Telefonaktiebolaget Lm Ericsson (publ)

Monica Wifvesson

Noamen Ben Henda

Vesa Lehtovirta

Vesa Torvinen

Prajwol Kumar Nakarmi

Karl Norrman

Christine Jost

Katharina Pfeffer

David Castellanos Zamora

Peter Hedman

Pasi Saarinen

Mikael Wass

Ivo Sedlacek

Qian Chen

Vlasios Tsiatsis

Shabnam Sultana

Gang Ren

Paul Schliwa-Bertling

Håkan Palm

Gunnar Mildh

Mats Näslund

Nicklas Johansson

Zhang Fu

Atle Monrad

Magnus Stattin

Fredrik Lindholm

Mats Folke

Magnus Karlsson

Lars-Bertil Olsson

Cheng Wang

Juying Gan

Michael Liljenstam

Klaus Turina

Mikael Willgert

John Mattsson

Helena Vahidi Mazinani

Maria Esther Bas Sanchez

Åke Arvidsson

Christian Herrero Verón

Patrik Teppo

Martin Kaibel

Hakan Niska

Kyosti Toivanen

Ivo Sedkacek

Kyösti Toivanen

Vesa Matti Torvinen

Vesa Petteri Lehtovirta

Christian Herrero Veron

A method performed by a user equipment, UE, for enabling user plane integrity protection of data in a packet data convergence protocol, PDCP, in a radio access network is provided. The method includes sending a session establishment request towards a session management node that includes an indication of a user plane integrity protection mode supported by the UE. The method further includes receiving an activation message from a receiving radio access node that includes an indication to the UE to activate the user plane integrity protection mode for a data radio bearer established with the receiving radio access node. Methods performed by a session management node, a target access and mobility node, and a radio access node are also provided.

User plane integrity protection

A method performed by a relay UE for determining whether the relay UE may provide a relay service to a remote UE. The method includes the relay UE receiving from the remote UE a first message comprising a first authorization token and a first digital signature for verifying the authenticity of the first authorization token, wherein the first digital signature was generated by a first network function using the first authorization token and a first key, and the first authorization token indicates whether or not the remote UE is authorized to utilize a relay service provided by the relay UE. The method further includes the relay UE verifying the authenticity of the first authorization token.

Relay UE and remote UE authorization

A serving network establishes a connection with a UE via an N3AN using a trusted registration procedure to establish a secure access link between the UE and the serving network via the N3AN. The serving network sends a trust indication message via the N3AN to the UE using the secure access link to identify the N3AN as trusted or untrusted. When the received trust indication message indicates the N3AN is untrusted, the serving network executes an untrusted registration procedure with the UE using the secure access link to establish the connection between the UE and the serving network. When the received trust indication message indicates the N3AN is trusted, the serving network continues execution of the initial registration with the UE using the trusted registration procedure to establish the connection between the UE and the serving network. The UE and serving network exchange messages via the established connection.

Determination of trust relationship of non-3GPP access networks in 5GC

A remote communication device can receive a discovery key; receive a communication key and a key identifier, ID, for the communication key; and discover a relay communication device. Discovering the relay communication device can include receiving an encrypted discovery message from the relay communication device and decrypting the encrypted discovery message using the discovery key. The remote communication device can further transmit a direct communication request to the relay communication device responsive to receiving and decrypting the encrypted discovery message from the relay communication device. The direct communication request can include the key ID for the communication key. The remote communication device can further receive an encrypted direct communication response from the relay communication device. Receiving the encrypted direct communication response can include decrypting the encrypted direct communication response.

Handling application functions for key management in communication device-network relay scenarios

A first communication node may provide first and second NAS connection identifications for respective first and second NAS connections between the first and a second communication node, with the first and second NAS connection identifications being different and the first and second NAS connections being different. A first NAS message may be communicated between the first and second communication nodes over the first NAS connection, including at performing integrity protection for the first NAS message using the first NAS connection identification and/or performing confidentiality protection for the first NAS message using the first NAS connection identification. A second NAS message may be communicated between the first and second communication nodes over the second NAS connection, including performing integrity protection for the second NAS message using the second NAS connection identification and/or performing confidentiality protection for the second NAS message for confidentiality protection using the second NAS connection identification.

Methods providing security for multiple NAS connections using separate counts and related network nodes and wireless terminals

A method by a core network node of a core network of a wireless communication system for authenticating a user equipment, UE, to the core network includes receiving a first authentication request to authenticate the UE to the core network, determining that the UE should be authenticated by an external authentication entity that is external to the wireless communication system, transmitting a second authentication request to the external authentication entity, the second authentication request identifying the UE, receiving an authentication response from the external authentication entity verifying authenticity of the UE, the authentication response including a master key, and deriving a first key for securing communications with the UE from the master key.

Non-public network authentication in 5G

A network node () is configured for use in a wireless communication network (). The network node () receives a request to establish a session (-) for a device (-) in a group (), e.g., a 5G Local Area Network group (). The network node () determines a user plane security policy (-) for the session (!-), based on a user plane security policy () for the group (). The user plane security policy () for the group () may specify a policy for securing a user plane path of a session for any device in the group (). The network node () may then transmit, to an access node of the wireless communication network (), control signaling indicating the determined user plane security policy (-).

