Bootstrapping secure connections for deployable networks

A method and apparatus for bootstrapping secure connections between wireless devices and deployable wireless communications networks. Using the method, a wireless device establishes a connection to an auxiliary network, and then establishes a connection with a deployable subscription bootstrapping service. The deployable subscription bootstrapping service generates a temporary subscription profile, including a temporary shared symmetric key, for the wireless device, writes the temporary profile to a deployable home subscriber server, and communicates the temporary profile to the wireless device, which stores the temporary profile. The wireless device then terminates the connection to the auxiliary network, and initiates a connection with the deployable wireless communications network using the temporary subscription profile.

BACKGROUND OF THE INVENTION

Increasingly, public safety agencies utilize mobile wireless devices, including, for example, smart phones and tablet computers. The wireless devices operate on wireless data communications networks, using protocols including, for example, long term evolution (LTE), 2G, 3G, 4G, and 5G. These networks and wireless devices can be used by public safety first responders to ensure effective interagency response to emergency or similar incidents. When public safety agencies respond in environments where there is no fixed network service, for example, rural areas, wilderness areas, or areas where catastrophic events have disabled pre-existing networks, deployable wireless communications networks can be used to establish or re-establish secure data networks for public safety use. A deployable wireless communications network can include components of a radio access network (RAN), the enhanced packet core (EPC), and packet data networks (PDNs) that contain applications and services utilized by the wireless devices.

Existing network authentication methods use shared symmetric keys (Ki) and require access to a home subscriber server (HSS) for authentication. The wireless devices store their shared symmetric keys on a physically secured universal integrated circuit card (UICC). The shared symmetric key is also stored at, and is associated with, a home subscriber server. At an incident scene or remote location where there is no fixed network service, there are few, if any, options for connecting visiting wireless devices with their corresponding home subscriber servers. In order to provide remotely operable wireless data communications networks, the deployable wireless data communications networks have their own local home subscriber servers. In order to support isolated, securely-authenticated service operation, sensitive security information for each wireless device (e.g., a shared symmetric key) from multiple remote home subscriber server databases, must be replicated on the local home subscriber server. In some cases, it may not be possible to acquire this data, and duplicating the data poses security risks. Therefore, existing authentication methods are not practical where users from multiple agencies require their wireless devices to access the same deployable wireless data communications network.

Accordingly, there is a need for bootstrapping secure connections for deployable networks.

DETAILED DESCRIPTION OF THE INVENTION

Some exemplary embodiments of the invention include a method for connecting a wireless device to a deployable wireless communications network that includes a deployable authentication database. In one embodiment, the method includes the wireless device establishing a connection to an auxiliary network, which is configured to allow the wireless device to access only a deployable subscription bootstrapping service. In some embodiments, the method includes the wireless device and the deployable subscription bootstrapping service determining a temporary shared symmetric key, and the deployable subscription bootstrapping service generating a temporary shared subscription profile including the temporary shared symmetric key. In some embodiments, the method may further include the deployable subscription bootstrapping service communicating the temporary subscription profile to the wireless device via the auxiliary network. The method further includes the wireless device terminating the connection to the auxiliary network, and establishing a wireless connection to the deployable wireless communications network using the subscription profile.

FIG. 1illustrates an exemplary deployable wireless communications network100, which operates according to the long term evolution (LTE) specification. In other embodiments, the deployable wireless communications network100operates using other specifications or protocols. Components of the deployable wireless communications network100are, in one embodiment configured to be mounted on a vehicle102(illustrated schematically), or some other means for transporting and deploying the deployable wireless communications network100where it is needed. The deployable wireless communications network100includes an auxiliary network104, a network firewall106, a deployable subscription bootstrapping service108, and a deployable authentication database110. As discussed below, the deployable authentication database110may be implemented more particularly as a home subscriber server. The deployable wireless communications network100also includes a mobile management entity112, one or more applications114a,114n, a packet/serving gateway116, and a base station118. The components of the deployable wireless communications network100may be connected by network nodes120. The base station118and the auxiliary network104may communicate with one or more wireless devices122. In some embodiments, components of the deployable wireless communications network100, for example, auxiliary network104and base station118may be removable from the vehicle102.

