Information protection to detect fake base stations

Abstract

Methods, systems, and devices for wireless communications are described. In some systems, a device may use information protection to detect a fake base station. A base station verified by a network may transmit first information to a user equipment (UE) in an unprotected message. If the fake base station intercepts a message and modifies the message before relaying it to the UE, the UE may receive information different from the transmitted first information. The UE may then transmit an indication of the received information to the verified base station in a protected message. In some cases, based on the indication, the verified base station may retransmit the first information to the UE in a message that is protected from modification by the fake base station. If the UE determines that the information originally received is different from the information received in the protected retransmission, the UE identifies the message modification of the fake base station.

Description

[0001] Cross-references

[0002] This patent application claims priority to U.S. application No. 16 / 743,927, entitled “INFORMATION PROTECTION TO DETECT FAKE BASE STATIONS,” filed by LEE et al. on January 15, 2020 (which claims the benefit of U.S. provisional patent application 62 / 794,491, entitled “INFORMATION PROTECTION TO DETECT FAKE BASE STATIONS,” filed by LEE et al. on January 18, 2019) and U.S. provisional patent application 62 / 839,500, entitled “DETECTION OF SYSTEM INFORMATION MODIFICATION USING ACCESS STRATUM SECURITY MODE COMMAND,” filed by LEE et al. on April 26, 2019, each of which is assigned to the assignee of this application.

[0003] background

[0004] The following relates generally to wireless communications and, more particularly, to information protection to detect fake base stations.

[0005] Wireless communication systems are widely deployed to provide various types of communication content, such as voice, video, packet data, messaging, broadcasting, etc. These systems may be able to support communication with multiple users by sharing available system resources (e.g., time, frequency, and power). Examples of such multiple access systems include fourth generation (4G) systems (such as long term evolution (LTE) systems, advanced LTE (LTE-A) systems, or LTE-A Pro systems), and fifth generation (5G) systems that may be referred to as new radio (NR) systems. These systems may use various technologies, such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal frequency division multiple access (OFDMA), or discrete Fourier transform spread orthogonal frequency division multiplexing (DFT-S-OFDM). A wireless multiple access communication system may include several base stations or network access nodes, each of which simultaneously supports the communication of multiple communication devices, which may be referred to as user equipment (UE).

[0006] In some wireless communication systems, the UE may process several messages (e.g., broadcast messages, unicast messages) before setting up a security context with the network. These messages may be referred to as "unprotected" messages because these messages received before the security context is established may lack protection via encryption, integrity protection, or both. In some cases, the UE may be connected to a "fake" base station and receive unprotected messages from the "fake" base station. A "fake" base station may refer to a wireless device that acts as a part of the network despite not being verified by the network. In some examples, the fake base station may use these unprotected messages (e.g., by modifying downlink messages from base stations verified by the network) to launch different types of attacks on the UE. These attacks may degrade the performance at the UE, deny service to the UE, prevent the UE from receiving important information, cause roaming problems at the UE, or cause any combination of these or other problems based on malicious modifications made by the fake base station to the information contained in one or more unprotected messages.

[0007] Overview

[0008] The described technology relates to improved methods, systems, devices and apparatuses that support information protection to detect fake base stations. In general, the described technology provides a method for enabling a user equipment (UE) to determine the authenticity of information (e.g., system information) received in an unprotected message (e.g., a message that is not protected by encryption, integrity protection, or both). In some wireless communication systems, a base station verified by a network may transmit a first set of information to the UE in an unprotected message. If a fake base station intercepts a message and modifies the message before relaying it to the UE, the UE may receive information different from the transmitted first set of information (e.g., a second set of information). The UE and the verified base station may complete a security establishment procedure between the UE and the verified base station, after which the UE may transmit an indication of the received second set of information to the verified base station in a protected (e.g., encrypted, integrity protected, or both) message. The UE may protect the message (e.g., encrypt and integrity protect the message) based on the security establishment between the UE and the verified base station. In some cases, based on the indication, the verified base station may retransmit the first set of information to the UE in a message that is protected from modification by the fake base station (e.g., using encryption, integrity protection). If the UE determines that the information originally received is different from the information received in the protected retransmission, the UE may identify that the message was modified by the fake base station. Based on the detection of the fake base station, the UE may detach from the fake base station and reattach to a different base station to communicate with the network.

[0009] Additionally or alternatively, once the UE registers with the network (e.g., once the UE has a valid non-access stratum (NAS) security context), the network may provide the UE with a UE-specific key, a key index, an initial access stratum (AS) security protection algorithm, or a combination thereof for protecting an initial AS message. The UE may use the UE-specific key to perform security protection on an indication of received information in an initial AS transmission to a base station of the network. The network may additionally provide information to the base station that supports decryption of the indication (e.g., a master key, a key index, an initial AS security protection algorithm). The base station may determine whether to retransmit the information to the UE in a protected message based on the received indication. If the protected information received in the retransmission is different from the information originally received at the UE (e.g., unauthentic information), the UE may determine the unauthentic information and detect a fake base station.

[0010] A method for wireless communication at a UE is described. The method may include: receiving a first set of information associated with communicating with a network from a base station, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; and transmitting an indication of the first set of information to the base station, wherein the indication is protected via cryptography, integrity protection, or a combination thereof. The method may further include: determining the authenticity of the first set of information based on whether a second set of information associated with communicating with the network is received from the base station, the second set of information being different from the first set of information; and communicating with the network based on the determination.

[0011] An apparatus for wireless communication at a UE is described. The apparatus may include a processor, a memory in electronic communication with the processor, and instructions stored in the memory. The instructions are executable by the processor to cause the device to: receive a first set of information associated with communicating with a network from a base station, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; and transmit an indication of the first set of information to the base station, wherein the indication is protected via cryptography, integrity protection, or a combination thereof. The instructions are executable by the processor to further cause the apparatus to: determine the authenticity of the first set of information based on whether a second set of information associated with communicating with the network is received from the base station, the second set of information being different from the first set of information; and communicate with the network based on the determination.

[0012] Another apparatus for wireless communication at a UE is described. The apparatus may include means for receiving a first set of information associated with communicating with a network from a base station, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; and transmitting an indication of the first set of information to the base station, wherein the indication is protected via cryptography, integrity protection, or a combination thereof. The apparatus may further include means for determining the authenticity of the first set of information based on whether a second set of information associated with communicating with the network is received from the base station, the second set of information being different from the first set of information; and communicating with the network based on the determination.

[0013] A non-transitory computer-readable medium storing code for wireless communication at a UE is described. The code may include instructions executable by a processor for the following operations: receiving a first set of information associated with communicating with a network from a base station, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; and transmitting an indication of the first set of information to the base station, wherein the indication is protected via cryptography, integrity protection, or a combination thereof. The code may further include instructions executable by the processor for the following operations: determining the authenticity of the first set of information based on whether a second set of information associated with communicating with the network is received from the base station, the second set of information being different from the first set of information; and communicating with the network based on the determination.

[0014] Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for the following actions: receiving a second set of information from a base station, wherein the second set of information is protected via cryptography, integrity protection, or a combination thereof; and comparing the second set of information to the first set of information, wherein the determination may be based on the comparison. In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, the second set of information may be received in a radio resource control (RRC) reconfiguration message.

[0015] In some examples of the methods, apparatus (devices), and non-transitory computer-readable media described herein, the first information set includes a first master information block (MIB), a first system information block (SIB) set, or a combination thereof, and the second information set includes a second MIB, a second SIB set, or a combination thereof.

[0016] In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, the indication may include a hash value based on the first information set and a system frame number (SFN) value associated with the first information set. Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for the following actions: if the second information set is different from the first information set, the second information set is received from the base station.

[0017] In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, the indication may include a request for a second set of information. Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for the following actions: receiving a second set of information from a base station based on the request for the second set of information.

[0018] In some examples of the methods, apparatus (devices), and non-transitory computer-readable media described herein, the UE is an unregistered UE without a valid NAS security context, and the indication of the first set of information is transmitted in the form of an AS security mode complete message.

[0019] Some examples of the methods, apparatus (devices) and non-transitory computer-readable media described herein may further include operations, features, apparatus or instructions for the following actions: receiving a UE-specific key for an initial AS message, wherein the UE-specific key may be based on one or more identifiers of the UE.

[0020] In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, the UE is a registered UE with a valid NAS security context. In some cases, transmitting an indication of the first set of information may include operations, features, means, or instructions for the following actions: security-protecting the indication of the first set of information based on a key that is specific to the UE, wherein the security protection includes encrypting the indication of the first set of information, integrity-protecting the indication of the first set of information, or a combination thereof.

[0021] In some examples of the methods, apparatus (devices) and non-transitory computer-readable media described herein, security protection of an indication of a first information set based on a UE-specific key may further include operations, features, apparatuses or instructions for the following actions: deriving a temporary encryption key for an initial AS message based on a UE-specific key, a pseudo-random number, an algorithm identifier or a combination thereof, encrypting the indication of the first information set using the temporary encryption key and an SFN value associated with the first information set, and transmitting an indication of the SFN value and the pseudo-random number, algorithm identifier or a combination thereof to a base station.

[0022] Some examples of the methods, apparatuses (devices), and non-transient computer-readable media described herein may further include operations, features, means, or instructions for the following actions: receiving an updated UE-specific key for an initial AS message, wherein the updated UE-specific key may be based on one or more identifiers, key indices, or a combination thereof of the UE. In some examples of the methods, apparatuses (devices), and non-transient computer-readable media described herein, an indication of the first information set may be transmitted in an RRC connection message.

[0023] Some examples of the methods, apparatus (devices), and non-transitory computer-readable media described herein may further include operations, features, apparatus, or instructions for receiving a key index value associated with a UE-specific key and transmitting the key index value with an indication of a first information set.

[0024] Some examples of the methods, apparatus (devices) and non-transitory computer-readable media described herein may further include operations, features, apparatuses or instructions for the following actions: detecting an additional base station, transmitting an initial RRC connection establishment message indicating the detection of the additional base station to the additional base station, wherein the initial RRC connection establishment message may be security protected based on a key that varies depending on the UE, and determining whether the additional base station is an authorized base station of the network based on the initial RRC connection establishment message.

[0025] In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, one or more identifiers of the UE include a globally unique temporary identity (GUTI), a service temporary mobile subscriber identity (S-TMSI), a temporary mobile subscriber identity (TMSI), or a combination thereof. In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, a key specific to the UE may be received in a secure NAS message.

[0026] In some examples of the methods, apparatuses (devices) and non-transitory computer-readable media described herein, determining includes operations, features, apparatuses or instructions for determining that a first set of information is true, and communicating includes operations, features, apparatuses or instructions for communicating with a network via a base station based on determining that the first set of information is true.

[0027] In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, determining includes operations, features, means, or instructions for determining that the first set of information is untrue, and communicating includes operations, features, means, or instructions for detaching from the base station based on determining that the first set of information is untrue, reattaching to an additional base station, and communicating with the network via the additional base station. Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for reporting the identity of the base station, at least a portion of the first information, or a combination thereof to the additional base station based on determining that the first set of information is untrue.

[0028] Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for the following actions: receiving an indication from a base station that security protection for a first set of information is enabled. In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, the indication that security protection for a first set of information is enabled may be received in a NAS security mode command message.

[0029] In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, the indication of the first set of information is integrity protected.

[0030] A method for wireless communication at a base station is described. The method may include: transmitting to a UE a first set of information associated with communicating with a network, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; and receiving from the UE an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via cryptography, integrity protection, or a combination thereof. The method may further include determining whether to retransmit the first set of information to the UE in a protected message based on the indication of the second set of information, wherein the protected message is protected via cryptography, integrity protection, or a combination thereof; and communicating with the UE based on whether the first set of information is different from the second set of information.

[0031] An apparatus for wireless communication at a base station is described. The apparatus may include a processor, a memory in electronic communication with the processor, and instructions stored in the memory. The instructions are executable by the processor to cause the device to: transmit a first set of information associated with communicating with a network to a UE, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; and receive from the UE an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via cryptography, integrity protection, or a combination thereof. The instructions are further executable by the processor to cause the apparatus to: determine whether to retransmit the first set of information to the UE in a protected message based on the indication of the second set of information, wherein the protected message is protected via cryptography, integrity protection, or a combination thereof; and communicate with the UE based on whether the first set of information is different from the second set of information.

[0032] Another apparatus for wireless communication at a base station is described. The apparatus may include means for transmitting to a UE a first set of information associated with communicating with a network, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; and receiving from the UE an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via cryptography, integrity protection, or a combination thereof. The apparatus may further include means for determining whether to retransmit the first set of information to the UE in a protected message based on the indication of the second set of information, wherein the protected message is protected via cryptography, integrity protection, or a combination thereof; and communicating with the UE based on whether the first set of information is different from the second set of information.

[0033] A non-transitory computer-readable medium storing code for wireless communication at a base station is described. The code may include instructions executable by a processor for the following operations: transmitting a first set of information associated with communicating with a network to a UE, wherein the first set of information lacks protection via ciphering, integrity protection, or a combination thereof; and receiving from the UE an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via ciphering, integrity protection, or a combination thereof. The code may further include instructions executable by the processor for the following operations: determining whether to retransmit the first set of information to the UE in a protected message based on the indication of the second set of information, wherein the protected message is protected via ciphering, integrity protection, or a combination thereof; and communicating with the UE based on whether the first set of information is different from the second set of information.

[0034] In some examples of the methods, apparatus (devices), and non-transitory computer-readable media described herein, the first information set includes a first MIB, a first SIB set, or a combination thereof, and the second information set includes a second MIB, a second SIB set, or a combination thereof.

[0035] In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, the indication of the second information set may include a hash value based on the second information set and an SFN value associated with the second information set. Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for the following actions: identifying the second information set based on the hash value; and if the second information set is different from the first information set, determining to retransmit the first information set to the UE in a protected message.

[0036] In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, the indication of the second information set may include a request for the second information set, wherein the first information set corresponds to the second information set. Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for the following actions: retransmitting the first information set to the UE in a protected message based on the request.

[0037] In some examples of the methods, apparatus (devices), and non-transitory computer-readable media described herein, the UE is an unregistered UE without a valid NAS security context, and the indication of the second set of information may be received in an AS security mode complete message.

[0038] Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for forwarding a UE-specific key for an initial AS message from a network entity of a network to a UE.

[0039] Some examples of the methods, apparatuses (devices) and non-transient computer-readable media described herein may further include operations, features, devices or instructions for the following actions: receiving a master key for an initial AS message from a network entity, receiving an initial AS message from a UE, wherein the initial AS message can be protected based on a key that varies from UE to UE, and deriving a key that varies from UE to UE using the master key and one or more identifiers of the UE based on receiving the initial AS message. Some examples of the methods, apparatuses (devices) and non-transient computer-readable media described herein may further include operations, features, devices or instructions for the following actions: receiving a key index associated with a master key, one or more security algorithms for an initial AS message, or a combination thereof from a network entity, and forwarding a key index associated with a master key, one or more security algorithms for an initial AS message, or a combination thereof from a network entity to a UE. In some examples of the methods, apparatuses (devices) and non-transient computer-readable media described herein, the master key corresponds to a region associated with a network entity. In some examples of the methods, apparatuses (devices) and non-transient computer-readable media described herein, a key that varies from UE to UE can be forwarded in a secure NAS message.

[0040] In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, the UE is a registered UE with a valid NAS security context, and the indication of the second set of information may be protected based on a UE-specific key used for the initial AS message. In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, the indication of the second set of information may be additionally protected based on an SFN value.

[0041] Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for the following actions: receiving a master key for an initial AS message from a network entity of a network, receiving an indication of an SFN value, a pseudo-random number, an algorithm identifier, or a combination thereof from a UE, deriving a UE-specific key using the master key and one or more identifiers of the UE, deriving a temporary encryption key for the initial AS message based on the UE-specific key and the SFN value, the pseudo-random number, the algorithm identifier, or a combination thereof, and decrypting an indication of the second information using the temporary encryption key. Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for the following actions: receiving a key index value associated with a UE-specific key from a UE, and identifying the master key based on the key index value.

[0042] Some examples of the methods, apparatus (devices), and non-transitory computer-readable media described herein may further include operations, features, apparatus, or instructions for the following actions: receiving an updated master key for an initial AS message from a network entity of a network, and forwarding an updated UE-specific key for the initial AS message to a UE, wherein the updated UE-specific key may be based on one or more identifiers of the UE and the updated master key.

[0043] In some examples of the methods, apparatus (devices), and non-transitory computer-readable media described herein, the indication of the second set of information may be received in an RRC connection message.

[0044] Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for the following actions: retransmitting the first information set in the RRC reconfiguration message. Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for the following actions: receiving a report indicating the identity of the additional base station, at least a portion of the second information set, or a combination thereof from the UE based on the retransmitted first information set, and verifying whether the additional base station is authorized by the network based on the report.

