State Transitions and Mobility

A UE transitioning between RRC_IDLE to RRC_CONNECTED must have its RRC and UP protection keys generation while NAS and higher layer protection keys are assumed to be already available in the MME. Higher layer keys may have been established in the MME as a result of an AKA run, or as a result of transfer from another MME during handover or idle mode mobility.

When transitioning between RRC_CONNECTED to RRC_IDLE, eNBs delete all the keys they store such that the state for IDLE mode has be maintained only at in the MME. The eNB will also not be storing any state information about the corresponding UE. Specifically, both the eNB and the UE will delete NH, K_eNB, K_RRCenc, K_RRCint, K_UPenc and related NCC, but the MME and the UE will maintain the K_ASME, K_NASint and K_NASenc.

Figure 14.4 Key Handling during Handover. Reproduced by permission of © 2010 3GPP. Further use is strictly prohibited.

During mobility, the key hierarchy does not allow explicit RRC and UP key updates, but RRC and UP keys are derived based on algorithm identifiers and K_eNB which results with new RRC and UP keys at every handover. Figure 14.4 shows the model for key handling during handover. The handling proceeds as follows.

Whenever an initial AS security context needs to be established between UE and eNB, MME and the UE shall derivate a K_eNB a NH, both of which are derived from the K_ASME. The UE and the eNB use the K_eNB to secure the communication between each other. On handovers, the basis for the K_eNB that will be used between the UE and the target eNB, called K_eNB*, is derived from either the currently active K_eNB or from the NH parameter. The former derivation is called a horizontal key derivation, while the latter is called a vertical key derivation. On handovers with vertical key derivation the NH is further bound to the target PCI and its frequency (EARFCN-DL) before it is taken into use as the K_eNB in the target Enb. On handovers with horizontal key derivation the currently active K_eNB is further bound to the target PCT and its frequency before it is taken into use as the K_eNB in the target eNB.