Patent Document

TECHNICAL FIELD 
       [0001]    The present invention relates to a security solution for group authentication in Machine-Type Communication (MTC). This solution can provide an efficient way for network to perform mutual authentication with all the group MTC UEs (User Equipments). 
       BACKGROUND ART 
       [0002]    The 3GPP (3rd Generation Partnership Project) architecture of MTC is disclosed in NPL 1. The AKA (Authentication and Key Management) procedure disclosed in NPL 2 can be performed individually to achieve mutual authentication. 
       CITATION LIST 
     Non Patent Literature  
       [0003]    NPL 1: 3GPP TS 23.682, “Architecture enhancements to facilitate communications with packet data networks and applications (Release 11)”, V11.2.0, 2012-09 
         [0004]    NPL 2: 3GPP TS 33.401, “3GPP System Architecture Evolution (SAE); Security architecture (Release 12)”, V12.5.1, 2012-10 
         [0005]    NPL 3: 3GPP TR 33.868, “Security aspects of Machine-Type and other Mobile Data Applications Communications Enhancements; (Release 12)”, V0.10.0, 2012-09 
       Patent Literature 
       [0006]    PTL 1: International Patent Publication No. WO 2012/018130 
       SUMMARY OF INVENTION 
     Technical Problem 
       [0007]    However, inventors of this application have found that there are few issues for MTC UEs as follows: 
         [0008]    1) Authentication happens at the same time can overload the network. 
         [0009]    2) MTC UE needs to have mutual authentication to the network not only as an individual but also as a group member. The security requirement has been disclosed in NPL 3: “UE can be verified as legitimate member of a MTC group”. 
         [0010]    3) New keys are needed for securing group messaging. 
         [0011]    The solution proposed in this invention is focused on will be described in the following sections. 
       Solution to Problem 
       [0012]    A few assumptions are made for the present invention as follows: 
         [0013]    1) SCS (Service Capability Server) knows the external group ID (identifier) and can use it to activate a group and communicate with the group of MTC UEs. 
         [0014]    2) MTC UEs are preconfigured with the group ID(s) that they can belong to and communicate through. 
         [0015]    3) MTC UEs are optionally preconfigured with a public group key. 
         [0016]    Note, in the description of this invention, MME (Mobility Management Entity) is used as an example but the mechanism should be the same for SGSN (Serving GPRS (General Packet Radio Service) Support Node) and MSC (Mobile Switching Centre). 
         [0017]    When the SCS first time actives a group of MTC UEs, it triggers the UEs by sending a trigger message with indication of trigger.type=“activate group”. When MTC-IWF (MTC Inter-Working Function) receives such type of trigger it will request subscriber information from HSS (Home Subscriber Server) by sending Subscriber Information Request. HSS will perform verification of whether such group exists and whether it can be triggered by the SCS and finds which are the possible MMEs. HSS pushes the routing information of MMEs to MTC-IWF, MTC-IWF will then forward the trigger to the serving MMEs. MME forwards it to group GW (gateway) and group GW broadcasts it to the UEs. The trigger contains local group ID and trigger ID. Only UEs which preconfigured the same group ID should respond to it and start the Attach procedure.  
         [0018]    Since this is first time UE attaches to network, AKA procedure will be started by network. The concept is to re-use AKA procedure disclosed in NPL 2. However, instead of authenticating the UE individually, MME sends all the authentication request in a concatenated message and group GW distributes that to UEs. In the same way for Authentication Response, group GW receives them from all the UEs and sends them in a concatenated message to MME. By doing this, the network usage can be reduced. 
         [0019]    Verification of whether UE belongs to this group is carried at network before authentication. 
         [0020]    The group gateway (GW) was proposed in a separate invention of PTL 1. The group GW receives (group) message and send it to MTC devices. It sends concatenated messages for MTC device communicating with network or SCS. It can be an independent node or a logical function installed in eNB (evolved Node B), MME/SGSN/MSC, HSS or MTC-IWF. When it is installed in eNB, broadcasting is used for sending messages to UEs. When it is installed in MME/SGSN/MSC, multicasting is used. Note that each of the MTC Device and the above-described MTC UE is a UE equipped for MTC, therefore the terms “MTC Device” and “MTC UE” are the same in meaning through the whole description of this application. 
       Advantageous Effects of Invention 
       [0021]    According to the present invention, it is possible to solve at least one of the above-mentioned issues. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0022]      FIG. 1  is a block diagram showing a configuration example of a communication system according to an exemplary embodiment of the present invention. 