In some embodiments, the deployable subscription bootstrapping service108includes, among other things, a processor (e.g., a microprocessor or another suitable programmable device), a memory (i.e., a computer-readable storage medium), and an input/output interface. (not shown) The processor, the memory, and the input/output interface, as well as the other various modules are connected by one or more control or data buses. The use of control and data buses for the interconnection between and communication among the various modules and components would be known to a person skilled in the art in view of the invention described herein.

The memory may include a program storage area and a data storage area. The processor is connected to the memory and executes computer readable code (“software”) stored in a random access memory (RAM) of the memory (e.g., during execution), a read only memory (ROM) of the memory (e.g., on a generally permanent basis), or another non-transitory computer readable medium. Software included for the processes and methods for the deployable subscription bootstrapping service108can be stored in the memory. The software may include firmware, one or more applications, program data, filters, rules, one or more program modules, and/or other executable instructions. The processor is configured to retrieve from the memory and execute, among other things, instructions related to the processes and methods described herein.

Each wireless device122may be, for example, a smart phone, tablet, personal digital assistant (PDA), or other device that includes or can be connected to a network modem or components to enable wireless network communications (such as a baseband processor, memory, amplifier, antenna, etc.). Each wireless device122includes software stored therein for execution by the processor, and a non-volatile memory or other memory location for storing a subscription profile (i.e., authentication data and network profile data). The non-volatile memory may be located on a universal integrated circuit card (UICC) in the wireless device122. In some embodiments, the wireless device122includes a wired communications module (e.g., Ethernet or USB), via which the processor is operable to communicate. Each wireless device122is designed to communicate wirelessly with the base station118over a wireless communication link124. Each wireless device122may also communicate wirelessly or otherwise with the auxiliary network104over an auxiliary communication link126.

Each wireless device122also includes a deployable subscription bootstrapping client (DSBC)128. The deployable subscription bootstrapping client128is capable of communicating and exchanging information with the deployable subscription bootstrapping service108. In some embodiments, the deployable subscription bootstrapping client128communicates over the wireless communication link124, and through the base station118, the packet/serving gateway116and network nodes120to the deployable subscription bootstrapping service108. In other embodiments, the deployable subscription bootstrapping client128communicates over the auxiliary communication link126, and through auxiliary network104, the network firewall106, and network node120to the deployable subscription bootstrapping service108. As would be known to one skilled in the art, other communication paths between the deployable subscription bootstrapping client128and the deployable subscription bootstrapping service108are possible. In some embodiments, the deployable subscription bootstrapping client128is a software application (an “app”) stored in the memory of wireless device122, and executed on the processor of the wireless device122. In other embodiments, the deployable subscription bootstrapping client128is built into the operating system of the wireless device122. The deployable subscription bootstrapping client128interacts with and controls aspects of the operating system and the network stack of the wireless device122to facilitate connection of the wireless device122to either the auxiliary network104or the deployable wireless communications network100. The deployable subscription bootstrapping client128is capable of accessing and modifying data on the non-volatile memory of the wireless device122to, among other things, store and retrieve a subscription profile.

The subscription profile includes credentials, parameters, and settings that the wireless device122uses to establish a connection with the deployable wireless communications network100and the services provided by the applications114a,114n. For example, the subscription profile may include a shared symmetric key unique to the wireless device122and the deployable wireless communications network100, a public land mobile network identification (PLMN) ID, an access point name (APN), an international subscriber module identity (IMSI), a shared symmetric key, and operator authentication keys (OPc). The subscriber profile may also include temporary user certificates or temporary identity tokens that allow the wireless device122to access the services provided by the applications114a,114n.

The auxiliary network104may be a wireless or wired network. In some cases, the auxiliary network104may be a wide-area network that conforms to the LTE specification. In other cases, a local-area network is implemented in accordance with a Wi-Fi, Bluetooth, or other near-field communication specification or protocol. Wired connections may be implemented using, for example, an Ethernet or universal serial bus (USB) connection. The auxiliary network104allows wireless devices122to establish a temporary, isolated connection to portions of the deployable wireless communications network100. As noted herein, the deployable subscription bootstrapping client128can utilize this temporary connection to register with the deployable wireless communications network100and to send and receive security credentials and subscription information.

