Handling of integrity check failure in a wireless communication system

Handling of integrity check failure in a wireless communication system can safely send the mobile station to the idle mode upon detection of security failure. Alternatively or in addition, attempts to recover from the security failure situation can be enabled without forcing the mobile station to enter idle mode. The mobile station autonomously transitions to idle mode when the integrity check failure is detected a certain threshold number ‘X’ times during a specified period ‘Y’. Whereupon, the mobile station initiates the Radio Resource Control (RRC) connection re-establishment procedure after integrity check failure is detected. In the RRC connection re-establishment procedure, the security parameters are re-initialized to provide a possibility to recover from the failure situation.

BACKGROUND

The present disclosure relates generally to communication, and more specifically to techniques for transmitting information in a wireless communication network.

The third generation (3 G) mobile communications system has adopted a Wideband Code Division Multiple Access (WCDMA) wireless air interface access method for a cellular network. WCDMA can provide high frequency spectrum utilization, universal coverage, and high quality, high speed multimedia data transmission. The WCDMA method also meets all kinds of Quality of Service (QoS) requirements simultaneously, providing diverse flexible two-way transmission services and better communication quality to reduce transmission interruption rates.

In order to protect user data and signaling information from being intercepted by unauthorized devices, the prior art 3 G mobile communications system can trigger Integrity Protection and Ciphering. Integrity protection is utilized for protecting Radio Resource Control (RRC) messages transmitted on Signaling Radio Bearers (SRBs), while Ciphering is utilized for protecting Radio Link Control Protocol Data Units (RLC PDU) transmitted on Dedicated Channels.

Radio Bearers (RBs) are “logical” data communication exchange channels, and are utilized for providing data transmission exchange to the user or for providing RRC layer control signal transmission exchange. SRBs are the RBs specifically used for transmitting RRC messages, and utilized for completing various RRC control processes, such as RRC Connection Management Procedures, RB Control Procedures, RRC Connection Mobility Procedures, and Measurement Procedures. Therefore, the messages sent on SRB are sporadic.

Moreover, take an RRC communications protocol specification established by the 3 GPP for example, after the integrity protection procedure is activated, every time the User Equipment (UE) or the network transmits signaling message, the UE or the network will add a Message Authentication Code for data Integrity (MAC-I), whose content is different for each signaling message. A legal UE or network can authenticate the accuracy of the MAC-I, and thereby accept the received signaling message when the expected MAC-I and the received MAC-I are the same or act as if the message was not received when the calculated expected MAC-I and the received MAC-I differ, i.e. when the integrity protection check fails.

Even between legal UE and network, occasionally or perhaps as a rare event, the received MAC-I does not match the calculated (expected) MAC-I. For example, false detection of a successful cyclic redundancy check (CRC) in the physical layer occurs. As another example, de-synchronization of input parameter(s) to the algorithm (e.g. COUNT, IK) between network and UE can occur.

SUMMARY

The following presents a simplified summary in order to provide a basic understanding of some aspects of the disclosed aspects. This summary is not an extensive overview and is intended to neither identify key or critical elements nor delineate the scope of such aspects. Its purpose is to present some concepts of the described features in a simplified form as a prelude to the more detailed description that is presented later.

In accordance with one or more aspects and corresponding disclosure thereof, various aspects are described in connection with recognizing that in UMTS Terrestrial Radio Access (UTRA) RRC, it is specified that the UE shall ignore the message for which integrity protection check has been failed. This seems to suggest that the UTRA specification relies on the network implementation to take an appropriate action when a security problem is detected. The most likely network behavior in this case is to release the RRC connection. In case of security failure, it is appropriate to use Radio Resource Control (RRC) CONNECTION RELEASE on Common Control Channel (CCCH) message without integrity protection so that the message will not be discarded by the UE due to integrity protection check failure. However, this tool is not available in E-UTRA (Evolved UMTS Terrestrial Radio Access) (i.e., RRC Connection Release is always integrity protected and sent on Dedicated Control Channel (DCCH)). It is advantageous to provide an innovation wherein the network can recover from security failure for the robustness of the protocol, even thought the occurrence of such an event is very rare. Moreover, the network may not detect the problem on the uplink with the UE delaying the recovery.

In one aspect, a method is provided for handling protocol errors in a wireless communications system by employing a processor executing computer executable instructions stored on a computer readable storage medium to implement the following acts: A first signaling radio bearer is established and an integrity protection procedure is triggered for the first signaling radio bearer. A first message is received on the first signaling radio bearer. An integrity protection failure message is transmitted in response to an integrity protection check failure for the first message Transitioning to an idle mode occurs in response to frequent integrity protection check failure for received messages on the first signaling radio bearer.

