UE, UE device and method, AMF device and method, and storage medium

Abstract

Systems and methods for protecting an initial NAS message are described. Depending on whether a security context for a serving PLMN is stored, the UE encrypts portions of the initial NAS message using a public key from the serving PLMN or a key from the security context. The initial NAS message containing the encrypted portions is then sent to the AMF of the serving PLMN. The serving PLMN public key is transmitted via the SIB. Prior to or in parallel with the transmission of the initial NAS message, an RRC message is sent to the base station. The RRC message contains a UE identifier and / or NSSAI encrypted using the serving PLMN public key.

Description

[0001] This application claims priority to U.S. Provisional Patent Application Serial No. 62 / 733,344, filed on September 19, 2018, which is incorporated herein by reference in its entirety. Technical Field

[0002] Embodiments relate to radio access networks (RANs). Some embodiments relate to cellular networks, including 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), 4th Generation (4G) and 5th Generation (5G) New Radio (NR) (or Next Generation (NG)) networks. Some embodiments relate to non-access stratum (NAS) messages in 5G systems. Background Art

[0003] Due to the increase in the number and type of user equipment (UE) using network resources and the increase in the amount of data and bandwidth used by various applications such as video streaming operating on these UEs, the use of various types of systems has increased. Bandwidth, latency and data rate enhancements can be used to deliver the increasing demand for network resources. The next generation of wireless communication systems 5G or NR will provide ubiquitous connectivity and information access, as well as the ability to share data by various users and applications. NR is expected to become a unified framework that aims to meet very different and sometimes conflicting performance standards and services. Generally speaking, NR will evolve based on 3GPP LTE Advanced technology and additional enhanced radio access technology (RAT) to achieve seamless wireless connectivity solutions. However, as with the emergence of any new technology, many problems have arisen with the introduction and use of such technologies. In this case, initial access to the NG radio access network (NG-RAN) may be problematic. Summary of the invention

[0004] According to a first aspect of the present disclosure, a device of a user equipment UE is provided, the device comprising: a memory, the memory being configured to store a security context associated with a serving public land mobile network PLMN; and a processor, the processor being configured to: decode a public key from the serving public land mobile network PLMN; determine whether the security context is stored in the memory; in response to determining that the security context is not stored in the memory, encrypt at least one information element IE using the public key to form at least one encrypted IE; and encode an initial non-access stratum NAS message for transmission to the serving PLMN, the initial NAS message comprising the at least one encrypted IE, the at least one encrypted IE comprising UE security capabilities, single network slice selection assistance information S-NSSAI and a key set identifier ngKSI for a next generation radio access network, wherein the entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is the first NAS message sent by the UE after transitioning from an idle state.

[0005] According to a second aspect of the present disclosure, a device of an access and mobility function AMF of a public land mobile network PLMN is provided, the device comprising: a processor, the processor being configured to: encode a public key of the PLMN for transmission in a system information block SIB or a non-access stratum NAS message; decode an initial NAS message from a UE, the initial NAS message comprising at least one encrypted information element IE encrypted using the public key, wherein the entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is the first NAS message sent by the UE after transitioning from an idle state, wherein the initial NAS message comprises: an encrypted IE containing UE security capabilities, single network slice selection assistance information S-NSSAI, and a key set identifier ngKSI for a next generation radio access network; and decrypt the at least one encrypted IE of the initial NAS message using a private key associated with the public key.

[0006] According to a third aspect of the present disclosure, a user equipment UE is provided, comprising: a radio; and a processor, the processor being operably connected to the radio and configured to enable the UE to: store a public key from a home public land mobile network PLMN; determine whether to store a security context for a serving PLMN; in response to determining that the security context is not stored, encrypt at least one information element IE using the public key from the home PLMN to form at least one encrypted IE; and transmit an initial non-access stratum NAS message for initial registration with the serving PLMN to the serving PLMN, the initial NAS message comprising the at least one encrypted IE, the at least one encrypted IE comprising UE security capabilities, single network slice selection assistance information S-NSSAI and a key set identifier ngKSI for a next generation radio access network, wherein the entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is the first NAS message sent by the UE after transitioning from an idle state.

[0007] According to a fourth aspect of the present disclosure, a method for a user equipment UE is provided, the method comprising: decoding a public key from a serving public land mobile network PLMN; determining whether a security context associated with the serving PLMN is stored in a memory included in the UE; in response to determining that the security context is not stored in the memory, encrypting at least one information element IE using the public key to form at least one encrypted IE; and encoding an initial non-access stratum NAS message for transmission to the serving PLMN, the initial NAS message comprising the at least one encrypted IE, the at least one encrypted IE comprising UE security capabilities, single network slice selection assistance information S-NSSAI and a key set identifier ngKSI for a next generation radio access network, wherein the entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is the first NAS message sent by the UE after transitioning from an idle state.

[0008] According to a fifth aspect of the present disclosure, a method for an access and mobility function AMF of a public land mobile network PLMN is provided, the method comprising: encoding a public key of the PLMN for transmission in a system information block SIB or a non-access stratum NAS message; decoding an initial NAS message from a UE, the initial NAS message comprising at least one encrypted information element IE encrypted using the public key, wherein the entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is the first NAS message sent by the UE after transitioning from an idle state, wherein the initial NAS message comprises: an encrypted IE containing UE security capabilities, single network slice selection assistance information S-NSSAI, and a key set identifier ngKSI for a next generation radio access network; and decrypting the at least one encrypted IE of the initial NAS message using a private key associated with the public key.

[0009] According to a sixth aspect of the present disclosure, a method for user equipment UE is provided, comprising: storing a public key from a home public land mobile network PLMN; determining whether to store a security context for a serving PLMN; in response to determining that the security context is not stored, encrypting at least one information element IE using the public key from the home PLMN to form at least one encrypted IE; and transmitting an initial non-access stratum NAS message for initial registration with the serving PLMN to the serving PLMN, the initial NAS message comprising the at least one encrypted IE, the at least one encrypted IE comprising UE security capabilities, single network slice selection assistance information S-NSSAI and a key set identifier ngKSI for a next generation radio access network, wherein the entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is the first NAS message sent by the UE after transitioning from an idle state.

[0010] According to a seventh aspect of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes instructions, which, when executed by one or more processors, enable the device to perform the above-mentioned method of user equipment UE or the method of access and mobility function AMF of public land mobile network PLMN.

[0011] According to an eighth aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein the computer program comprises instructions, which, when executed by one or more processors, enable the device to perform the above-mentioned method of user equipment UE or the method of access and mobility function AMF of public land mobile network PLMN. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In the drawings, which are not necessarily drawn to scale, like numbers may describe similar components in different views. Like numbers with different letter suffixes may represent different instances of similar components. The accompanying drawings generally illustrate various aspects described in this document by way of example and not by way of limitation.

[0013] Figure 1 A combined communication system according to some embodiments is shown.

[0014] Figure 2 A block diagram of a communication device according to some embodiments is shown.

[0015] Figure 3 An example of an initial NAS message transmission according to some embodiments is shown.

[0016] Figure 4 An example of a radio resource control (RRC) connection procedure is shown in accordance with some embodiments.

[0017] Figure 5 An example of a NAS Security Mode Command (SMC) process is shown in accordance with some embodiments.

[0018] Figure 6 An example of encryption at the UE according to some embodiments is shown.

