Abstract:
A method and apparatus for implementing data security and automatic repeat request (ARQ) in a wireless communication system are disclosed. Cipher entities are included in a wireless transmit/receive unit (WTRU) and an access gateway (aGW), and outer ARQ, (or radio link control (RLC)), entities are included in the WTRU and an evolved Node-B (eNode-B). Each cipher entity is located on top of an outer ARQ entity. The cipher entities cipher and decipher a data block by using a generic sequence number (SN) assigned to the data block. The outer ARQ entities may segment the ciphered data block to multiple packet data units (PDUs), may concatenate multiple ciphered data blocks to a PDU, or may generate one PDU from one data block. The outer ARQ entities may segment or re-segment the PDU when a transmission failure occurs.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS  
       [0001]     This application claims the benefit of U.S. provisional application Nos. 60/753,077 filed Dec. 22, 2005 and 60/796,161 filed Apr. 29, 2006, which are incorporated by reference as if fully set forth. 
     
    
     FIELD OF INVENTION  
       [0002]     The present invention is related to wireless communication systems. More particularly, the present invention is related to a method and apparatus for data security and automatic repeat request (ARQ) implementation in a wireless communication system.  
       BACKGROUND  
       [0003]     The third generation partnership project (3GPP) has initiated a long term evolution (LTE) project to bring new technology, new network architecture and configuration, and new applications and services to a wireless cellular network in order to provide improved spectral efficiency, reduced latency, faster user experiences, and richer applications and services with less cost.  
         [0004]     In the wireless communication network, user data privacy and user data accuracy are always the main concerns. The data privacy and accuracy concerns are addressed by data block encryption, (i.e., ciphering for both user data and control messages), and implementation of ARQ protocol on the data path to recover lost or inaccurate data.  
         [0005]      FIG. 1  shows a conventional third generation (3G) universal terrestrial radio access network (UTRAN)  100 . The UTRAN  100  includes a user equipment (UE)  110 , a Node-B  120  and a radio network controller (RNC)  130 . In the UTRAN  100 , security procedural entities  112 ,  132 , (i.e., cipher entities), are located in the UE  110  and the RNC  130 , along with outer ARQ entities  114 ,  134 , (i.e., radio link control (RLC) acknowledged mode (AM) entities). Both the cipher entities  112 ,  132  and the outer ARQ entities  114 ,  134  use RLC packet data unit (PDU) sequence numbers (SNs) as an input for the data block encryption/decryption and for ARQ operation.  
         [0006]     In LTE, the architecture of the UTRAN  100  will be changed. The RNC  130  no longer exists. An evolved Node-B (eNode-B) will assume medium access control (MAC) and some radio resource control (RRC) functionalities. Original RLC sub-layer and the data security, (or ciphering), entity in the RNC  130  will have to be re-located in LTE to maintain the necessary data encryption and data ARQ functionalities. Given this new LTE network architecture, the issue is where the outer ARQ entities and the data security entities shall be located and how the two formerly co-located entities cooperate to work in the LTE system.  
         [0007]      FIG. 2  shows a proposed LTE network  200  with respect to outer ARQ entities. The LTE network  200  includes a UE  210 , an eNode-B  220  and an access gateway (aGW)  230 . In the proposed LTE network  200 , outer ARQ entities  212  and  222  are located in the UE  210  and the eNode-B  220 , respectively. Placing the outer ARQ entity  222  in the eNode-B  220  would be optimal with respect to retransmission delay, retransmission PDU size, simple protocol complexity, low buffering requirements and possible hybrid ARQ (H-ARQ) and outer ARQ interaction. However, this approach does not have a user data security process in mind.  
         [0008]     It would be optimal to place user data security entities in the UE  210  and the aGW  230 , which is a network anchor node, for the following reasons. First, the security parameters of the UE  210  (or user), (such as UE security credentials, encryption key sets, or the like), may be kept in a safer place, (i.e., aGW  230 ), where the interaction of UE authentication with a home subscriber server (HSS) is administered. Second, user data may be protected all the way from the aGW  230  to the UE  210  without requiring an additional scheme to achieve at least the same level of security as in the conventional UTRAN  100 . Third, eNode-B physical protection may be simplified, thus increasing the total system security protection and the system cost effectiveness, and simplifying the eNodeB functionality. Forth, inter-Node-B handover and inter-aGW handover would be easier from less security context transfer, (between eNode-Bs if the data security entity is located on an eNode-B). However, the drawback on this approach is that the outer ARQ is not taken into consideration.  
         [0009]     Simply putting the data security entities in the eNode-B  220  or putting outer ARQ entities in the aGW  230  will not meet LTE security requirements and data retransmission performance requirements. Therefore, it would be desirable to provide an architecture and operational scheme which provides the best possible performances with respect to the data security functionality and the outer ARQ functionality for the new LTE network architecture.  
