Methods, apparatuses and computer programs

Abstract

There is provided a method, apparatus and computer program for causing an apparatus to obtain first signaling from a source network access node, the first signaling comprising information for performing a handover of the apparatus to a target network access node, and an indication of a delay to perform non-access stratum, NAS, signaling via the target network access node, and an indication of one or more access stratum security algorithms to be applied to communications between the apparatus and the target network access node, and perform the handover to the target network access node based on the information and the indications.

Description

Technical Field

[0001] Various exemplary embodiments of this disclosure relate to methods, apparatus, systems, and computer programs, and specifically, but not exclusively, to performing a handover of a user equipment from a source network access node to a target network access node. Background Technology

[0002] A communication network can be viewed as a facility that enables communication between two or more communication devices or provides communication devices with access to a data network. Mobile or wireless communication networks are an example of communication networks. Communication devices may be served by application servers.

[0003] Such communication networks operate according to standards provided by organizations such as 3GPP (3rd Generation Partnership Project) or ETSI (European Telecommunications Standards Institute). Examples of these standards are the so-called 5G (fifth generation) and 6G (sixth generation) standards provided by 3GPP. Summary of the Invention

[0004] Some exemplary embodiments of this disclosure will be described with respect to certain aspects. These aspects are not intended to indicate key or essential features of embodiments of this disclosure, nor are they intended to limit its scope. Other features, aspects, and elements will be apparent to those skilled in the art in light of this disclosure.

[0005] According to a first aspect, an apparatus is provided, comprising components for performing the following operations: obtaining first signaling from a source network access node, the first signaling including information for performing a handover from the apparatus to a target network access node, an indication for delaying the execution of non-access stratum (NAS) signaling via the target network access node, and an indication for one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and performing the handover to the target network access node based on the information and the indication.

[0006] According to a second aspect, an apparatus is provided, comprising: at least one processor; and at least one memory including code, which, when executed by the at least one processor, causes the apparatus to: obtain first signaling from a source network access node, the first signaling including information for performing a handover from the apparatus to a target network access node, and an indication for delaying the execution of non-access stratum (NAS) signaling via the target network access node, and an indication for one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and perform a handover to the target network access node based on the information and the indication.

[0007] According to a third aspect, a method for an apparatus is provided, the method comprising: obtaining first signaling from a source network access node, the first signaling including information for performing a handover from the apparatus to a target network access node, an indication for delaying the execution of non-access stratum (NAS) signaling via the target network access node, and an indication for one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and performing a handover to the target network access node based on the information and the indication.

[0008] According to a fourth aspect, an apparatus is provided, comprising: obtaining circuitry for obtaining first signaling from a source network access node, the first signaling including information for performing a handover from the apparatus to a target network access node, an indication for delaying the execution of non-access stratum (NAS) signaling via the target network access node, and an indication for one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and executing circuitry for performing the handover to the target network access node based on the information and the indication.

[0009] The following can apply to any (e.g., one or more, including all) aspects from the first to the fourth.

[0010] Instructions for one or more access stratum security algorithms may include one or more security mode command parameters.

[0011] According to a fifth aspect, an apparatus is provided, comprising components for performing the following operations: obtaining one or more access stratum security algorithms to be applied to communication between a user equipment and a target network access node; providing the user equipment with first signaling, the first signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed; and providing at least one network node with second signaling, the second signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, wherein the second signaling further includes an indication of the one or more access stratum security algorithms.

[0012] According to a sixth aspect, an apparatus is provided, comprising: at least one processor; and at least one memory including code, which, when executed by the at least one processor, causes the apparatus to perform: obtaining one or more access stratum security algorithms to be applied to communication between a user equipment and a target network access node; providing the user equipment with first signaling, the first signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed; and providing at least one network node with second signaling, the second signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, wherein the second signaling further includes an indication of the one or more access stratum security algorithms.

[0013] According to a seventh aspect, a method for an apparatus is provided, the method comprising: obtaining one or more access stratum security algorithms to be applied to communication between a user equipment and a target network access node; providing the user equipment with first signaling, the first signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed; and providing at least one network node with second signaling, the second signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, wherein the second signaling further includes an indication of the one or more access stratum security algorithms.

[0014] According to an eighth aspect, an apparatus is provided, comprising: obtaining circuitry for obtaining one or more access stratum security algorithms to be applied to communication between a user equipment and a target network access node; providing circuitry for providing the user equipment with first signaling, the first signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed; and providing circuitry for providing at least one network node with second signaling, the second signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, wherein the second signaling further includes an indication of the one or more access stratum security algorithms.

[0015] The following can be applied to any of the aspects from the fifth to the eighth (e.g., including one or more of all aspects).

[0016] The device can provide at least one network node with information indicating whether the key to the target network access node is obtained horizontally or vertically.

[0017] The device can provide instructions to user equipment regarding one or more access layer security algorithms.

[0018] This acquisition may include sending a request for one or more access layer security algorithms for the target access network node via source access and mobility functions.

[0019] Obtaining information may include sending instructions on the security capabilities of the user equipment to the target access network node via source access and mobility functions.

[0020] The device may perform the following actions: receiving the identifiers of one or more access stratum security algorithms via source access and mobility functions based on at least one of a request for one or more access stratum security algorithms or an indication of the security capabilities of a user equipment.

[0021] Instructions for one or more access stratum security algorithms may include one or more security mode command parameters.

[0022] The first and second signaling messages can be sent in parallel.

[0023] The information indicating whether the key is to be obtained horizontally or vertically may include at least one of the following: an indication of the next-hop link counter (NCC) value, or a key of the target network access node generated by the source network access node.

[0024] According to a ninth aspect, an apparatus is provided, comprising components for performing the following operations: obtaining second signaling from a source network access node, the second signaling including information for performing a handover from a user equipment to a target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and providing third signaling to a target access and mobility function, the third signaling including the information for performing the handover from the user equipment to the target network access node, the indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and the indication of one or more access stratum security algorithms.

[0025] According to a tenth aspect, an apparatus is provided, comprising: at least one processor; and at least one memory including code, which, when executed by the at least one processor, causes the apparatus to: obtain second signaling from a source network access node, the second signaling including information for performing a handover from a user equipment to a target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and provide third signaling to a target access and mobility function, the third signaling including the information for performing the handover from the user equipment to the target network access node, the indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and the indication of one or more access stratum security algorithms.

[0026] According to an eleventh aspect, a method for an apparatus is provided, the method comprising: obtaining second signaling from a source network access node, the second signaling including information for performing a handover from a user equipment to a target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and providing third signaling to a target access and mobility function, the third signaling including the information for performing the handover from the user equipment to the target network access node, the indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and the indication of one or more access stratum security algorithms.

[0027] According to a twelfth aspect, an apparatus is provided, comprising: obtaining circuitry for obtaining second signaling from a source network access node, the second signaling including information for performing a handover from a user equipment to a target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and providing circuitry for providing third signaling to a target access and mobility function, the third signaling including the information for performing a handover from the user equipment to the target network access node, the indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and the indication of one or more access stratum security algorithms.

[0028] The following may apply to any (e.g., one or more, including all) aspects from the ninth to the twelfth.

[0029] The device can perform the following actions: obtaining information from the source network access node indicating whether the key for the target network access node is obtained horizontally or vertically; and when the key is to be obtained vertically, generating a new key for the access and mobility functions.

[0030] The information indicating whether the key is to be obtained horizontally or vertically may include at least one of the following: an indication of the next-hop link counter (NCC) value, or a key of the target network access node generated by the source network access node.

[0031] According to a thirteenth aspect, an apparatus is provided, comprising components for performing the following operations: obtaining third signaling from a source access and mobility function, the third signaling including information for performing a handover from a user equipment to a target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and providing fourth signaling to the target network access node, the fourth signaling including information for performing a handover from the user equipment to the target network access node, and the indication of one or more access stratum security algorithms.

[0032] According to a fourteenth aspect, an apparatus is provided, comprising: at least one processor; and at least one memory including code, which, when executed by the at least one processor, causes the apparatus to perform: obtaining third signaling from a source access and mobility function, the third signaling including information for performing a handover from a user equipment to a target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and providing fourth signaling to the target network access node, the fourth signaling including information for performing a handover from the user equipment to the target network access node, and the indication of the one or more access stratum security algorithms.

[0033] According to a fifteenth aspect, a method for an apparatus is provided, the method comprising: obtaining third signaling from a source access and mobility function, the third signaling including information for performing a handover from a user equipment to a target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and providing fourth signaling to the target network access node, the fourth signaling including information for performing a handover from the user equipment to the target network access node, and the indication of the one or more access stratum security algorithms.

[0034] According to a sixteenth aspect, an apparatus is provided, comprising: obtaining circuitry for obtaining third signaling from a source access and mobility function, the third signaling including information for performing a handover from a user equipment to a target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the apparatus and the target network access node; and providing circuitry for providing fourth signaling to the target network access node, the fourth signaling including information for performing a handover from the user equipment to the target network access node, and the indication of one or more access stratum security algorithms.

[0035] According to a seventeenth aspect, an apparatus is provided, comprising components for performing the following operations: obtaining fourth signaling from a target access and mobility function, the fourth signaling including information for performing a handover from a user equipment to the apparatus, and an indication of one or more access stratum security algorithms to be applied to communication between the apparatus and the user equipment; and performing access stratum signaling with the user equipment based on the indication of the one or more access stratum security algorithms.

[0036] According to a sixteenth aspect, an apparatus is provided, comprising: at least one processor; and at least one memory including code, which, when executed by the at least one processor, causes the apparatus to: obtain fourth signaling from a target access and mobility function, the fourth signaling including information for performing a handover from a user equipment to the apparatus, and indications to one or more access stratum security algorithms to be applied to communication between the apparatus and the user equipment; and perform access stratum signaling with the user equipment based on the indications to the one or more access stratum security algorithms.

[0037] According to a nineteenth aspect, a method for an apparatus is provided, the method comprising: obtaining fourth signaling from a target access and mobility function, the fourth signaling including information for performing a handover from a user equipment to the apparatus, and an indication of one or more access layer security algorithms to be applied to communication between the apparatus and the user equipment; and performing access layer signaling with the user equipment based on the indication of the one or more access layer security algorithms.

[0038] According to a twentieth aspect, an apparatus is provided, comprising: an obtaining circuit for obtaining fourth signaling from a target access and mobility function, the fourth signaling including information for performing a handover from a user equipment to the apparatus, and an indication of one or more access layer security algorithms to be applied to communication between the apparatus and the user equipment; and an executing circuit for executing access layer signaling with the user equipment based on the indication of the one or more access layer security algorithms.

[0039] The following may apply to any (e.g., one or more, including all) aspects from the seventeenth to the twentieth.

[0040] The device can perform the following: After the user equipment enters the radio resource control connection state with the device, it provides the user equipment with fifth signaling, which includes information identifying how to perform NAS signaling.

[0041] Information identifying how to perform NAS signaling may include at least one of the following: one or more new parameters for establishing a NAS security context for performing NAS signaling, or an indication to establish a NAS security context for performing NAS signaling using at least one previously received parameter.

[0042] The following may apply to any (e.g., one or more, including all) aspects from the first to the twentieth.

[0043] At least one of the first to fourth signaling messages may not include information identifying the NAS security context.

[0044] According to one aspect, a non-transient computer-readable medium including program instructions that, when executed by a device, cause the device to perform at least the method according to any of the foregoing aspects.

[0045] Many different embodiments have been described above. It should be understood that other embodiments can be provided by any combination of two or more of the above embodiments. Attached Figure Description

[0046] Some exemplary embodiments will now be described by way of non-limiting and illustrative examples only, with reference to the accompanying drawings, in which: Figure 1A and 1B A representation of the communication system is shown; Figure 2 The illustration shows a method for using some example embodiments. Figure 1A and Figure 1B The representation of a communication system device; Figure 3 A representation of an apparatus according to some example embodiments is shown; Figures 4 to 6 The switching method is shown; Figures 7 to 11 Example methods are shown; Figures 12A to 12D This indicates that the instance key was obtained; and Figures 13 to 27 Example methods that can be performed by the apparatus described herein are shown. Detailed Implementation

[0047] Generally, the following describes a method for handover in which a user equipment (UE) is to switch from a source network access node to a target network access node.

[0048] The following specifically refers to the situation where the source network access node is configured to instruct both the UE and the target network access node to switch to the target network access node in parallel.

[0049] Although these concepts will be explained in more detail below, examples of communication environments in which the technologies currently described can be deployed are provided. It should be understood that these communication environments are not restrictive and are merely intended to provide at least one example of where such technologies can be deployed.

[0050] In other words, in the various example embodiments below, reference is made to a communication device capable of communicating with a communication system. Before explaining in detail embodiments of the methods and apparatus of this disclosure, refer to... Figure 1A , 1B Briefly explain the fifth-generation communication system (5GS), the access network and its core network (5GC), and communication equipment in sections 2 and 3.

[0051] Figure 1AA schematic diagram of a 5G communication system (5GS) is shown. 5GS may include user equipment (UE) (also called a terminal), an access network (such as a 5G radio access network (5G-RAN) or a next-generation radio access network (NG-RAN)), a 5G core network (5GC), and one or more application functions. Application functions may be deployed as trusted application functions within the 5GS, or they may be deployed or hosted on one or more application servers in the data network. Such application functions are untrusted application functions. 5GS connects the UE to the data network access network and the 5GC (e.g., the 5GC's UPF).

[0052] 5G-RAN may include one or more radio access nodes, such as gNodeBs (gNBs). A gNB may include one or more gNodeB distributed units connected to one or more gNodeB centralized units. 5G-RAN can be as follows: Figure 1B As shown.

[0053] 5GC may include the following network functions: Network Slice Selection Function (NSSF); Network Exposure Function; Network Repository Function (NRF); Policy Control Function (PCF); Unified Data Management (UDM); Application Function (AF); Authentication Server Function (AUSF); Access and Mobility Management Function (AMF); Session Management Function (SMF); and User Plane Function (UPF). Figure 1A Various interfaces (N1, N2, etc.) that can be implemented between various components of the system are also shown.

[0054] The term "terminal device" refers to any terminal device capable of wireless communication. By way of example and not limitation, a terminal device may also be referred to as a communication device, user equipment (UE), subscriber station (SS), portable subscriber station, mobile device, mobile station (MS), or access terminal (AT). Terminal devices may include, but are not limited to, mobile phones, cellular phones, smartphones, Voice over IP (VoIP) phones, wireless local loop phones, tablets, wearable terminal devices, personal digital assistants (PDAs), portable computers, desktop computers, image capture terminal devices (such as digital cameras), gaming terminal devices, music storage and playback devices, in-vehicle wireless terminal devices, wireless endpoints, mobile stations, laptop embedded devices (LEEs), laptop devices (LMEs), USB dongles, smart devices, wireless customer premises equipment (CPEs), machine-type communication (MTC) devices, Internet of Things (IoT) devices, watches or other wearable devices, head-mounted displays (HMDs), vehicles, drones, medical devices and applications (e.g., remote surgery), industrial devices and applications (e.g., robots and / or other wireless devices operating in the context of industrial and / or automated processing chains), data consumer electronics devices, devices operating on commercial and / or industrial wireless networks, etc. Terminal devices may also correspond to the mobile terminal (MT) portion of an integrated access and backhaul (IAB) node (e.g., a relay node). In the following description, the terms “terminal equipment”, “communication equipment”, “terminal”, “user equipment”, and “UE” are used interchangeably.