           [0023]      FIG. 2  is a sequence diagram showing a part of an operation example of the communication system according to the exemplary embodiment. 
           [0024]      FIG. 3  is a sequence diagram showing the remaining part of the operation example of the communication system according to the exemplary embodiment. 
           [0025]      FIG. 4  is a block diagram showing a configuration example of an MTC device according to the exemplary embodiment. 
           [0026]      FIG. 5  is a block diagram showing a configuration example of a gateway according to the exemplary embodiment. 
           [0027]      FIG. 6  is a block diagram showing a configuration example of a first network node according to the exemplary embodiment. 
           [0028]      FIG. 7  is a block diagram showing a configuration example of a second network node according to the exemplary embodiment. 
           [0029]      FIG. 8  is a block diagram showing a configuration example of a third network node according to the exemplary embodiment. 
           [0030]      FIG. 9  is a block diagram showing a configuration example of a server according to the exemplary embodiment. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0031]    Hereinafter, an exemplary embodiment of the present invention will be described with reference to the accompanying drawings. 
         [0032]    As shown in  FIG. 1 , a communication system according to this exemplary embodiment includes a core network (3GPP network), and a plurality of MTC UEs  10  which connect to the core network through a RAN (Radio Access Network). While the illustration is omitted, the RAN is formed by a plurality of base stations (i.e., eNBs). 
         [0033]    The MTC UEs  10  attach to the core network. The MTC UEs  10  can host one or multiple MTC Applications. The corresponding MTC Applications are hosted on one or multiple ASs (Application Servers).  
         [0034]    Further, the core network includes, as network elements, an MME  30 , an HSS  40  and an MTC-IWF  50 . The MTC-IWF  50  serves as a gateway to the core network for an SCS  60 . The HSS  40  stores subscription information on a group of MTC UEs. The MME  30 , as well as an SGSN and an MSC relay traffic between the MTC UEs  10  and the MTC-IWF  50 . 
         [0035]    Furthermore, a group GW  20  shown in  FIGS. 2 and 3  serves as a gateway to the core network for the MTC UEs  10 . The group GW  20  may be an independent node placed within the core network or the RAN, or may be a logical function installed in the eNB, MME, SGSN, MSC, HSS or MTC-IWF. 
         [0036]    Next, operations in this exemplary embodiment will be described with reference to  FIGS. 2 and 3 .  FIGS. 2 and 3  gives detailed message sequence description of how the SCS  60  activates a group of devices (MTC UEs) which are pre-configured with a local group ID. 
         [0037]    Step S 1 : SCS  60  has stored the external group ID. 
         [0038]    Step S 2 : HSS  40  has subscription information of a group and its member UEs  10 _ 1  to  10   —   n  (n≧2). 
         [0039]    Step S 3 : Each of UEs  10 _ 1  to  10   —   n  in the group has pre-configured local group ID and optionally public group key. 
         [0040]    Step S 4 : SCS  60  sends a trigger to MTC-IWF  50 , with trigger type of activate group, including external group ID, SCS ID and trigger ID. 
         [0041]    Step S 5 : MTC-IWF  50  sends Subscriber Information Request, reuse the message disclosed in NPL 1, with external group ID, indication of activate group request and the source SCS ID. 
         [0042]    Step S 6 : HSS  40  performs the verification of whether the external group ID is valid, whether any data available about this group, if SCS can trigger to activate the group, is there already a local group ID mapped to it. 
         [0043]    Step S 7 : After proper verification, HSS  40  sends the Subscriber Information Response message to MTC-IWF  50 , with local group ID and serving MMEs. 
         [0044]    Step S 8 : Optionally, HSS  40  can send information necessary for the verification and MTC-IWF  50  performs the verification. 
         [0045]    Step S 9 : MTC-IWF  50  forwards the trigger message to MME  30 , with local group ID and trigger method of broadcast. 
         [0046]    Step S 10 : MME  30  retrieves the MTC UE subscription data and the private group key. 
         [0047]    Step S 11 : MME  30  forwards the trigger to group GW  20 . 
         [0048]    Step S 12 : Group GW  20  broadcast the trigger, with a trigger type of e.g. callAttach, which UEs  10 _ 1  to  10   —   n  can understand. The trigger includes local group ID and trigger ID. 