In another aspect, a method is provided for handling protocol errors in a wireless communications system by employing a processor executing computer executable instructions stored on a computer readable storage medium to implement the following acts: A first signaling radio bearer is established and an integrity protection procedure of the first signaling radio bearer is triggered. A first message is received on the first signaling radio bearer. A connection re-establishment request is transmitted in response to an integrity protection check failure for the first message. Recovering from security failure occurs in response to receiving a connection re-establishment message. Transitioning to an idle mode occurs in response to receiving a connection re-establishment reject message not subject to the integrity protection procedure.

In an additional aspect, an apparatus is provided for handling protocol errors in a wireless communications system comprising at least one computer readable storage medium storing computer executable instructions that, when executed by at least one processor, implement components. In particular, means are provided for establishing a first signaling radio bearer and triggering an integrity protection procedure of the first signaling radio bearer. Means are provided for receiving a first message on the first signaling radio bearer. Means are provided for transmitting an integrity protection failure message in response to an integrity protection check failure for the first message. Means are provided for transitioning to an idle mode in response to frequent integrity protection check failure for received messages on the first signaling radio bearer.

In another additional aspect, an apparatus is provided for handling protocol errors in a wireless communications system comprising at least one computer readable storage medium storing computer executable instructions that, when executed by at least one processor, implement components. In particular, means are provided for establishing a first signaling radio bearer and triggering an integrity protection procedure of the first signaling radio bearer. Means are provided for receiving a first message on the first signaling radio bearer. Means are provided for transmitting a connection re-establishment request in response to an integrity protection check failure for the first message. Means are provided for recovering from security failure in response to receiving a connection re-establishment message. Means are provided for transitioning to an idle mode in response to receiving a connection re-establishment reject message not subject to the integrity protection procedure.

In a further aspect, an apparatus is provided for handling protocol errors in a wireless communications system comprising a processor operatively coupled to a computer readable medium having stored thereon the following computer executable components. In particular, a computing platform is provided for establishing a first signaling radio bearer and triggering an integrity protection procedure of the first signaling radio bearer. A receiver is for receiving a first message on the first signaling radio bearer. A transmitter is for transmitting an integrity protection failure message in response to an integrity protection check failure for the first message. The computing platform is further for transitioning to an idle mode in response to frequent integrity protection check failure for received messages on the first signaling radio bearer.

In another further aspect, an apparatus is provided for handling protocol errors in a wireless communications system comprising a processor operatively coupled to a computer readable medium having stored thereon the following computer executable components. In particular, a computing platform is for establishing a first signaling radio bearer and triggering an integrity protection procedure of the first signaling radio bearer. A receiver is for receiving a first message on the first signaling radio bearer. A transmitter is for transmitting a connection re-establishment request in response to an integrity protection check failure for the first message. The computing platform is further for recovering from security failure in response to receiving a connection re-establishment message; and for transitioning to an idle mode in response to receiving a connection re-establishment reject message not subject to the integrity protection procedure.

In yet one aspect, a method is provided for handling protocol errors in a wireless communications system by employing a processor executing computer executable instructions stored on a computer readable storage medium to implement the following acts. A first signaling radio bearer is established as a forward channel. A first message is transmitted on the first signaling radio bearer including integrity protection authentication. An integrity protection failure message is received in response to an integrity protection check failure for the first message. Resources are released for user equipment determined to be transitioning to an idle mode in response to frequent integrity protection check failure for received messages on the first signaling radio bearer.

In yet another aspect, a method is provided for handling protocol errors in a wireless communications system by employing a processor executing computer executable instructions stored on a computer readable storage medium to implement the following acts. In particular, a first signaling radio bearer is established and an integrity protection procedure of the first signaling radio bearer is triggered. A first message is transmitted on the first signaling radio bearer including integrity protection authentication. A connection re-establishment request is received. A connection re-establishment message is transmitted for enabling user equipment to recover from security failure in response to determining a valid connection re-establishment request. A connection re-establishment reject message not subject to the integrity protection procedure is transmitted to prompt user equipment to transition to an idle mode in response to determining an invalid connection re-establishment request.

In yet an additional aspect, an apparatus is provided for handling protocol errors in a wireless communications system comprising at least one computer readable storage medium storing computer executable instructions that, when executed by at least one processor, implement components. In particular, means are provided for establishing a first signaling radio bearer as a forward channel. Means are provided for transmitting a first message on the first signaling radio bearer including integrity protection authentication. Means are provided for receiving an integrity protection failure message in response to an integrity protection check failure for the first message. Means are provided for releasing resources for user equipment determined to be transitioning to an idle mode in response to frequent integrity protection check failure for received messages on the first signaling radio bearer.

In yet another additional aspect, an apparatus is provided for handling protocol errors in a wireless communications system comprising at least one computer readable storage medium storing computer executable instructions that, when executed by at least one processor, implement components. In particular, means are provided for establishing a first signaling radio bearer and triggering an integrity protection procedure of the first signaling radio bearer. Means are provided for transmitting a first message on the first signaling radio bearer including integrity protection authentication. Means are provided for receiving a connection re-establishment request. Means are provided for transmitting a connection re-establishment message for enabling user equipment to recover from security failure in response to determining a valid connection re-establishment request. Means are provided for transmitting a connection re-establishment reject message not subject to the integrity protection procedure to prompt user equipment to transition to an idle mode in response to determining an invalid connection re-establishment request.