[0055] As used herein, the terms "network device" and "network access node" are used interchangeably and refer to a node in a communication network through which terminal devices access the network and receive services. Network devices can refer to base stations (BS) or access points (APs), such as Node B (NodeB or NB), evolved Node B (eNodeB or eNB), NR NB (also known as gNB), Remote Radio Unit (RRU), Radio Head (RH), Remote Radio Head (RRH), repeater, integrated access and backhaul node, low-power node (such as femtoseconds, picoseconds), non-terrestrial network (NTN) or non-terrestrial network equipment (such as satellite network equipment, low Earth orbit (LEO) satellites and geostationary Earth orbit (GEO) satellites), spacecraft network equipment, etc., depending on the terminology and technology applied. In some example embodiments, the radio access network (RAN) split architecture includes a centralized unit (CU) and a distributed unit (DU) at the IAB donor node. An IAB node includes a mobile terminal (IAB-MT) portion that behaves like a UE toward its parent node, and a DU portion that behaves like a base station toward its next-hop IAB node.

[0056] In some example embodiments, the link from network device 120 to user equipment 110 or 115 is referred to as a DL, while the link from user equipment 110 or 115 to network device 120 is referred to as a UL. The link is also referred to herein as a “channel.” In the DL, network device 120 is a Tx device (or transmitter), and user equipment 110 or 115 is an Rx device (or receiver). In the UL, user equipment 110 or 115 is a Tx device (or transmitter), and network device 120 is an Rx device (or receiver). The link between user equipment 110 and another user equipment (not shown) is referred to as a side link (SL). In the SL, one of the user equipments is a Tx device (or transmitter), and the other is an Rx device (or receiver).

[0057] Communication in communication environment 100 can be implemented according to any suitable communication protocol, including but not limited to cellular communication protocols such as first-generation (1G), second-generation (2G), third-generation (3G), fourth-generation (4G), fifth-generation (5G), and sixth-generation (6G), wireless local area network communication protocols such as IEEE 802.11, and / or any other currently known or future-developed protocols. Furthermore, communication can utilize any suitable wireless communication technology, including but not limited to: Code Division Multiple Access (CDMA), Frequency Division Multiple Access (FDMA), Time Division Multiple Access (TDMA), Frequency Division Duplex (FDD), Time Division Duplex (TDD), Multiple-Input Multiple-Output (MIMO), Orthogonal Frequency Division Multiple Access (OFDM), Discrete Fourier Transform Extended OFDM (DFT-s-OFDM), and / or any other currently known or future-developed technologies.

[0058] Figure 2 It shows the control Figure 1A and 1B The access network shown (e.g., Figure 1A and 1BAn example of a control device 200 for 5G-RAN or NG-RAN functions is shown. The control device 200 may include at least one random access memory (RAM) 211a, at least one read-only memory (ROM) 211b, at least one processor 212, 213, and a network interface 214. The at least one processor 212, 213 may be coupled to the RAM 211a and ROM 211b. The at least one processor 212, 213 may be configured to execute appropriate software code 215. Execution of the software code 215 may, for example, cause the device to perform operations for controlling access network functions. The software code 215 may be stored in the ROM 211b. The control device 200 may interconnect with another control device 200 for controlling another function of the 5G-RAN or NG-RAN. In some embodiments, each function of the 5G-RAN or NG-RAN is deployed or hosted on the control device 200. In alternative embodiments, two or more functions of the 5G-RAN or NG-RAN may share the control device.

[0059] Figure 3 A communication device 300 (such as) is shown. Figure 1A and 1B The example shown above is a UE. Communication device 300 can be provided by any device capable of transmitting and receiving radio signals. Non-limiting examples of communication device 300 include user equipment, mobile station (MS) or mobile device (such as a mobile phone or a device called a "smartphone"), computer equipped with a wireless interface card or other wireless interface facility (e.g., a USB dongle), personal data assistant (PDA) or tablet computer providing wireless communication capabilities, machine-type communication (MTC) device, Internet of Things (IoT) type communication device, or any combination thereof. Communication device 300 may include a transceiver for transmitting and / or receiving wireless signals carrying, for example, communications (e.g., radio signals). The communications can be one or more of voice, email, text messages, multimedia data, machine data, etc.

[0060] Communication device 300 can receive wireless signals (e.g., radio signals) over the air or on radio interface 307 via suitable means for receiving, and can transmit wireless signals via suitable means for transmitting. Figure 3 In this diagram, the transceiver is schematically designated by block 306. Transceiver 306 may include, for example, a radio section and an associated antenna arrangement. The antenna arrangement may be located inside or outside the mobile device and may include one or more antenna elements. The antenna arrangement may be a multiple-input multiple-output (MIMO) antenna.

[0061] The communication device 300 may include at least one processor 301, a memory 302 including at least one ROM 302a and at least one RAM 302b, and other possible components 303 for use in the software and hardware-assisted execution of the tasks it is designed to perform, including access to a network (e.g., Figure 1A and Figure 1B The control of access and communication with 5G-RAN (or NG-RAN) and other communication devices shown is provided. At least one processor 301 is coupled to RAM 302b and ROM 302a. At least one processor 301 can be configured to execute appropriate software code 308. The software code 308 can, for example, allow the execution of one or more operations of the communication device. The software code 308 can be stored in ROM 302a.

[0062] Processors, ROM and RAM, transceivers, and other circuitry for the communication device (e.g., modems) may be located on a circuit board, in a chipset, or in a system-on-a-chip. Circuit boards, chipsets, or system-on-a-chip are indicated by reference numeral 304. The communication device 300 may optionally have a user interface, such as a keypad 305, a touchscreen or keypad, or combinations thereof. Optionally, depending on the type of communication device, one or more of a display, speaker, and microphone may be provided.

[0063] Security methods for situations such as those concerning Figures 1A to 3 The communication devices in the network shown are important.

[0064] For example, 3GPP currently defines several different keys that can be used for encryption and / or integrity protection in different communications. Figures 12A to 12D The different types of keys currently used in 3GPP are shown, along with example inputs for various Key Obtaining Functions (KDFs) used to obtain the keys.

[0065] The 3GPP system also includes at least two different security levels for providing security for messages transmitted between the UE and the network: the access layer (AS) for communication between the UE and the network access node, and the non-access layer (NAS) for communication between the UE and core network functions.

[0066] More specifically, the AS security level provides security between the UE and the network access node (e.g., gNB). The AS security method is used to perform encryption and integrity protection on AS signaling and to provide integrity protection for signaling user plane data.

[0067] For example, AS signaling can involve the establishment, maintenance, and termination of radio bearers, and its functions involve Radio Resource Control (RRC), Packet Data Convergence Protocol (PDCP), Radio Link Control (RLC), and Media Access Control (MAC).

[0068] In contrast, the NAS security level aims to provide security between the UE and core network functions (e.g., core network functions). NAS messages can be used to facilitate various processes such as registration, session establishment, security, and mobility management.

[0069] For example, NAS signaling can involve using functions related to session management, mobility management, and connection management to control the UE's mobility and session management.

[0070] The following provides some more information about NAS security in the context of NAS security.

[0071] In 3GPP networks, security parameters used for authentication, integrity protection, and encryption are bound together in the 5G NAS security context and identified by a key set identifier (denoted as "ngKSI" in this document). The relationships between these security parameters are defined in 3GPP TS 33.501 and discussed further below.

[0072] Before security can be activated, the UE establishes a 5G NAS security context with the target AMF.

[0073] Typically, a 5G NAS security context is created as a result of the primary authentication and key negotiation process performed between the AMF and the UE. A new 5G NAS security context can also be created during handover from one 5G entity to another, or during handover from a non-5G entity (e.g., Evolved Packet System (EPS) to a 5G entity). In the latter case, the AMF and UE can obtain the mapped 5G NAS security context from the EPS security context already established when the UE receives services via a non-5G entity.

[0074] The key set identifier ngKSI is assigned by the AMF. The AMF can perform this assignment during the primary authentication and key negotiation process, or during inter-system changes for a mapped 5G NAS security context. ngKSI includes the type and value of a security context parameter indicating whether the 5G NAS security context is a native 5G NAS security context or a mapped 5G NAS security context.

[0075] The 5G NAS security context indicated by ngKSI can be used to establish secure exchange of NAS messages when a new N1 NAS signaling connection is established without performing a new master authentication and key negotiation process, or when the AMF initiates a security mode control procedure. For this purpose, the initial NAS messages currently signaled in 3GPP (e.g., registration requests, deregistration requests, service requests, etc.) and security mode command messages include the ngKSI in the ngKSI information element, which indicates the current 5G NAS security context used for integrity protection of NAS messages.

[0076] Secure exchange of NAS messages via NAS signaling connections is typically established by the AMF during the registration process by initiating a secure mode control procedure. This secure mode control procedure usually provides the UE with a NAS container (NASC).

[0077] The NAS container is a field used to transmit UE-specific NAS layer information between the core network and the UE. The RRC layer is transparent to this field, although it affects the activation of AS security after a system handover to a new radio. The contents of the NAS container field are defined in TS 24.501, TS 38.331, and TS 33.501.

[0078] The NAS container field may include at least one of the following: The securityNASC field indicates whether the handover is an inter-system handover (e.g., between cells provided by different nodes). The MasterKeyChange field indicates whether there has been a change to the AS security algorithm associated with the master key; The K_AMF_change_flag indicates whether the AMF key (K_AMF) should be changed. This can indicate yes or no. Received downlink NAS COUNT value; ngKSI is the key set identifier; The selected NAS security algorithm; or NAS MAC.

[0079] Under the current specification, when the target AMF receives keyAmfHDerivationInd, K_AMF_change_flag is set to 1. Otherwise, K_AMF_change_flag is set to zero. When the target AMF does not receive keyAmfHDerivationInd but wants to change the NAS algorithm, the target AMF creates the NASC using the selected NAS security algorithm in the same manner as in the case obtained for horizontal KAMF. However, in the latter case, the target AMF does not set NASCOUNT to zero.

[0080] After the security mode control process is successfully completed, all NAS messages exchanged between the UE and AMF are sent with integrity protection using the current 5G security algorithm, and most NAS messages exchanged between the UE and AMF are sent with encryption using the current 5G security algorithm.

[0081] When the AMF initiates re-authentication to create a new 5G NAS security context, messages exchanged during the authentication process are protected for integrity and encrypted using the current 5G NAS security context (if any).

[0082] Both the UE and AMF continue to use the current 5G NAS security context until the AMF initiates a security mode control procedure by sending a security mode command message to the UE that includes the new NASC. The security mode command message sent by the AMF includes the ngKSI of the new 5G NAS security context to be used. The AMF sends a security mode command message that is integrity-protected with the new 5G NAS security context but not encrypted. When the UE responds to the security mode command message (e.g., using a security mode completion message), the UE sends a response message that makes it utilize the new 5G NAS security context with integrity protection and encryption.

[0083] During some handover processes, when the UE's source network access node decides to hand over the UE to a selected target network access node, the source network access node initiates preparation at the selected target network access node for the UE to send a handover request (HORequest) message to the selected target network access node. The selected target network access node can then initiate an admission control procedure upon receiving the HORequest message. The admission control procedure may include generating a security key based on a known procedure, etc. When the selected target network access node returns an acknowledgment message to the source network access node regarding the handover signaling, the generated security key (and other configuration information) can be provided to the source network access node. The source network access node can then trigger the UE's handover to the selected target network access node.

[0084] This switching process can be associated with latency and wasted network resources (e.g., especially when the switching is not actually performed).

[0085] To mitigate the drawbacks associated with this traditional process, the handover preparation phase can be postponed, in which the source network access node first provides the selected target network access node with UE handover-related information in parallel with the transmission of the handover command from the source network access node to the UE. When the handover preparation phase is delayed and / or skipped in this manner, the handover process can be referred to as an "unprepared handover".

[0086] How to perform this unprepared handover can depend on whether the source network access node can directly signal the target network access node (e.g., using the Xn interface between the two access network nodes), or whether the source network access node should signal the target network access node through core network functions (e.g., when there is no Xn interface between the two access network nodes, and communication can be performed via the AMF of the two access network nodes using the N2 interface). When the source network access node performs a handover to the target network access node by directly signaling the target network access node, this is called "Xn-based handover". When the source network access node performs a handover to the target network access node by signaling the target network access node through core network functions, this is called "N2-based handover".

[0087] about Figures 4 to 6 These two different types of switching are shown.

[0088] Figure 4 An example of unprepared handover-related signaling that can be executed when an interface (e.g., an Xn interface) exists between the source network access node and the target network access node is shown.

[0089] Figure 4 The signaling that can be executed between UE 401, source network access node 402 and target network access node 403 is shown.

[0090] During 4001, the target network access node 403 signals to the source network access node 402. This signaling may provide the source network access node with a baseline configuration for fast handover operations. This signaling may include RAN node configuration update messages. For each cell provided by the target network access node, the baseline configuration may be considered to include the corresponding default configuration for that cell. Each corresponding default configuration may be associated with a standard used for using that cell. The standard may be provided and / or indicated to the source network access node (e.g., during 4001).

[0091] During signaling 4002, the source network access node 402 sends a signal to the target network access node 403. This signaling can confirm the signaling of 4001. The signaling of 4002 may include RAN node configuration update confirmation.

[0092] 4003 to 4006 involve the source network access node 402 determining to perform a fast handover to switch UE 401 to the target cell 403.

[0093] During period 4003, the source network access node 402 sends a signal to the UE 401. This signaling can provide the UE with a measurement configuration for performing one or more measurements (e.g., on neighboring cells provided by the target network access node 403 and / or on cells provided by the source network access node 402).

[0094] During period 4004, UE 401 provides at least one measurement report to source network access node 402, including measurement values ​​based on the measurement configuration of 4003.

[0095] During 4005, the source network access node 402 determines, based on the measurement value of 4004, that a handover should be performed to switch UE 401 to the target network access node 403.

[0096] During period 4006, the source network access node 402 determines that at least one of the aforementioned criteria for performing a fast handover from the UE to the target network access node 403 has been met. In this scenario (e.g., when the source network access node has a UE to be handed over to the new node and simultaneously meets the associated criteria corresponding to the default target configuration), a handover without a HO preparation phase can be initiated (e.g., an unprepared handover can be performed).

[0097] During signaling 4007, the source network access node 402 signals to the UE 401. This signaling may include a handover identifier and the aforementioned default configuration of the target cell provided by the target network access node 403. The signaling for signaling 4007 may be included in a Radio Resource Control (RRC) reconfiguration message.

[0098] 4008 can be executed in parallel with 4007 and involves triggering preparations for the target network access node to utilize UE information.

[0099] During 4008, the source network access node 402 signals to the target network access node 403. This signaling may include a handover identifier and UE-related information. For example, the signaling for 4008 may include information similar to that provided in the handover request (HOR) message. The signaling for 4008 may be included in the handover information message.

