Lawful interception of activity by application functions

Abstract

The present invention relates to a method for enabling legal interception of the activity of a user equipment, UE, by means of an application function, AF, associated with a boot technology, said activity using an AF key while the UE is in a roaming situation using a Universal Global Temporary Identifier, GUTI, for a visited Public Land Mobile Network, vPLMN, for the purpose of legal interception. The provided application function key has been provided to the vPLMN by a third controlling the AF.

Description

Technical Field

[0001] The present invention relates to a method enabling the lawful interception of activities of a user equipment UE by means of an application function AF associated with a bootstrapping technique.

[0002] The present invention also relates to a user equipment UE implementing the method and a guiding anchoring function implementing the method. Background Art

[0003] Bootstrapping technologies enable keys to be shared between user equipment UE and application functions AF. Such bootstrapping technologies are typically authentication and key management for applications AKMA based on 3GPP certificates in 5G systems, or GBA. GBA has been defined in 4G, while AKMA has been specified in 5G Rel-17.

[0004] With the development of edge computing and proximity services (abbreviated as ProSe), among others, these technologies are gaining new applications. In particular, V2X applications involving vehicles are examples of services based on ProSe enablers.

[0005] Furthermore, these uses increase the use cases with application functions outside the currently used Public Land Mobile Network PLMN, which leads to specific scenarios regarding the activities of accessing the UE using the application functions.

[0006] In particular, the roaming use case has been excluded from Rel-17 by the Lawful Interception LI group (3GPP SA3-LI) until the solution is a guarantee that the VPLMN is receiving the appropriate material to ensure LI.

[0007] One solution could be to use certificate-based TLS, but this solution is not favored for newly developed applications. In contrast, bootstrapping technologies have real advantages and are needed to meet lawful intercept requirements for all deployment scenarios, usually when UEs are roaming for these technologies.

[0008] The bootstrapping techniques, typically GBA and AKMA, enable the establishment of a key shared between the UE and the AF. 3GPP does not exclude the AF from operating outside the visited public land mobile network VPLMN. The AF may be operated by the home network HPLMN or the visited network or a third party. During 3GPP Rel-17, the 3GPP SA3 LI group responsible for lawful interception raised the following question.

[0009] In most cases, a shared key can be used for encryption on the VPLMN by creating an encryption tunnel between the UE and a point outside the VPLMN (e.g., a point in the home PLMN or a third party). This prevents lawful interception from being performed as required in the VPLMN.

[0010] For encryption that the MNO has been involved in establishing, there are lawful intercept requirements to provide the service or means for law enforcement to decrypt the service.

[0011] This requirement applies to mechanisms such as AKMA, where the MNO is involved in establishing and distributing key material for encryption. Therefore, there are lawful interception requirements for AKMA and GBA.

[0012] Furthermore, when roaming, LI needs to be performed independently in possibly each involved jurisdiction (which includes the jurisdiction of the roaming country). In particular, activation of LI in the VPLMN needs to be performed without explicit support from the home PMLN, since otherwise it would result in the information that the inbound roamer is the LI target in the VPLMN. In particular, the issues to be addressed apply to AKMA and GBA.

[0013] So far, there is no known solution to solve the above problems. Therefore, further alternatives and advantageous solutions would be desirable in the art. Summary of the invention

[0014] The present invention aims to enable lawful interception also in roaming situations for any application using vectoring techniques.

[0015] In the broadest sense, the present invention is defined as a method enabling lawful interception of activities of a user equipment UE by an application function AF associated with a bootstrapping technique, said activities using an AF key, while the UE is in a roaming situation with respect to a visited public land mobile network PLMN, using at least one parameter known to both the UE and the visited PLMN, said provided application function key having been provided to said visited PLMN for the purpose of lawful interception, said method comprising the following steps for the UE or for the visited PLMN, respectively: - sending parameters known to both the UE and the visited PLMN, encrypted with the AF key or the provided AF key respectively, to the visited PLMN or the UE respectively, and For each visited PLMN or UE that has received the encryption parameters: - decrypting the encrypted parameters with the provided AF key or AF key, respectively, and - comparing the decrypted parameters with said parameters known to the visited PLMN or the UE, respectively, which has received said encrypted parameters, - The use of AF is authorized only if the comparison shows that both parameters are identical.

