Media Access Control Security

Abstract

Various aspects of the present disclosure generally relate to wireless communications. In some aspects, a user equipment (UE) may transmit information indicating a medium access control (MAC) security capability of the UE to a base station (BS). The UE may receive from the BS a communication including an indication of a MAC security configuration for communications between the UE and the BS. The indication of the MAC security configuration may be based at least in part on the MAC security capability of the UE. Numerous other aspects are provided.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Patent Application No. 62 / 794,454, entitled “MEDIUM ACCESS CONTROL SECURITY,” filed on January 18, 2019, and U.S. Non-Provisional Patent Application No. 16 / 734,009, entitled “MEDIUM ACCESS CONTROL SECURITY,” filed on January 3, 2020, which are hereby expressly incorporated herein by reference.

[0003] Public domain

[0004] Aspects of the present disclosure relate generally to wireless communications, and to techniques and apparatuses for medium access control (MAC) security.

[0005] background

[0006] Wireless communication systems are widely deployed to provide various telecommunication services such as telephony, video, data, messaging, and broadcasting. Typical wireless communication systems may employ multiple access technologies that can support communication with multiple users by sharing available system resources (e.g., bandwidth, transmit power, etc.). Examples of such multiple access technologies include code division multiple access (CDMA) systems, time division multiple access (TDMA) systems, frequency division multiple access (FDMA) systems, orthogonal frequency division multiple access (OFDMA) systems, single carrier frequency division multiple access (SC-FDMA) systems, time division synchronous code division multiple access (TD-SCDMA) systems, and long term evolution (LTE). LTE / LTE-Advanced is a set of enhancements to the Universal Mobile Telecommunications System (UMTS) mobile standard promulgated by the Third Generation Partnership Project (3GPP).

[0007] A wireless communication network may include several base stations (BS) that can support communication of several user equipments (UEs). User equipments (UEs) may communicate with base stations (BSs) via downlinks and uplinks. Downlinks (or forward links) refer to the communication link from a BS to a UE, while uplinks (or reverse links) refer to the communication link from a UE to a BS. As will be described in more detail herein, a BS may be referred to as a Node B, gNB, Access Point (AP), Radio Head, Transmit Receiving Point (TRP), New Radio (NR) BS, 5G Node B, and the like.

[0008] The above multiple access technologies have been adopted in various telecommunication standards to provide a common protocol that enables different user equipment to communicate at city, country, region, and even global levels. New Radio (NR) (which may also be referred to as 5G) is an enhancement set to the LTE mobile standard promulgated by the Third Generation Partnership Project (3GPP). NR is designed to better support mobile broadband Internet access by improving spectrum efficiency, reducing costs, improving services, utilizing new spectrum, and using orthogonal frequency division multiplexing (OFDM) (CP-OFDM) with cyclic prefix (CP) on the downlink (DL), using CP-OFDM and / or SC-FDM (e.g., also referred to as discrete Fourier transform spread OFDM (DFT-s-OFDM) on the uplink (UL), and supporting beamforming, multiple-input multiple-output (MIMO) antenna technology, and carrier aggregation. Other open standards are better integrated to better support mobile broadband Internet access.

[0009] Overview

[0010] In some aspects, a wireless communication method performed by a user equipment (UE) may include transmitting information indicating a medium access control (MAC) security capability of the UE to a base station (BS). The method may include receiving a communication from the BS including an indication of a MAC security configuration for communications between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on the MAC security capability of the UE.

[0011] In some aspects, a UE for wireless communication may include a memory and one or more processors operatively coupled to the memory. The memory and the one or more processors may be configured to transmit information indicating MAC security capabilities of the UE to a BS. The memory and the one or more processors may be configured to receive, from the BS, a communication including an indication of a MAC security configuration for communication between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on the MAC security capabilities of the UE.

[0012] In some aspects, a non-transitory computer-readable medium may store one or more instructions for wireless communication. The one or more instructions, when executed by one or more processors of a UE, may cause the one or more processors to transmit information indicating MAC security capabilities of the UE to a BS. The one or more instructions, when executed by one or more processors of the UE, may cause the one or more processors to receive, from the BS, a communication including an indication of a MAC security configuration for communication between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on the MAC security capabilities of the UE.

[0013] In some aspects, an apparatus for wireless communications may include means for transmitting information indicating MAC security capabilities of the apparatus to a BS. The apparatus may include means for receiving, from the BS, a communication including an indication of a MAC security configuration for communications between the apparatus and the BS, wherein the indication of the MAC security configuration is based at least in part on the MAC security capabilities of the apparatus.

[0014] In some aspects, a wireless communication method performed by a BS may include receiving information indicating MAC security capabilities of the UE from a UE. The method may include transmitting a communication to the UE including an indication of a MAC security configuration for communications between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on the MAC security capabilities of the UE.

[0015] In some aspects, a base station for wireless communication may include a memory and one or more processors operatively coupled to the memory. The memory and the one or more processors may be configured to receive information indicating a MAC security capability of the UE from a UE. The memory and the one or more processors may be configured to transmit to the UE a communication including an indication of a MAC security configuration for communication between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on the MAC security capability of the UE.

[0016] In some aspects, a non-transitory computer-readable medium may store one or more instructions for wireless communication. The one or more instructions, when executed by one or more processors of a base station, may cause the one or more processors to receive information indicating MAC security capabilities of the UE from a UE. The one or more instructions, when executed by one or more processors of the base station, may cause the one or more processors to transmit to the UE a communication including an indication of a MAC security configuration for communication between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on the MAC security capabilities of the UE.

