Abstract:
An example of the present invention is a method of transmitting encrypted user data to a mobile terminal in a wireless telecommunications network. The method comprises sending to the mobile terminal a data packet. The data packet comprises both an identifier of encryption information to used in recovering encrypted user data, and user data encrypted using said encryption information.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention relates to telecommunications, in particular to wireless telecommunications. 
       DESCRIPTION OF THE RELATED ART 
       [0002]    In known Universal Mobile Telecommunications System (UMTS) systems, some messages are encrypted. Encryption is initiated by a security mode command being sent from the core network via the UMTS terrestrial radio access network (UTRAN) to be received by the mobile terminal. This is followed by a security mode response being sent from the mobile terminal and received by the core network. 
         [0003]    For example, as shown in  FIG. 1 , upon receiving a session, or bearer, establishment request  1 , the core network (CN)  2  sends a security mode command  4  to the UTRAN  6 . This causes the UTRAN  6  to forward the security mode command  4  to the mobile terminal (User Equipment, UE  8 ). The mobile terminal  8  reacts by initialising its encryption algorithms using specific parameter values, sometimes referred to as a security context, and then acknowledges by sending a security mode response  10  to the UTRAN  6  which passes the response  10  on to the core network  2 . Thereafter an encrypted Non Access Stratum (NAS) message, such as a session establishment response  12  is sent from the core network  2  to the mobile terminal  8  via the UTRAN  6 . 
         [0004]    In this known approach, the security mode messages are unencrypted since they provide the encryption information needed to encrypt the messages that follow. 
         [0005]    Another area of background is Long Term Evolution, LTE, networks. From UMTS networks, so-called Long Term Evolution, LTE, networks are now being developed. For background on Long Term Evolution networks, the reader is referred to Third Generation Partnership Project Technical Specification 3GPP TS23.882. 
       SUMMARY OF THE INVENTION 
       [0006]    The reader is referred to the appended independent claims. Some preferred features are laid out in the dependent claims. 
         [0007]    An example of the present invention is a method of transmitting encrypted user data to a mobile terminal in a wireless telecommunications network. The method comprises sending to the mobile terminal a data packet. The data packet comprises both an identifier of encryption information to be used in recovering encrypted user data, and user data encrypted using said encryption information. 
         [0008]    The inventors realised that in the known approach security mode command and response signalling causes delay in session establishment procedures. For example, when the mobile terminal moves to the coverage area of another base station, there can be a change in the encryption key used. This requires security mode command and response signalling so as to inform the mobile terminal of the new key before data encrypted using the new key is sent. This additional signalling can give rise to additional delay. Such a delay may be irksome to the subscriber, and can cause problems with applications that are call setup delay sensitive, such as Push-to-talk. In some embodiments of the invention such delays may be reduced. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0009]    Embodiments of the present invention will now be described by way of example and with reference to the drawings, in which: 
           [0010]      FIG. 1  is a diagram illustrating the known approach to instigating encryption as part of session establishment (PRIOR ART), 
           [0011]      FIG. 2  is a diagram illustrating a Long Term Evolution, LTE, network according to a first embodiment of the present invention, 
           [0012]      FIG. 3  is a diagram illustrating an approach to instigating encryption as part of session establishment in the network shown in  FIG. 2 , 
           [0013]      FIG. 4  is a diagram illustrating the structure of a NAS message sent in session establishment, 
           [0014]      FIG. 5  is a diagram illustrating how NAS signalling messages are encrypted, 
           [0015]      FIG. 6  is a diagram illustrating handover between core network CN nodes in the LTE network, 
           [0016]      FIG. 7  is a diagram illustrating instigating encryption as part of Radio resource control, RRC, connection establishment in the LTE network, 
           [0017]      FIG. 8  is a diagram illustrating a Universal Mobile Telecommunications System (UMTS) network according to a second embodiment of the present invention, and 
           [0018]      FIG. 9  is a diagram illustrating an approach to instigating encryption as part of session establishment in the network shown in  FIG. 8 . 
       
    
    
     DETAILED DESCRIPTION 
       [0019]    An example LTE network will first be described, followed by explanations of how encryption is initiated in session establishment using a combined message. This is followed by an explanation of how encryption is handled upon handover of a mobile terminal from connection with one core network node to another. 
         [0020]    An alternative combined message is then described. 
         [0021]    An alternative network is then described, that being a UMTS network, followed by an explanation of how encryption is initiated in that network. 