[0100] 4009 to 4012 involve the connection between the UE and the target network access node 403.

[0101] During the period from 4009 to 4010, UE 401 and target network access node 403 perform random access channel signaling procedures.

[0102] During 4011, UE 401 signals to the target network node an indication that UE 401 has successfully applied the target cell's baseline (e.g., default) configuration. This signaling can be provided in the RRC reconfiguration completion message. This signaling may include a handover identifier.

[0103] During period 4012, when the target cell determines that the default configuration can be improved for the UE, the target cell 403 signals a reconfiguration message (e.g., an RRC reconfiguration message) to the UE. This signaling may include one or more changes to the default configuration. The signaling may include an identifier of the target cell to which the change will be applied. For example, the signaling may include a Cell Radio Network Temporary Identifier (C-RNTI). The C-RNTI is a unique temporary identifier assigned to the UE by the network access node and can be assigned to the UE during the random access procedure.

[0104] Figure 5 and 6 Examples are shown where at least one intermediate entity (e.g., one or more AMFs via corresponding N2 interfaces) is used to facilitate handover-related communication between the source network access node and the target network access node. These examples illustrate the security handling of a normal HO (not an unprepared HO). In other words, in Figure 5 and 6 In the example, there is no Xn interface between the source network access node and the target network access node, or the Xn interface between the source network access node and the target network access node is not used by the source network access node and the target network access node to send handover-related communications. Figure 5 and 6 Examples are shown where the source and destination network access nodes are associated with different AMFs. However, it should be understood that in some handovers, the source and destination network access nodes are served by the same AMF.

[0105] Figure 5 and Figure 6 They differ in how they obtain the key (K_gNB) of the target network access node.

[0106] Specifically, Figure 5 An example of an N2-based switch that does not change the AMF key is shown, while Figure 6 An example of a vertical key obtained by switching based on N2 is shown.

[0107] Figure 5 Example signaling is shown in an example where the source AMF does not set keyAmfHDerivationInd, but the target AMF still determines to change the NAS algorithm.

[0108] Figure 5 The signaling that can be executed between UE 501, source network access node 502, source AMF 503 associated with the source network access node, target network access node 504, and target AMF 505 associated with the target network access node is shown.

[0109] 5001 to 5003 involve the source network access node 502 determining to perform a handover to switch UE 501 to the target network access node 504.

[0110] During period 5001, the source network access node 502 sends a signal to the UE 501. This signaling can provide the UE with a measurement configuration for performing one or more measurements (e.g., on neighboring cells provided by the target network access node 504 and / or on cells provided by the source network access node 502).

[0111] During 5002, UE 501 provides at least one measurement report to source network access node 502, including measurement values ​​based on the measurement configuration of 5001.

[0112] During 5003, the source network access node 502 determines, based on its measurements, that a handover should be performed to switch UE 501 to the target network access node 504.

[0113] During period 5004, the source network access node 502 signals to the source AMF 503. For example, this signaling can instruct UE 501 to be switched to the target network access node 504.

[0114] Based on signaling 5004, the key is obtained for the target network access node 504. This is illustrated by signaling 5005 to 5015. This key acquisition (derivation) can be referred to as horizontal key acquisition (derivation).

[0115] During signaling 5005, source network access node 502 signals to source AMF 503. This signaling may include information indicating that a Next Generation Application Protocol (NGAP) handover should be performed.

[0116] During period 5006, source AMF 503 increments the next-hop chain counter (NCC) and calculates a new next-hop (NH) value. The NCC is a counter that tracks how many times the key chain has been executed vertically. Figure 12C An exemplary NCC and NH relationship for obtaining (deriving) horizontal and vertical keys is shown.

[0117] The new NH and incremental NCC of 5006 can be said to be paired together, or otherwise associated together.

[0118] During 5007, source AMF 503 signals to target AMF 505. This signaling may include a request to create a UE context at target network access node 504. For example, this signaling may include a Namf_Com_createUEContext_request message. This signaling may include indications of the NH and NCC pairs, and indications of the AMF key K_AMF.

[0119] During 5008, the target AMF is stored in the NH and NCC pairs and K_AMF received during 5007.

[0120] 5009 to 5011 involve the target network access node 504, which determines the network access node key K_gNB based on NH and NCC.

[0121] During period 5009, target AMF 505 signals to target network access node 504. This signaling may include NH and NCC pairs. This signaling may include an NGAP handover request.

[0122] During process 5010, target network access node 504 determines the new key K_NG-RAN. The new key can be determined based on (for example, using) the identifier of the target network node (e.g., the Physical Cell Identifier (PCI) of the target network access node cell and / or the downlink absolute radio frequency channel number (ARFCN-DL) and / or NH value of the cell). ARFCN-DL is the downlink absolute radio frequency channel number (ARFCN) that identifies a cell or base station in a wireless network.

[0123] During period 5010, target network access node 504 uses K_NG-RAN. To determine K_gNB. This can be done as per [reference to...]. Figure 12B To execute, see the instructions.

[0124] During 5011, the target network access node 504 associates K_gNB with NH.

[0125] Sections 5012 to 5013 involve the creation of NAS containers (NASCs) related to NAS security by the target AMF.

[0126] During 5012, the target network access node 504 signals to the target AMF 505. This signaling may include NCC (Network Control Center). This signaling may include acknowledgment of the signaling in 5009. For example, this signaling may include NGAP (Next Generation Access Point) handover acknowledgment.

[0127] During signaling 5013, target AMF 505 signals to source AMF 503. This signaling may include NAS security-related information. This signaling may include the NAS container (NASC). This signaling may include the NCC value. This signaling may include the UE context of UE 501. For example, this signaling may include Namf_com_createUContext_response. In other words, this signaling may include a response to the signaling in signaling 5007.

[0128] During 5014, source AMF 503 signals to source network access node 502. This signaling may include NCC. This signaling may include NAS containers. This signaling may include acknowledgment of signaling to 5003. This signaling may include acknowledgment of NGAP handover requests.

[0129] During signaling 5015, the source network access node sends a signal to UE 501. This signaling may include an RRC reconfiguration message. This signaling may include an NCC message. This signaling may include a NAS container.

[0130] During period 5016, the UE determines whether the NCC received during period 5015 is equal to the current NCC value maintained at the UE. If these two NCC values ​​are the same, then K_NG-RAN is determined based on K_gNB, target PCI, and ARFCN. When they are not equal, the UE performs NH value synchronization based on the received NCC and the NH value maintained at the UE.

[0131] During 5017, UE 501 and target network access node 504 exchange signaling to complete the random access procedure.

[0132] During 5018, UE 501 sends a signal to the target network access node 504 to notify it of the RRC reconfiguration completion message.

[0133] exist Figure 5 In the example, from the UE's perspective, the key derivation of the target network access node is controlled by the NCC (provided in the handover command) and parameters optionally used for NAS security updates.

[0134] In addition, Figure 5 In this example, the source network access node determines to initiate a handover to the target network access node. To do this, the source network access node contacts its source AMF. In this example, the source AMF retains K_AMF and increments the NCC value by 1. The source AMF uses this incremented NCC value to calculate the corresponding NH value. The incremented NCC value and the corresponding NH value are associated together to form an NCC-NH pair.

[0135] The NCC and NH pair are provided to the target AMF, which has the source AMF's key (i.e., K_AMF). Since the source AMF computed this key, the source network access node knows the key at the target network access node. The source network access node possesses the key used between the UE and the target for a period of time. Once connected to the UE, the target can choose to perform a key update to remedy this situation (not shown in the figure).

[0136] The target AMF can store the received K_AMF and provide the NCC and NH pairs to the target network access node. The target AMF can also determine whether to use new NAS security parameters to perform signaling communication between the target network access node and the UE. When it is determined that new NAS security parameters will be used, the target AMF can form a new NACS (NAS Security Container) based on the new NAS security parameters.

[0137] The NASC is later provided to the source network access node, which can forward the NASC and NCC to the UE in the handover command.

[0138] When the UE receives a handover command, it disconnects from the source network access node. The UE can also calculate a key (e.g., K_gNB) to be used with the target network access node based on its stored K_AMF version and the received NCC. The UE can also determine the NAS security key based on the K_AMF and the received NASC. The UE can then use the AS key (e.g., K_gNB) and the obtained key (such as K_RRC_int used for communication with the target network access node) to access the target network access node. At this point, the handover is considered complete.

[0139] Once the handover is complete, the network can allow the key to be updated. This can be done, for example, using a path switching mechanism and / or by performing something known as an "internal handover" or "self-handover." From a privacy perspective, changing the key can be useful to ensure that the source network access node no longer contains a valid security key used for communication.

[0140] As mentioned above, Figure 6 An example of obtaining (deriving) the vertical key in N2-based switching is shown.

[0141] UE 601, source network access node 602, source AMF associated with the source network access node 603, target network access node 604, and target AMF associated with the target network access node 605.

[0142] Steps 6001 to 6003 involve the source network access node 602 determining to perform a handover to switch UE 601 to the target network access node 604.

[0143] During period 6001, source network access node 602 sends a signal to UE 601. This signaling can provide the UE with a measurement configuration for performing one or more measurements (e.g., on neighboring cells provided by target network access node 604 and / or cells provided by source network access node 602).

[0144] During 6002, UE 601 provides at least one measurement report to source network access node 602, including measurement values ​​based on the measurement configuration of 6001.

[0145] During 6003, the source network access node 602 determines, based on its measurements, that a handover should be performed to switch UE 601 to the target network access node 604.

[0146] During period 6004, the source network access node 602 signals to the source AMF 603. This signaling may include handover information. For example, the signaling may indicate that UE 601 will be handed over to the target network access node 604.

[0147] Based on signaling 6004, it is determined that a new key will be obtained for target network access node 604 and target AMF 605. This is illustrated by signaling from 6005 to 6015.

[0148] During step 6005, the source AMF 603 sets the NCC to 0 and generates a new network access node key, KgNB. The source AMF 603 can also generate a new key for the target AMF.

[0149] During period 6006, source AMF 603 signals to target AMF 605. This signaling may include a request to create a UE context at target network access node 604. For example, this signaling may include a Namf_Com_createUEContext_request message. This signaling may include an indication of a new NCC, a newly generated KgNB, a newly generated ngKSI, a NAS count, and an indication of whether a new key AMF has been obtained (keyAmfHD erivationInd). During 6007, the target AMF sets NH to equal KgNB and associates it with NCC to form an NCC and NH pair. The target AMF also stores the K_AMF received during 6006 and sets the NAS count to zero. Target AMF 605 also creates a NASC for setting NAS security parameters for communication between UE 601 and the core network.

[0150] Sections 6008 to 6011 involve the target network access node 604, which determines the network access node key K_gNB based on NCC and NH pairs.

[0151] During 6008, target AMF 605 signals to target network access node 604. This signaling may include NCC and NH pairs stored at target AMF 605. This signaling may include NACS and NSCI. This signaling may include an NGAP handover request.

[0152] During process 6009, target network access node 604 determines the new key K_NG-RAN. The new key can be determined based on (for example, using) the target network access node's PCI and ARFCN-DL, as well as the received NH.

[0153] During 6010, target network access node 604 uses K_NG-RAN. To determine K_gNB.

[0154] During 6011, the target network access node 604 associates K_gNB with NH.

[0155] Sections 6012 to 6013 involve the creation of NAS containers (NASCs) related to NAS security by the target AMF.

[0156] During 6012, the target network access node 604 signals to the target AMF 605. This signaling may include NCC (Network Control Center). This signaling may include acknowledgment of the signaling at 6009. For example, this signaling may include NGAP (Next Generation Access Point) handover acknowledgment.

[0157] During signaling 6013, target AMF 605 sends a signal to source AMF 603. This signaling may include NAS security-related information. This signaling may include NAS containers. This signaling may include NCC. This signaling may include Namf_com_createUContext_response. In other words, this signaling may include a response to the signaling 6007.

[0158] More specifically, and according to TS 33.501, when the target AMF receives an instruction to perform a level KAMF derivation (i.e., keyAmfHD erivationInd), the target AMF obtains the NAS encryption and integrity protection key from the received KAMF, as specified in TS 33.501, and sets the NAS COUNT to zero. The target AMF creates a NASC (NAS container) that includes K_AMF_change_flag, the received downlink NAS COUNT, ngKSI, the selected NAS security algorithm, and the NAS MAC.

[0159] During 6014, source AMF 603 signals to source network access node 602. This signaling may include NCC. This signaling may include NAS containers. This signaling may include acknowledgment of the signaling at 6004. This signaling may include acknowledgment of the NGAP handover request.

[0160] During signaling 6015, the source network access node sends a signal to UE 601. This signaling may include an RRC reconfiguration message. This signaling may include an NCC message. This signaling may include a NAS container.

[0161] During step 6016, the UE determines whether NCC_HOC is equal to NCC_current_KgNB. If so, then K_NG-RAN... It is determined based on K_gNB, target PCI, and ARFCN. When they are not equal, the UE performs network synchronization based on the local NH value.

[0162] During 6017, UE 601 and target network access node 604 exchange signaling to complete the random access procedure.

[0163] During 6018, UE 601 sends a signal to target node 604 to notify the RRC of the reconfiguration completion message.

[0164] In these N2-based handover examples, the target network access node is guided by its AMF (e.g., the "target AMF") to use the new NAS security settings. In this case, the handover command sent from the source access network node to the UE includes the NAS container (NASC) of the target network access node.

[0165] This means that for N2-based unprepared handover, the source network access node still needs to wait for the target AMF to provide the source network access node with a UE-specific NACS before (multiple) handover commands can be sent to the UE and the target network access node.

[0166] This may mitigate the beneficial effects of performing an unprepared handover because there is a delay before the source network access node is able to send a handover command to the UE (caused by the source network access node waiting for the UE-specific target network access node NAS configuration).

[0167] In addition to awaiting NAS security parameters from the target network, the source network access node also provides the UE with access stratum security parameters for communication between the UE and the target network access node. In other words, the handover command provided to the UE includes an indication of which AS security algorithms the UE should use with the target network access node. This can lead to issues because the source network access node can be configured to wait for UE-specific configurations from the target network access node. It should be understood that, for AS security parameters, the target network does not need to retain resources or generate keys for the source network access node to obtain information about the AS security algorithms to be used by the network access node.

[0168] The following aims to address one or more of the problems mentioned above.

[0169] Specifically, the following proposal suggests that during N2-based handover, the UE should relinquish NAS signaling via the target network access node until a new NAS security procedure is performed after the UE is connected to the target network access node. In other words, the following UE postpones NAS signaling relative to the previous N2-based handover.

[0170] In the method described below, although the NAS security parameters accompanying the handover command are not provided to the UE, the UE can still be provided with AS security mechanisms for communicating with the target network access node. Providing these AS security mechanisms does not result in reserving any resources for the UE, therefore this method can still be considered an unprepared handover.

[0171] Figures 7 to 27 The example illustrates sample signaling that can be executed according to the principles described in this article.

[0172] Figure 7 The signaling that can be executed between UE 701, source network access node 702, source AMF 703, target AMF 704, and target network access node 705 is shown.

