Telefonaktiebolaget Lm Ericsson (publ)

Vesa Lehtovirta

Monica Wifvesson

Noamen Ben Henda

Vesa Torvinen

Karl Norrman

Christine Jost

Prajwol Kumar Nakarmi

Mats Näslund

Stefan Rommer

David Castellanos Zamora

Patrik Salmela

Jari Arkko

Magnus Stattin

Rolf Blom

Dinand Roeland

Ivo Sedlacek

Mikael Wass

Dung Pham Van

Peter Hedman

Qian Chen

Oscar Ohlsson

Paul Schliwa-Bertling

Andreas Höglund

Torsten Dudda

Helka-Liina Määttanen

Fredrik Lindholm

Emre Yavuz

Mats Folke

Alex Krister Raith

Bernard Smeets

Tuomas Tirronen

Alexander Vesely

Magnus Karlsson

Lars-Bertil Olsson

Cheng Wang

Gino Masini

Vlasios Tsiatsis

Katharina Pfeffer

Helena Vahidi Mazinani

Kristian Slavov

Bengt Sahlin

Shabnam Sultana

Per Ståhl

Luis Barriga

Pablo Martinez De La Cruz

Mohit Sethi

John Mattsson

Markus Drevö

Kazi Wali Ullah

Zhang Fu

Pasi Saarinen

Mattias Johansson

Gang Ren

Eric Turcotte

Mattias Eld

Michael John Slssingar

Joseph Eric Turcotte

Harri Tapani Vilander

Patrik Teppo

Alain Guy Maupin

Ferhat Karakoc

Markus Hanhisalo

Karl Norman

Krister Sällberg

Jari Huoppila

Michael John Sissingar

Okcar Ohlsson

Mats Naeslund

Krister Raith

Ben Henda Noamen

A method for a user equipment (UE) to obtain security credentials for accessing a non-public network (NPN) is provided. The method comprises sending, to an onboarding network (ON), a registration request that includes an identifier of the UE, and obtaining an indication of a credential provisioning protocol (CPP) used by a provisioning server (PS) for provisioning security credentials to access the NPN. The method further comprises obtaining, from the PS via the ON using the indicated CPP, security credentials for the UE to access the NPN.

Indication of provisioning protocol for credentials to access a non-public network

There is provided mechanisms for authenticating a first radio communication device with a network. A method is performed by the first radio communication device. The method comprises obtaining credentials for a network subscription to the network. The method comprises obtaining an upper part of a radio protocol stack, according to which radio protocol stack the first radio communication device is configured to communicate with the network. The method comprises authenticating with the network. The method comprises providing, to a second radio communication device, at least one key, as derived from the credentials during the authenticating, for use by the second radio communication device when executing the remaining part of the radio protocol stack for communication between the second radio communication device and the network.

Authentication of a radio communication device to a network

A serving network establishes a connection with a UE via an N3AN using a trusted registration procedure to establish a secure access link between the UE and the serving network via the N3AN. The serving network sends a trust indication message via the N3AN to the UE using the secure access link to identify the N3AN as trusted or untrusted. When the received trust indication message indicates the N3AN is untrusted, the serving network executes an untrusted registration procedure with the UE using the secure access link to establish the connection between the UE and the serving network. When the received trust indication message indicates the N3AN is trusted, the serving network continues execution of the initial registration with the UE using the trusted registration procedure to establish the connection between the UE and the serving network. The UE and serving network exchange messages via the established connection.

Determination of trust relationship of non-3GPP access networks in 5GC

A remote communication device can receive a discovery key; receive a communication key and a key identifier, ID, for the communication key; and discover a relay communication device. Discovering the relay communication device can include receiving an encrypted discovery message from the relay communication device and decrypting the encrypted discovery message using the discovery key. The remote communication device can further transmit a direct communication request to the relay communication device responsive to receiving and decrypting the encrypted discovery message from the relay communication device. The direct communication request can include the key ID for the communication key. The remote communication device can further receive an encrypted direct communication response from the relay communication device. Receiving the encrypted direct communication response can include decrypting the encrypted direct communication response.

Handling application functions for key management in communication device-network relay scenarios

A method performed by a network server is provided for authentication and key management for a terminal device in a wireless communication network. The method includes authenticating the terminal device during a primary authentication session for the terminal device. The method further includes responsive to a successful authentication of the terminal device, obtaining a first key. The method further includes generating bootstrapping security parameters. The parameters include a second key derived from the first key and a temporary identifier. The temporary identifier identifies the terminal device and the bootstrapping security parameters.

