Secondary Cell Group (SCG) Security Key Update for Selective SCG Activation in Wireless Systems

Description

1 / 47 Secondary Cell Group (SCG) Security Key Update for Selective SCG Activation in Wireless Systems BACKGROUND Field

[0001] The present invention relates generally to wireless communication, including updating the secondary cell group (SCG) security key for selective activation of SCG in wireless systems. Related technique

[0002] In a wireless system, dual connectivity (DC) has been used to increase the data transfer rate in a user equipment (UE). In a wireless system with DC, the UE can transmit and receive data on multiple component carriers from two or more cell groups, such as a master cell group (MSG) and secondary cell groups (SCGs), to increase the UE's transfer rate. In the fifth-generation New Radio (NR) standard (5G) developed by the 3rd Generation Partnership Project (3GPP), dual connectivity to a UE can be provided by a first base station serving a primary cell (PCell) and a second base station serving a secondary cell (SCell).New Radio Dual Connectivity (NR DC) allows a UE to be connected to two server nodes with multiple carriers on each node using carrier aggregation techniques. However, improved security is desired for a UE with dual connectivity using multiple SCGs. SUMMARY

[0003] Some aspects of this invention relate to apparatus and Petition 870250089351, dated 10 / 01 / 2025, page 8 / 80 2 / 47 methods for implementing mechanisms to update the secondary cell group (SCG) security key for selective SCG activation in wireless systems supporting dual connectivity (DC). A candidate SCG for a user equipment (UE) can be selectively activated from a list of candidate SCGs when an activation condition for the candidate SCG is met. The embodiments in the present invention may be applicable to fifth-generation (5G) New Radio (NR) wireless networks, systems developed based on the 3rd Generation Partnership Project (3GPP) standards, or other wireless systems.

[0004] Some aspects of this invention relate to the UE. The UE may include a transceiver and a processor communicatively coupled to the transceiver. The transceiver may be configured to enable communication in a wireless system, where the wireless system includes a master node (MN) of a primary cell (PCell) and a plurality of secondary nodes (SNs) of a plurality of secondary cell groups (SCGs).

[0005] According to some aspects, the UE processor may receive a main node configuration from the MN, where the main node configuration may include an ordered list of counter numbers and a list of candidate SCG configurations from the plurality of SCGs served by a list of candidate SNs. A counter number from the ordered list of counter numbers may be allocated to any candidate SCG in the list of candidate SCGs. A candidate SCG served by a candidate SN has an associated activation condition. Once the associated activation condition is met, the candidate SCG may be activated to become an active SCG, and the candidate SN becomes an active SN. In some embodiments, the ordered list of counter numbers may include a block of consecutive numbers. Petition 870250089351, dated 10 / 01 / 2025, p. 9 / 80 3 / 47 cultivated in a range defined by an initial number and a maximum number indicated by the master node configuration.

[0006] According to some aspects, the UE processor may maintain an activation record including a total number of SCG activations by the UE before selecting the candidate SCG to be activated, where the total number of SCG activations has an initial value. The processor may further select the candidate SCG and the candidate SN to be activated to become an active SCG served by an active SN based on the determination that the activation condition associated with the candidate SCG is met. After that, the processor may update the total number of SCG activations to increase the initial value by 1 to be a current value of the total number of SCG activations, based on the activation of the candidate SCG.

[0007] In certain aspects, the UE processor can select a counter number from the ordered list of counter numbers, where the counter number has an index within the ordered list. The index can be determined based on the current value of the total number of SCG activations and a predetermined selection rule applicable by the UE and the MN. The processor can also generate a security key for the active SCG served by the active SN based on the selected counter number and a security key from the MN. The processor can also communicate data between the UE and the active SN within the active SCG, where the data is securely protected by the security key for communication between the UE and the active SN.

[0008] Some aspects of this invention relate to the base station. The base station may include a transceiver and a processor communicatively coupled to the transceiver. The transceiver may be configured to enable communication in a wireless system, where the wireless system includes the base station as an MN of an MCG, an UE, and a plurality of SNs of a plurality of SCGs. Petition 870250089351, dated 10 / 01 / 2025, p. 10 / 80 4 / 47

[0009] According to some aspects, the base station processor can transmit a master node configuration to the UE. The master node configuration can include an ordered list of meter numbers and a list of candidate SCGs from the plurality of SCGs served by a list of candidate SNs. A candidate SCG served by a candidate SN has an associated activation condition. Once the associated activation condition is met, the candidate SCG can be activated to become an active SCG, and the candidate SN becomes an active SN. A counter number from the ordered list of counter numbers can be allocated to any candidate SCG in the list of candidate SCGs.

[0010] According to some aspects, the base station processor can identify a security key for an active SCG served by an active SN after the completion of an activation of the candidate SCG and the candidate SN to become the active SCG served by the active SN based on a determination that the associated activation condition for the candidate SCG is met. The security key for the active SCG can be generated based on a security key from the MN, an activation record from the list of candidate SNs including a total number of SCG activations by the UE, and a counter number selected from the ordered list of counter numbers based on the total number of SCG activations and a predetermined selection rule applicable by the UE and the MN. The total number of SCG activations refers to the current value of the total number of SCG activations that includes the activation of the candidate SCG and the candidate SN.

[0011] This summary is provided merely for illustrative purposes to provide an understanding of the subject matter described herein. Consequently, the resources described above are merely examples and should not be interpreted in a way that restricts Petition 870250089351, dated 10 / 01 / 2025, page 11 / 80 5 / 47 the scope or spirit of the matter of this invention. Other features, aspects and advantages of this invention will become apparent from the detailed description, figures and claims that follow. BRIEF DESCRIPTION OF THE FIGURES

[0012] The attached drawings, which are incorporated herein and form part of the descriptive report, illustrate the present invention and, together with the description, further serve to explain the principles of the invention and enable one (or more) skilled in the art to produce and use the invention.

[0013] Figures 1A to 1C illustrate a wireless system for supporting secondary cell group (SCG) security key upgrade for selective SCG activation, according to some aspects of the invention.

[0014] Figure 2 illustrates a block diagram of a UE or a base station for performing the functions described herein, according to some aspects of the invention.

[0015] Figures 3A to 3B illustrate exemplary processes performed by an UE or a base station to support SCG security key update for selective SCG activation, according to some aspects of the invention.

[0016] Figures 4A to 4D illustrate exemplary processes for updating the SCG security key for selective activation of the SCG, according to some aspects of the invention.

[0017] Figure 5 is an example of a computer system for implementing some aspects or a portion (or portions) thereof of the invention provided herein.

[0018] The present invention is described with reference to the accompanying drawings. In the drawings, similar reference numbers generally indicate identical or functionally similar elements. Petition 870250089351, dated 10 / 01 / 2025, p. 12 / 80 6 / 47 Furthermore, generally speaking, the digit(s) to the left of a reference number identify the drawing in which the reference number first appears. DETAILED DESCRIPTION

[0019] In a wireless system that supports dual connectivity (DC), a user equipment (UE) can transmit and receive data on multiple component carriers (CCs) from at least two cell groups, a main cell group (MCG) including a main node (MN) in a primary cell (PCell), and secondary cell groups (SCells) (SCGs) including secondary nodes (SNs), to increase the UE's processing capacity. An MN and / or an SN can be a base station. An SCG can include a primary secondary cell (PScell) and other secondary cells. In some embodiments, dual connectivity can be used to aggregate long-term evolution (LTE) and New Radio (NR) 5G technology in E-UTRANR (EN-DC).In a 5G NR DC, two or more base stations, such as g-NodeB (gNB) of the 5G wireless network, can configure a PCell using PCell CC (PCC - PCell CC) and one or more SCell CCs (SCC - CCs of SCell) for communication between the UE and the 5G wireless network using dual connectivity.

[0020] In the present invention, several embodiments are related to handling security key updates during a conditional PSCell change (CPC) procedure between multiple SCGs in a connected state of a UE. Currently, during each PSCell change in the connected state of the UE, security keys are exchanged with the UE using level 3 signaling, for example, radio resource control (RRC) signaling. In other words, the UE is reconfigured for security keys each time there is a change of Petition 870250089351, dated 10 / 01 / 2025, page 13 / 80 7 / 47 PSCell or SCG change. Several methods described here eliminate the need to reconfigure the UE for a secure connection to one or more PSC cells or their corresponding SNs in one or more SCGs during the CPC procedure.

[0021] In the Technical Specification (TS) of In 3GPP 37.340 Version 17, a conditional PSCell addition (CPA - conditional PSCell addition) procedure was introduced, according to which a network can configure multiple candidate secondary cell groups (SCGs) for a UE for an SCG addition. For each candidate SCG, a network and / or a master node (MN) can also provide one or more radio conditions or activation conditions that need to be met to connect to the candidate SCG. As the UE performs the evaluation of one or more radio conditions for the candidate SCG, the UE can add the candidate SCG after the fulfillment of one or more radio conditions configured by the network and / or the MN. Once the candidate SCG is added by the UE, the UE releases a configuration related to all other candidate SCGs. Consequently, CPC / CPA configurations are released after the PCell change.Therefore, UE reconfiguration is required for a subsequent CPA mechanism for the UE to add another SCG or a CPC mechanism for the UE to switch to another SCG. Consequently, the procedures in TS 37.340 Version 17 have some inefficiencies.