[0017] In some aspects, an apparatus for wireless communication may include means for receiving information indicating MAC security capabilities of the UE from a UE. The apparatus may include means for transmitting to the UE a communication including an indication of a MAC security configuration for communications between the UE and the apparatus, wherein the indication of the MAC security configuration is based at least in part on the MAC security capabilities of the UE.

[0018] Aspects generally include methods, apparatuses, systems, computer program products, non-transitory computer-readable media, user equipment, base stations, wireless communication devices, and processing systems substantially as described herein with reference to and as illustrated in the accompanying drawings.

[0019] The foregoing has broadly outlined the features and technical advantages of examples according to the present disclosure in an effort to make the following detailed description better understood. Additional features and advantages will be described hereinafter. The disclosed concepts and specific examples can be easily used as a basis for modifying or designing other structures for implementing the same purpose as the present disclosure. Such equivalent constructions do not depart from the scope of the appended claims. The characteristics of the concepts disclosed herein, both in terms of their organization and method of operation, and the associated advantages will be better understood by considering the following description in conjunction with the accompanying drawings. Each of the accompanying drawings is provided for the purpose of illustration and description and is not intended to define limitations on the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to understand the above-stated features of the present disclosure in detail, the above briefly summarized content may be described in more detail with reference to various aspects, some of which are illustrated in the accompanying drawings. However, it should be noted that the accompanying drawings only illustrate certain typical aspects of the present disclosure and should not be considered to limit its scope, as the description may allow for other equally effective aspects. The same reference numerals in different drawings may identify the same or similar elements.

[0022] Figure 1 is a block diagram conceptually illustrating an example of a wireless communication network in accordance with various aspects of the present disclosure.

[0023] Figure 2 is a block diagram conceptually illustrating an example of a base station and a UE in communication in a wireless communication network according to various aspects of the present disclosure.

[0024] Figure 3 An example logical architecture of a distributed radio access network (RAN) in accordance with various aspects of the present disclosure is illustrated.

[0025] Figure 4 An example physical architecture of a distributed RAN in accordance with various aspects of the present disclosure is illustrated.

[0026] Figures 5A-5F is a diagram illustrating an example of MAC security according to various aspects of the present disclosure.

[0027] Figure 6 is a diagram illustrating example processes performed, for example, by a UE according to various aspects of the present disclosure.

[0028] Figure 7 is a diagram illustrating example processes performed, for example, by a BS according to various aspects of the present disclosure.

[0029] Detailed Description

[0030] In a wireless network, a BS and a UE may communicate using various protocol layers, such as a packet data convergence protocol (PDCP) layer, a radio link control (RLC) layer, a medium access control (MAC) layer, and the like. In some cases, various techniques may be used to protect certain protocol layers, such as a PDCP layer (which may be used for control plane signaling and user plane data). However, some layers, such as a MAC layer, may not be protected by security. Since the MAC layer may carry performance-critical information, such as buffer status reports, timing advance information, transmission configuration indication (TCI) status information, and the like, the lack of MAC layer security may make the MAC layer vulnerable to attacks (e.g., denial of service (DoS) attacks, man-in-the-middle attacks, and / or other types of attacks). As a result, a malicious entity may be allowed to change buffer status report information (which may result in performance degradation in resource scheduling), timing advance information (which may result in desynchronization between the UE and the BS), TCI status information (which may result in beam and / or precoding mismatches between the UE and the BS), and the like.

[0031] Some aspects described herein provide techniques and devices for MAC security. In some aspects, the UE may transmit an indication of MAC security capabilities to the BS. The BS may transmit an indication of a MAC security configuration for communication between the UE and the BS to the UE. The MAC security configuration may be based at least in part on the MAC security capabilities of the UE, and may indicate the MAC security level to be used when encrypting, decrypting and / or integrity protecting a MAC protocol data unit (PDU) transmitted between the UE and the BS. Moreover, the UE and the BS may generate various keys that may be used when encrypting, decrypting and / or integrity protecting a MAC PDU transmitted between the UE and the BS. In this way, the UE and the BS may implement MAC security for a MAC PDU transmitted between the UE and the BS, which increases the security of the MAC PDU, prevents performance degradation and attacks on the MAC PDU, and the like.

[0032] The various aspects of the present disclosure are described more fully below with reference to the accompanying drawings. However, the present disclosure can be implemented in many different forms and should not be interpreted as being limited to any specific structure or function given throughout the present disclosure. Specifically, these aspects are provided to make the present disclosure thorough and complete, and it will fully convey the scope of the present disclosure to those skilled in the art. Based on the teachings herein, those skilled in the art will appreciate that the scope of the present disclosure is intended to cover any aspect of the present disclosure disclosed herein, whether it is independently or in combination with any other aspect of the present disclosure. For example, any number of aspects set forth herein can be used to implement a device or practice method. In addition, the scope of the present disclosure is intended to cover such devices or methods practiced using supplements or other other structures, functionality, or structures and functionality as the various aspects of the present disclosure set forth herein. It should be understood that any aspect of the present disclosure disclosed herein can be implemented by one or more elements of the claims.

[0033] Several aspects of telecommunication systems will now be presented with reference to various devices and techniques. These devices and techniques will be described in the following detailed description and illustrated in the accompanying drawings by various blocks, modules, components, circuits, steps, processes, algorithms, etc. (collectively referred to as "elements"). These elements can be implemented using hardware, software, or a combination thereof. Whether such elements are implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system.

[0034] It should be noted that although various aspects may be described herein using terminology typically associated with 3G and / or 4G wireless technologies, various aspects of the present disclosure may be applied in communication systems based on other generations, such as 5G and later generations, including NR technologies.

