Enhanced ue parameters update (UPU) procedures

The AUSF derives a message authentication code based on a UPU header protection indicator to authenticate and protect UE parameter updates, ensuring only compatible user equipment can perform updates, thus enhancing security and integrity.

HK40135745APending Publication Date: 2026-07-31NOKIA TECHNOLOGIES OY
View PDF 0 Cites 0 Cited by

Patent Information

Application Number
HK62026124245
Authority / Receiving Office
HK · HK
Patent Type
Applications
Current Assignee / Owner
Priority Date
2023-02-01
Filing Date
2026-06-02
Publication Date
2026-07-31

AI Technical Summary

Technical Problem

Existing systems lack efficient mechanisms for authenticating and protecting user equipment parameter updates (UPUs) in the context of user equipment (UE) parameter updates, particularly in the derivation of message authentication codes.

Method used

The Authentication Server Function (AUSF) derives a message authentication code based on a UPU header protection indicator, ensuring that only user equipment supporting UPU header protection can perform UE parameter updates, by sending a UPU protection response message including the derived code.

Benefits of technology

Enhances security and integrity of UE parameter updates by ensuring only compatible user equipment can perform updates, thereby preventing unauthorized changes.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure 00000000_0000_ABST
    Figure 00000000_0000_ABST
Patent Text Reader

Abstract

Systems, methods, and software of performing a UE parameters update (UPU) of user equipment. In an embodiment, an AUSF receives a UPU protection request message from a UDM regarding the UE parameters update, where the UPU protection request message includes UPU information containing UPU data and a UPU header. The AUSF determines whether the user equipment supports UPU header protection in derivation of message authentication codes based on a UPU header protection indicator in the UPU protection request message. The AUSF derives a message authentication code based on the UPU header when the user equipment supports UPU header protection, and sends a UPU protection response message to the UDM that includes the message authentication code.
Need to check novelty before this filing date? Find Prior Art

Description

This abstract describes a system, method, and software for performing UE parameter updates (UPUs) on a user equipment. In an embodiment, the AUSF receives a UPU protection request message from a UDM regarding the UE parameter update. The UPU protection request message includes UPU information, which contains UPU data and a UPU header. The AUSF determines whether the user equipment supports UPU header protection in the derivation of the message authentication code based on the UPU header protection indicator in the UPU protection request message. When the user equipment supports UPU header protection, the AUSF derives the message authentication code based on the UPU header and sends a UPU protection response message including the message authentication code to the UDM.

Claims

What is claimed is:

1. A method of performing a UE parameters update (UPU) for user equipment, the method comprising: receiving, at an Authentication Server Function (AUSF) of a 5G core network, a UPU protection request message from a Unified Data Management (UDM) regarding the UE parameters update for the user equipment, wherein the UPU protection request message includes first UPU information containing UPU data and a UPU header; determining, at the AUSF, whether the user equipment supports UPU header protection in derivation of message authentication codes based on a UPU header protection indicator in the UPU protection request message; deriving, at the AUSF, a first message authentication code based on the UPU header when the user equipment supports UPU header protection; and sending a UPU protection response message from the AUSF to the UDM that includes the first message authentication code.

2. The method of claim 1, further comprising: deriving, at the AUSF, the first message authentication code based on the UPU data and exclusive of the UPU header when the user equipment does not support UPU header protection.

3. The method of claim 2, further comprising: receiving the UPU protection response message at the UDM from the AUSF that includes the first message authentication code; generating, at the UDM, a subscriber data management notification message that includes second UPU information containing the UPU Data, and the first message authentication code; and sending the subscriber data management notification message from the UDM to an Access and Mobility Management Function (AMF).

4. The method of claim 3, further comprising: receiving the subscriber data management notification message at the AMF from the UDM; constructing, at the AMF, a UPU transparent container that contains the UPU data, the UPU header, and the first message authentication code; and sending a downlink transport message from the AMF to the user equipment with the UPU transparent container.

5. The method of claim 4, further comprising: receiving the downlink transport message at the user equipment from the AMF; and deriving, at the user equipment, a second message authentication code based on the UPU header when the user equipment supports UPU header protection: comparing, at the user equipment, the second message authentication code with the first message authentication code; and verifying, at the user equipment, the UE parameters update when the second message authentication code matches the first message authentication code.

6. The method of claim 5, further comprising: deriving, at the user equipment, the second message authentication code based on the UPU data and exclusive of the UPU header when the user equipment does not support UPU header protection.

7. The method of claim 5, wherein deriving the second message authentication code comprises: inputting, at the user equipment, the UPU data and the UPU header to a key derivation function.

8. The method of claim 5, further comprising: prior to the UE parameters update: inserting, at the user equipment, the UPU header protection indicator in a control plane message directed to the 5G core network; and sending the control plane message from the user equipment to the AMF.

9. The method of claim 8, wherein inserting the UPU header protection indicator in the control plane message comprises: inserting the UPU header protection indicator in an initial non-access stratum message.

10. The method of claim 8, wherein inserting the UPU header protection indicator in the control plane message comprises: inserting the UPU header protection indicator in a registration request provided during primary authentication of the user equipment.

11. The method of claim 1, wherein deriving the first message authentication code comprises: inputting, at the AUSF, the UPU data and the UPU header to a key derivation function.

