell.

12. The method according to claim 8, further comprising: declaring a radio link failure of the first cell when security has not been established with the first cell upon receiving the indication to redirect the wireless device to the second cell; and After selecting a new serving cell based at least in part on declaring a radio link failure with the first cell, a tracking area update is performed with the new serving cell.

13. The method according to claim 8, further comprising: When security with the first cell has not been established when the indication to redirect the wireless device to the second cell is received, the first cell is barred.

14. The method according to claim 8, further comprising: When security with the first cell has not been established when the indication to redirect the wireless device to the second cell is received, the second cell is inhibited.

15. A computer readable medium having instructions stored thereon, wherein the instructions, when executed by a processor, cause the processor to perform operations comprising: Establishing a radio resource control RRC connection with the first cell; receiving an RRC connection release message from the first cell, wherein the RRC connection release message includes an indication for redirecting the wireless device to a second cell; releasing the RRC connection with the first cell; determining whether security with the first cell has been established when the indication to redirect the wireless device to the second cell is received; determining whether the stored configuration indicates to ignore an indication to redirect to an unsecured cell received with an RRC connection release message before security is established; and Ignoring the redirection indication and selecting a new serving cell in response to determining: security with the first cell has not been established when the indication to redirect the wireless device to the second cell is received, and The stored configuration indicates to ignore the redirection to an unsecured cell indication received with the RRC Connection Release message before security is established.

16. The computer-readable medium of claim 15, wherein: The second cell operates according to a specific RAT that is less secure than a RAT of the first cell.

17. The computer-readable medium of claim 15, wherein: The operations also include: declaring a radio link failure of the first cell when security has not been established with the first cell upon receiving the indication to redirect the wireless device to the second cell; and After selecting a new serving cell based at least in part on declaring a radio link failure with the first cell, a tracking area update is performed with the new serving cell.

18. The computer readable medium of claim 15, in, If security with the first cell has been established when the indication to redirect the wireless device to the second cell is received, the second cell is selected as a new serving cell.

19. The computer readable medium of claim 18, in, Selecting a new serving cell is further based at least in part on the RAT of the second cell.

20. The computer readable medium of claim 18, The operations also include: receiving configuration information instructing the wireless device to ignore unprotected redirection indications when attaching to a cellular network associated with the first cell, The selection of a new serving cell is also based on the configuration information.

Images