[0035] Figure 1 1 is a diagram illustrating a wireless network 100 in which various aspects of the present disclosure may be practiced. The wireless network 100 may be an LTE network or some other wireless network, such as a 5G or NR network. The wireless network 100 may include several BSs 110 (shown as BS 110a, BS 110b, BS 110c, and BS 110d) and other network entities. A BS is an entity that communicates with a user equipment (UE) and may also be referred to as a base station, NR BS, B node, gNB, 5G B node (NB), access point, transmit receive point (TRP), etc. Each BS may provide communication coverage for a particular geographic area. In 3GPP, the term "cell" may refer to a coverage area of ​​a BS and / or a BS subsystem serving the coverage area, depending on the context in which the term is used.

[0036] A BS may provide communication coverage for a macro cell, a pico cell, a femto cell, and / or another type of cell. A macro cell may cover a relatively large geographic area (e.g., several kilometers in radius) and may allow unrestricted access by UEs with service subscriptions. A pico cell may cover a relatively small geographic area and may allow unrestricted access by UEs with service subscriptions. A femto cell may cover a relatively small geographic area (e.g., a residence) and may allow restricted access by UEs associated with the femto cell (e.g., UEs in a closed subscriber group (CSG)). A BS for a macro cell may be referred to as a macro BS. A BS for a pico cell may be referred to as a pico BS. A BS for a femto cell may be referred to as a femto BS or a home BS. In Figure 1 , BS 110a may be a macro BS for macro cell 102a, BS 110b may be a pico BS for pico cell 102b, and BS 110c may be a femto BS for femto cell 102c. The BS may support one or more (e.g., three) cells. The terms “eNB,” “base station,” “NR BS,” “gNB,” “TRP,” “AP,” “Node B,” “5G NB,” and “cell” may be used interchangeably herein.

[0037] In some examples, the cell may not necessarily be stationary, and the geographic area of ​​the cell may move depending on the location of the mobile BS. In some examples, the BSs may be interconnected to each other and / or to one or more other BSs or network nodes (not shown) in the wireless network 100 via various types of backhaul interfaces, such as direct physical connections, virtual networks, and / or the like using any suitable transport network.

[0038] The wireless network 100 may also include a relay station. A relay station is an entity that can receive transmissions of data from an upstream station (e.g., a BS or a UE) and send transmissions of the data to a downstream station (e.g., a UE or a BS). A relay station may also be a UE that can relay transmissions for other UEs. Figure 1 In the example shown in , a relay station 110d may communicate with a macro BS 110a and a UE 120d to facilitate communication between the BS 110a and the UE 120d. A relay station may also be referred to as a relay BS, a relay base station, a relay, or the like.

[0039] The wireless network 100 may be a heterogeneous network including different types of BSs, such as macro BSs, pico BSs, femto BSs, relay BSs, etc. These different types of BSs may have different transmit power levels, different coverage areas, and different effects on interference in the wireless network 100. For example, a macro BS may have a high transmit power level (e.g., 5 to 40 watts), while a pico BS, a femto BS, and a relay BS may have a lower transmit power level (e.g., 0.1 to 2 watts).

[0040] A network controller 130 may be coupled to a set of BSs and may provide coordination and control of these BSs. The network controller 130 may communicate with each BS via a backhaul. The BSs may also communicate with each other directly or indirectly, for example, via a wireless or wired backhaul.

[0041] UE 120 (e.g., 120a, 120b, 120c) may be dispersed throughout the wireless network 100, and each UE may be stationary or mobile. UE may also be referred to as an access terminal, terminal, mobile station, subscriber unit, station, etc. UE may be a cellular phone (e.g., a smart phone), a personal digital assistant (PDA), a wireless modem, a wireless communication device, a handheld device, a laptop computer, a cordless phone, a wireless local loop (WLL) station, a tablet, a camera, a gaming device, a netbook, a smartbook, an ultrabook, a medical device or equipment, a biometric sensor / device, a wearable device (smart watch, smart clothing, smart glasses, smart wristband, smart jewelry (e.g., smart ring, smart bracelet)), an entertainment device (e.g., a music or video device, or a satellite radio), a vehicle component or sensor, a smart meter / sensor, an industrial manufacturing equipment, a global positioning system device, or any other suitable device configured to communicate via a wireless or wired medium.

[0042] Some UEs may be considered as machine type communication (MTC) UEs, or evolved or enhanced machine type communication (eMTC) UEs. MTC and eMTC UEs include, for example, robots, drones, remote devices, sensors, meters, monitors, location tags, etc., which may communicate with a base station, another device (e.g., a remote device), or some other entity. A wireless node may provide connectivity to or to a network (e.g., a wide area network (such as the Internet) or a cellular network), for example, via a wired or wireless communication link. Some UEs may be considered as Internet of Things (IoT) devices, and / or may be implemented as NB-IoT (narrowband Internet of Things) devices. Some UEs may be considered as client equipment (CPE). UE 120 may be included inside a housing that houses components of UE 120, such as a processor component, a memory component, and the like.

[0043] In general, any number of wireless networks may be deployed in a given geographic area. Each wireless network may support a specific RAT and may operate on one or more frequencies. RAT may also be referred to as radio technology, air interface, etc. Frequency may also be referred to as carrier, frequency channel, etc. Each frequency may support a single RAT in a given geographic area to avoid interference between wireless networks of different RATs. In some cases, NR or 5G RAT networks may be deployed.

[0044] In some examples, access to the air interface may be scheduled, wherein a scheduling entity (e.g., a base station) allocates resources for communication among some or all devices and equipment within a service area or cell of the scheduling entity. Within the present disclosure, as discussed further below, a scheduling entity may be responsible for scheduling, assigning, reconfiguring, and releasing resources for one or more subordinate entities. That is, for scheduled communications, the subordinate entities utilize resources allocated by the scheduling entity.

