Abstract:
Apparatus, methods and computer program products incorporate improvements that provide enhanced security during handovers in a cellular wireless communications network. In one aspect, user equipment performs additional operations during handover to improve security. During such operations, user equipment begins key generation based on a predicted target base station before it is notified of the handover decision. User equipment also signs certain communications generated during handover operations to prevent hijacked base stations from generating false location updates. Separate keys are used to authenticate communications made by base stations during handover proceedings defeating, for example, logical theft of service attacks since a target base station&#39;s signature and encrypted content is required to be sent to the user equipment before the user equipment can switch to the target base station. In other aspects, user equipment assigns location updates sequence numbers and the active gateway keeps track of them defeating attacks based on replay of intercepted location update messages.

Description:
CROSS REFERENCE TO A RELATED UNITED STATES PATENT APPLICATION 
       [0001]    This application hereby claims priority under 35 U.S.C. §119(e) from copending provisional U.S. Patent Application No. 60/786,600 entitled “APPARATUS, METHOD AND COMPUTER PROGRAM PRODUCT PROVIDING UNIFIED REACTIVE AND PROACTIVE HANDOVERS” filed on Mar. 27, 2006 by Dan Forsberg. This preceding provisional application is hereby incorporated by reference in its entirety. 
     
    
     TECHNICAL FIELD 
       [0002]    The exemplary and non-limiting embodiments of this invention relate generally to wireless communications systems, methods, computer program products and devices and, more specifically, relate to hand over or hand off (HO) procedures executed when a user equipment (UE) changes cells. 
       BACKGROUND 
       [0003]    The following abbreviations are herewith defined: 
         [0000]    
       
         
               
               
             
           
               
                   
               
             
             
               
                 3GPP 
                 Third Generation Partnership Project 
               
               
                 C Plane 
                 control plane 
               
               
                 CN 
                 core network 
               
               
                 DL 
                 downlink (Node B to UE) 
               
               
                 GW 
                 gateway (aGW = active GW) 
               
               
                 LTE 
                 Long Term Evolution 
               
               
                 MME 
                 mobile management entity 
               
               
                 Node B 
                 base station 
               
               
                 RNC 
                 radio network control 
               
               
                 RNTI 
                 radio network temporary identity (C-RNTI = C plane RNTI) 
               
               
                 RRC 
                 radio resource control 
               
               
                 SKC 
                 secret key cryptography (aka as symmetric key cryptography) 
               
               
                 UE 
                 user equipment 
               
               
                 UPE 
                 user plane entity 
               
               
                 UL 
                 uplink (UE to Node B) 
               
               
                 UMTS 
                 Universal Mobile Telecommunications System 
               
               
                 UTRAN 
                 UMTS Terrestrial Radio Access Network 
               
               
                 E-UTRAN 
                 Evolved UTRAN 
               
               
                   
               
             
          
         
       
     
         [0004]    An important aspect of a handover or handoff of a mobile communication device from a serving cell to a neighbor cell is security protection. This can be particularly important in view of the potential to use smaller and low-cost cell equipment as node-Bs (which may referred to as eNBs). 
         [0005]    Some problems with previous proposals in this regard include the following:
       reactive handover was considered an error case and was not integrated with the proactive handover;   message sizes were quite large, and it was possible to track UE movements because the signals were not properly encrypted;   key derivation occurred during the radio break, meaning that more resources were needed during the break; and   nonces were used quite liberally and inconsistently.       
 