[0022] In accordance with certain aspects, the UE may execute an intra-SN CPC mechanism, an inter-SN CPC mechanism and / or an MN / SN-initiated CPC mechanism, as described in TS 37.340 Version 17, and in accordance with which the UE may perform an evaluation of one or more radio conditions for .... Petition 870250089351, dated 10 / 01 / 2025, p. 14 / 80 8 / 47 CPC initiated by MN / SN. After fulfilling one or more conditions corresponding to the intra-SN CPC mechanism, the inter-SN CPC mechanism, and / or the MN / SN-initiated CPC mechanism, and after the completion of the intra-SN CPC mechanism, the inter-SN CPC mechanism, and / or the MN / SN-initiated CPC mechanism, the UE may release a configuration related to SCGs to which the UE is not currently connected. Consequently, UE reconfiguration is required for a subsequent intra-SN CPC mechanism, inter-SN CPC mechanism, and / or MN / SN-initiated CPC mechanism.

[0023] In some embodiments, to improve efficiency, a baseline procedure to support SCG change may include the following steps: (1) Step 1: when the execution condition of a candidate PSCell for CPC is met, the UE performs CPC execution with respect to this candidate PSCell; (2) Step 2: after finalizing the addition or change of PSCell, the UE does not release the conditional configuration of the other candidate PSCells for subsequent CPC, the UE continues evaluating the execution conditions of other candidate PSCells; (3) Step 3: When the execution condition of a candidate PSCell is met, the UE performs CPC execution with respect to this candidate PSCell. Such a process of adding or changing the candidate PSCell and its corresponding SCG after the fulfillment of one or more radio conditions may be called selective activation of the candidate SCG.

[0024] For a secure connection to a primary cell (PCell), the MN can provide the UE with a security configuration to derive a security key corresponding to a base station or an MN (KgNB). The MN can also provide the UE with a counter number, as an sk_counter parameter, to be used by the candidate SN as part of an SN addition procedure and / or a procedure of Petition 870250089351, dated 10 / 01 / 2025, page 15 / 80 9 / 47 SN change. In some modes, the MN may send a particular sk_counter to the candidate SN to be used to generate the security key for the candidate SN, where the specific sk_counter is not shared by other SNs. In some other modes, the MN may provide a master node configuration that includes a list of counter numbers, for example, a list of sk_counters and a list of candidate SCGs served by a list of candidate SNs. A counter number from the list of counter numbers can be allocated to any candidate SCG in the list of candidate SCGs. Consequently, a meter number is not specifically allocated to any particular SN, but shared among all candidate SNs for the list of candidate SCGs. Therefore, the list of meter numbers shared by the list of candidate SCGs can provide more flexibility.In some embodiments, the list of counter numbers may be an ordered list such that a counter number in the list has an index. The ordered list of counter numbers can further improve security and reduce the need to explicitly communicate the security key between the UE and the SN. Instead, an index of the counter numbers within the ordered list can be communicated. A counter number can refer to an integer or a number that is used for security key generation. A counter number can be a number generated by a counter. In the current description, the term counter number can be used interchangeably with the term sk_counter, since an sk_counter can be an example of a counter number.

[0025] In some embodiments, the UE may use KgNB and sk_counter to derive a security key for the SN, KSN, in order to further derive a cipher key (CK) and an integrity key (IK) for a secure carrier connection, for example, a data radio carrier (DRB) connection. Petition 870250089351, dated 10 / 01 / 2025, page 16 / 80 The 10 / 47 radio bearer) or a signaling radio bearer (SRB), which terminates in a packet data convergence protocol (PDCP) layer of the SN. The MN also derives a Ksn using the KgNB and a respective sk_counter and provides the derived KSN to each respective SN (or PSCell). The SN uses the received KSN to derive a CK and an IK for the secure carrier connection with the UE. The security configuration can also be called a CPC configuration.

[0026] In a legacy cell group change (CG) mechanism, the UE is required to release a configuration, including a security configuration, related to a source CG after the CG change mechanism is complete. Consequently, the UE is mandated to release the sk_counter after applying it, and the MN needs to provide a new sk_counter to the UE and a new Ksn for each candidate PSCell or SN whenever there is a change in an SN (or PSCell).

[0027] In some embodiments, to avoid reconfiguration of Whenever there is a change in a SN (or PSCell), the UE can be configured to save the previous configuration corresponding to each SCG. However, in this way, the UE may end up reusing the same KSN when the UE returns to the same SN (or PSCell), which can represent a security risk.

[0028] Several embodiments described in the present invention provide solutions eliminating the need to reconfigure the UE with a safety configuration whenever there is a change in an SN (or PSCell) and also ensuring that a new Ksn is used by the UE when the UE returns to the same SN (or PSCell) to which the UE may have been connected earlier. Furthermore, an ordered list of counter numbers can be used, where a counter number from the ordered list can be allocated to any candidate SCG from the list of candidate SCGs. Consequently, a number Petition 870250089351, dated 10 / 01 / 2025, p. 17 / 80 The 11 / 47 meter number is not specifically allocated to any particular SN, but is shared among all candidate SNs for the candidate SCG list. Thus, the list of meter numbers shared by the candidate SCG list can provide more flexibility and greater security.

[0029] Consequently, no RRC reconfiguration is performed for security key change by SCG change (CPC / CPA) during the selective SCG activation procedure. Furthermore, the same SCG key cannot be reused if the enabled SCG is changed. The network or MN can configure an sk_counter pool in a primary node configuration, and the resource in the sk_counter pool can be used in any candidate SCG configuration. An sk_counter pool can be called from an ordered list of count numbers, where each sk_counter is a number generated by a counter. Consequently, an sk_counter resource is not allocated per SCG, but across all candidate SCGs. For each SCG change / activation, the MN and UE follow the same rule to select an sk_counter from the sk_counter pool to generate an SCG security key for the newly activated SCG.Furthermore, the MN can share the SCG key list with all candidate SCGs through a network interface, and the order of the SCG key in the SCG key list is the same as that of sk_counter in the sk_counter pool.

[0030] In some modes, for each SCG activation or UE access to the candidate SCG, the MN and the candidate SN can exchange the use of the SCG security key. If the UE sends the SCG RRCRecfgComplete message to the SN directly, the SN will inform the MN, and the MN will update the list of SCG keys among all candidate SNs. If the UE sends an SCG RRCRecfgComplete message to the MN, the MN will inform the selected SN and update the list of SCG keys among all candidate SNs. Petition 870250089351, dated 10 / 01 / 2025, p. 18 / 80 12 / 47

[0031] Figures 1A to 1C illustrate a wireless system 100 including a UE, for example, UE 101, configured to support SCG security key update for selective SCG activation, according to some aspects of the invention. Figure 1A provides the wireless system 100 for illustrative purposes, where the wireless system 100 may include, but is not limited to, UE 101, a base station 103, a base station 105, a base station 107, a base station 109, a base station 122, and a base station 124, all communicatively coupled to a main network 110. UE 101 communicates with base station 103 via a communication link 121, communicates with base station 105 via a communication link 123, communicates with base station 107 via a communication link 125, communicates with base station 109 via a communication link 127, and via other communication links with other base stations.

[0032] In some instances, the 100 wireless system may be a non-standalone (NSA) system that includes one or more of an NR system, an LTE system, a 5G system, or some other wireless system. In some instances, the 100 wireless system may be a standalone (SA) system including an NR system. There may be other network entities, for example, a network controller, a relay station, not shown. The 100 wireless system may support a wide range of use cases, such as enhanced mobile broadband (eMBB), massive machine-type communications (mMTC), ultra-reliable and low-latency communications (URLLC), and enhanced vehicle-to-everything (eV2X) communications.

[0033] According to some aspects, base station 103, base station 105, base station 107, base station 109, the station Petition 870250089351, dated 10 / 01 / 2025, p. 19 / 80 Base stations 122 and 124 can be either fixed or mobile stations. Base stations 103, 105, 107, 109, 122, and 124 may also be referred to by other names, such as a base transceiver system (BTS), an access point (AP), a transmission / reception point (TRP), an evolved NodeB (eNB), a next-generation node B (gNB), a 5G node B (NB), or some other equivalent terminology. In some examples, base station 103 may be a gNB, while base stations 105 and 107 may be either a gNB or an eNB.In some examples, base station 103, base station 105, base station 107, base station 109, base station 122, and base station 124 can be interconnected to each other and / or to other base stations or network nodes on a network through various types of backhaul interfaces such as a direct physical connection, a virtual network, and / or similar, not shown.

[0034] In some respects, the UE 101 can be stationary or mobile. The UE 101 can be a mobile phone (e.g., a smartphone), a personal digital assistant (PDA), a wireless modem, a wireless communication device, a portable device, a laptop computer, a desktop computer, a cordless phone, a wireless local area network station, a wireless sensor, a tablet computer, a camera, a video surveillance camera, a gaming device, a netbook computer, an ultrabook computer, a medical device or equipment, a biometric sensor or device, a wearable device (smartwatch, smart clothing, smart glasses, smart bracelet, smart jewelry such as a smart ring or smart bracelet), Petition 870250089351, dated 10 / 01 / 2025, page 20 / 80 14 / 47 an entertainment device (for example, a music or video device, or a satellite radio), a vehicle component, a smart appliance, an industrial manufacturing equipment, a global positioning system device, an Internet of Things (IoT) device, a machine-type communication (MTC) device, an evolved or enhanced machine-type communication (eMTC) device, or any other suitable device that is configured to communicate via a wireless medium. For example, an MTC and eMTC device may include a robot, a drone, a location tag and / or the like.

[0035] According to some aspects, base station 103, base station 105, base station 107, base station 109, base station 122, and base station 124 can be communicatively coupled to the main network 110. Base station 103 can serve a cell 102, base station 105 can serve a cell 104 contained within cell 102, base station 107 can serve a cell 106 contained within cell 102 that overlaps with cell 104, base station 109 can serve a cell 108 contained within cell 102 that overlaps with cell 104, base station 122 can serve a cell 126 contained within cell 102, and base station 124 can serve a cell 128 contained within cell 102.