[0045] Some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for the following actions: transmitting to the UE an indication that security protection for the first information set is enabled. In some examples of the methods, apparatuses (devices), and non-transitory computer-readable media described herein, the indication that security protection for the first information set is enabled may be transmitted in a NAS security mode command message. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 and Figure 2 An example of a wireless communication system supporting information protection to detect fake base stations in accordance with aspects of the present disclosure is illustrated.

[0048] Figure 3 and Figure 4 An example of a process flow to support information protection to detect fake base stations in accordance with aspects of the present disclosure is illustrated.

[0049] Figure 5 and Figure 6 A block diagram of a device supporting information protection to detect fake base stations according to aspects of the present disclosure is shown.

[0050] Figure 7A block diagram of a UE information protection manager supporting information protection to detect fake base stations according to aspects of the present disclosure is shown.

[0051] Figure 8 A diagram of a system including a device supporting information protection to detect fake base stations according to aspects of the present disclosure is shown.

[0052] Fig. 9 and Fig.10 A block diagram of a device supporting information protection to detect fake base stations according to aspects of the present disclosure is shown.

[0053] Fig.11 A block diagram of a base station information protection manager supporting information protection to detect fake base stations according to aspects of the present disclosure is shown.

[0054] Fig.12 A diagram of a system including a device supporting information protection to detect fake base stations according to aspects of the present disclosure is shown.

[0055] Figures 13 to 16 A flow chart illustrating a method of supporting information protection to detect fake base stations according to aspects of the present disclosure is shown.

[0056] Detailed Description

[0057] In some wireless communication systems (e.g., new radio (NR) systems), a user equipment (UE) may process several messages before establishing a secure connection with a base station. Since these messages lack protection via encryption, integrity protection, or both, these messages may be referred to as "unprotected" messages. In some cases, a "fake" base station (e.g., a wireless device that acts like a base station of a network) may use these unprotected messages to launch one or more attacks against the UE. For example, if the UE starts a connection procedure with a fake base station, the fake base station may modify one or more of these unprotected messages sent by a real (e.g., verified) base station of the network. Modifications to messages (e.g., messages including system information for the UE) may degrade performance at the UE when attempting to connect to the network via a fake base station, deny service to the UE, prevent the UE from receiving important information, cause roaming problems at the UE, or cause any combination of these or other problems for the UE.

[0058] To support authentication of information (e.g., system information) at the UE, the UE may transmit a security indication of unprotected information received before establishing a security context with the network. These indications may be used to verify whether the received information is modified by a fake base station before being received by the UE. For example, in some wireless communication systems, a real base station (e.g., a base station verified by the network) may broadcast a first set of information to a set of UEs in a coverage area in an unprotected message. , an unregistered UE in the coverage area may receive a first set of information in an unprotected message before the authentication procedure. The first set of information may include system information, for example, in the form of a master information block (MIB), one or more system information blocks (SIBs), or some combination of these. If a fake base station intercepts a message and modifies the message before relaying it to the UE, the UE may receive information (e.g., a second set of information) different from the first set of information transmitted by the verified base station. Subsequently, the UE may transmit an indication of the received second set of information to the verified base station in a protected message (e.g., relayed by a fake base station). In some cases, based on the indication, the verified base station may retransmit the first set of information to the UE in a message that is protected from modification by the fake base station (e.g., using encryption, integrity protection). If the UE determines that the information originally received is different from the information received in the protected retransmission, the UE may identify that the message was modified by the fake base station. Based on the detection of the fake base station, the UE may detach from the fake base station and reattach to a different base station to communicate with the network.

[0059] In some cases, the UE may initiate a connection procedure with a fake base station, and the fake base station may accurately relay unprotected messages between the UE and the verified base station. In these cases, the fake base station may avoid detection during the connection procedure, and the UE and the verified base station may establish a security context based on the connection procedure and establish a secure connection accordingly. However, the fake base station may modify the unprotected message after the security context is established. In order to support information protection and fake base station detection in these cases, the verified base station may transmit one or more requests to the UE (e.g., periodically, non-periodically, based on security triggers) to provide a security indication of unprotected information, even after the security context is established. For example, if the fake base station modifies the system information to initiate an attack on the UE after the security context is established, the UE may transmit a security indication of the modified system information based on a request received from the verified base station. Based on the security indication, the UE and / or the verified base station may detect the attack and identify that the UE is connected to the fake base station.

[0060] Additionally or alternatively, once the UE registers with the network (e.g., once the UE has a valid non-access stratum (NAS) security context), the network may provide the UE with a UE-specific key for protecting an initial access stratum (AS) message. The UE may use the UE-specific key to perform security protection on an indication of received information in an initial AS transmission to a base station of the network. In some cases, the UE may additionally use a UE-specific key to perform security protection (e.g., using encryption and integrity protection) on other information (e.g., privacy-sensitive information) included in the initial AS message transmission. The network may additionally provide information (e.g., master key, key index, initial AS security protection algorithm) to support decryption of the indication to the verified base station. The base station verified by the network may determine whether to retransmit the information to the UE in a protected message based on the received indication. If the protected information received in the retransmission is different from the information originally received at the UE (e.g., unauthentic information), the UE may determine the unauthentic information and detect a fake base station.

[0061] In a first example, a security indication of unprotected information received at a UE may be an example of a hash value. For example, the UE may receive system information from a base station and may use the system information as an input to a hash function to calculate a hash value. In some cases, the hash value may be further based on a system frame number (SFN) value associated with the system information. The UE may transmit the calculated hash value and an identifier of the system information (e.g., a SIB number for the hashed system information) to the base station in a protected message. In this first example, the base station may determine whether the received information is modified based on the hash value, and if the unprotected information is modified, the base station may retransmit the information in a secure message. In a second example, a security indication of unprotected information received at a UE may be an example of a request for retransmission of information. For example, the UE may receive unprotected information for a specific MIB or SIB and may transmit a request for the MIB or SIB to the base station in a protected message. The base station may retransmit information corresponding to the indicated MIB or SIB number in a protected message based on the request. In this second example, the UE may determine whether the received unprotected information is modified by comparing the received unprotected information with the protected information received in the retransmission.

[0062] Various aspects of the present disclosure are initially described in the context of wireless communication systems. Additional aspects of the present disclosure are described with respect to process flows. Various aspects of the present disclosure are further illustrated and described by and with reference to apparatus diagrams, system diagrams, and flow charts related to information protection to detect fake base stations.

[0063] Figure 1An example of a wireless communication system 100 that supports information protection to detect fake base stations according to various aspects of the present disclosure is illustrated. The wireless communication system 100 includes a base station 105, a UE 115, and a core network 130. In some examples, the wireless communication system 100 may be a long term evolution (LTE) network, an advanced LTE (LTE-A) network, an LTE-A Pro network, or a new radio (NR) network. In some cases, the wireless communication system 100 may support enhanced broadband communications, ultra-reliable (e.g., mission-critical) communications, low latency communications, or communications with low-cost and low-complexity devices.

[0064] The base station 105 may communicate wirelessly with the UE 115 via one or more base station antennas. The base station 105 described herein may include or may be referred to by those skilled in the art as a base transceiver station, a radio base station, an access point, a radio transceiver, a Node B, an evolved Node B (eNB), a next generation Node B, or a Gigabit Node B (any of which may be referred to as a gNB), a Home Node B, a Home Evolved Node B, or some other suitable terminology. The wireless communication system 100 may include different types of base stations 105 (e.g., macro cell base stations or small cell base stations). The UE 115 described herein may be able to communicate with various types of base stations 105 and network equipment (including macro eNBs, small cell eNBs, gNBs, relay base stations, etc.).

[0065] Each base station 105 may be associated with a particular geographic coverage area 110 in which it supports communications with various UEs 115. Each base station 105 may provide communications coverage for the respective geographic coverage area 110 via a communications link 125, and the communications link 125 between the base station 105 and the UE 115 may utilize one or more carriers. The communications link 125 shown in the wireless communication system 100 may include an uplink transmission from the UE 115 to the base station 105, or a downlink transmission from the base station 105 to the UE 115. Downlink transmissions may also be referred to as forward link transmissions, and uplink transmissions may also be referred to as reverse link transmissions.

[0066] The geographic coverage area 110 of the base station 105 may be divided into sectors that constitute a portion of the geographic coverage area 110, and each sector may be associated with a cellular cell. For example, each base station 105 may provide communication coverage for a macrocellular cell, a small cellular cell, a hotspot, or other types of cellular cells, or various combinations thereof. In some examples, the base station 105 may be mobile and therefore provide communication coverage for a mobile geographic coverage area 110. In some examples, different geographic coverage areas 110 associated with different technologies may overlap, and the overlapping geographic coverage areas 110 associated with different technologies may be supported by the same base station 105 or different base stations 105. The wireless communication system 100 may include, for example, a heterogeneous LTE / LTE-A / LTE-A Pro or NR network, in which different types of base stations 105 provide coverage for various geographic coverage areas 110.

[0067] The term "cell" refers to a logical communication entity for communicating with base station 105 (e.g., on a carrier), and may be associated with an identifier to distinguish adjacent cells operating via the same or different carriers (e.g., physical cell identifier (PCID), virtual cell identifier (VCID)). In some examples, a carrier may support multiple cells, and different cells may be configured according to different protocol types that may provide access to different types of devices (e.g., machine type communication (MTC), narrowband Internet of Things (NB-IoT), enhanced mobile broadband (eMBB), or others). In some cases, the term "cell" may refer to a portion of a geographic coverage area 110 (e.g., a sector) on which the logical entity operates.

[0068] Each UE 115 can be dispersed throughout the wireless communication system 100, and each UE 115 can be stationary or mobile. UE 115 can also be referred to as a mobile device, a wireless device, a remote device, a handheld device, or a subscriber device, or some other suitable term, wherein "device" can also be referred to as a unit, a station, a terminal, or a client. UE 115 can also be a personal electronic device, such as a cellular phone, a personal digital assistant (PDA), a tablet computer, a laptop computer, or a personal computer. In some examples, UE 115 can also refer to a wireless local loop (WLL) station, an Internet of Things (IoT) device, an Internet of Everything (IoE) device, or an MTC device, etc., which can be implemented in various items (such as electrical appliances, vehicles, meters, etc.).

[0069] Some UEs 115, such as MTC or IoT devices, may be low-cost or low-complexity devices and may provide automated communication between machines (e.g., via machine-to-machine (M2M) communication). M2M communication or MTC may refer to data communication technology that allows devices to communicate with each other or with a base station 105 without human intervention. In some examples, M2M communication or MTC may include communications from devices that integrate sensors or meters to measure or capture information and relay the information to a central server or application, which may utilize the information or present the information to a person interacting with the program or application. Some UEs 115 may be designed to collect information or implement automated behavior of machines. Examples of applications for MTC devices include: smart metering, inventory monitoring, water level monitoring, equipment monitoring, health care monitoring, field survival monitoring, weather and geographic event monitoring, queue management and tracking, remote security sensing, physical access control, and transaction-based commercial charging.

[0070] Some UEs 115 may be configured to employ a reduced power consumption mode of operation, such as half-duplex communication (e.g., a mode that supports unidirectional communication via transmission or reception but not simultaneous transmission and reception). In some examples, half-duplex communication may be performed with a reduced peak rate. Other power saving techniques for UE 115 include entering a power saving "deep sleep" mode when not engaged in active communications, or operating over a limited bandwidth (e.g., in accordance with narrowband communications). In some cases, UE 115 may be designed to support critical functions (e.g., mission critical functions), and the wireless communication system 100 may be configured to provide ultra-reliable communications for these functions.

[0071] In some cases, UE 115 may also be able to communicate directly with other UE 115 (e.g., using a peer-to-peer (P2P) or device-to-device (D2D) protocol). One or more UEs in a group of UEs 115 utilizing D2D communication may be within the geographic coverage area 110 of the base station 105. Other UEs 115 in this group may be outside the geographic coverage area 110 of the base station 105, or may not be able to receive transmissions from the base station 105 for other reasons. In some cases, each group of UEs 115 communicating via D2D communication may utilize a one-to-many (1:M) system, in which each UE 115 transmits to each other UE 115 in the group. In some cases, the base station 105 facilitates the scheduling of resources for D2D communication. In other cases, D2D communication is performed between UEs 115 without involving the base station 105.

[0072] The base stations 105 may communicate with the core network 130 and with each other. For example, the base stations 105 may interface with the core network 130 via a backhaul link 132 (e.g., via S1, N2, N3, or other interfaces). The base stations 105 may communicate with each other directly (e.g., directly between the base stations 105) or indirectly (e.g., via the core network 130) on a backhaul link 134 (e.g., via X2, Xn, or other interfaces).

[0073] The core network 130 may provide user authentication, access authorization, tracking, Internet Protocol (IP) connectivity, and other access, routing, or mobility functions. The core network 130 may be an evolved packet core (EPC), which may include at least one mobility management entity (MME), at least one serving gateway (S-GW), and at least one packet data network (PDN) gateway (P-GW). The MME may manage non-access layer (e.g., control plane) functions such as mobility, authentication, and bearer management of UEs 115 served by base stations 105 associated with the EPC. User IP packets may be delivered through the S-GW, which itself may be connected to the P-GW. The P-GW may provide IP address allocation and other functions. The P-GW may be connected to network operator IP services. Operator IP services may include access to the Internet, an intranet, an IP multimedia subsystem (IMS), or packet switched (PS) streaming services.

[0074] At least some network devices (such as base stations 105) may include subcomponents, such as access network entities, which may be examples of access node controllers (ANCs). Each access network entity may communicate with each UE 115 through a number of other access network transport entities, which may be referred to as radio heads, smart radio heads, or transmission / reception points (TRPs). In some configurations, the various functions of each access network entity or base station 105 may be distributed across various network devices (e.g., radio heads and access network controllers) or merged into a single network device (e.g., base station 105).

[0075] The wireless communication system 100 can operate using one or more frequency bands, typically in the range of 300 megahertz (MHz) to 300 gigahertz (GHz). In general, the 300 MHz to 3 GHz region is referred to as the ultra-high frequency (UHF) region or decimeter band because the wavelengths are in the range of from about 1 decimeter to 1 meter long. UHF waves can be blocked or redirected by buildings and environmental features. However, these waves can penetrate various structures sufficiently for macro cells to provide services to UEs 115 located indoors. Transmission of UHF waves can be associated with smaller antennas and shorter ranges (e.g., less than 100 km) compared to transmission using lower frequencies and longer waves in the high frequency (HF) or very high frequency (VHF) portion of the spectrum below 300 MHz.

[0076] The wireless communication system 100 may also operate in the Super High Frequency (SHF) region using frequency bands from 3 GHz to 30 GHz, also known as centimeter bands. The SHF region includes frequency bands that may be opportunistically used by devices that may be able to tolerate interference from other users, such as the 5 GHz Industrial, Scientific, and Medical (ISM) band.

[0077] The wireless communication system 100 may also operate in the extremely high frequency (EHF) division of the spectrum (e.g., from 30 GHz to 300 GHz), which is also referred to as the millimeter band. In some examples, the wireless communication system 100 may support millimeter wave (mmW) communications between the UE 115 and the base station 105, and the EHF antenna of the corresponding device may be even smaller and more closely spaced than the UHF antenna. In some cases, this may facilitate the use of antenna arrays within the UE 115. However, the propagation of EHF transmissions may be subject to even greater atmospheric attenuation and shorter range than SHF or UHF transmissions. The technology disclosed herein may be adopted across transmissions using one or more different frequency divisions, and the use of frequency bands specified across these frequency divisions may differ by country or regulatory agency.

[0078] In some cases, the wireless communication system 100 may utilize both licensed and unlicensed radio frequency spectrum bands. For example, the wireless communication system 100 may employ license assisted access (LAA), LTE unlicensed (LTE-U) radio access technology, or NR technology in an unlicensed band (such as a 5 GHz ISM band). When operating in an unlicensed radio frequency spectrum band, wireless devices (such as base stations 105 and UE 115) may employ a listen-before-talk (LBT) procedure to ensure that the frequency channel is clear before transmitting data. In some cases, operations in unlicensed bands may be based on carrier aggregation configuration (e.g., LAA) in coordination with component carriers operating in licensed bands. Operations in unlicensed spectrum may include downlink transmissions, uplink transmissions, peer-to-peer transmissions, or a combination of these. Duplexing in unlicensed spectrum may be based on frequency division duplexing (FDD), time division duplexing (TDD), or a combination of the two.