In yet a further aspect, an apparatus is provided for handling protocol errors in a wireless communications system comprising a processor operatively coupled to a computer readable medium having stored thereon the following computer executable components. In particular, a computing platform is for establishing a first signaling radio bearer as a forward channel. A transmitter is for transmitting a first message on the first signaling radio bearer including integrity protection authentication. A receiver is for receiving an integrity protection failure message in response to an integrity protection check failure for the first message. The computing platform is further for releasing resources for user equipment determined to be transitioning to an idle mode in response to frequent integrity protection check failure for received messages on the first signaling radio bearer.

In yet another further aspect, an apparatus is provided for handling protocol errors in a wireless communications system comprising a processor operatively coupled to a computer readable medium having stored thereon the following computer executable components. A computing platform is for establishing a first signaling radio bearer and triggering an integrity protection procedure of the first signaling radio bearer. A transmitter is for transmitting a first message on the first signaling radio bearer including integrity protection authentication. A receiver is for receiving a connection re-establishment request. The transmitter is further for transmitting a connection re-establishment message for enabling user equipment to recover from security failure in response to the computing platform determining a valid connection re-establishment request. The transmitter is further for transmitting a connection re-establishment reject message not subject to the integrity protection procedure to prompt user equipment to transition to an idle mode in response to the computing platform determining an invalid connection re-establishment request.

In another additional aspect, a computer program product is provided for handling protocol errors in a wireless communications system. At least one computer readable storage medium stores computer executable instructions that when executed by at least one processor implement components: A set of instructions causes a computer to establish a first signaling radio bearer and triggering an integrity protection procedure of the first signaling radio bearer. A set of instructions causes the computer to receive a first message on the first signaling radio bearer. A set of instructions causes the computer to transmit an integrity protection check failure message in response to an integrity protection check failure for the first message. A set of instructions causes the computer to transition to an idle mode in response to frequent integrity protection check failure for received messages on the first signaling radio bearer.

In yet another additional aspect, a computer program product is provided for handling protocol errors in a wireless communications system. At least one computer readable storage medium stores computer executable instructions that when executed by at least one processor implement components. A set of instructions causes a computer to establish a first signaling radio bearer as a forward channel. A set of instructions causes the computer to transmit a first message on the first signaling radio bearer including integrity protection authentication. A set of instructions causes the computer to receive an integrity protection failure message in response to an integrity protection check failure for the first message. A set of instructions causes the computer to release resources for user equipment determined to be transitioning to an idle mode in response to frequent integrity protection check failure for received messages on the first signaling radio bearer.

To the accomplishment of the foregoing and related ends, one or more aspects comprise the features hereinafter fully described and particularly pointed out in the claims. The following description and the annexed drawings set forth in detail certain illustrative aspects and are indicative of but a few of the various ways in which the principles of the aspects may be employed. Other advantages and novel features will become apparent from the following detailed description when considered in conjunction with the drawings and the disclosed aspects are intended to include all such aspects and their equivalents.

DETAILED DESCRIPTION

Handling of integrity check failure in a wireless communication system can safely send the mobile station to the idle mode upon detection of security failure. Alternatively or in addition, attempts to recover from the security failure situation can be enabled without forcing the mobile station to enter idle mode. The mobile station autonomously transitions to idle mode when the integrity check failure is detected at a certain threshold number ‘X’ times during a specified period ‘Y’. Whereupon, the mobile station initiates the Radio Resource Control (RRC) connection re-establishment procedure after integrity check failure is detected. In the RRC connection re-establishment procedure, the security parameters are re-initialized to provide a possibility to recover from the failure situation.

With reference toFIG. 1, a communication system100is depicted as a wireless network wherein a node (e.g., macro base station, femto cell, pico cell, etc.)102schedules user equipment (UE)104to receive a downlink (DL)106and to transmit on an uplink (UL)108. To prevent unauthorized use, the node102has an original authentication code110that is provided to the UE104as depicted at111to ensure integrity protection for the system100. In an illustrative implementation, the node102generates a repeating sequence of authentication codes for each message112based upon a Message Authentication Code for data Integrity (MAC-I).

It should be appreciated that the node102handles an integrity protection check failure on the uplink108; however, instances can occur that result in an integrity protection check failure114on the downlink106. False detection of a successful cyclic redundancy check (CRC) in the physical layer by the UE104depicted at116, is a rare occurrence. Advantageously, the UE104transmits an integrity protection check failure message118that is coded with the integrity protection authentication code (e.g., MAC-I). At this point, the node102can have a component that detects an UL integrity protection check failure as depicted at120. Alternatively, the node102can detect this integrity protection check failure on the uplink108in another type of transmission. The node102can respond with a connection release message122that is not sent on signaling radio bearer that is subject to integrity protection checking. Thus, even with an error in the integrity protection checking at the UE104, the UE104receives and acts upon this connection release message122, unlike a message with a MAC-I whose content would be ignored if the integrity protection checking failed. Thus, the UE104transitions to idle mode as depicted at124. Advantageously, the UE104utilizes an integrity protection check failure frequency tracking component127that determines that the number in a row or as a function of time of integrity protection check failures warrants transitioning to idle mode124. Thus, a rare instance of a false detection of a successful CRC can be overcome.