[0173] During 7001, the source network access node 702 is configured with information indicating the AS security algorithm to be applied by the target network access node 702. This configuration of 7001 can be considered as part of preparation for a handover that is not yet ready (e.g., for a handover in which the UE and the target network access node are simultaneously instructed to perform a handover).

[0174] During 7002, the source network access node 702 determines the Security Mode Command (SMC) parameters of the target network access node 705 based on the AS security algorithm indicated during 7001. Typically, SMC parameters can be understood as parameters corresponding to a specific AS algorithm that will be applied by the network access node for the UE. AS parameters may include algorithm identifiers used for encryption and integrity protection. These Security Mode Command parameters may correspond to one or more AS algorithm changes, which will be executed as part of an unprepared handover command provided to the source AMF.

[0175] During 7003, the source network access node 702 signals to the UE 701 via an RRC message containing, for example, MeasConfig. This signaling can provide the UE with a measurement configuration for performing one or more measurements (e.g., on neighboring cells provided by the target network access node 604 and / or on cells provided by the source network access node 702).

[0176] During 7004, UE 701 provides at least one measurement report to source network access node 702, including measurement values ​​based on the measurement configuration of 7003.

[0177] During 7005, the source network access node 702 determines whether to perform a handover to switch UE 701 to the target network access node 704 based on 7002's measurements or load considerations.

[0178] 7006 to 7007 correspond to signaling used to perform an unprepared handover for this N2 handover situation.

[0179] During 7006, the source network access node 702 signals to the UE. This signaling can be used to cause the UE 701 to attempt to connect to the network via the target network access node 705. For example, this signaling may include an RRCReconfiguration with synchronization, or any other signaling used to cause the UE to perform a handover. This signaling may include configuration for performing an unprepared handover. This signaling may include an NCC value. This signaling may include AS parameters, which include an algorithm identifier for encryption and integrity protection to be used in the target network access node. This signaling may include an indication that the UE should abandon the execution of NAS signaling until the UE has received information about NAS signaling via the network access node. In other words, the signaling in 7006 may include information causing the UE to postpone the execution of any NAS signaling until after the target network access node has provided signaling to the UE, providing information on how to execute the NAS signaling.

[0180] Considering the current languages ​​and methods available in 3GPP, an indication to defer NAS signaling can be a new information element in the existing RRCReconfigurationWithSync field and / or MasterKeyUpdate field. In those cases, notification of the deferral of NAS signaling can be provided to a higher layer (e.g., NAS). The indication that NAS will be deferred can be a new element in the NASC corresponding to the source network access. This indication can be explicit or implicit. When the indication is implicit, specific values ​​for existing elements in the NASC (such as setting "NAS MAC" or "selected NAS security algorithm") can be set to new values ​​(e.g., None) to indicate that NAS signaling will be deferred.

[0181] During 7007, the source network access node 702 signals to the source AMF 703. This signaling may include information to allow the target network access node 705 to act as the serving node of UE 701. This signaling may include (or may include therein) messages such as NGAP handover requests and / or NGAP notification messages.

[0182] The signaling in 7007 may include an indication to perform an unprepared handover. The signaling may include an indication of the SMC parameter selected in 7002, i.e., the AS security algorithm identifier signaled to the UE. An indication of the selected SMF parameter may be included in the indication to perform an unprepared handover. An indication of the selected SMF parameter may be provided as part of the indication to perform an unprepared handover. In some examples, an indication of the selected SMF parameter may be used as an indication to perform an unprepared handover.

[0183] An unprepared handover indication can be interpreted as informing the target AMF and target network access node that the handover request cannot be refused (because the UE has already received the handover command). This indication may include security settings for the UE contained in the handover command. This indication allows the target AMF to understand that NAS is postponed. This signaling also allows the target AMF and / or target network access node to determine the encryption algorithm and key set identifier that the UE will use. In the example, this indication is also configured (e.g., via standard protocols) to signal to the target network access node and / or target AMF that a horizontal or vertical K_gNB is being executed (thus allowing the omission of NCC). NAS delay indication can be configured (e.g., via standard protocols) to identify a specific AS algorithm.

[0184] The signaling of 7007 may also include other information to enable the target network access node 705 to serve UE 701. For example, the signaling of 7007 may include the UE's network identifier (e.g., the C-RNTI used or another UE identifier used for HO or not prepared for HO), UE context, and / or data radio bearer (DRB) configuration. The DRB configuration can provide information about how to provide data to the UE (e.g., by providing Quality of Service (QoS) flow mapping to the data radio bearer). In some cases, AS security parameters may be included in the DRB configuration according to the Dynamic Radio Resource Allocation (DRP) configuration.

[0185] 7008 to 7009 involve signaling preparation for handover based on 7006 to 7007. It should be understood that 7008 to 7009 can be executed in parallel with each other in order to reduce the handover time.

[0186] During 7008, UE 701 obtains a key (e.g., K_gNB) for communicating with the target network access node 705. This may involve horizontal key acquisition or vertical key acquisition (as illustrated in the examples later). The UE may relinquish (e.g., postpone execution) NAS signaling until UE 701 has received further information via the target network access node 705 instructing how to execute the NAS signaling. This further information may include, for example, a security update including a new NASC (e.g., updated RRC security), and / or an indication to continue using the NASC previously configured at UE 701.

[0187] During 7009, the source AMF decides whether to perform horizontal or vertical key acquisition to obtain the K_gNB of the target network access node. In other words, the source AMF decides whether to obtain a new AMF K_amf to determine the new K_gNB for the target network access node 705.

[0188] During 7009, the target AMF further determined whether the UE's existing NASC should be updated.

[0189] During the period from 7010 to 7012, the UE does not send any NAS messages.

[0190] During 7010, UE 701 and target network access node 705 exchange AS access-related signaling (e.g., by performing a contention-based random access procedure and / or a contention-free random access procedure).

[0191] During 7011, UE 701 signals to the target network access node 705 to indicate that the UE has applied the RRC configuration received in 7006. This signaling in 7011 can also indicate that the random access network procedure has been completed (e.g., the primary authentication procedure has been completed). This signal (in some examples) can be incorporated into the random access procedure 7010. This signaling may include an RRCReconfigurationComplete message. The signaling in 7011 can be encrypted using an AS key.

[0192] During 7012, the target network access node 705 signals to the UE 701. This signaling may include information indicating how to perform NAS signaling. For example, the signaling may include a new NASC in an RRC security update message. The signaling for 7012 can be signaled using an internal HO signaling procedure. As another example, the signaling for 7012 may include an indication that the UE will use NAS parameters previously configured at UE 701 for NAS-based signaling. This signaling can be performed using a new RRC message or a new Information Element (IE) container, and does not necessarily require an internal HO operation.

[0193] During 7013, UE 701 obtains the NAS key based on the signaling of 7012, and performs signaling based on (for example, using) these NAS keys.

[0194] In 7014, the target network access node indicates to the AMF that the HO is complete (e.g., using a "HO notification" message). This message allows the AMF to understand that it can resume non-security-related NAS signaling toward the UE, etc.

[0195] During 7015, the source network access node 702 is instructed to release any UE context previously held for UE 701. In other words, during 7014, the target network access node 705 becomes the serving network access node for UE 701.

[0196] During 7016, the target AMF indicates to the source network access node 702 (via the source AMF) that the source network access node can now release the UE context of UE 701 previously maintained at the source network access node.

[0197] exist Figure 7In the example, the UE may receive a handover command including an NCC value. This value may be the same as the current value of the NCC maintained at the UE, or it may be an incremented value relative to the NCC maintained version at the UE (e.g., the current NCC or NCC+1). The current value may be received when performing horizontal key acquisition to obtain the K_gNB of the target network access node. The incremented value may be received when using vertical key acquisition to obtain the K_gNB of the target network access node. The handover command may include an indication that NAS security is deferred at the target. The UE also obtains the AS security key based on the received NCC value and the contents of the optional AS algorithm security settings. In some examples, instead of receiving the NCC value, an indication of NAS deferred is received. In this case, a predefined (e.g., default) AS security acquisition method may be used to obtain the K_gNB of the target network access node.

[0198] The UE then initiates access to the target network access node and establishes an RRC connection using the AS security key. When the UE RRC connects to the target network access node, the UE does not attempt to execute NAS signaling.

[0199] When the UE is connected to the target network access node via RRC-, it waits for an RRC security update (MasterKeyUpdate) and NAS container from the network to establish NAS security, and / or waits for an indication of whether previously received NAS parameters will be used for NAS signaling.

[0200] What may happen is, Figure 7 A UE can perform AS access before the target network has completed UE context creation. In this case, it is assumed that the target already knows the UE's identifier (e.g., as part of unprepared handover admission control during unprepared handover preparation signaling). It can also be assumed that the target network access node can identify that the contention-based random access message 3 (containing an unencrypted C-RNTI) belongs to a UE undergoing unprepared handover. This can be achieved, for example, by the target network access node providing a pool of C-RNTIs to the source network access node as part of the target network access node's baseline configuration, and the source network access node selecting one of the C-RNTIs from the pool, and providing an indication of the selected C-RNTI to the UE in HO command 7006 and / or to the target network access node in signaling 7007. When the target network access node has not received the handover information before receiving the random access preamble from the UE as part of the random access procedure, the target network node can still know that the UE is a UE that applied the C-RNTI from the default C-RNTI pool.

[0201] As another example, the source network access node can generate its own unique identifier for an unprepared HO and provide that identifier in signaling 7006 and 7007. A similar mechanism can be applied at the target network access node to identify the UE as an unprepared HO UE when signaling arrives from the target network access node before the target has been prepared using the UE context. The target network access node can delay the integrity check of message 3 and delay the contention resolution of contention-based random access message 4 (with additional optional RRCR econfiguration) until the AS encryption key is obtained at the target.

[0202] Despite Figure 7 It is not shown in the diagram, but UE 701 can maintain a timer to ensure that the NAS security context is eventually updated.

[0203] A timer can be started (e.g., initiated) in any of a variety of ways. For example, a timer can be started when initiating primary authentication (e.g., initiating a random access procedure). Depending on the network configuration, a timer can be started when the UE RRC connects to the target network access node. A timer can be started when the UE receives a handover command.

[0204] The timer can be stopped when a time value expires (e.g., timer expires) or when the UE receives an RRC security update containing parameters for establishing NAS security or an RRC indication indicating that the previously configured NAS security can continue to be used. The timer can also be started when the UE receives an HO command or when the UE has already established an RRC connection with the target (e.g., with RRCR econfigurationComplete).

[0205] When the timer expires and the network does not provide the UE with a NAS security context, the UE can re-initiate primary authentication (e.g., according to TS 33.501) or request the establishment of a NAS security context from the RRC using a new message.

[0206] Timer values ​​can be configured via the network. For example, timer values ​​can be provided via fields in the switching command and / or in a configuration where a switch is not yet planned.

[0207] On the network side, new signaling is introduced that allows network access nodes to know the AS security policies of their neighbors. This allows the source network access node to populate the "unready handover" command sent to the UE with parameters that allow the UE to establish an RRC connection (AS access) with the target network access node.

[0208] Figures 8A to 8CExample signaling is shown to illustrate how a source network access node can determine SMC parameters for signaling to a target network access node of the UE.

[0209] Figure 8A The signaling that can be executed between UE 801, source network access node 802, source AMF 803, target AMF 804, and target network access node 805 is shown.

[0210] Sections 8001 to 8003 involve informing the source network access node of the handover policy. In the case of N2 handover, the currently proposed NAS latency method is applied.

[0211] During 8001, the source network access node 801 is configured with a policy that indicates when to perform an N2 handover and when to perform an X2 handover.

[0212] During 8002, the source network access node 801 is configured with multiple AS security algorithms available at the target network node 805 and their associated priorities for selection.

[0213] During step 8003, the source network access node 802 is configured with information about the UE's security capabilities. For example, the source network access node 802 may be configured with information about the UE's AS security capabilities.

[0214] During the period from 8004 to 8005, the source network access node performs unprepared handover preparation by obtaining the unprepared handover baseline RRC configuration of the target network access node.

[0215] During period 8004, source network access node 802 signals to target network access node 805 via source AMF and target AMF. This signaling may be a request for handover readiness information if not yet ready. This signaling may also include a request for AS security priority of target network access node 805.

[0216] During period 8005, the target network access node signals to the source network access node 802 via the target AMF and the source AMF. This signaling may include an indication that the target network access node is not ready to switch radio access network configurations. This signaling may also include an indication of how the target network access node selects an AS security algorithm. For example, this signaling may include indications of multiple AS security algorithms, each used to determine the priority for selection in communication between the UE and the target network access node.

[0217] During 8006, the target network access node 805 and the target AMF 804 do not create any UE-specific contexts and do not store any UE-specific keys.

[0218] During 8007, the source network access node 805 determines the target network access node 805 AS security algorithm to be used by the target network access node based on the priority of the signaling notification of 8005.

[0219] During 8008, the source network access node determines the target network access node Security Mode Command (SMC) parameters based on the AS security algorithm selected during 8007. The SMC parameters may include, for example, an NCC value and / or an indication of one or more differences between the AS security algorithm to be used by the target network access node and the AS security algorithm used by the source network access node to communicate with UE 801.

[0220] During period 8009, the source network access node signals the measurement configuration to UE 801. This can be done as described above.

[0221] During 8010, UE 801, based on the measurement configuration of 8009, signals one or more measurement reports to the source network access node. This can be done as described above.

[0222] During 8011, the source network access node 802 makes a handover decision based on one or more measurement reports received during 8010.

[0223] Figure 8B The signaling that can be executed between UE 801', source network access node 802', source AMF 803', target AMF 804', and target network access node 805' is shown.

[0224] Sections 8001' to 8003' involve informing the source network access node of the handover policy. In the case of N2 handover, the currently proposed NAS latency method is applied.

[0225] During 8001', the source network access node 802' is configured with a policy that indicates when to perform an N2 handover and when to perform an X2 handover.

[0226] During 8002', the source network access node 802' is configured with multiple AS security algorithms available at the target network node 805' and their associated priorities for selection.

[0227] During 8003', the source network access node 802' is configured with information about the UE's security capabilities. For example, the source network access node 802' may be configured with information about the UE's AS security capabilities.

[0228] During 8004' to 8005', the source network access node performs preparation for unprepared handover by obtaining the unprepared handover baseline RRC configuration of the target network access node.

[0229] During 8004', the source network access node 802' sends a signal to the target network access node 805' via the source AMF and the target AMF. This signaling may be a request for handover preparation information if the UE is not ready. This signaling may include information indicating the UE's security capabilities.

[0230] During 8005', the target network access node sends a signal to the source network access node 802 via the target AMF and the source AMF. This signaling may include an indication that the target network access node is not ready to switch radio access network configurations. This signaling may also include information indicating the AS security algorithms that will be used by the target network access node 805' when communicating with the UE 801'. These AS security algorithms may have been selected based on the security capabilities of the UE that is signaling during 8005'.

[0231] During 8006', the target network access node 805' and the target AMF 804' do not create any UE-specific contexts and do not store any UE-specific keys.

