Abstract:
A VoLGA Access Network Controller (VANC), a User Equipment, and methods are described herein for providing security to Voice over Long-Term Evolution via Generic Access (VoLGA) traffic.

Description:
TECHNICAL FIELD 
       [0001]    The present invention relates in general to the wireless telecommunications field and, in particular, to a VANC, a UE and methods for providing security to VoLGA traffic. 
       BACKGROUND 
       [0002]    The following abbreviations are herewith defined, at least some of which are referred to within the following description of the prior art and the present invention. 
       3GPP 3rd Generation Partnership Project 
       [0003]    AAA Authentication, Authorization &amp; Accounting 
         [0004]    BSC Base Station Controller 
         [0005]    BTS Base Transceiver Station 
         [0006]    CBC Cell Broadcast Centre 
         [0007]    CDMA Code Division Multiple Access 
         [0008]    CS Circuit Switched 
         [0009]    EAP-AKA Extensible Authentication Protocol—Authentication and Key Agreement 
         [0010]    EAP-SIM Extensible Authentication Protocol—Subscriber Identity Module 
         [0011]    EPS Evolved Packet System 
         [0012]    E-UTRAN Evolved-UMTS Radio Access Network 
         [0013]    GAN Generic Access Network 
         [0014]    GANC Generic Access Network Controller 
         [0015]    GERAN GSM EDGE Radio Access Network 
         [0016]    GSM Global System for Mobile Communications 
         [0017]    HLR Home Location Register 
         [0018]    HO Handoff 
         [0019]    HPLMN Home Public Land Mobile Network 
         [0020]    HSS Home Subscriber Server 
         [0021]    IMS IP Multimedia Subsystem 
         [0022]    LTE Long-Term Evolution 
         [0023]    MS Mobile Station 
         [0024]    MSC Mobile Switching Centre 
         [0025]    MME Mobile Management Entity 
         [0026]    P-GW Packet-Gateway 
         [0027]    PDN-GW Packet Data Network-Gateway 
         [0028]    PS Packet Switched 
         [0029]    RAT Radio Access Technology 
         [0030]    RNC Radio Network Controller 
         [0031]    SAE System Architecture Evolution 
         [0032]    SEGW Security GateWay 
         [0033]    SGSN Serving GPRS Support Node 
         [0034]    S-GW Serving Gateway 
         [0035]    SIP Session Initiated Protocol 
         [0036]    SMLC Serving Mobile Location Centre 
         [0037]    SRVCC Single Radio Voice Call Continuity 
         [0038]    TCP Transmission Control Protocol 
         [0039]    TLS Transport Layer Security 
         [0040]    UE User Equipment 
         [0041]    UI User Network Interface 
         [0042]    UMTS Universal Mobile Telecommunications System 
         [0043]    UTRAN UMTS Radio Access Network 
         [0044]    VANC VoLGA Access Network Controller 
         [0045]    VLR Visitor Location Register 
         [0046]    VoLGA Voice over LTE via Generic Access 
         [0047]    VoIP Voice Over Internet Protocol 
         [0048]    VPLMN Visited Public Land Mobile Network 
         [0049]    WCDMA Wideband Code Division Multiple Access 
         [0050]    WLAN Wireless Local Area Network 
         [0051]    In 3GPP there are currently several different solutions that can be used to support a voice service via EPS (Evolved Packet System). For instance, one solution is IMS MMTel and another solution is CS Fallback. The IMS MMTel solution might have to use the SRVCC (Single Radio Voice Call Continuity) solution if there are no VoIP radio bearers in the whole wide area network. The SRVCC solution targets supporting IMS Voice with a mechanism to move to the GSM, WCDMA, or cdma2000 1×RTT access and continue to support the voice service using a CS service bearer thus performing a handover from the PS domain (EPS) to the CS domain.  FIG. 1  (PRIOR ART) is a diagram of an architecture which illustrates the SRVCC solution described in 3GPP TS 23.216 v. 8.1.0, “Single Radio Voice Call Continuity (SRVCC)” Sep. 24, 2008 (the contents of which are incorporated herein by reference). 
         [0052]    The CS Fallback solution on the other hand provides a solution where the user is registered in the CS domain even when he/she is on the LTE PS only access and when the user receives or makes a CS call his/her UE is moved over to a radio technology that supports CS service (GSM, WCDMA, or cdma2000 1×RTT). Hence, the UE has fallen back to CS. FIG. 2 (PRIOR ART) is a diagram of an architecture which illustrates the CS Fallback solution described 3GPP TS 23.272 v. 8.1.0, “Circuit Switched Fallback in Evolved Packet System” Sep. 24, 2008 (the contents of which are incorporated herein by reference). 