[0019] Figure 7 An example of decryption at a UE according to some embodiments is shown. DETAILED DESCRIPTION

[0020] The following description and accompanying drawings sufficiently illustrate specific aspects to enable those skilled in the art to practice these aspects. Other aspects may incorporate structural changes, logical changes, electrical changes, process changes, and other changes. Portions and features of some aspects may be included in or replace portions and features of other aspects. Aspects set forth in the claims encompass all available equivalents in those claims.

[0021] Figure 1 A combined communication system according to some embodiments is shown. System 100 includes 3GPP LTE / 4G and NG network functions. The network functions may be implemented as discrete network elements on dedicated hardware, as software instances running on dedicated hardware, or as virtualized functions instantiated on an appropriate platform (e.g., dedicated hardware or cloud infrastructure).

[0022] The Evolved Packet Core (EPC) of the LTE / 4G network contains protocols and reference points defined for each entity. These core network (CN) entities may include a Mobility Management Entity (MME) 122, a Serving Gateway (S-GW) 124, and a Paging Gateway (P-GW) 126.

[0023] In NG networks, the control plane and the user plane may be separated, thereby allowing independent scaling and allocation of resources for each plane. The UE 102 may be connected to an access network or random access network (RAN) 110 and / or may be connected to an NG-RAN 130 (gNB) or an access and mobility function (AMF) 142. The RAN 110 may be an eNB or a general non-3GPP access point, such as an eNB or a general non-3GPP access point for Wi-Fi. The NG core network may also include multiple network functions in addition to the AMF 112. The UE 102 may generate uplink transmissions to the RAN 110 and / or gNB 130, encode and possibly encrypt them, and decode (and decrypt) downlink transmissions from the RAN 110 and / or gNB 130 (where the reverse is true for the RAN 110 / gNB130).

[0024] The network functions may include a user plane function (UPF) 146, a session management function (SMF) 144, a policy control function (PCF) 132, an application function (AF) 148, an authentication server function (AUSF) 152, and a user data management (UDM) 128. The various elements are connected by Figure 1 NG reference point connections shown.

[0025] AMF 142 may provide UE-based authentication, authorization, mobility management, etc. AMF 142 may be independent of access technology. SMF 144 may be responsible for session management and allocation of IP addresses to UE 102. SMF 144 may also select and control UPF 146 for data transmission. SMF 144 may be associated with a single session of UE 102 or multiple sessions of UE 102. That is, UE 102 may have multiple 5G sessions. A different SMF may be assigned to each session. Using different SMFs allows each session to be managed separately. Therefore, the functions of each session may be independent of each other. UPF 126 may be connected to a data network with which UE 102 may communicate, and UE 102 transmits uplink data to the data network or receives downlink data from the data network.

[0026] AF 148 may provide information about packet flows to PCF 132, which is responsible for policy control, to support the required QoS. PCF 132 may set mobility and session management policies for UE 102. To this end, PCF 132 may use packet flow information to determine appropriate policies for the correct operation of AMF 142 and SMF 144. AUSF 152 may store data for UE authentication. UDM 128 may similarly store UE subscription data.

[0027] The gNB 130 may be a standalone gNB or a non-standalone gNB, for example, operating in dual connectivity (DC) mode as a booster controlled by the eNB 110 via an X2 or Xn interface. At least some of the functionality of the EPC and NG CN may be shared (or, separate components may be used for each of the combined components shown). The eNB 110 may be connected to the MME 122 of the EPC via an S1 interface and to the SGW 124 of the EPC 120 via an S1-U interface. The MME 122 may be connected to the HSS 128 via an S6a interface, and the UDM may be connected to the AMF 142 via an N8 interface. The SGW 124 may be connected to the PGW 126 via an S5 interface (connected to the control plane PGW-C via S5-C and to the user plane PGW-U via S5-U). The PGW 126 may serve as an IP anchor for data over the Internet.

[0028] As described above, the NG CN may include AMF 142, SMF 144, and UPF 146, among others. The eNB 110 and the gNB 130 may communicate data with the SGW 124 of the EPC 120 and the UPF 146 of the NG CN. If the EPC 120 supports the N26 interface, the MME 122 and the AMF 142 may be connected via the N26 interface to provide control information therebetween. In some embodiments, when the gNB 130 is an independent gNB, the 5G CN and the EPC 120 may be connected via the N26 interface.

[0029] Figure 2 A block diagram of a communication device according to some embodiments is shown. In some embodiments, the communication device may be a UE (including IoT devices and NB-IoT devices), an eNB, a gNB, or other equipment used in a network environment. For example, the communication device 200 may be a dedicated computer, a personal or laptop computer (PC), a tablet, a mobile phone, a smart phone, a network router, a switch or a bridge, or any machine capable of executing (in sequence or otherwise) instructions specifying actions to be taken by the machine. In some embodiments, the communication device 200 may be embedded in other non-communication-based devices such as vehicles and appliances.

[0030] Examples as described herein may include a logical component or multiple components, modules or mechanisms, or may operate on a logical component or multiple components, modules or mechanisms. Modules and components are tangible entities (e.g., hardware) that can perform specified operations and can be configured or arranged in some way. In one example, a circuit may be arranged as a module in a specified manner (e.g., internally or relative to an external entity such as other circuits). In one example, all or part of one or more computer systems (e.g., independent computer systems, client computer systems, or server computer systems) or one or more hardware processors may be configured by firmware or software (e.g., instructions, application parts, or applications) to operate to perform a specified operation of the module. In one example, the software may reside on a machine-readable medium. In one example, the software, when executed by the underlying hardware of the module, causes the hardware to perform the specified operation.

[0031] Thus, the term "module" (and "component") should be understood to encompass a tangible entity, i.e., an entity that is physically constructed, specifically configured (e.g., hardwired), or temporarily (e.g., transiently) configured (e.g., programmed) to operate in a specified manner or to perform part or all of any operations described herein. Considering an example where a module is temporarily configured, each module need not be instantiated at any one time. For example, if a module includes a general-purpose hardware processor configured using software, the general-purpose hardware processor may be configured as corresponding different modules at different times. The software may configure the hardware processor accordingly, for example, to constitute a particular module at one instance in time and to constitute a different module at a different instance in time.

[0032] The communication device 200 may include a hardware processor 202 (e.g., a central processing unit (CPU), a GPU, a hardware processor core, or any combination thereof), a main memory 204, and a static memory 206, some or all of which may communicate with each other via an interconnection link (e.g., a bus) 208. The main memory 204 may include any or all of a removable storage device and a non-removable storage device, a volatile memory, or a non-volatile memory. The communication device 200 may also include a display unit 210 such as a video display, a mixed digital and alphanumeric input device 212 (e.g., a keyboard), and a user interface (UI) navigation device 214 (e.g., a mouse). In one example, the display unit 210, the input device 212, and the UI navigation device 214 may be a touch screen display. The communication device 200 may additionally include a storage device (e.g., a drive unit) 216, a signal generating device 218 (e.g., a speaker), a network interface device 220, and one or more sensors, such as a global positioning system (GPS) sensor, a compass, an accelerometer, or other sensors. The communication device 200 may also include an output controller, such as a serial (e.g., Universal Serial Bus (USB)) connection, a parallel connection, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection to communicate with or control one or more peripheral devices (e.g., a printer, a card reader, etc.).