[0232] During 8007', the source network access node determines the target network access node Security Mode Command (SMC) parameters based on the AS security algorithm indicated in the signaling of 8005'. The SMC parameters may include, for example, an NCC value and / or an indication of one or more differences between the AS security algorithm to be used by the target network access node and the AS security algorithm used by the source network access node to communicate with UE 801.

[0233] During 8008', the source network access node sends the measurement configuration to the UE at 801'. This can be done as described above.

[0234] During 8009', UE 801' signals one or more measurement reports to the source network access node based on the measurement configuration of 8008'. This can be done as described above.

[0235] During 8010', the source network access node 802' makes a switching decision based on one or more measurement reports from 8009'.

[0236] Figure 8C An example of network preparation prior to the handover preparation in N2 handover is shown. In this example, the source network access node is pre-configured with all AS security algorithm priorities for the AS security algorithm selection of at least one of the source network access node's neighboring network access nodes.

[0237] Figure 8CThe signaling that can be executed by UE 801'', source network access node 802'', source AMF 803'', target AMF 804'', and target network access node 805'' is shown.

[0238] The methods 8001'' to 8005'' involve the source network access node knowing the available AS security algorithms and the corresponding priorities of the network access nodes adjacent to the source network access node.

[0239] During 8001'', the source AMF 803'' is configured with a local policy to indicate when an N2-based handover will be performed.

[0240] During 8002'', the source AMF 803'' sends a signal to the source network access node 802''. This signaling may include a policy for indicating when to perform an N2-based handover.

[0241] During 8003'', the source network access node 802'' is configured to determine when to choose between Xn-based handover or N2-based handover.

[0242] During 8004'', the source network access node is configured by the network with the available AS security algorithms (and their corresponding selection priorities) for the source network access node.

[0243] During 8005'', the source network access node is configured by the network using the available AS security algorithms (and their corresponding selection priorities) of its neighboring network access nodes (such as the target network access node).

[0244] It should be understood that the information mentioned in 8001's to 8005's can be considered specific to the network access node, rather than specific to the UE. In other words, the information in 8001's to 8005's can be applied to any UE.

[0245] It should also be understood that the operations of 8001'' to 8005'' can also be performed as part of the "Not Ready for HO Configuration" steps mentioned later for 8008'' and 8009'' (e.g., integrated into them). In this case, the gNB will be given knowledge of the UE's AS security algorithm selection.

[0246] 8006'' to 8009'' involve preparing for a switchover that is not yet ready.

[0247] During 8006'', the UE's security capabilities are provided to the source network access node 802''. This can be performed when the UE 801 connects to the network via the source network access node 802''.

[0248] During 8007, the source network access node 802'' determines the SMC parameters of the target network access node 805'' based on the information from 8005'' and 8006''. This may include, for example, NCC parameters and / or information indicating the AS cryptographic algorithm that will be applied by the target network access node 805'' when communicating with the UE 801''.

[0249] For example, during 8007'', for all possible neighboring network access nodes, the source network access node can determine whether the AS algorithm differs from the source one, and what type of N2-based handover needs to be performed. In other words, the source network access node can obtain the security-related parameters of the handover command.

[0250] It should be understood that handover decision 8012 (mentioned below) can be executed after handover decision 8007. In such a scenario, the source network access node can obtain only the security-related parameters for the identified target network access node (e.g., rather than multiple network access nodes) to which the UE will be handed over.

[0251] During 8008'', the source network access node 802'' sends a signal to the target network access node. This signaling can be an unprepared handover preparation request, as mentioned above regarding... Figure 8A and 8B Any of the descriptions.

[0252] During 8009'', the target network access node 805'' sends a signal to the source network access node 802''. This signaling may include the target network access node 805'''s unprepared baseline switching RRC configuration.

[0253] During 8010'', the source network access node signals the measurement configuration to the UE at 801'. This can be done as described above.

[0254] During 8011'', UE 801'' sends one or more measurement reports to the source network access node based on the measurement configuration of 8010''. This can be done as described above.

[0255] During 8012'', the source network access node 802'' makes a handover decision based on the measurement report of 8011''.

[0256] Figure 9 and Figure 10 The principles described herein are shown in detail in relation to how the horizontal and vertical keys of the K_gNB of the target network access node can be obtained.

[0257] Figure 9 This demonstrates a method that can be executed to obtain the horizontal key for the K_gNB of the target network access node when performing an N2-based handover.

[0258] Figure 9 The signaling that can be executed between UE 901, source network access node 902, source AMF 903, target AMF 904, and target network access node 905 is shown.

[0259] During 9001, the source network access node 902 determines the SMC parameters of the target network access node for communication with UE 901. This can be as described above with respect to any of 8A to 8C. In other words, during 9001, the source network access node 902 determines whether it should include a parameter in the unprepared handover signal to be sent to UE 901 that identifies which AS security algorithm the target network access node will use for the access layer with UE 901.

[0260] During 9002, the source network access node determines the horizontal key of the target network access node's K_gNB to be executed according to the policy used to perform N2-based unprepared handover.

[0261] During periods 9003 to 9004, the UE is configured with a measurement configuration and provides at least one measurement report to the source network access node 902'' according to the measurement configuration.

[0262] During period 9005, the source network access node makes a handover decision based on at least one measurement report received during period 9004.

[0263] During 9006, the source network access node obtains the first key K_RAN based on the key (K_gNBsource) used by the source network access node for access stratum signaling with UE 901. .

[0264] 9007 and 9008 can be executed in parallel.

[0265] During 9007, the source network access node 902 signals to UE 901. This signaling may include a handover request to switch UE 901 to the target network access node 905. For example, the signaling may include an RRCReconfiguration with a synchronization message. The signaling may include information indicating the execution of the level key. For example, the signaling may include an NCC value that is currently maintained by the UE. The signaling may include an indication that NAS will be postponed. This can be as described above regarding... Figure 7 As described.

[0266] The signaling may also include information indicating the changes to one or more AS key algorithms to be applied when communicating with the target network access node. For example, the signaling may include an indication of an unprepared handover configuration for communicating with the target network access node.

[0267] During 9008, the source network access node 902 signals to the source AMF 903. This signaling may include an indication that an unprepared handover will be performed to hand the UE over to the target network access node 905. This signaling may include an indication that the UE will postpone the execution of NAS signaling until the UE is notified of what NAS security parameters will be applied to communications transmitted via the target network access node.

[0268] The signaling in 9008 may include the same NCC value sent to the UE in 9007. This signaling may include the obtained key K_NG-RAN. This will be used as an indication of the initial AS signaling key between the target network access node and the UE. This signaling may include an indication of the selected AS key algorithm of 9001 (e.g., by including one or more SMC parameters).

[0269] 9009 to 9017 can be executed at least partially in parallel.

[0270] During 9009, UE 901 obtains a key (K_gNBtarget) for encrypting AS communication between the UE and the target network access node 904. This can be performed using the same level key derivation method employed by the source network access node during 9006. The UE may further postpone or otherwise abandon sending NAS messages during 9009 until signaling is executed in 9019.

[0271] During step 9010, source AMF 903 determines that the AMF key (K_AMF) is the same for both the source and target AMFs, and therefore determines that the target AMF does not need to obtain a new AMF key. Source AMF 903 further determines that it is not necessary to perform an increment of the NCC.

[0272] During 9011, source AMF 903 signals to target AMF 904. This signaling may include a request to create a UE context for UE 901. This signaling may include an indication that a handover is not ready. This signaling may include the NCC value provided to the source AMF during 9008. This signaling may include the AMF's key (K_AMF). This signaling may include the obtained key K_NG-RAN. and the obtained key K_NG-RAN This signaling will be an indication of the AS key used for communication between the UE and the target network access node 905. This signaling may include the Namf_Com_createUEContext_request message.

[0273] During 9012, target AMF 904 stores the AMF key (K_AMF), the NCC value received from 9011, and the obtained key K_NG-RAN. The target AMF can also internally store instructions regarding whether the UE is delaying NAS signaling until the target AMF provides information about the NAS security methods to be used for NAS signaling.

[0274] During 9013, target AMF 904 signals to target network access node 905. This signaling may include an indication to perform a handover, causing target network access node 905 to act as the serving network access node 905 for UE 901. This signaling may include the obtained key K_NG-RAN. This signaling may include an NGAP handover request.

[0275] During 9014, the target network access node 905 sets the value of its key (e.g., K_gNBtarget) to be equal to the received key K_NG-RAN. .

[0276] During 9015, the target network access node 905 signals a handover confirmation to the target AMF 904. This signaling may include an NGAP handover confirmation message.

[0277] During period 9016, target network access node 905 and target AMF 904 refrain from sending UE context information to source AMF and / or source network access node.

[0278] During 9017, UE 901 and the target network access node 905 exchange signaling to establish a connection between them. In other words, during 9017, access stratum signaling is performed to execute a random access procedure. In other words, during 9017, the UE and the target network access node may exchange AS access-related signaling (e.g., by executing a contention-based random access procedure and / or a contention-free random access procedure).

[0279] During 9018, UE 901 signals to the target network access node. This signaling can indicate that the UE has applied the RRC configuration received during 10008. This signaling can also indicate that the random access network procedure has been completed (e.g., the primary authentication procedure has been completed). In some examples, this signaling can be incorporated into the random access procedure of 9018. This signaling may include an RRCReconfigurationComplete message. An AS key (e.g., based on K_NG-RAN) can be used. Encrypt the signaling of 9018.

[0280] During 9019, the target network access node 905 signals to the UE. This signaling may include information indicating how to perform NAS signaling. For example, the signaling may include a new NASC in an RRC security update message. The signaling for 9019 can be signaled using an internal HO signaling procedure. As another example, the signaling for 9019 may include an indication that the UE will use NAS parameters previously configured at UE901 for NAS-based signaling. Similar to 7012, this signaling can be performed using a new RRC message or a new IE inclusion, and does not necessarily require the internal HO procedure.

[0281] During 9020, UE 901 obtains the NAS key based on the signaling of 9019, and performs signaling based on (for example, using) these NAS keys.

[0282] During 9021, the target network access node indicates to the AMF that HO is complete (e.g., using a "HO notification" message). This message allows the AMF to understand that it can resume non-security-related NAS signaling toward the UE, etc.

[0283] During period 9022, the source network access node 902 is instructed to release any UE context previously held for UE 901. In other words, during period 9021, the target network access node 905 becomes the serving network access node for UE 901.

[0284] Figure 10 An example method is shown when the principles described are applied to a scenario where the target network access node key (K_gNB) will be vertically obtained when an N2-based handover is to be performed.

[0285] Figure 10 The signaling that can be executed between UE 1001, source network access node 1002, source AMF 1003, target AMF 1004, and target network access node 1005 is shown.

[0286] During step 10001, the source network access node 1002 determines the SMC parameters of the target network access node for communicating with UE 1001. This can be as described above with respect to any of 8A to 8C. In other words, during step 10001, the source network access node 1002 determines whether it should include a parameter in the unprepared handover signal to be sent to UE 1001 that identifies which AS security algorithm the target network access node will use for the access layer with UE 1001.

[0287] During period 10002, the source network access node determines the vertical key of the target network access node's K_gNB to be executed based on the policy used to perform N2-based unprepared handover.

[0288] During the period from 10003 to 10004, the UE is configured with a measurement configuration and provides at least one measurement report to the source network access node 1002'' according to the measurement configuration.

[0289] During period 10005, the source network access node makes a handover decision based on at least one measurement report received during period 10004.

[0290] 10006 and 10007 can be executed in parallel.

[0291] During period 10006, source network access node 1002 signals to UE 1001. This signaling may include a handover request to switch UE 1001 to target network access node 1005. For example, the signaling may include an RRCReconfiguration with a synchronization message. The signaling may include information indicating that vertical key acquisition should be performed. For instance, this signaling may include an NCC value different from the NCC value currently maintained by the UE (e.g., an incrementing NCC value NCC+1 may be signaled to the UE). The signaling may include an indication that NAS will be postponed. This can be as described above regarding... Figure 7 As described.

[0292] The signaling may also include information indicating one or more AS key algorithms to be changed when communicating with the target network access node. For example, the signaling may include an indication of an unprepared handover configuration for communicating with the target network access node.

[0293] During period 10007, source network access node 1002 signals to source AMF 1003. This signaling may include an indication that an unprepared handover will be performed to hand the UE over to target network access node 1005. This signaling may also include an indication that the UE will postpone the execution of NAS signaling until the UE is notified of what NAS security parameters will be applied to communications transmitted via the target network access node.

[0294] This signaling in 10007 may include the NCC value maintained at the UE (e.g., a non-incrementing NCC value). This signaling may include an indication of the selected AS key algorithm in 10001 (e.g., by including one or more SMC parameters).

[0295] 10008 to 10016 can be executed at least partially in parallel.

[0296] During 10008, UE 1001 obtains a key (K_gNBtarget) for encrypting AS communication between the UE and the target network access node 1004. This can be performed using the same vertical key acquisition method as described above. The UE may further postpone or otherwise abandon sending NAS messages during 10008 until signaling at 10018 is executed.

[0297] During period 10009, the source AMF 1003 increments the NCC value to form an incremented NCC value and determines a fresh (e.g., a new) NH value. The incremented NCC value and the fresh NH value are associated together as a pair. In other words, during period 10009, the source AMF determines to generate a new AMF key (K_AMF) for vertically obtaining the key for the target network access node. The incremented NCC value corresponds to the NCC value provided to the UE during period 10006.

[0298] During period 10010, source AMF 1003 signals to target AMF 1004. This signaling may include a request to create a UE context for UE 1001. This signaling may include an indication that a handover is not ready. This signaling may include a pair of incrementing NCC values ​​and fresh NH values ​​generated during period 10009. This signaling may include the target AMF's key (K_AMF). This signaling may include the Namf_Com_createUEContext_request message.

[0299] During 10011, target AMF 1004 stores the incrementing NCC-new NH pair and the target AMF key (K_AMF). Target AMF 1004 can create NASC for the UE and keep the NAS count value the same. Target AMF can also internally store indications that the UE is deferring NAS signaling until the target AMF provides information about the NAS security method to be used for NAS signaling.

[0300] During period 10012, target AMF 1004 signals to target network access node 1005. This signaling may include an indication to perform a handover, causing target network access node 1005 to act as the serving network access node 1005 for UE 1001. This signaling may include an incrementing NCC-fresh NH pair, NACS, and NAS Security Context Indicator (NSCI). This signaling may include an indication that a handover is not ready to be performed. This indication may be as described in any of the examples above. This signaling may include an NGAP handover request.

[0301] During period 10013, target network access node 1005 used the information in this article regarding... Figure 12B The vertical derivation method shown determines the value of its key (e.g., K_gNBtarget). For example, the target network access node can use... Figure 12B Example derivation to calculate (e.g., determine) the K_NG RAN of the target network access node. And set K_gNBtarget to be equal to the calculated K_NG-RAN .

[0302] During period 10014, target network access node 1005 signals a handover confirmation to target AMF 1004. This signaling may include an NGAP handover confirmation message. This signaling may also include an indication that a handover is not yet ready.

[0303] During period 10015, target network access node 1005 and target AMF 1004 refrain from sending UE context information to source AMF and / or source network access node.