[0036] In some other embodiments, cell 102 may overlap with cell 104, cell 106, cell 108, cell 126, and cell 128. Cell 102, cell 104, cell 106, cell 108, cell 126, and cell 128 may be a macrocell, a picocell, a femtocell, and / or another type of cell. In comparison, a macrocell may cover a relatively large geographic area, for example, several kilometers in radius, a femtocell may cover a relatively small geographic area, for example, a house, while a pi Petition 870250089351, dated 10 / 01 / 2025, page 21 / 80 15 / 47 A picocell covers a smaller area than a macrocell, but a larger area than a femtocell. For example, cell 102 could be a macrocell, while cells 104 and 106 could be picocells or femtocells. Additionally, cell 102 could be a picocell, while cells 104 and 106 could be femtocells. In some instances, the geographic area of ​​a cell may shift according to the location of a mobile base station.

[0037] Depending on some aspect, base station 103 may be the serving base station, a primary node, or a main node (MN), and cell 102 may be the serving cell or the primary cell (PCell). Thus, base station 103 may be called MN 103. Base stations 105, 107, 109, 122, and 124 may be neighboring base stations to UE 101 and may be secondary nodes (SNs). Cell 104, 106, 108, 126, and 128 may be secondary cells (SCell) or secondary primary cells (PScells). There may be other secondary cells for UE 101 not shown.Data for UE 101 can be transferred simultaneously between UE 101 and the main network 110 by one or more component operators between UE 101 and base station 103 on communication link 121, one or more component operators between UE 101 and base station 105 on communication link 123, and one or more component operators between UE 101 and base station 107 on communication link 125, or other links not shown. UE 101 can communicate with the serving base station, for example, base station 103, using a first frequency band, and communicate with a neighboring base station, for example, base station 105 or base station 107, using a second frequency band different from the first frequency band. Petition 870250089351, dated 10 / 01 / 2025, page 22 / 80 16 / 47 In some embodiments, cell 102, which is the PCell, may be referred to as the anchor cell that provides a radio resource control (RRC) connection to UE 101. In some instances, the PCell (cell 102) and the SCell, for example, cell 104, may be colocalized (e.g., different TRPs in the same physical location).

[0038] In some embodiments, one or more of the SCells, such as cell 104 or cell 106, may be activated or added to cell 102, which is the PCell, to form the service cells that serve UE 101. Each service cell uses one or more CCs. The CC of the PCell, for example, cell 102, may be called a primary CC (PCC), and the CC of an SCell, for example, cell 104 or cell 106, may be called a secondary CC (SCC). Each of the PCells (cell 102) and one or more of the SCells (cell 104, cell 106, cell 108, cell 126, or cell 128) can be served by a respective base station 103, base station 105, base station 107, base station 109, base station 122, or base station 124. The coverage areas of the PCell and SCell may differ, as component operators in different frequency bands may experience different path loss.In some configurations, the PCell (cell 102) can add or remove one or more of the SCells (cell 104, cell 106, cell 108, cell 126, or cell 128) to improve the reliability of the connection to UE 101 and / or increase the data rate.

[0039] In some embodiments, the PCell (cell 102) may be a low-band cell using a low-frequency band, and the SCells (cell 104, cell 106, cell 108, cell 126, or cell 128) may be high-band cells using a high-frequency band. A low-band (LB) cell uses a CC in a first frequency band, such as a first frequency range (FR1), which is lower than that of the high-band cells. Petition 870250089351, dated 10 / 01 / 2025, page 23 / 80 17 / 47 high using a second frequency band. Therefore, the first frequency band can be in the first frequency band (FR1) and the second frequency band can be in FR1 or the second frequency band (FR2). In some embodiments, high-band cells may use millimeter-wave DC (mmW) and the low-band cell may use DC in a band (e.g., sub-6 GHz band) lower than mmW. In general, a cell using mmW DC can provide greater bandwidth than a cell using low-band DC. Furthermore, when using a frequency carrier that is above 6 GHz (e.g., mmW), beamforming can be used to transmit and receive signals in some instances. For example, FR1 may be below 7.225 GHz and the FR2 frequency band may be in the mmWave frequency above 24.250 GHz.When communicating with the 5G network, the UE can be configured with one or more bandwidth parts (BWPs) from FR1 and / or FR2 in which to communicate.

[0040] In some embodiments, UE 101 may be served by base station 103, which may be the MN, and one or more secondary nodes, for example, base station 105 and / or base station 107. A main cell group (MCG) is associated with base station 103 in the PCell and with one or more SCells (cell 108). In some embodiments, Figure 1C illustrates multiple secondary cell groups (SCGs) associated with the SCells. For example, as shown in Figure 1C, SCell 104 and SCell 106 may form an SCG 153, and SCell 126 and SCell 128 may form an SCG 155. Different SCGs may include a different number of SCells. An SCell in an SCG may be a PSCell. For example, cell 104 could be a PSC cell in SCG 153, and cell 126 could be a PSC cell in SCG 155. Each SCell could correspond to a base station. For example, cell 108 corresponds to SN 109, cell 104 corresponds to SN 105, cell 106 corresponds to SN 109. Petition 870250089351, dated 10 / 01 / 2025, p. 24 / 80 18 / 47 to SN 107, cell 126 corresponds to SN 122 and cell 128 corresponds to SN 124. Due to the one-to-one correspondence between a SCell and an SN, an SN and a SCell can be used interchangeably.

[0041] In some modes, the PCell, the PSCells used to serve UE 101 may change over time. For example, due to traffic conditions at MN (base station 103) or some other factor, MN (base station 103) may choose to add another PSCell to serve UE 101. As another example, due to signaling conditions between UE 101 and one or more of the current PSC cells (e.g., as determined from signal measurements made by UE 101), MN (base station 103) or one of the PSCells may choose to swap one or more PSCells. A PSCell change may occur when a certain activation condition for an SCG is met. Such a process of adding or changing the candidate PScell ​​and its corresponding SCG after the fulfillment of one or more radio conditions may be called selective activation of the candidate SCG.UE 101, base station 103 which is an MN, and other SNs can perform various operations to update the SCG security key for selective SCG activation.

[0042] Figure 1B illustrates further details of the UE 101 related to operations performed to support secondary cell group security key (SCG) update for selective SCG activation. In some embodiments, as shown in Figures 1A to 1B, the UE 101 may include a transceiver, a memory 112, and a processor 114 communicatively coupled to the transceiver and memory 112. The transceiver may be configured to allow communication in the wireless system 100.

[0043] According to some aspects, the 114 processor can Petition 870250089351, dated 10 / 01 / 2025, page 25 / 80 19 / 47 receive a master node configuration 113 from MN 103, where master node configuration 113 may include an ordered list of counter numbers and a list of candidate SCG configurations from the plurality of SCGs served by a list of candidate SNs. Master node configuration 113 may also be called an MCG configuration. A counter number 115 from the ordered list of counter numbers may be allocated to any candidate SCG from the list of candidate SCGs. A candidate SCG 117 served by a candidate SN 119 has an associated activation condition 118. Once the associated activation condition 118 is met, candidate SCG 117 may be activated to become an active SCG and candidate SN 119 becomes an active SN. In some embodiments, the ordered list of counter numbers may include a block of consecutive numbers in a range defined by a start number and a maximum number indicated by the master node configuration.

[0044] According to some aspects, processor 114 may maintain an activation register 131 including a total number of SCG activations 133 by UE 101 before selecting the candidate SCG to be activated, where the total number of SCG activations 133 may have an initial value. The processor may further select candidate SCG 117 and candidate SN 119 to be activated to become an active SCG served by an active SN based on the determination that the activation condition 118 associated with candidate SCG 117 is met. After that, processor 114 may update the total number of SCG activations 133 to increase the initial value by 1 to be a current value of the total number of SCG activations, based on the activation of candidate SCG 117.

[0045] According to some aspects, processor 114 can select a counter number, for example, counter number Petition 870250089351, dated 10 / 01 / 2025, page 26 / 80 20 / 47 115, from the ordered list of counter numbers, where the counter number has an index within the ordered list. The index can be determined based on the current value of the total number of SCG activations and a predetermined selection rule 143 applicable by UE 101 and MN 103. Processor 114 can also generate a security key 141 for the active SCG serviced by the active SN based on the selected counter number and a security key 145 for the MN. Processor 114 can also communicate data between UE 101 and the active SN within the active SCG, where the data is encrypted by security key 141 for communication between UE and the active SN.

[0046] Figure 2 illustrates a block diagram of the UE 101, which has an antenna panel 217 that includes one or more antenna elements, for example, an antenna element 219 coupled to the transceiver 203 and controlled by the processor 114. In detail, the transceiver 203 may include a radio frequency (RF) circuit 216, a baseband transmit circuit 212, and a baseband receive circuit 214. The RF circuit 216 may include multiple parallel RF chains for one or more transmit or receive functions, each connected to one or more antenna elements of the antenna panel. Furthermore, processor 114 can be communicatively coupled to memory 112, which is then coupled to transceiver 203. A base station, such as base station 103, can be implemented similarly to UE 101, as shown, to include a transceiver, a processor, memory, and other components.

[0047] In some examples, RF 216 circuits are used by UE 101 to update the SCG security key for selective SCG activation in wireless systems. Memory 112 can store main node configuration 113, counter number 115, candidate SCG 117, candidate SN 119, associated activation condition 118, activation log 131, total number of SCG activations 133, key. Petition 870250089351, dated 10 / 01 / 2025, page 27 / 80 Security key 141 for the active SCG served by the active SN, security key 145 of the MN, predetermined selection rule 143. Memory 112 may include instructions that, when executed by processor 114, perform the functions described herein. Alternatively, processor 114 may be coded to perform the functions described herein.

[0048] Figure 3A illustrates an exemplary process 300 performed by a UE to update the SCG security key for selective SCG activation, according to some aspects of the invention. Process 300 can be performed by UE 101 as shown in Figures 1A to 1C and Figure 2, and process 310 can be performed by base station 103 as shown in Figures 1A to 1C.