[0079] In some examples, the base station 105 or the UE 115 may be equipped with multiple antennas, which may be used to employ techniques such as transmit diversity, receive diversity, multiple-input multiple-output (MIMO) communication, or beamforming. For example, the wireless communication system 100 may use a transmission scheme between a transmitting device (e.g., the base station 105) and a receiving device (e.g., the UE 115), wherein the transmitting device is equipped with multiple antennas and the receiving device is equipped with one or more antennas. MIMO communication may employ multipath signal propagation to increase spectral efficiency by transmitting or receiving multiple signals via different spatial layers, which may be referred to as spatial multiplexing. For example, the transmitting device may transmit multiple signals via different antennas or different antenna combinations. Similarly, the receiving device may receive multiple signals via different antennas or different antenna combinations. Each of these multiple signals may be referred to as a separate spatial stream and may carry bits associated with the same data stream (e.g., the same codeword) or different data streams. Different spatial layers may be associated with different antenna ports for channel measurement and reporting. MIMO technology includes single-user MIMO (SU-MIMO), in which multiple spatial layers are transmitted to the same receiving device, and multi-user MIMO (MU-MIMO), in which multiple spatial layers are transmitted to multiple devices.

[0080] Beamforming (which may also be referred to as spatial filtering, directional transmission, or directional reception) is a signal processing technique that may be used at a transmitting device or a receiving device (e.g., a base station 105 or a UE 115) to shape or direct an antenna beam (e.g., a transmit beam or a receive beam) along a spatial path between the transmitting device and the receiving device. Beamforming may be achieved by combining signals communicated via antenna elements of an antenna array so that signals propagating at a particular orientation relative to the antenna array experience constructive interference, while other signals experience destructive interference. Adjustments to signals communicated via antenna elements may include the transmitting device or the receiving device applying a specific amplitude and phase shift to the signal carried via each antenna element associated with the device. The adjustments associated with each antenna element may be defined by a set of beamforming weights associated with a particular orientation (e.g., relative to the antenna array of the transmitting device or the receiving device, or relative to some other orientation).

[0081] In one example, the base station 105 may use multiple antennas or antenna arrays to perform beamforming operations for directional communication with the UE 115. For example, some signals (e.g., synchronization signals, reference signals, beam selection signals, or other control signals) may be transmitted multiple times by the base station 105 in different directions, which may include a signal being transmitted according to different beamforming weight sets associated with different transmission directions. The transmissions in different beam directions may be used (e.g., by the base station 105 or a receiving device, such as the UE 115) to identify the beam direction used by the base station 105 for subsequent transmission and / or reception.

[0082] Some signals, such as data signals associated with a particular recipient device, may be transmitted by base station 105 in a single beam direction (e.g., a direction associated with a recipient device, such as UE 115). In some examples, a beam direction associated with transmissions along a single beam direction may be determined based at least in part on signals transmitted in different beam directions. For example, UE 115 may receive one or more signals transmitted by base station 105 in different directions, and UE 115 may report to base station 105 an indication of the signals received by it with the highest signal quality or other acceptable signal quality. Although these techniques are described with reference to signals transmitted by base station 105 in one or more directions, UE 115 may use similar techniques for transmitting signals multiple times in different directions (e.g., for identifying a beam direction used by UE 115 for subsequent transmission or reception) or for transmitting signals in a single direction (e.g., for transmitting data to a recipient device).

[0083] A receiving device (e.g., UE 115, which may be an example of a mmW receiving device) may try multiple receive beams when receiving various signals (such as synchronization signals, reference signals, beam selection signals, or other control signals) from base station 105. For example, the receiving device may try multiple receive directions by receiving via different antenna subarrays, processing received signals according to different antenna subarrays, receiving according to different receive beamforming weight sets applied to signals received at multiple antenna elements of an antenna array, or processing received signals according to different receive beamforming weight sets applied to signals received at multiple antenna elements of an antenna array, any of which may be referred to as "listening" according to different receive beams or receive directions. In some examples, the receiving device may use a single receive beam to receive along a single beam direction (e.g., when receiving a data signal). The single receive beam may be aligned on a beam direction determined at least in part based on listening according to different receive beam directions (e.g., a beam direction determined to have the highest signal strength, highest signal-to-noise ratio, or other acceptable signal quality based at least in part on listening according to multiple beam directions).

[0084] In some cases, the antennas of a base station 105 or a UE 115 may be located within one or more antenna arrays that may support MIMO operations or transmit or receive beamforming. For example, one or more base station antennas or antenna arrays may be co-located at an antenna assembly, such as an antenna tower. In some cases, the antennas or antenna arrays associated with a base station 105 may be located at different geographic locations. A base station 105 may have an antenna array having several rows and columns of antenna ports that the base station 105 may use to support beamforming for communications with a UE 115. Likewise, a UE 115 may have one or more antenna arrays that may support various MIMO or beamforming operations.

[0085] In some cases, the wireless communication system 100 can be a packet-based network that operates according to a layered protocol stack. In the user plane, the communication of the bearer or packet data convergence protocol (PDCP) layer can be IP-based. The radio link control (RLC) layer can perform packet segmentation and reassembly to communicate on the logical channel. The media access control (MAC) layer can perform priority handling and multiplex logical channels into transport channels. The MAC layer can also use hybrid automatic repeat request (HARQ) to provide retransmission of the MAC layer, thereby improving link efficiency. In the control plane, the radio resource control (RRC) protocol layer can provide the establishment, configuration and maintenance of the RRC connection of the radio bearer supporting user plane data between the UE 115 and the base station 105 or the core network 130. In the physical layer, the transport channel can be mapped to the physical channel.

[0086] In some cases, UE 115 and base station 105 may support retransmission of data to increase the likelihood that the data is successfully received. HARQ feedback is a technique that increases the likelihood of correctly receiving data on communication link 125. HARQ may include a combination of error detection (e.g., using cyclic redundancy check (CRC)), forward error correction (FEC), and retransmission (e.g., automatic repeat request (ARQ)). HARQ can improve the throughput of the MAC layer in poor radio conditions (e.g., signal-to-noise ratio conditions). In some cases, a wireless device may support simultaneous slot HARQ feedback, where the device may provide HARQ feedback in a specific time slot for data received in a previous symbol in the time slot. In other cases, the device may provide HARQ feedback in a subsequent time slot or according to some other time interval.

[0087] The time interval in LTE or NR can be represented by a basic time unit (which may refer to a sampling period T, for example). s =1 / 30,720,000 seconds). The time intervals of the communication resources may be organized according to radio frames each having a duration of 10 milliseconds (ms), where the frame period may be expressed as T f =307,200Ts . A radio frame may be identified by a system frame number (SFN) ranging from 0 to 1023. Each frame may include 10 subframes numbered from 0 to 9, and each subframe may have a duration of 1 ms. A subframe may be further divided into 2 slots, each slot having a duration of 0.5 ms, and each slot may contain 6 or 7 modulation symbol periods (e.g., depending on the length of a cyclic prefix prepended to each symbol period). Excluding the cyclic prefix, each symbol period may contain 2048 sampling periods. In some cases, a subframe may be the minimum scheduling unit of the wireless communication system 100 and may be referred to as a transmission time interval (TTI). In other cases, the minimum scheduling unit of the wireless communication system 100 may be shorter than a subframe or may be dynamically selected (e.g., in a burst of a shortened TTI (sTTI) or in a selected component carrier using sTTI).

[0088] In some wireless communication systems, a time slot may be further divided into a plurality of mini-slots containing one or more symbols. In some instances, a symbol of a mini-slot or a mini-slot may be the minimum scheduling unit. For example, each symbol may vary in duration depending on the subcarrier spacing or the operating frequency band. Further, some wireless communication systems may implement time slot aggregation, wherein a plurality of time slots or mini-slots are aggregated together and used for communication between UE 115 and base station 105.

[0089] The term "carrier" refers to a set of radio frequency spectrum resources having a defined physical layer structure for supporting communications on the communication link 125. For example, a carrier of the communication link 125 may include a portion of a radio frequency spectrum band that operates according to a physical layer channel for a given radio access technology. Each physical layer channel may carry user data, control information, or other signaling. A carrier may be associated with a predefined frequency channel (e.g., an Evolved Universal Mobile Telecommunications System Terrestrial Radio Access (E-UTRA) Absolute Radio Frequency Channel Number (EARFCN)) and may be located according to a channel grid for discovery by a UE 115. A carrier may be downlink or uplink (e.g., in FDD mode), or may be configured to carry downlink communications and uplink communications (e.g., in TDD mode). In some examples, a signal waveform transmitted on a carrier may include multiple subcarriers (e.g., using a multi-carrier modulation (MCM) technique such as orthogonal frequency division multiplexing (OFDM) or discrete Fourier transform spread OFDM (DFT-S-OFDM)).

[0090] The organization structure of the carrier may be different for different radio access technologies (e.g., LTE, LTE-A, LTE-A Pro, NR). For example, communications on a carrier may be organized according to TTIs or time slots, each of which may include user data and control information or signaling to support decoding of the user data. A carrier may also include dedicated acquisition signaling (e.g., synchronization signals or system information) and control signaling to coordinate carrier operations. In some examples (e.g., in a carrier aggregation configuration), a carrier may also have acquisition signaling or control signaling to coordinate the operations of other carriers.

[0091] Physical channels may be multiplexed on a carrier according to various techniques. Physical control channels and physical data channels may be multiplexed on a downlink carrier, for example, using a time division multiplexing (TDM) technique, a frequency division multiplexing (FDM) technique, or a hybrid TDM-FDM technique. In some examples, control information transmitted in a physical control channel may be distributed in a cascaded manner between different control regions (e.g., between a common control region or a common search space and one or more UE-specific control regions or UE-specific search spaces).

[0092] A carrier may be associated with a particular bandwidth of the radio frequency spectrum, and in some examples, the carrier bandwidth may be referred to as the "system bandwidth" of the carrier or wireless communication system 100. For example, the carrier bandwidth may be one of several predetermined bandwidths of a carrier for a particular radio access technology (e.g., 1.4, 3, 5, 10, 15, 20, 40, or 80 MHz). In some examples, each served UE 115 may be configured to operate on part or all of the carrier bandwidth. In other examples, some UEs 115 may be configured to operate using a narrowband protocol type associated with a predefined portion or range (e.g., a set of subcarriers or RBs) within a carrier (e.g., an "in-band" deployment of a narrowband protocol type).

[0093] In a system using MCM technology, a resource element may include a symbol period (e.g., the duration of a modulation symbol) and a subcarrier, where the symbol period and the subcarrier spacing are inversely related. The number of bits carried by each resource element may depend on the modulation scheme (e.g., the order of the modulation scheme). Thus, the more resource elements received by UE 115 and the higher the order of the modulation scheme, the higher the data rate of UE 115 can be. In a MIMO system, wireless communication resources may refer to a combination of radio frequency spectrum resources, time resources, and space resources (e.g., space layers), and the use of multiple space layers may further increase the data rate of communication with UE 115.

[0094] A device (e.g., base station 105 or UE 115) of wireless communication system 100 may have a hardware configuration that supports communication on a particular carrier bandwidth, or may be configurable to support communication on one of a set of carrier bandwidths. In some examples, wireless communication system 100 may include base stations 105 and / or UEs 115 that support simultaneous communication via carriers associated with more than one different carrier bandwidths.

[0095] The wireless communication system 100 may support communication with the UE 115 on multiple cells or carriers, a feature that may be referred to as carrier aggregation or multi-carrier operation. The UE 115 may be configured with multiple downlink component carriers and one or more uplink component carriers according to a carrier aggregation configuration. Carrier aggregation may be used with both FDD and TDD component carriers.

[0096] In some cases, the wireless communication system 100 may utilize an enhanced component carrier (eCC). An eCC may be characterized by one or more features including a wider carrier or frequency channel bandwidth, a shorter symbol duration, a shorter TTI duration, or a modified control channel configuration. In some cases, an eCC may be associated with a carrier aggregation configuration or a dual connectivity configuration (e.g., when multiple serving cells have suboptimal or non-ideal backhaul links). An eCC may also be configured for use in an unlicensed spectrum or a shared spectrum (e.g., where more than one operator is allowed to use the spectrum). An eCC characterized by a wide carrier bandwidth may include one or more segments that may be utilized by a UE 115 that is not capable of monitoring the entire carrier bandwidth or is otherwise configured to use a limited carrier bandwidth (e.g., to save power).

[0097] In some cases, an eCC may utilize a different symbol duration than other component carriers, which may include using a reduced symbol duration compared to the symbol duration of other component carriers. A shorter symbol duration may be associated with an increased spacing between adjacent subcarriers. A device utilizing an eCC (such as a UE 115 or a base station 105) may transmit a wideband signal (e.g., based on a frequency channel or carrier bandwidth of 20, 40, 60, or 80 MHz) with a reduced symbol duration (e.g., 16.67 microseconds). A TTI in an eCC may include one or more symbol periods. In some cases, the TTI duration (i.e., the number of symbol periods in a TTI) may be variable.

[0098] The wireless communication system 100 may be an NR system that may utilize any combination of licensed, shared, and unlicensed spectrum bands, etc. The flexibility of eCC symbol duration and subcarrier spacing may allow eCC to be used across multiple spectrums. In some examples, NR shared spectrum may improve spectrum utilization and spectrum efficiency, particularly through dynamic vertical (e.g., across frequency domain) and horizontal (e.g., across time domain) sharing of resources.

[0099] In some wireless communication systems 100, the network may include several base stations 105 that are verified by the network. These base stations 105 may be referred to as verified base stations, "real" base stations, authorized base stations, legal base stations, etc. However, other wireless devices may operate within the wireless communication system 100 that is not part of the network. In some cases, these wireless devices may perform operations so that it appears as if they are part of the network. For example, the device may act as a UE 115 relative to a real base station 105 in order to obtain a valid subscription to the network through the real base station 105, and may act as a base station 105 relative to the UE 115 in order to launch an attack on the UE 115. Such a device may be referred to as a "fake" or "rogue" base station 105 because the device may communicate with one or more UEs 115 as if the device were a real base station 105 of the network. However, the device may modify unprotected messages intended for the UE 115 to negatively affect the performance, throughput, cost, etc. of the communication between the UE 115 and the network.

[0100] The wireless communication system 100 may support the base station 105 and the UE 115 to protect information from such attacks by fake base stations. The base station 105 verified by the network may transmit a first set of information to the UE 115 in an unprotected message. If the fake base station intercepts the message and modifies the message before relaying it to the UE 115, the UE 115 may receive information different from the transmitted first set of information (e.g., a second set of information). The UE 115 may then transmit an indication (e.g., a hash value, a request) of the received second set of information to the verified base station 105 in a protected message. In some cases, based on the indication, the verified base station 105 may retransmit the first set of information to the UE 115 in a message that is prevented from being modified by the fake base station (e.g., using encryption, integrity protection). If the UE 115 determines that the information originally received is different from the information received in the protected retransmission, the UE 115 may identify that the message was modified by the fake base station. Based on the detection of the fake base station, the UE 115 may detach from the fake base station and reattach to a different base station 105 to communicate with the network.

[0101] Additionally or alternatively, once UE 115 registers with the network, the network may provide UE 115 with a UE-specific key for protecting the initial connection message delivery. UE 115 may use the UE-specific key to perform security protection on the indication of the received information during the connection procedure with the base station (e.g., in a random access channel (RACH) request, an RRC connection request, or an RRC connection establishment completion message). The network may additionally provide information (e.g., a master key, a key index, an encryption algorithm) supporting the decryption of the indication to the verified base station 105. If UE 115 is performing a connection procedure with a fake base station, the fake base station may not be able to identify the indication because the decryption information is not provided to the fake base station. The real base station 105 may receive the indication, decrypt the protected message, and determine whether to retransmit the information to UE 115 in the protected message based on the received indication. If the protected information received in the retransmission is different from the information originally received at UE 115, UE 115 may determine the untrue information and detect the fake base station.

[0102] Figure 2 An example of a wireless communication system 200 that supports information protection to detect fake base stations according to aspects of the present disclosure is illustrated. The wireless communication system 200 can implement aspects of the wireless communication system 100. For example, the wireless communication system 200 can include a UE 115-a and a base station 105-a, which can be reference Figure 1 An example of a device described herein. Base station 105-a may serve a cellular cell having coverage area 110-a. Wireless communication system 200 may also include a wireless device operating as a fake base station 105-b. To protect information from attacks from fake base stations 105-b, wireless communication system 200 may implement techniques for authenticating information in unprotected transmissions, thereby supporting detection of fake base stations 105.

[0103] In some wireless communication systems (such as wireless communication system 200), malicious third-party users may attempt to undermine the security of the system via fake base station 105b. For example, fake base station 105-b may attempt to bypass system information protection. In the case of establishing a security context between UE115 (e.g., UE 115-a) and a real base station 105 (e.g., base station 105-a), one or two wireless devices can protect signaling at one or more layers. For example, the device can use encryption, integrity protection, or both to protect information transmitted in the system. However, before establishing a security context, certain types of transmissions may be vulnerable to security breaches. In order to prevent fake base station 105-b from making unauthorized modifications to signaling (e.g., system information transmission in MIB, SIB, or both), wireless communication system 200 can support security enhancements. These security enhancements can prevent certain attacks or frauds (e.g., denial of service (DOS) attacks, availability attacks) of fake base stations 105. Even in the event that a malicious third-party user uses the fake base station 105-b to modify or copy system information, the security enhancements can prevent the malicious third party from establishing a secure connection between the fake base station 105-b and the UE 115-a (e.g., due to failure of the initial access procedure or AS security mode command).