[0045] The base station is not the only entity that can be used as a scheduling entity. That is, in some examples, a UE can be used as a scheduling entity, thereby scheduling resources for one or more subordinate entities (e.g., one or more other UEs). In this example, the UE is acting as a scheduling entity, and other UEs use the resources scheduled by the UE for wireless communication. The UE can be used as a scheduling entity in a peer-to-peer (P2P) network and / or in a mesh network. In the mesh network example, the UEs can optionally communicate directly with each other in addition to communicating with the scheduling entity.

[0046] Thus, in a wireless communication network having scheduled access to time-frequency resources and having a cellular configuration, a P2P configuration, and a mesh configuration, a scheduling entity and one or more subordinate entities may communicate using the scheduled resources.

[0047] In some aspects, two or more UEs 120 (e.g., shown as UE 120a and UE 120e) may communicate directly (e.g., without using base station 110 as an intermediary to communicate with each other) using one or more sidelink channels. For example, UE 120 may communicate using peer-to-peer (P2P) communication, device-to-device (D2D) communication, vehicle-to-everything (V2X) protocols (e.g., which may include vehicle-to-vehicle (V2V) protocols, vehicle-to-infrastructure (V2I) protocols, etc.), mesh networks, etc. In this case, UE 120 may perform scheduling operations, resource selection operations, and / or other operations described elsewhere herein as being performed by base station 110.

[0048] As indicated above, Figure 1 These are provided as examples only. Other examples may differ from those described herein. Figure 1 The content described.

[0049] Figure 2 A block diagram of a design 200 of a base station 110 and a UE 120 is shown, which may be Figure 1 One for each base station and one for each UE in the base station 110. Base station 110 may be equipped with T antennas 234a through 234t, and UE 120 may be equipped with R antennas 252a through 252r, where in general T≧1 and R≧1.

[0050] At the base station 110, the transmit processor 220 may receive data for one or more UEs from the data source 212, select one or more modulation and coding schemes (MCS) for each UE based at least in part on a channel quality indicator (CQI) received from the UE, process (e.g., encode and modulate) the data for each UE based at least in part on the MCS selected for the UE, and provide data symbols for all UEs. The transmit processor 220 may also process system information (e.g., for semi-static resource partitioning information (SRPI), etc.) and control information (e.g., CQI requests, grants, upper layer signaling, etc.), and provide overhead symbols and control symbols. The transmit processor 220 may also generate reference symbols for reference signals (e.g., cell-specific reference signals (CRS)) and synchronization signals (e.g., primary synchronization signals (PSS) and secondary synchronization signals (SSS)). The transmit (TX) multiple-input multiple-output (MIMO) processor 230 may perform spatial processing (e.g., precoding) on ​​data symbols, control symbols, overhead symbols, and / or reference symbols, where applicable, and may provide T output symbol streams to T modulators (MOD) 232a to 232t. Each modulator 232 may process a respective output symbol stream (e.g., for OFDM, etc.) to obtain an output sample stream. Each modulator 232 may further process (e.g., convert to analog, amplify, filter, and up-convert) the output sample stream to obtain a downlink signal. The T downlink signals from modulators 232a to 232t may be transmitted via T antennas 234a to 234t, respectively. According to various aspects described in more detail below, position coding may be used to generate synchronization signals to convey additional information.

[0051] At UE 120, antennas 252a to 252r may receive downlink signals from base station 110 and / or other base stations and may provide received signals to demodulators (DEMODs) 254a to 254r, respectively. Each demodulator 254 may condition (e.g., filter, amplify, downconvert, and digitize) the received signal to obtain input samples. Each demodulator 254 may further process the input samples (e.g., for OFDM, etc.) to obtain received symbols. A MIMO detector 256 may obtain received symbols from all R demodulators 254a to 254r, perform MIMO detection on the received symbols where applicable, and provide detected symbols. A receive processor 258 may process (e.g., demodulate and decode) the detected symbols, provide decoded data for UE 120 to a data sink 260, and provide decoded control information and system information to a controller / processor 280. The channel processor may determine reference signal received power (RSRP), received signal strength indicator (RSSI), reference signal received quality (RSRQ), channel quality indicator (CQI), etc. In some aspects, one or more components of UE 120 may be included in a housing.

[0052] On the uplink, at the UE 120, a transmit processor 264 may receive and process data from a data source 262 and control information from a controller / processor 280 (e.g., for reports including RSRP, RSSI, RSRQ, CQI, etc.). The transmit processor 264 may also generate reference symbols for one or more reference signals. The symbols from the transmit processor 264 may be precoded by a TX MIMO processor 266, if applicable, further processed by modulators 254a through 254r (e.g., for DFT-s-OFDM, CP-OFDM, etc.), and transmitted to the base station 110. At the base station 110, uplink signals from the UE 120 as well as other UEs may be received by the antenna 234, processed by the demodulator 232, detected by the MIMO detector 236, if applicable, and further processed by the receive processor 238 to obtain decoded data and control information sent by the UE 120. The receive processor 238 may provide decoded data to a data sink 239 and decoded control information to a controller / processor 240. The base station 110 may include a communication unit 244 and communicate with the network controller 130 via the communication unit 244. The network controller 130 may include a communication unit 294, a controller / processor 290, and a memory 292.

[0053] The controller / processor 240 of the base station 110, the controller / processor 280 of the UE 120, and / or Figure 2Any other component(s) of the UE 120 may perform one or more techniques associated with MAC security, as described in more detail elsewhere herein. For example, the controller / processor 240 of the base station 110, the controller / processor 280 of the UE 120, and / or Figure 2 Any other component(s) may perform or direct e.g. Figure 6 The process of 600 Figure 7 The operations of process 700, and / or other processes as described herein. Memories 242 and 282 may store data and program codes for base station 110 and UE 120, respectively. Scheduler 246 may schedule UEs for data transmission on the downlink and / or uplink.