Alternatively or in addition, the UE104can detect or become subject to an unsynchronized integrity protection component126. Thus, while the original authentication code111is valid, the sequence of calculated MAC-I for each message yields an integrity protection check failure. The UE104transmits a connection re-establishment request including a MAC-I as depicted at128, seeking to recover from the lack of synchronization. The node102utilizing the MAC-I validity checking component130to determine that the original authentication code111being used by the UE104is valid or not. If so, a re-establishment message132transmitted on the downlink106allows the UE104to recover its integrity protection synchronization, as depicted at134. If the MAC-I is invalid, then the node102can continue to send connection release messages122as necessary to force the UE104to transition to the idle mode124.

With the benefit of the foregoing, the node102is able to anticipate when the UE104is going to transition to idle mode124due to integrity protection check failures on the downlink106, and thus release resources as depicted at136. Alternatively or in addition, the node102is capable of prompting the UE104to transition to the idle mode124when integrity protection check failure is detected on the uplink108.

InFIG. 2, a methodology or sequence of operations200is provided for handling of protocol errors on a downlink. The base node transmits and UE receives on the downlink data with an authentication code (e.g., MAC-I) (block202). The UE finds integrity protection check failure for the data (block204). The UE transmits on the uplink information to the base node indicative of the integrity protection check failure on the downlink (block206). For instance, the UE sends an integrity protection check failure message (block208). Alternatively, the UE sends a connection re-establishment request (block210). In one situation, the base node knows based upon receipt of this information that the UE will go idle, such as after a certain number of such reports indicative of frequent integrity protection check failures on the downlink. Thus, the base node can release resources (block212). Alternatively, the base node can determine that the UE has a valid original authentication code (MAC-I) and could recover, thus approves or initiates re-establishment (block214). In some instances, the base node is first to detect an integrity protection check failure (block216) and can take advantage of a disconnect message sent on the downlink that does not utilize a signaling radio bearer subject to integrity protection (block218). Thus, the UE will act upon the content of this disconnect message.

InFIG. 3, a methodology or sequence of operations300is depicted for Radio Resource Control (RRC) connection release on Common Control Channel (CCCH) wherein UE302autonomously enters idle mode with respect to serving evolved Base node (eNode-B)304. An RRC message with authentication code is sent on the downlink from the eNB304to the UE302as depicted at310. The UE302determines that the integrity protection check has failed (block312). The UE302responds as depicted at314by transmitting an RRC Failure (i.e., integrity protection failure) message. This downlink centralized method relies upon the UE302detecting integrity protection check failure and entering idle mode autonomously after a certain criterion is met. In this solution, the UE tries to send a RRC failure message to the network to inform the occurrence of the integrity protection check failure as depicted at314.

In one aspect, it would be sensible here to provide a means to prevent the UE from going to idle mode only after a single detection of integrity protection check failure because the integrity protection check failure can happen with the false detection of CRC. This can be solved by having a criterion that the UE only enters idle mode after detecting frequent integrity protection check failure, depicted as “X time(s) within Y” at316. For clarity, one additional iteration is depicted with the eNB304responding at318with the RRC message with MAC-I on the downlink, which results in another integrity protection check failure (block320). When the criterion is satisfied, the UE302transitions to idle mode (block322). Since this process is determinative with the eNB304kept informed, the eNB304is able to anticipate the UE idle status and release resources.

Alternatively the criterion can be such that the UE302enters idle mode after consecutive value “X” integrity protection check failure detections, which can be for a specified period “Y”. It should be appreciated that this consecutive value “X” could be 1 and period “Y” could be the entire duration of the RRC connection such that the depicted “X times within Y” can encompass a wide range of desired settings.

InFIG. 4, it should be noted that this mechanism automatically brings about the ability for the network (e.g., eNB304) to release the RRC connection in case of integrity protection check failure in the uplink in a methodology or sequence of operations340. An UE302transmits RRC message with authentication code as depicted at350on the uplink. Upon failure detection in an uplink (block352), the network can send one or more instances of RRC Connection Release message depicted at354,356. The UE302will enter idle mode regardless of whether or not the integrity protection check in the downlink fails. This is depicted as each connection release message354,356forcing a corresponding integrity protection check failure (blocks358,360) that is sufficient to satisfy criterion “X times within Y”362. Then the UE302transitions to idle mode (block364).