         [0010]    As employed herein a nonce is considered to be a random variable used as an input for a key negotiation process. Nonces provide key freshness, as they are selected separately for each key negotiation process. 
         [0011]    Prior to this invention, no completely satisfactory solution has been proposed to overcome these and other problems. 
       SUMMARY OF THE INVENTION 
       [0012]    A first embodiment of the invention is user equipment comprising a transceiver configured for bidirectional communication in a wireless telecommunications network; and user equipment control apparatus. The user equipment control apparatus is configured to perform handoff-related measurements using the transceiver; to select at least one handoff candidate from available base stations in dependence on the handoff-related measurements; and to begin generation of at least one security key for use in communication with the at least one handoff candidate if the at least one handoff candidate is selected to receive the handoff, the security key generation beginning prior to receipt of a message by the user equipment identifying the base station selected by the network to receive the handoff. 
         [0013]    A second embodiment of the invention is a base station comprising a transceiver configured for bidirectional communication in a wireless telecommunications network; and base station control apparatus. The base station control apparatus is configured to operate the base station as a source base station during handoff operations; and to add context identification information to handoff-related messages when operating as a source base station, the context identification information identifying a context for a handoff. 
         [0014]    A third embodiment of the invention is a base station comprising at least a transceiver configured for bidirectional communication in a wireless telecommunications network and base station control apparatus. The base station control apparatus is configured to operate the base station as a source base station during handoff operations; to identify context identification information in handoff-related messages received from source base stations; to determine whether the base station has received context for a handoff using the context identification information; and if context for a handoff has not been received, to use the context identification information to request the context from a source base station. 
         [0015]    A fourth embodiment of the invention is a method comprising: at user equipment in a wireless communication system: predicting a candidate base station to receive a handoff from a source base station currently handling communications for the user equipment; and pre-calculating at least one security key to be used for communicating with the candidate base station if the candidate base station receives the handoff. 
         [0016]    A fifth embodiment of the invention is a computer program product comprising a computer readable memory medium storing a computer program. The computer program is configured to be executed by digital processing apparatus of user equipment operative in a wireless telecommunications network. When the computer program is executed operations are performed. The operations comprise: predicting a candidate base station to receive a handoff from a source base station currently handling communications for the user equipment; and pre-calculating at least one security key to be used for communicating with the candidate base station if the candidate base station receives the handoff. 
         [0017]    A sixth embodiment of the invention is an integrated circuit for use in a base station operative in a wireless communications network. The integrated circuit comprises circuitry configured to operate the base station as a source base station during handoff-related operations; to access a measurement report message received by the base station from user equipment; to select, in dependence on data contained in the measurement report message, a target base station to receive a handoff involving the user equipment; to generate a context data message containing at least context identification information for the handoff; to encrypt at least the context identification information portion of the context data message with a user-equipment-specific security key shared by the source and target base station; and to cause the base station to transmit the context data message to the target base station. 
         [0018]    In conclusion, the foregoing summary of the alternate embodiments of the invention is exemplary and non-limiting. For example, one of ordinary skill in the art will understand that one or more aspects from one embodiment can be combined with one or more aspects from another embodiment to create a new embodiment within the scope of the present invention. In addition, one skilled in the art will understand that operations in accordance with the invention performed in embodiments expressed as methods can also be performed by apparatus. Such apparatus is also within the scope of the invention. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0019]    In the attached Drawing Figures: 