[0049] In 301, UE 101 can receive the primary node configuration 113 from MN 103. The primary node configuration 113 can include an ordered list of counter numbers in MCG configuration, and a list of candidate SCG configurations from the plurality of SCGs served by a list of candidate SNs. A counter number 115 from the ordered list of counter numbers can be allocated to any candidate SCG from the list of candidate SCGs. Candidate SCG 117 served by candidate SN 119 has associated activation condition 118. Once associated activation condition 118 is met, candidate SCG 117 can be activated to become an active SCG and candidate SN 119 becomes an active SN.

[0050] In 303, UE 101 can maintain the activation record 131 including the total number of SCG activations 133 by the UE that has an initial value before selecting a candidate SCG to be activated.

[0051] In 305, UE 101 may select candidate SCG 117 and candidate SN 119 to be activated to become an active SCG served by an active SN based on the determination that activation condition 118 associated with candidate SCG 117 is met. Petition 870250089351, dated 10 / 01 / 2025, page 28 / 80 22 / 47

[0052] In 306, UE 101 can update the total number of SCG activations 133 to increase the initial value by 1 to be a current value of the total number of SCG activations, based on the activation of candidate SCG 117.

[0053] In 307, UE 101 can select the meter number 115 from the ordered list of counter numbers, where the counter number has an index within the ordered list. The index can be determined based on the current value of the total number of SCG activations and a predetermined selection rule 143 applicable by UE 101 and MN 103. Once the index is known, the counter number (e.g., 115) follows.

[0054] In 308, UE 101 can generate security key 141 for the active SCG serviced by the active SN based on the selected counter number 115 and the security key 145 of the MN. Consequently, UE 101 can still communicate data with the active SN within the active SCG, where the data is encrypted by security key 141 for communication between UE and the active SN. Several techniques can be used to generate security key 141 based on the selected counter number 115 and the security key 145 of the MN, such as techniques defined in current communication standards.

[0055] According to some aspects, to facilitate secure communication between UE 101 and the active SN, there may be several ways for the active SN to determine the same security key for the active SCG served by the active SN based on the selected counter number and a security key from the MN. More details of the examples are shown in Figures 4A to 4D.

[0056] In some modes, UE 101 can transmit a message to MN 103 to indicate the current value of the total number of activations, where the total number of SCG activations enables MN 103 to independently generate the security key for the SCG. Petition 870250089351, dated 10 / 01 / 2025, page 29 / 80 23 / 47 active served by the active SN based on the selected counter number and security key. Subsequently, the MN can transmit the generated security key 141 to the active SCG to the active SN. In some modes, the message transmitted to MN 103 may include an RRC message indicating completion of the activation of candidate SCG 117 and candidate SN 119, and the current value of the total number of SCG activations is included in the RRC message. In some modes, the message may include a media access control (MAC) control element (CE) transmitted along with the RRC message, and the current value of the total number of SCG activations is included in the MAC CE.In some modes, the message includes an RRC message to indicate completion of the activation of candidate SCG 117 and candidate SN 119, where the RRC message may enable MN 103 to independently determine the current value of the total number of SCG activations using a UE activation log maintained locally by MN 103. By default, the total number of SCG activations refers to the current value of the total number of SCG activations.

[0057] In some modes, UE 101 may transmit a message indicating the current value of the total number of SCG activations to the active SN that serves the active SCG, where the current value of the total number of SCG activations may enable the active SN to independently select security key 141 from a list of security keys, where the list of security keys has a one-to-one correspondence with the ordered list of counter numbers.

[0058] In some modes, the predetermined selection rule 143 may be a random selection rule, the counter number 115 having the index may be randomly selected from the ordered list of counter numbers. UE 101 may transmit a message indicating the index to MN 101 or the active SN serving. Petition 870250089351, dated 10 / 01 / 2025, page 30 / 80 24 / 47 the active SCG, where the index allows the active MN or SN to select the security key from a list of security keys. The list of security keys has a one-to-one correspondence with the ordered list of counter numbers.

[0059] In accordance with certain aspects, UE 101 may determine that all counter numbers in the sorted list have been used based on activation record 131 and the total number of SCG activations 133 and further transmit a notification to MN 103 to indicate the determination that all counter numbers in the sorted list have been used. Subsequently, UE 101 may release resources associated with the list of candidate SCGs.

[0060] According to some aspects, candidate SCG 117 can be selected to become the active SCG in a first time instance based on a first activation record, and a first security key is used for communication between UE 101 and the active SN. Furthermore, candidate SCG 117 can be activated to become the active SCG in a second time instance based on a second activation record, and a second security key, different from the first security key, is used for communication between UE 101 and the active SN. Therefore, even if the same candidate SCG is selected to be the active SCG at different times, the security keys used for communication between UE 101 and the active SCG are different at different times. Thus, the security key for the active SCG, or the SCG security key, is updated for selective SCG activation when the condition for the candidate SCG is met at different times.Therefore, the security of the wireless system can be increased.

[0061] Figure 3B illustrates an exemplary process 310 executed by a base station to update the SCG security key for selective SCG activation, in accordance with some aspects of Petition 870250089351, dated 10 / 01 / 2025, page 31 / 80 25 / 47 invention. Process 310 can be performed by base station 103, as shown in Figures 1A to 1C, which can be called MN 103. More details of the examples are shown in Figures 4A to 4D.

[0062] In 312, base station 103 can transmit the configuration of master node 113 to UE 101. In some embodiments, base station 103 can transmit the configuration of main node 113 to UE 101. The configuration of main node 113 can include an ordered list of counter numbers and a list of candidate SCGs from the plurality of SCGs served by a list of candidate SNs. A candidate SCG served by a candidate SN has an associated activation condition.

[0063] In 314, base station 103 can identify security key 141 for an active SCG served by an active SN after the completion of an activation of candidate SCG 117 and candidate SN 119 to become the active SCG served by the active SN based on a determination that the associated activation condition 118 for candidate SCG 117 is met. Security key 141 for the active SCG is generated based on security key 145 of MN 103, activation record 131 from the list of candidate SNs, including the total number of SCG activations 133 by UE 101, and counter number 115 selected from the ordered list of counter numbers based on the total number of SCG activations 133 and the predetermined selection rule 143 applicable by UE 101 and MN 103. The total number of SCG activations 133 may include the activation of candidate SCG 117 and candidate SN 119.

[0064] In some embodiments, base station 103 may identify a security key for an active SCG served by an active SN after the completion of an activation of candidate SCG 117 and candidate SN 119 to become the active SCG served by the active SN based on a determination that the associated activation condition 118 for candidate SCG 117 is met. Security key 141 Petition 870250089351, dated 10 / 01 / 2025, page 32 / 80 26 / 47 for the active SCG can be generated based on a security key 145 from MN 103, the activation record 133 from the list of candidate SNs including the total number of SCG activations 133 and the counter number 115 selected from the ordered list of counter numbers based on the total number of SCG activations 133 and a predetermined selection rule 143 applicable by UE 101 and MN 103. The total number of SCG activations 133 includes the activation of candidate SCG 117 and candidate SN 119.

[0065] In some modes, to identify security key 141 for the active SCG, base station 103 may receive a completion message from UE 101. The completion message may indicate the completion of the activation of candidate SCG 117 and candidate SN 119 to become the active SCG served by the active SN. Base station 103 may also receive a security key indication from UE 101 about security key 141 for the active SCG served by the active SN.

[0066] In some embodiments, the security key indication may include an indication of the total number of SCG 133 activations to identify the security key. Base station 103 may generate security key 141 for the active SCG served by the active SN based on security key 145 of the MN and the counter number 115 selected by the predetermined selection rule 143 based on the total number of SCG 133 activations. Subsequently, base station 103 may transmit security key 141 for the active SCG to the active SN.

[0067] In some modes, the completion message includes an RRC message indicating the completion of the activation of the candidate SCG and the candidate SN, and the total number of SCG activations 133 is included in the RRC message. In some modes, the completion message includes a MAC CE transmitted along with Petition 870250089351, dated 10 / 01 / 2025, page 33 / 80 27 / 47 the RRC message, and the total number of SCG 133 activations is included in the MAC CE.

[0068] In some modes, the completion message includes an RRC message to indicate the completion of the activation of candidate SCG 117 and candidate SN 119, and base station 103 can determine the total number of SCG 133 activations using an activation log of UE 101 maintained by MN 103.

[0069] In some embodiments, the security key indication may include an index of the counter number 115 within the sorted list, the predetermined selection rule 143 is a random selection rule, and the counter number 115 that has the index is randomly selected from the sorted list of counter numbers based on the random selection rule.

[0070] In some embodiments, base station 103 may generate a list of security keys, which has a one-to-one correspondence with the ordered list of counter numbers, and distribute the list of security keys to the list of candidate SNs from the list of candidate SCGs. To identify the security key for the active SCG, base station 103 may receive the security key from the active SN, where the security key is identified by the SN based on the list of security keys and an indication of the selected counter number from the ordered list of counter numbers.

[0071] In some embodiments, the predetermined selection rule 143 may be a random selection rule and the counter number indication includes an index of the counter number within the sorted list. In some embodiments, the counter number with the index may be randomly selected from the sorted list of counter numbers based on the random selection rule.

[0072] Figures 4A to 4D illustrate exemplary processes for updating SCG security keys for selective activation. Petition 870250089351, dated 10 / 01 / 2025, page 34 / 80 28 / 47 of SCG, according to some aspects of the invention. The processes shown in Figures 4A to 4D are examples of process 300 performed by UE 101 and process 310 performed by base station 103 and other base stations, such as base station 105 within SCG 153, which may be SCG No. 1, and base station 122 within SCG 155, which may be SCG No. 2.