InFIG. 5, a methodology or sequence of operations400provides RRC connection re-establishment for recovering in certain instances when security failure occurs for integrity protection on the downlink between UE402and eNB404. This solution is to try to possibly recover from the security failure situation by relying on the COUNT value reset and KeNB (i.e. security key) change taking place at the RRC connection re-establishment procedure. Additionally this solution takes the advantage of the RRC Connection Re-establishment Reject message being transmitted on CCCH which is not integrity protected.

The UE402determines an integrity protection check failure on the downlink (block410) and transmits an RRC connection re-establishment request on the uplink (block412). The eNB404determines that the request is sent with a valid MAC-I (block414) and responds by transmits RRC Connection Re-establishment message (block416). The UE402responds with an RRC Connection Re-establishment Complete message sent with a MAC-I418. The eNB404confirms that the MAC-I is still valid (block420). Recovery from the security failure then occurs (block422). For instance, the cryptosynch is reset and a security key is re-derived during the procedure. InFIG. 5, a successful recovery case is depicted wherein the serving eNB404finds valid MAC-I for RRC Connection Re-establishment Request message412and valid MAC-I for RRC Connection Re-establishment Complete message418.

InFIG. 6, a methodology or sequence of operations440depicts a similar or identical implementation when the recovery is unsuccessful. An UE402determines an integrity protection check failure on the downlink (block450) and transmits an RRC connection re-establishment request on the uplink (block452). The eNB404determines that the request is sent with a valid MAC-I (block454) and responds by transmits RRC Connection Re-establishment message (block456). The UE402responds with an RRC Connection Re-establishment Complete message458. The eNB404finds that the MAC-I is invalid (block460). The eNB404transmits an RRC Connection Release message as depicted at462deemed by the UE402as integrity protection check failure (block464). When the UE402requests RRC Connection Re-establishment as depicted at466, the eNB404can respond with a rejection468and thus the UE402transitions to idle mode (block470).

Alternatively, the network could choose not to fix the security problem right after looking at the MAC-I in the RRC Connection Re-establishment Request message that could tell the integrity of the original key that the UE has been using. In one illustrative aspect inFIG. 7, a methodology or sequence of operations500between UE502and network depicted as eNB504begins with an RRC message on the uplink as depicted at510that is found by the eNB504to have an integrity protection check failure (block512). An RRC Connection Release is sent on the downlink as depicted at514. The subsequent integrity protection check failure (block516) at the UE502results in an RRC Connection Re-establishment request on the uplink518, which in this instance is detected as an invalid MAC-I (block520). This prompts the eNB504to send a rejection to the re-establishment request as depicted at522and the UE502transitions to idle mode (block524).

InFIG. 8, a similar situation for a methodology or sequence of operations540begins as depicted at550with an eNB504transmitting an RRC message on the downlink. An UE502detects an integrity protection check failure (block552). When an RRC Connection Re-establishment request is transmitted on the uplink as depicted at554, the eNB detects an invalid MAC-I (block556) and rejects re-establishment as depicted at558. The UE502then transitions to idle mode (block560).

FIG. 9shows a wireless communication network900, which may include a number of base stations910and other network entities. A base station may be a station that communicates with the terminals and may also be referred to as an access point, a Node B, an evolved Node B, etc. Each base station910may provide communication coverage for a particular geographic area. The term “cell” can refer to a coverage area of a base station and/or a base station subsystem serving this coverage area, depending on the context in which the term is used.

A base station may provide communication coverage for a macro cell, a pico cell, a femto cell, and/or other types of cell. A macro cell may cover a relatively large geographic area (e.g., several kilometers in radius) and may allow unrestricted access by terminals with service subscription. A pico cell may cover a relatively small geographic area and may allow unrestricted access by terminals with service subscription. A femto cell may cover a relatively small geographic area (e.g., a home) and may allow restricted access by terminals having association with the femto cell, e.g., terminals belonging to a closed subscriber group (CSG). The CSG may include terminals for users in a home, terminals for users subscribing to a special service plan, etc. A base station for a macro cell may be referred to as a macro base station. A base station for a pico cell may be referred to as a pico base station. A base station for a femto cell may be referred to as a femto base station or a home base station.

In the example shown inFIG. 9, base stations910a,910band910cmay be macro base stations for macro cells902a,902band902c, respectively. Base station910xmay be a pico base station for a pico cell902xcommunicating with terminal920x. Base station910ymay be a femto base station for a femto cell902ycommunicating with terminal920y. Although not shown inFIG. 9for simplicity, the macro cells may overlap at the edges. The pico and femto cells may be located within the macro cells (as shown inFIG. 9) or may overlap with macro cells and/or other cells.

Wireless network900may also include relay stations, e.g., a relay station910zthat communicates with terminal920z. A relay station is a station that receives a transmission of data and/or other information from an upstream station and sends a transmission of the data and/or other information to a downstream station. The upstream station may be a base station, another relay station, or a terminal. The downstream station may be a terminal, another relay station, or a base station. A relay station may also be a terminal that relays transmissions for other terminals. A relay station may transmit and/or receive low reuse preambles. For example, a relay station may transmit a low reuse preamble in similar manner as a pico base station and may receive low reuse preambles in similar manner as a terminal.