         [0053]    There are a number of shortcomings associated with both the IMS MMTel solution and the CS Fallback solution. The IMS MMTel solution has the problems of having to catch-up to the service level of CS and requiring the users to migrate from the PS domain (EPS) to the CS domain. The CS fallback solution has the problems where it does not make use of LTE radio resources for the CS service, and it has a longer call setup time than what is normal in the current CS networks. To remedy these shortcomings, a number of other solutions have been presented which can be used to enable the running of the CS service over LTE. 
         [0054]    One proposed solution is to use the GAN (Generic Access Network) architecture.  FIG. 3  (PRIOR ART) is a diagram of the GAN architecture which is described in TS 43.318 v.6.12.0 Generic Access Network (GAN); Stage 2 Jun. 16, 2008 (the contents of which are incorporated herein by reference). The GAN re-uses some of the mechanisms from SRVCC to give the possibility to run CS services over a generic IP access and interne, e.g. provided over a WLAN. In particular, the GAN provides an overlay access between the UE and the CS core without requiring specific enhancements or support in the network it traverses. This provides a UE with a ‘virtual’ connection to the core network which is already deployed by an operator. The UE and network thus reuse most of the network&#39;s existing mechanisms, deployment and operational aspects. However, for GAN to support handover the UE is assumed to use two radios, one radio for the macro network and one radio for the IP access network. This will not be the case when applied in LTE, since in this case only one radio is assumed (only one RAT can be used at one instance in time). To help address this handover problem, a forum was started that is known as the “Voice over LTE via Generic Access” forum (VoLGA forum). 
         [0055]    The aim of VoLGA is to make traditional GSM/UMTS circuit switched (CS) services available to UEs accessing the EPS network via LTE. The VoLGA service closely resembles the GAN service. For instance, VoLGA provides a controller node known as the VANC which inserted between the IP access network (i.e., the EPS) and the 3GPP core network. Plus, the VoLGA provides an overlay access between the UE and the CS core without requiring specific enhancements or support in the network it traverses. This provides a UE with a ‘virtual’ connection to the core, network already deployed by an operator. Thus, the UE and network reuse most of the network&#39;s existing mechanisms, deployment and operational aspects. The VoLGA reuses the GAN services and goals wherever beneficial however there are some differences between them as will be discussed next. 
         [0056]      FIG. 4  (PRIOR ART) is a diagram of the proposed architecture for VoLGA which is described in a n unofficial preliminary VoLGA stage 2 specification. In VoLGA, all signalling and user plane traffic for the UE is fully transparent to the EPS access network on the Z1 interface known as the UNI (User Network Interface). This means that the EPS sees all of the VoLGA traffic as normal user plane traffic of the UE occurring over suitable EPS bearers. This also implies that the UE must attach to the access network first before the transmission of VoLGA traffic. 
         [0057]    However, one important distinction between VoLGA services and GAN services exists. The VoLGA only supports access to CS services, not PS. Unlike GAN, the VoLGA does not support packet access to the 2G/3G SGSN. Instead, packet services are provided to the VoLGA enabled UE by directly employing the EPS system without any additional entities or functions related to VoLGA, other than the capability for combined handover of voice (including facsimile, data, etc) and non-voice packet bearers. Thus, there is no impact on the packet service delivery onto the EPS UE from VoLGA. This distinction between VoLGA service and GAN service can as discussed next have an impact on the security for VoLGA traffic. 
         [0058]    For security, the current GAN specification uses IPsec both for control plane and user plane for the GAN traffic. In VoLGA the UE is no longer connected through Internet, thus a different security scheme might be used. In LTE, the normal way of operating would be that the radio interface is secure, however it is optional if the user plane should be secured or not. This means that the inherit security on the LTE control plane may not be used for the VoLGA control plane, since the VoLGA control plane is on the LTE/SAE user plane. The current working assumption is to use IPsec and the GAN security architecture to get the needed security for the VoLGA traffic. However, to use IPsec and reuse the GAN solution would mean that the UE is authenticated using EAP-SIM or EAP-AKA, which in principle means that there will also need to be an AAA interface from the security gateway within the VOLGA as in GAN. 