In the illustrated embodiment, the network firewall106controls (allow, reject, or restrict) data communications between the wireless device122and parts of the deployable wireless communications network100over the auxiliary network104. In one embodiment, the network firewall106is configured to prevent the wireless device122from accessing any part of the deployable wireless communications network100other than the deployable subscription bootstrapping service108over the auxiliary network104. The network firewall106may be implemented as a stand-alone device, or as part of one of the other components of the deployable wireless communications network100.

In some embodiments, access to the auxiliary network104is physically secured, and no authentication is necessary to establish the auxiliary communication link126. For example, access to the auxiliary network104may be physically secured, for example, by being located within a security perimeter, or within a lockable structure, cabinet, or vehicle. In some embodiments, physical security also includes radio frequency isolation of the auxiliary network104. In other embodiments, access to the auxiliary network104is electronically secured using Wi-Fi protected setup (WPS), passphrase authentication (e.g., Wi-Fi protected access (WPA)), or digital certificate-based authentication (e.g., extensible authentication protocol (EAP)). In some embodiments, the auxiliary network104is an open LTE network having a network identifier distinct from the network identifier for the deployable wireless communications network100. In some embodiments, access to the auxiliary network104is both physically and electronically secured.

In the embodiment illustrated inFIG. 1, the deployable authentication database110is a deployable home subscriber server (HSS). The database110stores subscription profiles and performs authentication functions for the deployable wireless communications network100.

The deployable subscription bootstrapping service108communicates with the database110and the deployable subscription bootstrapping client128on the wireless device122. In some embodiments, communication between the deployable subscription bootstrapping service108and the deployable subscription bootstrapping client128is established without authentication. In other embodiments, communication between the deployable subscription bootstrapping service108and the deployable subscription bootstrapping client128is authenticated by providing a security credential, for example a digital certificate issued by a trusted certificate authority of the wireless device122that is accepted by the deployable subscription bootstrapping service108. The security credential may also be a passphrase, or an identity token (ID), e.g., a security assertion markup language (SAML) token, or an open authorization token (OAuth token), provided by a trusted authority. In some embodiments, the identity token contains attributes that determine what services or applications (present on the deployable wireless communications network100) can be accessed by the wireless device122. The ID token's attributes also provide other information to be included in the subscription profile for the wireless device122. In other embodiments, the deployable subscription bootstrapping client128establishes a security association tunnel (SA tunnel) and communicates with the deployable subscription bootstrapping service108over the SA tunnel. In some embodiments, the SA tunnel is established with the deployable subscription bootstrapping service108. In other embodiments, the SA tunnel is established with a virtual private network server (VPN server) positioned between the auxiliary network104and the deployable subscription bootstrapping service108.

The deployable subscription bootstrapping service108is configured to generate a temporary network subscription profile for one or more wireless devices122. The deployable subscription bootstrapping service108communicates as least a portion of the generated subscription profile to the deployable subscription bootstrapping client128over the auxiliary network104, and stores the subscription profile in the database110. In some embodiments, the deployable subscription bootstrapping client128stores the network profile in a non-volatile memory, for example a universal integrated circuit card (UICC). The temporary subscription profile is used by the deployable wireless communications network100and the wireless device122to establish the wireless communication link124between the wireless device122and the base station118.

The shared symmetric key and the subscription profile that includes the shared symmetric key are temporary in nature. In some embodiments, the temporary subscription profile may expire after a predetermined period of time (e.g., 24 or 48 hours), or after the wireless device122disconnects from the deployable wireless communications network100, as set by the operators of the deployable wireless communications network100. In other embodiments, the user of the wireless device122can signal the deployable subscription bootstrapping client128to manually disconnect from the deployable wireless communications network100, which will trigger the expiration of the temporary subscription profile. In other embodiments, the operators of the deployable wireless communications network100can terminate the subscription profile for one or more wireless devices122manually at any time. In other embodiments, the deployable wireless communications network100may require the wireless device to take action to renew or extend its temporary subscription profile by, for example, confirming its use of the deployable wireless communications network100.