[0304] During period 10016, UE 1001 and target network access node 1005 exchange signaling to establish a connection between them. In other words, during period 10016, access stratum signaling is executed to perform a random access procedure. In other words, during period 10016, the UE and target network access node may exchange AS access-related signaling (e.g., by executing a contention-based random access procedure and / or a contention-free random access procedure).

[0305] During 10017, UE 1001 signals to the target network access node. This signaling may indicate that the UE has applied the RRC configuration received during 10008. This signaling may also indicate that the random access network procedure has been completed (e.g., the primary authentication procedure has been completed). In some examples, this signaling may be incorporated into the random access procedure of 10017. This signaling may include an RRCReconfigurationComplete message. The signaling of 10017 may be encrypted using an AS key (e.g., based on NH).

[0306] During 10018, the target network access node 1005 signals to the UE. This signaling may include information indicating how to perform NAS signaling. For example, the signaling may include a new NASC in an RRC security update message. The signaling for 10018 can be signaled using an internal HO signaling procedure. As another example, the signaling for 10018 may include an indication that the UE will use NAS parameters previously configured at UE1001 for NAS-based signaling. This signaling can be performed using a new RRC message or a new IE inclusion, and does not necessarily require an internal HO.

[0307] During 10019, UE 1001 obtains the NAS key based on the signaling of 10019, and performs signaling based on (for example, using) these NAS keys.

[0308] During 10020, the target network access node indicates to the AMF that HO is complete (e.g., using a "HO notification" message). This message allows the AMF to understand that it can resume non-security-related NAS signaling toward the UE, etc.

[0309] During 10021, the source network access node 1002 is instructed to release any UE context previously held for UE 1001. In other words, during 10021, the target network access node 1005 becomes the serving network access node for UE 1001.

[0310] It should be understood that, despite Figure 10 The example shows an instance where the new K_AMF is determined by the source AMF, but in some cases, the new K_AMF can be obtained by signaling originating from the source network access node.

[0311] In the example, assume the source network access node knows the source AMF wants to perform a horizontal K_AMF acquisition. However, the source network access node cannot provide the UE with the corresponding unprepared handover command because the unprepared HO command does not include the NASC with integrity protection maintained by the downlink NAS COUNT, which is used as input for K_AMF derivation. Therefore, if the source K_AMF has a horizontal K_AMF acquisition strategy, the process for unprepared handover can be reverted to obtaining the AS key horizontally without K_AMF acquisition. When the NAS is updated, K_AMF acquisition can be performed at the target network access node using security updates.

[0312] Figure 11 This illustrates another example where no information about possible core network actions is provided to the source network access node.

[0313] Figure 11 The signaling that can be executed between UE 1101, source network access node 1102, source AMF 1103, target AMF 1104, and target network access node 1105 is shown.

[0314] During 11001, the source network access node 1102 knows the UE's security capabilities.

[0315] During 11002, source network access node 1102 signals to target network access node 1105 via source AMF and target AMF. This signaling may include an unprepared handover preparation message. This signaling may include a baseline RRC configuration for causing target network access node 1105 to perform an unprepared handover. The signaling at 11002 may optionally include information indicating the AS security algorithms supported by the source network access node, which have a priority for their selection (as described above).

[0316] During 11003, the target network access node 1105 signals to the source network access node 1102. This signaling may include acknowledgment of the signaling from 11002. For example, the signaling may include an acknowledgment of an unprepared handover radio access network configuration. The signaling may optionally include an indication of the AS security algorithm supported by the target network access node, along with accompanying priority information for its selection (as described above).

[0317] During the period from 11004 to 11005, the UE is configured with a measurement configuration and provides at least one measurement report to the source network access node 1102 according to the measurement configuration.

[0318] During 11006, the source network access node makes a handover decision based on at least one measurement report received during 11004. Based on the handover decision in 11006, the source network access node determines at least one AS security algorithm to be applied by the target network access node when communicating with the UE. The source network access node may further perform a level key acquisition method to obtain K_NG-RAN. .

[0319] 11007 and 11008 can be executed in parallel.

[0320] During 11007, the source network access node 1102 signals to UE 1101. This signaling may include a handover request for UE 1101 to be handed over to the target network access node 1105. For example, this signaling may include an RRCReconfiguration with a synchronization message. This signaling may include information used by the source network access node to determine the K_NG RAN during 11006. The NCC value (e.g., the same value as the NCC value maintained at the UE or a different value from the NCC value maintained at the UE, depending on whether a horizontal or vertical key is executed). This signaling may include the security algorithm configuration for the AS security algorithm used by the target network access node. This signaling may include an indication that NAS will be postponed. This can be as described above regarding... Figure 7 As described.

[0321] The signaling may also include information indicating one or more AS key algorithms to be changed when communicating with the target network access node. For example, the signaling may include an indication of an unprepared handover configuration for communicating with the target network access node.

[0322] During 11008, the source network access node 1102 signals to the source AMF 1103. This signaling may include an indication that an unprepared handover will be performed to hand the UE over to the target network access node 1105. This signaling may also include an indication that the UE will postpone the execution of NAS signaling until the UE is notified of what NAS security parameters will be applied to communications transmitted via the target network access node.

[0323] This signaling in 11008 may include the NCC value maintained at the UE (e.g., a non-incrementing NCC value). This signaling may include an indication of the selected AS key algorithm in 11007 (e.g., by including one or more SMC parameters). This signaling may transmit the obtained key K_NG-RAN Set as the temporary key for the target network access node 1105. Figure 5 and Figure 6 The examples do not include the K_gNB value obtained at the level of the target network access node (e.g., the temporary key mentioned above).

[0324] 11009 to 11010 can be executed at least partially in parallel.

[0325] During 11009, UE 1101 obtains the target network access node's key (K_gNBtarget), as well as encryption and integrity protection keys for AS communication between the UE and the target network access node 1104. This can be performed using the same key acquisition method performed by the source network access node during 11006. The UE may further postpone or otherwise abandon sending NAS messages during 11009 until signaling is executed after 11017. The UE may also obtain RRC and user plane integrity and encryption keys.

[0326] During 11010, source AMF 1103 determines whether to generate a new K_AMF (e.g., using the associated new NCC and NH pairs, as described above). Figure 10 (as described above), or whether to use the existing K_AMF.

[0327] During 11011, source AMF 1103 signals to target AMF 1104. This signaling may include a request to create a UE context for UE 1101. This signaling may include an indication of an unprepared handover. This signaling may include an NCC value and NH pair generated during 1101 or otherwise determined during 11010. This signaling may include the key of the target AMF (K_AMF). This signaling may include an indication to perform an unprepared handover. This signaling may include the temporary key K_NG-RAN signaled during 11009. The signaling may include the Namf_Com_createUEContext_request message.

[0328] During period 11013, target AMF 1104 stores the NCC-NH pair, the target AMF key (K_AMF), and K_NG-RAN. The target AMF 1104 can create a NASC for the UE and keep the NAS count value the same. The target AMF can also internally store indications that the UE is deferring NAS signaling until the target AMF provides information about the NAS security method to be used for NAS signaling. This signaling may include an indication of the AS algorithm selected by the source network node during 11007.

[0329] During 11014, target AMF 1104 signals to target network access node 1105. This signaling may include an indication to perform a handover, causing target network access node 1105 to act as the serving network access node 1105 for UE 1101. This signaling may include NCC-NH pairs and K_NG-RAN pairs. NASC and NAS Security Context Indicator (NSCI). This signaling may include an indication that an unprepared handover is being performed. This signaling may include an indication of the AS algorithm selected by the source network node during 11007. This indication may be as described in any of the examples above. This signaling may include an NGAP handover request.

[0330] During step 11015, the target network access node 1105 determines the value of its key (e.g., K_gNBtarget). For example, the target network access node 1105 may temporarily set K_NG-RAN... Set to K_gNBtarget and use it during 11018 and 11019. Following the signaling at 11019, the target network access node 1105 can set NH as the target network access node's key (KgNBtarget) and obtain the AS key using the indication of the selected algorithm. For example, the target network access node 1105 can set K_NG-RAN based on whether vertical or horizontal key acquisition is performed. Alternatively, NH can be set as the key of the target network access node (KgNBtarget), and the AS key can be derived using the instructions of the selected algorithm. The target network access node 1105 can store NACS, NCC, and NH.

[0331] During 11016, the target network access node 1105 signals a handover confirmation to the target AMF 1104. This signaling may include an NGAP handover confirmation message.

[0332] During 11017, target network access node 1105 and target AMF 1104 refrain from sending UE context information to source AMF and / or source network access node.

[0333] During 11018, UE 1101 and target network access node 1105 exchange signaling to establish a connection between them. In other words, during 11018, access stratum signaling is performed to execute a random access procedure. In other words, during 10018, UE and target network access node may exchange AS access-related signaling (e.g., by executing a contention-based random access procedure and / or a contention-free random access procedure).

[0334] During 11019, UE 1101 signals to the target network access node. This signaling can indicate that the UE has applied the RRC configuration received during 11007. This signaling can also indicate that the random access network procedure has been completed (e.g., the primary authentication procedure has been completed). In some examples, this signaling can be incorporated into the random access procedure of 11018. This signaling may include an RRCReconfigurationComplete message. An AS key (e.g., based on K_NG-RAN) can be used. (or NH) encrypts the signaling of 11019.

[0335] During 11020, the target network access node 1105 signals to the UE. This signaling may include information indicating how to perform NAS signaling. For example, the signaling may include a new NASC in an RRC security update message. The signaling for 11020 can be signaled using an internal HO signaling procedure. As another example, the signaling for 11020 may include an indication that the UE will use NAS parameters previously configured at UE1101 for NAS-based signaling. This signaling can be performed using a new RRC message or a new IE inclusion, and does not necessarily require an internal HO.

[0336] During 11021, UE 1101 obtains NAS keys based on the signaling of 11021, and performs signaling based on (for example, using) these NAS keys.

[0337] During 11022, the target network access node indicates to the AMF that HO is complete (e.g., using a "HO notification" message). This message allows the AMF to understand that it can resume non-security-related NAS signaling toward the UE, etc.

[0338] During 11023, the source network access node 1102 is instructed to release any UE context previously held for UE 1101. In other words, during 11022, the target network access node 1105 becomes the serving network access node for UE 1101.

[0339] exist Figure 11 In this example, the source network access node is not configured with any information regarding core network handover processing. In this example, the actions and signaling in the source network access node are identical, regardless of whether the core network (e.g., the source AMF) decides to execute level K_AMF.

[0340] Figure 11 This example is similar to Figure 9 and Figure 10The difference in the example is that the network signaling from the source AMF to the target AMF can include a K_gNB generated horizontally by the source network access node and a vertically generated NH (later K_gNB) generated by the source AMF.

[0341] exist Figure 11 In the example, when the UE connects to the network, the source network access node learns the UE's security capabilities.

[0342] The source network access node then sends an unprepared handover preparation message to the target network access node via the source AMF and the target AMF. This message includes the security algorithms supported by the source network access node for AS security. The source network access node can provide information about its preferred AS security algorithms by including priority information. For example, AS security algorithms can be provided in an ordered list, where algorithms are listed in ascending or descending priority order. As another example, each AS security algorithm can be associated with an explicit priority value that ranks the AS security algorithm for selection relative to other AS security algorithms.

[0343] The target network access node can respond to the source network access node with an unprepared handover readiness acknowledgment (ACK) message that may include the target AS security algorithm.

[0344] By calling the corresponding AMF's non-UE associated API, such as Namf_Communication_NonUeN2MessageTransfer, the service-based interface (SBI) can be used to transmit unprepared handover preparation messages and unprepared handover preparation ACK messages between the source AMF and the target AMF.

[0345] The source network access node uses RRC signaling to configure the UE for measurement and measurement reporting. The UE then uses RRC signaling to send measurement reports to the source network access node according to the configuration.

[0346] The source network access node decides to initiate an unprepared handover.

[0347] If the source network access node has available unused {NCC, NH} pairs or an alternative horizontal derivation method, the source network access node can use a vertical derivation method to derive K_NG-RAN. Key. The source network access node determines the AS security algorithm to be used with the temporary key in the target network access node.

[0348] The source network access node sends an RRCReconfiguration message with a synchronization message to cause the UE to perform an unprepared handover to the target network access node. The NCC value included in this message depends on whether K_NG-RAN has been executed. The message includes a NAS delay indication, which tells the UE that this is an unprepared HO and that temporary security used by the AS will only be used upon arrival at the target network access node. The UE can suspend NAS signaling until it receives a new NASC. The securityAlgorithmConfig information element informs the UE of the AS security algorithm that will be used for integrity protection and / or encryption using a temporary key.

[0349] The source RAN sends a message to the source AMF requesting NGAP handover. This message includes an indication of an unprepared handover and a postponed NAS, the NCC value, and the obtained K_NG-RAN. The tempKey and the selected AS algorithm that will be used with the tempKey.

[0350] The UE obtains K_gNB according to the traditional procedure, that is, it starts by obtaining K_NG-RAN based on the received NCC value. If the received NCC value is the same as the locally stored NCC value, then the UE achieves the desired level. Otherwise, the UE synchronizes its local NH value with the network by obtaining the NH value and incrementing the local NCC value until it matches the received NCC value. The UE then begins calculating K_NG-RAN using the NH, PCI, and ARFCN of the target network access node. .

[0351] The source AMF can decide to continue the current K_AMF or generate a new K_AMF (i.e., execute the level K_AMF obtained). In either case, the source AMF generates NH and NCC values ​​associated with the corresponding K_AMF. In this way, in 33.501, the action of the source AMF is not different from the action specified for the current N2-based switch.

[0352] The source AMF can invoke the target AMF's Namf_Communication_createUContext_request service. This message includes K_AMF, NH (which will be used to obtain the new K_gNB in ​​the target), NCC, DL NAS COUNT, and optional ULNAS COUNT. New information included in this step relates to temporary security and includes an unprepared handover indication and a delayed NAS, tempKey (the key obtained in the UE), and the selected AS algorithm.

[0353] The target AMF stores the information received during 11012 locally. If K_AMF has changed, i.e., the target AMF receives keyAmfChangeIndication (which would be the case where the source AMF's horizontal K_AMF has received or has not yet signaled to the UE the activation of the new 5GNAS security context), the target AMF should create a NAS container (NASC), which includes the K_AMF change indication, DL NAS COUNT, NAS security algorithm, and message authentication code (MAC). The target AMF internally marks the NAS as deferred by the UE. If K_AMF has not changed and the target AMF does not want to change the NAS algorithm, the contents of the NASC should indicate to the UE that the UE can resume NAS signaling without changes.

[0354] The target network access node sends an NGAP handover request message to the target network access node, which indicates the unprepared handover, the tempKey and AS algorithm to be used for temporary security during the unprepared handover, the NACS, and the NH and NCC to be used for AS security updates after the UE successfully completes the unprepared handover.

[0355] The target network access node uses tempKey as K_gNB and obtains the integrity protection and encryption keys from it using the selected AS algorithm. The target network access node stores NACS, NH, and NCC.

[0356] The target network access node responds using the NGAP handover request ACK. No UE context information is sent to the source AMF or the source network access node.