           [0020]      FIG. 1  shows a simplified block diagram of various electronic devices that are suitable for use in practicing the exemplary embodiments of this invention; 
           [0021]      FIG. 2  shows the relative orientation of  FIG. 2A  to  FIG. 2B , which together depict a first exemplary embodiment of an inter-radio access handoff security as example of the utility of the exemplary embodiments of this invention.  FIGS. 2A and 2B  are connected via the circular connectors designated as A, B, C and D; 
           [0022]      FIG. 3  shows the relative orientation of  FIG. 3A  to  FIG. 3B , which together depict a second exemplary embodiment of an inter-radio access handoff security as a further example of the utility of the exemplary embodiments of this invention.  FIGS. 3A and 3B  are also connected via the circular connectors designated as A, B, C and D; 
           [0023]      FIG. 4  is a flowchart depicting a method performed by user equipment during an HO implemented in accordance with an exemplary embodiment of the invention; 
           [0024]      FIG. 5  is a flowchart depicting a method performed by a target base station during an HO implemented in accordance with an exemplary embodiment of the invention; 
           [0025]      FIG. 6  is a flowchart depicting a method performed by user equipment during an HO implemented in accordance with an exemplary embodiment of the invention; and 
           [0026]      FIG. 7  is a flowchart depicting a method performed by user equipment during an HO implemented in accordance with an exemplary embodiment of the invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0027]    By way of introduction, RRC termination on an eNB, and an interface between eNBs have been previously agreed upon (see 3GPP Technical Report, TR25.912, incorporated by reference herein). One aspect of this is “common UE specific keys” working assumptions for eNBs. Reference may also be made to a S3-060033 contribution for SA3#42, Bangalore (incorporated by reference herein) which presents some security measures for an intra-eNB handover procedure. 
       Security Measures 
       [0028]    Security measures have been considered to mitigate denial of service (DoS) and resource theft attacks that an attacker may create by hijacking an eNB and/or injecting packets (threats such as man-in-the-middle and false-eNB. Reference in this regard can be made to S3-060034, Discussion of threats against eNB and last-mile in Long Term Evolved RAN/3GPP System Architecture Evolution (incorporated by reference herein in its entirety)). 
         [0029]    In accordance with exemplary embodiments of this invention, the UE is enabled to guess or predict which base station would be the best HO candidate based on measurements, and the UE can begin key generation before the network transmits a message containing the HO decision. The exemplary embodiments of this invention also unify reactive and proactive handovers by adding context id into proper messages, making it possible for the target eNB to detect if it has already received the context. If the target eNB has not yet received the context it can request it from the source eNB with the context id. This procedure thus unifies reactive and proactive handovers. The exemplary embodiments of this invention also provide for adding a new message after a “HO Confirm” message from the target eNB to the UE. The message contains the context id for the target eNB UE context, and a new network nonce to be used in the next handover and key derivation. 
         [0030]    As will be discussed in greater detail below, the use of the exemplary embodiments of this invention provides for improved performance and simpler error recovery if the UE loses the connection to the serving base station, especially during HO; a unification of reactive and proactive HOs; and also enhanced security. 
         [0031]    Reference is made first to  FIG. 1  for illustrating a simplified block diagram of various electronic devices that are suitable for use in practicing the exemplary embodiments of this invention. In  FIG. 1  a wireless network  100  is adapted for communication with a UE  110  via a node B (base station)  120 . The network  100  may include an RNC  140 , or other radio controller function, which may be referred to as a serving RNC (SRNC). The UE  110  includes a data processor  112 , a memory  114  that stores a program  116 , and a suitable radio frequency transceiver  118  for bidirectional wireless communications with the node B  120 , which also includes a data processor  122 , a memory  124  that stores a program  126 , and a suitable RF transceiver  128 . The node B  120  is coupled via a data path  130  (Iub) to the RNC  140  that also includes a data processor  142  and a memory  144  storing an associated program  146 . The RNC  140  may be coupled to another RNC (not shown) by another data path  150  (Iur). At least one of the programs  116 ,  126  and  146  is assumed to include program instructions that, when executed by the associated data processor, enable the electronic device to operate in accordance with the exemplary embodiments of this invention, as will be discussed below in greater detail. 
