Intel Corporation

Apple Inc.

Abhijeet Ashok Kolekar

Farid Adrangi

Alexandre Saso Stojanovski

Ching-Yu Liao

Bharat Shrestha

Sudeep K Palat

Robert Zaus

Ahmed M Soliman

Qian Li

Sangeetha L Bangolae

Karthik Veeramani

Meghashree Dattatri Kedalagudde

Jaemin Han

Zongrui Ding

Inching Chen

Thomas Luetzenkirchen

Ashish Singhi

Raimund Wloka

Youn Hyoung Heo

Vivek G Gupta

Sameer S Sharma

Lin Han

Ajit P Joshi

Preston Joel Hunt

Stephen S Ing

Anees A Sahib

Royce Fernald

Amr Mostafa

Xiaopeng Tong

Neal P Smith

Babu P Lukose

Mario Barba Garcia

Ooi Ping Chuin

Sivakumar Murugesu

Andrey Larionov

Yang Su Ming

Allen Hung

Tung Ean Ean

Jose Gerardo Galindo Valadez

Armando Rubio Torroella

Ivan Gomes Castellanos

Soo Phing Tan

Chan Wai Phang

Ooi Joo Aik

Tan Zheng Jing

Chai Eong Boo

Evan A Edstrom

Anisha Allada

Adrian Ortega Garcia

Shing Yung Lo

Puneet Jain

Soon Yueh Shen

Ong Gee Tat

Alan Previn Teres Alexis

An apparatus and system for onboarding based on UE default manufacturer credentials are described. A UE sends default manufacturer credentials and an indication to proceed with restricted onboarding to an onboarding non-public network (O-SNPN). An Onboarding Server validates the authenticity of the UE based on the manufacturer credentials and sends a certificate. The UE is provisioned with a set of roots of trust certificate information to use to authenticate the certificate using one way authentication. After authentication, the UE receives network credentials and performs mutual authentication to register with a NPN while being authenticated by a home network. The UE identity is indicated as anonymous in response to an indication by the O-SNPN for subscriber identifier privacy.

UE onboarding and provisioning using one way authentication

This disclosure describes systems, methods, and devices related to service function chaining in wireless networks. A communications system may include a communication control function to select one or multiple communication service functions associated with establishing service function chaining (SFC) services for telecommunications; a service orchestration and chaining function (SOCF) to establish the SFC services; and a service orchestration exposure function (SOEF) to expose the SFC services to an application function (AF) of the system.

Enhanced service function chaining in next generation cellular networks

This disclosure describes methods, systems, and devices for uplink data integrity protection in a communication system including a radio access network (RAN) serving a user equipment (UE) operating in an Early Data Transmission (EDT) configuration. In one example, a method involves generating a hash marker based on a packet data convergence protocol (PDCP) control protocol data unit (PDU) or service data unit (SDU). The method also involves transmitting a message including the hash marker to the RAN.

Integrity protection of uplink data

Systems and methods are provided to control traffic accessing a public land mobile network service (PLMN) at a non-public network to perform local breakout for selected traffic.

Systems, methods, and devices for privacy and control of traffic accessing PLMN service at a non-public network

Systems, devices, and techniques for handover and false base station detection in a wireless communication network are described. A described technique performed by a user equipment (UE) includes receiving, from a source base station of a wireless network, a handover command to indicate a handover to a target base station for communication in the wireless network; receiving information from the target base station; determining whether the target base station is a legitimate base station of the wireless network based on the information from the target base station and handover information included in the handover command; and performing a handover based on the handover command and a determination that the target base station is the legitimate base station.

Methods of detecting fake base station by UE during handover

An apparatus and system to enable dynamic offloading and execution of compute tasks are described. In split CU-DU RAN architectures, the CU-CP is connected with multiple compute control functions (CF) and service functions (SF) that have different computing hardware/software capabilities. Different architectures depend on whether the SF is collocated with the CU-UP, the CU-UP and SF only serve compute messages, a compute message is supplied directly to the CU-UP or also traverses the CU-CP. In response to reception from a UE of a compute message containing data for computation being sent to the CU-CP through the DU, the CU-CP sends the data to the SF with identifiers and sends the result to the UE.