[0104] Base station 105-a can be an example of a real base station 105 verified by the network. Base station 105-a can communicate with UE 115-a on downlink channel 205, uplink channel 210, or both. In some cases, a transmission sent from base station 105-a can be received at UE 115-a without unauthorized modification. For example, base station 105-a can transmit directly to UE 115-a on downlink channel 205-a, or base station 105-b can relay information from base station 105-a to UE 115-a in downlink channel 205-a without modification. Similarly, a transmission sent from UE 115-a to base station 105-a on uplink channel 210 can be received without unauthorized modification (e.g., via direct transmission or successful relay). However, in other cases, fake base station 105-b can act as a relay device between verified base station 105-a and UE 115-a. The fake base station 105-b may receive information from the base station 105-a on the downlink channel 205-b and may modify the information in a process that is transparent to both the base station 105-a and the UE 115-a. The fake base station 105-b may then transmit the modified information to the UE 115-a on the downlink channel 205-c so that the UE 115-a receives the modified information as if it were the originally transmitted information from the base station 105-a.

[0105] In some cases, UE 115-a can connect to the fake base station 105-b through a connection procedure. For example, the fake base station 105-b can block the first downlink transmission (e.g., on the downlink channel 205-b) and can send a modified downlink transmission in its place (e.g., on the downlink channel 205-c). Based on the modified downlink transmission, UE 115-a can connect to the fake base station 105-b, thereby potentially exposing UE 115-a to attacks. If UE 115-a is connected to the fake base station 105-b, the fake base station 105-b can use the unprotected first information set 215-b to launch different types of attacks on UE 115-b. For example, the unprotected first information set 215-b can correspond to any number of broadcast or unicast messages processed at UE 115-a before the security setup procedure is completed. Because these messages are not protected (eg, they lack protection via encryption, integrity protection, or both), they may be vulnerable to attack by a fake base station 105-b.

[0106] In other cases, the fake base station 105-b can perform a middleman attack. In these cases, the fake base station 105-b can act as a relay between the verified base station 105-a and the UE 115-a. In this way, the fake base station 105-b can be able to use the message that the UE 115-a identifies as originating from the verified base station 105-a to launch different types of attacks on the UE 115-a. The fake base station 105-b can act as a UE 115 for the base station 105-a to obtain a valid subscription to the network, and can act as a base station 105 for the UE 115-a to connect to the UE 115-a. The fake base station 105-b can correctly or incorrectly relay messages between the base station 105-a and the UE 115-a. For example, the fake base station 105-b may correctly relay some information to allow the UE 115-a to configure security with the base station 105-a, but the fake base station 105-b may make unauthorized modifications to any number of unprotected signals transmitted between these devices (e.g., even after security is configured). These unprotected messages may correspond to messages in layers below the Packet Data Convergence Protocol (PDCP) layer, such as the Radio Link Control (RLC) layer, the Media Access Control (MAC) layer, or the Physical (PHY) layer.

[0107] A potential attack performed by a fake base station 105-b connected to UE 115-a may involve the fake base station 105-b transmitting false or modified system information (e.g., in an unauthentic MIB or SIB set) to UE 115-a in an unprotected first information set 215-b or transmitting other false or modified unprotected messages. The modified MIB or SIB may support various types of DoS attacks (e.g., using a false public land mobile network identifier (PLMN-ID), using cell restrictions for a set of UEs 115 using a first SIB (SIB1) or for a specific UE 115 using a second SIB (SIB2)), amplification and / or DoS attacks (e.g., using a fake tracking area code (TAC) to trigger continuous tracking area updates (TAUs), relay attacks (e.g., location record poisoning via a fake TAC, behavioral profile establishment of UE 115-a (including call information, short message service (SMS) information, data traffic information), blocking downlink messages from the core network to deny service), or any combination of these or other possible attacks. In some cases, a malicious third-party user may inject false messages into the communication stream without intercepting the connection. In some examples, these types of attacks may be more damaging than fake base station attacks.

[0108] The fake base station 105-a connected to the UE 115-a can modify various parameters in the MIB to degrade the performance of the UE 115-a. For example, the fake base station 105-a can modify the SFN, downlink bandwidth, scheduling information, or some combination of these or other parameters in the MIB. Additionally or alternatively, the fake base station 105-a can modify various parameters in the SIB. These parameters (for example, for SIB1) may include but are not limited to a PLMN identity list, a TAC, a cell identity, a cell barring, a closed subscriber group (CSG) indication, a cell selection information, a frequency band indicator, a scheduling information list, a time division duplex (TDD) configuration, and a system information value tag. Modifying one or more of the fields indicated above may cause the UE 115-a to fail to select a suitable cell, delay access to a suitable cell, consume too much battery life, fail to correctly decode system information, perform incorrect operations, and / or perform inefficiently.

[0109] For example, SIB1 (e.g., in an LTE system, an NR system, or any other wireless communication system) may include access-related parameters (such as barring information, CSG identity, etc.). Different types of systems may refer to similar parameters using different names. If the fake base station 105-b modifies any of these parameters of the UE 115-a, the fake base station 105-b may delay or prevent the UE 115-a from accessing a cell (e.g., a cell associated with the verified base station 105-a). In a specific example, by setting a barring bit in an untrue SIB1, the fake base station 105-b may prevent the UE 115-a from accessing a cell for a long period of time (e.g., up to five minutes). Further, modifying access control parameters may affect connection establishment, because incorrect settings may delay connection establishment, thereby degrading service for the UE 115-a. Modifying cell selection parameters (which may be broadcast in other SIBs for neighboring UEs 115) may delay or prevent the UE 115-a from residing. For example, if the false base station 105-b broadcasts a minimum level at which signal quality is high, multiple UEs 115 may be prevented from camping on the verified base station 105-a.

[0110] Some systems implement solutions from the perspective of AS security to allow UE 115 operating in RRC idle mode to detect fake base stations 105 and accordingly prevent one or more potential fake base station attacks. In a first example, the system can implement digital signatures for system information verification. Although digital signatures can mitigate system information attacks (e.g., replay attacks, DoS attacks), the size of protected system information transmissions may be much larger than the size of unprotected system information transmissions due to digital signatures and timestamp parameters. Accordingly, a system implementing digital signatures for system information protection may result in a substantial increase in processing and / or memory overhead. This may result in inefficient communication within the system. In a second example, the system may support UE 115 to verify fake base stations 105 using "system query". However, for the "system query" solution for protecting system information, UE 115 may need to communicate with the network despite being in RRC idle mode. If UE 115 is stationed on a fake cell during the RRC idle state, UE 115 may be vulnerable to possible DoS or availability attacks. For example, if UE 115 camps on a fake base station 105, the fake base station 105 may send fake messages (such as public safety warnings, incoming emergency calls, real-time application server push services, proximity services, etc.) to UE 115 or prevent real messages from reaching UE 115. Some services (similar to the Earthquake and Tsunami Warning System (ETWS)) may be provided to UE 115 in RRC idle mode through one or more SIBs. Thus, in order to ensure that UE 115 receives these services, UE 115 may not be allowed to camp on a fake base station 105 in RRC idle mode.

[0111] From the perspective of RRC control plane signaling (e.g., unicast messages), there may be unprotected procedures performed before AS security is activated, including RRC connection establishment procedures, UE identity acquisition procedures, UE capability information transmission, downlink / uplink information transmission procedures, etc. The fake base station 105 can also perform attacks on these signals, because malicious attacks in the wireless communication system 100 or 200 can target any unprotected initial messages between the UE and the base station 105. For example, the fake base station 105 can make unauthorized modifications to signals such as attach reject messages (e.g., using an enclosure management module (EMM) error code), tracking area update reject messages, etc., which can be transmitted by the network-verified base station 105-e on the air interface before AS security is activated.

[0112] Many possible implementations of AS security during RRC idle mode result in significant overhead, excessive signaling, unprotected messaging, or a combination of these problems. In one implementation, the network may sign selected signaling messages using a certificate-based signature, an elliptic curve digital signature algorithm (ECDSA), etc. As discussed above, these signature-based solutions may result in significant and harmful overhead in the system. In another implementation, UE 115 may verify the authenticity of base station 105 during RRC idle mode. In this implementation, UE 115 may verify base station 105 using a certificate-based signature, an identity-based signature (IBS), or both. In some cases, verification may be additionally based on one or more "freshness" parameters (e.g., global positioning system (GPS) values, coordinated universal time (UTC) time). Similarly, this solution may cause significant and harmful overhead to the system. In yet another implementation, UE 115 may detect fake base station 105 using uplink traffic monitoring and system query. In this implementation, UE 115 may need to monitor the uplink traffic of nearby UEs within the system. UE 115 may not support such excessive signal monitoring level. In another implementation, UE 115 may use IBS to detect fake base station 105 to protect redirection messages to second generation (2G) systems. This implementation may use key exchange and mutual authentication based on identity-based encryption (IBC), which may require message exchange between UE 115 and base station 105. This message exchange may be vulnerable to attacks from fake base station 105, resulting in security risks within the system. Each of these implementations may not be an ideal solution for protecting information (such as system information).

[0113] In contrast, the wireless communication system 200 can protect the initial AS message, which can result in protection of system information (e.g., MIB, SIB) or other unprotected lower layer messages. The wireless communication system 200 can implement a shared key-based approach that can be more efficient (e.g., resulting in significantly lower overhead) than implementing a signature for system information protection. The wireless communication system 200 can support protection of a fake base station 105 at UE 115-a for modifying unprotected information. For unregistered UEs 115, detection of unauthorized modifications may occur during the AS security mode command procedure. Registered UEs 115 can improve detection latency by performing detection of unauthorized modifications during a connection procedure (e.g., a RACH procedure or an RRC configuration procedure). The verified base station 105-a can determine whether the unprotected information is modified (e.g., by a fake base station 105-b), and can retransmit the correct information in a secure message (e.g., an RRC reconfiguration message). Additionally, all unprotected messages transmitted before AS security is established may be protected using the initial AS protection key for the registered UE 115.

[0114] In some cases, this approach can prevent false negative results when performing fake base station 105 detection. For example, even if UE 115-a is connected to fake base station 105-b, UE 115-a can identify whether an unprotected message has been modified by fake base station 105-b. This can provide a second level of defense for information protection. This encryption protection can be implemented alone or in combination with other protection mechanisms (e.g., a common or shared key approach).

[0115] In a specific example, a verified base station 105-a may transmit an unprotected first information set 215-a to a UE 115-a on a downlink channel 205-b. The unprotected first information set 215-a may be, for example, a SIB and may lack protection via encryption, integrity protection, or both. The fake base station 105-b may receive the unprotected first information set 215-a, but the fake base station 105-b may modify the information to obtain the unprotected first information set 215-b instead of relaying the information to the UE 115-a. The modified unprotected first information set 215-b may include one or more modified parameters that degrade performance at the UE 115-a. The fake base station 105-b may transmit the modified unprotected first information set 215-b to the UE 115-a on the downlink channel 205-c. The UE 115-a may receive the modified unprotected first information set 215-b as if it were correctly relayed by the actual base station 105.

[0116] To prevent this unauthorized modification, the UE 115-a may transmit a protected indication to the base station 105-a on the uplink channel 210. The indication may be protected via encryption, integrity protection, or both, such that the fake base station 105-b does not modify or decode the indication. The indication may indicate an unprotected first information set 215-b received by the UE 115-a. For example, the indication may include an indication of the received information (e.g., in the form of a hash value) or a request for the base station 105-a to retransmit the information. The base station 105-a may receive the protected indication 220 and may determine the indication (e.g., when the base station 105-a is verified by the network, the network may provide the base station 105-a with the information required to decode the protected indication). Since the originally transmitted unprotected first information set 215-a was modified by the fake base station 105-b, the base station 105-a may retransmit the first information set. For example, the base station 105-a may retransmit the SIB as a protected second information set 225 on the downlink channel 205-a, where the second information set is protected via encryption, integrity protection, or both. Similarly, because the information is protected, the fake base station 105-b may not be able to read or modify the information. The UE 115-a may receive the protected second information set 225 and may compare it with the unprotected first information set 215-b. If the second information set is different from the first set, the UE 115-a may detect that the unprotected first information set 215-b is modified (e.g., the UE 115-a detects the SIB modification) and is unauthentic. Based on this detection, the UE 115-a may determine that the wireless device acting as a relay base station 105 is a fake base station 105-b, and the UE 115-a may be separated from the fake base station 105-b. In this way, while connected to the fake base station 105-b, the UE 115-a can effectively receive correct, unmodified system information (e.g., in the protected second information set 225), while also detecting and detaching from the fake base station 105-b.

[0117] Figure 3 An example of a process flow 300 for supporting information protection to detect fake base stations in accordance with aspects of the present disclosure is illustrated. The process flow 300 may illustrate an initial network access procedure for an unregistered UE 115 (e.g., a UE 115 without a valid NAS security context). In some examples, the process flow 300 may implement aspects of wireless communication systems 100 and 200. The process flow 300 may include a base station 105-c and a UE 115-b, which may be referenced Figure 1 and Figure 2Examples of the devices described. Base station 105-c can be an example of a real or verified base station of a network. Base station 105-c can communicate with the network via a network entity 305 (such as, an access and mobility management function (AMF), a security anchor function (SEAF), or some combination of these or other network entities). In some cases, a device can operate as a relay between base station 105-c and UE 115-b. The device can be used as a fake base station 105-d. The following alternative examples can be implemented, in which some of the steps are performed in a different order than described or not performed at all. In some cases, the steps may include additional features not mentioned below, or further steps may be added.

[0118] At 310, UE 115-b may receive a first information set from base station 105-c. The first information set may be associated with communicating with a network. For example, the first information set may include system information in a MIB, a SIB set, or a combination thereof. Since UE 115-b has not yet connected to the network or performed an authentication procedure, UE 115-b may not have a valid security context established with the network. Accordingly, base station 105-c may transmit the first information set in an unprotected message (e.g., the first information set lacks protection via encryption, integrity protection, or both) so that UE 115-b can successfully receive and decode the first information set. However, transmitting the first information set in an unprotected message makes the information vulnerable to attacks by fake base station 105-d. In some cases, if fake base station 105-d relays the first information set from base station 105-c to UE 115-b, fake base station 105-d may modify the information in one or more ways. As such, UE 115 - b may receive false information (eg, false system information) from base station 105 - c due to a man-in-the-middle attack by base station 105 - d . The attack may result in performance loss or other inefficiencies at UE 115 - b .

[0119] At 315, UE 115-b may perform a connection procedure 315 to connect to the network. The connection procedure may include a random access procedure and an RRC configuration procedure. In some cases, UE 115-b may perform a connection procedure to attach to the network via base station 105-c. However, in other cases (e.g., if a fake base station 105-c relays information between base station 105-c and UE 115-b), UE 115-b may perform a connection procedure to attach to the network via fake base station 105-d (e.g., and base station 105-c). The connection procedure 315 may involve UE 115-b transmitting a RACH request message (Msg1) and receiving a RACH response (RAR) message (Msg2) from base station 105-c. Additionally, the connection procedure 315 may involve UE 115-b transmitting an RRC connection request message (Msg3) to base station 105-c upon configuring RRC, receiving an RRC connection setup message (Msg4) from base station 105-c, and transmitting an RRC connection setup complete message (Msg5) to base station 105-c. In some cases, one or more of these messages may be referred to as initial AS messages. For example, UE 115-b may transmit an RRC connection setup complete message as an initial AS message.

[0120] At 320, UE 115-b may transmit a registration request to the network. Registering UE 115-b with the network may allow UE 115-b to obtain a valid NAS security context with the network. The registration request may be sent to the network via pseudo base station 105-d, base station 105-c, network entity 305, or any combination of these devices. At 325, the network may perform an authentication procedure to authenticate UE 115-b. In some cases, UE 115-b may additionally authenticate base station 105, the network, or both.

[0121] At 330, the network may send a NAS security mode command to the UE 115-b (e.g., by the network entity 305). For example, the base station 105-c may receive the NAS security mode command from the network entity 305 and may forward the NAS security mode command to the UE 115-b. The network may include network policy information in the NAS security mode command. For example, the UE 115-b may receive an indication at 330 that a security feature (e.g., security protection for a first set of information) is enabled. The indication may be an indication of SIB and / or MIB protection at a radio access network (RAN). In one example, the NAS security mode command may include an information element (e.g., one or more bits) to indicate whether the security feature is enabled. For example, a first bit value (e.g., a one (1) value) of the information element may indicate that SIB and / or MIB protection is enabled for the network, while a second bit value (e.g., a zero (0) value) may indicate that SIB and / or MIB protection is not enabled or disabled for the network. UE 115-b may receive a NAS security mode command message, identify a value of the indication, and determine whether to perform information protection to detect a fake base station based on the identified value, as described herein. UE 115-b may configure NAS security based on the NAS security mode command, and may transmit a NAS security mode complete message at 335 in response.