[0073] Process 400 shown in Figure 4A performs operations related to updating the SCG safety key for selective SCG activation, according to some aspects of the invention.

[0074] In 402, MN 103 can send an RRC message to UE 101, where the RRC message can be an RRC reconfiguration message. The message can include the MN 113 configuration. The MN 113 configuration includes an ordered list of counter numbers, shown as a sk_counter list including [A1, A2, A3, A4], where A1, A2, A3, and A4 are each a counter number or an sk_counter. In the modes, A1, A2, A3, and A4 are integers. The MN 113 configuration can also include a list of candidate SCGs, including candidate SCG #1 (C-SCG1), candidate SCG #2 (CSCG2), and more. Other components of the MN 113 configuration, such as a list of candidate SNs, and an associated activation condition for each candidate SCG, are not shown.

[0075] In 404, UE 101 can perform operations described in process 300. In detail, UE 101 can detect channel conditions between UE 101 and base station 103, base station 105, and other base stations and determine that the activation condition for a candidate SCG, such as condition C-SCG1, is met. There are several candidate SCGs included in the MN 113 configuration. UE 101 can monitor the conditions for all these candidate SCGs and select the SCG that has its activation condition met. UE 101 can maintain activation log 131 including the total number of activations. Petition 870250089351, dated 10 / 01 / 2025, page 35 / 80 29 / 47 of SCG 133 by the UE before selecting the candidate SCG to be activated. Initially, the total number of SCG 133 activations is 0, as there are no activated SCGs yet. Thus, UE 101 performs selective activation of SCGs. In some modes, UE 101 selects C-SCG1 to activate it and further updates the total number of SCG 133 activations to become 1. UE 101 applies the predetermined selection rule 143 to select a counter number. In some modes, the predetermined selection rule 143 selects the counter number according to the total number of 133 activations. Thus, UE 101 selects A1 as the sk_counter to generate the SCG 1 key, since the activation of C-SCG1 is the first activation. The SCG 1 key can be used for secure communication between UE 101 and SN 105 of CSCG1.

[0076] In 406, UE 101 can transmit a message, such as an RRC message that can be RRCRecfgComplete to indicate the completion of the activation of the candidate SCG, for example, C-SCG1, and the candidate SN. The RRC message can be viewed as an SCG container and can optionally include the total number of SCG activations. The total number of SCG activations included in the message considers the activation of C-SCG1. In the current example, the activation of C-SCG1 is the first activation.

[0077] In 408, MN 103 can use the total number of activations of SCG to select the first counter number, sk_counter A1, to generate the SCG key 1.

[0078] In 409, MN 103 can send the security key, SCG 1 key, to SN C-SCG1, which is shown as C-SN1, or base station 105. MN 103 can transmit an RRC message, such as an RRCRecfgComplete message, to SN 105 to indicate the SCG 1 security key.

[0079] In 411, a secure communication channel between EU 101 and Petition 870250089351, dated 10 / 01 / 2025, page 36 / 80 30 / 47 SN 105 is established. Data communication can be performed between UE 101 and SN 105. The activation of C-SCG1 is the first activation, as shown. Consequently, C-SCG1 is activated and SCG Key1 is generated with sk_counter = A1.

[0080] In 412, UE 101 can detect the channel conditions between UE 101 and base station 103, base station 105, and other base stations and determine that the activation condition for a candidate SCG, such as condition C-SCG2, is met. UE 101 selects C-SCG2 to activate it. UE 101 also maintains activation record 131 and the total number of SCG activations 133. In this example, the total number of SCG activations 133 shows that the current activation of C-SCG2 is the second activation. Thus, the total number of SCG activations 133 is 2. Consequently, UE 101 can select the second counter number, which is the second sk_counter A2, to generate the SCG 2 key.

[0081] In 413, UE 101 can transmit a message, such as an RRC message that can be RRCRecfgComplete to indicate the completion of the activation of the candidate SCG, for example, C-SCG2, and the candidate SN. The RRC message can optionally include the total number of SCG activations. The total number of SCG activations included in the message includes the activation of C-SCG2. In the current example, the activation of C-SCG2 is the second activation.

[0082] In 414, MN 103 can use the total number of activations of SCG, which is 2, to select the second counter number, sk_counter A2, to generate the SCG 2 key. Consequently, by only transmitting the total number of SCG activations, MN 103 can determine the counter number, sk_counter A2, used to generate the SCG 2 key and even generate the SCG 2 key without it being transmitted from UE 101. Therefore, security can be improved.

[0083] In 415, MN 103 can still deactivate the previous SCG, CPetition 870250089351, of 01 / 10 / 2025, page 37 / 80 31 / 47 SCG1.

[0084] In 416, MN 103 can send the security key, SCG 2 key, to SN C-SCG2, which is shown as C-SN2, or base station 122. MN 103 can transmit an RRC message, such as an RRCRecfgComplete message, to SN 122 to indicate the security key, SCG 2 key.

[0085] In 417, a secure communication channel between EU 101 and SN 122 is established. Data communication can be performed between UE 101 and SN 122. The activation of C-SCG2 is the second activation, as shown. Consequently, C-SCG2 is activated, and the SCG 2 key is generated with sk_counter = A2.

[0086] Process 420 shown in Figure 4B performs operations related to updating the SCG safety key for selective SCG activation, according to some aspects of the invention.

[0087] In 421, MN 103 generates a list of security keys, [K1, K2, K3, K4...], which has a one-to-one correspondence with the ordered list of counter numbers, for example, list sk_counter [A1, A2, A3, A4...]. Consequently, security K1 is derived from sk_counter A1, based on a security algorithm and a security key of MN 101. The list sk_counter [A1, A2, A3, A4...] and the list of security keys, [K1, K2, K3, K4...] can be allocated to any SCGs and are therefore shared by the SCGs that serve UE 101.

[0088] In 422, MN 103 can distribute the list of security keys, [K1, K2, K3, K4 ...], to the list of candidate SNs from the list of candidate SCGs, such as SCG 153, SCG 155. The list of security keys, [K1, K2, K3, K4 ...] are also saved by SN 105 and SN 122.

[0089] In 402, MN 103 can send an RRC message to Petition 870250089351, dated 10 / 01 / 2025, p. 38 / 80 32 / 47 of UE 101, where the RRC message may be an RRC reconfiguration message. The message may include the MN 113 configuration. The MN 113 configuration includes an ordered list of counter numbers, shown as a list sk_counter including [A1, A2, A3, A4], where A1, A2, A3, and A4 are each a counter number, for example, an sk_counter. The MN 113 configuration may also include a list of candidate SCGs, including candidate SCG no. 1 (C-SCG1), candidate SCG no. 2 (C-SCG2), and more.

[0090] In 404, UE 101 can detect the channel conditions between UE 101 and base station 103, base station 105, and other base stations and determine that the activation condition for a candidate SCG, such as the C-SCG1 condition, is met. UE 101 selects A1 as the sk_counter to generate the SCG 1 key.

[0091] In 423, UE 101 can transmit a message to the SN 105, as an RRC message that can be RRCRecfgComplete to indicate the completion of the activation of the candidate SCG, for example, C-SCG1, and the candidate SN. The RRC message can be viewed as an SCG container and can optionally include the total number of SCG activations. The total number of SCG activations included in the message considers the activation of C-SCG1. In the current example, the activation of C-SCG1 is the first activation.

[0092] In 424, SN 105 can use the total number of activations of SCG selects the first K1 security key from the list of security keys and then uses the first K1 security key to process the RRC message.

[0093] In 425, SN 105 can transmit an indication to MN 103 that the first security key K1 is used for the activation of SCG from SCG1.

[0094] In 426, MN 103 can update the list of security keys [K1, K2, K3, K4^] and the list of counter numbers [A1, A2, A3, Petition 870250089351, dated 10 / 01 / 2025, page 39 / 80 33 / 47 A4] to indicate that the first security key K1 and its corresponding counter number A1 were used. MN 103 can further update the list of security keys [K1, K2, K3, K4.] to remove K1 to obtain an updated list of security keys [K1, K2, K3, K4.] or [K2, K3, K4 ...]. A similar update can be made to the list of counter numbers [A1, A2, A3, A4] to become [A1, A2, A3, A4 .] or [A2, A3, A4 .].

[0095] In 427, MN 103 can distribute the updated valid security list (K2,K3,K4) to the SCGs, including SCG 153 and SCG 155. The updated valid security list (K2,K3,K4) can be saved by SN 105 and SN 122, respectively. There may be other ways for MN 103 to indicate to remove the first key from the list of security keys previously saved by 105 and SN 122.

[0096] In 411, a secure communication channel between EU 101 and SN 105 is established. Data communication can be performed between UE 101 and SN 105. The activation of C-SCG1 is the first activation, as shown. Consequently, C-SCG1 is activated and SCG Key1 is generated with sk_counter = A1.

[0097] In 412, UE 101 can detect the channel conditions between UE 101 and base station 103, base station 105, and other base stations and determine that the activation condition for a candidate SCG, such as condition C-SCG2, is met. UE 101 selects C-SCG2 to activate it. UE 101 also maintains activation log 133 and the total number of activations of SCG 133. In this example, the total number of activations of SCG 133 shows that the current activation of C-SCG2 is the second activation. Thus, the total number of activations of SCG 133 is 2. Consequently, UE 101 can select the second counter number, which is the second sk_counter A2, to generate the key for SCG 2.

[0098] In 428, UE 101 can transmit a message to the SN Petition 870250089351, dated 10 / 01 / 2025, page 40 / 80 34 / 47 105, as an RRC message that can be RRCRecfgComplete to indicate the completion of the activation of the candidate SCG, for example, C-SCG2, and the candidate SN. The RRC message can be viewed as an SCG container and can optionally include the total number of SCG activations. The total number of SCG activations included in the message includes the activation of C-SCG2. In the current example, the activation of C-SCG2 is the second activation.