         [0049]    Step S 13 : When each of UEs  10 _ 1  to  10   —   n  receives the trigger, it verifies if the local group ID in the broadcast trigger is the same with the one it has pre-configured. If not, it ignores the broadcast. If the group ID is the same, each of UEs  10 _ 1  to  10   —   n  starts the attach procedure. 
         [0050]    Step S 14 : UEs  10 _ 1  to  10   —   n  which have the same local group ID send Attach Request with IMSI as in standardized Attach Request and also the trigger ID it received. 
         [0051]    Step S 15 : Group GW  20  sends a concatenated Attach Request to MME  30 , it contains the Attach Request messages from all the UEs. 
         [0052]    Step S 16 : MME  30  performs the verification of whether the timer of response is expired, whether the UEs whom responded belong to the group and which are the UEs have not responded yet. 
         [0053]    Step S 17 : MME  30  sends Authentication Request (reusing standardized message disclosed in NPL 2, but in a concatenated message. 
         [0054]    Step S 18 : Group GW  20  distributes the Authentication Request to the UEs  10 _ 1  to  10   —   n , this can be optionally protected by private group key such that UEs  10 _ 1  to  10   —   n  can verify whether the group GW  20  is an authenticated network element, with their pre-configured public group key. 
         [0055]    Step S 19 : Each of UEs  10 _ 1  to  10   —   n  responds Authentication Response. 
         [0056]    Step S 20 : Group GW  20  sends Authentication Response from all the UEs  10 _ 1  to  10   —   n  in a concatenated message. 
         [0057]    Step S 21 : MME  30  performs authentication for the UEs  10 _ 1  to  10   —   n.    
         [0058]    Step S 22 : MME  30  sends Authentication Reject messages to UE, if the authentication failed. 
         [0059]    Steps S 23  and S 24 : MME  30  reports authentication failure to SCS  60  through MTC-IWF  50 . 
         [0060]    Step S 25 : NAS (Non Access Stratum) and AS key management according to standardized procedure disclosed in NPL  2 , with MME  30  sending the concatenated message and group GW  20  distributing it to UEs  10 _ 1  to  10   —   n  for downlink and group GW  20  concatenating the messages from UEs  10 _ 1  to  10   —   n  and sending to MME  30  for uplink. 
         [0061]    Step S 26   a : MME  30  sends NAS SMC (Security Mode Command) messages in concatenated message which includes the new group keys encrypted by NAS key. 
         [0062]    Step S 26   b : Group GW  20  distributes the NAS SMC message containing encrypted new group keys to the UEs  10 _ 1  to  10   —   n.    
         [0063]    Step S 27   a : MME  30  sends Attach Accept messages in concatenated message which includes the new group keys. 
         [0064]    Step S 27   b : Group GW  20  distributes the Attach Accept message with new group keys to the UEs  10 _ 1  to  10   —   n.     
         [0065]    Note that the new group keys in Step S 26  and Step S 27  are the same as in our previous patent file PTL 1, that they are a pair of keys for confidentiality and integrity protection. 
         [0066]    Next, configuration examples of the MTC UE  10 , the group GW  20 , the MME  30 , the HSS  40 , the MTC-IWF  50  and the SCS  60  according to this exemplary embodiment will be described with reference to  FIGS. 4 to 9 . Note that in the following explanation, there will be described only elements which specific to this exemplary embodiment. However, it will be understood that the MTC UE  10 , the group GW  20 , the MME  30 , the HSS  40 , the MTC-IWF  50  and the SCS  60  also include elements for functioning as typical MTC UE, GW, MME, HSS, MTC-IWF and SCS, respectively. 
         [0067]    As shown in  FIG. 4 , the MTC UE  10  includes an inclusion unit  11 . The inclusion unit  11  includes the received trigger ID in the Attach Request message as shown at step S 14  in  FIG. 3 . This inclusion unit  11  can be configured by, for example, a transceiver which conducts communication with the SCS  60  through the core network, and a controller such as a CPU (Central Processing Unit) which controls this transceiver. 
         [0068]    As shown in  FIG. 5 , the group GW  20  includes at least one of an addition unit  21  and a protection unit  22 . The addition unit  21  adds the indication of trigger type=“callAttach” to the trigger message as shown at step S 12  in  FIG. 2 . The protection unit  22  protects the Authentication Request message with the private group key as shown at step S 18  in  FIG. 3 . Note that these units  21  and  22  are mutually connected with each other through a bus or the like. These units  21  and  22  can be configured by, for example, a transceiver which conducts communication with the MTC UE  10 , and a controller such as a CPU which controls this transceiver. 