       SUMMARY  
       [0010]     The present invention is related to a method and apparatus for implementing data security and ARQ in a wireless communication system. Cipher entities are included in a wireless transmit/receive unit (WTRU) and an aGW, and outer ARQ, (or RLC), entities are included in the WTRU and an eNode-B. Each cipher entity is located on top of an outer ARQ entity. The cipher entities cipher and decipher a data block by using a generic SN assigned to the data block. The outer ARQ entities may segment the ciphered data block to multiple PDUs, may concatenate multiple ciphered data blocks to a PDU, or may generate one PDU from one data block. The outer ARQ entities may segment or re-segment the PDU when a transmission failure occurs. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0011]      FIG. 1  shows a conventional 3G UTRAN.  
         [0012]      FIG. 2  shows a proposed LTE network architecture with respect to outer ARQ entities.  
         [0013]      FIG. 3  shows a wireless communication system configured in accordance with the present invention.  
         [0014]      FIG. 4  shows a ciphered data block configured in accordance with the present invention.  
         [0015]      FIGS. 5A and 5B  show two exemplary segmented PDUs in accordance with the present invention.  
         [0016]      FIG. 6  shows an exemplary concatenated PDU in accordance with the present invention.  
         [0017]      FIG. 7  shows an exemplary PDU generated by one-to-one mapping in accordance with the present invention.  
         [0018]      FIG. 8  is a flow diagram of a process for segmentation and re-segmentation operation between a WTRU and an eNode-B in accordance with the present invention. 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0019]     When referred to hereafter, the terminology “WTRU” includes but is not limited to a user equipment (UE), a mobile station, a fixed or mobile subscriber unit, a pager, a personal data assistant (PDA), a cellular telephone, a computer, or any other type of user device capable of operating in a wireless environment. When referred to hereafter, the terminology “eNode-B” includes but is not limited to a base station, a Node-B, a site controller, an access point (AP) or any other type of interfacing device in a wireless environment.  
         [0020]     The features of the present invention may be incorporated into an integrated circuit (IC) or be configured in a circuit comprising a multitude of interconnecting components.  
         [0021]      FIG. 3  shows a wireless communication system  300  configured in accordance with the present invention. The system  300  includes a WTRU  310 , an eNode-B  320  and an aGW  330 . The WTRU  310  includes an RRC/non-access stratum (NAS) entity  312 , a packet data convergence protocol (PDCP) entity  314 , a cipher entity  316 , an outer ARQ, (or RLC), entity  318  and a user application layer  319 . The eNode-B  320  includes an outer ARQ entity  322 . The aGW  330 , (may also be referred to as an evolved global packet radio services (GPRS) service node (eGSN)), includes an NAS entity  332 , a PDCP entity  334 , a cipher entity  336  and a user application layer  338 .  
         [0022]     In accordance with the present invention, cipher entities  316  and  336  reside in the WTRU  310  and the aGW  330 , respectively, and outer ARQ entities  318  and  322  reside in the WTRU  310  and the eNode-B  320 , respectively. The order of ciphering operation and the outer ARQ operation is changed from the conventional system such that data block ciphering is performed before data block segmentation or concatenation by the outer ARQ entities  318  and  322 . This means that the cipher entities  316  and  336  are located on top of the outer ARQ entities  318  and  322 . The cipher entities  316  and  336  may be directly invoked by the RRC/NAS entity  312  and the NAS entity  332 , respectively, on a control plane (C-plane) through the PDCP entities  314  and  334 , or by the PDCP entities  314 ,  334 , (under the user application layers  319 ,  338 ), on a user plane (U-plane).  
         [0023]     The cipher entities  316 ,  336  perform data security functionality by encrypting and decrypting a data block, (i.e., control message from the RRC/NAS entity  312  or the NAS entity  332  through the PDCP entity  314 ,  334  or a user service data unit (SDU) from the PDCP entity  314 ,  334 ). The cipher entities  316 ,  336  use a generic SN for data encryption and decryption. The generic SN is a sequence number used for ciphering and deciphering the data block. The generic SN for each data block is preferably used together with other ciphering parameters, (such as a ciphering key, bearer-ID, etc.), to encrypt and decrypt the data block.  
         [0024]      FIG. 4  shows a ciphered data block  400  configured in accordance with the present invention. The ciphered data block  400  includes a generic SN  402  and a ciphered data portion  404 . A data block is ciphered by the cipher entity  316 ,  336  using a generic SN  402 . The generic SN  402  is left unencrypted.  