[0033] The storage device 216 may include a non-transitory machine-readable medium 222 (hereinafter referred to as a machine-readable medium) on which is stored one or more sets of data structures or instructions 224 (e.g., software) embodied or utilized by any one or more of the techniques or functions described herein. During execution of the instructions 224 by the communication device 200, these instructions may also reside successfully or at least partially within the main memory 204, within the static memory 206, and / or within the hardware processor 202. Although the machine-readable medium 222 is illustrated as a single medium, the term "machine-readable medium" may include a single medium or multiple media (e.g., a centralized or distributed database, and / or associated caches and servers) configured to store one or more instructions 224.

[0034] The term "machine-readable medium" may include any medium capable of storing, encoding, or carrying instructions for execution by the communication device 200 and causing the communication device 200 to perform any one or more of the techniques of the present disclosure, or capable of storing, encoding, or carrying data structures used by or associated with such instructions. Non-limiting examples of machine-readable media may include solid-state memory, and optical and magnetic media. Specific examples of machine-readable media may include: non-volatile memory, such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; random access memory (RAM); and CD-ROM and DVD-ROM disks.

[0035] The instructions 224 may also be transmitted or received in a communication network via the network interface device 220 using a transmission medium 226, the transmission or reception being performed using any of a plurality of transmission protocols (e.g., frame relay, Internet Protocol (IP), transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), etc.). Exemplary communication networks may include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), a mobile phone network (e.g., a cellular network), a plain old telephone (POTS) network, and a wireless data network. Communications over the network may include one or more different protocols, such as the Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards (referred to as Wi-Fi), the IEEE 802.16 family of standards (referred to as WiMax), the IEEE 802.15.4 family of standards, the Long Term Evolution (LTE) family of standards, the Universal Mobile Telecommunications System (UMTS) family of standards, peer-to-peer (P2P) networks, NG / NR standards, and the like. In one example, the network interface device 220 may include one or more physical jacks (eg, Ethernet, coaxial, or telephone jacks) or one or more antennas to connect to the transmission medium 226 .

[0036] The communication device 200 may be an IoT device (also referred to as a "machine type communication device" or "MTC device"), a narrowband IoT (NB-IoT) device, or a non-IoT device (e.g., a smartphone, a vehicle-mounted UE), any of which may be connected via Figure 1The eNB or gNB shown communicates with the core network. The communication device 200 can be an autonomous or semi-autonomous device that performs one or more functions (such as sensing or control, etc.) and communicates with other communication devices and a wider network (such as the Internet). If the communication device 200 is an IoT device, in some embodiments, the communication device 200 can be limited in memory, size, or functionality, allowing a larger number to be deployed at a similar cost to a smaller number of larger devices. In some embodiments, the communication device 200 can be a virtual device, such as an application on a smartphone or other computing device.

[0037] As described above, in order to transition from the idle state to the connected state over the 5G system, the UE may send an initial NAS message to the AMF. Depending on the context, this initial NAS message may be one of the following three NAS messages: a registration request, a service request, or a deregistration request. A registration request may be sent to register the UE with the 5G network, for example, during the UE's initial registration with the network, for mobility registration updates, or as part of a periodic registration update. A service request may start the establishment of a NAS signaling connection. A deregistration request may be sent to deregister the UE from the 5G network.

[0038] Figure 3 An example of an initial NAS message transmission according to some embodiments is shown. Figure 3 Also shown is a security mechanism for protecting NAS signaling and data between UE 302 and AMF 304 over the N1 reference point. The security mechanism involves both integrity protection and confidentiality protection.

[0039] like Figure 3 As shown in the first operation in FIG, the initial NAS message is the first NAS message sent after the UE 302 transitions from the idle state. The UE 302 sends a limited set of information elements (IEs) called plaintext IEs in the first NAS message. In the case where the UE 302 does not have a NAS security context, the plaintext IE may include an IE for establishing security and / or implementing the selection of the AMF 304 in the initial message. In this case, the UE 302 may include an additional IE in the NAS security mode completion message to provide encryption protection for the IE. In the case where the UE 302 has a security context, the UE 302 may send a complete initial message, which is protected by the integrity of the unencrypted plaintext IE. The plaintext IE may include an IE for allowing the AMF 304 to verify the message, establish security, and / or implement the selection of the AMF 304. The UE 302 may send all other encrypted IEs. In the case where there is no security context in the UE 302 or the integrity protection check fails at the AMF 304, the AMF 304 may use a hash value to protect the integrity of the unencrypted IE.

[0040] Therefore, if Figure 3 As shown, the UE 302 may send an initial NAS message to the AMF 304 at step 1. If the UE 302 does not have a NAS security context, the initial NAS message may contain only plaintext IEs. The plaintext IEs may include a subscription identifier (e.g., a subscription hidden identifier (SUCI) or a globally unique temporary UE identity (GUTI) assigned by the network during a previous session), UE security capabilities, single network slice selection assistance information (S-NSSAI), a key set identifier for the next generation radio access network (ngKSI), a last visited tracking area identifier (TAI), an indication that the UE 302 is moving from the EPC, and an IE containing a TAU request in the case of idle mobility from a 4G network. When the initial NAS message is used as a registration request during the initial registration of the UE 302 with the AMF 304, the UE 302 may generally not have a security context.

[0041] For completeness, when the initial NAS message is a Registration Request message, the plaintext IEs are: Extended Protocol Discriminator; Security Header Type; Spare Nibble; Registration Request Message Identifier; 5GS Registration Type; ngKSI; 5GS Mobile Identity; UE Security Capabilities; Additional GUTI; UE State; and EPS NAS Message Container. When the initial NAS message is a Service Request message, the plaintext IEs are: Extended Protocol Discriminator; Security Header Type; Spare Nibble; ngKSI; Service Request Message Identifier; Service Type; and 5G-S-TMSI.

[0042] If the UE 302 has a NAS security context, the initial message may contain a complete message using partial encryption. In this case, the above information may be sent in plain text, but the rest of the message (remaining IEs) may be encrypted. Using the NAS security context, the initial message may also be integrity protected. If the initial message is protected, the AMF 304 may have the same security context and successfully check the integrity. In this case, steps 2 to 4 may be omitted. For example, when the initial NAS message is used as a registration request during a periodic registration or service request, the UE 302 may have a security context.

[0043] If the AMF 304 does not have a security context, as determined by the AMF 304 in communication with the last visited AMF 306 (last visited by the UE 302 at step 2a), the AMF 304 may initiate an authentication procedure with the UE 302 at step 2b. The AMF 304 may also initiate an authentication procedure with the UE 302 if the integrity check fails.

[0044] After successful authentication of the UE 302, the AMF 304 may send a NAS Security Mode Command message at step 3. If the initial message was sent without integrity protection or integrity protection failed (due to MAC failure or the AMF 304 failed to find a used security context), the AMF 304 may include a hash value of the initial NAS message in the NAS Security Mode Complete message. If the AMF 304 does not receive the Additional IE from step 1, because the Additional IE is not included or because the AMF 304 cannot decrypt the IE, the AMF 304 may include a hash value of the initial NAS message in the NAS Security Mode Command message.

[0045] At step 4, UE 302 may send a NAS Security Mode Complete message to the network in response to receiving the NAS Security Mode Command message. The NAS Security Mode Complete message may be encrypted and integrity protected. If the check on the hash value fails, the NAS Security Mode Complete message may include a complete initial NAS message. In this case, AMF 304 may treat the NAS Security Mode Complete message as an initial NAS message to respond to. Otherwise, if UE 302 successfully checks the hash value, the NAS Security Mode Complete message may include additional IEs in the NAS Security Mode Command message. In this case, AMF 304 may use the plain text IEs from step 1 and the additional IEs from step 4 as the initial NAS message to respond to.