[0054] The stored program code, when executed by the processor 280 and / or other processors and modules at the UE 120, may cause the UE 120 to perform operations related to Figure 6 The stored program code, when executed by the processor 240 and / or other processors and modules at the base station 110, may cause the base station 110 to perform operations related to Figure 7 The operations described in process 700 and / or other processes described herein. The scheduler 246 may schedule UEs for data transmission on the downlink and / or uplink.

[0055] In some aspects, UE 120 may include: means for transmitting information indicating MAC security capabilities of UE 120 to BS 110; means for receiving, from BS 110, a communication including an indication of a MAC security configuration for communications between UE 120 and BS 110, wherein the indication of the MAC security configuration is based at least in part on the MAC security capabilities of UE 120; and the like. In some aspects, such means may include in conjunction with Figure 2 One or more components of UE 120 are described.

[0056] In some aspects, base station 110 may include: means for receiving information indicating MAC security capabilities of UE 120 from UE 120; means for transmitting to UE 120 a communication including an indication of a MAC security configuration for communications between UE 120 and BS 110, wherein the indication of the MAC security configuration is based at least in part on the MAC security capabilities of UE 120; and so on. In some aspects, such means may include in conjunction with Figure 2 One or more components of base station 110 are described.

[0057] although Figure 2The blocks in the 200 and 210 are illustrated as different components, but the functions described above with respect to these blocks may be implemented with a single hardware, software, or combined component or various combinations of components. For example, the functions described with respect to the transmit processor 264, the receive processor 258, and / or the TX MIMO processor 266 may be performed by the processor 280 or under the control of the processor 280.

[0058] As indicated above, Figure 2 These are provided as examples only. Other examples may differ from those described herein. Figure 2 The content described.

[0059] Figure 3 An example logical architecture of a distributed RAN 300 according to various aspects of the present disclosure is illustrated. A 5G access node 306 may include an access node controller (ANC) 302. The ANC may be a central unit (CU) of the distributed RAN 300. A backhaul interface to a next generation core network (NG-CN) 304 may terminate at the ANC. A backhaul interface to an adjacent next generation access node (NG-AN) may terminate at the ANC. The ANC may include one or more TRPs 308 (which may also be referred to as a BS, NR BS, B node, 5G NB, AP, gNB, or some other term). As described above, a TRP may be used interchangeably with a "cell".

[0060] The TRP 308 may be a distributed unit (DU). The TRP may be connected to one ANC (ANC 302) or more than one ANC (not illustrated). For example, for RAN sharing, Radio as a Service (RaaS), and service-specific AND deployments, the TRP may be connected to more than one ANC. The TRP may include one or more antenna ports. The TRP may be configured to serve traffic to the UE individually (e.g., dynamically selected) or jointly (e.g., jointly transmitted).

[0061] The fronthaul definition may be illustrated using the local architecture of the RAN 300. The architecture may be defined to support fronthaul solutions across different deployment types. For example, the architecture may be based at least in part on transport network capabilities (e.g., bandwidth, latency, and / or jitter).

[0062] The architecture may share features and / or components with LTE. According to various aspects, the next generation AN (NG-AN) 310 may support dual connectivity with NR. For LTE and NR, the NG-AN may share a common fronthaul.

[0063] The architecture may enable collaboration between and among TRPs 308. For example, collaboration may be provisioned within a TRP and / or across TRPs via ANC 302. According to various aspects, an inter-TRP interface may not be required / present.

[0064] According to various aspects, there may be a dynamic configuration of split logical functions within the architecture of the RAN 300. Packet Data Convergence Protocol (PDCP), Radio Link Control (RLC), Medium Access Control (MAC) protocols may be adaptively placed at the ANC or TRP.

[0065] According to various aspects, a BS may include a central unit (CU) (e.g., ANC 302) and / or one or more distributed units (e.g., one or more TRPs 308). In some aspects, a CU of a BS may generate BS keys for various security implementations associated with the BS. Various security implementations may include encryption / decryption, integrity protection, and the like. In some aspects, a CU may generate one or more other keys based at least in part on the BS keys, such as one or more keys for radio resource control (RRC) security at a CU and / or DU associated with the BS, one or more keys for user plane (UP) security at a CU and / or DU associated with the BS, one or more keys for MAC security at a CU and / or DU associated with the BS, and the like. In some aspects, a CU and / or DU may use one or more keys generated at least in part based on the BS keys to encrypt and decrypt communications with a UE, integrity protect communications with the UE, and the like.

[0066] As indicated above, Figure 3 These are provided as examples only. Other examples may differ from those described herein. Figure 3 The content described.

[0067] Figure 4 An example physical architecture of a distributed RAN 400 according to aspects of the present disclosure is illustrated. A centralized core network unit (C-CU) 402 may host core network functions. The C-CU may be centrally deployed. C-CU functionality may be offloaded (e.g., to Advanced Wireless Services (AWS)) in an effort to handle peak capacity.

[0068] A centralized RAN unit (C-RU) 404 may host one or more ANC functions. Optionally, the C-RU may host core network functions locally. The C-RU may have a distributed deployment. The C-RU may be closer to the network edge.

[0069] A distributed unit (DU) 406 may host one or more TRPs. A DU may be located at the edge of the network with radio frequency (RF) functionality.