[0357] The UE uses a random access message to access the target network access node. The UE sends an RRCReconfigurationComplete message to the target network access node. This RRCReconfigurationComplete message uses the key obtained from K_gNB (also designated as the network-side tempKey) during 11010 for integrity protection and encryption with AS security. The UE cannot send a NAS message while NAS is still being postponed.

[0358] The target network access node performs an internal handover to update RRC security and also transmits NASC to the UE.

[0359] Upon receiving the NACS, the UE determines whether a new K_AMF is needed and whether the NAS algorithm should be changed. The UE updates the NAS security context based on the contents of the NACS. If the NAS algorithm has not changed, the NACS will contain a new indicator, as mentioned in step 13, and NAS signaling can continue. The UE can then resume sending NAS messages. According to conventional processing, the internal handover also indicates to the UE the NCC value associated with the new AS security context and the new securityAlgorithmConfig created by the target network access node that the UE should apply. In the special case where this process also applies to Xn handover (during which K_AMF and the NAS algorithm remain the same), there is no explicit need to perform an internal handover. The UE can continue its AS and NAS connections without security updates. In this case, the UE can be notified that it can recover NAS via RRC messages other than RRCReconfiguration.

[0360] The target network access node sends an NGAP handover notification message to the target AMF, indicating successful handover completion. The AMF requests the SMF to perform a PDU session update to switch the user plane connection from the source network access node to the target network access node. The target AMF notifies the source AMF of the successful completion of the handover process. The source AMF releases the UE context from the source network access node.

[0361] The following is for reference. Figures 13 to 27 At least some features of the examples above are shown. It should be understood that in all these examples, the mentioned switching can be N2-based switching. In other words, it should be understood that in... Figures 13 to 27 In all examples, communication between the source network access node and the target network access node related to the handover can be provided through at least one AMF.

[0362] Figures 13 to 17 An example method is shown that can be performed by an interactive device when the UE is configured to perform delayed NAS signaling, based on the principles described herein.

[0363] Figure 13 Features that can be performed by the device are shown. Figure 13 The device may include the UE, and / or be included in the UE, as referenced above. Figure 3 As described.

[0364] During 1301, the device receives first signaling from the source network access node, which includes information for performing a handover from the device to the target network access node, and an indication of delay in performing non-access stratum (NAS) signaling via the target network access node.

[0365] During 1302, the device performs a handover to the target network access node based on the information and instructions.

[0366] implement Figure 13 , 18 The device of at least one of the methods of or 23 may perform at least one of the following further methods.

[0367] The first signaling message may include information indicating that an N2-based handover should be performed. The first signaling message may include a handover-based message. For example, the first signaling message may include an RRC reconfiguration message with synchronization.

[0368] The device can delay the execution of non-access stratum signaling with the target network node until it receives another signaling message that includes information indicating how to execute the NAS signaling.

[0369] Information identifying how to perform NAS signaling may include at least one of the following: one or more new parameters for establishing a NAS security context for performing NAS signaling, or an indication to establish a NAS security context for performing NAS signaling using at least one previously received parameter. One or more parameters may be included in the NAS container. In other words, the NAS container may be provided to the device, wherein the NAS container includes one or more parameters for establishing NAS security for NAS signaling.

[0370] The device can start a timer, and if the timer expires before the device has determined a NAS security context for communication via the target network access node, it performs at least one of the following: sending a new primary authentication request to the target network access node, or sending a request for the NAS security context via the target network access node. The random access procedure can be used to synchronize and / or establish some configuration at the physical layer. The primary authentication request mentioned herein can correspond to discarding (e.g., deleting) any current security context maintained at the device, and creating a new security context between the device and the target network access node.

[0371] As described above, in the example, a timer can be started when a random access procedure is initiated as part of a handover process. In another example, a timer can be started upon receiving the first signaling. In the example, a timer can be started upon receiving a handover command. A timer can be started when information for performing a handover is obtained. A timer can be started when the device establishes a radio resource control connection with the target network access node.

[0372] Figure 14 A method that can be performed by a device is shown. The device may include means for a network access node (e.g., a gNB). Figure 14The apparatus may include a source network access node (e.g., a network access node serving the UE). Figure 14 The device can be as about Figure 2 As described.

[0373] During 1401, the device sends a signal to the user equipment (e.g., Figure 13 , 18 The device (or at least one of the means of 23) provides first signaling, which includes information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network access node will be delayed.

[0374] The first signaling can be as described above. Figure 13 As described.

[0375] During 1402, the device provides a second signaling to at least one other device, the second signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed.

[0376] At least one other device may be about Figure 15 , 20 Or at least one of the devices mentioned in 25. The second call may include a switching command.

[0377] Can about Figure 14 , 19 Or at least one of the devices of 24 to perform the following features.

[0378] The device can provide at least one other device with information indicating whether the key of the target network access node is obtained horizontally or vertically.

[0379] The first and second signaling messages can be sent in parallel.

[0380] Figure 15 A method that can be performed by an apparatus is shown. This apparatus may include means for core network functions. For example, the apparatus may include means for AMF (Active Network Function). Figure 15 The apparatus may include a source AMF (e.g., an AMF configured to interact with a source network access node (e.g., the network access node serving the UE)). Figure 15 The device can be as about Figure 2 As described.

[0381] During step 1501, the device receives second signaling from the source network access node. This second signaling includes information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling from the user equipment via the target network node will be delayed. This second signaling may correspond to... Figure 14 The second signaling.

[0382] During 1502, the device provides third signaling to the target access and mobility function (AMF), which includes the information for performing a handover from the user equipment (UE) to the target network access node (NAD). The target AMF can be considered as an AMF that interacts (e.g., communicates) with the target network access node, where the target network access node is the subject of the handover command.

[0383] The following features can be derived from Figure 15 , 20 Or at least one of the devices in 25 to perform The device can obtain information from the source network access node indicating whether the key for the target network access node is obtained horizontally or vertically. When the key is to be obtained vertically, the device can generate a new key for access and mobility functions (e.g., for the target network access node).

[0384] about Figure 14 and 15 For example, the information indicating whether the key is to be obtained horizontally or vertically may include at least one of the following: an NCC value indication of the next-hop link counter, or a key of the target network access node generated by the source network access node.

[0385] Figure 16 A method that can be performed by an apparatus is shown. This apparatus may include means for core network functions. For example, the apparatus may include means for AMF (Active Network Function). Figure 16 The apparatus may include a target AMF (e.g., an AMF configured to interact with a target network access node (e.g., the network access node to which the UE will be switched). Figure 16 The device can be as about Figure 2 As described.

[0386] During 1601, the device obtains third signaling from the source access and mobility functions, which includes information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed.

[0387] During 1602, the device provides a fourth signaling to the target network access node, which includes the information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed.

[0388] Figure 17 A method that can be performed by a device is shown. The device may include means for a network access node (e.g., a gNB). Figure 17 The device may include a target network access node (e.g., a network access node that is the subject of a handover command for the serving UE). Figure 17 The device can be as about Figure 2 As described.

[0389] During 1701, the device receives a fourth signaling from the target access and mobility function, including information for performing a handover from the user equipment to the device.

[0390] During 1702, after the user equipment enters the radio resource control connection state with the equipment, a fifth signaling is provided to the user equipment. This fifth signaling includes information identifying how to perform non-access stratum (NAS) signaling, wherein NAS signaling is not received from the user equipment until the fifth signaling has been provided to the user equipment.

[0391] The following features can be derived from Figure 17 , 22 The features performed by or by at least one of the devices in 27.

[0392] Information identifying how to perform NAS signaling may include at least one of the following: one or more new parameters for establishing a NAS security context for performing NAS signaling, or an indication to establish a NAS security context for performing NAS signaling using at least one previously received parameter.

[0393] Figures 18 to 22 An example method is shown that can be performed by an interactive device when the UE is configured to perform delayed NAS signaling, based on the principles described herein.

[0394] Figure 18 Features that can be performed by the device are shown. Figure 18 The device may include the UE, and / or be included in the UE, as referenced above. Figure 3 As described.

[0395] During 1801, the device receives first signaling from the source network access node, the first signaling including information for performing a handover from the device to the target network access node, an indication for delaying the execution of non-access stratum (NAS) signaling via the target network access node, and an indication for one or more access stratum security algorithms to be applied to communication between the device and the target network access node.

[0396] During 1802, the device performs a handover to the target network access node based on the information and instructions.

[0397] Instructions for one or more access stratum security algorithms may include one or more security mode command parameters.

[0398] Figure 19 A method that can be performed by a device is shown. The device may include means for a network access node (e.g., a gNB). Figure 19 The apparatus may include a source network access node (e.g., a network access node serving the UE). Figure 19 The device can be as about Figure 2 As described.

[0399] During 1901, the device acquires one or more access layer security algorithms that will be applied to communication between the user equipment and the target network access node.

[0400] During 1902, the device provides the user equipment with first signaling, which includes information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed.

[0401] During 1903, the device provides a second signaling to at least one network node, the second signaling including information for performing a handover of a user equipment to a target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, wherein the second signaling also includes an indication of one or more access stratum security algorithms.

[0402] This device can provide user equipment with instructions on one or more access stratum security algorithms.

[0403] This acquisition may include sending a request for one or more access layer security algorithms for the target access network node via source access and mobility functions.

[0404] Obtaining information may include sending instructions on the security capabilities of the user equipment to the target access network node via source access and mobility functions.

[0405] The device can receive an identifier for one or more access stratum security algorithms via source access and mobility functions based on at least one of a request for one or more access stratum security algorithms or an indication of the security capabilities of a user equipment.

[0406] Instructions for one or more access stratum security algorithms may include one or more security mode command parameters.

[0407] Figure 20 A method that can be performed by an apparatus is shown. This apparatus may include means for core network functions. For example, the apparatus may include means for AMF (Active Network Function). Figure 20 The apparatus may include a source AMF (e.g., an AMF configured to interact with a source network access node (e.g., the network access node serving the UE)). Figure 20 The device can be as about Figure 2 As described.

[0408] During 2001, the device receives second signaling from the source network access node, the second signaling including information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the device and the target network access node.

[0409] During 2002, the device provides third signaling to the target access and mobility functions, the third signaling including the information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms.

[0410] The device can obtain information from the source network access node indicating whether the key to the target network access node is obtained horizontally or vertically, and when the key is obtained vertically, it enables the generation of a new key for access and mobility functions.

[0411] The information indicating whether the key is to be obtained horizontally or vertically may include at least one of the following: an indication of the next-hop link counter (NCC) value, or a key of the target network access node generated by the source network access node.

[0412] Figure 21 A method that can be performed by an apparatus is shown. This apparatus may include means for core network functions. For example, the apparatus may include means for AMF (Active Network Function). Figure 21 The apparatus may include a target AMF (e.g., an AMF configured to interact with a target network access node (e.g., the network access node to which the UE will be switched). Figure 21The device can be as about Figure 2 As described.

[0413] During 2101, the device obtains third signaling from the source access and mobility functions. The third signaling includes information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the device and the target network access node.

[0414] During 2102, the device provides a fourth signaling to the target network access node, which includes information for performing a handover from the user equipment to the target network access node, and instructions for one or more access layer security algorithms.

[0415] Figure 22 A method that can be performed by a device is shown. The device may include means for a network access node (e.g., a gNB). Figure 22 The device may include a target network access node (e.g., a network access node that is the subject of a handover command for the serving UE). Figure 22 The device can be as about Figure 2 As described.

[0416] During 2201, the device obtains a fourth signaling from the target access and mobility function, which includes information for performing a handover from the user equipment to the device, and an indication of one or more access layer security algorithms to be applied to communication between the device and the user equipment.

[0417] During 2202, the device performs access layer signaling with the user equipment based on instructions for one or more access layer security algorithms.

[0418] After the user equipment enters the radio resource control connection state with the device, the device can provide the user equipment with fifth signaling, which includes information identifying how to perform NAS signaling.

[0419] Information identifying how to perform NAS signaling may include at least one of the following: one or more new parameters for establishing a NAS security context for performing NAS signaling, or an indication to establish a NAS security context for performing NAS signaling using at least one previously received parameter.

[0420] Figures 23 to 27 An example method is shown that can be performed by an interactive device when the UE is configured to perform delayed NAS signaling, based on the principles described herein.

[0421] Figure 23 Features that can be performed by the device are shown. Figure 23 The device may include the UE, and / or be included in the UE, as referenced above. Figure 3 As described.

[0422] During 2301, the device receives first signaling from the source network access node, the first signaling including information for performing a handover from the device to the target network access node, an indication for delaying the execution of non-access stratum (NAS) signaling via the target network access node, and an indication of one or more access stratum security algorithms selected by the source network access node to be applied to communication between the device and the target network access node.

[0423] During 2302, the device performs a handover to the target network access node based on the information and instructions.

[0424] Instructions for one or more access stratum security algorithms may include one or more security mode command parameters. This can be as described above.

[0425] Figure 24 A method that can be performed by a device is shown. The device may include means for a network access node (e.g., a gNB). Figure 24 The apparatus may include a source network access node (e.g., a network access node serving the UE). Figure 24 The device can be as about Figure 2 As described.

[0426] During 2401, the device selects one or more access layer security algorithms from a plurality of access layer security algorithms to be applied to communication between the user equipment and the target network access node.

[0427] During 2402, the device provides the user equipment with first signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network access node will be delayed.

[0428] During 2403, the device provides a second signaling to at least one network node, the second signaling including information for performing a handover from a user equipment to a target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, wherein the second signaling also includes an indication of one or more selected access stratum security algorithms.

[0429] The device can provide at least one network node with information indicating whether the key of the target network access node is obtained horizontally or vertically.

[0430] The device can use its key to horizontally generate a key for a target network access node, wherein the second signaling includes the generated key for the target network access node.

[0431] This device can provide user equipment with instructions on one or more access stratum security algorithms.

[0432] This acquisition may include sending a request for one or more access layer security algorithms for the target access network node via source access and mobility functions.

[0433] Obtaining information may include sending instructions on the security capabilities of the user equipment to the target access network node via source access and mobility functions.

[0434] The device can receive an identifier for one or more access stratum security algorithms via source access and mobility functions based on at least one of a request for one or more access stratum security algorithms or an indication of the security capabilities of a user equipment.

[0435] Instructions for one or more access stratum security algorithms may include one or more security mode command parameters.

[0436] Figure 25 A method that can be performed by an apparatus is shown. This apparatus may include means for core network functions. For example, the apparatus may include means for AMF (Active Network Function). Figure 25 The apparatus may include a source AMF (e.g., an AMF configured to interact with a source network access node (e.g., the network access node serving the UE)). Figure 25 The device can be as about Figure 2 As described.

[0437] During 2501, the device receives a second signaling from the source network access node, which includes information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms selected by the source network access node to be applied to communication between the device and the target network access node.

[0438] During 2502, the device provides third signaling to the target access and mobility function, the third signaling including the information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms.

[0439] The device can obtain information from the source network access node indicating whether the key for the target network access node is obtained horizontally or vertically. When the key is to be obtained vertically, the device can enable the generation of a new key for access and mobility functions. The second signaling may include the key for the target network access node generated by the source network access node.

[0440] The device can determine whether to provide the device's key in the third signaling and / or whether to provide the target network access node's key generated by the source network access node in the third signaling based on information indicating whether the key is obtained horizontally or vertically.