[0046] At step 5, the AMF 304 may send its response to the initial NAS message. The message may be encrypted and integrity protected.

[0047] However, in Figure 3 In the message exchange shown, a relatively large number of parameters carrying sensitive information may be sent in plain text. These parameters may allow, for example, tracking of the UE. To further improve the security of the initial NAS message, in some embodiments, the serving public land mobile network (PLMN) network may announce a public key via a system information block (SIB). Alternatively or in addition, the serving PLMN network may send the public key via dedicated NAS signaling after the transmission of the registration request. The UE may use the public key to encrypt part of the initial NAS message (registration request, service request, or deregistration request). Each AMF in the serving PLMN may know the corresponding private key for decrypting the initial NAS message. By using public key encryption, more complete security can be provided for the initial NAS message, and security attacks (e.g., tracking) can be prevented. In addition, problems associated with "passive" attackers (such as attackers who only eavesdrop on radio signals) can be alleviated. In addition, the embodiments of this article even allow the UE identity (e.g., 5G-GUTI) to be encrypted.

[0048] In some implementations, the serving PLMN network may announce the public key via the SIB. Figure 3 Prior to transmission at step 1 of , the UE may encrypt a portion of the initial NAS message (Registration Request, Service Request, or Deregistration Request) using a public key. In addition, each AMF in the serving PLMN may know the corresponding private key for decrypting the initial NAS message. In some embodiments, the portion of the initial NAS message encrypted using the public key may include the entire message, while in other embodiments, only a subset of the initial NAS message may be encrypted. In the latter case, for example, some or all of the plaintext IEs of the initial NAS message may be encrypted (or encrypted) using the public key rather than sent in plaintext.

[0049] When the UE has a security context, the plaintext IE can be encrypted using a public key, while the remaining IEs can be protected using the existing partial encryption mechanism using the encryption key from the NAS security context. The initial NAS message can also contain a Nonce, a timestamp, or a sequence number so that the result of the public key encryption changes periodically. This can be used to prevent replay attacks, for example. The Nonce itself can belong to the plaintext IE.

[0050] The advertised public key may change over time. The frequency of public key changes may be set by the operator (network). During the transition time (i.e., when the new public key is distributed to all core network (CN) and radio access network (RAN) nodes), the network may accept initial NAS messages encrypted with either the old public key or the new public key to avoid unnecessary rejection of UE requests.

[0051] An "active" attacker (e.g., a malicious base station) will advertise a public key that is different from the public keys advertised by other base stations in order to be able to decrypt the initial NAS message of the "victim" UE. If the UE is able to read the SIB from multiple neighboring cells, the UE may be able to identify the malicious base station simply by comparing the advertised public keys and realizing that one of them is different from the others. The UE can then report the malicious base station to the real network after registering with the real network.

[0052] Such an implementation may also be used to encrypt the RRC message carrying the initial NAS message. This will allow for confidentiality of parameters (e.g., NSSAI) expressed in plain text at the RRC level. If so, the RAN node will also know the private key. Note that the public key used at the RRC level may be the same or different from the public key used at the NAS level, however, both of them may be announced via the SIB. Obviously, RRC-level encryption may be performed in either or both of the RRC setup messages (RRCSetupRequest and RRCSetupComplete). In some implementations, the initial NAS message may be carried on the RRCSetupComplete message together with the NSSAI and UE identity. In this case, the encryption of the initial NAS message may occur simultaneously with the encryption of the NSSAI and UE identity at the RRC layer. In other implementations, the RRCSetupRequest message may contain only the initial UE identity, which may also be encrypted using a public key. Therefore, public key encryption at the RRC layer may occur alone (RRCSetupRequest) or simultaneously with encryption at the NAS layer (RRCSetupComplete).

[0053] In some embodiments, the UE may be configured with the home PLMN operator's public key for encrypting the UE's 5G Subscription Permanent Identifier (SUPI) instead of broadcasting the public key as described above. The home PLMN operator's public key may be used to protect the initial NAS message for initial registration. In this case, the serving PLMN network may send the serving PLMN operator's public key via dedicated NAS signaling during or after the initial registration. The serving PLMN operator's public key may be used to protect the initial NAS message protection for subsequent network access (i.e., in addition to the initial registration).

[0054] In the initial NAS message during initial registration (i.e., before any security context between the UE and the serving network), the UE may use the Home PLMN public key (used to generate the SUCI) to encrypt the entire NAS message payload included in the Registration Request message. The EE may use the SUCI as a mobile identity (subscription identifier). Other information in the initial NAS message (plaintext IEs or remaining IEs) may be included in a separate part of the initial NAS message and encrypted.

[0055] Upon receiving the initial NAS message for initial registration, the AMF in the serving network may send the SUCI with the encrypted NAS message to the home network. The home operator may decrypt the SUCI to extract the SUPI specified in TS 33.501 and may also decrypt the NAS message payload. The home operator may then send the SUPI and the decrypted NAS message payload to the AMF in the serving network.

[0056] Upon successful authentication, the AMF in the serving network may send its public key to the UE in the SMC command. In addition, the AMF may include the public key of an equivalent PLMN. An example of an equivalent PLMN may be, for example, a PLMN in a neighborhood where the UE may attempt to register via a mobility registration update rather than an initial registration. If the UE receives the public key of the AMF in the SMC command, the UE may use the AMF public key to encrypt subsequent initial NAS messages transmitted to the AMF.

[0057] Figure 4 An example of a radio resource control (RRC) connection procedure according to some embodiments is shown. During initial acquisition, the UE 402 may perform initial synchronization by detecting the primary synchronization signal (PSS) and the secondary synchronization signal (SSS) of the synchronization signal block (SSB) to obtain the cell identity and frame timing. The PSS may provide slot timing and physical layer ID; the SSS may provide the physical layer cell identity group number, physical layer cell ID, cyclic prefix length, FDD or TDD determination for radio frame timing detection.

[0058] The UE 402 may then obtain system information during reception of a physical broadcast channel (PBCH) in the SSB, which may carry a master information block (MIB) and a system information block (SIB) of the AMF 404. In some embodiments, one of the SIBs may include a public key of the AMF 404. The public key may be provided in a SIB already present in the 3GPP standard or in a new SIB. The UE 402 may also obtain random access procedure configuration information from the PBCH.

[0059] After obtaining the random access procedure configuration information, the UE 402 may perform a random access procedure. The random access procedure may include the UE 402 initially transmitting a random access preamble to the AMF 404 using a random access channel (RACH) (Msg-1). The RACH may use a random access radio network temporary identifier (RA-RNTI) and a selected preamble index. The RACH may be sent at a time and frequency location determined according to the RACH parameters in SIB2 of the PBCH.

[0060] UE 402 may receive a random access response (RAR) in a physical downlink shared channel (PDSCH) (Msg-2) from AMF 404. The RAR may include a RA-RNTI, a cell RNTI (RA-RNTI), a timing adjustment for UE 402, and an uplink grant.