In some embodiments, the deployable subscription bootstrapping service108is also removes a subscription profile from the database110when the profile expires, upon receiving a command from the administrator of the deployable wireless communications network100, or upon receiving a command from the deployable subscription bootstrapping client128. The deployable subscription bootstrapping client128, in turn, deletes the subscription profile from the wireless device122when the subscription profile expires, upon receiving a command from the deployable subscription bootstrapping service108, or upon receiving a command from the device user to disconnect.

FIG. 2illustrates a method200for bootstrapping secure connections between a wireless device122and a deployable wireless communications network100. For purposes of description, the embodiment of the deployable wireless communications network100used with method200is a long term evolution (LTE) network. However, the concepts and techniques embodied in the method described may be implemented with networks using other protocols, for example 2G, 3G, 4G, and future network architectures, which rely on shared symmetric key authentication mechanisms (e.g., 5G). Using method200, a public safety user is able to connect an LTE wireless device122, for example a smartphone, to an LTE deployable wireless communications network100in a location where the LTE deployable wireless communications network100is unable to communicate with the home subscriber server associated with the LTE wireless device122.

To initiate the connection with the deployable wireless communications network100, the wireless device122establishes a connection over the auxiliary communication link126to the auxiliary network104in block201. As noted above, access to the auxiliary network104can be unsecured, physically secured, electronically secured, or both physically and electronically secured. The network firewall106is configured such that the only communication possible over the auxiliary communication link126is between the wireless device122and the deployable subscription bootstrapping service108. Wireless device122is not able to communicate with other parts of the deployable wireless communications network100, or with other devices attached to the auxiliary network104.

In block203, the deployable subscription bootstrapping client128is launched on the wireless device122. In some embodiments, the deployable subscription bootstrapping client128may establish the auxiliary communication link126to the auxiliary network104after it is launched.

In block205, the deployable subscription bootstrapping client128discovers the deployable subscription bootstrapping service108over the auxiliary network104using simple service discovery protocol (SSDP) or another suitable network protocol. After the deployable subscription bootstrapping client128has discovered the presence of the deployable subscription bootstrapping service108, the deployable subscription bootstrapping client128establishes a connection with the deployable subscription bootstrapping service108in block207. In some embodiments, this connection is unsecured. In other embodiments, the deployable subscription bootstrapping client128establishes an authenticated connection, or connects over a security association (SA) tunnel. In block209, the deployable subscription bootstrapping service108and the deployable subscription bootstrapping client128agree on a temporary shared symmetric key, the deployable subscription bootstrapping service108creates a temporary shared subscription profile (e.g., an LTE subscription profile) containing the temporary shared symmetric key, and the deployable subscription bootstrapping service108communicates the subscription profile to the deployable subscription bootstrapping client128. The shared symmetric key is unique to the wireless device122and the deployable wireless communications network100. The subscription profile additionally contains the parameters and settings that the wireless device122may use to establish a connection with the communications network100(e.g., the public land mobile network identification (PLMN) ID, the access point name (APN), and other network parameters. In addition, in block209, the deployable subscription bootstrapping service108automatically provisions services, on the deployable wireless communications network100, for the newly-created subscription profile. Such services may include internet protocol (IP) multimedia subsystem (IMS), voice over IP (VoIP), push-to-talk, location, presence, or other services.

In embodiments where the connection to the deployable subscription bootstrapping service108is authenticated, the deployable subscription bootstrapping service108may generate a temporary subscription profile with settings specific to the wireless device122, based on the attributes of the security credential or ID token provided to the deployable subscription bootstrapping service108by the wireless device122. In embodiments where the connection to the deployable subscription bootstrapping service108is unauthenticated, the deployable subscription bootstrapping service108may generate a temporary subscription profile with default settings, which may be more limited in duration or scope.