[0070] As above Figure 3 As indicated in , the BS may include a central unit (CU) (e.g., C-CU 402) and / or one or more distributed units (e.g., one or more DUs 406). In some aspects, the C-CU 402 of the BS may generate BS keys for various security implementations associated with the BS. The various security implementations may include encryption / decryption, integrity protection, and the like. In some aspects, the C-CU 402 may generate one or more other keys based at least in part on the BS keys, such as one or more keys for radio resource control (RRC) security at the C-CU 402 and / or DU 406 associated with the BS, one or more keys for user plane (UP) security at the C-CU 402 and / or DU 406 associated with the BS, one or more keys for MAC security at the C-CU 402 and / or DU 406 associated with the BS, and the like. In some aspects, the C-CU 402 and / or DU 406 may use one or more keys generated at least in part based on the BS keys to encrypt and decrypt communications with the UE, integrity protect communications with the UE, and the like.

[0071] As indicated above, Figure 4 These are provided as examples only. Other examples may differ from those described herein. Figure 4 The content described.

[0072] Figures 5A-5F is a diagram illustrating an example 500 of MAC security in accordance with various aspects of the present disclosure. Figures 5A-5F As shown in , example 500 may include BS 110 and UE 120. In some aspects, BS 110 and UE 120 may be included in a wireless network (e.g., wireless network 100). In some aspects, BS 110 may include a CU (e.g., C-CU 402 or another type of CU) and one or more DUs (e.g., DU 406).

[0073] like Figure 5A1 and indicated by reference numeral 502, to initiate MAC security between BS 110 and UE 120, UE 120 may transmit information indicating MAC security capabilities of UE 120 to BS 110. In some aspects, UE 120 may transmit information indicating MAC security capabilities of UE 120 based at least in part on being communicatively connected with BS 110, based at least in part on being handed over to BS 110, and the like. In some aspects, the information indicating MAC security capabilities of the UE may include information identifying whether UE 120 is capable of implementing MAC security at a MAC protocol data unit (PDU) level, at a MAC sub-PDU type level, at an individual MAC-control element (MAC-CE) level, and the like.

[0074] In some aspects, a MAC PDU may include multiple MAC sub-PDUs. A subset of the multiple MAC sub-PDUs may include a MAC-CE, while other MAC sub-PDUs in the multiple MAC sub-PDUs may include a MAC service data unit (SDU) or padding (e.g., bits added to the MAC PDU to align the size of the MAC PDU with an expected transport block size (TBS) of the MAC PDU).

[0075] In some aspects, the MAC PDU level of MAC security may include the ability to secure the entire MAC PDU or not secure the entire MAC PDU. In this case, the UE 120 is either able to secure all MAC sub-PDUs or is unable to secure any MAC sub-PDU in the MAC PDU. In some aspects, the MAC sub-PDU type level of MAC security may include the ability to selectively secure certain types of MAC sub-PDUs included in the MAC PDU, which reduces the overhead of applying MAC security to the MAC PDU. For example, the UE 120 may be able to selectively secure only the MAC sub-PDU that includes the MAC-CE. In some aspects, the MAC-CE level of MAC security may include the ability to selectively secure specific MAC-CEs, which further reduces the overhead of applying MAC security to the MAC PDU while increasing the flexibility of applying MAC security to the MAC PDU.

[0076] like Figure 5A10 and further indicated by reference numeral 504, BS 110 may transmit to UE 120 an indication of a MAC security configuration for communications between UE 120 and BS 110. In some aspects, BS 110 may transmit the indication of the MAC security configuration based at least in part on receiving an indication of a MAC security capability of UE 120, based at least in part on a handover of UE 120 being initiated, and the like. In some aspects, the handover may include an intra-BS handover, such as a handover between a first DU of BS 110 and a second DU of BS 110. In some aspects, the handover may include an inter-BS handover (which may also be referred to as an Xn-based handover), such as a handover between another BS and BS 110, a handover between a DU of another BS to a DU of BS 110, and the like. In some aspects, BS 110 may transmit the indication of the MAC security configuration in an RRC reconfiguration communication and / or another type of signaling communication.

[0077] In some aspects, the indication of the MAC security configuration may indicate a MAC security level to be applied to MAC PDUs transmitted between the UE 120 and the BS 110. For example, the indication of the MAC security configuration may indicate that a MAC PDU level of MAC security is to be applied to MAC PDUs transmitted between the UE 120 and the BS 110, may indicate that a MAC sub-PDU type level of MAC security is to be applied to MAC PDUs transmitted between the UE 120 and the BS 110, or may indicate that a MAC-CE level of MAC security is to be applied to MAC PDUs transmitted between the UE 120 and the BS 110.

[0078] In some aspects, the indication of the MAC security configuration may be based at least in part on the MAC security capabilities of UE 120. For example, BS 110 may configure the indication of the MAC security configuration to match the MAC security capabilities of UE 120. In this manner, BS 110 may configure the indication of the MAC security configuration such that the MAC security configuration is compatible with the MAC security capabilities of UE 120. In some aspects, the indication of the MAC security configuration may be based at least in part on other factors such as available bandwidth on a connection between UE 120 and BS 110, based at least in part on the type of information conveyed in a particular MAC PDU, based at least in part on BS 110 being configured to pick a highest or lowest MAC security level that UE 120 can support, and / or other factors.

[0079] like Figure 5B, and indicated by reference numeral 506, UE 120 and BS 110 may generate one or more keys. In some aspects, BS 110 may generate the one or more keys based at least in part on receiving an indication of MAC security capabilities of UE 120, based at least in part on a handover of UE 120 being initiated, etc. In some aspects, UE 120 may generate the one or more keys based at least in part on receiving an indication to generate one or more keys (e.g., in an RRC reconfiguration communication including an indication of a MAC security configuration), based at least in part on a handover of UE 120 being initiated, etc.

[0080] Figure 5C-5E Various key structures of one or more keys that may be generated by UE 120 and BS 110 are illustrated. Figure 5C-5E As shown, UE 120 and BS 110 may generate a BS key (K BS ), one or more key sets associated with the CU of BS 110, one or more keys associated with the DU of BS 110, and so on.