         [0032]    Shown in  FIG. 1  is also a second node B  120 ′, it being assumed that the first node B  120  establishes a first cell (Cell  1 ) and the second node B  120 ′ establishes a second cell (Cell  2 ), and that the UE  110  is capable of a handoff from one cell to another. In  FIG. 1  the Cell  1  may be assumed to be a currently serving cell, while Cell  2  may be a neighbor or target cell to which handoff may occur. Note that the node Bs could be coupled to the same RNC  140  (as shown), or to different RNCs  140 . Note that while shown spatially separated, Cell  1  and Cell  2  will typically be adjacent and/or overlapping, and other cells will typically be present as well. 
         [0033]    The node Bs  120  may also be referred to for convenience as a serving eNB and as a target eNB. 
         [0034]    The exemplary embodiments of this invention may be implemented by computer software executable by the data processor  112  of the UE  110  and the other data processors, such as in cooperation with a data processor in the network, or by hardware, or by a combination of software and/or firmware and hardware. 
         [0035]    In general, the various embodiments of the UE  110  can include, but are not limited to, cellular telephones, personal digital assistants (PDAs) having wireless communication capabilities, portable computers having wireless communication capabilities, image capture devices such as digital cameras having wireless communication capabilities, gaming devices having wireless communication capabilities, music storage and playback appliances having wireless communication capabilities, Internet appliances permitting wireless Internet access and browsing, as well as portable units or terminals that incorporate combinations of such functions. 
         [0036]    The memories  114 ,  124  and  144  may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory. The data processors  112 ,  122  and  142  may be of any type suitable to the local technical environment, and may include one or more of general purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs) and processors based on a multi-core processor architecture, as non-limiting examples. 
         [0037]    Having thus introduced one suitable but non-limiting technical context for the practice of the exemplary embodiments of this invention, the exemplary embodiments will now be described with greater specificity. 
         [0038]    Describing now the exemplary embodiments of this invention in greater detail, in order to achieve the benefits and advantages discussed above, it is assumed that any eNB shall not be able to launch denial of service attacks towards other eNBs, MMEs, or UPEs with handoff signaling messages to mitigate the threat of a hijacked eNB. To fulfill this goal UE-specific separate keys for each eNB are employed. It is also assumed that the UE must sign path switch messages towards an aGW, and that it is preferred to use RRC ciphering, in addition to integrity protection, except for some message parts in the first message from UE to the target eNB in the handover. 
         [0039]    It is also assumed that there are no separately managed security associations between eNBs. Also, a desired goal is to assume minimal trust between eNBs, which is consistent with the assumption of the presence of small and low cost eNBs, for example in home and office environments. 
         [0040]    It is also preferred to employ SKC based eNB-eNB signaling security protection. 
         [0041]    It is noted that a non-limiting assumption is to reuse UMTS security algorithms for key derivation (CK, IK), encryption and, as an example, for integrity protection for the RRC signaling. However, one may assume that the 128 bit RAND used in UMTS (see 3GPP TS 33.102 v3.5.0: “3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 3G Security; Security Architecture”, incorporated by reference herein) is created from 64 bit nonces from UE (Nonce UE ) and from the network (Nonce NET ) with concatenation (Nonce UE ∥Nonce NET ). The FRESH value is derived from the nonces if required in LTE. However, the size of the nonce may be an issue when sent in the measurement report message, and thus may not be used in every case. 
       Security Analysis 
       [0042]    Based on the security measures of the exemplary signaling flow shown in  FIG. 2 , and discussed in further detail below, one may conclude the following. 
         [0043]    A. UE  110  signature for path switch: An (hijacked) eNB cannot spoof location updates to the MME/UPE since the UE&#39;s signature is required in the message. Also, an attacker cannot inject location update messages to the MME/UPE, because the message is signed. A case, where an eNB would start to signal path switch update messages to the core network on behalf of multiple UEs, and without UE signatures, is not acceptable and poses a high risk if not mitigated. 
         [0044]    B. UE  110  signature for path switch: An (hijacked) eNB can not replay the location update messages to the MME/UPE, since the aGW keeps track of the received Sequence numbers (and if the UE_TID (Transaction Identifier) is changed). 