Computing workload transport over control plane in next generation cellular networks

Systems, methods, and devices authenticate mobile network cellular cells using asymmetric/public-key cryptography algorithms (e.g., Digital Signature Algorithm (DSA)) through integrity protecting the cellular cells broadcasted messages (e.g., paging and/or system information blocks (SIBs) system information broadcast messages) by message authentication code (MAC).

Mobile cellular networks authenticated access

Systems and methods of protecting an initial NAS message are described. Depending on whether a security context for a serving PLMN is stored, the UE uses either a public key from the serving PLMN or a key from the security context to encrypt parts of the initial NAS message. An initial NAS message containing the encrypted parts is then sent to an AMF of the serving PLMN. The serving PLMN public key is transmitted via a SIB. Prior to transmission of the initial NAS message or in parallel with it, an RRC message is sent to the base station. The RRC message contains the UE identifier and/or a NSSAI encrypted using the serving PLMN public key.

Protection of initial non-access stratum protocol message in 5G systems

Various embodiments herein provide techniques for discovery and handling of regulatory requirements for non-3GPP inter-working function (N3IWF) selection, e.g., to access a standalone non-public network (SNPN). In embodiments, a user equipment (UE) may determine the local requirement in a country using a domain name system (DNS) query with a fully qualified domain name (FQDN) associated with the N3IWF. Other embodiments may be described and claimed.

Domain name system (DNS)-based discovery of regulatory requirements for non-3GPP inter-working function (N3IWF) selection

Systems and methods of protecting an initial NAS message are described. The NAS message is encrypted using the home PLMN public key during initial registration with the network using a registration request message. An AMF of the serving PLMN sends a serving PLMN public key which is then used to encrypt information including an S-NSSAI of later initial NAS messages after initial registration is completed. The S-NSSAI may not be sent in the later initial NAS message if the S-NSSAI is provided at an access stratum level. The RRC message may contain an indication that the S-NSSAI is encrypted using the serving PLMN public key.

Systems and methods are provided to control traffic accessing a public land mobile network service (PLMN) at a nonpublic network to perform local breakout for selected traffic.

Embodiments disclosed herein relate to allowing unauthenticated UEs to gain restricted access to an operator network to access network access subscription service. Once the unauthenticated UE successfully downloads a subscription profile for accessing the operator network, the unauthenticated UE can disconnect and can, thereafter, authenticate to the operator network using the subscription profile. Embodiments disclosed herein can perform one-way authentication to the operator network for obtaining a limited connectivity to reduce DoS attacks on the operator network. More specifically, these embodiments can support unauthenticated UEs to allow unauthenticated UEs to access the operator network for RLOS while minimizing DoS attack.

Evolved packed core (EPC) solution for restricted local operator services (RLOS) access using device authentication

Packet protection is described. Data of a group of packets is concatenated with a security key and a sequence number of the packet. A hash mark of the concatenated data is calculated and sent with data or control information in a packet. If each packet has reserved bits, at least some of the packets each has data, a least a portion of the hash mark, and a header having: a first bit that indicates if the hash mark is present, and a second bit that indicates if the packet is used to determine the hash mark. Otherwise, a separate control packet is sent that contains the hash mark, a first sequence number of the group of packets, and a PDU type indicating that the control packet is an integrity protection packet for the group of PDCP packets.

Integrity protection for frequent small data transmission

Disclosed embodiments are related to Management Data Analytics (MDA) relation with Self-Organizing Network (SON) functions and coverage issues analysis use case. Other embodiments may be described and/or claimed.

Secure user equipment capability transfer for user equipment with no access stratum security

Embodiments of the present disclosure describe methods, apparatuses, storage media, and systems for performing a restricted local operator services (RLOS) authorization procedure. Various embodiments enable a network to authorize a user equipment (UE) with an RLOS access or subscription properly while aiding in minimizing or preventing potential denial-of-service (DoS) attacks. Other embodiments may be described and claimed.

Techniques in evolved packet core for restricted local operator services access

Growing community of inventors

Hillsboro, OR, United States of America

Abhijeet Ashok Kolekar