[0081] like Figure 5C As shown, if RRC communication is initiated and terminated at a CU of BS 110, the one or more key sets associated with the CU may include an RRC key set and a UP key set. The RRC key set may include an RRC encryption key (K RRCEnc ) and the RRC integrity key (K RRCInt ). RRCEnc can be used to encrypt and decrypt RRC communications between BS 110 and UE 120, and K RRCInt The UP key set may be used to perform integrity protection on the RRC communication between the BS 110 and the UE 120. UPEnc ) and the UP integrity key (K UPInt ). UPEnc can be used to encrypt and decrypt UP communications between BS 110 and UE 120, and K UPInt It can be used to perform integrity protection on UP communications between BS 110 and UE 120.

[0082] like Figure 5C As further shown in FIG. 1 , if the RRC communication is initiated and terminated at the CU of the BS 110, the one or more key sets associated with the DU may include a DU key (K DU ) and multiple MAC security keys. UE 120 and BS 110 may determine the identity of the UE 120 and BS 110 based at least in part on K DU To generate multiple MAC security keys. The multiple MAC security keys may include a MAC encryption key (KMACEnc ) and the MAC integrity key (K MACInt UE 120 and BS 110 may use K depending on the MAC security configuration indicated by BS 110. MACEnc The UE 120 and the BS 110 may use K depending on the MAC security configuration indicated by the BS 110. MACInt To perform integrity protection on the entire MAC PDU, the MAC sub-PDU including the MAC-CE, or the MAC sub-PDU including a specific MAC-CE.

[0083] In some aspects, UE 120 and BS 110 may communicate at least in part based on K BS To generate K RRCEnc , K RRCInt , K UPEnc , K UPInt and K DU For example, UE 120 and BS 110 may use a key derivation function as described in 3GPP TS 33.401 from K BS Generate K RRCEnc , K RRCInt , K UPEnc and K UPInt As another example, UE 120 and BS 110 may use a key derivation function according to the following equation 1 from K BS Generate K DU :

[0084] K DU =KDF(K BS ,P DU ,DH)

[0085] Formula 1

[0086] Where P DU DH includes one or more parameters unique to the DU of BS 110, and DH includes one or more Diffie-Hellman parameters used for Diffie-Hellman key generation between UE 120 and BS 110. In some aspects, UE 120 and BS 110 may generate a Diffie-Hellman key similar to that generated from K BS Generate K RRCEnc , K RRCInt , K UPEnc and K UPInt Way from K DU Generate K MACEnc and K MACInt .

[0087] In some aspects, the one or more parameters unique to a DU of BS 110 may include a physical cell identifier (PCI) associated with the DU, a random number randomly generated by the DU, an alphanumeric string unique to the DU, another type of identifier unique to the DU, and / or any other parameter that distinguishes the DU from other DUs of BS 110 and / or other DUs of other BSs included in the wireless network. In some aspects, BS 110 may transmit the one or more parameters unique to the DU of BS 110 in the same communication that includes the indication of the MAC security configuration or in a different communication.

[0088] like Figure 5D As shown, if the RRC communication is initiated and terminated at the DU of the BS 110, the one or more key sets associated with the CU may include a UP key set (K UPEnc and K UPInt One or more key sets associated with a DU may include a DU key (K DU ), RRC key set (K RRCEnc and K RRCInt ), and MAC security key set (K MACEnc and K MACInt ). In this case, UE 120 and BS 110 may obtain BS Generate K UPEnc and K UPInt , K can be generated based at least in part on Equation 1 above DU , and can be obtained from K DU Generate K RRCEnc , K RRCInt , K MACEnc and K MACInt .

[0089] like Figure 5E As shown, if RRC communication is initiated and terminated at the DU of BS 110, then instead of having separate key sets for RRC communication and MAC security, UE 120 and BS 110 can obtain the key sets from K DU Generate a key set for DU encryption (K DUEnc ) and DU integrity protection (K DUInt ). In this case, UE 120 and BS 110 may obtain BS Generate K UPEnc and K UPInt , K can be generated based at least in part on Equation 1 above DU , and can be obtained from K DU Generate K DUEnc and K DUInt UE 120 and BS 110 can use K DUEncFor both RRC encryption and decryption and MAC encryption and decryption. Similarly, UE 120 and BS 110 may use K DUInt Used for both RRC integrity protection and MAC integrity protection.

[0090] like Fig. 5F , and indicated by reference numeral 508, UE 120 and BS 110 may implement MAC security for MAC PDU communications transmitted between UE 120 and BS 110. In some aspects, UE 120 and BS 110 may implement MAC security based at least in part on a MAC security configuration indicated by BS 110, based at least in part on one or more keys generated by UE 120 and BS 110, and so on.

[0091] In some aspects, the DU of the UE 120 and / or the BS 110 may generate a MAC PDU communication to be transmitted such that the MAC PDU communication includes a plurality of MAC sub-PDUs. The plurality of MAC sub-PDUs may include a MAC security CE, one or more MAC-CEs, one or more MAC SDUs, and / or padding. In some aspects, the DU of the UE 120 and / or the BS 110 may configure the MAC security CE to include information associated with MAC security for MAC PDU communication. The information associated with MAC security for MAC PDU communication may be based at least in part on the MAC security configuration for communication between the UE 120 and the BS 110.

[0092] For example, if the MAC security configuration indicates that MAC security is to be used for the entire MAC PDU communication, the information associated with the MAC security for the MAC PDU communication may include an indication of the length of the MAC PDU communication. The DU of the UE 120 and / or BS 110 may use the indication of the length of the MAC PDU communication to determine the number of bits included in the MAC PDU communication to be decoded and / or subjected to integrity checking.