[0099] In 429, SN 105 can use the total number of activations of SCG selects the second K2 security key from the list of security keys and still uses the second K2 security key to process the RRC message.

[0100] In 431, SN 105 can transmit an indication to MN 103 that the second security key K2 is used for SCG activation from SCG2.

[0101] In 432, MN 103 can update the security key list [K2, K3, K4.] and the counter number list [A2, A3, A4] to indicate that the first security key K2 and its corresponding counter number A2 have been used. MN 103 can further update the security key list [K2, K3, K4.] to remove K2 to obtain an updated security key list [K1, K2, K3, K4 ...] or [K3, K4 .]. A similar update can be made to the counter number list [A1, A2, A3, A4] to become [A1, A2, A3, A4 ...] or [A3, A4 .].

[0102] In 433, MN 103 can distribute the updated valid security list (K3,K4) to the SCGs, including SCG 153 and SCG 155. The updated valid security list (K3,K4) can be saved by SN 105 and SN 122, respectively. There may be other ways for MN 103 to indicate to remove the second key from the list of security keys previously saved by 105 and SN 122.

[0103] In 417, a secure communication channel between EU 101 and Petition 870250089351, dated 10 / 01 / 2025, page 41 / 80 35 / 47 SN 122 is established. Data communication can be performed between UE 101 and SN 122. The activation of C-SCG2 is the second activation, as shown. Consequently, C-SCG2 is activated and SCG Key2 is generated with sk_counter = A2.

[0104] Process 440 shown in Figure 4C performs operations related to updating the SCG security key for selective SCG activation, according to some aspects of the invention.

[0105] In 402, MN 103 can send an RRC message to UE 101, where the RRC message can be an RRC reconfiguration message. The message can include the MN 113 configuration. The MN 113 configuration includes an ordered list of counter numbers, shown as a sk_counter list including [A1, A2, A3, A4,...], where A1, A2, A3, and A4 are each a counter number or an sk_counter. The MN 113 configuration can also include a list of candidate SCGs, including candidate SCG #1 (C-SCG1), candidate SCG #2 (C-SCG2), and more. Other components of the MN 113 configuration, such as a list of candidate SNs, and the associated activation condition for each candidate SCG, are not shown.

[0106] In 444, UE 101 can detect channel conditions between UE 101 and base station 103, base station 105, and other base stations and determine that the activation condition for a candidate SCG, such as condition C-SCG1, is met. In some modes, UE 101 selects C-SCG1 to activate it. The operations performed here are different from the operations performed in 404 of Figure 4A. As shown above in Figure 4A, in 404 in Figure 4A, UE 101 selects A1 as the sk_counter to generate the SCG 1 key, corresponding to the first activation of the SCG. In some modes, in 444, the predetermined selection rule 143 is a random selection rule; the counter number having the index is randomly selected from the ordered list of counter numbers. Consequently, UE Petition 870250089351, dated 10 / 01 / 2025, page 42 / 80 36 / 47 101 can randomly select a counter number, for example, A4, which can be used to generate a security key, the SCG K4 key, which has an index of 3, where the index starts from position 0. The security key, SCG K4 key, can be used for secure communication between UE 101 and SN 105 of C-SCG1.

[0107] In 446, UE 101 can transmit a message, such as an RRC message that can be RRCRecfgComplete to indicate the completion of the activation of the candidate SCG, for example, C-SCG1. The message may include the index 3, not the total number of SCG activations, to be transmitted to MN 103. The total number of SCG activations is not included in the message because the selection of K4 with index 3 is selected randomly and cannot be determined based solely on the total number of SCG activations.

[0108] In 448, MN 103 can use the received index 3 to select the counter number, sk_counter A4, to generate the SCG key 4.

[0109] In 449, MN 103 can inform the security key, SCG 4 key, to SN 105 of C-SCG1. MN 103 can transmit an RRC message, such as an RRCRecfgComplete message, to SN 105 to inform the security key, SCG 4 key.

[0110] In 411, a secure communication channel between EU 101 and SN 105 is established. Data communication can be performed between UE 101 and SN 105. The activation of C-SCG1 is the first activation, as shown. Consequently, C-SCG1 is activated, and the SCG 4 key is generated with sk_counter = A4.

[0111] In 452, UE 101 can detect channel conditions between UE 101 and base station 103, base station 105, and other base stations and determine that the activation condition for a candidate SCG, such as condition C-SCG2, is met. UE 101 selects C-SCG2 to activate it. UE 101 also maintains activation log 133 and the Petition 870250089351, dated 10 / 01 / 2025, page 43 / 80 37 / 47 total number of SCG 133 activations. In this example, the total number of SCG 133 activations shows that the current activation of C-SCG2 is the second activation. Thus, the total number of SCG 133 activations is 2. However, since the predetermined selection rule 143 is a random selection rule, as shown in operation 444, UE 101 can randomly select a counter number, which is sk_counter A1, to generate the SCG 1 key with an index of 0.

[0112] In 453, UE 101 can transmit a message, such as an RRC message which can be RRCRecfgComplete to indicate the completion of the activation of the candidate SCG, for example, C-SCG2. The RRC message can optionally include the index 0.

[0113] In 454, MN 103 can use index 0 received from UE 101 to select the first counter number, sk_counter A1, to generate the SCG 1 key.

[0114] In 415, MN 103 can still deactivate the previous SCG, CSCG1.

[0115] In 456, MN 103 can report the security key, SCG 1 key, to SN C-SCG2, which is shown as C-SN2, or base station 122. MN 103 can transmit an RRC message, such as an RRCRecfgComplete message, to SN 122 to report the security key, SCG 1 key.

[0116] In 417, a secure communication channel between EU 101 and SN 122 is established. Data communication can be performed between UE 101 and SN 122. The activation of C-SCG2 is the second activation, as shown. Consequently, C-SCG2 is activated, and the SCG 1 key is generated with sk_counter = A1.

[0117] Process 460 shown in Figure 4D performs operations related to updating the SCG security key for selective SCG activation, according to some aspects of the invention.

[0118] In 421, MN 103 generates a list of security keys, Petition 870250089351, dated 10 / 01 / 2025, page 44 / 80 38 / 47 [K1, K2, K3, K4 ...], which has a one-to-one correspondence with the ordered list of counter numbers, for example, list sk_counter [A1, A2, A3, A4.]. Consequently, security K1 is derived from sk_counter A1, based on a security algorithm and a security key of MN 101. The list sk_counter [A1, A2, A3, A4...] and the list of security keys, [K1, K2, K3, K4 ...] can be allocated to any SCGs and are therefore shared by the SCGs that serve UE 101.

[0119] In 422, MN 103 can distribute the list of security keys, [K1, K2, K3, K4 ...], to the list of candidate SNs from the list of candidate SCGs, such as SCG 153, SCG 155. The list of security keys, [K1, K2, K3, K4 ...] are also saved by SN 105 and SN 122.

[0120] In 402, MN 103 can send an RRC message to UE 101, where the RRC message can be an RRC reconfiguration message. The message can include the MN 113 configuration. The MN 113 configuration includes an ordered list of counter numbers, shown as a list sk_counter including [A1, A2, A3, A4], where A1, A2, A3, and A4 are each a counter number, for example, an sk_counter. The MN 113 configuration can also include a list of candidate SCGs, including candidate SCG no. 1 (C-SCG1), candidate SCG no. 2 (C-SCG2), and more.

[0121] In 462, UE 101 can detect the channel conditions between UE 101 and base station 103, base station 105, and other base stations and determine that the activation condition for a candidate SCG, such as condition C-SCG1, is met. UE 101 can randomly select A4 as the sk_counter to generate the SCG 4 key with an index of 3, and also indicate that A4 and K4 are used.

[0122] In 463, UE 101 can transmit a message to the SN 105, as an RRC message that may be RRCRecfgComplete Petition 870250089351, dated 10 / 01 / 2025, page 45 / 80 39 / 47 to indicate completion of the activation of the candidate SCG, for example, C-SCG1. The RRC message may include index=3.

[0123] In 464, SN 105 can use index =3 to select security key K4 from the list of security keys and still use security key K4 to process the RRC message.

[0124] In 465, SN 105 can transmit an indication to MN 103 that the K4 security key is used for SCG activation from SCG1.

[0125] In 466, MN 103 can update the security key list [K1, K2, K3, K4.] and the counter number list [A1, A2, A3, A4] to indicate that the security key K4 and its corresponding counter number A4 have been used. MN 103 can further update the security key list [K1, K2, K3, K4.] to remove K4 to obtain an updated security key list [K1, K2, K3, K4.] or [K1, K2, K3 ..]. A similar update can be made to the counter number list [A1, A2, A3, A4] to become [A1, A2, A3, A4 .] or [A1, A2, A3 .].

[0126] In 467, MN 103 can distribute the updated valid security list [K1, K2, K3 ...] to the SCGs, including SCG1 and SCG2. The updated valid security list [K1, K2, K3 .] can be saved by SN 105 and SN 122, respectively. There may be other ways for MN 103 to indicate to remove K4 from the list of security keys previously saved by 105 and SN 122.

[0127] In 411, a secure communication channel between EU 101 and SN 105 is established. Data communication can be performed between UE 101 and SN 105. The activation of C-SCG1 is the first activation, as shown. Consequently, C-SCG1 is enabled and SCG Key1 is generated with sk_counter = A1.