         [0059]      FIG. 5  (PRIOR ART) is a diagram of a possible architecture for VoLGA in a roaming situation when the UE is authenticated using EAP-SIM or EAP-AKA where there needs to be an AAA proxy server and AAA server to use IPsec as the security gateway for the VoLGA traffic. In this architecture, there needs to be a new roaming interface Wd on the AAA lever which means that the normal roaming interfaces used in the CS domain such as the D interface cannot be used alone. The addition of a new roaming interface Wd means that a new roaming agreement needs to be made which is a cumbersome business and administration task. Accordingly, there is a need to address this shortcoming to provide security to VoLGA traffic with an UE that is in communication with the VANC and a 3GPP circuit switched node. This need and other needs are satisfied by the present invention. 
       SUMMARY 
       [0060]    In one aspect, the present invention provides a method implemented by a VANC for providing security to VoLGA traffic. The method includes the steps of: (a) participating with the UE to establish therewith an unprotected TCP connection; (b) calculating a pre-shared key using a key (e.g., Kc or CK/IK) that was received during an authentication of the UE by a 3GPP circuit switched node (e.g., MSC), where the UE also has the pre-shared key; and (c) participating with the UE to establish therewith a TLS connection using the pre-shared key, where the TLS connection provides security to the UE&#39;s VoLGA traffic. The method enables a secure signaling channel to be established on the TLS connection between a UE and a VANC without the need for an AAA infrastructure and undesirable roaming agreements. 
         [0061]    In another aspect, the present invention provides a VANC that provides security for VoLGA traffic by including: (1) a processor; and (2) a memory that stores processor-executable instructions where the processor interfaces with the memory and executes the processor-executable instructions to perform the following operations: (a) participating with a UE to establish therewith an unprotected TCP connection; (b) calculating a pre-shared key using a key (e.g., Kc or CK/IK) that was received during an authentication of the UE by a 3GPP circuit switched node (e.g., MSC), where the UE also has the pre-shared key; and (c) participating with the UE to establish therewith a TLS connection using the pre-shared key, where the TLS connection provides security to the UE&#39;s VoLGA traffic. The VANC enables a secure signaling channel to be established on the TLS connection with the UE without the need for an AAA infrastructure and undesirable roaming agreements. 
         [0062]    In still yet another aspect, the present invention provides a method implemented by a UE for providing security to VoLGA traffic. The method includes the steps of: (a) establishing an unprotected TCP connection with a VANC; (b) calculating a pre-shared key using a key (e.g., Kc or CK/IK) that was derived during an authentication with a 3GPP circuit switched node (e.g., MSC), where the VANC also has the pre-shared key; and (c) establishing a TLS connection with the VANC using the pre-shared key, where the TLS connection provides security to the VoLGA traffic. The method enables a secure signaling channel to be established on the TLS connection between a UE and a VANC without the need for an AAA infrastructure and undesirable roaming agreements. In yet another aspect, the present invention provides a UE that provides security for VoLGA traffic by including: (1) a processor; and (2) a memory that stores processor-executable instructions where the processor interfaces with the memory and executes the processor-executable instructions to perform the following operations: (a) establishing an unprotected TCP connection with a VANC; (b) calculating a pre-shared key using a key (e.g., Kc or CK/IK) that was derived during an authentication with a 3GPP circuit switched node (e.g., MSC), where the VANC also has the pre-shared key; and (c) establishing a TLS connection with the VANC using the pre-shared key, where the TLS connection provides security to the VoLGA traffic. The UE enables a secure signaling channel to be established on the TLS connection with the VANC without the need for an AAA infrastructure and undesirable roaming agreements. 