[0061] Then, in some embodiments, UE 402 may transmit an RRC connection request (Msg-3) on an uplink shared channel (UL-SCH) using resources indicated by the RAR at a timing based on the timing adjustment. In some embodiments, UE 402 may send an RRC setup request (Msg-3) using the UE identity and establishment cause used during contention resolution. The UE identity may be encrypted using a network key.

[0062] The AMF 404 may then respond to the RRC connection request by transmitting an RRC connection setup message or an RRC setup message (Msg-4) on a downlink shared channel (DL-SCH). The RRC connection setup message may include information on signaling radio bearers (SRBs), data radio bearers (DRBs), and UE-specific configurations.

[0063] UE 402 may transmit an RRC connection complete message or an RRC setup complete message on the UL-SCH in response. The RRC connection / setup complete message may confirm the receipt of the RRC setup message and provide the PLMN ID of the UE's home network and dedicated NAS information to AMF 404. The dedicated NAS information may include the UE's registration (GUAMI) type, 5G-GUTI (SAE-Temporary Mobile Subscriber Identity (S-TMSI), the last tracking area identifier (TAI), the requested NSSAI, the UE capabilities, and a list of PDU sessions. At least a portion of the dedicated NAS information (plain text IE) may be encrypted using the public key of AMF 404.

[0064] Subscription Persistent Identifier

[0065] A SUPI may be allocated to each subscriber in the 5G system for use within the 3GPP system. The 5G system may support identification of subscriptions independently of the identification of the UE. Each UE accessing the 5G system may also be allocated a permanent equipment identifier (PEI). The 5G system may also support allocation of a temporary identifier (5G-GUTI) to support user confidentiality protection.

[0066] A globally unique SUPI may be assigned to each subscriber in the 5G system and provided in the UDM / UDR. The SUPI may be used only within the 3GPP system. The SUPI may contain an IMSI or a network-specific identifier for a private network. For a network access identifier (NAI) based on an International Mobile Subscriber Identity (IMSI) or based on a non-IMSI (e.g., when used over a non-3GPP access technology or for a private network), the SUPI may take the form of an NAI using NAI RFC 7542. To enable roaming scenarios, the SUPI may contain the address of the home network (e.g., the Mobile Country Code (MCC) and Mobile Network Code (MNC) in the case of an IMSI-based SUPI). For interworking with the EPC, the SUPI assigned to a 3GPP UE may be based on the IMSI to enable the UE to present the IMSI to the EPC. By using the SUCI described below, the SUPI may be privacy protected over the air.

[0067] Subscribe to hidden identifiers

[0068] The SUCI is a privacy-preserving identifier that contains a hidden SUPI or Mobile Subscriber Identity Number (MSIN). The SUCI may be a one-time use subscription identifier that contains a hidden subscription identifier (e.g., the MSIN portion of the SUPI), and additional non-hidden information for home network routing and protection scheme use. The UE may generate the SUCI using a protection scheme with an original public key that is securely provisioned under the control of the home network. The protection scheme may be specified in Annex C or by the HPLMN.

[0069] The UE may construct a scheme input from the subscription identifier part of the SUPI, as specified by the protection scheme. The UE may execute the protection scheme with the constructed scheme input as input and the output as the scheme output. The UE may not hide the home network identifier, such as MCC or MNC. The UE may construct the SUCI with the following data fields: a protection scheme identifier representing the protection scheme specified in Annex C or a protection scheme specified by the HPLMN; a home network public key identifier representing the public key provided by the HPLMN; if the null scheme is used, this data field may be set to null; the home network identifier; and the scheme output. The format of the identifier and the scheme output is defined elsewhere. In the case of a non-null scheme, the freshness and randomness of the SUCI may be addressed by the corresponding SUPI protection scheme.

[0070] The UE may include the SUCI only in certain 5G NAS messages. If the UE is sending a Registration Request message of an initial registration type to a PLMN for which the UE does not yet have a 5G-GUTI, the UE may include the SUCI in the Registration Request message. In addition, if the UE includes the 5G-GUTI when sending a Registration Request message of a re-registration type to the PLMN and, in response, receives an Identity Request message, the UE may include a new SUCI in the Identity Response message.

[0071] The UE may never send a SUPI in response to the Identifier Request message. The UE may only use the Null scheme to generate the SUCI in certain circumstances. If the UE is conducting an unauthenticated emergency session and does not have a 5G-GUTI to the selected PLMN, the UE may use the Null scheme to generate the SUCI. In addition, if the home network has configured the Null scheme to be used, the UE may use the Null scheme to generate the SUCI. If the home network has not yet provided a public key for generating the SUCI, the UE may also use the Null scheme to generate the SUCI.

[0072] If the operator decision indicated by the User Subscriber Identity Module (USIM) is that the USIM may calculate the SUCI, the USIM may not provide the Mobile Entity (ME) with any parameters for calculating the SUCI, including the Home Network Public Key, the Home Network Public Key Identifier, the Protection Scheme Profile, and the Protection Scheme Identifier. If the ME determines that the calculation of the SUCI indicated by the USIM may be performed by the USIM, the ME may delete any previously received or locally cached parameters for calculating the SUCI, including the Home Network Public Key, the Home Network Public Key Identifier, the Protection Scheme Profile, and the Protection Scheme Identifier. If the operator chooses to perform the calculation of the SUCI in the USIM, the operator may use a proprietary identifier for the protection scheme.

[0073] If the operator's decision is for the ME to calculate the SUCI, the home network operator may provide an ordered priority list of protection scheme identifiers allowed by the operator in the USIM. The priority list of protection scheme identifiers in the USIM may contain only the protection scheme identifiers specified in Annex C, and the list may contain one or more protection scheme identifiers. The ME may read the SUCI calculation information from the USIM, including SUPI, home network public key, home network public key identifier, and protection scheme identifier list. The ME may select a protection scheme from the schemes it supports that has the highest priority in the list obtained from the USIM. If the home network public key or priority list is not provided in the USIM, the ME may calculate the SUCI using a null scheme.

[0074] Note that the protection scheme selected by the older ME may not be the protection scheme with the highest priority in the USIM list. The Subscription Identifier Dehiding Function (SIDF) may be responsible for dehiding the SUCI. The SIDF is a service provided by the UDM in the subscriber's home network and is responsible for dehiding the SUPI from the SUCI. The SIDF parses the SUPI from the SUCI based on the protection scheme used to generate the SUCI. The home network key for subscriber privacy may be protected from physical attacks in the UDM. When a private key / public key pair is used for subscriber privacy, the UDM may retain the key identifier. Algorithms for subscriber privacy may be executed in the secure environment of the UDM.

[0075] Permanent Equipment Identifier

[0076] A Permanent Equipment Identifier (PEI) may be defined for 3GPP UEs accessing 5G systems. The PEI may take different formats for different UE types and use cases. The UE may present the PEI to the network together with an indication of the PEI format used. If the UE supports at least one 3GPP access technology, the UE may be assigned a PEI in IMEI format.

[0077] 5G Globally Unique Temporary Identifier

[0078] The AMF may allocate a 5G-GUTI shared by 3GPP and non-3GPP access to the UE. The same 5G-GUTI may be used within the AMF of a given UE to access 3GPP access and non-3GPP access security contexts. The AMF may reallocate a new 5G-GUTI to the UE at any time. The AMF may delay updating the UE with its new 5G-GUTI until the next NAS transaction.