         [0025]     The generic SN  402  may be allocated by a higher layer entity, (such as the NAS entity  312 ,  332  or the PDCP entity  314 ,  334 ). Alternatively, the generic SN  402  may be derived by the cipher entity  316 ,  336  with a seed, such as a required transmission sequence numbers known at the WTRU  310  and the aGW  330 , (e.g., a PDCP SN for U-plane data, an RRC message SN or a NAS message SN for C-plane data). The advantage of this scheme is that the generic SN  402  may be used for multiple H-ARQ and/or outer ARQ transmissions, which results in reducing signaling overhead.  
         [0026]     The outer ARQ entity  318 ,  322  generates a PDU from the ciphered data block  400  and performs ARQ operation. The outer ARQ entity  318 ,  322  may segment the ciphered data block  400  into a number of outer ARQ PDUs. When a ciphered data block size exceeds a PDU size, the ciphered data block  400  is segmented into multiple blocks. The outer ARQ entity  318 ,  322  may assign an ARQ SN for each of the PDUs. The ARQ SN is a sequence number used for transmission feedback, (i.e., a positive acknowledgement (ACK) or a negative acknowledgement (NACK)), and retransmission of failed PDUs between two outer ARQ entities  318 ,  322 .  
         [0027]      FIGS. 5A and 5B  show two exemplary segmented PDUs  510 ,  520  in accordance with the present invention. In this example, a ciphered data block is segmented into two ciphered data parts  518 ,  528  which are included in two PDUs  510 ,  520 , respectively. The generic SN  516  may be included only in the first PDU  510  and the generic SN  526  may be omitted in the subsequent PDUs  520  to avoid repeated transmission of the generic SN. An SN field  515 ,  525  is a  1 -bit indicator field in preceding the generic SN  516 ,  526  to indicate whether a generic SN  516 ,  526  is following or not. The extension field  513 ,  523  after the ARQ SN  512 ,  522  indicates whether a segment header  514 ,  524  is following or not. The segment header  514 ,  524  comprises a length indicator (LI) and a segment extension indicator (SE). The LI indicates the last position of the ciphered data part in the PDU, as shown in  FIG. 5B . The SE indicates whether another segment header is following or not. The segment header  514 ,  524  is optional and may be omitted when there is no padding, as shown in  FIG. 5A , or the ciphered data block has a fixed size.  
         [0028]     Alternatively, the outer ARQ entity  318 ,  322  may concatenate several data blocks into one PDU. When a ciphered data block size is smaller than a PDU size, multiple ciphered data blocks may be concatenated in one PDU.  
         [0029]      FIG. 6  shows an exemplary concatenated PDU  600  in accordance with the present invention. An optional ARQ SN  602  may be assigned by the outer ARQ entity  318 ,  322  to the PDU  600 . The concatenated PDU  600  is generated from multiple ciphered data blocks and includes multiple segment headers  604   a - 604   n.  Each segment header  604   a - 604   n  indicates the ending position of the corresponding ciphered data blocks  608   a - 608   n  in the PDU  600 . A different generic SN is used for each of the data blocks and the generic SNs  606   a - 606   n  are included in the PDU  600 . The extension field  603  after the ARQ SN  602  indicates whether a segment header  604   a  is following or not. If the concatenation always supports in-sequence concatenated SDUs, the generic sequence number may only be included in the first concatenated SDU.  
         [0030]     Alternatively, the outer ARQ entity  318 ,  322  may generate one PDU from one ciphered data block, (i.e., one-to-one mapping). When the ciphered data block size is close or same to the PDU size, the outer ARQ entity  318 ,  322  may generate one PDU from one data block. The one-to-one mapping may occur by coincidence or by configuration. If the one-to-one mapping is configured, the generic SN used by the cipher entity  316 ,  336  may include an ARQ SN, (either in higher or lower order bit positions in the generic SN). In this case, the generic SN is called a common SN. The common SN is a sequence number as a generic SN, but it embeds an ARQ SN. The common SN may be used when by configuration one data block is carried by one PDU. Since the ARQ SN is embedded in the common SN, the outer ARQ entity does not need to allocate another ARQ SN and a processing overhead is reduced.  
         [0031]      FIG. 7  shows an exemplary PDU  700  generated by one-to-one mapping. The PDU  700  includes a common SN  702  which embeds an ARQ SN  701 . The segment header  704  indicates the last position of the ciphered data block  706 . The data block size may be fixed, (by configuration), or may be flexible. The segment header  704  may be omitted if padding is zero or the size of the data block is fixed. An FX field  703  is a 1-bit indicator field following the common SN  702 , indicating whether a segment header  704  is following or not.  
         [0032]     A receiving side outer ARQ entity checks the ARQ SN for ACK or NACK. The transmission status feedback flows between the WTRU  310  and the eNode-B  320  to ensure the guaranteed data service at the shortest possible time. All correctly received PDUs are then passed to a reassembly process to form the original ciphered data block, each associated with a unique ciphering sequence number. The generic SN, (or common SN), is used for data deciphering by the cipher entity  314 ,  334 .  
