Telefonaktiebolaget Lm Ericsson (publ)

Noamen Ben Henda

Monica Wifvesson

Vesa Torvinen

Vesa Lehtovirta

Christine Jost

Prajwol Kumar Nakarmi

David Castellanos Zamora

Karl Norrman

Peter Hedman

Qian Chen

Ivo Sedlacek

Mikael Wass

Katharina Pfeffer

Helena Vahidi Mazinani

Paul Schliwa-Bertling

Shabnam Sultana

Pasi Saarinen

Lars-Bertil Olsson

Håkan Palm

Vlasios Tsiatsis

Jörgen Axell

Gunnar Mildh

Mats Näslund

Gang Ren

Juha Kujanen

Markus Hanhisalo

Magnus Stattin

Mats Folke

Magnus Karlsson

Cheng Wang

Zhang Fu

Henrik Normann

Fredrik Lindblom

Security and privacy mechanisms are provided to protect the L2 identifiers used in groupcast communications over the sidelink (e.g., PC5 interface) without requiring a UE to periodically refresh the L2 identifiers, which may cause extra signaling overhead, increased latency and greater risk of synchronization issues. To prevent tracking of a UE, a group identifier (ID) is used as a source layer 2 (L2) ID in groupcast messages. Additionally, a message authentication code (MAC) is introduced into the group discovery procedure to authenticate the UE sending a group discovery request.

Privacy protection for sidelink communications

A method performed by a network server is provided for authentication and key management for a terminal device in a wireless communication network. The method includes authenticating the terminal device during a primary authentication session for the terminal device. The method further includes responsive to a successful authentication of the terminal device, obtaining a first key. The method further includes generating bootstrapping security parameters. The parameters include a second key derived from the first key and a temporary identifier. The temporary identifier identifies the terminal device and the bootstrapping security parameters.

Methods for authentication and key management in a wireless communications network and related apparatuses

A first communication node may provide first and second NAS connection identifications for respective first and second NAS connections between the first and a second communication node, with the first and second NAS connection identifications being different and the first and second NAS connections being different. A first NAS message may be communicated between the first and second communication nodes over the first NAS connection, including at performing integrity protection for the first NAS message using the first NAS connection identification and/or performing confidentiality protection for the first NAS message using the first NAS connection identification. A second NAS message may be communicated between the first and second communication nodes over the second NAS connection, including performing integrity protection for the second NAS message using the second NAS connection identification and/or performing confidentiality protection for the second NAS message for confidentiality protection using the second NAS connection identification.

Methods providing security for multiple NAS connections using separate counts and related network nodes and wireless terminals

A method by a core network node of a core network of a wireless communication system for authenticating a user equipment, UE, to the core network includes receiving a first authentication request to authenticate the UE to the core network, determining that the UE should be authenticated by an external authentication entity that is external to the wireless communication system, transmitting a second authentication request to the external authentication entity, the second authentication request identifying the UE, receiving an authentication response from the external authentication entity verifying authenticity of the UE, the authentication response including a master key, and deriving a first key for securing communications with the UE from the master key.

Non-public network authentication in 5G

A network node () is configured for use in a wireless communication network (). The network node () receives a request to establish a session (-) for a device (-) in a group (), e.g., a 5G Local Area Network group (). The network node () determines a user plane security policy (-) for the session (!-), based on a user plane security policy () for the group (). The user plane security policy () for the group () may specify a policy for securing a user plane path of a session for any device in the group (). The network node () may then transmit, to an access node of the wireless communication network (), control signaling indicating the determined user plane security policy (-).

Securing the user plane path for a group communication session based on a security policy common to all devices in the group

The present disclosure relates to methods and apparatus for flexible, security context management during AMF changes. One aspect of the disclosure is a mechanism for achieving backward security during AMF changes in idle mode. Instead of passing the current NAS key to the target AMF, the source AMF derives a new NAS key, provides the new NAS key to the target AMF, along with a key change indication indicating that the NAS key has changed. The target AMF sends the key change indication to the user equipment.

Security context handling in 5G during idle mode

A wireless device () performs authentication () with a home network (H) of the wireless device (). The wireless device () encrypts a network slice identifier () with cryptographic key material () that is available from the authentication () with the home network (H) and that is shared between the wireless device () and the home network (H). The wireless device () transmits a message () that includes the encrypted network slice identifier (). In some embodiments, a network node in a serving network (S) of the wireless device () receives the message () and decrypts, or requests decryption of, the encrypted network slice identifier () using cryptographic key material () that is available to the wireless device () from authentication () of the wireless device () with the home network (H) and that is shared between the wireless device () and the home network (H).