[0122] At 340, the base station 105-c may transmit an AS security mode command to the UE 115-b. The UE 115-b may configure AS security based on the AS security mode command and may transmit an AS security mode complete message in response at 345. In some cases (e.g., if security protection for the first information set is enabled), the UE 115-b may include an indication of the first information set in the AS security mode complete message. That is, at 345, the UE 115-b may transmit an indication of the first information set to the base station 105-c. Since the AS security mode complete message is a protected message (e.g., the information included in the AS security mode complete message is encrypted, integrity protected, or both), the indication is protected via encryption, integrity protection, or both.

[0123] In a first example, the indication may be an example of a hash value. The hash value may be based on a first information set received at UE 115-b. In some cases, the hash value may be additionally based on an SFN value associated with the first information set. For example, UE 115-b may calculate a hash value of the SIB using at least a portion of the SIB and the corresponding SFN value as inputs to a hash function. The hash function may be preconfigured at UE 115-b, configured in a protected message by a network or base station 105-c, or dynamically determined by UE 115-b. Additionally or alternatively, UE 115-b may determine a hash value for multiple SIBs, MIBs, or a combination thereof. UE 115-b may also include in the AS security mode completion message an indication of the MIB and / or SIB read by UE 115-b at 310 and used to generate the hash (e.g., SIB number). Additionally or alternatively, the indication may include other unprotected information exchanged between the UE 115-b and the real base station 105-c prior to completing the security setup procedure. This unprotected information may also be used to generate the hash.

[0124] The base station 105-c may receive an indication of information received at the UE 115-b from the UE 115-b. At 350, the base station 105-c may determine whether to retransmit the first set of information to the UE 115-b in a protected message (e.g., where the first set of information is protected via encryption, integrity protection, or a combination thereof) based on the indication of the second set of information. For example, the base station 105-c may determine whether the UE 115-b received the correct system information by comparing the information indicated by the hash value at 345 with the information transmitted at 310. If the base station 105-c detects any previous modification of the first set of information (e.g., the MIB and / or SIB(s) indicated by the hash value at 345 is different from the MIB and / or SIB transmitted at 310), the base station 105-c may determine that the modified information is to be retransmitted. Additionally or alternatively, the base station 105-c may determine to retransmit the changed information if the base station 105-c identifies a change to the system information of the network since the UE 115-b received the system information at 310. In these cases, the base station 105-c may retransmit the first set of information (e.g., a portion or a complete set of MIBs, SIBs, or some combination thereof) to the UE 115-b at 355. For example, the base station 105-c may retransmit the first set of information in an RRC reconfiguration message, wherein the first set of information is protected via ciphering, integrity protection, or a combination thereof.

[0125] In a second example, the indication may be an example of an information request. For example, if UE 115-b receives a particular MIB or SIB at 310, UE 115-b may send a request for the MIB or SIB at 345. UE 115-b may indicate a MIB, a set of SIBs (e.g., using a SIB number), or both in a protected request for retransmission. Base station 105-c may receive the request and may determine to retransmit the indicated information to UE 115-b in a protected message. For example, if UE 115-b requests retransmission of a first set of information, base station 105-c may retransmit the first set of information in an RRC reconfiguration message at 355, wherein the first set of information is protected via encryption, integrity protection, or a combination thereof. Additionally or alternatively, base station 105-c may retransmit any system information that has changed for the network since UE 115-b received the system information at 310.

[0126] In some examples, UE 115-b may transmit some combination of one or more hash values ​​and one or more requests for retransmission in an uplink message. Base station 105-c may transmit an RRC reconfiguration message with or without retransmission of the first information set, depending on the indication received from UE 115-b.

[0127] At 360, UE 115-b may determine the authenticity of the first set of information received at 310. For example, UE 115-b may decode the protected information retransmitted by base station 105-c at 355 and may determine whether the retransmitted information is different from the information originally received at 310. If the received sets of information are the same, UE 115-b may determine that the first set of information received at 310 is authentic and may communicate with the network using the established connection. In this case, UE 115-b may not receive the modified message from the fake base station 105-d. UE 115-b may reconfigure the RRC connection based on the RRC reconfiguration message and may transmit an RRC reconfiguration complete message to base station 105-c at 365.

[0128] If the received information set is different, UE 115-b can determine that the unprotected message received at 310 is modified and is not authentic. In these situations, UE 115-b can determine the presence of a fake base station 105-d based on the detection of unauthorized message modification. If UE 115-b detects that it is connected to a fake base station 105-d, UE 115-b can be separated from the fake base station 105-d. UE 115-b can reattach to a different base station 105 to communicate with the network. In some cases, UE 115-b can be directly connected to base station 105-c. In other cases, UE 115-b can be connected to another base station 105 (not shown), which can act as a relay between base station 105-c and UE 115-b. In any of these situations, UE 115-b can repeat the above process to determine whether the new connection is to a real base station 105 or to a fake base station 105. Once UE 115-b is connected to a genuine base station verified by the network, where UE 115-b determined the connection based on receiving genuine system information in an unprotected message, UE 115-b may communicate with the network via the connection.

[0129] If UE 115-b detects one or more fake base stations 105, UE 115-b may report the fake base station 105 when successfully connecting to the network via the verified base station 105. For example, a registered UE 115-b (e.g., a UE 115 with a valid NAS security context) may report the identity of a detected or suspected fake base station 105-d, at least a portion of untrue information for the detected or suspected fake base station 105-d (e.g., MIB or SIB content modified by the fake base station 105-d), or a combination of these to a verified base station 105-c. Base station 105-c may receive the report and perform a verification process with the identified fake base station 105-d. The verification process may allow the network to attempt to verify the legitimacy of the detected or suspected fake base station 105-d. The verification process may involve the base station 105-c performing a transport network layer (TNL) discovery to attempt to receive the address of the fake base station 105-d, establishing an Xn connection with the fake base station 105-d, reporting the fake base station 105-d to the network entity 305, or performing a combination of these or related processes. If the base station 105-c or the network verifies that the base station 105-d is a fake base station, the base station 105-c may generate and transmit a message identifying the fake base station 105-d as a security threat. In some cases, the fake base station 105-d identifier may be included in the MIB or SIB transmission. The UE 115 receiving the message may suppress connecting to the fake base station 105-d based on the message.

[0130] In some cases, once the UE 115 has completed initial network access and registered with the network, the network may provide the UE 115 with a UE-specific key. The UE-specific key may improve the protection of the initial AS message by the registered UE 115-b, thereby reducing the latency involved in detecting the fake base station 105 during the connection procedure. For example, at 370, the network (by the network entity 305) may forward the UE-specific key to the UE 115-b via the base station 105. The UE-specific key may be transmitted in a registration accept message at 370, which may be responsive to the registration request message received by the network at 320. The registered UE 115-b may use the UE-specific key to protect an indication of information transmitted in an initial AS message (e.g., a RACH request, an RRC connection request, an RRC connection setup complete message) in a subsequent connection procedure.

[0131] To create a UE-specific key, the network entity 305 may use a master key. The network entity 305 (eg, AMF) may generate and / or store a master initial AS key K INIT_AS The network entity 305 may provide the master key, a key index corresponding to a particular version (e.g., a current version) of the master key, one or more algorithms (e.g., an encryption algorithm such as an initial AS security protection algorithm), or some combination of these variables to authenticated base stations 105 of the network. For example, the network entity 305 may provide some or all of this information to base stations 105 in an area (e.g., a tracking area, a registration area) associated with the network entity 305.

[0132] The network entity 305 may use the master key and the identity of the UE 115-b to derive a UE-specific key. For example, the network entity 305 may perform a key derivation function that accepts as input the master key and one or more identifiers of the UE 115-b and outputs an initial UE-specific AS security key K INIT_AS_UE . The UE identifier may include a globally unique temporary identity (GUTI), a service temporary mobile subscriber identity (S-TMSI), a temporary mobile subscriber identity (TMSI), or any combination of these or other identifiers for the UE 115-b. The UE-specific initial AS key may be associated with a particular key index (e.g., a key index based on a master key used to derive the UE-specific key). The network entity 305 may provide the UE 115-b with the UE-specific key at 370. Additionally, the network entity 305 may provide the UE 115-b with a key index associated with the UE-specific key, one or more security algorithms for initial AS protection, or a combination thereof. The provision may be performed via the authenticated base station 105-c in a secure NAS message (such as a registration accept message).

[0133] Figure 4 An example of a process flow 400 for supporting information protection to detect fake base stations in accordance with aspects of the present disclosure is illustrated. The process flow 400 may illustrate a network access procedure for a registered UE 115 (e.g., a UE 115 with a previously established valid NAS security context). In some examples, the process flow 400 may implement aspects of wireless communication systems 100 and 200. The process flow 400 may include a base station 105-e and a UE 115-c, which may be referenced Figure 1 and Figure 2 Examples of the devices described. The base station 105-e can be an example of a real or verified base station of a network. The base station 105-e can communicate with the network via a network entity 405 (e.g., an AMF, a SEAF, or some combination of these or other network entities). In some cases, a device can operate as a relay between the base station 105-e and the UE 115-c. The device can be used as a fake base station 105-f. The following alternative examples can be implemented, in which some of the steps are performed in a different order than described or not performed at all. In some cases, the steps may include additional features not mentioned below, or further steps may be added.

[0134] UE 115-c may be an example of a registered UE 115. For example, UE 115-c may have previously performed an initial access procedure to register with the network, as described herein with reference to Figure 3 as described. During this initial access procedure, the network may provide UE 115-c with a UE-specific key for protecting the initial AS message. If the registered UE 115-c performs a connection procedure using a valid NAS security context and a UE-specific key, the network may support UE 115-c in authenticating a first set of information (e.g., system information) and detecting a connection to the fake base station 105-f. This connection procedure for UE 115-c may be an example of a handover procedure, a reconnection procedure based on UE 115-c entering RRC connected mode from RRC idle mode, or any other connection procedure in which UE 115-c attempts to connect to the network via a different base station 105.

[0135] At 410, the UE 115-c may receive a first set of information associated with communicating with a network from the base station 105-e. For example, the first set of information may include system information in a MIB, a SIB set, or a combination thereof. The base station 105-c may transmit the first set of information in an unprotected message (e.g., the first set of information lacks protection via cryptography, integrity protection, or both), and the UE 115-c may successfully receive and decode the first set of information. However, because the first set of information is not protected by cryptography, integrity protection, or both, the fake base station 105-f may receive (e.g., intercept) the first set of information, decode the information, and modify the information. Modifying information (such as system information) may allow the fake base station 105-f to reduce the efficiency or performance of communications between the UE 115-c and the network. In this way, the UE 115-c may receive untrue information (e.g., system information modified by the fake base station 105-f) from the base station 105-e due to message modifications made during the relaying of information through the fake base station 105-f.

[0136] UE 115-b may perform a connection procedure based on the received first information set. The connection procedure may involve a RACH procedure, an RRC configuration procedure, or both, as described in detail in Figure 3 The connection procedure 315 may include 415, 420, 425, 430 and 435, as described herein.

[0137] At 415, the UE 115-c may transmit a RACH request to the base station 105 in order to connect to the base station 105. The base station 105 may be an example of a fake base station 105-f or a verified base station 105-e. At 420, the UE 115-c may receive a RACH response from the base station 105 in response to the RACH request. At 425, the UE 115-c may transmit an RRC connection request to the base station 105, and may receive an RRC connection setup message in response at 430. The UE 115-c may update the RRC connection based on the received RRC connection setup message, and may transmit an RRC connection setup complete message in response at 435.

[0138] To support information protection and fake base station 105 detection, the UE 115-c may transmit a security indication of the first information set received by the UE 115-c at 410 during the connection procedure. The indication may be as described in reference to Figure 3An example of a hash value or a request for retransmission described. UE 115-c may transmit the indication to base station 105 as a component of a RACH request, an RRC connection request, or an RRC connection setup complete message. Although these messages may be examples of unprotected messages (e.g., messages transmitted by UE 115-c at 415, 425, and 435 may lack protection via encryption, integrity protection, or both), UE 115-c may partially protect the messages using a UE-specific key provided to UE 115-c. For example, UE 115-c may perform partial encryption on an initial AS message to protect at least an indication of a first set of information. UE 115-c may also perform integrity protection on the entire message for improved protection.

[0139] To perform this partial protection, the UE 115-c may derive one or more initial AS security protection keys from the UE-specific keys received from the network entity 405 (e.g., previously in a registration accept message). The UE 115-c may derive one or more initial AS security protection keys based on the provided UE-specific initial AS keys K INIT_AS_UE To derive the initial AS encryption key K INIT_AS_En c. Initial AS integrity protection key K INIT_AS_Int Or both. In some cases, the initial AS security protection key(s) may be derived from an intermediate key rather than directly from a UE-specific key. For example, UE 115-c may derive a temporary initial AS key K based on a UE-specific key and a freshness parameter. temp_INIT_AS UE 115-c may implement a key derivation function (KDF) such that:

[0140] K temp_INIT_AS = KDF (K INIT_AS_UE , freshness parameter) (1)

[0141] Wherein the freshness parameter can be the SFN value of the information indicated by the security indication, a pseudo-random number (e.g., generated by a random number generator at UE115-c), or a combination thereof. UE 115-c can provide the freshness parameter to base station 105 together with the security indication. However, the freshness parameter can be unprotected so that the verified base station 105-e can receive the freshness parameter and can use the freshness parameter to determine the temporary key. Additionally or alternatively, UE 115-c can determine one or more initial AS security protection keys based on the algorithm type and / or algorithm identifier. For example:

[0142] K INIT_AS_Enc, Int = KDF (K INIT_AS_UE , algorithm type, algorithm ID) (2)

[0143] The algorithm type, algorithm identifier, or both may be preconfigured at the UE 115-c, previously provided by the network, or dynamically selected by the UE 115-c and included in the transmission along with the security indication (unprotected). The UE 115-c may use the derived key to protect the indication of the first information set in the initial AS transmission (e.g., using K INIT_AS_Enc To encrypt the information, use K INIT_AS_Int to protect the integrity of the information, or both).

[0144] The network-verified base station 105-e may receive an initial AS message (e.g., a RACH request, an RRC connection request, or an RRC connection setup complete message) and may derive one or more initial AS security protection keys required to determine an indication of the first set of information. For example, the network entity 405 may provide the verified base station 105-e with a master initial AS key K INIT_AS The base station 105-e can obtain the master key K INIT_AS Derive the initial AS key K that varies from UE to UE INIT_AS_UE and the identity of UE 115-c (e.g., one or more UE identifiers, such as GUTI, S-TMSI, TMSI). Using the derived UE-specific keys, base station 105-e may derive one or more initial AS security protection keys (in some cases, based on intermediate keys, such as K temp_INIT_AS Once the base station 105-e derives the key for protecting the indication, the base station 105-e may use one or more initial AS security protection keys to determine a protected indication (e.g., using K INIT_AS_Enc To decrypt the information, use K INIT_AS_Int , reverse integrity protection of the information, or both). Since the network does not provide the master key and / or key index to the fake base station 105, the fake base station 105-f receiving the initial AS message may not be able to derive the key used to protect the indication of the first information set. As such, the fake base station 105-f may not be able to modify the indication of the first information set. Accordingly, the verified base station 105-e may correctly receive the indication of the first information set received by the UE 115-c at 410.

[0145] At 440, in some cases, the base station 105-e may determine whether the UE 115-c received the correct first set of information (e.g., system information) at 410. For example, if the base station 105-e decrypts the indication received in the initial AS message, where the indication is a hash value of the information received by the UE 115-c at 410, the base station 105-e may compare the information transmitted to the UE 115-c at 410 with the information received by the UE 115-c at 410. If the sets of information do not match, the base station 105-e may determine that the information received at the UE 115-c was modified (e.g., modified by the fake base station 105-f). In these cases, the base station 105-e may retransmit the first set of information to the UE 115-c in a protected message (e.g., where the retransmitted information is protected via encryption, integrity protection, or both). Additionally or alternatively, the base station 105-e may identify a request for retransmission in the decrypted indication and may retransmit the first set of information to the UE 115-c in a protected message based on the request. Furthermore, if the base station 105-e determines that the system information for the network has changed since the UE 115-c received the system information at 410, the base station 105-e may retransmit the system information (e.g., the now updated system information) to the UE 115-c.