         [0063]    Additional aspects of the invention will be set forth, in part, in the detailed description, figures and any claims which follow, and in part will be derived from the detailed description, or can be learned by practice of the invention. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention as disclosed. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0064]    A more complete understanding of the present invention may be obtained by reference to the following detailed description when taken in conjunction with the accompanying drawings: 
           [0065]      FIG. 1  (PRIOR ART) is a diagram of an architecture which illustrates the SRVCC solution; 
           [0066]      FIG. 2  (PRIOR ART) is a diagram of an architecture which illustrates the CS Fallback solution;  FIG. 3  (PRIOR ART) is a diagram of the GAN architecture; 
           [0067]      FIG. 4  (PRIOR ART) is a diagram of the proposed architecture for the VoLGA solution; 
           [0068]      FIG. 5  (PRIOR ART) is a diagram of a possible architecture for VoLGA in a roaming situation when the UE is authenticated using EAP-SIM or EAP-AKA where there needs to be an AAA proxy server and AAA server to use IPsec as the security gateway for VOLGA traffic; 
           [0069]      FIG. 6  is a signal flow diagram which illustrates the steps associated with an exemplary GSM use case that provides security to the UE&#39;s VoLGA traffic in accordance with an embodiment of the present invention; and 
           [0070]      FIG. 7  is a signal flow diagram which illustrates the steps associated with an exemplary UMTS use case that provides security to the UE&#39;s VoLGA traffic in accordance with another embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0071]    In the following description, a brief discussion about the VANC and the VANC&#39;s method of the present invention is provided first and then a detailed discussion is provided to describe details and enable a thorough understanding about several embodiments of the present invention that can be used for providing security to VoLGA traffic between the VANC and the UE. It will be apparent to one of ordinary skill in the art having had the benefit of the present disclosure that the present invention may be practiced in other embodiments that depart from the specific details disclosed herein. Moreover, it will be apparent to one of ordinary skill in the art that descriptions of well-known architectures, devices, interfaces and signaling steps have been omitted so as not to obscure the description related to the present invention. 
         [0072]    The VANC and the VANC&#39;s method provides security for the UE&#39;s VoLGA traffic by: (1) participating with the UE to establish therewith an unprotected Transmission Control Protocol, TCP, connection; (2) calculating a pre-shared key using a key that was received during an authentication of the UE in the CS domain with a 3GPP circuit switched node (e.g., MSC), where the UE also has the pre-shared key; and (3) participating with the UE to establish therewith a Transport Layer Security, TLS, connection using the pre-shared key, where the TLS connection provides security to the UE&#39;s VoLGA traffic. In other words, the VANC relies on a MSC authenticating the UE, and if there is a successful authentication then the VANC and UE will use the keys derived during the authentication to calculate a pre-shared key which will then be used to establish a TLS connection. A detailed discussion about how this can be implemented is provided next with respect to an exemplary GSM use case and an exemplary UMTS use case. 
         [0073]    Referring to  FIG. 6 , there is a signal flow diagram which illustrates the steps associated with an exemplary GSM use case for providing security to the UE&#39;s VoLGA traffic in accordance with an embodiment of the present invention. In this case, the VANC  602  is connected via the Z1 interface to the UE  604  and connected via the A interface to the MSC  606 . The exemplary GSM use case can be understood with reference to the following messages that can be exchanged between the VANC  602 , UE  604  and MSC  606  to provide security for the UE&#39;s VoLGA traffic (i.e. the traffic between the VANC  602  and the UE  604 ): 
         [0000]    1. The UE  604  initiates the establishment of an unprotected TCP connection with the VANC  602 . The VANC  602  was found during the discovery procedures.
 