Securing the user plane path for a group communication session based on a security policy common to all devices in the group

The present disclosure relates to methods and apparatus for flexible, security context management during AMF changes. One aspect of the disclosure is a mechanism for achieving backward security during AMF changes in idle mode. Instead of passing the current NAS key to the target AMF, the source AMF derives a new NAS key, provides the new NAS key to the target AMF, along with a key change indication indicating that the NAS key has changed. The target AMF sends the key change indication to the user equipment.

Security context handling in 5G during idle mode

According to certain embodiments, a method by a user equipment (UE) for securing network steering information includes transmitting a registration request to a Visited Public Land Mobile Network (VPLMN). Upon successful authentication by an authentication server function (AUSF), a home network root key is generated. A protected message comprising Network Steering Information is received from a first network node. The protected message is protected using a configuration key (Kconf) and a first Message Authentication Code (MAC-1). The configuration key (Kconf) is determined from the home network root key, and the UE verifies the MAC-1. Based on the Kconf and the MAC-1, it is verified that the VPLMN did not alter Network Steering Information. An acknowledgement message, which is protected with a second Message Authentication Code (MAC-2), is transmitted to a Home Public Land Mobile Network (HPLMN).

Securing network steering information

A method performed by a core network node in a core network of a wireless communication system includes receiving a first request to establish a first protocol data unit, PDU, session between a user equipment, UE and a user plane function in the core network, generating user plane, UP, security enforcement information, to be applied to the first PDU session, transmitting the UP security enforcement information to a radio access network, RAN, node for establishing the first PDU session, and storing the UP security enforcement information for use in establishing a subsequent PDU session for the UE.

Establishing a protocol data unit session

A method to operate a UE for handling security policy for user plane protection of communications in a communications system is provided. The method includes transmitting a packet data unit (PDU) session establishment request network access stratum (NAS) message toward an Access and Mobility Management Function (AMF) to establish a PDU session. The method further includes receiving an access network (AN) specific resource setup message indicating whether the UE is to activate integrity protection for data radio bearers (DRBs) serving the PDU session.

Non-orthogonal signaling for radio access networks

In a wireless communication network implementing network slicing (NS), an Initial Access and Mobility Management Function (AMF) for a user equipment (UE) in one NS is able to re-allocate a UE to a Target AMF in a different NS, despite not being able to directly communicate with the Target AMF due to NS security restrictions. In a first embodiment, the Initial AMF transfers the UE context—including its security context—to a Default AMF. The Default AMF has the capability to communicate with network functions in different NSes. The Default AMF transfers the UE context to the Target AMF. In a second embodiment, a security key Kamf' is horizontally derived in a manner that avoids NS security conflicts. The derived key is transferred to the UE and Target AMF, which establish a security context. In a third embodiment, the Initial AMF allocates a Token, and transfers it, along with the UE security context (directly or via RAN) to the Default AMF. The Default AMF then transfers the security context to the Target AMF.

AMF re-allocation due to slicing

A method is provided to operate a CN node to determine UP security activation. A UP session establishment request is obtained for a wireless device. An indication is obtained that the UP session establishment request is associated with an emergency session and/or that null ciphering and/or null integrity protection are applied to a CP associated with a CP session for the wireless device. It is determined that a UP should be configured for the UP session without activating integrity and/or confidentiality protection for the UP based on the indication. A UP security policy is provided to a RAN node associated with the wireless device, wherein the UP security policy indicates to configure the UP for the UP session without activating integrity and/or confidentiality protection based on determining that a UP should be configured for the UP session without activating integrity and/or confidentiality protection.

Methods providing management of emergency sessions and related devices and nodes

A method performed by a UE. The method incudes generating a SUCI comprising: i) an encrypted part in which a Mobile Subscription Identification Number of a SUPI is encrypted and ii) a clear-text part comprising: a) a Mobile Country Code of the SUPI, b) a Mobile Network Code of the SUPI, c) a public key identifier for a public key of a home network of the user equipment, and d) an encryption scheme identifier that identifies an encryption scheme used by the UE to encrypt the Mobile Subscription Identification Number in the SUCI. The method also includes transmitting the SUCI to an authentication server in the home network for forwarding of the SUCI to a de-concealing server capable of decrypting the Mobile Subscription Identification Number.

Privacy key and message authentication code

In some embodiments, a method in a wireless device comprises registering first and second connections with an AMF. The first and second connections share a first security context and connect via first and second access networks, respectively. The method further comprises establishing a second security context with the AMF, setting a flag to a first value based on the second security context having been taken into use on the first connection, and setting the flag to a second value based on the second security context having been taken into use on the second connection. The second value indicates that the second security context has been taken into use on both the first and second connections. The method further comprises retaining the first security context when the flag is set to the first value, and disposing of the first security context after setting the flag to the second value.

First and second connections with an authentication management function

Growing community of inventors

Lund, Sweden

Monica Wifvesson