[0016] The lawful interception possibility of the present invention is based on the provision of shared AF keys to the visited PLMN by the home PLMN (hereinafter HPLMN) or by any third party responsible for a given application function AF. It should be noted here that the AF belongs to the HPLMN or to a third party. So far, the provision of shared AF keys has only been the responsibility of the HPLMN, since the HPLMN is the owner of the anchor function, typically the AAnF of the AKMA anchor function in which the AF keys are derived. However, the present invention is also applicable to the case where such keys are provided by a third party monitoring the application function. The present invention is applicable to both cases.

[0017] The invention also ensures that the HPLMN or a third party responsible for providing the application function key cannot lie to the visited PLMN (hereinafter VPLMN) about the shared key value. Otherwise, the provision of the AF key may be of no value for lawful interception requirements.

[0018] In the bootstrapping technology context, when the UE is in roaming and the AF belongs to the HPLMN or another party, a scenario occurs where the HPLMN may lie to the VPLMN about the value of the shared AF key.

[0019] In the case where AF keys are systematically provided to the VPLMN, the present invention includes a way to check whether the correct AF keys have been provided to meet the lawful interception requirements. In other words, when the UE is roaming and when the AF is operated by a third party of the HPLMN or the visited PLMN, the present invention enables the VPLMN to verify the AF keys provided by the HPLMN.

[0020] The principle of the present invention is therefore to perform a parallel encryption operation using the AF key to be verified in order to be able to verify that the provided AF key is correct. It is therefore to be noted here that the term encryption / decryption refers to any kind of encryption operation that is able to check whether the HPLMN has provided the correct AF key. Therefore, the calculation of the integrity value of the parameter calculated with the AF key is considered to be encryption in the sense of the present invention.

[0021] Therefore, in a particular embodiment, the encrypted parameter is an integrity value of a parameter calculated using the AF key or the provided AF key, respectively, the decryption step consists in calculating the integrity value of the parameter known by the visited PLMN or the UE, respectively, which has received the encrypted parameter, using the provided AF key or the AF key, respectively, the comparison step consists in comparing the calculated integrity value with the received integrity value, and the use of the AF is authorized only when the comparison shows that the two integrity values ​​are identical.

[0022] In this particular embodiment, typically a message authentication code calculated with the AF key is used.

[0023] The present invention prevents the HPLMN or any PLMN hosting the application functionality implementing the bootstrapping technique and therefore prevents the AF key from lying to any other PLMN, typically a VPLMN, about the shared key used between the UE and the AF.

[0024] Therefore, the present invention relies on the use of AF keys provided to the VPLMN by the HPLMN or by another entity associated with the AF and the use of parameter(s) known by the UE and the VPLMN.The present invention relates to parameters known by the UE and the VPLMN.

[0025] In a preferred embodiment, this parameter is a Generalized Global Temporary Identifier, GUTI.

[0026] This embodiment uses the main parameters for connecting the UE to the visited PLMN and is therefore a simple and thus preferred embodiment.

[0027] The present invention enables checking the authenticity of application function keys in a user equipment roaming context where the user equipment using the application function keys is connected to a visited public land mobile network.

[0028] The invention ensures a GBA and AKMA solution which, besides the usual reliance on the presence of a USIM, can be used in any deployment scenario where there is an interest in protecting the interface thanks to the Pre-Shared Keys - TLS PSK-TLS.

[0029] According to an advantageous feature, an application function identifier identifying the AF of interest is included in the exchange between the UE and the visited PLMN.

[0030] Such AF identifier enables retrieval of appropriate application function keys and authorization of use of the correct application function authenticated.Such identifier is a minimum value associated with messages including said encryption parameters and authorization related messages.