       Long Term Evolution Network 
       [0022]    The LTE network  14 , which is based on a Universal Mobile 
         [0023]    Telecommunications System (UMTS) network, is basically as shown in  FIG. 2 . The core network includes Mobile Management Entities (MME). Each MME  16  includes a NAS message encryption stage  26 . In  FIG. 2 , only one Mobile Management Entity (MME)  16  of the core network  18  and one base station  20  of the LTE network  14  are shown for simplicity. The LTE network includes multiple base stations. In the Figure, the base station is also designated “eNode B” in accordance with LTE terminology. A cell, also referred to as a sector, is the radio-coverage area served by a corresponding antenna of a base station. Each base station  20  typically has three cells  22 , each covered by one of three directional antennas  24  angled at 120 degrees to each other in azimuth. 
         [0024]    In use, a mobile user terminal  28  (often referred to as User Equipment (UE) in LTE/UMTS terminology) communicates with a mobile management entity  16  via at least one cell  22  of at least one base station  20 . In that way, the mobile user terminal communicates with the UTRAN network  2 . 
       Instigating Encryption in Session Establishment 
       [0025]    The inventors realised that it is possible to combine the Security mode command and Non Access Stratum (NAS) message (such as a session establishment response) into a single combined message. The first part of the message is the security mode command and this part is unencrypted. The second part of the message is a NAS message and this part is encrypted. 
         [0026]    As shown in  FIG. 3 , upon receiving a session establishment request  30 , the mobile management entity  16  sends the combined message  32  consisting of the unencrypted security mode command and encrypted NAS signalling message to the base station  20 . This causes the base station  20  to forward the combined message  32  to the mobile terminal (User Equipment, UE  28 ). The mobile terminal  28  effects initialisation of its security context and then acknowledges by sending a security mode response  34  to the base station  20  from where the response  34  is forwarded on to the mobile management entity  16 . Thereafter an encrypted Non Access Stratum (NAS) message, such as a session establishment response  36  is sent from the MME  16  to the mobile terminal  28  via the base station  20 . 
         [0027]    The combined message  32  referred to above is as shown in  FIG. 4 , and consists of an unencrypted security command  38  and an encrypted NAS message  40 . The security command  38  consists of information elements defining security context information such as an identifier of the encryption key to be used, and for example, an identifier of start time for the encryption. The NAS message  40  consists of information elements constituting a Session Establishment response. 
       Production of the Combined Message 
       [0028]    In the LTE network  14  encryption of NAS messages is performed by encryption stages  26  in the respective nodes of the core network  18 . Encryption of NAS messages is independent of encryption of user data. 
         [0029]    As shown in  FIG. 5 , the NAS message for encryption together with information to effect the encryption such as encryption keys are input to the encryption stage  26  from which the encrypted NAS message  40  is provided. The encrypted NAS message  40  is concatenated with unencrypted header information  38 . This is possible because the MME  16  generally allows encryption of at least part of an NAS message before concatenation with another unencrypted message portion. 
       Handling Encryption Upon Handover 
       [0030]    Handover is the process of transferring the mobile terminal  28  from connection with one base station  20  and hence core network node  18  to another base station (not shown) and hence another core network node (not shown). Handover is sometimes known as handoff. 
         [0031]    An example of handover procedure is shown in  FIG. 6 . Initially the connection is to the base station  20  and involves using a first encryption key. The core network node  18  sends a handover command  42  via the base station  20  to the mobile terminal  28 , after which handover  44  of the call connection to a further base station  20 ′ and hence core network node  20 ′ is effected. A “handover complete” message  46  is then sent from the mobile terminal  28  to the new base station  18 ′ and hence core network node  18 ′. Thereafter the core network node sends a combined message  48 , consisting of an unencrypted security mode command  50  including encryption key identifiers as previously discussed, followed by an encrypted portion  52  of user data such as NAS signalling messages. So, for example, when the core network node doing encryption changes, the first combined message  50  from the new core network node  18 ′ indicates in the security mode command the new security parameter values to be used, and includes in encrypted form, new NAS signalling messages. 
         [0032]    In an otherwise similar embodiment, if encryption and encryption configuration is instead done in the user plane, the combined packet in the user plane consists of the unencrypted security mode command concatenated with user data. 
         [0033]    Of course, in some embodiments, switching to a new encryption key, by sending a combined message consisting of an unencrypted security mode command including encryption key identifiers followed by an encrypted portion of user data encrypted using that encryption key, can be done at other times than handover between cells. For example, in another embodiment, the old cell and new cell can be the same cell. 