A network controller930may couple to a set of base stations and provide coordination and control for these base stations. Network controller930may be a single network entity or a collection of network entities. Network controller930may communicate with base stations910via a backhaul. Backhaul network communication934can facilitate point-to-point communication between base stations910a-910cemploying such a distributed architecture. Base stations910a-910cmay also communicate with one another, e.g., directly or indirectly via wireless or wireline backhaul.

Wireless network900may be a homogeneous network that includes only macro base stations (not shown inFIG. 9). Wireless network900may also be a heterogeneous network that includes base stations of different types, e.g., macro base stations, pico base stations, home base stations, relay stations, etc. These different types of base stations may have different transmit power levels, different coverage areas, and different impact on interference in wireless network900. For example, macro base stations may have a high transmit power level (e.g., 20 Watts) whereas pico and femto base stations may have a low transmit power level (e.g., 9 Watt). The techniques described herein may be used for homogeneous and heterogeneous networks.

Terminals920may be dispersed throughout wireless network900, and each terminal may be stationary or mobile. A terminal may also be referred to as an access terminal (AT), a mobile station (MS), user equipment (UE), a subscriber unit, a station, etc. A terminal may be a cellular phone, a personal digital assistant (PDA), a wireless modem, a wireless communication device, a handheld device, a laptop computer, a cordless phone, a wireless local loop (WLL) station, etc. A terminal may communicate with a base station via the downlink and uplink. The downlink (or forward link) refers to the communication link from the base station to the terminal, and the uplink (or reverse link) refers to the communication link from the terminal to the base station.

A terminal may be able to communicate with macro base stations, pico base stations, femto base stations, and/or other types of base stations. InFIG. 9, a solid line with double arrows indicates desired transmissions between a terminal and a serving base station, which is a base station designated to serve the terminal on the downlink and/or uplink. A dashed line with double arrows indicates interfering transmissions between a terminal and a base station. An interfering base station is a base station causing interference to a terminal on the downlink and/or observing interference from the terminal on the uplink.

Wireless network900may support synchronous or asynchronous operation. For synchronous operation, the base stations may have the same frame timing, and transmissions from different base stations may be aligned in time. For asynchronous operation, the base stations may have different frame timing, and transmissions from different base stations may not be aligned in time. Asynchronous operation may be more common for pico and femto base stations, which may be deployed indoors and may not have access to a synchronizing source such as Global Positioning System (GPS).

In one aspect, to improve system capacity, the coverage area902a,902b, or902ccorresponding to a respective base station910a-910ccan be partitioned into multiple smaller areas (e.g., areas904a,904b, and904c). Each of the smaller areas904a,904b, and904ccan be served by a respective base transceiver subsystem (BTS, not shown). As used herein and generally in the art, the term “sector” can refer to a BTS and/or its coverage area depending on the context in which the term is used. In one example, sectors904a,904b,904cin a cell902a,902b,902ccan be formed by groups of antennas (not shown) at base station910, where each group of antennas is responsible for communication with terminals920in a portion of the cell902a,902b, or902c. For example, a base station910serving cell902acan have a first antenna group corresponding to sector904a, a second antenna group corresponding to sector904b, and a third antenna group corresponding to sector904c. However, it should be appreciated that the various aspects disclosed herein can be used in a system having sectorized and/or unsectorized cells. Further, it should be appreciated that all suitable wireless communication networks having any number of sectorized and/or unsectorized cells are intended to fall within the scope of the hereto appended claims. For simplicity, the term “base station” as used herein can refer both to a station that serves a sector as well as a station that serves a cell. It should be appreciated that as used herein, a downlink sector in a disjoint link scenario is a neighbor sector. While the following description generally relates to a system in which each terminal communicates with one serving access point for simplicity, it should be appreciated that terminals can communicate with any number of serving access points.

Referring toFIG. 10, a multiple access wireless communication system according to one embodiment is illustrated. An access point (AP)1000includes multiple antenna groups, one including1004and1006, another including1008and1010, and an additional including1012and1014. InFIG. 10, only two antennas are shown for each antenna group, however, more or fewer antennas may be utilized for each antenna group. Access terminal (AT)1016is in communication with antennas1012and1014, where antennas1012and1014transmit information to access terminal1016over forward link1020and receive information from access terminal1016over reverse link1018. Access terminal1022is in communication with antennas1006and1008, where antennas1006and1008transmit information to access terminal1022over forward link1026and receive information from access terminal1022over reverse link1024. In a FDD system, communication links1018,1020,1024and1026may use different frequency for communication. For example, forward link1020may use a different frequency then that used by reverse link1018.