2. The UE  604  sends a register request over the unprotected TCP connection to the VANC  602 .
 
3. The VANC  602  sends a register accept over the unprotected TCP connection to the UE  604 .
 
4. Once registered the UE  604  starts the location update procedure by sending a location update request over the unprotected TCP connection to the VANC  602 . The VANC  602  forwards the location update request to the MSC  606 .
 
5. The MSC  606  authenticates the UE  604  by sending an authentication request to the VANC  602  which forwards the authentication request over the unprotected TCP connection to the UE  604 . The authentication request includes the normal authentication parameters for the Challenge Response procedure that GSM uses for authentication.
 
6. The UE  604  sends an authentication response over the unprotected TCP connection to the VANC  602 . The VANC  602  forwards the authentication response to the MSC  606 . In this case, the UE  604  calculates Kc and a result where the result is sent in the authentication response to the MSC  606 . The MSC  606  checks the authentication response and if correct continues with commanding a ciphering mode assuming the network is configured to cipher (see step 7). If the authentication fails, the MSC  606  can either re-attempt the authentication procedure or reject the location update. If the MSC  606  rejects the authentication attempt, then the VANC  602  will de-register the UE  604 .
 
7. The MSC  606  sends a ciphering mode command to the VANC  602 . The VANC  602  forwards the ciphering mode command over the unprotected TCP connection to the UE  604 . The forwarded ciphering mode command may include an indication that the signaling channel shall be encrypted (goto TLS connection). When the UE  604  receives the ciphering mode command it calculates a key based on the Kc which was an output from the authentication procedure. The VANC  602  which has received Kc from the UE  604  during the authentication process also calculates the key thus these keys are pre-shared keys.
 
8. The UE  604  based on the calculated key establishes a pre-shared key TLS connection with the VANC  602 . Since, the VANC  602  has also calculated the key, the TLS connection establishment will be successful. However, if the UE  604  for some reason does not manage to establish the TLS connection then the VANC  602  will after a pre-set time go to GA-RC de-register state.
 
         [0074]    If the UE  604  has a Kc then the UE  604  will always use the pre-shared key calculated from Kc try to set-up the TLS connection with the VANC  602  and then start the registration procedures. However, if a new Kc is calculated during the VANC registration due to new authentication and ciphering key procedures, then there will be a re-negotiation of the pre-shared key TLS connection. In other words, if a new Kc is received then the TLS connection will be re-negotiated using the new pre-shared keys (ciphering keys) derived from the new Kc. 
         [0000]    9. The UE  604  sends a ciphering mode complete over the TLS connection to the VANC  602 . The VANC  602  forwards the ciphering mode complete to the MSC  606 .
 
10. The unprotected TCP session is released (teared-down) after the ciphering mode complete.
 
11. The MSC  606  after the completion of the ciphering procedure will respond to the previously received location update request by sending a location update response to the VANC  602 . The VANC  602  forwards the location update response over the TLS connection to the UE  604 . At this point, the VoLGA traffic between the VANC  602  and the UE  604  is protected by the TLS connection.
 
         [0075]    In view of the foregoing, the VANC  602  can provide security for the VoLGA traffic by including: (1) a processor  608 ; and (2) a memory  610  that stores processor-executable instructions where the processor  608  interfaces with the memory  610  and executes the processor-executable instructions to perform the following operations: (a) participating with the UE  604  to establish therewith an unprotected TCP connection; (b) calculating a pre-shared key using a key (Kc) that was received during an authentication of the UE  604  by the MSC  606 , where the UE  604  also has the pre-shared key; (c) participating with the UE  604  to establish therewith a TLS connection using the pre-shared key, where the TLS connection provides security to the UE&#39;s VoLGA traffic; and (d) tearing down the unprotected TCP connection (note: the one or more processors  608  and the at least one memory  610  can be implemented, at least partially, as software, firmware, hardware, or hard-coded logic). 
         [0076]    The VANC  602  can perform the calculating operation (b) by: (i) receiving a register request from the UE  604  over the unprotected TCP connection; (ii) sending a register accept to the UE  604  over the unprotected TCP connection; (iii) receiving a location update request from the UE  604  over the unprotected TCP connection; (iv) forwarding the location update request to the MSC  606 ; (v) receiving an authentication request from the MSC  606 ; (vi) forwarding the authentication request to the UE  604  over the unprotected TCP connection, where the UE  604  upon receiving the authentication request calculates the key (Kc) and a result; (vii) receiving an authentication response from the UE  604  over the unprotected TCP connection, where the authentication response includes the UE calculated result; (viii) forwarding the authentication response to the MSC  606 ; (ix) receiving a ciphering mode command from the MSC  606 ; (x) forwarding the ciphering mode command to the UE  604  over the unprotected TCP connection, where the UE  604  upon receiving the ciphering mode command uses the key to calculate the pre-shared key; and (xi) calculating the pre-shared key using the key (Kc) derived by the UE  604 . 
         [0077]    The UE  604  can provide security for the VoLGA traffic by including: (1) a processor  612 ; and (2) a memory  614  that stores processor-executable instructions where the processor  612  interfaces with the memory  614  and executes the processor-executable instructions to perform the following operations: (a) establishing an unprotected TCP connection with the VANC  602 ; (b) calculating a pre-shared key using a key (Kc) that was derived during an authentication with the MSC  606 , where the VANC  602  also has the pre-shared key; and (c) establishing a TLS connection with the VANC  602  using the pre-shared key, where the TLS connection provides security to the VoLGA traffic (note: the one or more processors  612  and the at least one memory  614  can be implemented, at least partially, as software, firmware, hardware, or hard-coded logic). 
         [0078]    The UE  602  can perform the calculating operation (b) by: (i) registering with the VANC  602 ; (ii) sending a location update request via the VANC  602  to the MSC  606 ; (iii) receiving an authentication request from the MSC  606  via the VANC  602 ; (iv) calculating the key (Kc) and a result; (v) sending an authentication response including the result to the MSC  606  via the VANC  602 ; (vi) receiving a ciphering mode command from the MSC  606  via the VANC  602 ; and (vii) calculating the pre-shared key based on the key (Kc). 
         [0079]    Referring to  FIG. 7 , there is a signal flow diagram which illustrates the steps associated with an exemplary UMTS use case for providing security to the UE&#39;s VoLGA traffic in accordance with an embodiment of the present invention. In this case, the VANC  602  is connected via the Z1 interface to the UE  604  and connected via the A interface to the MSC  606 . The exemplary UMTS use case can be understood with reference to the following messages that can be exchanged between the VANC  602 , UE  604  and MSC  606  to provide security for the UE&#39;s VoLGA traffic (i.e. the traffic between the VANC  602  and the UE  604 ): 
         [0000]    1. The UE  604  initiates the establishment of an unprotected TCP connection with the VANC  602 . The VANC  602  was found during the discovery procedures.
 