         [0045]    C. Separate keys: An (hijacked) eNB cannot launch denial of service attacks against other eNBs, MMEs, or UPEs, because the UE&#39;s signature and sequence number are required in the messages. 
         [0046]    D. Separate keys: An (hijacked) eNB cannot perform a logical service theft for the UE  110  by commanding it to another eNB, because the target eNB&#39;s signature and encrypted content is required to be sent to the UE  110 , before the UE  110  can switch the radio to the target eNB. 
         [0047]    E. Separate keys: Man-in-the-middle eNB condition is not possible, as the SK key derivation is bound to the eNB identity, and the MME encrypts the SK key for the eNBs (i.e., it is not created based on the over-the-air signaling). Thus, the eNB is also authenticated for the UE  110 . 
         [0048]    F. Separate keys: An attacker cannot send spoofed (or replay) measurement reports on behalf of the UE  110 , since the UE  110  signs them. 
         [0049]    G. RRC ciphering: An eavesdropper cannot bind together the old and new C-RNTIs, because they are not sent in plain text in a single packet. An attacker hijacking the eNB may possibly perform this mapping, but only for the two C-RNTIs that it can see, not the entire chain of them (i.e. the C-RNTI is changed in every handoff). Also, since the handoff messages are mostly encrypted, the binding between them is not possible to readily ascertain without accurate timing analysis and making distinction between possible other handoffs. 
         [0050]    H. RRC ciphering: An eavesdropper cannot obtain the location of the UE  110  by examining the measurement reports, since they are encrypted. Also, an attacker cannot spoof measurement reports. Note that a malicious UE  110  may attack the network by sending different bogus measurement reports to the serving eNB, and not actually by performing the handoff. This is not a serious threat, as the serving eNB can readily detect this type of aberrant UE behavior. 
         [0051]    I. UE-specific eNB-eNB security: With the SPK key within the SKC entry for each eNB, the target-eNB is only able to decrypt the received context, as the other SKC entries are encrypted with the SPK key and thus other eNBs cannot obtain the UE-specific SKC entry if it is not explicitly sent to them. 
         [0052]    J. UE-specific eNB-eNB security: With SPKs shared within the SKC, there is no need to pre-establish shared keys between eNBs. This allows the establishment of a secure mesh network between the eNBs listed in the SKC. 
         [0053]    Based on the foregoing, it can be appreciated that exemplary aspects of this invention are directed to providing enhanced security measures for an eNB-to-eNB handoff in LTE_ACTIVE mode. It is shown that the resulting system with eNB-to-eNB handoff signaling is secure and does not allow a single node (eNB, UE) to launch logical denial of service or resource theft attacks based on handoff signaling. A desirable aspect of the exemplary embodiments of this invention is in providing separate UE-specific session keys for each eNB, and a further desirable aspect is in requiring the presence of a UE signature for those path switching messages that are directed towards the core network. 
         [0054]    It should be noted that the security measures discussed herein are not solely specific to the eNB-to-eNB interface, and that their use provides enhanced denial of service and theft of resources attack resistance for the entire network. 
         [0055]    Discussed now with reference to  FIGS. 2A and 2B , collectively referred to as  FIG. 2 , is a first non-limiting example of handoff signaling security measures in accordance with the foregoing description of the exemplary embodiments of this invention. 
         [0056]      FIG. 2  presents the handoff signaling flow with added security measures in accordance with the exemplary embodiments of this invention. The following designations indicate which keys are used to sign/encrypt the messages: 
         [0057]    content marked as “SE” is signed with the source-eNB keys; 
         [0058]    content marked with “TE” is signed with the target-eNB keys; and 
         [0059]    content marked with “CN” is signed with the CN keys (aGW  205 ). 
         [0060]    In addition, “UE-S” denotes signatures/ciphering with a UE specific key that is shared securely through the SKC among the eNBs listed in the SKC. Reference in this regard may be had to S3-050721, Nokia Security Solution, SAE Security, Nokia contribution to SA3 meeting #41, San Diego, USA, Nov. 15-18, 2005 (incorporated by reference herein). 
         [0061]    The following notation is used to show which contents are signed and/or encrypted: 
         [0062]    Sign SK {&lt;content&gt;}; 
         [0063]    Encrypt SK {&lt;content&gt;}; and 
         [0064]    Sign+Encrypt SK {&lt;content&gt;}. 
         [0065]    With this notation, an example row for an eNB in the SKC would appear as follows: 
         [0000]      Sign eNB1 {ID eNB1 , Encrypt eNB1 {SK UE     —     eNB1 , SPK UE }}. 
