Nokia Technologies Oy

Nokia of America Corporation

Alcatel Lucent

Nokia Solutions and Networks Oy

Fujitsu Corporation

Fujitsu Network Communications, Inc.

Jennifer Liu

Li Mo

Abinder S Dhillon

James Alvah Spallin

Alessio Casati

Jussi-Pekka Koskinen

Bruno Landais

Laurent Thiebaut

Hannu Petri Hietalahti

Ulrich Wiehe

Nimer Yaseen

James H Buchanan

Xiao Hu

Badarinath Devalla

Systems and methods that update configuration parameters on a UE using control plane functionalities. In one embodiment, an AMF element of a mobile network receives a control plane message from a UDM element that includes a UE configuration parameter update for the UE. The UE configuration parameter update is security protected via a secured packet, integrity protection, etc. The AMF element is configured to transparently send the UE configuration parameter update to the UE. Thus, AMF element inserts the UE configuration parameter update (that is security protected) in a container of a Non-Access Stratum (NAS) message, and sends the NAS message to the UE. The UE may then update its configuration parameters based on the update when security checks are complete.

Systems and method for secure updates of configuration parameters provisioned in user equipment

An interworking function in a core network system, such as a 5G core network, attempts to establish a secure association with user equipment (UE) in an untrusted access network. When the secure association is not accepted by the 5G core network, the UE receives from the core network a response including a message type indicating that Non-3GPP access to the 5G core network is not allowed. Upon receiving the response message, the UE ends the session by sending a 5G-Stop message formatted in an Extensible Authentication Protocol (EAP) response. The EAP-Response/5G-Stop message includes a message-id field with a 5G Stop value.

Method and apparatus for handling authentication failure during security association establishment

Systems and methods that provide NAS security protection for mobile networks. In one embodiment, a network element of a mobile network performs a NAS procedure in multiple phases to establish a NAS communication session with User Equipment (UE) when no NAS security context exists. For a first phase, the network element receives an initial NAS message from the UE populated with a subset of NAS protocol Information Elements (IEs) designated for security-related handling, selects a NAS security algorithm for the NAS security context, and sends a response to the UE that indicates the NAS security algorithm. For a second phase, the network element receives a subsequent NAS message from the UE having a NAS message container that contains the initial NAS message populated with each of the NAS protocol IEs for the NAS procedure, and decrypts the NAS message container of the subsequent NAS message using the NAS security algorithm.

System and method for security protection of NAS messages

This application relates to session establishment by user equipment over a plurality of heterogenous access networks. In one aspect, the heterogenous access networks may include 3GPP and non-3GPP access networks (). The non-3GPP access networks () may include one or more non-3GPP trusted access networks () or one or non-3GPP, non-trusted access networks ().

Method and apparatus for security realization of connections over heterogeneous access networks

Methods, computer program products, and apparatuses are provided for enabling efficient update of steering of roaming information. An apparatus may include a processor and a memory storing computer program code configured to cause the apparatus to generate a registration request message associated with a user equipment, said registration request comprising a steering of roaming (SoR) information update request, and cause transmission of said registration request message to a network entity of a mobile network. Alternatively, the memory, computer program code, and processor may be configured to cause the apparatus to receive a registration request message comprising an indication of whether a user equipment expects to receive SoR information, and, in an instance in which it is determined that said user equipment expects to receive SoR information, triggering retrieval of said SoR information from a home network of said user equipment.

Methods to enable efficient update of steering of roaming (SOR) information

Techniques for security management in communication systems are provided. For example, a method includes receiving, from user equipment, a request indicating one or more security capabilities of the user equipment. The method also includes determining whether the indicated one or more security capabilities meet one or more designated criteria of a communication network, and rejecting the request by the user equipment responsive to determining that the indicated one or more security capabilities do not meet the one or more designated criteria of the communication network. For example, the request is rejected when it is determined that the user equipment does not support any encryption and/or integrity algorithms, or fails to support mandatory encryption and/or integrity algorithms. This serves to prevent malicious user equipment from gaining access to the communication network.

Management of user equipment security capabilities in communication system

A non-access stratum (NAS) control protocol includes procedures for control plane cellular internet of things (CP-CIOT) service requests and attach requests. A user equipment (UE) in idle mode may transmit an NAS service request message including user data to a mobility management entity (MME) over the control plane. The MME extracts the user data from the NAS service request message and determines a type of the user data. The MME may forward non-IP data to a Service Capability Exposure Function (SCEF) and forward IP data to a packet gateway.

Method and apparatus for CIoT device data transfer

In some example embodiments, there may be provided an apparatus including at least one processor and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to at least: obtain information to enable selection of an access node for a non-GPP access; query a server to determine whether the country at which the access node is located requires lawful interception of communications; and select, based at least on the obtained information and/or a response to the query, the access node for the non-3GPP access. Related systems, methods, and articles of manufacture are also described.

Interception aware access node selection

Various communication systems may benefit from improved network signaling or attachment. A method, in certain embodiments, may include receiving at a network node an initial attachment request message from a user equipment. The method may also include issuing a back-off timer when accepting the initial attachment request from the user equipment. The back-off timer may include a duration of time in which the user equipment is not allowed to reattach to a network. In addition, the method may include receiving at the network node another attachment request message from the user equipment. Further, the method may include determining whether the duration of the back-off timer has lapsed, and rejecting the another attachment request from the user equipment when the duration of time of the back-off timer has not lapsed.

Back-off timer for network reattachment

A non-access stratum (NAS) control protocol includes procedures for control plane cellular internet of things (CP-CIoT) service requests and attach request. UE in idle mode may transmit an NAS service request message including user data to a mobility management entity (MME) over the control plane. The MME extracts the user data from the NAS service request message and determines a type of the user data. The MME may forward non-IP data to a Service Capability Exposure Function (SCEF) and forward IP data to a packet gateway.

A method, apparatus and computer program product are provided for performing a public warning system (PWS) function. In the context of a method, a warning message is received via a first interface. The warning message is provided by a cell broadcast entity. The method includes transforming the warning message. The method further includes causing the warning message, as transformed, to be transmitted via a second interface, different than the first interface, to an access and mobility management function (AMF) for transmission to a radio access network.

Method and apparatus for a generic service interface for a public warning system management and notification

In some example embodiments, there may be provided a method that includes forming, by a user equipment, a session establishment message including an indication of at least one session management capability supported by the user equipment; sending, by the user equipment, the session establishment message including the indication towards a session management function; and receiving, by the user equipment and from the session management function, a response indicative of whether the session management function and/or a corresponding network supports the at least one session management capability to enable the user equipment to operate in accordance with the at least one session management capability. Related systems, methods, and articles of manufacture are also described.

Growing community of inventors

Plano, TX, United States of America

Jennifer Liu