[0079] 5G-GUTI can be constructed as:

[0080] <5G-GUTI>:= <guami><5G-TMSI>

[0081] Where GUAMI identifies one or more AMFs. When GUAMI identifies only one AMF, the 5G-TMSI may uniquely identify the UE within the AMF. However, when the AMF allocates to the UE a 5G-GUTI where the GUAMI value is used by more than one AMF, the AMF may ensure that the 5G-TMSI value used within the allocated 5G-GUTI has not been used by other AMFs that share the GUAMI value.

[0082] The Globally Unique AMF ID (GUAMI) can be constructed as:

[0083] <guami> :＝ <mcc> <mnc><AMF Region ID><AMF Set ID><AMF Pointer>

[0084] Wherein the AMF Region ID identifies the region, the AMF Set ID uniquely identifies the AMF group within the AMF region, and the AMF Pointer identifies one or more AMFs within the AMF group. By enabling operators to reuse the same AMF Group ID and AMF Pointer in different regions, the AMF Region ID solves the situation where the number of AMFs in the network exceeds the number of AMFs that the AMF Group ID and AMF Pointer can support. 5G-S-TMSI is an abbreviated form of GUTI used to enable more efficient radio signaling processes (for example, during paging and service requests) and is defined as:

[0085] <5G-S-TMSI>:= <AMF Set ID><AMF Pointer<5G-TMSI>

[0086] NAS Security Mode Command Process

[0087] Figure 5 An example of a NAS Security Mode Command (SMC) procedure according to some embodiments is shown. The NAS Security Mode Command (SMC) procedure may be used to establish a NAS security context between the UE and the AMF. The procedure may include messaging between the AMF and the UE. The AMF may send a NAS Security Mode Command message to the UE, and the UE may reply with a NAS Security Mode Complete message.

[0088] The NAS SMC procedure may be designed so that it protects the Registration Request from a man-in-the-middle attack, where an attacker modifies the IE containing the UE security capabilities provided by the UE in the Registration Request. This works as follows: If the method completes successfully, the UE attaches to the network knowing that no degradation attack has occurred. In the event that a degradation attack is attempted, the verification of the NAS SMC will fail and the UE may reply with a rejection message which means that the UE will not attach to the network.

[0089] As shown in the figure, at step 1a., AMF 504 may activate NAS integrity protection before sending a NAS security mode command message. At step 1b., AMF 504 may send a NAS security mode command message to UE 502. The NAS security mode command message may include: a replayed UE security capability, a selected NAS algorithm, and a method for identifying K AMF ngKSI. The NAS security mode command message may include horizontal export parameters, HASH AMF , Anti-degradation between architectures (ABBA) parameters. If K AMF If the horizontal derivation is performed during a mobility registration update or during multiple registrations in the same PLMN, the horizontal derivation parameters may be included in the NAS Security Mode Command message as described in clause 6.9.3 of TS 33.501.

[0090] HASH AMF The inclusion is described in clause 6.4.6 of TS 33.501. AMF can calculate HASH AMF , as described in Annex H.2. This message may be integrity protected (but not encrypted) using the NAS integrity key, where the NAS integrity key is based on the K indicated by ngKSI in the NAS Security Mode Command message. AMF (See Figure 6 .7.2-1). After sending the NAS Security Mode Command message, NAS uplink decryption at the AMF 504 can begin using this context.

[0091] If the network supports interworking using the N26 interface between the MME and the AMF, the AMF may also include the selected EPS NAS algorithm (defined in Annex B of TS 33.501) in the NAS Security Mode Command message for use after moving to EPS (see clause 8.5.2). The UE may use the N26 interface between the MME and the AMF to store the algorithm for use after moving to EPS. The AMF may store the selected EPS algorithm in the UE security context.

[0092] The message may be integrity protected (but not encrypted) using a NAS integrity key, where the NAS integrity key is derived from the KAMF indicated by ngKSI in the NAS Security Mode Command message.

[0093] At step 1c, the AMF 504 may activate NAS uplink decryption after sending the NAS Security Mode Command message.

[0094] At step 2a, UE 502 may verify the NAS Security Mode Command message. This may include checking that the UE security capabilities sent by AMF 504 match the UE security capabilities stored in UE 502 to ensure that these UE security capabilities have not been modified by an attacker, and verifying that the NAS security mode command message is valid using the indicated NAS integrity algorithm and the K value based on the ngKSI. AMF The NAS integrity key is used to verify the integrity protection.

[0095] If the NAS security mode command message includes HASH AMF , then UE 502 can calculate HASH based on the entire initial NAS message sent by UE 502 UE , and HASH UE With HASH AMF UE 502 may calculate HASHUE. UE 502 may calculate HASHUE after UE 502 sends the registration request and before UE 502 receives the NAS security mode command message. Alternatively, UE 502 may calculate HASHUE after successfully verifying the NAS security mode command message. AMF If the NAS security mode command message includes a horizontal derivation parameter, the UE 502 may derive the new K as described in Appendix A.13. AMF And set the NAS count to zero. If the integrity verification of the NAS Security Mode Command message succeeds, the UE 502 may start utilizing NAS integrity protection and encryption / decryption of the security context indicated by ngKSI.

[0096] At step 2b, UE 502 may send an encrypted and integrity protected NAS Security Mode Complete message to AMF 504. The NAS Security Mode Complete message may include the PEI if requested by AMF 504 in the NAS Security Mode Command message. AMF The processing is described in clause 6.4. If K AMF If the level is exported, the AMF 504 may set the NAS count to zero.

[0097] If the verification of the NAS Security Mode Command message is unsuccessful in the UE 502, the UE 502 may reply with a NAS Security Mode Reject message (see TS 24.501). The NAS Security Mode Reject message and all subsequent NAS messages may be protected with the previous (if any) 5G NAS security context (i.e., the 5G NAS security context used before the failed NAS Security Mode Command message). If no 5G NAS security context existed before the NAS Security Mode Command message, the NAS Security Mode Reject message may remain unprotected.

[0098] The failed hash value comparison may not affect the security establishment because the UE 502 still checks the UE security capabilities sent by the AMF 504 in the NAS Security Mode Command message. The AMF 504 may decrypt the NAS Security Mode Complete message and check the integrity protection using the key and algorithm indicated in the NAS Security Mode Command message. After receiving the NAS Security Mode Complete message, NAS downlink encryption at the AMF 504 may begin using the security context. If the AMF 504 has sent the HASH value comparison in step 1b, the AMF 504 may decrypt the NAS Security Mode Complete message and check the integrity protection. AMF , then AMF 504 may execute as described in clause 6.4.6.

[0099] At step 1d, the AMF 504 may activate NAS downlink decryption. If the uplink NAS count would wrap around by sending a NAS security mode reject message, the UE 502 may release the NAS connection instead of sending a NAS security mode reject message.

[0100] Elliptic Curve Integrated Encryption Scheme (ECIES)

[0101] Figure 6 An example of encryption at the UE according to some embodiments is shown. Figure 6 An example of decryption at the UE according to some embodiments is similarly shown. Specifically, Figure 6 shows the use of ECIES to hide the SUPI to comply with the SECG specification, while Figure 7 ECIES decryption is shown. The following describes the processing on the UE side and the home network side.