Each group of antennas and/or the area in which they are designed to communicate is often referred to as a sector of the access point. In the aspect, antenna groups each are designed to communicate to access terminals in a sector, of the areas covered by access point1000.

In communication over forward links1020and1026, the transmitting antennas of access point1000utilize beamforming in order to improve the signal-to-noise ratio of forward links for the different access terminals1016and1022. Also, an access point using beamforming to transmit to access terminals scattered randomly through its coverage causes less interference to access terminals in neighboring cells than an access point transmitting through a single antenna to all its access terminals.

An access point may be a fixed station used for communicating with the terminals and may also be referred to as an access point, a Node B, or some other terminology. An access terminal may also be called an access terminal, user equipment (UE), a wireless communication device, terminal, access terminal or some other terminology.

FIG. 11shows a block diagram of a design of communication system1100between a base station1102and a terminal1104, which may be one of the base stations and one of the terminals inFIG. 1. Base station1102may be equipped with TX antennas1134athrough1134t, and terminal1104may be equipped with RX antennas1152athrough1152r, where in general T≧1 and R≧1.

At base station1102, a transmit processor1120may receive traffic data from a data source1112and messages from a controller/processor1140. Transmit processor1120may process (e.g., encode, interleave, and modulate) the traffic data and messages and provide data symbols and control symbols, respectively. Transmit processor1120may also generate pilot symbols and data symbols for a low reuse preamble and pilot symbols for other pilots and/or reference signals. A transmit (TX) multiple-input multiple-output (MIMO) processor1130may perform spatial processing (e.g., precoding) on the data symbols, the control symbols, and/or the pilot symbols, if applicable, and may provide T output symbol streams to T modulators (MODs)1132athrough1132t. Each modulator1132may process a respective output symbol stream (e.g., for OFDM, SC-FDM, etc.) to obtain an output sample stream. Each modulator1132may further process (e.g., convert to analog, amplify, filter, and upconvert) the output sample stream to obtain a downlink signal. T downlink signals from modulators1132athrough1132tmay be transmitted via T antennas1134athrough1134t, respectively.

At terminal1104, antennas1152athrough1152rmay receive the downlink signals from base station1102and may provide received signals to demodulators (DEMODs)1154athrough1154r, respectively. Each demodulator1154may condition (e.g., filter, amplify, downconvert, and digitize) a respective received signal to obtain input samples. Each demodulator1154may further process the input samples (e.g., for OFDM, SC-FDM, etc.) to obtain received symbols. A MIMO detector1156may obtain received symbols from all R demodulators1154athrough1154r, perform MIMO detection on the received symbols if applicable, and provide detected symbols. A receive processor1158may process (e.g., demodulate, deinterleave, and decode) the detected symbols, provide decoded traffic data for terminal1104to a data sink1160, and provide decoded messages to a controller/processor1180. A low reuse preamble (LRP) processor1184may detect for low reuse preambles from base stations and provide information for detected base stations or cells to controller/processor1180.

On the uplink, at terminal1104, a transmit processor1164may receive and process traffic data from a data source1162and messages from controller/processor1180. The symbols from transmit processor1164may be precoded by a TX MIMO processor1168if applicable, further processed by modulators1154athrough1154r, and transmitted to base station1102. At base station1102, the uplink signals from terminal1104may be received by antennas1134, processed by demodulators1132, detected by a MIMO detector1136if applicable, and further processed by a receive data processor1138to obtain the decoded packets and messages transmitted by terminal1104for providing to a data sink1139.

Controllers/processors1140and1180may direct the operation at base station1102and terminal1104, respectively. Processor1140and/or other processors and modules at base station1102may perform or direct processes for the techniques described herein. Processor1184and/or other processors and modules at terminal1104may perform or direct processes for the techniques described herein. Memories1142and1182may store data and program codes for base station1102and terminal1104, respectively. A scheduler1144may schedule terminals for data transmission on the downlink and/or uplink and may provide resource grants for the scheduled terminals.

With reference toFIG. 12, illustrated is a system1200for handling protocol errors in a wireless communications system. For example, system1200can reside at least partially within user equipment (UE). It is to be appreciated that system1200is represented as including functional blocks, which can be functional blocks that represent functions implemented by a computing platform, processor, software, or combination thereof (e.g., firmware). System1200includes a logical grouping1202of electrical components that can act in conjunction. For instance, logical grouping1202can include an electrical component for establishing a first signaling radio bearer and triggering an integrity protection procedure of the first signaling radio bearer1204. Moreover, logical grouping1202can include an electrical component for receiving a first message on the first signaling radio bearer1206. Further, logical grouping1202can include an electrical component for transmitting an IP failure message in response to an IP check failure for the first message1208. Logical grouping1202can include an electrical component for transitioning to an idle mode in response to frequent IP check failure for received messages on the first signaling radio bearer1210. Logical grouping1202can include an electrical component for recovering from security failure in response to receiving a connection re-establishment message1212. Logical grouping1202can include an electrical component for transitioning to an idle mode in response to receiving a connection re-establishment reject message not subject to the integrity protection procedure1214. Additionally, system1200can include a memory1220that retains instructions for executing functions associated with electrical components1204-1214. While shown as being external to memory1220, it is to be understood that one or more of electrical components1204-1214can exist within memory1220.