[0031] According to a particular feature, the UE has a home public land mobile network PLMN, and the provisioning of the application function key is done by the home PLMN.

[0032] This scenario corresponds to the case where the Home PLMN owns the AF, and also to the case where the Home PLMN centrally manages the bootstrapping scenarios involving third parties. This is the currently implemented solution most of the time when a third party in the sense of 3GPP standardization participates in the management of the AF. In such cases, the Home PLMN receives the necessary key information for implementing the bootstrapping from such third party, thus including the application function keys.

[0033] According to another particular feature of the invention, the bootstrapping technology implements an anchor function in the PLMN, the anchor function stores the application function key generated by the bootstrapping technology, and the steps performed by the visited PLMN are performed by the anchor function of the visited PLMN.

[0034] This feature corresponds to the simplest implementation of the invention in a visited PLMN. Centrally directing the necessary material in the anchor function of the visited PLMN and performing the steps of the invention within the anchor function is a simple and effective way to implement the invention.

[0035] According to one implementation, in a roaming scenario using an access management function, for an entity that encrypts parameters known to both the UE and the visited PLMN, the step of sending the encrypted parameters to another entity includes, for the encrypting entity, a sub-step of sending the encrypted parameters to the access management function, which forwards the encrypted parameters to the other entity.

[0036] This implementation means that the access management function AMF, which is generally active in roaming situations, is involved in the method of the present invention. It should be noted here that when the AF identifier is used, it follows the same way via the AMF.

[0037] The invention also relates to a user equipment UE having a roaming feature for a visited PLMN, using parameters known to both the UE and the visited PLMN, and having a responsibility to enable lawful interception of its activities through an application function AF associated with a steering technique, said activities using an AF key stored in the UE, said UE comprising: - an encryption / decryption module adapted to encrypt parameters known to both the UE and the visited PLMN using stored AF keys and / or to decrypt received encrypted parameters using stored AF keys, - a receiving / transmitting module adapted to send said ciphering parameters to a visited PLMN and / or to receive said ciphering parameters from a visited PLMN, - a processing module adapted to compare the decrypted parameters with said parameters known to the UE, in the case where the parameters are decrypted, in which case the receiving / transmitting module is also adapted to send the result of the comparison to the access management function, so that the access management function authorizes the use of the AF only if the comparison shows that the two parameters are identical.

[0038] According to the two embodiments of the method of the present invention, that is, in the direction from UE to visited PLMN or from visited PLMN to UE, such user equipment is suitable for implementing the method of the present invention. Of course, for a specific AF, these two embodiments can be implemented in one direction, and for another AF, these two embodiments can be implemented in another direction. These two embodiments can coexist, or one of them can also be implemented exclusively to perform the method of the present invention. The use of the terms "or" and "and / or" in the claims is intended to cover the two embodiments together or independently in the definition of the scope of the present invention. The term "respectively" can cover the two embodiments in parallel.

[0039] The invention also relates to a PLMN suitable for attaching a User Equipment UE in a roaming situation as a Visited Public Land Mobile Network PLMN using parameters known to both the UE and itself as a Visited PLMN, and suitable for enabling the lawful interception of the activities of the UE by an Application Function AF associated with a bootstrapping technique, the AF being owned by a third party of the PLMN, the activities using an AF key, the PLMN is suitable for being provided with an application function key, The PLMN also includes: - an encryption / decryption module adapted to encrypt said parameters using a provided AF key and / or to decrypt received encrypted parameters using a provided AF key, - a receiving / transmitting module adapted to send said ciphering parameters to a UE and / or receive said ciphering parameters from a UE, - a processing module adapted to compare the decrypted parameters with said parameters known to the PLMN, in the case where the parameters are decrypted by said PLMN, in which case the receiving / transmitting module is also adapted to send the result of the comparison to the access management function, so that the access management function authorizes the use of the AF only if the comparison shows that the two parameters are identical.

[0040] Such PLMN is suitable for executing both embodiments of the method of the present invention. Likewise, implementation of only one embodiment without the second embodiment is also included in the scope defined by the claims.