[0128] In 472, UE 101 can detect channel conditions between UE 101 and base station 103, base station 105, and other stations. Petition 870250089351, dated 10 / 01 / 2025, p. 46 / 80 40 / 47 base and determine that the activation condition for a candidate SCG, such as condition C-SCG2, is met. UE 101 selects C-SCG2 to activate it. UE 101 also maintains activation record 133 and the total number of activations of SCG 133. In this example, the total number of activations of SCG 133 shows that the current activation of C-SCG2 is the second activation. Thus, the total number of activations of SCG 133 is 2. However, since the predetermined selection rule 143 is a random selection rule, as shown in operation 452, UE 101 can randomly select a counter number, which is sk_counter A1, to generate the SCG 1 key with an index of 0.

[0129] In 473, UE 101 can transmit a message to the SN 105, as an RRC message that may be RRCRecfgComplete to indicate the completion of the activation of the candidate SCG, for example, C-SCG1, and the candidate SN. The RRC message may include the index 0.

[0130] In 474, SN 105 can use index 0 to select the first security key K1 from the list of security keys and still use the first security key K1 to process the RRC message.

[0131] In 475, SN 105 can transmit an indication to MN 103 that the first security key K1 is used for the activation of SCG from SCG1.

[0132] In 476, MN 103 can update the list of security keys [K1, K2, K3, K4^] and the list of counter numbers [A1, A2, A3, A4] to indicate that the first security key K1 and its corresponding counter number A1 have been used. MN 103 can further update the list of security keys [K1, K2, K3, K4^] to remove K1 to obtain an updated list of security keys [K1, K2, K3, K4^] or [K2, K3, .„]. A similar update can be made to the list of counter numbers [A1, A2, A3, A4] to become [A1, A2, A3, A4_] or [A2, A3, .„]. Petition 870250089351, dated 10 / 01 / 2025, page 47 / 80 41 / 47

[0133] In 477, MN 103 can distribute the updated valid security list (K2,K3) to the SCGs, including SCG 153 and SCG 155. The updated valid security list (K2,K3) can be saved by SN 105 and SN 122, respectively. There may be other ways for MN 103 to indicate to remove K1 from the list of security keys previously saved by 105 and SN 122.

[0134] In 417, a secure communication channel between EU 101 and SN 122 is established. Data communication can be performed between UE 101 and SN 122. The activation of C-SCG2 is the second activation, as shown. Consequently, C-SCG2 is activated and SCG Key2 is generated with sk_counter = A2.

[0135] In 482, UE 101 can determine that all counter numbers in the sorted list have been used based on the activation record and the total number of SCG activations. UE 101 can also release resources associated with the list of candidate SCGs.

[0136] In 483, UE 101 may transmit a notification to MN to indicate the determination that all meter numbers in the sorted list have been used.

[0137] Several aspects can be implemented, for example, using one or more computer systems, such as computer system 500 shown in Figure 5. Computer system 500 can be any computer capable of performing the functions described herein, such as UE 101 or base station 103, as shown in Figure 1A, Figure 1B and Figure 2, for the operations described for UE 101, base station 103, process 300 and process 310, as shown in Figures 3A to 3B, or process 400, process 420, process 440 or process 460, as shown in Figures 4A to 4D. Computer system 500 includes one or more processors (also called central processing units (CPUs)). Petition 870250089351, dated 10 / 01 / 2025, pp. 48 / 80 42 / 47 (cessing units), such as a processor 504. The processor 504 is connected to a communication infrastructure 506 (e.g., a bus). The computer system 500 also includes one or more user input / output devices 503, such as monitors, keyboards, pointing devices, etc., which communicate with the communication infrastructure 506 through one or more user input / output interfaces 502. The computer system 500 also includes a main or primary memory 508, such as random access memory (RAM). The main memory 508 may include one or more levels of cache. The main memory 508 has control logic (e.g., computer software) and / or data stored in it.

[0138] The computer system 500 may also include one or more secondary storage devices or memory 510. Secondary memory 510 may include, for example, a hard disk drive 512 and / or a removable storage device or unit 514. The removable storage unit 514 may be a floppy disk drive, a magnetic tape drive, a compact disk drive, an optical storage device, a tape backup device and / or any other storage device / unit.

[0139] Removable storage unit 514 can interact with removable storage unit 518. Removable storage unit 518 includes a computer-readable or usable storage device that has computer software (control logic) and / or data stored on it. Removable storage unit 518 can be a floppy disk, a magnetic tape, a compact disc, a DVD, an optical storage disc, and / or any other computer data storage device. Removable storage unit 514 reads and / or writes to removable storage unit 518 in a well-known manner. Petition 870250089351, dated 10 / 01 / 2025, page 49 / 80 43 / 47

[0140] In some respects, secondary memory 510 may include other means, other devices or other approaches to enable computer programs and / or other instructions and / or other data to be accessed by the computer system 500. Such means, devices or other approaches may include, for example, a removable storage unit 522 and an interface 520.Examples of removable storage units 522 and interfaces 520 may include a program cartridge and cartridge interface (such as that found in video game devices), a removable memory chip (such as erasable programmable read-only memory (EPROM) or programmable read-only memory (PROM)) and associated socket, a memory stick and Universal Serial Bus (USB) port, a memory card and associated memory card slot, and / or any other removable storage unit and associated interface.

[0141] In some examples, main memory 508, removable storage unit 518, removable storage unit 522 may store instructions that, when executed by processor 504, cause processor 504 to perform operations for a UE or a base station, for example, UE 101 or base station 103, as shown in Figure 1A, Figure 1B and Figure 2, for the operations described for UE 101, base station 103, process 300 and process 310, as shown in Figures 3A to 3B, or process 400, process 420, process 440 or process 460, as shown in Figures 4A to 4D.

[0142] The computer system 500 may also include a network or communication interface 524. The communication interface 524 has Petition 870250089351, dated 10 / 01 / 2025, pp. 50 / 80 44 / 47 enables computer system 500 to communicate and interact with any combination of remote devices, remote networks, remote entities, etc. (individually and collectively referenced by reference number 528). For example, communication interface 524 can enable computer system 500 to communicate with remote devices 528 along communication path 526, which may use wired and / or wireless connections, and which may include any combination of LANs, WANs, the Internet, etc. Control logic and / or data can be transmitted to and from computer system 500 via communication path 526. Operations of communication interface 524 can be performed by a wireless controller and / or a cellular controller. The cellular controller can be a separate controller to manage communications according to a different wireless communication technology.The operations in the preceding aspects can be implemented in a wide variety of configurations and architectures. Therefore, some or all of the operations in the preceding aspects can be performed in hardware, in software, or in both. In some aspects, a tangible, non-transient manufactured device or article that includes a tangible, non-transient, usable or computer-readable medium that has control logic (software) stored thereon is also referred to herein as a computer program product or program storage device. This includes, but is not limited to, a computer system 500, main memory 508, secondary memory 510, and removable storage units 518 and 522, as well as tangible manufactured articles incorporating any combination of the aforementioned items.This control logic, when executed by one or more data processing devices (such as computer system 500), causes those data processing devices to operate as described herein. Petition 870250089351, dated 10 / 01 / 2025, pp. 51 / 80 45 / 47

[0143] Based on the teachings contained in this invention, it will be evident to those skilled in the art how to develop and use aspects of the invention with the use of data processing devices, computer systems and / or computer architectures different from those shown in Figure 5. In particular, the aspects can operate with software, hardware and / or operating system implementations beyond those described herein.

[0144] It should be noted that the 'detailed description' section, and not the 'summary' and 'abstract' sections, is intended to be used to interpret the claims. The 'summary' and 'abstract' sections may present one or more, but not all, exemplary aspects of the invention as contemplated by the inventor(s), and therefore are not intended to limit the invention or the appended claims in any way.

[0145] Although the invention has been described herein with reference to exemplary aspects for exemplary applications and fields, it should be understood that the invention is not limited to them. Other aspects and modifications thereto are possible and are within the scope and spirit of the invention. For example, and without limiting the generality of this paragraph, the aspects are not limited to the software, hardware, firmware and / or entities illustrated in the figures and / or described herein. Furthermore, the aspects (whether or not explicitly described herein) have significant utility for fields and applications beyond the examples described herein.

[0146] The aspects described here have been used to illustrate the implementation of specific functions and their relationships. The boundaries of these functional structural units have been arbitrarily defined here for the convenience of the description. Alternative boundaries may be defined, provided that the specified functions and relationships (or their equivalents) are Petition 870250089351, dated 10 / 01 / 2025, page 52 / 80 46 / 47 properly implemented. Furthermore, alternative aspects can implement functional blocks, steps, operations, methods, etc., using orderings different from those described here.

[0147] References in the present invention to a (numeral) embodiment, an (article) embodiment, an exemplary embodiment, or similar phrases indicate that the described embodiment may include a specific feature, structure, or characteristic, but each embodiment may not necessarily include the specific feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. In addition, when a specific feature, structure, or characteristic is described in connection with an embodiment, it would be within the knowledge of those skilled in the art to incorporate such feature, structure, or characteristic in other aspects whether explicitly mentioned or described herein or not.

[0148] The scope and extent of the invention shall not be limited by any of the exemplary aspects described above, but shall be defined only in accordance with the claims and their equivalents below.

[0149] For one or more embodiments or examples, at least one of the components presented in one or more of the preceding figures may be configured to perform one or more operations, techniques, processes and / or methods presented in the examples section below. For example, the circuits associated with a threaded device, routers, network element, etc., as described above in connection with one or more of the preceding figures, may be configured to operate according to one or more of the examples presented below in the example section.