         [0033]      FIG. 8  is a flow diagram of a process  800  for segmentation and re-segmentation operation between a WTRU  310  and an eNode-B  320  of the wireless communication system  300  of  FIG. 3  in accordance with the present invention. The WTRU  310  and the eNode-B  320  implement an H-ARQ for transmission of a PDU. At a transmitting node, (either the WTRU  310  or the eNode-B  320 ), an outer ARQ entity  318 ,  322  generates at least one PDU from at least one ciphered data block and transmits the PDU(s) to a receiving node (step  802 ). The PDU(s) may be generated by segmenting one data block, by concatenating multiple data blocks, or may be generated from one data block by one-to-one mapping. The receiving node checks whether the PDU is successfully received and sends an ACK or a NACK to the transmitting node (step  804 ).  
         [0034]     Upon receiving feedback indicating H-ARQ transmission failure, (including H-ARQ retransmissions), of one or more segments, the transmitting node may resend the data block. The data block may be retransmitted as long as retransmission criteria is met, (i.e., maximum delay or latency, or maximum number of retransmissions is not exceeded). The assigned physical resources, channel quality and/or available transmission power may result in a different allowable transport format combination (TFC) subset requiring different segment sizes for retransmitting the data block.  
         [0035]     In resending the data block, the transmitting node has three options. The outer ARQ entity  318 ,  322  may segment or re-segment the data block or PDU for retransmission and increments a segmentation version identifier for this data block identified by the generic SN (step  806 ). If the data block was not segmented previously, (i.e., the data block was generated by one-to-one mapping), the outer ARQ entity  318 ,  322  may segment the data block for retransmission. If the data block was segmented previously, the outer ARQ entity  318 ,  322  may re-segment the data block or PDU to different segment sizes and potentially different number of segments. Upon reception of a new segmentation version identifier, in the case of data block re-segmentation, the receiving node discards previously received segments of the data block or PDU with an old segmentation version identifier(s) (step  812 ). Optionally, in the case of data block re-segmentation, upon performing re-segmentation and setting a new segmentation version identifier, the transmitting node may terminate H-ARQ process for the old segments.  
         [0036]     Alternatively, the outer ARQ entity  318 ,  322  of the transmitting node may choose not to re-segment the data block, but retransmit only the H-ARQ failed segment(s) of the previous transmission (step  808 ). In this case, the segmentation version identifier is not incremented so that the receiving node does not discard successfully received segments of the previous transmission of the data block or PDU.  
         [0037]     If the previously transmitted PDU is generated by concatenating multiple data blocks, depending on assigned physical resources, channel quality, and/or available transmission power, the transmitting node may separate the previous PDU into multiple sub-PDUs, each including one or more data blocks without segmenting the data blocks (step  810 ). Since the data blocks are not segmented and the receiving node can unambiguously determine lost and duplicate data block from the generic SN, it is not necessary to coordinate transmissions between the transmitting node and the receiving node with a segmentation version identifier.  
         [0038]     Although the features and elements of the present invention are described in the preferred embodiments in particular combinations, each feature or element can be used alone without the other features and elements of the preferred embodiments or in various combinations with or without other features and elements of the present invention. The methods or flow charts provided in the present invention may be implemented in a computer program, software, or firmware tangibly embodied in a computer-readable storage medium for execution by a general purpose computer or a processor. Examples of computer-readable storage mediums include a read only memory (ROM), a random access memory (RAM), a register, cache memory, semiconductor memory devices, magnetic media such as internal hard disks and removable disks, magneto-optical media, and optical media such as CD-ROM disks, and digital versatile disks (DVDs).  
         [0039]     Suitable processors include, by way of example, a general purpose processor, a special purpose processor, a conventional processor, a digital signal processor (DSP), a plurality of microprocessors, one or more microprocessors in association with a DSP core, a controller, a microcontroller, Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) circuits, any other type of integrated circuit (IC), and/or a state machine.  
         [0040]     A processor in association with software may be used to implement a radio frequency transceiver for use in a wireless transmit receive unit (WTRU), user equipment (UE), terminal, base station, radio network controller (RNC), or any host computer. The WTRU may be used in conjunction with modules, implemented in hardware and/or software, such as a camera, a video camera module, a videophone, a speakerphone, a vibration device, a speaker, a microphone, a television transceiver, a hands free headset, a keyboard, a Bluetooth® module, a frequency modulated (FM) radio unit, a liquid crystal display (LCD) display unit, an organic light-emitting diode (OLED) display unit, a digital music player, a media player, a video game player module, an Internet browser, and/or any wireless local area network (WLAN) module.