[0041] It is to be noted here that, in general and in other parts of the patent application, the term "third party" means what it generally means in 3GPP, i.e. corresponds to an entity different / independent from the operator, which operator is the home PLMN or the visited PLMN. However, in the above definition of the PLMN of the present invention in the last paragraph, these terms refer to all third parties of the PLMN, this time also including the home PLMN.

[0042] According to an advantageous implementation, the PLMN has a bootstrap anchoring functionality suitable for performing the steps of the method of the invention.

[0043] As mentioned above, this implementation is a simple and effective way to implement the invention.

[0044] To the accomplishment of the foregoing and related ends, one or more embodiments comprise the features hereinafter fully described and particularly pointed out in the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The following description and drawings set forth certain illustrative aspects in detail and are indicative of only some of the various ways in which the principles of the embodiments may be employed. Other advantages and novel features will become apparent from the following detailed description when considered in conjunction with the accompanying drawings, and the disclosed embodiments are intended to include all such aspects and their equivalents. · Figure 1 A time flow chart showing a first embodiment of the method of the present invention; · Figure 2 A time flow chart of a second embodiment of the method of the present invention is shown. DETAILED DESCRIPTION

[0046] In order to more completely understand the present invention, the present invention will now be described in detail with reference to the accompanying drawings. The detailed description will illustrate and describe the contents of the preferred embodiments of the present invention. It should be understood that various modifications and changes in form or details can be easily made without departing from the scope of the present invention. Therefore, it is intended that the present invention may not be limited to the exact form and details shown and described herein, nor to all of the present invention that is less than disclosed herein and claimed below. In different drawings, the same elements have been represented by the same reference numerals. For the sake of clarity, only those elements and steps that are useful for understanding the present invention have been shown in the drawings and will be described.

[0047] Figure 1 A flow chart of the method of the present invention is schematically shown. A method of the apparatus 10 of the present invention of the type of application of the present invention is used as an embodiment. The present invention relates to GBA and AKMA as bootstrap technologies implemented in 5G. The following illustrative description is made for AKMA bootstrap, but similar functional entities exist in GBA or other bootstrap technologies, and the implementation of the present invention will be similar.

[0048] In this exemplary flow chart, the user equipment UE is in a roaming situation to a visited public land mobile network VPLMN with a visited AKMA anchor function vAAnF.When attaching to the VPLMN, the UE has been provisioned with a general global temporary identifier GUTI.

[0049] As a prerequisite of the present invention, in step S0, the UE has been registered and has derived the bootstrapping AF keys in order to use the application function AF using the bootstrapping technique, typically for using several AFs to use AKMA-based AF keys. This prerequisite can be done before or during a roaming situation as long as the UE is able to establish a relationship with the AF. For this registration, the UE communicates with the access and mobility management function AMF in 5G and with the authentication server function AUSF.

[0050] Registration is done to use an application function AF managed by the UE's home PLMN or another entity. In such a case, this can be the anchor function hAAnF of the home PLMN, which derives the keys related to the bootstrapping technology, but the AF keys can also be managed by any other third party qualified to manage such an AF and therefore provided by it.

[0051] Thus, the primary authentication and establishment of useful keys for the bootstrapping technology is performed in an initial step S0. The useful keys (which include at least one master bootstrapping key mKBS from which the application function keys are to be derived) are then stored in an anchor function hAAnF, which here belongs to the home PLMN. It can also be an anchor function belonging to a third party that manages the application function AF. This step is a prerequisite for the method of the invention.

[0052] Then, in step S1, the UE when in roaming state requests to establish an application session with the AF. This means that the AKMA key identifier of the UE A-KID is sent in the AKMA infrastructure. The identifier to be used in the GBA infrastructure is the B-TID.

[0053] In step S2, the AF then sends a request for the application key KAF with A-KID and the AF identifier AF_ID. This request is made to the anchor function hAAnF responsible for AF management and through which the UE has previously performed the main authentication and establishment of the master bootstrap key mKBS.