2. The UE  604  sends a register request over the unprotected TCP connection to the VANC  602 .
 
3. The VANC  602  sends a register accept over the unprotected TCP connection to the UE  604 .
 
4. Once registered the UE  604  starts the location update procedure by sending a location update request over the unprotected TCP connection to the VANC  602 . The VANC  602  forwards the location update request to the MSC  606 .
 
5. The MSC  606  authenticates the UE  604  by sending an authentication request to the VANC  602  which forwards the authentication request over the unprotected TCP connection to the UE  604 . The authentication request includes the normal authentication parameters for the Challenge Response procedure that UMTS uses for authentication.
 
6. The UE  604  sends an authentication response over the unprotected TCP connection to the VANC  602 . The VANC  602  forwards the authentication response to the MSC  606 . In this case, the UE  604  calculates cipher key CK, an integrity key IK and a result where the result is sent in the authentication response to the MSC  606 . The MSC  606  checks the authentication response and if correct continues with commanding a security mode assuming the network is configured to support the security mode (see step 7). If the authentication fails, the MSC  606  can either re-attempt the authentication procedure or reject the location update. If the MSC  606  rejects the authentication attempt, then the VANC  602  will de-register the UE  604 .
 
7. The MSC  606  sends a security mode command to the VANC  602 . The VANC  602  forwards the security mode command over the unprotected TCP connection to the UE  604 . The forwarded security mode command may include an indication that the signaling channel shall be encrypted (goto TLS connection). When the UE  604  receives the security mode command it calculates a key based on the CK and IK which was an output from the authentication procedure. The VANC  602  which has received CK and IK from the UE  604  during the authentication process also calculates the key thus these keys are pre-shared keys.
 
8. The UE  604  based on the calculated key establishes a pre-shared key TLS connection with the VANC  602 . Since, the VANC  602  has also calculated the key, the TLS connection establishment will be successful. However, if the UE  604  for some reason does not manage to establish the TLS connection then the VANC  602  will after a pre-set time go to GA-RC de-register state.
 