[0102] Processing on the UE side

[0103] The ECIES scheme may be implemented such that, to calculate a new SUCI, the UE may use the provided home network's public key and a newly generated elliptic curve cryptography (ECC) temporary public / private key pair according to the ECIES parameters provided by the home network. The processing on the UE side may be done according to the cryptographic operations defined in SECG SEC 1: Recommended Elliptic Curve Cryptography, Version 2.0, 2009. Available at http: / / www.secg.org / sec1-v2.pdf (which is incorporated herein by reference in its entirety and hereinafter referred to as "SECG SEC 1v2"), with the following changes made to Section 3.8 and Steps 5 and 6 of Section 5.1.3.

[0104] As shown, key data K of length enckeylen+icblen+mackeylen may be generated. The leftmost enckeylen octets of K may be parsed as an encryption key (EK), the middle icblen octets of K may be parsed as an initial counter block (ICB), and the rightmost mackeylen octets of K may be parsed as a MAC key (MK). The final output may be a concatenation of the ECC temporary public key, the ciphertext value, the MAC tag value, and any other parameters (if applicable). In some cases, when point compression is used, other parameters may be used to enable the sender to send additional symbol indications.

[0105] ECIES Profile

[0106] Unless otherwise specified, the ECIES profile follows the terminology and processing specified in SECG SEC 1v2. The profile is intended for use with named curves over prime fields.

[0107] To generate a continuous counter block from the ICB in control (CTR) mode, the configuration file may use the standard increment function in Section B.1 of NIST Special Publication 800-38A (where m=32 bits). The ICB corresponds to T1.

[0108] Profile A may use its own standardized processes for key generation (Section 6 of RFC 7748) and shared secret computation (Section 5 of RFC 7748). The Diffie-Hellman primitive X25519 (Section 5 of RFC 7748) takes two random octet strings as input, decodes them into a scalar and a coordinate, performs a multiplication, and encodes the result as an octet string. The shared secret output octet string from X25519 may be used as input Z in the ECIES KDF (Section 3.6.1 of SECG SEC1v2).

[0109] Profile B may use point compression to save overhead, and may use the Elliptic Curve Cofactor Diffie-Hellman primitive (SECTION 3.3.2 of SECG SEC 1v2) to enable future additions to the profile for cofactor h≠1. For curves with cofactor h=1, the two primitives (SECTION 3.3.1 and SECTION 3.3.2 of SECG SEC 1v2) may be equal. The profile may not use backwards compatibility mode (and thus is not compatible with version 1 of SECG).

[0110] Profile A

[0111] ME and SIDF can implement this profile. The ECIES parameters of this profile can be as follows:

[0112]

[0113] Profile B

[0114] ME and SIDF can implement this profile. The ECIES parameters of this profile can be as follows:

[0115]

[0116]

[0117] Although an aspect has been described with reference to specific exemplary aspects, it is apparent that various modifications and changes may be made to these aspects without departing from the broader scope of the present disclosure. Accordingly, the specification and the drawings should be regarded as having illustrative rather than restrictive meanings. The drawings forming part of this document illustrate specific aspects of the practicable subject matter in an illustrative rather than restrictive manner. The aspects shown are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other aspects may be utilized and derived from the present disclosure, so that structural substitutions and logical substitutions and changes may be made without departing from the scope of the present disclosure. Therefore, this specific embodiment is not restrictive, and the scope of each aspect is limited only by the appended claims and the full scope of equivalents to which such claims are authorized.

[0118] The description abstract is provided to comply with 37 CFR § 1.72 (b), which requires the provision of a description abstract that will allow the reader to quickly ascertain the essence of the technical disclosure. The description abstract is provided with the understanding that the technical disclosure will not be used to interpret or limit the scope or meaning of the claims. In addition, in the above-described detailed description, it can be seen that various features are concentrated in a single aspect for the purpose of simplifying the disclosure. The disclosed method should not be interpreted as reflecting the intention that the claimed aspects require more features than those expressly recited in each claim. On the contrary, as reflected in the following claims, the inventive subject matter lies in less than all the features of a single disclosed aspect. Therefore, the following claims are hereby incorporated into the detailed description, with each claim existing independently as a separate aspect.< / mnc> < / mcc> < / guami> < / guami>

Claims

1. A device for user equipment UE, the device comprising: a memory configured to store a security context associated with a serving public land mobile network, PLMN; and A processor, the processor being configured to: Decoding a public key from a serving public land mobile network PLMN; determining whether the security context is stored in the memory; In response to determining that the security context is not stored in the memory, encrypting at least one information element IE using the public key to form at least one encrypted IE; encrypting the UE identifier using another public key different from the public key; encoding an initial non-access stratum NAS message for transmission to the serving PLMN, the initial NAS message comprising the at least one encrypted IE, the at least one encrypted IE comprising UE security capabilities, single network slice selection assistance information S-NSSAI and a key set identifier for a next generation radio access network ngKSI, wherein the entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is a first NAS message sent by the UE after transitioning from an idle state; as well as A radio resource control (RRC) message is encoded for transmission to the serving PLMN, the RRC message including the UE identifier.

2. The apparatus of claim 1, wherein the processor is further configured to: Decoding a system information block SIB from the serving PLMN; and The public key is extracted from the SIB.

3. The apparatus of claim 1, wherein the initial NAS message comprises a plurality of IEs.

4. The apparatus of claim 1 , wherein the at least one encrypted IE comprises a UE identifier and the initial NAS message is a registration request.

5. The device according to claim 1, wherein: The initial NAS message includes at least one of a Nonce including a random number, a timestamp, or a sequence number, and The processor is further configured to periodically change a result of encryption using the public key based on the at least one of the Nonce, the timestamp, or the sequence number.

6. The apparatus of claim 1, wherein the processor is further configured to: encrypting at least one of a UE identifier or network slice selection assistance information NSSAI using the public key; and A radio resource control (RRC) message is encoded for transmission to the serving PLMN, the RRC message including the at least one of the UE identifier or the NSSAI.

7. The device according to claim 1, wherein the processor is further configured to, in response to determining that the security context is stored in the memory, encrypt another IE using an encryption key of the security context, and The initial NAS message includes another encrypted IE.

8. The apparatus of claim 1, wherein the processor is further configured to: detecting a corresponding public key from each of a plurality of neighboring base stations, the neighboring base stations of the serving PLMN using the same public key; comparing the corresponding public keys from the neighboring base stations; and A malicious base station among the plurality of neighboring base stations is detected based on a public key received from the malicious base station that is different from public keys received from other neighboring base stations among the plurality of neighboring base stations.

9. The apparatus of claim 1 , wherein the public key used to encrypt the at least one encrypted IE is independent of which access and mobility function (AMF) of the serving PLMN the UE is to communicate with.

10. A device of an access and mobility function AMF of a public land mobile network PLMN, the device comprising: A processor, the processor being configured to: Encoding a public key of the PLMN for transmission in a system information block SIB or a non-access stratum NAS message; decoding an initial NAS message from the UE, the initial NAS message comprising at least one encrypted information element IE encrypted using the public key, wherein an entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is a first NAS message sent by the UE after transitioning from an idle state, wherein the initial NAS message comprises: an encrypted IE including UE security capabilities, single network slice selection assistance information S-NSSAI, and a key set identifier ngKSI for a next generation radio access network; and decrypting the at least one encrypted IE of the initial NAS message using a private key associated with the public key, wherein a UE identifier is encrypted using another public key different from the public key; and wherein a radio resource control (RRC) message transmitted by the UE includes the UE identifier.

11. The device according to claim 10, wherein: The processor is further configured to decrypt all IEs of the initial NAS message using the private key.