[0054] In step S3, hAAnF derives the application function key KAF from the previously stored master boot key mKBS. Then, in step S4, hAAnF replies to AF, sending at least the key KAF and advantageously the key expiry time.

[0055] In step S5, when the hAAnF is informed of the visited PLMN of the UE, the hAAnF also sends the key KAF to the visited anchor function vAAnF. The vAAnF is the entity that receives the KAF from the home PLMN of the UE or from a third party that manages the application function. Therefore, it is noted here that another third party other than the hAAnF may be informed of the visited PLMN of the UE so that the necessary AF key can be provided.

[0056] In step S6, step S4 triggers the AF to respond to the UE, thereby notifying the UE that the application session is established.

[0057] In a first embodiment of the invention, after the application session establishment response, messages are exchanged in the direction from the UE in the roaming situation to the AMF, and then the AMF communicates with the vAAnF.

[0058] In step S10, the UE encrypts the GUTI with the KAF. Alternatively, the UE can also calculate the integrity value of the GUTI using the KAF as the encrypted GUTI. Then, in step S11, it sends the encrypted GUTIe to the AMF together with an identifier enabling the retrieval of the appropriate KAF in the target VAAnF. In step S12, the AMF, knowing the GUTI, forwards the encrypted GUTIe and the GUTI to the VAAnF in plain text, where the identifier enables the retrieval of the appropriate KAF in the target vAAnF. In step S13, the vAAnF then deciphers the encrypted GUTIe using the KAFp received from the hAAnF of the home PLMN or from a third party managing the AF. Alternatively, the vAAnF calculates the integrity value GUTId of the GUTI received in plain text together with the KAFp received from the hAAnF of the home PLMN or from a third party managing the AF.

[0059] In step S14, the decoded GUTId is compared with the received GUTI in plain text. Alternatively, the calculated integrity value GUTId is compared with the received integrity GUTI value. In step S15, the vAAnF sends a message to the AMF, indicating whether the GUTI verification has been successful, wherein the identifier enables the retrieval of the appropriate KAF in the UE. The AMF then sends a message to the UE, indicating whether the GUTI verification has been successful, as shown in step S16. The UE then uses the application function AF only if the verification has been successful.

[0060] exist Figure 2 In the second embodiment shown, after the application session establishment response in step S6, messages are exchanged in the direction from vAAnF to AMF and then forwarded to the UE.

[0061] In a first step S20, vAAnF contacts AMF to obtain GUTI in step S21. Then, in step S22, vAAnF encrypts GUTI with the key KAFp received from hAAnF.

[0062] Then, in step s23, the vAAnF sends the encrypted GUTIe to the AMF together with an identifier enabling the retrieval of the appropriate KAF in the UE. In step S24, the AMF forwards the encrypted GUTIe to the UE together with an identifier enabling the retrieval of the appropriate KAF. In step S25, the UE decrypts the GUTI with the appropriate key KAF. Then, in step S26, it compares the decrypted value GUTId with the GUTI stored in the UE. In step S27, the UE sends a message to the AMF indicating whether the GUTI verification has been successful. Then, in step S28, the AMF forwards the indication to the vAAnF. Only if the verification has been successful does the UE use the application function.

[0063] For the present invention, as long as the UE is in roaming, the UE checks whether a GUTI verification has been performed while any use of any application function AF has been requested. Only in the case where a GUTI verification has occurred, the applicability steps with respect to AF occur. These solutions are applicable to any application using bootstrapping technology, typically AKMA and GBA.

[0064] In the above detailed description, reference is made to the accompanying drawings which show by way of illustration specific embodiments in which the invention may be implemented. These embodiments are described in sufficient detail to enable a person skilled in the art to practice the invention. Therefore, the above detailed description should not be taken as limiting, and the scope of the invention is limited only by the appended claims when appropriately interpreted. In particular, it is within the scope of the invention to use integrity values ​​as encrypted values. In this case, the decryption step is actually to calculate the integrity value using the AF key, without departing from the principles of the invention, which solves the problem of being able to lawfully intercept an application by being able to check whether the correct application key has been provided.