[0146] In a first example, the base station 105-e may retransmit the information in an RRC reconfiguration message. The UE 115-c may transmit a registration and / or service request at 450, the network may perform authentication at 455, and the base station 105-e may transmit an RRC reconfiguration message including a first set of information at 460. In this example, at 465, the UE 115-c may determine the authenticity of the information originally received by the UE 115-c at 410 based on the retransmitted information. For example, if the two sets of information are different, the UE 115-c may determine that the information received at 410 is not authentic and may determine to separate from the connected base station 105 (e.g., the fake base station 105-f). If the two sets of information match (or if the UE 115-c does not receive a retransmission of the information in the RRC reconfiguration message), the UE 115-c may continue the network access procedure. For example, the UE 115-c may reconfigure the RRC configuration at 470 and transmit an RRC reconfiguration complete message. The UE 115 - c may then communicate with the network using a connected base station 105 (eg, a verified base station 105 - e ).

[0147] In a second example, the base station 105-e and the UE 115-c may use an RRC message to indicate detection of the base station 105 during connection establishment. In some cases, the base station 105-e may transmit an RRC detection message to the UE 115-c at 445. In these cases, the RRC message may include a retransmission of information for the UE 115-c, and the UE 115-c may determine the authenticity of the received system information based on the retransmitted information. Alternatively, the UE 115-c may transmit an RRC message (e.g., an RRC detection message) as an initial step of a connection procedure (e.g., before a RACH procedure, before an RRC connection procedure, and / or before a registration or service procedure). A registered UE 115-c may be configured to transmit the RRC message at the beginning of any connection procedure. The RRC message may be protected using one or more initial AS keys. The UE 115-c may monitor for an expected response from the base station 105. If the UE 115-c does not receive the expected response, the UE 115-c may identify an abnormal call flow and may indirectly determine that the base station 105 is a fake base station 105. In these situations, the UE 115-c may not perform a connection procedure with the identified fake base station 105, but may continue to search for a different base station 105 to connect to. For example, if the fake base station 105-f receives a protected RRC message, the fake base station 105-f may not be able to determine the protected information because the fake base station 105-f is not provided with the information required to determine one or more initial AS keys. In this way, the fake base station 105-f may not be able to determine how to respond to the RRC message. However, if the verified base station 105-e receives a protected RRC message, information may be provided to the verified base station 105-e to determine one or more initial AS keys. In this way, the verified base station 105-e can determine the protected information and can respond accordingly, implicitly indicating to the UE 115-c that the UE 115-c is initiating a connection procedure with the verified base station 105 (rather than a fake base station).

[0148] In some cases, once the UE 115-c has network access (e.g., via the authenticated base station 105-e), the network may provide the updated UE-specific key to the UE 115-c at 475. For example, the network entity 405 may update the master key to a new version and may use the updated master key to derive the updated UE-specific key. The base station 105-e may forward the updated UE-specific key, the updated key index, or both from the network entity 405 to the UE 115-c. The UE 115-c may remove the previous UE-specific key from memory and replace it with the updated UE-specific key. Additionally, the network entity 405 may provide the updated master key, the updated key index, or both to the base station 105-e (e.g., when providing to the UE 115-c or when the base station 105-e receives a message protected using the UE-specific key). The updated UE-specific keys may be sent to the UE 115 - c in a secure NAS message, such as a Registration and / or Service Accept message.

[0149] Figure 5 A block diagram 500 of a device 505 supporting information protection to detect fake base stations according to aspects of the present disclosure is shown. The device 505 may be an example of aspects of the UE 115 as described herein. The device 505 may include a receiver 510, a UE information protection manager 515, and a transmitter 520. The device 505 may also include a processor. Each of these components may be in communication with each other (e.g., via one or more buses).

[0150] Receiver 510 may receive information, such as packets, user data, or control information associated with various information channels (e.g., control channels, data channels, and information related to detecting fake base stations (such as protected information)). The information may be passed to other components of device 505. Receiver 510 may be a reference Figure 8 Examples of aspects of the described transceiver 820. The receiver 510 may utilize a single antenna or a collection of antennas.

[0151] The UE information protection manager 515 may receive a first set of information associated with communicating with a network from a base station, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; and may transmit an indication of the first set of information to the base station, wherein the indication is protected via cryptography, integrity protection, or a combination thereof. The UE information protection manager 515 may determine the authenticity of the first set of information based on whether a second set of information associated with communicating with a network is received from the base station, the second set of information being different from the first set of information; and may communicate with the network based on the determination. The UE information protection manager 515 may be an example of aspects of the UE information protection manager 810 described herein.

[0152] The UE information protection manager 515 or its subcomponents may be implemented in hardware, in code (e.g., software or firmware) executed by a processor, or any combination thereof. If implemented in code executed by a processor, the functions of the UE information protection manager 515 or its subcomponents may be performed by a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described in the present disclosure.

[0153] The UE information protection manager 515 or its subcomponents may be physically located in various locations, including being distributed so that portions of the functionality are implemented by one or more physical components at different physical locations. In some examples, according to various aspects of the present disclosure, the UE information protection manager 515 or its subcomponents may be separate and distinct components. In some examples, according to various aspects of the present disclosure, the UE information protection manager 515 or its subcomponents may be combined with one or more other hardware components (including, but not limited to, input / output (I / O) components, transceivers, network servers, another computing device, one or more other components described in the present disclosure, or a combination thereof).

[0154] The transmitter 520 may transmit signals generated by other components of the device 505. In some examples, the transmitter 520 may be co-located with the receiver 510 in a transceiver module. For example, the transmitter 520 may be a reference Figure 8 Examples of aspects of the described transceiver 820. The transmitter 520 may utilize a single antenna or a collection of antennas.

[0155] Figure 6 A block diagram 600 of a device 605 supporting information protection to detect fake base stations according to aspects of the present disclosure is shown. The device 605 may be an example of aspects of the device 505 or UE 115 as described herein. The device 605 may include a receiver 610, a UE information protection manager 615, and a transmitter 640. The device 605 may also include a processor. Each of these components may be in communication with each other (e.g., via one or more buses).

[0156] Receiver 610 may receive information, such as packets, user data, or control information associated with various information channels (e.g., control channels, data channels, and information related to detecting fake base stations (such as protected information)). The information may be passed to other components of device 605. Receiver 610 may be a reference Figure 8 Examples of aspects of the described transceiver 820. The receiver 610 may utilize a single antenna or a collection of antennas.

[0157] The UE information protection manager 615 may be an example of aspects of the UE information protection manager 515 described herein. The UE information protection manager 615 may include an unprotected receiving component 620, a protected indicating component 625, an authentication component 630, and a communication component 635. The UE information protection manager 615 may be an example of aspects of the UE information protection manager 810 described herein.

[0158] Unprotected receiving component 620 can receive a first set of information associated with communicating with a network from a base station, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof. Protected indicating component 625 can transmit an indication of the first set of information to the base station, wherein the indication is protected via cryptography, integrity protection, or a combination thereof. Authentication component 630 can determine the authenticity of the first set of information based on whether a second set of information associated with communicating with a network is received from the base station, the second set of information being different from the first set of information. Communication component 635 can communicate with the network based on the determination.

[0159] The transmitter 640 may transmit signals generated by other components of the device 605. In some examples, the transmitter 640 may be co-located with the receiver 610 in a transceiver module. For example, the transmitter 640 may be a reference Figure 8 Examples of aspects of the described transceiver 820. The transmitter 640 may utilize a single antenna or a collection of antennas.

[0160] Figure 7 A block diagram 700 of a UE information protection manager 705 supporting information protection to detect fake base stations according to aspects of the present disclosure is shown. The UE information protection manager 705 may be an example of aspects of the UE information protection manager 515, the UE information protection manager 615, or the UE information protection manager 810 described herein. The UE information protection manager 705 may include an unprotected reception component 710, a protected indication component 715, an authentication component 720, a communication component 725, a protected reception component 730, a UE-specific key component 735, a base station detection component 740, a reporting component 745, and a security protection determination component 750. Each of these modules may communicate directly or indirectly with each other (e.g., via one or more buses).

[0161] The UE information protection manager 705 may be a component of the UE. The unprotected receiving component 710 may receive a first set of information associated with communicating with a network from a base station, wherein the first set of information lacks protection via encryption, integrity protection, or a combination thereof. In some cases, the first set of information includes a first MIB, a first set of SIBs, or a combination thereof.

[0162] The protected indication component 715 can transmit an indication of the first set of information to the base station, wherein the indication is protected via encryption, integrity protection, or a combination thereof. In some cases, the UE is an example of an unregistered UE without a valid NAS security context. The indication of the first set of information can be transmitted in an AS security mode complete message.

[0163] The authentication component 720 can determine the authenticity of the first information set based on whether a second information set associated with communicating with the network is received from the base station, the second information set being different from the first information set. In some cases, the second information set includes a second MIB, a second SIB set, or a combination thereof. The communication component 725 can communicate with the network based on the determination.

[0164] In some cases, the determining includes determining that the first set of information is authentic. In these cases, communicating may include communicating with the network via the base station based on determining that the first set of information is authentic.

[0165] In other cases, the determination includes determining that the first information set is not authentic. In these cases, the communication component 725 can be detached from the base station based on determining that the first information set is not authentic, and can be reattached to the additional base station. The communication component 725 can communicate with the network via the additional base station. In some cases, the reporting component 745 can report the identity of the base station, at least a portion of the first information, or a combination thereof to the additional base station based on determining that the first information set is not authentic.

[0166] The protected receiving component 730 can receive a second set of information from the base station, wherein the second set of information is protected via encryption, integrity protection, or a combination thereof. In some examples, the protected receiving component 730 can compare the second set of information with the first set of information, wherein the determination is based on the comparison. In some cases, the second set of information is received in an RRC reconfiguration message.

[0167] In some examples, the indication can be an example based on a hash value of the first information set and an SFN value associated with the first information set. In these examples, the protected receiving component 730 can receive the second information set from the base station if the second information set is different from the first information set. In other examples, the indication is an example of a request for the second information set. In these examples, the protected receiving component 730 can receive the second information set from the base station based on the request for the second information set.

[0168] The UE-specific key component 735 may receive a UE-specific key for an initial AS message, wherein the UE-specific key is based on one or more identifiers of the UE. In some examples, the UE-specific key component 735 may receive a key index value associated with the UE-specific key, and may transmit a key index value with an indication of a first set of information. In some cases, the one or more identifiers of the UE include a GUTI, an S-TMSI, a TMSI, or a combination thereof. In some cases, the UE-specific key is received in a secure NAS message.

[0169] In some examples, the UE is an example of a registered UE with a valid NAS security context. Transmitting the indication of the first set of information may involve the protected indication component 715 security protecting the indication of the first set of information based on a key specific to the UE, wherein the security protection involves encrypting the indication of the first set of information, integrity protecting the indication of the first set of information, or a combination thereof. In some cases, the indication of the first set of information is transmitted in an RRC connection message.

[0170] In some examples, protecting security on the indication may involve the UE-specific key component 735 deriving a temporary encryption key for the initial AS message based on a UE-specific key, a pseudo-random number, an algorithm identifier, or a combination thereof. In some examples, the UE-specific key component 735 may encrypt the indication of the first information set using the temporary encryption key and the SFN value associated with the first information set, and may transmit the indication of the SFN value and the pseudo-random number, the algorithm identifier, or a combination thereof to the base station.

[0171] In some examples, the UE-specific key component 735 can receive an updated UE-specific key for an initial AS message, where the updated UE-specific key is based on one or more identifiers of the UE, a key index, or a combination thereof.

[0172] In some cases, the base station detection component 740 can detect an additional base station. The base station detection component 740 can transmit an initial RRC connection establishment message indicating the detection of the additional base station to the additional base station, wherein the initial RRC connection establishment message is security-protected based on a key that varies with the UE, and can determine whether the additional base station is an authorized base station of the network based on the initial RRC connection establishment message.

[0173] Security protection determining component 750 can receive an indication from the base station that security protection for the first set of information is enabled. In some cases, the indication that security protection for the first set of information is enabled is received in a NAS Security Mode Command message.

[0174] Figure 8 A diagram of a system 800 including a device 805 supporting information protection to detect a fake base station according to various aspects of the present disclosure is shown. The device 805 may be an example of or include components of the device 505, device 605, or UE 115 as described herein. The device 805 may include components for two-way voice and data communications, including components for transmitting and receiving communications, including a UE information protection manager 810, an I / O controller 815, a transceiver 820, an antenna 825, a memory 830, and a processor 840. These components may be in electronic communication via one or more buses (e.g., bus 845).

[0175] The UE information protection manager 810 may receive a first set of information associated with communicating with a network from a base station, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; and may transmit an indication of the first set of information to the base station, wherein the indication is protected via cryptography, integrity protection, or a combination thereof. The UE information protection manager 810 may determine the authenticity of the first set of information based on whether a second set of information associated with communicating with a network is received from the base station, the second set of information being different from the first set of information; and may communicate with the network based on the determination.

[0176] I / O controller 815 can manage input and output signals of device 805. I / O controller 815 can also manage peripheral devices that are not integrated into device 805. In some cases, I / O controller 815 can represent a physical connection or port to an external peripheral device. In some cases, I / O controller 815 can utilize an operating system, such as Or another known operating system. In other cases, I / O controller 815 may represent or interact with a modem, keyboard, mouse, touch screen, or similar device. In some cases, I / O controller 815 may be implemented as part of a processor. In some cases, a user may interact with device 805 via I / O controller 815 or via hardware components controlled by I / O controller 815.

[0177] The transceiver 820 can communicate bidirectionally via one or more antennas, wired or wireless links, as described above. For example, the transceiver 820 can represent a wireless transceiver and can communicate bidirectionally with another wireless transceiver. The transceiver 820 can also include a modem to modulate packets and provide the modulated packets to an antenna for transmission, and demodulate packets received from an antenna.

[0178] In some cases, a wireless device may include a single antenna 825. However, in some cases, the device may have more than one antenna 825, which may be capable of transmitting or receiving multiple wireless transmissions concurrently.

[0179] The memory 830 may include random access memory (RAM) and read-only memory (ROM). The memory 830 may store computer-readable, computer-executable code 835 including instructions that, when executed, cause the processor to perform the various functions described herein. In some cases, the memory 830 may include, among other things, a basic input / output system (BIOS), which may control basic hardware or software operations, such as interaction with peripheral components or devices.

[0180] The processor 840 may include an intelligent hardware device (e.g., a general-purpose processor, a DSP, a central processing unit (CPU), a microcontroller, an ASIC, an FPGA, a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof). In some cases, the processor 840 may be configured to operate a memory array using a memory controller. In other cases, the memory controller may be integrated into the processor 840. The processor 840 may be configured to execute computer-readable instructions stored in a memory (e.g., memory 830) so that the device 805 performs various functions (e.g., functions or tasks that support the use of information protection to detect fake base stations).

[0181] The code 835 may include instructions for implementing various aspects of the present disclosure, including instructions for supporting wireless communications. The code 835 may be stored in a non-transitory computer-readable medium, such as a system memory or other type of memory. In some cases, the code 835 may not be directly executable by the processor 840, but may cause a computer (e.g., when compiled and executed) to perform the functions described herein.

[0182] Fig. 9 A block diagram 900 of a device 905 supporting information protection to detect fake base stations according to aspects of the present disclosure is shown. The device 905 may be an example of aspects of a base station 105 as described herein. The device 905 may include a receiver 910, a base station information protection manager 915, and a transmitter 920. The device 905 may also include a processor. Each of these components may be in communication with each other (e.g., via one or more buses).

[0183] Receiver 910 may receive information, such as packets, user data, or control information associated with various information channels (e.g., control channels, data channels, and information related to detecting fake base stations (such as protected information)). The information may be passed to other components of device 905. Receiver 910 may be a reference Fig.12 Examples of aspects of the described transceiver 1220. The receiver 910 may utilize a single antenna or a collection of antennas.

[0184] The base station information protection manager 915 may transmit to the UE a first set of information associated with communicating with the network, wherein the first set of information lacks protection via ciphering, integrity protection, or a combination thereof; and may receive from the UE an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via ciphering, integrity protection, or a combination thereof. The base station information protection manager 915 may determine whether to retransmit the first set of information to the UE in a protected message based on the indication of the second set of information, wherein the protected message is protected via ciphering, integrity protection, or a combination thereof; and may communicate with the UE based on whether the first set of information is different from the second set of information. The base station information protection manager 915 may be an example of aspects of the base station information protection manager 1210 as described herein.

[0185] The base station information protection manager 915 or its subcomponents may be implemented in hardware, in code (e.g., software or firmware) executed by a processor, or in any combination thereof. If implemented in code executed by a processor, the functions of the base station information protection manager 915 or its subcomponents may be performed by a general purpose processor, DSP, ASIC, FPGA or other programmable logic device designed to perform the functions described in the present disclosure, discrete gate or transistor logic, discrete hardware components, or in any combination thereof.