12. The method of claim 1, further comprising: triggering, at the UDM, the UE parameters update for the user equipment; generating, at the UDM, a UPU protection request message; determining, at the UDM, whether the user equipment supports UPU header protection; when the user equipment supports UPU header protection, setting the UPU header protection indicator in the UPU protection request message to a first value indicating that the user equipment supports UPU header protection, when the user equipment does not support UPU header protection, setting the UPU header protection indicator in the UPU protection request message to a second value or omitting the UPU header protection indicator to indicate that the user equipment does not support UPU header protection; and sending the UPU protection request message from the UDM to the AUSF.

13. The method of claim 12 wherein determining whether the user equipment supports UPU header protection comprises: receiving, at the UDM, the UPU header protection indicator during primary authentication of the user equipment.

14. The method of claim 1, wherein: the UPU protection request message comprises an Nausf_UPUProtection Request message of an Nausf_UPUProtection service; and an extension to the Nausf_UPUProtection service provides for the UPU header protection indicator as an optional input.

15. An Authentication Server Function (AUSF) element of a 5G core network, comprising: at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the AUSF element at least to: receive, for a UE parameters update (UPU) of user equipment, a UPU protection request message from a Unified Data Management (UDM) regarding the UE parameters update for the user equipment, wherein the UPU protection request message includes UPU information containing UPU data and a UPU header; determine whether the user equipment supports UPU header protection in derivation of message authentication codes based on a UPU header protection indicator in the UPU protection request message; derive a message authentication code based on the UPU header when the user equipment supports UPU header protection; and send a UPU protection response message to the UDM that includes the message authentication code.

16. The AUSF element of claim 15, wherein the instructions, when executed by the at least one processor, further cause the AUSF element at least to: derive the message authentication code based on the UPU data and exclusive of the UPU header when the user equipment does not support UPU header protection.

17. The AUSF element of claim 15, wherein the instructions, when executed by the at least one processor, further cause the AUSF element at least to: input the UPU data and the UPU header to a key derivation function to derive the message authentication code, when the user equipment supports UPU header protection.

18. A Unified Data Management (UDM) element of a 5G core network, comprising: at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the UDM element at least to: trigger a UE parameters update (UPU) for user equipment; generate a UPU protection request message that includes first UPU information containing UPU data and a UPU header; determine whether the user equipment supports UPU header protection in derivation of message authentication codes; setting, when the user equipment supports UPU header protection, a UPU header protection indicator in the UPU protection request message to a first value indicating that the user equipment supports UPU header protection; setting, when the user equipment does not support UPU header protection, the UPU header protection indicator in the UPU protection request message to a second value or omitting the UPU header protection indicator to indicate that the user equipment does not support UPU header protection; and send the UPU protection request message to an Authentication Server Function (AUSF).

19. The UDM element of claim 18, wherein the instructions, when executed by the at least one processor, further cause the UDM element at least to: receive the UPU header protection indicator during primary authentication of the user equipment.

20. The UDM element of claim 18, wherein the instructions, when executed by the at least one processor, further cause the UDM element at least to: receive a UPU protection response message from the AUSF that includes a message authentication code; wherein when the user equipment supports UPU header protection, the message authentication code is derived by the AUSF based on the UPU header; wherein when the user equipment does not support UPU header protection, the message authentication code is derived by the AUSF based on the UPU data and exclusive of the UPU header; generate a subscriber data management notification message that includes second UPU information containing the message authentication code and the UPU data; and send the subscriber data management notification message to an Access and Mobility Management Function (AMF).

21. User equipment, comprising: at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the user equipment at least to: receive a downlink transport message from an Access and Mobility Management Function (AMF) of a 5G core network for a UE parameters update (UPU) of the user equipment, wherein the downlink transport message includes a UPU transparent container containing UPU data, a UPU header, and a first message authentication code generated by an Authentication Server Function (AUSF); derive, when the user equipment supports UPU header protection in derivation of message authentication codes, a second message authentication code based on the UPU header; compare the second message authentication code with the first message authentication code; and verify the UE parameters update when the second message authentication code matches the first message authentication code.

22. The user equipment of claim 21, wherein the instructions, when executed by the at least one processor, further cause the user equipment at least to: derive, when the user equipment does not support UPU header protection, the second message authentication code based on the UPU data and exclusive of the UPU header.

23. The user equipment of claim 21, wherein the instructions, when executed by the at least one processor, further cause the user equipment at least to: input the UPU data and the UPU header to a key derivation function to derive the second message authentication code, when the user equipment supports UPU header protection.

24. The user equipment of claim 21, wherein the instructions, when executed by the at least one processor, further cause the user equipment at least to: prior to the UE parameters update: insert a UPU header protection indicator in a control plane message directed to the 5G core network, wherein the UPU header protection indicator indicates whether the user equipment supports UPU header protection; and send the control plane message to the AMF.

25. The user equipment of claim 24, wherein the instructions, when executed by the at least one processor, further cause the user equipment at least to: insert the UPU header protection indicator in an initial non-access stratum message.

26. The user equipment of claim 24, wherein the instructions, when executed by the at least one processor, further cause the user equipment at least to: insert the UPU header protection indicator in a registration request provided during primary authentication of the user equipment.