Claims

1. A method for enabling lawful interception of activities of a user equipment UE by means of an application function AF associated with a bootstrapping technology, said activities using an AF key, while said UE is in a roaming situation with respect to a visited public land mobile network PLMN, using at least one parameter known to both the UE and the visited PLMN, said provided application function key having been provided to said visited PLMN for the purpose of lawful interception, said method comprising the following steps for said UE or for said visited PLMN, respectively: - sending parameters known to the UE and the visited PLMN, encrypted with the AF key or the provided AF key, to the visited PLMN or the UE, respectively, and For the visited PLMN or the UE having received the ciphering parameter, respectively: - decrypting said encrypted parameters with said provided AF key or said AF key, respectively, and - comparing the decrypted parameters with the parameters known to the visited PLMN or the UE, respectively, which have received the encrypted parameters, - Use of the AF is authorized only if the comparison shows that both parameters are identical.

2. The method according to claim 1, wherein The parameter known to both the UE and the visited PLMN is the Generic Global Temporary Identifier GUTI.

3. A method according to any one of the preceding claims, wherein An application function identifier for identifying the AF of interest is included in the exchange between the UE and the visited PLMN.

4. A method according to any one of the preceding claims, wherein The UE has a home public land mobile network PLMN, and the provisioning of the application function key is completed by the home PLMN.

5. A method according to any one of the preceding claims, wherein The bootstrapping technology implements an anchor function in the PLMN, the anchor function stores an application function key generated by the bootstrapping technology, and the steps performed by the visited PLMN are performed by the anchor function of the visited PLMN.

6. A method according to any one of the preceding claims, wherein In a roaming scenario using an access management function, for an entity that encrypts parameters known to both the UE and the visited PLMN, the step of sending the encrypted parameters to another entity comprises, for the encrypting entity, a sub-step of sending the encrypted parameters to the access management function, which forwards the encrypted parameters to the other entity.

7. A user equipment, UE, having roaming characteristics for a visited PLMN, using parameters known to both the UE and the visited PLMN, and having a responsibility to enable lawful interception of activities of the UE by an application function AF associated with a bootstrapping technique, said activities using an AF key stored in the UE, the UE comprising: - an encryption / decryption module adapted to encrypt parameters known to both the UE and the visited PLMN using said stored AF keys and / or to decrypt received encrypted parameters using said stored AF keys, - a receiving / transmitting module adapted to send said ciphering parameters to said visited PLMN and / or to receive said ciphering parameters from said visited PLMN, - a processing module adapted to compare the decrypted parameters with the parameters known to the UE in the case where the parameters are decrypted, in which case the receiving / transmitting module is also adapted to send the result of the comparison to an access management function so that the access management function authorizes the use of the AF only if the comparison shows that the two parameters are identical.

8. A PLMN adapted to attach a UE in a roaming situation as a visited public land mobile network PLMN using parameters known to both the user equipment UE and itself as a visited PLMN, and adapted to enable lawful interception of activities of said UE by an application function AF associated with a bootstrapping technique, said AF being owned by a third party of said PLMN, said activities using an AF key, the PLMN is suitable for being provided with an application function key, The PLMN also includes: - an encryption / decryption module adapted to encrypt said parameters using the provided AF key and / or to decrypt received encrypted parameters using the provided AF key, - a receiving / transmitting module adapted to send the ciphering parameters to the UE and / or receive the ciphering parameters from the UE, - a processing module adapted to compare the decrypted parameters with the parameters known to the PLMN, in the case where the parameters are decrypted by the PLMN, in which case the receiving / transmitting module is also adapted to send the result of the comparison to an access management function, so that the access management function authorizes the use of the AF only if the comparison shows that the two parameters are identical.

9. A PLMN according to claim 8, said PLMN having a bootstrap anchoring function, said bootstrap anchoring function being adapted to perform the steps of the method of claims 1 to 6.

Images