[0150] The present invention contemplates that the entities responsible for the collection, analysis, invention, transfer, storage or other use of such personal information data will comply with policies Petition 870250089351, dated 10 / 01 / 2025, page 53 / 80 47 / 47 privacy and / or well-established privacy practices. In particular, these entities need to implement and consistently use privacy policies and practices that are generally recognized as meeting or exceeding commercial or governmental requirements to keep personal information private and secure. Such policies should be easily accessible to users and should be updated as changes in data collection and / or use change. Users' personal information should be collected for the entity's legitimate and reasonable uses and not shared or sold outside the scope of such legitimate uses. Furthermore, such collection / sharing should only occur after receiving informed consent from users.Furthermore, these entities should consider taking any necessary measures to safeguard and protect access to this personal information data and ensure that others with access to the personal information data comply with their privacy policies and procedures. Additionally, these entities may submit to a third-party assessment to certify their compliance with widely accepted privacy policies and practices. Furthermore, policies and practices should be tailored to the specific types of personal information data that are collected and / or accessed and should adapt to applicable laws and standards, including jurisdiction-specific considerations.For example, in the US, the collection of or access to certain health data may be regulated by federal and / or state laws, such as the Health Insurance Portability and Accountability Act (HIPAA); whereas in other countries, health data may be subject to other regulations and policies and must be handled appropriately. Therefore, different privacy practices must be maintained for different types of personal data in each country. Petition 870250089351, dated 10 / 01 / 2025, pp. 54 / 80

Claims

1 / 8 CLAIMS 1. User equipment (UE), characterized by comprising: a transceiver configured to enable communication in a wireless system, wherein the wireless system includes a main node (MN) of a main cell group (MCG) and a plurality of secondary nodes (SNs) of a plurality of secondary cell groups (SCGs); and a processor communicatively coupled to the transceiver and configured to: receive a main node configuration provided from the MN, wherein the main node configuration includes an ordered list of counter numbers and a list of candidate SCG configurations from the plurality of SCGs served by the respective candidate SNs, wherein a candidate SCG served by a candidate SN has an associated activation condition; maintain an activation register indicating a total number of SCG activations by the UE, wherein the total number of SCG activations has an initial value;select the candidate SCG and the candidate SN to be activated to become an active SCG based on the determination that the associated activation condition for the candidate SCG is met; update, based on the activation of the candidate SCG, the total number of SCG activations to increase the initial value by 1 to calculate a current value of the total number of SCG activations; select a counter number from the ordered list of counter numbers, where the counter number has an index within the ordered list, and the index is determined based on the current value of the total number of SCG activations and a predetermined selection rule applicable by the EU and the MN; and Petition 870250089351, dated 01 / 10 / 2025, page 55 / 80 2 / 8 generate a security key for the active SCG served by the active SN based on the selected counter number and a security key from the MN.; 2. UE, according to claim 1, characterized in that the processor is further configured to transmit a message to the MN to indicate the current value of the total number of SCG activations, wherein the total number of SCG activations enables the MN to independently generate the security key for the active SCG served by the active SN based on the selected counter number and the MN's security key.

3. UE, according to claim 2, characterized in that the message includes the Radio Resource Control (RRC) message indicating a completion of the activation of the candidate SCG and the candidate SN and the current value of the total number of SCG activations is included in the RRC message; or the message includes a Media Access Control (MAC) control element (CE) transmitted together with the RRC message and the current value of the total number of SCG activations is included in the MAC CE.

4. UE, according to claim 2, characterized in that the message includes a radio resource control (RRC) message to indicate completion of the activation of the candidate SCG and candidate SN, wherein the RRC message enables the MN to independently determine the current value of the total number of SCG activations using a UE activation log maintained locally by the MN.

5. EU, according to claim 1, characterized in that the processor is further configured to transmit a message indicating the current value of the total number of SCG activations to the active SN that serves the active SCG, wherein the current value of the total number of SCG activations enables the active SN to independently select the security key from a list of security keys, wherein the list of security keys has a one-to-one correspondence with the ordered list of counter numbers.

6. A device according to claim 1, characterized in that the predetermined selection rule is a random selection rule, the counter number that has the index is randomly selected from the ordered list of counter numbers, the processor is further configured to transmit a message indicating the index to the active MN or SN that serves the active SCG, wherein the index enables the active MN or SN to select the security key from a list of security keys, wherein the list of security keys has a one-to-one correspondence with the ordered list of counter numbers.

7. UE, according to claim 1, characterized in that the processor is further configured to communicate data between the UE and the active SN within the active SCG, wherein the data is protected by the security key for communication between the UE and the active SN.

8. A UE, according to claim 1, characterized in that the ordered list of counter numbers comprises a block of consecutive numbers in a range defined by a starting number and a maximum number indicated by the main node configuration.

9. UE, according to claim 1, characterized in that the candidate SCG is selected to be activated to become the active SCG in a first instance of time based on a first activation record and a first security key is used for communication between the UE and the active SN, and the candidate SCG is activated to become the active SCG in a second instance of time based on a second activation record and a second security key different from the first security key is used for communication between the UE and the active SN.

10. UE, according to claim 1, characterized in that the processor is further configured to: determine that all counter numbers in the sorted list have been used based on the activation record and the current value of the total number of SCG activations; transmit a notification to the MN to indicate the determination that all counter numbers in the sorted list have been used; and optionally release resources associated with the list of candidate SCGs.

11. Base station, characterized by comprising: a transceiver configured to enable communication in a wireless system, wherein the wireless system includes the base station as a primary node (MN) of a Primary Cell Group (PCG), a user equipment (UE), and a plurality of secondary nodes (SNs) of a plurality of secondary cell groups (SCGs); and a processor communicatively coupled to the transceiver and configured to: transmit a primary node configuration to the UE, wherein the primary node configuration includes an ordered list of counter numbers and a configuration list of candidate SCGs from the plurality of SCGs served by the respective candidate SNs, wherein a candidate SCG served by a candidate SN has an associated activation condition;and identify a security key for an active SCG served by an active SN, wherein the security key for the active SCG is generated based on a security key from the MN, a Petition record 870250089351, dated 01 / 10 / 2025, page 58 / 80 5 / 8 activation of the list of candidate SNs including a total number of SCG activations by the EU and a counter number selected from the ordered list of counter numbers, wherein the counter number is based on the total number of SCG activations and an applicable predetermined selection rule, wherein the total number of SCG activations includes an activation of the candidate SCG and the candidate SN to become the active SCG and the active SN.; 12. Base station, according to claim 11, characterized in that, to identify the security key for the active SCG, the processor is configured to: receive a completion message from the UE, wherein the completion message indicates the completion of the activation of the candidate SCG and the candidate SN to become the active SCG served by the active SN; and receive, from the UE, a security key indication associated with the security key for the active SCG served by the active SN.

13. Base station, according to claim 12, characterized in that the security key indication includes an indication of the total number of SCG activations, wherein, to identify the security key, the processor is further configured to: generate the security key for the active SCG served by the active SN based on the MN security key and the counter number selected by the predetermined selection rule based on the total number of SCG activations; and transmit the security key for the active SCG to the active SN.

14. Base station, according to claim 13, characterized in that the completion message includes a Radio Resource Control (RRC) message indicating the completion of the activation of the candidate SCG and the candidate SN and the total number of SCG activations is included in the RRC message; or Petition 870250089351, dated 10 / 01 / 2025, page 59 / 80 6 / 8 the completion message includes a Media Access Control (MAC) control element (CE) transmitted together with the RRC message and the total number of SCG activations is included in the MAC CE.

15. Base station, according to claim 13, characterized in that the completion message includes a Radio Resource Control (RRC) message to indicate the completion of the activation of the candidate SCG and the candidate SN, and the processor is further configured to determine the total number of SCG activations using an activation log of the UE maintained by the MN.

16. Base station, according to claim 12, characterized in that the security key indication includes an index of the counter number within the ordered list, the predetermined selection rule being a random selection rule, and in which the counter number that has the index is randomly selected from the ordered list of counter numbers based on the random selection rule.

17. Base station, according to claim 11, characterized in that the processor is further configured to: generate a list of security keys, wherein the list of security keys has a one-to-one correspondence with the ordered list of counter numbers; and distribute the list of security keys to the list of candidate SNs from the list of candidate SCGs.

18. Base station, according to claim 16, characterized in that, to identify the security key for the active SCG, the processor is configured to: receive the security key from the active SN, wherein the security key is identified by the SN based on the list of security keys and an indication of the counter number selected from the ordered list of counter numbers. Petition 870250089351, dated 10 / 01 / 2025, pp. 60 / 80 7 / 8 19. Base station, according to claim 18, characterized in that the predetermined selection rule is a random selection rule and the counter number indication includes an index of the counter number within the ordered list, wherein the counter number having the index is randomly selected from the ordered list of counter numbers based on the random selection rule.

20. Method for communication, characterized by comprising: receiving a primary node configuration from a primary node (MN) of a wireless system, wherein the wireless system includes the MN of a primary cell group (MCG) and a plurality of secondary nodes (SNs) from a plurality of secondary cell groups (SCGs), the primary node configuration includes an ordered list of counter numbers, a list of candidate SCG configurations from the plurality of SCGs served by a list of candidate SNs, wherein a candidate SCG served by a candidate SN has an associated activation condition, where a counter number from the ordered list of counter numbers is capable of being allocated to any candidate SCG from the list of candidate SCGs; maintaining an activation record including a total number of SCG activations by the UE before selecting the candidate SCG to be activated, wherein the total number of SCG activations has an initial value;select the candidate SCG and the candidate SN to be activated to become an active SCG served by an active SN based on the determination that the associated activation condition for the candidate SCG is met; update the total number of SCG activations to increase the initial value by 1 to be a current value of the total number of SCG activations, based on the activation of the candidate SCG; Petition 870250089351, dated 10 / 01 / 2025, page 61 / 80 8 / 8 select a counter number from the ordered list of counter numbers, where the counter number has an index within the ordered list, and the index is determined based on the current value of the total number of SCG activations and a predetermined selection rule applicable by the UE and the MN; and generate a security key for the active SCG served by the active SN based on the selected counter number and a security key from the MN. Petition 870250089351, dated 10 / 01 / 2025, pp. 62 / 80;

Images