         [0069]    As shown in  FIG. 6 , the MME  30  includes at least an inclusion unit  31 . For example, the inclusion unit  31  includes the new group keys in the Attach Accept message as shown at step S 27  in  FIG. 3 . Alternatively, the inclusion unit  31  includes the new group keys in the NAS SMC message as shown at step S 26  in  FIG. 3 . In the latter case, it is preferable that the MME  30  further includes an encryption unit  34 . The encryption unit  34  encrypts the new group keys with the NAS keys. In addition to or as a substitute for the encryption unit  34 , the MME  30  can include a concatenation unit  32  and a send unit  33 . The concatenation unit  32  concatenates the messages addressed to the MTC UEs  10 _ 1  to  10   —   n  as shown at Steps S 17  and S 25  in  FIG. 3 . The send unit  33  sends the concatenated message to the group GW  20 . Note that these units  31  to  34  are mutually connected with each other through a bus or the like. These units  31  to  34  can be configured by, for example, a transceiver which conducts communication with the MTC UE  10  through the group GW  20 , and a controller such as a CPU which controls this transceiver. 
         [0070]    As shown in  FIG. 7 , the HSS  40  includes a verification unit  41  which performs the verification as shown at step S 6  in  FIG. 2 . This verification unit  41  can be configured by, for example, a transceiver which conducts communication with the MTC-IWF  50 , and a controller such as a CPU which controls this transceiver. 
         [0071]    As shown in  FIG. 8 , the MTC-IWF  50  includes an instruction unit  51 . The instruction unit  51  instructs the group GW  20  to broadcast the trigger message, for example by using the indication of trigger method=“broadcast” as shown at step S 9  in  FIG. 2 . This instruction unit  51  can be configured by, for example, a transceiver which conducts communication with the group GW  20  through the MME  30 , and a controller such as a CPU which controls this transceiver. 
         [0072]    As shown in  FIG. 9 , the SCS  60  includes a send unit  61 . The send unit  61  sends, to the MTC-IWF  50 , the trigger message includes the indication of trigger type=“activate group” as shown at step S 4  in  FIG. 2 . This send unit  61  can be configured by, for example, a transceiver which conducts communication with the MTC UE  10  through the core network, and a controller such as a CPU which controls this transceiver. 
         [0073]    Note that the present invention is not limited to the above-mentioned exemplary embodiment, and it is obvious that various modifications can be made by those of ordinary skill in the art based on the recitation of the claims. 
         [0074]    The whole or part of the exemplary embodiment disclosed above can be described as, but not limited to, the following supplementary notes. 
       (Supplementary Note 1) 
       [0075]    Introduced a new trigger type “activate group” in the trigger message, which is sent over interface Tsp, T5, and the interface between MME/SGSN/MSC and UE. 
       (Supplementary Note 2)  
       [0076]    Introduced “broadcast” as a new trigger delivery method. 
       (Supplementary Note 3) 
       [0077]    Authentication Request can be protected by private group key. 
       (Supplementary Note 4) 
       [0078]    Introduced trigger field in the broadcasting message to indicate it is to call MTC UE to start Attach procedure. 
       (Supplementary Note 5) 
       [0079]    New function for HSS of verification to determine whether the external group is valid. 
       (Supplementary Note 6) 
       [0080]    Included “trigger ID” in Attach Request message. 
       (Supplementary Note 7) 
       [0081]    Sending the encrypted new group keys in NAS SMC message. 
       (Supplementary Note 8) 
       [0082]    Or sending the new group keys in Attach Accept message which has NAS security protection. 
         [0083]    This application is based upon and claims the benefit of priority from Japanese patent application No. 2012-267255, filed on Dec. 6, 2012, the disclosure of which is incorporated herein in its entirety by reference. 
       REFERENCE SIGNS LIST 
       [0000]    
       
           10 ,  10 _ 1 - 10   —   n  MTC UE 
           11 ,  31  INCLUSION UNIT 
           20  GROUP GW 
           21  ADDITION UNIT 
           22  PROTECTION UNIT 
           30  MME 
           32  CONCATENATION UNIT 
           33 ,  61  SEND UNIT 
           34  ENCRYPTION UNIT 
           40  HSS 
           41  VERIFICATION UNIT 
           50  MTC-IWF 
           51  INSTRUCTION UNIT 
           60  SCS

Technology Category: 5