Methods for authentication and key management in a wireless communications network and related apparatuses

A method of providing authentication at a communication device is provided. A primary authentication is run with a Trusted Non-3GPP Gateway Function TNGF node to obtain a TNGF Key (K). A re-authentication Root Key (rRK) is provided based on the TNGF key. A re-authentication Master Session Key (rMSK1) is derived based on the re-authentication Root Key. A security setup is performed with a Trusted Non-3GPP Access Point TNAP using the re-authentication Master Session Key. Related methods of performing authentication using a Trusted Non-3-GPP Gateway Function are also discussed.

Methods providing bootstrapping

A method by a core network node of a core network of a wireless communication system for authenticating a user equipment, UE, to the core network includes receiving a first authentication request to authenticate the UE to the core network, determining that the UE should be authenticated by an external authentication entity that is external to the wireless communication system, transmitting a second authentication request to the external authentication entity, the second authentication request identifying the UE, receiving an authentication response from the external authentication entity verifying authenticity of the UE, the authentication response including a master key, and deriving a first key for securing communications with the UE from the master key.

Non-public network authentication in 5G

A method () for registering with a serving network (). The method is performed by a UE (). The method includes the UE transmitting (s) to the serving network () a message () indicating a UE capability that is relevant for a home network (), wherein the 5 serving network () is configured to send to the home network () a message () indicating the UE capability.

Providing UE capability information to an authentication server

A method performed by a network equipment of a communication network to dynamically provide trust information to a communication device registered or being registered to the communication network is provided. The method includes determining a trust information for each of one or more access networks. The trust information indicates whether each of the one or more access networks is trusted. The method further includes indicating to the communication device whether the one or more access networks is trusted for a current session or a later session. A method performed by a communication device registered or being registered with a communication network to dynamically receive trust information is also provided. The method includes receiving a message including a protected trust information list from a network equipment. The method further includes verifying the protection of the message. The method further includes storing the protected trust information list.

Methods for trust information in communication network and related communication equipment and communication device

Enabling the exchange of connection parameters where a user equipment (UE) lacks a secret shared with the network (e.g. a server), such as key materials, and lacks a valid certificate. In some embodiments, the connection parameters may be exchanged via EAP messages. In certain aspects, and particularly with respect to emergency attach, a simplified protocol is used with limited overhead because the UE does not attempt to authenticate the network, and the network does not attempt to authenticate the UE.

Parameter exchange during emergency access using extensible authentication protocol messaging

A method for key derivation for non-3GPP access. The method includes determining a particular non-3GPP access type, wherein the particular non-3GPP access type is one of N different particular non-3GPP access types (N>1), and each one of the N particular non-3GPP access types is associated with a unique access type distinguisher value. The method also includes generating (s) a first access network key using a key derivation function and the unique access type distinguisher value with which the determined particular non-3GPP access type is associated, thereby generating a first access network key for the particular non-3GPP access type.

Key derivation for non-3GPP access

Secure, authenticated communication is enabled between an initiator () (e.g., a user equipment) and a responder () (e.g., an authentication server function, AUSF, or a subscription de-concealing function, SIDF). The initiator () transmits a message () to the responder () over a secure communication channel (). The message () may include information indicating a third party () whose signing of data (e.g., bound to the secure communication channel ()) will authenticate the responder () to the initiator (). The responder () correspondingly retrieves from the third party () data that is signed by the third party () and transmits a response () to the initiator () that includes the retrieved data. The initiator () receives this response () and determines whether or not the responder () is authenticated by determining whether or not the response () includes data that is signed by the third party ().

Secured authenticated communication between an initiator and a responder

A key management is provided that enables security activation before handing over a user equipment from a source 5G wireless communication system, i.e., a Next Generation System (NGS), to a target 4G wireless communication system, i.e., a Evolved Packet System (EPS)/Long Term Evolution (LTE). The key management achieves backward security, i.e., prevents the target 4G wireless communication system from getting knowledge of 5G security information used in the source 5G wireless communication system.

Methods, apparatuses, computer programs and carriers for security management before handover from 5G to 4G system

Methods of operating a user equipment (UE) in a mobile communication network are disclosed. An authentication process start message may be transmitted from the UE to the mobile communication network, wherein the authentication process start message includes an identifier for the UE. After transmitting the authentication process start message from the UE, a request commit message may be received from the mobile communication network. Responsive to receiving the request commit message, a response commit message may be transmitted to the mobile communication network. After transmitting the response commit message, an authentication challenge message may be received corresponding to the authentication process start message. Related methods of operating network nodes are also discussed.

Methods providing authentication using a request commit message and related user equipment and network nodes

Growing community of inventors

Espoo, Finland

Vesa Lehtovirta