With reference toFIG. 13, illustrated is a system1300for handling protocol errors in a wireless communication system. For example, system1300can reside at least partially within a base station. It is to be appreciated that system1300is represented as including functional blocks, which can be functional blocks that represent functions implemented by a computing platform, processor, software, or combination thereof (e.g., firmware). System1300includes a logical grouping1302of electrical components that can act in conjunction. For instance, logical grouping1302can include an electrical component for establishing a first signaling radio bearer as a forward channel1304. Moreover, logical grouping1302can include an electrical component for transmitting a first message on the first signaling radio bearer including integrity protection (IP) authentication1306. Further, logical grouping1302can include an electrical component for receiving an IP failure message in response to an IP check failure for the first message1308. Logical grouping1302can include an electrical component for releasing resources for user equipment determined to be transitioning to an idle mode in response to frequent IP check failure for received messages on the first signaling radio bearer1310. Logical grouping1302can include an electrical component for receiving a connection re-establishment request1312. Logical grouping1302can include an electrical component for transmitting a connection re-establishment message for enabling user equipment to recover from security failure in response to determining a valid connection re-establishment request1314. Logical grouping1302can include an electrical component for transmitting a connection re-establishment reject message not subject to the integrity protection procedure to prompt user equipment to transition to an idle mode in response to determining an invalid connection re-establishment request1316. Additionally, system1300can include a memory1320that retains instructions for executing functions associated with electrical components1304-1316. While shown as being external to memory1320, it is to be understood that one or more of electrical components1304-1316can exist within memory1320.

With reference toFIG. 14, illustrated is an apparatus1400for handling protocol errors in a wireless communications system. For example, apparatus1400can reside at least partially within user equipment (UE). Apparatus1400provides means for establishing a first signaling radio bearer and triggering an integrity protection procedure of the first signaling radio bearer1404. Moreover, apparatus1400provides means for receiving a first message on the first signaling radio bearer1406. Further, apparatus1400provides means for transmitting an IP failure message in response to an IP check failure for the first message1408. Apparatus1400provides means for transitioning to an idle mode in response to frequent IP check failure for received messages on the first signaling radio bearer1410. Apparatus1400provides means for recovering from security failure in response to receiving a connection re-establishment message1412. Apparatus1400provides means for transitioning to an idle mode in response to receiving a connection re-establishment reject message not subject to the integrity protection procedure1414.

With reference toFIG. 15, illustrated is an apparatus1500for handling protocol errors in a wireless communication system. For example, apparatus1500can reside at least partially within a base station. Apparatus1500provides means for establishing a first signaling radio bearer as a forward channel1504. Apparatus1500provides means for transmitting a first message on the first signaling radio bearer including integrity protection (IP) authentication1506. Apparatus1500provides means for receiving an IP failure message in response to an IP check failure for the first message1508. Apparatus1500provides means for releasing resources for user equipment determined to be transitioning to an idle mode in response to frequent IP check failure for received messages on the first signaling radio bearer1510. Apparatus1500provides means for receiving a connection re-establishment request1512. Apparatus1500provides means for transmitting a connection re-establishment message for enabling user equipment to recover from security failure in response to determining a valid connection re-establishment request1514. Apparatus1500provides means for transmitting a connection re-establishment reject message not subject to the integrity protection procedure to prompt user equipment to transition to an idle mode in response to determining an invalid connection re-establishment request1516.

Various aspects will be presented in terms of systems that may include a number of components, modules, and the like. It is to be understood and appreciated that the various systems may include additional components, modules, etc. and/or may not include all of the components, modules, etc. discussed in connection with the figures. A combination of these approaches may also be used. The various aspects disclosed herein can be performed on electrical devices including devices that utilize touch screen display technologies and/or mouse-and-keyboard type interfaces. Examples of such devices include computers (desktop and mobile), smart phones, personal digital assistants (PDAs), and other electronic devices both wired and wireless.

In view of the exemplary systems described supra, methodologies that may be implemented in accordance with the disclosed subject matter have been described with reference to several flow diagrams. While for purposes of simplicity of explanation, the methodologies are shown and described as a series of blocks, it is to be understood and appreciated that the claimed subject matter is not limited by the order of the blocks, as some blocks may occur in different orders and/or concurrently with other blocks from what is depicted and described herein. Moreover, not all illustrated blocks may be required to implement the methodologies described herein. Additionally, it should be further appreciated that the methodologies disclosed herein are capable of being stored on an article of manufacture to facilitate transporting and transferring such methodologies to computers. The term article of manufacture, as used herein, is intended to encompass a computer program accessible from any computer-readable device, carrier, or media.