[0441] The information indicating whether the key is to be obtained horizontally or vertically may include at least one of the following: an indication of the next-hop link counter (NCC) value, or a key of the target network access node generated by the source network access node.

[0442] Figure 26 A method that can be performed by an apparatus is shown. This apparatus may include means for core network functions. For example, the apparatus may include means for AMF (Active Network Function). Figure 26 The apparatus may include a target AMF (e.g., an AMF configured to interact with a target network access node (e.g., the network access node to which the UE will be switched). Figure 26 The device can be as about Figure 2 As described.

[0443] During 2601, the device receives third signaling from the source access and mobility functions. This third signaling includes information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms selected by the source network access node to be applied to communication between the device and the target network access node.

[0444] During 2602, the device provides a fourth signaling to the target network access node, the fourth signaling including the information for performing a handover from the user equipment to the target network access node, and an indication of one or more access layer security algorithms.

[0445] Figure 27 A method that can be performed by a device is shown. The device may include means for a network access node (e.g., a gNB). Figure 27 The device may include a target network access node (e.g., a network access node that is the subject of a handover command for the serving UE). Figure 27 The device can be as about Figure 2 As described.

[0446] During 2701, the device receives a fourth signaling from the target access and mobility function, which includes information for performing a handover from the user equipment to the device, and an indication of one or more access layer security algorithms selected by the source access network node to be applied to communication between the user equipment and the device.

[0447] During 2702, the device uses one or more access layer security algorithms to obtain at least one key for access layer signaling.

[0448] During 2703, the device performs access layer signaling with the user equipment based on at least one obtained key.

[0449] After the user equipment enters the radio resource control connection state with the device, the device can provide the user equipment with fifth signaling, which includes information identifying how to perform NAS signaling.

[0450] Information identifying how to perform NAS signaling may include at least one of the following: one or more new parameters for establishing a NAS security context for performing NAS signaling, or an indication to establish a NAS security context for performing NAS signaling using at least one previously received parameter.

[0451] exist Figures 13 to 27 In at least one of the examples, at least one of the first to fourth signaling does not include information identifying the NAS security context.

[0452] At least one of the methods described herein can be associated with one or more advantages. For example, the principles described herein enable the use of unprepared handover techniques for N2-based handover. Furthermore, no resources are reserved at the target network, and the target network access node does not establish a UE context before sending a handover command to the UE. Simultaneously, the handover command does not need to be delayed until the target AMF and / or the target network access node has provided security parameters in the handover command relayed to the source network access node.

[0453] It should be understood that the foregoing references to various network functions (e.g., AMF, SMF, etc.) may include means for performing at least some of the functions associated with these network functions. Furthermore, means including a network function may include a virtual network function instance of that network function.

[0454] It should be understood that the device may include or be coupled to other units or modules for transmitting and / or receiving, such as a radio section or a radio head. Although the device has been described as a single entity, different modules and memories may be implemented in one or more physical or logical entities.

[0455] Note that while some embodiments have been described with respect to 5G networks, similar principles can be applied to other networks and communication systems. Therefore, although some embodiments have been described above by way of example with reference to certain example architectures for wireless networks, technologies, and standards, these embodiments can be applied to any other suitable form of communication system compared to those shown and described herein.

[0456] It should also be noted that although exemplary embodiments have been described above, several changes and modifications can be made to the disclosed solutions without departing from the scope of the invention.

[0457] As used herein, “at least one of the following: ” and “at least one of ” and similar wording, where the list of two or more elements is connected by “and” or “or”, means at least any one of the elements, or at least any two or more of the elements, or at least all of the elements.

[0458] Generally, various embodiments can be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects of this disclosure may be implemented in hardware, while others may be implemented in firmware or software executable by a controller, microprocessor, or other computing device, but this disclosure is not limited thereto. Although various aspects of this disclosure may be illustrated and described as block diagrams, flowcharts, or using some other graphical representation, it should be understood that these blocks, apparatuses, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware, or controllers or other computing devices, or some combination thereof, as non-limiting examples.

[0459] As used herein, the term "circuit system" may refer to one or more, or all of the following: (a) - Hardware circuit implementation only (such as implementation in analog and / or digital circuits only), and (b) A combination of hardware circuitry and software, such as (if applicable): (i) A combination of analog and / or digital hardware circuitry with software / firmware, and (ii) Any part of a hardware processor having software (including multiple digital signal processors working together to enable a device (such as a mobile phone or server) to perform various functions), software, and memory, and (c) Hardware circuitry and / or processors, such as microprocessors or portions thereof, that require software (e.g., firmware) to operate, but the software may not be present when operation is not required. This definition of circuit applies to all uses of the term herein, including in any claim. As another example, as used herein, the term circuit system also covers only hardware circuitry or a processor (or processors) or a portion thereof and its accompanying software and / or firmware implementations. For example, and if applicable to a particular claim element, the term circuit also covers baseband integrated circuits or processor integrated circuits for use in mobile devices or servers, cellular network devices or other computing or networking devices.

[0460] Embodiments of this disclosure can be implemented by a data processor of a mobile device (such as in a processor entity) or by computer software executed by hardware or a combination of software and hardware. Computer software or programs (also referred to as program products, including software routines, applets, and / or macros) can be stored in any device-readable data storage medium, and they include program instructions for performing specific tasks. A computer program product may include one or more computer-executable components that, when the program is run, are configured to execute the embodiments. The one or more computer-executable components may be at least one piece of software code or a portion thereof.

[0461] Furthermore, it should be noted that any box in the logical flow diagram may represent a program step, or an interconnected logical circuit, a box and function, or a combination of program steps and logical circuits, boxes and functions. Software may be stored on physical media such as memory chips or memory blocks implemented within a processor, magnetic media such as hard disks or floppy disks, and optical media such as DVDs and their data variants CDs. Physical media are non-transitory media.

[0462] As used herein, the term “non-transitory” refers to the limitation of the medium itself (i.e., tangible, not signaling), rather than a limitation on the persistence of data storage (e.g., RAM versus ROM).

[0463] The memory can be of any type suitable for the local technical environment and can be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory. The data processor can be of any type suitable for the local technical environment and, by way of non-limiting example, can include one or more of a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an FPGA, gate-level circuits, and processors based on multi-core processor architectures.

[0464] The various exemplary embodiments of this disclosure can be practiced in a variety of components, such as integrated circuit modules. Integrated circuit design is a highly automated process. Complex and powerful software tools can be used to transform logic-level designs into semiconductor circuit designs ready to be etched and formed on a semiconductor substrate.

[0465] The scope of protection sought by the various exemplary embodiments of this disclosure is set forth in the independent claims. Exemplary embodiments and features (if any) described in this disclosure that are not within the scope of the independent claims are to be interpreted as examples useful for understanding the various exemplary embodiments of this disclosure.

[0466] The foregoing description has provided a complete and informative description of various exemplary embodiments of the present disclosure by way of non-limiting and illustrative examples. However, various modifications and adaptations may become apparent to those skilled in the art when read in conjunction with the accompanying drawings and claims, given the foregoing description. Nevertheless, all such and similar modifications to the present teachings will still fall within the various exemplary embodiments of the present disclosure as set forth in the claims. As a non-limiting and illustrative example, there are other exemplary embodiments that include combinations of one or more exemplary embodiments with any other exemplary embodiments discussed above.

Claims

1. An apparatus for communication, comprising components for performing the following operations: A first signaling is obtained from the source network access node, the first signaling including information for performing a handover from the device to the target network access node, an indication to delay the execution of non-access stratum (NAS) signaling via the target network access node, and an indication of one or more access stratum security algorithms to be applied to communication between the device and the target network access node; and The handover to the target network access node is performed based on the information and the instructions.

2. The apparatus of claim 1, wherein the indication of the one or more access layer security algorithms includes one or more security mode command parameters.

3. An apparatus for communication, comprising means for performing the following operations: Obtain one or more access layer security algorithms that will be applied to communication between the user equipment and the target network access node; The user equipment is provided with first signaling, the first signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed; as well as A second signaling is provided to at least one network node, the second signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, wherein the second signaling also includes an indication of the one or more access stratum security algorithms.

4. The apparatus according to claim 3, further comprising: A component for providing information to the at least one network node indicating whether the key of the target network access node should be obtained horizontally or vertically.

5. The apparatus of claim 4, wherein the information indicating whether the key is to be obtained horizontally or vertically includes at least one of the following: an indication of the next-hop link counter (NCC) value, or the key of the target network access node generated by the source network access node.

6. The apparatus according to any one of claims 3 to 4, further comprising: A component for providing the user equipment with instructions on one or more access stratum security algorithms.

7. The apparatus according to any one of claims 3 to 4, wherein the component for obtaining the substance comprises: A component for sending requests for one or more access layer security algorithms for the target access network node via source access and mobility functions.

8. The apparatus according to any one of claims 3 to 4, wherein the component for obtaining the substance comprises: A component for sending an indication of the security capabilities of the user equipment to a target access network node via source access and mobility functions.

9. The apparatus according to claim 7, further comprising: A component for receiving an identifier of one or more access stratum security algorithms via the source access and mobility function based on at least one of the request for the one or more access stratum security algorithms or the indication of the security capabilities of the user equipment.

10. The apparatus according to any one of claims 3 to 4, wherein the indication of the one or more access stratum security algorithms includes one or more security mode command parameters.

11. The apparatus according to any one of claims 3 to 4, wherein the first signaling and the second signaling are transmitted in parallel.

12. An apparatus for communication, comprising components for performing the following operations: A second signaling is obtained from the source network access node, the second signaling including information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the device and the target network access node; and A third signaling is provided to the target access and mobility function, the third signaling including the information for performing a handover from the user equipment to the target network access node, the indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and the indication for one or more access stratum security algorithms.

13. The apparatus of claim 12, further comprising components for performing the following operations: Obtain information from the source network access node indicating whether the key for the target network access node should be obtained horizontally or vertically; and When the key is to be obtained vertically, a new key for access and mobility functions is generated.

14. The apparatus of claim 13, wherein the information indicating whether the key is to be obtained horizontally or vertically includes at least one of the following: an indication of the next-hop link counter (NCC) value, or a key of the target network access node generated by the source network access node.

15. An apparatus for communication, comprising components for performing the following operations: A third signaling is obtained from the source access and mobility functions, the third signaling including information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the device and the target network access node; and A fourth signaling is provided to the target network access node, the fourth signaling including information for performing a handover from the user equipment to the target network access node, and the indication of one or more access layer security algorithms.

16. An apparatus for communication, comprising components for performing the following operations: A fourth signaling is obtained from the target access and mobility functions, the fourth signaling including information for performing a handover from the user equipment to the device, and an indication of one or more access layer security algorithms to be applied to communication between the device and the user equipment; and Based on the instructions for the one or more access stratum security algorithms, access stratum signaling with the user equipment is executed.

17. The apparatus of claim 16, further comprising components for performing the following operations: After the user equipment enters the radio resource control connection state with the device, a fifth signaling is provided to the user equipment, the fifth signaling including information identifying how to execute the NAS signaling.

18. The apparatus of claim 17, wherein the information identifying how to perform the NAS signaling includes at least one of the following: one or more new parameters for establishing a NAS security context for performing the NAS signaling, or an indication to use at least one previously received parameter to establish a NAS security context for performing the NAS signaling.

19. The apparatus according to any one of claims 16 to 18, wherein at least one of the first to fourth signaling does not include information identifying the NAS security context.

20. A communication method for a device, the method comprising: The device obtains first signaling from the source network access node. The first signaling includes information for performing a handover from the device to the target network access node, an indication for delaying the execution of non-access stratum (NAS) signaling via the target network access node, and an indication for one or more access stratum security algorithms to be applied to communication between the device and the target network access node. as well as The handover to the target network access node is performed based on the information and the instructions.

21. A communication method for a device, the method comprising: Obtain one or more access layer security algorithms that will be applied to communication between the user equipment and the target network access node; The user equipment is provided with first signaling, the first signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed; as well as A second signaling is provided to at least one network node, the second signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, wherein the second signaling also includes an indication of the one or more access stratum security algorithms.

22. A communication method for a device, the method comprising: A second signaling is obtained from the source network access node, the second signaling including information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the device and the target network access node; and A third signaling is provided to the target access and mobility function, the third signaling including the information for performing a handover from the user equipment to the target network access node, the indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and the indication for one or more access stratum security algorithms.

23. A communication method for a device, the method comprising: A third signaling is obtained from the source access and mobility functions, the third signaling including information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the device and the target network access node. as well as A fourth signaling is provided to the target network access node, the fourth signaling including information for performing a handover from the user equipment to the target network access node, and an indication of one or more access layer security algorithms.

24. A communication method for a device, the method comprising: A fourth signaling is obtained from the target access and mobility functions, the fourth signaling including information for performing a handover from the user equipment to the device, and an indication of one or more access layer security algorithms to be applied to communication between the device and the user equipment; and Based on the instructions for the one or more access stratum security algorithms, access stratum signaling with the user equipment is executed.

25. A computer program product comprising instructions that, when executed by a computer of the apparatus, cause the apparatus to perform: A first signaling is obtained from the source network access node, the first signaling including information for performing a handover from the device to the target network access node, an indication to delay the execution of non-access stratum (NAS) signaling via the target network access node, and an indication of one or more access stratum security algorithms to be applied to communication between the device and the target network access node; and The handover to the target network access node is performed based on the information and the instructions.

26. A computer program product comprising instructions that, when executed by a computer of the apparatus, cause the apparatus to perform: Obtain one or more access layer security algorithms that will be applied to communication between the user equipment and the target network access node; The user equipment is provided with first signaling, the first signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed; as well as A second signaling is provided to at least one network node, the second signaling including information for performing a handover from the user equipment to the target network access node, and an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, wherein the second signaling also includes an indication of the one or more access stratum security algorithms.

27. A computer program product comprising instructions that, when executed by a computer of the apparatus, cause the apparatus to perform: A second signaling is obtained from the source network access node, the second signaling including information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the device and the target network access node; and A third signaling is provided to the target access and mobility function, the third signaling including the information for performing a handover from the user equipment to the target network access node, the indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and the indication for one or more access stratum security algorithms.

28. A computer program product comprising instructions that, when executed by a computer of the apparatus, cause the apparatus to perform: A third signaling is obtained from the source access and mobility functions, the third signaling including information for performing a handover from the user equipment to the target network access node, an indication that non-access stratum (NAS) signaling of the user equipment via the target network node will be delayed, and an indication of one or more access stratum security algorithms to be applied to communication between the device and the target network access node; and A fourth signaling is provided to the target network access node, the fourth signaling including information for performing a handover from the user equipment to the target network access node, and the indication of one or more access layer security algorithms.

29. A computer program product comprising instructions that, when executed by a computer of the apparatus, cause the apparatus to perform: A fourth signaling is obtained from the target access and mobility functions, the fourth signaling including information for performing a handover from the user equipment to the device, and an indication of one or more access layer security algorithms to be applied to communication between the device and the user equipment; and Based on the instructions for the one or more access stratum security algorithms, access stratum signaling with the user equipment is executed.

Images