         [0080]    If the UE  604  has a CK and IK then the UE  604  will always use the pre-shared key calculated from CK and IK try to set-up the TLS connection with the VANC  602  and then start the registration procedures. However, if a new CK and IK is calculated during the VANC registration due to new authentication and security procedures, then there will be a re-negotiation of the pre-shared key TLS connection. In other words, if a new CK and IK is received then the TLS connection will be re-negotiated using the new pre-shared keys (ciphering keys) derived from the new CK and IK. 
         [0000]    9. The UE  604  sends a security mode complete over the TLS connection to the VANC  602 . The VANC  602  forwards the security mode complete to the MSC  606 .
 
10. The unprotected TCP session is released (teared-down) after the security mode complete.
 
11. The MSC  606  after the completion of the security procedure will respond to the previously received location update request by sending a location update response to the VANC  602 . The VANC  602  forwards the location update response over the TLS connection to the UE  604 . At this point, the VoLGA traffic between the VANC  602  and the UE  604  is protected by the TLS connection.
 
         [0081]    In view of the foregoing, the VANC  602  can provide security for the VoLGA traffic by including: ( 1 ) a processor  608 ; and ( 2 ) a memory  610  that stores processor-executable instructions where the processor  608  interfaces with the memory  610  and executes the processor-executable instructions to perform the following operations: (a) participating with the UE  604  to establish therewith an unprotected TCP connection; (b) calculating a pre-shared key using a key (CK and IK) that was received during an authentication of the UE  604  by the MSC  606 , where the UE  604  also has the pre-shared key; (c) participating with the UE  604  to establish therewith a TLS connection using the pre-shared key, where the TLS connection provides security to the UE&#39;s VoLGA traffic; and (d) tearing down the unprotected TCP connection (note: the one or more processors  608  and the at least one memory  610  can be implemented, at least partially, as software, firmware, hardware, or hard-coded logic). 
         [0082]    The VANC  602  can perform the calculating operation (b) by: (i) receiving a register request from the UE  604  over the unprotected TCP connection; (ii) sending a register accept to the UE  604  over the unprotected TCP connection; (iii) receiving a location update request from the UE  604  over the unprotected TCP connection; (iv) forwarding the location update request to the MSC  606 ; (v) receiving an authentication request from the MSC  606 ; (vi) forwarding the authentication request to the UE  604  over the unprotected TCP connection, where the UE  604  upon receiving the authentication request calculates the key (CK and IK) and a result; (vii) receiving an authentication response from the UE  604  over the unprotected TCP connection, where the authentication response includes the UE calculated result; (viii) forwarding the authentication response to the MSC  606 ; (ix) receiving a security mode command from the MSC  606 ; (x) forwarding the security mode command to the UE  604  over the unprotected TCP connection, where the UE  604  upon receiving the security mode command uses the key (CK and IK) to calculate the pre-shared key; and (xi) calculating the pre-shared key using the key (CK and IK) derived by the UE  604 . 
         [0083]    The UE  604  can provide security for the VoLGA traffic by including: ( 1 ) a processor  612 ; and ( 2 ) a memory  614  that stores processor-executable instructions where the processor  612  interfaces with the memory  614  and executes the processor-executable instructions to perform the following operations: (a) establishing an unprotected TCP connection with the VANC  602 ; (b) calculating a pre-shared key using a key (CK and IK) that was derived during an authentication with the MSC  606 , where the VANC  602  also has the pre-shared key; and (c) establishing a TLS connection with the VANC  602  using the pre-shared key, where the TLS connection provides security to the VoLGA traffic (note: the one or more processors  612  and the at least one memory  614  can be implemented, at least partially, as software, firmware, hardware, or hard-coded logic). 
         [0084]    The UE  602  can perform the calculating operation (b) by: (i) registering with the VANC  602 ; (ii) sending a location update request via the VANC  602  to the MSC  606 ; (iii) receiving an authentication request from the MSC  606  via the VANC  602 ; (iv) calculating the key (CK and IK) and a result; (v) sending an authentication response including the result to the MSC  606  via the VANC  602 ; (vi) receiving a security mode command from the MSC  606  via the VANC  602 ; and (vii) calculating the pre-shared key based on the key (CK and IK). 
         [0085]    Although several embodiments of the present invention have been illustrated in the accompanying Drawings and described in the foregoing Detailed Description, it should be understood that the invention is not limited to the disclosed embodiments, but instead is also capable of numerous rearrangements, modifications and substitutions without departing from the present invention that as has been set forth and defined within the following claims.