Telefonaktiebolaget Lm Ericsson (publ)

Helena Vahidi Mazinani

Vesa Lehtovirta

Noamen Ben Henda

Christine Jost

Prajwol Kumar Nakarmi

David Castellanos Zamora

Cheng Wang

Paul Schliwa-Bertling

Monica Wifvesson

Christofer Lindheimer

Ivo Sedlacek

Juha Kujanen

Markus Hanhisalo

Ben Henda Noamen

A method for a user equipment (UE) to obtain security credentials for accessing a non-public network (NPN) is provided. The method comprises sending, to an onboarding network (ON), a registration request that includes an identifier of the UE, and obtaining an indication of a credential provisioning protocol (CPP) used by a provisioning server (PS) for provisioning security credentials to access the NPN. The method further comprises obtaining, from the PS via the ON using the indicated CPP, security credentials for the UE to access the NPN.

Indication of provisioning protocol for credentials to access a non-public network

A wireless device () receives, over an access stratum (), a capability enquiry () that requests the wireless device () to transmit capability information () indicating one or more capabilities of the wireless device (). After receiving the capability enquiry (), the wireless device () generates a token () using one or more input parameters () and transmits the token (). The one or more input parameters () include at least some part of the capability enquiry () and/or at least some of the capability information (). In some embodiments, the token () is generated or transmitted based on a non-access stratum security context () at the wireless device (). The wireless device () also transmits the capability information () over the access stratum ().

Protecting capability information transfer in a wireless communication network

A serving network establishes a connection with a UE via an N3AN using a trusted registration procedure to establish a secure access link between the UE and the serving network via the N3AN. The serving network sends a trust indication message via the N3AN to the UE using the secure access link to identify the N3AN as trusted or untrusted. When the received trust indication message indicates the N3AN is untrusted, the serving network executes an untrusted registration procedure with the UE using the secure access link to establish the connection between the UE and the serving network. When the received trust indication message indicates the N3AN is trusted, the serving network continues execution of the initial registration with the UE using the trusted registration procedure to establish the connection between the UE and the serving network. The UE and serving network exchange messages via the established connection.

Determination of trust relationship of non-3GPP access networks in 5GC

Network equipment () is configured as a proxy () for one of multiple different core network domains of a wireless communication system (). The network equipment () is configured to receive a message () that has been, or is to be, transmitted between the different core network domains. The network equipment () is further configured to perform inter-domain security measures according to a security policy (). The security policy () may indicate which one or more portions of (e.g., the content of a field in) the message () are to be used by inter-domain security measures (e.g., inter-domain anti-spoofing measures) and/or which types of messages are to be used by the inter-domain security measures.

Message transmission between core network domains

A method performed by a network server is provided for authentication and key management for a terminal device in a wireless communication network. The method includes authenticating the terminal device during a primary authentication session for the terminal device. The method further includes responsive to a successful authentication of the terminal device, obtaining a first key. The method further includes generating bootstrapping security parameters. The parameters include a second key derived from the first key and a temporary identifier. The temporary identifier identifies the terminal device and the bootstrapping security parameters.

Methods for authentication and key management in a wireless communications network and related apparatuses

A method of providing authentication at a communication device is provided. A primary authentication is run with a Trusted Non-3GPP Gateway Function TNGF node to obtain a TNGF Key (K). A re-authentication Root Key (rRK) is provided based on the TNGF key. A re-authentication Master Session Key (rMSK1) is derived based on the re-authentication Root Key. A security setup is performed with a Trusted Non-3GPP Access Point TNAP using the re-authentication Master Session Key. Related methods of performing authentication using a Trusted Non-3-GPP Gateway Function are also discussed.

Methods providing bootstrapping

A first network node operating in a telecommunications network can receive an authentication request associated with a communication device requesting registration with the telecommunications network. The authentication request can include first subscriber information. The first network node can determine that the first subscriber information includes an anonymous identifier. Responsive to determining that the first subscriber information includes the anonymous identifier, the network node can determine an authentication procedure to be performed. The network node can receive information associated with the communication device as part of the authentication procedure. The network node can generate second subscriber information based on the information associated with the communication device.

Subscription retrieval for anonymous identification

A method performed by a network equipment of a communication network to dynamically provide trust information to a communication device registered or being registered to the communication network is provided. The method includes determining a trust information for each of one or more access networks. The trust information indicates whether each of the one or more access networks is trusted. The method further includes indicating to the communication device whether the one or more access networks is trusted for a current session or a later session. A method performed by a communication device registered or being registered with a communication network to dynamically receive trust information is also provided. The method includes receiving a message including a protected trust information list from a network equipment. The method further includes verifying the protection of the message. The method further includes storing the protected trust information list.

Methods for trust information in communication network and related communication equipment and communication device

A method for key derivation for non-3GPP access. The method includes determining a particular non-3GPP access type, wherein the particular non-3GPP access type is one of N different particular non-3GPP access types (N>1), and each one of the N particular non-3GPP access types is associated with a unique access type distinguisher value. The method also includes generating (s) a first access network key using a key derivation function and the unique access type distinguisher value with which the determined particular non-3GPP access type is associated, thereby generating a first access network key for the particular non-3GPP access type.

Key derivation for non-3GPP access

A method of operating a network device in a serving network for providing regulation compliant privacy in a communications network is provided. Operations of such methods include obtaining a concealed subscription identifier from a user equipment, UE, that is associated with a home network, HN, obtaining a permanent subscription identifier that is associated with the concealed subscription identifier from the HN, determining whether the concealed subscription identifier from the UE corresponds to the permanent subscription identifier from the HN, and responsive to determining that the concealed subscription identifier from the UE corresponds to the permanent subscription identifier from the HN, performing further operations to provide service to the UE.

Methods for providing regulation compliant privacy and related apparatuses

A method performed by a wireless device () includes determining whether a first message received from a network node () includes an Authentication and Key Management for Applications (AKMA) key indicator and, based on whether the first message includes the AKMA indicator, determining whether to generate AKMA key material for the authentication procedure with the network.

Growing community of inventors

Lund, Sweden

Helena Vahidi Mazinani