In block211, the deployable subscription bootstrapping service108writes the temporary subscription profile to the deployable authentication database110. In block213, the deployable subscription bootstrapping client128stores the temporary subscription profile on the wireless device122in a non-volatile memory, and configures the settings of the wireless device122to enable connection to the network and applications114a,114n, as specified in the temporary subscription profile. In block215, the deployable subscription bootstrapping client128causes the wireless device122to disconnect from the auxiliary network104.

In block217, the deployable subscription bootstrapping client128causes the wireless device122to establish a wireless connection to the deployable wireless communications network100. The wireless device122initiates authentication with the deployable wireless communications network100using the authentication data from the temporary subscription profile stored in block213. The authentication data includes data used to enable the wireless device to authenticate itself to the mobility management entity112of the deployable wireless communications network100, including the temporary shared symmetric key generated in block209. In block221, the deployable authentication database110generates authentication vectors for the wireless device122using the authentication and key agreement (AKA) algorithm. In block223, the mobility management entity112challenges the wireless device122with the vectors. The wireless device122runs the AKA algorithm, and returns a response, based on the temporary shared symmetric key, to the mobile management entity112in block225. The wireless device122then establishes a security association (SA) with the base station118and the mobile management entity112in block227. In block229, the wireless device122attaches to the access point of the deployable wireless communications network100, and is connected to the packet/serving gateway116. At this point, the LTE wireless device122can use the deployable wireless communications network100as it would normally use an LTE network, and access the services provided by the applications114a,114n, based on the temporary subscription profile for the wireless device122. Services, other than access to the LTE network, for example, VoIP, IMS, push to talk, location, and presence, may utilize information provided during the subscription bootstrapping process to enable clients on the wireless device122to connect with their respective services within the deployable wireless communications network100.

As noted above, the subscription profile is temporary. At block231, the deployable subscription bootstrapping client128determines whether the wireless device122will continue to access the deployable wireless communications network100. In block233, unless it has been determined otherwise, the wireless device122maintains the connection and continues to use the deployable wireless communications network100as usual. However, if an indication (e.g., the time period expires, the device disconnects, the user issues a command, the deployable subscription bootstrapping client128receives a disconnect command from the deployable subscription bootstrapping service108, and the like) triggers the determination that access is no longer needed, the deployable subscription bootstrapping client128will delete the authentication profile and restore the previous network settings for the wireless device122in block235. The deployable subscription bootstrapping client128transmits a notification of the deletion to the deployable subscription bootstrapping service108in block237. In block239, the deployable subscription bootstrapping client128causes the wireless device122to disconnect from the deployable wireless communications network100. In block241, the deployable subscription bootstrapping service108deletes the temporary subscription profile for the wireless device122from the deployable authentication database110.

In some embodiments, when a disconnected wireless device122needs to reconnect to the deployable wireless communications network100, it begins the process again at block201. In other embodiments, the subscription profile is not deleted, and the wireless device122reconnects to the deployable wireless communications network100beginning with block217.

In some embodiments, an authenticated wireless device122may be allowed to act as a proxy to allow access to the deployable subscription bootstrapping service108from a second wireless device130, which is not in range of the auxiliary network104. In some embodiments, the deployable subscription bootstrapping client128on the authenticated wireless device122receives security credentials in its subscription profile that it can use to establish a secure tunnel (e.g., a security association tunnel) to the deployable subscription bootstrapping service108over the deployable wireless communications network100. In some embodiments, the deployable subscription bootstrapping client128on the authenticated wireless device122may use a communications module in the authenticated wireless device122to create an access point for a secondary auxiliary network132, which is connected to the secure tunnel to extend the auxiliary network104via the secondary auxiliary network132. Similar to firewall106, the wireless device122is configurable to only allow communications between the secondary auxiliary network132and the secure tunnel to the deployable subscription bootstrapping service108. In one exemplary embodiment, an authenticated wireless device may activate its Wi-Fi hotspot to provide a secondary auxiliary network132. A deployable subscription bootstrapping client136on the second, unauthenticated wireless device130can then establish a wireless connection134to the secondary auxiliary network132, and then execute the method200beginning with block205by discovering the deployable subscription bootstrapping service108.