         [0066]    Here the key SK UE     —     eNB1  between the UE  110  and eNB 1 , and the key SPK UE , (the same in all the SKC rows for the same UE  110 ) are encrypted with a key shared between the eNB and the core network (Encrypt eNB1 ). These encrypted keys and the eNB identification ID eNB1  is then signed together with the same key so that the receiving eNB can authenticate and verify the integrity of the SKC row. 
         [0067]    The source for the key used for signing (IK) and/or encryption (CK) is presented with the “SK” notion, and the integrity protected and/or encrypted content (&lt;content&gt;) is inside the curly brackets ({}). Note that the signing and encryption procedures can be applied over the same or partially same content multiple times (overlapping signatures). IK and CK may be derived from the SK and RAND as in UMTS. 
         [0068]    A reason for having only integrity protection for most of the messages is, for example, that the contents of the message can be used before the signature is verified (e.g., to derive IK based on the content and then verify the signature based on the derived IK), and also to check that the content is correct before forwarding the message. This allows error detection and tracing in early phases. However, if the signaling messages are not ciphered, they can be more easily mapped together in a handoff situation. 
         [0069]    Referring now to the numbered messages in  FIG. 2 , the description of each is as follows. 
         [0070]    1. UE  110  generates and signs and encrypts a measurement report message  210  that is transmitted to source base station eNB 1   120 . The eNB 1   120  to which UE  110  is attached derives a handover decision to a new (target) Cell located at a target eNB 2   120 ′ based on, e.g., the signed measurement report(s)  210  received from UE  110 . With measurement report  210  UE  110  provides a fresh nonce (Nonce UE ) for the serving-eNB  120  if it has not been sent before. This nonce has not previously been used to create keys. 
         [0071]    The temporal sequence of operations is shown in  FIG. 2 . An aspect of the invention concerning proactive preparation for handoffs is practiced at this stage prior to occurrence of the handoff. Using algorithms known to those skilled in the art UE  110  can calculate with a high degree of probability whether handoff will occur, and to which target eNB 2   120 ′ handoff will be made. Thus it can pre-calculate keys if necessary before a handover command message is received from the serving base station eNB  1   120 . UE  110  additionally can calculate keys for other eNB 2 s that may be selected to receive the handoff. The handoff decision is made by the network based, at least in part, on a load balancing criterion. Thus, UE  110  typically is not sure exactly which target base station eNB 2   120 ′ will receive the handoff. 
         [0072]      FIG. 4  depicts operations typically performed by UE  110  when pre-calculating keys to be used for communicating with the target eNB 2  that is predicted to receive the handoff. At  410 , UE  110  derives SK UE     —     eNB2  based on a Root Key from the core network and the identity (ID eNB2 ) of the predicted target base station eNB 2   120 ′. Next, at  420 , UE  110  derives encryption key CK UE     —     eNB2  and signing key IK UE     —     eNB2  based on SK UE     —     eNB2 , Source base station eNB 1   120  identity (ID eNB1 ), Nonce UE , Nonce NET , and UE_TID. 
         [0073]    2. When source eNB 1   120  receives the measurement report message”  210  it decides whether to initiate a handoff procedure for UE  110 . If it decides to initiate a handoff, source base station eNB 2   120  generates a context data message  212  including at least UE-specific session keys context (SKC) (see again S3-050721, Nokia Security Solution, SAE Security, Nokia contribution to SA3 meeting #41, San Diego, USA, Nov. 15-18, 2005); the received Nonce UE  from UE  110 ; a Nonce NET ; and the UE_TID, along with other RAN context information. UE_TID and RAN context information are encrypted, to protect against eavesdroppers between the source and target eNBs, with a UE-specific SKC Protection Key (SPK UE ) that is shared among the eNBs listed in the UE&#39;s SKC (e.g., each of the rows in the SKC contains the SPK UE  encrypted for the specific eNB). 
         [0074]    Note in this regard that this message does not have a signature from the UE  110 . Thus, the target-eNB  120 ′ does not know if UE  110  is actually coming to target eNB  120 ′ with a completed handoff sequence. This allows pre-distribution of the SKC rows to neighboring eNBs. Further, this allows the serving-eNB to prepare multiple target-eNBs for the UE  110  and may thus reduce the handoff preparation time. 