[0186] The base station information protection manager 915 or its subcomponents may be physically located at various locations, including being distributed so that portions of the functionality are implemented by one or more physical components at different physical locations. In some examples, according to various aspects of the present disclosure, the base station information protection manager 915 or its subcomponents may be separate and distinct components. In some examples, according to various aspects of the present disclosure, the base station information protection manager 915 or its subcomponents may be combined with one or more other hardware components (including but not limited to I / O components, transceivers, network servers, another computing device, one or more other components described in the present disclosure, or a combination thereof).

[0187] The transmitter 920 may transmit signals generated by other components of the device 905. In some examples, the transmitter 920 may be co-located with the receiver 910 in a transceiver module. For example, the transmitter 920 may be a reference Fig.12 Examples of various aspects of the described transceiver 1220. The transmitter 920 may utilize a single antenna or a collection of antennas.

[0188] Fig.10A block diagram 1000 of a device 1005 supporting information protection to detect fake base stations according to aspects of the present disclosure is shown. The device 1005 may be an example of aspects of the device 905 or base station 105 as described herein. The device 1005 may include a receiver 1010, a base station information protection manager 1015, and a transmitter 1040. The device 1005 may also include a processor. Each of these components may be in communication with each other (e.g., via one or more buses).

[0189] Receiver 1010 may receive information, such as packets, user data, or control information associated with various information channels (e.g., control channels, data channels, and information related to detecting fake base stations (such as protected information)). The information may be passed to other components of device 1005. Receiver 1010 may be a reference Fig.12 Examples of various aspects of the described transceiver 1220. The receiver 1010 may utilize a single antenna or a collection of antennas.

[0190] The base station information protection manager 1015 may be an example of aspects of the base station information protection manager 915 as described herein. The base station information protection manager 1015 may include an unprotected transmission component 1020, a protected indication component 1025, a retransmission determination component 1030, and a communication component 1035. The base station information protection manager 1015 may be an example of aspects of the base station information protection manager 1210 as described herein.

[0191] The unprotected transmission component 1020 can transmit a first set of information associated with communicating with a network to the UE, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof. The protected indication component 1025 can receive from the UE an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via cryptography, integrity protection, or a combination thereof. The retransmission determination component 1030 can determine whether to retransmit the first set of information to the UE in a protected message based on the indication of the second set of information, wherein the protected message is protected via cryptography, integrity protection, or a combination thereof. The communication component 1035 can communicate with the UE based on whether the first set of information is different from the second set of information.

[0192] The transmitter 1040 may transmit signals generated by other components of the device 1005. In some examples, the transmitter 1040 may be co-located with the receiver 1010 in a transceiver module. Fig.12 Examples of various aspects of the described transceiver 1220. The transmitter 1040 may utilize a single antenna or a collection of antennas.

[0193] Fig.11A block diagram 1100 of a base station information protection manager 1105 supporting information protection to detect fake base stations according to aspects of the present disclosure is shown. The base station information protection manager 1105 can be an example of aspects of the base station information protection manager 915, the base station information protection manager 1015, or the base station information protection manager 1210 described herein. The base station information protection manager 1105 may include an unprotected transmission component 1110, a protected indication component 1115, a retransmission determination component 1120, a communication component 1125, a UE-specific key component 1130, a master key component 1135, a key derivation component 1140, a decryption component 1145, a base station authentication component 1150, and a security protection indication component 1155. Each of these modules can communicate directly or indirectly with each other (e.g., via one or more buses).

[0194] The base station information protection manager 1105 can be a component of the base station. The unprotected transmission component 1110 can transmit a first set of information associated with communicating with the network to the UE, wherein the first set of information lacks protection via encryption, integrity protection, or a combination thereof. In some cases, the first set of information includes a first MIB, a first set of SIBs, or a combination thereof.

[0195] The protected indication component 1115 can receive from the UE an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via encryption, integrity protection, or a combination thereof. In some cases, the second set of information includes a second MIB, a second SIB set, or a combination thereof.

[0196] In some cases, the UE may be an example of an unregistered UE without a valid NAS security context. In these cases, the indication of the second set of information is received in an AS security mode complete message. In other cases, the UE may be an example of a registered UE with a valid NAS security context, and the indication of the second set of information is protected based on a UE-specific key used for the initial AS message. In some examples, the indication of the second set of information is additionally protected based on a SFN value. The indication of the second set of information may be received in an RRC connection message.

[0197] The retransmission determination component 1120 can determine whether to retransmit the first information set to the UE in a protected message based on the indication of the second information set, wherein the protected message is protected via encryption, integrity protection, or a combination thereof. In some examples, the retransmission determination component 1120 can retransmit the first information set in an RRC reconfiguration message.

[0198] In some examples, the indication of the second information set includes a hash value based on the second information set and a SFN value associated with the second information set. In these examples, the retransmission determination component 1120 can identify the second information set based on the hash value; and can determine to retransmit the first information set to the UE in a protected message if the second information set is different from the first information set.

[0199] In other examples, the indication of the second set of information includes a request for the second set of information, wherein the first set of information corresponds to the second set of information. In these examples, retransmission determining component 1120 can retransmit the first set of information to the UE in a protected message based on the request.

[0200] The communication component 1125 can communicate with the UE based on whether the first set of information is different from the second set of information.

[0201] The UE-specific key component 1130 may forward the UE-specific key for the initial AS message from a network entity of the network to the UE. In some cases, the UE-specific key is forwarded in a secure NAS message.

[0202] The master key component 1135 may receive a master key for an initial AS message from a network entity. The key derivation component 1140 may receive an initial AS message from a UE, wherein the initial AS message is protected based on a key specific to the UE. In some examples, the key derivation component 1140 may derive a key specific to the UE using the master key and one or more identifiers of the UE based on receiving the initial AS message.

[0203] In some examples, the master key component 1135 may receive a key index associated with the master key, one or more security algorithms for the initial AS message, or a combination thereof from the network entity. The master key component 1135 may forward a key index associated with the master key, one or more security algorithms for the initial AS message, or a combination thereof from the network entity to the UE. In some cases, the master key corresponds to a region associated with the network entity.

[0204] In some examples, the master key component 1135 can receive a master key for the initial AS message from a network entity of the network. Additionally, in some examples, the key derivation component 1140 can receive an indication of an SFN value, a pseudo-random number, an algorithm identifier, or a combination thereof from the UE. The key derivation component 1140 can use the master key and one or more identifiers of the UE to derive a key that is specific to the UE, and can derive a temporary encryption key for the initial AS message based on the key that is specific to the UE and the SFN value, the pseudo-random number, the algorithm identifier, or a combination thereof. The decryption component 1145 can use the temporary encryption key to decrypt the indication of the second information.

[0205] In some examples, the master key component 1135 can receive a key index value associated with a UE-specific key from the UE, and can identify the master key based on the key index value. In some examples, the master key component 1135 can receive an updated master key for an initial AS message from a network entity of the network, and can forward the updated UE-specific key for the initial AS message to the UE, wherein the updated UE-specific key is based on one or more identifiers of the UE and the updated master key.

[0206] Base station verification component 1150 can receive a report from the UE indicating an identity of an additional base station, at least a portion of the second information set, or a combination thereof based on the retransmitted first information set. In some examples, base station verification component 1150 can verify whether the additional base station is authorized by the network based on the report.

[0207] The security protection indication component 1155 can transmit an indication to the UE that security protection for the first information set is enabled. In some cases, the indication that security protection for the first information set is enabled is transmitted in a NAS security mode command message.

[0208] Fig.12 A diagram of a system 1200 including a device 1205 that supports information protection to detect fake base stations according to various aspects of the present disclosure is shown. The device 1205 may be an example of or include components of a device 905, a device 1005, or a base station 105 as described herein. The device 1205 may include components for two-way voice and data communications, including components for transmitting and receiving communications, including a base station information protection manager 1210, a network communication manager 1215, a transceiver 1220, an antenna 1225, a memory 1230, a processor 1240, and an inter-station communication manager 1245. These components may be in electronic communication via one or more buses (e.g., bus 1250).

[0209] The base station information protection manager 1210 may transmit a first set of information associated with communicating with a network to a UE, wherein the first set of information lacks protection via ciphering, integrity protection, or a combination thereof; and may receive from the UE an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via ciphering, integrity protection, or a combination thereof. The base station information protection manager 1210 may determine whether to retransmit the first set of information to the UE in a protected message based on the indication of the second set of information, wherein the protected message is protected via ciphering, integrity protection, or a combination thereof; and may communicate with the UE based on whether the first set of information is different from the second set of information.

[0210] The network communication manager 1215 can manage communications with the core network 130 (e.g., via one or more wired backhaul links). For example, the network communication manager 1215 can manage the delivery of data communications for client devices (such as one or more UEs 115). The actions performed by the network communication manager as described herein can be implemented to achieve one or more potential advantages. One implementation can allow the UE 115 to avoid certain attacks or spoofing, and can support efficient communications. Another implementation can provide improved quality of service and reliability at the UE 115 because performance degradation caused by fake base station attacks at the UE 115 can be reduced.

[0211] The transceiver 1220 can communicate bidirectionally via one or more antennas, wired or wireless links, as described above. For example, the transceiver 1220 may represent a wireless transceiver and can communicate bidirectionally with another wireless transceiver. The transceiver 1220 may also include a modem to modulate packets and provide the modulated packets to an antenna for transmission, and demodulate packets received from an antenna.

[0212] In some cases, a wireless device may include a single antenna 1225. However, in some cases, the device may have more than one antenna 1225, which may be capable of transmitting or receiving multiple wireless transmissions concurrently.

[0213] The memory 1230 may include RAM, ROM, or a combination thereof. The memory 1230 may store computer readable code 1235 including instructions that, when executed by a processor (e.g., processor 1240), cause the device to perform various functions described herein. In some cases, the memory 1230 may include, among other things, a BIOS that may control basic hardware or software operations, such as interaction with peripheral components or devices.

[0214] Processor 1240 may include an intelligent hardware device (e.g., a general-purpose processor, a DSP, a CPU, a microcontroller, an ASIC, an FPGA, a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof). In some cases, processor 1240 may be configured to operate a memory array using a memory controller. In some cases, the memory controller may be integrated into processor 1240. Processor 1240 may be configured to execute computer-readable instructions stored in a memory (e.g., memory 1230) to enable device 1205 to perform various functions (e.g., functions or tasks that support the use of information protection to detect fake base stations).

[0215] The inter-site communication manager 1245 may manage communications with other base stations 105 and may include a controller or scheduler for controlling communications with UE 115 in cooperation with other base stations 105. For example, the inter-site communication manager 1245 may coordinate the scheduling of transmissions to UE 115 for various interference mitigation techniques, such as beamforming or joint transmission. In some examples, the inter-site communication manager 1245 may provide an X2 interface within an LTE / LTE-A wireless communication network technology to provide communications between base stations 105.

[0216] The code 1235 may include instructions for implementing various aspects of the present disclosure, including instructions for supporting wireless communications. The code 1235 may be stored in a non-transitory computer-readable medium, such as a system memory or other type of memory. In some cases, the code 1235 may not be directly executable by the processor 1240, but may cause a computer (e.g., when compiled and executed) to perform the functions described herein.

[0217] Fig.13 A flow chart illustrating a method 1300 for supporting information protection to detect fake base stations according to aspects of the present disclosure is shown. The operations of the method 1300 may be implemented by the UE 115 or its components as described herein. For example, the operations of the method 1300 may be implemented by referring to Figures 5 to 8 The UE information protection manager described above may be used to perform the following functions. In some examples, the UE may execute an instruction set to control the functional elements of the UE to perform the following functions. Additionally or alternatively, the UE may use dedicated hardware to perform various aspects of the following functions.

[0218] At 1305, the UE may receive from a base station a first set of information associated with communicating with a network, wherein the first set of information lacks protection via encryption, integrity protection, or a combination thereof. The operations of 1305 may be performed according to the methods described herein. In some examples, aspects of the operations of 1305 may be performed as described with reference to Figures 5 to 8 The described unprotected receiving component is performed.

[0219] At 1310, the UE may transmit an indication of a first set of information to a base station, wherein the indication is protected via encryption, integrity protection, or a combination thereof. The operations of 1310 may be performed according to the methods described herein. In some examples, aspects of the operations of 1310 may be performed as described with reference to Figures 5 to 8 The protected instruction component described is executed.

[0220] At 1315, the UE may determine the authenticity of the first set of information based on whether a second set of information associated with communicating with the network is received from the base station, the second set of information being different from the first set of information. The operations of 1315 may be performed according to the methods described herein. In some examples, aspects of the operations of 1315 may be performed as described with reference to Figures 5 to 8 The authentication component described is performed.

[0221] At 1320, the UE may communicate with the network based on the determination. The operations of 1320 may be performed according to the methods described herein. In some examples, aspects of the operations of 1320 may be performed as described with reference to Figures 5 to 8 The described communication components are used to perform.

[0222] Fig.14 A flow chart illustrating a method 1400 for supporting information protection to detect fake base stations according to aspects of the present disclosure is shown. The operations of the method 1400 may be implemented by a UE 115 or a component thereof as described herein. For example, the operations of the method 1400 may be implemented by referring to Figures 5 to 8 The UE information protection manager described above may be used to perform the following functions. In some examples, the UE may execute an instruction set to control the functional elements of the UE to perform the following functions. Additionally or alternatively, the UE may use dedicated hardware to perform various aspects of the following functions.

[0223] At 1405, the UE may receive from a base station a first set of information associated with communicating with a network, wherein the first set of information lacks protection via encryption, integrity protection, or a combination thereof. The operations of 1405 may be performed according to the methods described herein. In some examples, aspects of the operations of 1405 may be performed as described with reference to Figures 5 to 8 The described unprotected receiving component is performed.

[0224] At 1410, the UE may transmit an indication of a first set of information to a base station, wherein the indication is protected via encryption, integrity protection, or a combination thereof. The operations of 1410 may be performed according to the methods described herein. In some examples, aspects of the operations of 1410 may be performed as described with reference to Figures 5 to 8 The protected instruction component described is executed.

[0225] At 1415, the UE may receive a second set of information from the base station, wherein the second set of information is protected via encryption, integrity protection, or a combination thereof. The operations of 1415 may be performed according to the methods described herein. In some examples, aspects of the operations of 1415 may be performed as described with reference to Figures 5 to 8 The protected receiving component described is executed.

[0226] At 1420, the UE may compare the second set of information with the first set of information. The operations of 1420 may be performed according to the methods described herein. In some examples, aspects of the operations of 1420 may be performed as described with reference to Figures 5 to 8 An example of the advantage of comparing the second information set with the first information set is that the UE can efficiently identify attacks from fake base stations and avoid potential mistakes in operation, thereby maintaining operation efficiency.

[0227] At 1425, the UE may determine the authenticity of the first information set based on the received second information set and the comparison. The operations of 1425 may be performed according to the methods described herein. In some examples, aspects of the operations of 1425 may be performed as described with reference to Figures 5 to 8 The authentication component described is performed.

[0228] At 1430, the UE may communicate with the network based on the determination. The operations of 1430 may be performed according to the methods described herein. In some examples, aspects of the operations of 1430 may be performed as described with reference to Figures 5 to 8 The described communication components are used to perform.

[0229] Fig.15 A flow chart illustrating a method 1500 for supporting information protection to detect fake base stations according to aspects of the present disclosure is shown. The operations of the method 1500 may be implemented by the base station 105 or its components as described herein. For example, the operations of the method 1500 may be implemented by the base station 105 or its components as described herein. Figures 9 to 12 In some examples, the base station may execute an instruction set to control the functional elements of the base station to perform the following functions. Additionally or alternatively, the base station may use dedicated hardware to perform various aspects of the following functions.

[0230] At 1505, the base station may transmit to the UE a first set of information associated with communicating with the network, wherein the first set of information lacks protection via encryption, integrity protection, or a combination thereof. The operations of 1505 may be performed according to the methods described herein. In some examples, aspects of the operations of 1505 may be performed as described with reference to Figures 9 to 12 The described unprotected transport component is performed.

[0231] At 1510, the base station may receive from the UE an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via encryption, integrity protection, or a combination thereof. The operations of 1510 may be performed according to the methods described herein. In some examples, aspects of the operations of 1510 may be performed as described with reference to Figures 9 to 12 The protected instruction component described is executed.

[0232] At 1515, the base station may determine whether to retransmit the first set of information to the UE in a protected message based on the indication of the second set of information, wherein the protected message is protected via encryption, integrity protection, or a combination thereof. The operations of 1515 may be performed according to the methods described herein. In some examples, aspects of the operations of 1515 may be performed as described with reference to Figures 9 to 12 The described retransmission determination component is performed.