         [0034]    In this example, initially the cell communicates with the mobile terminal using the old encryption parameters. Part-way through the session the cell sends a packet containing the new encryption parameters and additional user data. The mobile terminal receives the new encryption parameters. The mobile terminal uses the new encryption parameters to decrypt the encrypted part of the packet. The mobile terminal also stores the new encryption parameters for subsequent use in decryption of subsequent packets that are encrypted using the new encryption parameters. 
       Radio Resource Control 
       [0035]    As shown in  FIG. 7 , a combined message can similarly be sent consisting of an unencrypted security mode command and an encrypted user data portion, where the user data portion consists of a Radio Resource Control (RRC) message. As shown in  FIG. 7 , a RRC Connection Request  54  is sent to a base station  20 ″ and the combined message  56 , which more specifically comprises the unencrypted Security Mode command followed by the encrypted (with the new key) RRC Connection Response, is sent by the base station to the mobile terminal  28 ′ in reply. A security mode response is then sent from the user terminal  28 ′. 
       Another Example System: UMTS 
       [0036]    The network is a Universal Mobile Telecommunications System (UMTS) terrestrial access network (UTRAN), which is a type of wideband code division multiple access (CDMA) network for mobile telecommunications. The UTRAN network is basically as shown in  FIG. 8 . Only one radio network controller and two base stations of the UTRAN network  62  are shown for simplicity. As shown in this Figure, the UTRAN network  62  includes base stations  64 . In the Figure, each of the base stations  64  is also designated “Node B” in accordance with UMTS terminology. 
         [0037]    A cell, also referred to as a sector, is the radio-coverage area served by a corresponding antenna of a base station. Each base station typically has three cells  66 , each covered by one of three directional antennas  67  angled at 120 degrees to each other in azimuth. Each radio network controller (RNC)  68  typically controls several base stations  64  and hence a number of cells  66 . A base station  64  is connected to its controlling radio network controller (RNC)  68  via a respective interface  69  known as an IuB interface. In use, a mobile user terminal  70  (often referred to as User Equipment (UE) in UMTS terminology) communicates with a serving radio network controller (RCN)  68  via at least one cell  66  of at least one base station  64 . In that way, the mobile user terminal communicates with the UTRAN network  62 . 
         [0038]    The RNC is connected to a Serving Gateway Support Node, SGSN,  72  of the core network  74 . The SGSN  72  includes a NAS message encryption stage  76  as described in more detail below. 
       Instigating Encryption in Session Establishment: UMTS Example 
       [0039]    The inventors realised that it is possible to combine the Security mode command and Non Access Stratum (NAS) message (such as a session establishment response) into a single combined message. The first part of the message is the security mode command and this part is unencrypted. The second part of the message is a NAS message and this part is encrypted. 
         [0040]    As shown in  FIG. 9 , upon receiving a session establishment request  78 , the SGSN  72  sends the combined message  80  consisting of the unencrypted security mode command and encrypted NAS signalling message to the RNC  68  and hence base station  64 . This causes the base station  64  to forward the combined message  80  to the mobile terminal (User Equipment, UE  70 ). 
         [0041]    The combined message  80  consists of an unencrypted security command and an encrypted NAS message. The security commend consists of information elements defining security context information such as an identifier of the encryption key to be used, and for example, an identifier of start time for the encryption. The encrypted NAS message portion of message  80  consists of information elements constituting a 
       Session Establishment Response. 
       [0042]    The mobile terminal  70  effects initialisation of its security context and then acknowledges by sending a security mode response  82  to the base station  64  and hence RNC  68  from where the response  82  is forwarded on to the SGSN  72 . 
       General 
       [0043]    The present invention may be embodied in other specific forms without departing from its essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description. All changes that come within the meaning and range of equivalency of the claims are to be embraced within their scope. 
       Some Abbreviations 
       [0044]    CN: Core Network 
         [0045]    UMTS: Universal Mobile Telecommunications System 
         [0046]    UE: User equipment 
         [0047]    NAS: Non Access Stratum (also known as the Core network protocol) 
         [0048]    MME: Mobility Management Entity 
         [0049]    LTE: Long Term Evolution, a term used in 3GPP for system that is being standardised after UMTS 
         [0050]    IE: Information Element 
         [0051]    RRC: Radio Resource Control (The Radio part of the control protocol otherwise called Access Stratum part of the control protocol) 
         [0052]    SGSN: Signalling Gateway Support Node.