         [0075]    3. When target eNB 2   120 ′ receives the context data message  212  it performs the operations depicted in  FIG. 5 . At  510 , target eNB 2   120 ′ checks whether the message was targeted to it (ID eNB2 ). This prevents the packet from being replayed by an attacker for multiple eNBs. Then, at  520 , target eNB 2   120 ′ finds and verifies the row from the SKC created for the target eNB 2  initially in the CN. It can be noted that even if the attacker would be able to replay this message, the attacker cannot modify the valid SKC entries. The target eNB 2  also decrypts the SKC entry and retrieves SPK UE  from the SKC entry. Next, at  530 , eNB 2   120 ′ derives CK UE     —     CTX  and IK UE     —     CTX  from SPK UE , and verifies the integrity protection of the Context Data Message  212 . At  540 , eNB 2   120 ′ decrypts the UE_TID, nonces, and the RAN context. Then, at  550 , based on the SK UE     —     eNB2  in the SKC row for the target eNB 2 , nonces, and the UE ‘3 TID, the target eNB 2  derives CK UE     —     eNB2  and IK UE     —     eNB2  for the UE  10 . With the CK UE     —     eNB2  the target eNB 2  at  560  encrypts Radio Link ID (C-RNTI eNB2 ), Context ID (CTXID eNB2 ), and UE_TID. The encrypted content is signed (with IK UE     —     eNB2 ) with eNB 2  id (ID eNB2 ), and the nonces. 
         [0076]    It is noted that upon receipt of the context data message  212  target base station eNB 2   120 ′ is ready to receive UE  110  in case of a reactive handoff, for example because UE  110  looses connection to the source base station eNB 1   120 . 
         [0077]    The target eNB 2   120 ′ then generates and transmits a context confirmation message  214 , where the signed and encrypted contents are included. The message is signed with the IK UE     —     CTX  key derived from SPK UE . 
         [0078]    4. When the source eNB 1   120  receives context confirmation message  214  it forwards the content in a handover command message  216  to UE  110 . The entire message is signed with IK UE     —     eNB1 . 
         [0079]    If a different target base station eNB 2   120 ′ is selected to receive the handoff from that predicted by UE  110 , UE  110  derives new keys using the method depicted in  FIG. 4 . 
         [0080]    5. When UE  110  receives the handover command message  216  it performs the operations depicted in  FIG. 6 . At  610 , UE  110  verifies the signature from eNB 1  (RRC integrity protection). Then, at  620 , UE  110  derives the IK UE     —     eNB2  and CK UE     —     eNB2  for eNB 2  based on the Nonce UE , Nonce NET , Root Key, ID eNB2 , ID eNB1 , and UE_TID. With these keys UE  110  at  630  verifies the signature from target eNB 2  and decrypts the C-RNTI eNB2  and CTXID eNB2 . 
         [0081]    Note that UE  110  cannot derive the target eNB 2  keys before it receives the nonces and the target eNB 2  identity. If it is desired to begin this key derivation process earlier the nonce exchange can be performed earlier (for example in the last handoff signaling or in the beginning of the handoff signaling by adding an additional round trip between the UE  110  and the source eNB). 
         [0082]    UE  110  then completes the handoff to target base station eNB 2   120 ′ by sending a signed and partially encrypted handover confirmation message  218  to target base station eNB 2   120 ′ (which will become the new source base station). This message contains signed content created with keys that UE  110  and the aGW share (IK UE     —     CN , CK UE     —     CN ). This signed content is used as verification by the aGW  205  in path switch message  224  (described below). The Seq number is provided for replay protection. The message is also signed for the eNB 1  to ensure that the source eNB 1  is able to check that the UE  110  was successfully connected to the target eNB 2  (handover completed message  222 , described below). Encryption protects against UE_TID based location tracking (see R3-060035, Security of RAN signaling, Nokia contribution to the joint RAN2/3-SA3 meeting #50, Sophia-Antipolis, France, Jan. 9-13, 2006, incorporated by reference herein). 
         [0083]    6. Target base station eNB 2   120 ′ receives the handover confirmation message  218  and performs the steps depicted in  FIG. 7 . At  710 , eNB 2   120 ′ gets context from eNB 1  based on CTXID eNB1  if not yet in memory. Then, at  720  eNB 2   120 ′ gets a new Nonce NET . Next, at  730 , eNB 2   120 ′ replies to handover confirmation message  218  with a handover confirmation acknowledgement message”  220 ; this contains a new NonceNET and optionally CTXID eNB2  in the case of a reactive HO. 
         [0084]    Upon receipt of the handover confirmation acknowledgement message  220 , UE  110  stores the new Nonce NET  and creates a new Nonce UE . 
         [0085]    7. When target base station eNB 2   120 ′ receives the handover confirmation message  218 , it also forwards it with signature to the source eNB 1  in the handover completed message  222 . Source eNB 1   120  is then able to verify that the message contains correct eNB identities (i.e., source and target) and that it came from the UE  110  (signature and encryption with the key between UE and source eNB 1 ). The original source base station eNB 1   120  releases UE context if necessary at this point. 
         [0086]    8. Target base station eNB 2   120 ′ then sends a signed path switch message  224  to the aGW  205 . This message contains the contents from the handover confirmation message  218  that UE  110  signed for the CN. The UE_TID is also included. 
         [0087]    9. The aGW sends a path switch acknowledgment message  226  to the target eNB 2 . 