[0233] At 1520, the base station may communicate with the UE based on whether the first set of information is different from the second set of information. The operations of 1520 may be performed according to the methods described herein. In some examples, aspects of the operations of 1520 may be performed as described with reference to Figures 9 to 12 The described communication components are used to perform.

[0234] Fig.16 A flow chart illustrating a method 1600 for supporting information protection to detect fake base stations according to aspects of the present disclosure is shown. The operations of the method 1600 may be implemented by the base station 105 or its components as described herein. For example, the operations of the method 1600 may be implemented by the base station 105 or its components as described herein. Figures 9 to 12 In some examples, the base station may execute an instruction set to control the functional elements of the base station to perform the following functions. Additionally or alternatively, the base station may use dedicated hardware to perform various aspects of the following functions.

[0235] At 1605, the base station may transmit to the UE a first set of information associated with communicating with the network, wherein the first set of information lacks protection via encryption, integrity protection, or a combination thereof. The operations of 1605 may be performed according to the methods described herein. In some examples, aspects of the operations of 1605 may be performed as described with reference to Figures 9 to 12 The described unprotected transport component is performed.

[0236] At 1610, the base station may receive from the UE an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via encryption, integrity protection, or a combination thereof. The operations of 1610 may be performed according to the methods described herein. In some examples, aspects of the operations of 1610 may be performed as described with reference to Figures 9 to 12 The protected instruction component described is executed.

[0237] At 1615, the base station may determine whether to retransmit the first set of information to the UE in a protected message based on the indication of the second set of information, wherein the protected message is protected via encryption, integrity protection, or a combination thereof. The operations of 1615 may be performed according to the methods described herein. In some examples, aspects of the operations of 1615 may be performed as described with reference to Figures 9 to 12 The described retransmission determination component is performed.

[0238] At 1620, the base station may retransmit the first set of information in a protected message (e.g., an RRC reconfiguration message) based on the determination. The operations of 1620 may be performed according to the methods described herein. In some examples, aspects of the operations of 1620 may be as described with reference to Figures 9 to 12 The described retransmission determination component is performed.

[0239] At 1625, the base station may communicate with the UE based on whether the first set of information is different from the second set of information. The operations of 1625 may be performed according to the methods described herein. In some examples, aspects of the operations of 1625 may be performed as described with reference to Figures 9 to 12 The described communication components are used to perform.

[0240] At 1630, the base station may receive a report from the UE indicating an identity of an additional base station, at least a portion of the second information set, or a combination thereof based on the retransmitted first information set. The operations of 1630 may be performed according to the methods described herein. In some examples, aspects of the operations of 1630 may be performed as described with reference to Figures 9 to 12 The described base station authentication component is performed.

[0241] At 1635, the base station may verify whether the additional base station is authorized by the network based on the report. The operations of 1635 may be performed according to the methods described herein. In some examples, aspects of the operations of 1635 may be performed as described with reference to Figures 9 to 12 The described base station authentication component is performed.

[0242] It should be noted that the methods described herein describe possible implementations, and that the various operations and steps may be rearranged or otherwise modified and other implementations are possible. Furthermore, aspects from two or more methods may be combined.

[0243] The technology described herein can be used in various wireless communication systems, such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal frequency division multiple access (OFDMA), single carrier frequency division multiple access (SC-FDMA) and other systems. CDMA systems can implement radio technologies such as CDMA2000, Universal Terrestrial Radio Access (UTRA). CDMA2000 covers IS-2000, IS-95 and IS-856 standards. IS-2000 versions are generally referred to as CDMA2000 1X, 1X, etc. IS-856 (TIA-856) is generally referred to as CDMA2000 1xEV-DO, High Rate Packet Data (HRPD), etc. UTRA includes Wideband CDMA (WCDMA) and other variants of CDMA. TDMA systems can implement radio technologies such as Global System for Mobile Communications (GSM).

[0244] OFDMA systems can implement radio technologies such as Ultra Mobile Broadband (UMB), Evolved UTRA (E-UTRA), Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, Flash-OFDM, etc. UTRA and E-UTRA are part of Universal Mobile Telecommunications System (UMTS). LTE, LTE-A, and LTE-A Pro are versions of UMTS that use E-UTRA. UTRA, E-UTRA, UMTS, LTE, LTE-A, LTE-A Pro, NR, and GSM are described in documents from an organization named "3rd Generation Partnership Project" (3GPP). CDMA2000 and UMB are described in documents from an organization named "3rd Generation Partnership Project 2" (3GPP2). The techniques described herein may be used for systems and radio technologies mentioned herein as well as for other systems and radio technologies. Although aspects of LTE, LTE-A, LTE-A Pro, or NR systems may be described for example purposes and LTE, LTE-A, LTE-A Pro, or NR terminology may be used in much of the description, the techniques described herein may also be applicable to applications other than LTE, LTE-A, LTE-A Pro, or NR applications.

[0245] A macro cell generally covers a relatively large geographic area (e.g., a radius of several kilometers) and may allow unrestricted access by UEs with service subscriptions to a network provider. A small cell may be associated with a lower power base station (compared to a macro cell), and the small cell may operate in the same or different (e.g., licensed, unlicensed) frequency band as the macro cell. According to various examples, a small cell may include a pico cell, a femto cell, and a micro cell. A pico cell, for example, may cover a smaller geographic area and may allow unrestricted access by UEs with service subscriptions to a network provider. A femto cell may also cover a smaller geographic area (e.g., a residence) and may provide restricted access by UEs associated with the femto cell (e.g., UEs in a closed subscriber group (CSG), UEs of users in the residence, etc.). An eNB for a macro cell may be referred to as a macro eNB. An eNB for a small cell may be referred to as a small cell eNB, a pico eNB, a femto eNB, or a home eNB. An eNB may support one or more (eg, two, three, four, etc.) cells and may also support communication using one or more component carriers.

[0246] The wireless communication systems described herein may support synchronous or asynchronous operation. For synchronous operation, each base station may have similar frame timing, and transmissions from different base stations may be roughly aligned in time. For asynchronous operation, each base station may have different frame timing, and transmissions from different base stations may not be aligned in time. The techniques described herein may be used for synchronous or asynchronous operation.

[0247] The information and signals described herein may be represented using any of a variety of different techniques and technologies. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referred to throughout this description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

[0248] The various illustrative blocks and modules described in conjunction with the disclosure herein may be implemented or executed with a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in an alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration).

[0249] The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions may be stored on or transmitted by a computer-readable medium as one or more instructions or codes. Other examples and implementations fall within the scope of the present disclosure and the appended claims. For example, due to the nature of software, the functions described herein may be implemented using software executed by a processor, hardware, firmware, hardwiring, or any combination thereof. Features that implement the functions may also be physically located in various locations, including being distributed so that parts of the functions are implemented at different physical locations.

[0250] Computer-readable medium includes both non-transient computer storage medium and communication medium, and it includes any medium that facilitates computer program to transfer from one place to another.Non-transient storage medium can be any available medium that can be accessed by general or special-purpose computer.As an example and not limitation, non-transient computer-readable medium can include RAM, ROM, electrically erasable programmable ROM (EEPROM), flash memory, compact disk (CD) ROM or other optical disk storage, disk storage or other magnetic storage device, or can be used to carry or store instruction or data structure form of desired program code means and can be accessed by general or special-purpose computer or general or special-purpose processor any other non-transient medium.Any connection is also properly referred to as computer-readable medium.For example, if software is transmitted from website, server or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wireless technology such as infrared, radio and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL or wireless technology such as infrared, radio and microwave are just included in the definition of medium. Disk and disc as used herein include CDs, laser discs, optical discs, digital versatile discs (DVDs), floppy disks, and Blu-ray discs, where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above are also included within the scope of computer-readable media.

[0251] As used herein (including in the claims), "or" used in a list of items (e.g., a list of items with a phrase such as "at least one of" or "one or more of") indicates an inclusive list, so that, for example, a list of at least one of A, B, or C means A or B or C or AB or AC or BC or ABC (i.e., A and B and C). Similarly, as used herein, the phrase "based on" should not be interpreted as referring to a closed set of conditions. For example, an exemplary step described as "based on condition A" may be based on both condition A and condition B without departing from the scope of the present disclosure. In other words, as used herein, the phrase "based on" should be interpreted in the same manner as the phrase "based at least in part on."

[0252] In the accompanying drawings, similar components or features may have the same reference number. In addition, various components of the same type may be distinguished by following the reference number with a dash and a second reference number that distinguishes between similar components. If only the first reference number is used in the specification, the description may apply to any of the similar components having the same first reference number regardless of the second reference number, or other subsequent reference numbers.

[0253] The descriptions set forth herein in conjunction with the accompanying drawings describe example configurations and do not represent all examples that may be implemented or that fall within the scope of the claims. The term "exemplary" as used herein means "used as an example, instance, or illustration" and does not mean "better than" or "better than other examples." This detailed description includes specific details to provide an understanding of the described techniques. However, these techniques may be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form to avoid obscuring the concepts of the described examples.

[0254] The description herein is provided to enable those skilled in the art to make or use the present disclosure. Various modifications to the present disclosure will be apparent to those skilled in the art, and the universal principles defined herein may be applied to other variations without departing from the scope of the present disclosure. Thus, the present disclosure is not limited to the examples and designs described herein, but should be granted the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for wireless communication at a user equipment UE, comprising: receiving, from a base station, a first set of information associated with communicating with a network, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; receiving a UE-specific key for an initial access stratum message, wherein the UE-specific key is based at least in part on one or more identifiers of the UE and the UE-specific key is used to security protect an indication of the first information set; transmitting the indication of the first set of information to the base station, wherein the indication is protected via encryption, integrity protection, or a combination thereof; determining authenticity of the first set of information based at least in part on whether a second set of information associated with communicating with the network is received from the base station, the second set of information being different from the first set of information; as well as Communicating with the network is performed based at least in part on the determination.

2. The method of claim 1, further comprising: receiving the second set of information from the base station, wherein the second set of information is protected via ciphering, integrity protection, or a combination thereof; as well as The second set of information is compared to the first set of information, wherein the determining is based at least in part on the comparing.

3. The method of claim 2, wherein the second set of information is received in a radio resource control reconfiguration message.

4. The method of claim 1, wherein: The first information set includes a first master information block, a first system information block set, or a combination thereof; and The second information set includes a second master information block, a second system information block set, or a combination thereof.

5. The method of claim 1, wherein the indication comprises a hash value based at least in part on the first set of information and a system frame number value associated with the first set of information, the method further comprising: If the second set of information is different from the first set of information, the second set of information is received from the base station.

6. The method of claim 1, wherein the indication comprises a request for the second set of information, the method further comprising: The second set of information is received from the base station based at least in part on the request for the second set of information.

7. The method of claim 1, wherein: The UE comprises an unregistered UE without a valid non-access stratum security context; and An indication of the first set of information is transmitted in an Access Stratum Security Mode Complete message.

8. The method of claim 1 , wherein the UE comprises a registered UE having a valid non-access stratum security context, and wherein transmitting an indication of the first set of information comprises: The indication of the first set of information is security protected based at least in part on the UE-specific key, wherein the security protection includes encrypting the indication of the first set of information, integrity protecting the indication of the first set of information, or a combination thereof.

9. The method of claim 8, wherein security protecting the indication of the first set of information based at least in part on the UE-specific key further comprises: deriving a temporary encryption key for the initial access stratum message based at least in part on the UE-specific key, a pseudo-random number, an algorithm identifier, or a combination thereof; encrypting an indication of the first set of information using the temporary encryption key and a system frame number value associated with the first set of information; as well as An indication of the system frame number value and the pseudo-random number, the algorithm identifier, or a combination thereof is transmitted to the base station.

10. The method of claim 8, further comprising: An updated UE-specific key for the initial access stratum message is received, wherein the updated UE-specific key is based at least in part on one or more identifiers of the UE, a key index, or a combination thereof.

11. The method of claim 8, wherein the indication of the first set of information is transmitted in a radio resource control connect message.

12. The method of claim 1, further comprising: receiving a key index value associated with the UE-specific key; as well as A key index value is transmitted with an indication of the first set of information.

13. The method of claim 1, further comprising: Detecting additional base stations; transmitting an initial radio resource control connection setup message to the additional base station indicating detection of the additional base station, wherein the initial radio resource control connection setup message is security protected based at least in part on the UE-specific key; as well as A determination is made based at least in part on the initial radio resource control connection setup message whether the additional base station is an authorized base station of the network.

14. The method of claim 1, wherein the one or more identifiers of the UE include a globally unique temporary identity, a serving temporary mobile subscriber identity, a temporary mobile subscriber identity, or a combination thereof.

15. The method of claim 1, wherein the UE-specific key is received in a secure non-access stratum message.

16. The method of claim 1, wherein: The determining includes determining that the first set of information is authentic; and The communicating includes communicating with the network via the base station based at least in part on determining that the first set of information is authentic.

17. The method of claim 1, wherein: The determining includes determining that the first set of information is untrue; and The communication comprises: disassociating from the base station based at least in part on determining that the first set of information is unauthentic; reattaching to an additional base station; and Communicating with the network via the additional base station.

18. The method of claim 17, further comprising: Based at least in part on determining that the first set of information is not authentic, reporting the identity of the base station, at least a portion of the first set of information, or a combination thereof to the additional base station.

19. The method of claim 1, further comprising: An indication is received from the base station that security protection for the first set of information is enabled, wherein the indication is received in a non-access stratum security mode command message.

20. A method for wireless communication at a base station, comprising: transmitting, to a user equipment (UE), a first set of information associated with communicating with a network, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; receiving, from the UE, an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via integrity protection and wherein, in the case where the UE comprises an unregistered UE without a valid non-access stratum security context, the indication is received in an access stratum security mode complete message, or, in the case where the UE comprises a registered UE with a valid non-access stratum security context, the indication is protected based at least in part on a UE-specific key for an initial access stratum message, the UE-specific key being based at least in part on one or more identifiers of the UE; determining whether to retransmit the first set of information to the UE in a protected message based at least in part on the indication of the second set of information, wherein the protected message is protected via ciphering, integrity protection, or a combination thereof; and Communicating with the UE is performed based at least in part on whether the first set of information is different from the second set of information.

21. The method of claim 20, wherein: The first information set includes a first master information block, a first system information block set, or a combination thereof; and The second information set includes a second master information block, a second system information block set, or a combination thereof.

22. The method of claim 20, wherein the indication of the second set of information comprises a value based at least in part on a hash value of the second set of information and a system frame number value associated with the second set of information, the method further comprising: identifying the second set of information based at least in part on the hash value; as well as If the second information set is different from the first information set, it is determined to retransmit the first information set to the UE in the protected message.

23. The method of claim 20, wherein the indication of the second set of information comprises a request for the second set of information, wherein the first set of information corresponds to the second set of information, the method further comprising: The first set of information is retransmitted to the UE in the protected message based at least in part on the request.

24. The method of claim 20, further comprising: receiving a master key for the initial access stratum message from a network entity of the network; receiving, from the UE, an indication of a system frame number value, a pseudorandom number, an algorithm identifier, or a combination thereof; deriving the UE-specific key using the master key and one or more identifiers of the UE; deriving a temporary encryption key for the initial access stratum message based at least in part on the UE-specific key and the system frame number value, the pseudo-random number, the algorithm identifier, or a combination thereof; and An indication of the second set of information is decrypted using the temporary encryption key.

25. An apparatus for wireless communication at a user equipment UE, comprising: means for receiving, from a base station, a first set of information associated with communicating with a network, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; means for receiving a UE-specific key for an initial access stratum message, wherein the UE-specific key is based at least in part on one or more identifiers of the UE, and the UE-specific key is used to security protect an indication of the first set of information; means for transmitting the indication of the first set of information to the base station, wherein the indication is protected via integrity protection; means for determining the authenticity of the first set of information based at least in part on whether a second set of information associated with communicating with the network is received from the base station, the second set of information being different from the first set of information; as well as Means for communicating with the network based at least in part on the determination.

26. An apparatus for wireless communication at a base station, comprising: means for transmitting to a user equipment UE a first set of information associated with communicating with a network, wherein the first set of information lacks protection via cryptography, integrity protection, or a combination thereof; means for receiving, from the UE, an indication of a second set of information received at the UE and associated with communicating with the network, wherein the indication is protected via ciphering, integrity protection, or a combination thereof, and wherein, in the case where the UE comprises an unregistered UE without a valid non-access stratum security context, the indication is received in an access stratum security mode complete message, or in the case where the UE comprises a registered UE with a valid non-access stratum security context, the indication is protected based at least in part on a UE-specific key for an initial access stratum message, the UE-specific key being based at least in part on one or more identifiers of the UE; means for determining whether to retransmit the first set of information to the UE in a protected message based at least in part on an indication of the second set of information, wherein the protected message is protected via integrity protection; as well as means for communicating with the UE based at least in part on whether the first set of information is different from the second set of information.

Images