Home controlled network slice privacy

A method performed by a core network node in a core network of a wireless communication system includes receiving a first request to establish a first protocol data unit, PDU, session between a user equipment, UE and a user plane function in the core network, generating user plane, UP, security enforcement information, to be applied to the first PDU session, transmitting the UP security enforcement information to a radio access network, RAN, node for establishing the first PDU session, and storing the UP security enforcement information for use in establishing a subsequent PDU session for the UE.

Establishing a protocol data unit session

A method performed by a network equipment of a communication network to dynamically provide trust information to a communication device registered or being registered to the communication network is provided. The method includes determining a trust information for each of one or more access networks. The trust information indicates whether each of the one or more access networks is trusted. The method further includes indicating to the communication device whether the one or more access networks is trusted for a current session or a later session. A method performed by a communication device registered or being registered with a communication network to dynamically receive trust information is also provided. The method includes receiving a message including a protected trust information list from a network equipment. The method further includes verifying the protection of the message. The method further includes storing the protected trust information list.

Methods for trust information in communication network and related communication equipment and communication device

A method by a first security edge protection proxy (SEPP) for security edge protection of messages being communicated between first and second communications networks of a communications system. The method receives, from a first network function of the first communications network, a first message containing an address identifying a second network function which is located in the second communications network. The method receives, from a second SEPP operating to protect communications with the second communications network, a second message containing a fully qualified domain name, FQDN, reference for a combination of the second SEPP and the second network function. The method stores the FQDN reference for the combination of the second SEPP and second network function in a label-to-FQDN mapping data structure with a logical association to a substitute locally-unique label, and sends a third message containing the substitute locally-unique label to the first network function.

Fully qualified domain name handling for service interactions in 5G

A method to operate a UE for handling security policy for user plane protection of communications in a communications system is provided. The method includes transmitting a packet data unit (PDU) session establishment request network access stratum (NAS) message toward an Access and Mobility Management Function (AMF) to establish a PDU session. The method further includes receiving an access network (AN) specific resource setup message indicating whether the UE is to activate integrity protection for data radio bearers (DRBs) serving the PDU session.

Non-orthogonal signaling for radio access networks

A method performed by a wireless device (). The method comprises performing, over a first cell () associated with a public network, a non-access stratum (NAS) procedure in which the wireless device () is authenticated as being authorized to access a non-public network. The method also comprises after performing the NAS procedure, receiving from the first cell () a mobility command that commands the wireless device () to perform a mobility procedure towards a second cell () associated with the non-public network.

Privacy in a wireless communication network

A method is provided to operate a CN node to determine UP security activation. A UP session establishment request is obtained for a wireless device. An indication is obtained that the UP session establishment request is associated with an emergency session and/or that null ciphering and/or null integrity protection are applied to a CP associated with a CP session for the wireless device. It is determined that a UP should be configured for the UP session without activating integrity and/or confidentiality protection for the UP based on the indication. A UP security policy is provided to a RAN node associated with the wireless device, wherein the UP security policy indicates to configure the UP for the UP session without activating integrity and/or confidentiality protection based on determining that a UP should be configured for the UP session without activating integrity and/or confidentiality protection.

Methods providing management of emergency sessions and related devices and nodes

A method performed by a UE. The method incudes generating a SUCI comprising: i) an encrypted part in which a Mobile Subscription Identification Number of a SUPI is encrypted and ii) a clear-text part comprising: a) a Mobile Country Code of the SUPI, b) a Mobile Network Code of the SUPI, c) a public key identifier for a public key of a home network of the user equipment, and d) an encryption scheme identifier that identifies an encryption scheme used by the UE to encrypt the Mobile Subscription Identification Number in the SUCI. The method also includes transmitting the SUCI to an authentication server in the home network for forwarding of the SUCI to a de-concealing server capable of decrypting the Mobile Subscription Identification Number.

Privacy key and message authentication code

In some embodiments, a method in a wireless device comprises registering first and second connections with an AMF. The first and second connections share a first security context and connect via first and second access networks, respectively. The method further comprises establishing a second security context with the AMF, setting a flag to a first value based on the second security context having been taken into use on the first connection, and setting the flag to a second value based on the second security context having been taken into use on the second connection. The second value indicates that the second security context has been taken into use on both the first and second connections. The method further comprises retaining the first security context when the flag is set to the first value, and disposing of the first security context after setting the flag to the second value.

Growing community of inventors

Stockholm, Sweden

Noamen Ben Henda