12. The apparatus of claim 10, wherein the at least one encrypted IE comprises a UE identifier.

13. The apparatus of claim 10, wherein the initial NAS message is a registration request.

14. The device according to claim 10, wherein: The initial NAS message includes at least one of a Nonce including a random number, a timestamp, or a sequence number, and the at least one is periodically changed so that a result of encryption using the public key changes periodically.

15. The apparatus of claim 10, wherein the processor is further configured to: periodically replacing the public key with a new public key; and During the transition period between replacements, initial NAS messages encrypted using either the public key or the new public key are accepted.

16. A user equipment UE, comprising: radio; and a processor operably connected to the radio and configured to cause the UE to: Storing a public key from a home public land mobile network PLMN; determining whether to store a security context for the serving PLMN; In response to determining that the security context is not stored, encrypting at least one information element IE using the public key from the home PLMN to form at least one encrypted IE; transmitting an initial non-access stratum NAS message for initial registration with the serving PLMN to the serving PLMN, the initial NAS message comprising the at least one encrypted IE, the at least one encrypted IE comprising UE security capabilities, single network slice selection assistance information S-NSSAI and a key set identifier for a next generation radio access network ngKSI, wherein an entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is a first NAS message sent by the UE after transitioning from an idle state; as well as A radio resource control (RRC) message is transmitted to the serving PLMN, the RRC message including a UE identifier encrypted using another public key different from the public key.

17. The UE according to claim 16, wherein the processor is further configured to cause the UE to: receiving said public key from an Access and Mobility Function (AMF) of said serving PLMN via a Security Mode Command after transmitting said initial NAS message, Determines that a subsequent Initial NAS will be transmitted to the AMF, forming another encrypted IE using the public key from the AMF, and transmitting the subsequent initial NAS including the further encrypted IE to the AMF.

18. The UE of claim 16, wherein the initial NAS message includes at least one of a Nonce including a random number, a timestamp, or a sequence number.

19. A method for a user equipment UE, the method comprising: Decoding a public key from a serving public land mobile network PLMN; determining whether a security context associated with the serving PLMN is stored in a memory included in the UE; In response to determining that the security context is not stored in the memory, encrypting at least one information element IE using the public key to form at least one encrypted IE; encrypting the UE identifier using another public key different from the public key; encoding an initial non-access stratum NAS message for transmission to the serving PLMN, the initial NAS message comprising the at least one encrypted IE, the at least one encrypted IE comprising UE security capabilities, single network slice selection assistance information S-NSSAI and a key set identifier for a next generation radio access network ngKSI, wherein the entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is a first NAS message sent by the UE after transitioning from an idle state; as well as A radio resource control (RRC) message is encoded for transmission to the serving PLMN, the RRC message including the UE identifier.

20. The method according to claim 19, further comprising: Decoding a system information block SIB from the serving PLMN; as well as The public key is extracted from the SIB.

21. The method of claim 19, wherein the initial NAS message comprises a plurality of IEs.

22. The method of claim 19, wherein the at least one encrypted IE comprises a UE identifier and the initial NAS message is a registration request.

23. The method of claim 19, wherein: The initial NAS message includes at least one of a Nonce including a random number, a timestamp, or a sequence number, and The method further includes periodically changing a result of encryption using the public key based on the at least one of the Nonce, the timestamp, or the sequence number.

24. The method of claim 19, further comprising: encrypting at least one of a UE identifier or network slice selection assistance information NSSAI using the public key; as well as A radio resource control (RRC) message is encoded for transmission to the serving PLMN, the RRC message including the at least one of the UE identifier or the NSSAI.

25. The method according to claim 19, The method further comprises, in response to determining that the security context is stored in the memory, encrypting another IE using an encryption key of the security context, and the initial NAS message includes the another encrypted IE.

26. The method of claim 19, further comprising: detecting a corresponding public key from each of a plurality of neighboring base stations, the neighboring base stations of the serving PLMN using the same public key; comparing the corresponding public keys from the neighboring base stations; as well as A malicious base station among the plurality of neighboring base stations is detected based on a public key received from the malicious base station that is different from public keys received from other neighboring base stations among the plurality of neighboring base stations.

27. The method of claim 19, wherein the public key used to encrypt the at least one encrypted IE is independent of which access and mobility function (AMF) of the serving PLMN the UE is to communicate with.

28. A method of an access and mobility function (AMF) of a public land mobile network (PLMN), the method comprising: Encoding a public key of the PLMN for transmission in a system information block SIB or a non-access stratum NAS message; decoding an initial NAS message from the UE, the initial NAS message comprising at least one encrypted information element IE encrypted using the public key, wherein an entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is a first NAS message sent by the UE after transitioning from an idle state, wherein the initial NAS message comprises: an encrypted IE including UE security capabilities, single network slice selection assistance information S-NSSAI, and a key set identifier ngKSI for a next generation radio access network; and decrypting the at least one encrypted IE of the initial NAS message using a private key associated with the public key, wherein a UE identifier is encrypted using another public key different from the public key; and wherein a radio resource control (RRC) message transmitted by the UE includes the UE identifier.

29. The method according to claim 28, further comprising: All IEs of the initial NAS message are decrypted using the private key.

30. The method of claim 28, wherein the at least one encrypted IE comprises a UE identifier.

31. The method of claim 28, wherein the initial NAS message is a registration request.

32. The method of claim 28, wherein: The initial NAS message includes at least one of a Nonce including a random number, a timestamp, or a sequence number, and the at least one is periodically changed so that a result of encryption using the public key changes periodically.

33. The method of claim 28, further comprising: periodically replacing the public key with a new public key; as well as During the transition period between replacements, initial NAS messages encrypted using either the public key or the new public key are accepted.

34. A method for a user equipment UE, comprising: Storing a public key from a home public land mobile network PLMN; determining whether to store a security context for the serving PLMN; In response to determining that the security context is not stored, encrypting at least one information element IE using the public key from the home PLMN to form at least one encrypted IE; transmitting an initial non-access stratum NAS message for initial registration with the serving PLMN to the serving PLMN, the initial NAS message comprising the at least one encrypted IE, the at least one encrypted IE comprising UE security capabilities, single network slice selection assistance information S-NSSAI and a key set identifier for a next generation radio access network ngKSI, wherein an entire NAS message payload of the initial NAS message is encrypted using the public key, wherein the initial NAS message is a first NAS message sent by the UE after transitioning from an idle state; as well as A radio resource control (RRC) message is transmitted to the serving PLMN, the RRC message including a UE identifier encrypted using another public key different from the public key.

35. The method of claim 34, further comprising: receiving said public key from an Access and Mobility Function (AMF) of said serving PLMN via a Security Mode Command after transmitting said initial NAS message, Determines that a subsequent Initial NAS will be transmitted to the AMF, forming another encrypted IE using the public key from the AMF, and transmitting the subsequent initial NAS including the further encrypted IE to the AMF.

36. The method of claim 34, wherein the initial NAS message includes at least one of a Nonce including a random number, a timestamp, or a sequence number.

37. A computer-readable storage medium storing a computer program comprising instructions which, when executed by one or more processors, cause an apparatus to perform a method according to any one of claims 19-36.

38. A computer program product comprising a computer program, the computer program comprising instructions which, when executed by one or more processors, cause an apparatus to perform a method according to any one of claims 19 to 36.

Images