         [0088]    As is apparent from  FIG. 2  key derivation is here bound to source eNB 1   120 , which makes it unnecessary to transfer IDs and Nonces over the air in the handover command message  216 . Replay protection is implemented by using integrity-protected sequence numbers. CTXID for reactive handoff is for the source base station eNB 1   120  so that the proper context can be found since UE  110  cannot encrypt the UE_TID (otherwise the source base station  120  would not be able to find the proper decryption key). CTXID is sent to target eNB 2   120 ′ in case of a reactive handoff. Target base station eNB 2   120 ′ finds the context based on the CTXID if it has been distributed to it. 
         [0089]    Reference is now made to  FIG. 3  for illustrating a second exemplary embodiment of an inter-radio access handoff security as a further example of the utility of the exemplary embodiments of this invention.  FIG. 3  differs from  FIG. 2  in the messages  214 ′,  216 ′ and  220 ′ and more specifically differs in transferring the CTXID, C-RNTI and the Nonce(s) in message  220 ′, as opposed to the messages  216 ′ and  220 ′. In other respects the description of  FIG. 2  is herewith incorporated into the description of  FIG. 3 . 
         [0090]    Based on the foregoing, it should be apparent that in accordance with the exemplary embodiments of this invention there are provided methods, apparatus and computer program products for enabling multiple involved nodes to sign messages and use cryptographically separate UE-specific keys for eNBs to thereby facilitate secure handoff procedures and to provide improved performance and simpler error recovery if the UE  10  loses the connection to the serving eNB, especially during handoff, as well as to provide a unification of reactive and proactive handoffs and enhanced security. 
         [0091]    In general, the various embodiments may be implemented in hardware or special purpose circuits, software, logic or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software which may be executed by a controller, microprocessor or other computing device, although the invention is not limited thereto. While various aspects of the invention may be illustrated and described as block diagrams and message flow diagrams, it should be understood that these blocks, apparatus, systems, techniques or methods described herein may be implemented in, as non-limiting examples, hardware, software, firmware, special purpose circuits or logic, general purpose hardware or controller or other computing devices, or some combination thereof. 
         [0092]    One of ordinary skill in the art will understand that computer programs capable of performing methods depicted and described herein can be embodied in a tangible computer-readable storage medium. Such a suitably programmed computer-readable storage medium thus comprises another embodiment of the invention. Instructions of the computer programs embodied in the tangible computer-readable memory medium perform the steps of the methods when executed. Tangible computer-readable memory media include, but are not limited to, hard drives, CD- or DVD ROM, flash memory storage devices or in RAM memory of a computer system. 
         [0093]    Embodiments of the inventions may be practiced in various components such as integrated circuit modules. The design of integrated circuits is by and large a highly automated process. Complex and powerful software tools are available for converting a logic level design into a semiconductor circuit design ready to be etched and formed on a semiconductor substrate. 
         [0094]    Programs, such as those provided by Synopsys, Inc. of Mountain View, Calif. and Cadence Design, of San Jose, Calif. automatically route conductors and locate components on a semiconductor chip using well established rules of design as well as libraries of pre-stored design modules. Once the design for a semiconductor circuit has been completed, the resultant design, in a standardized electronic format (e.g., Opus, GDSII, or the like) may be transmitted to a semiconductor fabrication facility or “fab” for fabrication. 
         [0095]    Various modifications and adaptations may become apparent to those skilled in the relevant arts in view of the foregoing description, when read in conjunction with the accompanying drawings. However, any and all modifications of the teachings of this invention will still fall within the scope of the non-limiting embodiments of this invention. 
         [0096]    For example,  FIGS. 2 and 3  illustrate two exemplary approaches to the message flow between the UE  10 , the eNBs and the aGW, and it is thus possible that those skilled in the art may derive other modifications to the message flow. However, all such and other modifications will still fall within scope of the exemplary embodiments of this invention. 
         [0097]    Furthermore, some of the features of the various non-limiting embodiments of this invention may be used to advantage without the corresponding use of other features. As such, the foregoing description should be considered as merely illustrative of the principles, teachings and exemplary embodiments of this invention, and not in limitation thereof.