[0093] As another example, if the MAC security configuration indicates that MAC security is to be used for all MAC sub-PDUs including a MAC-CE, the information associated with the MAC security for the MAC PDU communication may include an indication of the number of all MAC sub-PDUs including a MAC-CE included in the MAC PDU communication, and an indication of the combined length of all MAC sub-PDUs including a MAC-CE included in the MAC PDU communication. Since the MAC sub-PDUs including a MAC-CE may be located in a continuous block in the MAC PDU communication, the DU of the UE 120 and / or the BS 110 may use the indication of the combined length to identify the contiguous blocks of MAC sub-PDUs, and may use the indication of the number to determine the number of MAC sub-PDUs included in the contiguous blocks to be decrypted and / or subjected to integrity checking.

[0094] As another example, if the MAC security configuration indicates that MAC security is to be used for a subset of MAC sub-PDUs including a MAC-CE, the information associated with MAC security for MAC PDU communication may include an indication of the number of MAC sub-PDUs included in the subset of MAC sub-PDUs, may include an indication of a corresponding identifier associated with the subset of MAC sub-PDUs, and may include an indication of a corresponding length of the subset of MAC sub-PDUs. The DU of the UE 120 and / or the BS 110 may use the indication of the number, the indication of the corresponding identifier, and the indication of the corresponding length to identify the subset of MAC sub-PDUs to be decrypted and / or subjected to integrity checking.

[0095] In some aspects, information associated with MAC security for a MAC PDU may include a MAC security sequence number associated with the MAC PDU communication. The MAC security sequence number may be specific to the MAC PDU communication and may be sequentially incremented for each subsequent transmission of the MAC PDU communication. If the DU of the UE 120 and / or BS 110 receives the MAC PDU and determines that the MAC security sequence is not incremented or out of sequence relative to a previously received MAC PDU communication, the DU of the UE 120 and / or BS 110 may discard the MAC PDU communication and / or transmit an instruction for retransmitting the MAC PDU communication. In this way, if a potential malicious entity intercepts a MAC PDU communication between the DU of the UE 120 and the DU of the BS 110 and attempts to use the MAC PDU communication for malicious purposes, the recipient of the MAC PDU communication (e.g., the DU of the UE 120 or BS 110) may prevent the malicious purpose by first reviewing the MAC security sequence number.

[0096] In some aspects, UE 120 and / or BS 110 may further utilize a K associated with a DU of BS 110. MACEnc or K DUEnc Decrypting or encrypting the MAC PDU communication, by using the K associated with the DU of the BS 110 MACInt or K DUInt MAC security for MAC PDU communication may be implemented by integrity protection of MAC PDU communication, etc. For example, a transmitter of MAC PDU communication (e.g., UE 120 or BS 110) may perform integrity protection on MAC PDU communication by using K in an encryption algorithm (such as the encryption algorithm specified in 3GPP TS 33.501 D.2). MACEnc or K DUEnc to encrypt the MAC PDU communication (e.g., based at least in part on the indicated MAC security configuration). DUEnc is used for an encryption algorithm, the transmitter may include a MAC encryption input parameter (e.g., a value specific to MAC encryption) in the encryption algorithm to distinguish encryption of the MAC PDU from encryption used for RRC communication. The transmitter may generate a keystream block for each protected MAC sub-PDU using the encryption algorithm, and may generate a ciphertext block from a plaintext block for each MAC sub-PDU based at least in part on the corresponding keystream block.

[0097] As another example, the transmitter may use K in an integrity protection algorithm (such as the integrity protection specified in 3GPP TS 33.501 D.3). MACInt or K DUInt to integrity protect the MAC PDU communication (e.g., based at least in part on the indicated MAC security configuration). DUInt If an integrity protection algorithm is used, the transmitter may include a MAC integrity protection input parameter (e.g., a value specific to MAC integrity protection) in the integrity protection algorithm to separate the integrity protection for MAC PDU communications from the integrity protection zone for RRC communications. The transmitter may generate a message authentication code using the integrity protection algorithm and may attach the message authentication code to the MAC PDU.

[0098] The receiver may receive the MAC PDU and may decode the MAC PDU by using K in a decryption algorithm (such as the decryption algorithm specified in 3GPP TS 33.501 D.2). MACEnc or K DUEnc to decrypt the MAC PDU communication (e.g., based at least in part on the indicated MAC security configuration). DUEncThe receiver may include the MAC encryption input parameters in the decryption algorithm if the MAC encryption input parameters are used in the decryption algorithm. The receiver may generate a keystream block for each protected MAC sub-PDU using the decryption algorithm, and may generate a plaintext block from the ciphertext block for each MAC sub-PDU based at least in part on the corresponding keystream block.

[0099] As another example, the receiver may use K in an integrity protection algorithm (such as the integrity protection algorithm specified in 3GPP TS 33.501 D.3) to MACInt or K DUInt to perform an integrity check on the MAC PDU communication (e.g., based at least in part on the indicated MAC security configuration). DUInt is used for an integrity protection algorithm, the receiver may include the MAC integrity protection input parameter in the integrity protection algorithm. The receiver may generate a message authentication code using the integrity protection algorithm, and may compare the generated message authentication code with the message authentication code attached to the MAC PDU to determine whether the generated message authentication code is an exact match of the message authentication code.

[0100] In this manner, UE 120 may transmit an indication of the MAC security capability of UE 120 to BS 110. BS 110 may transmit an indication of a MAC security configuration for communication between UE 120 and BS 110 to UE 120. The MAC security configuration may be based at least in part on the MAC security capability of UE 120, and may indicate a MAC security level to be used when encrypting, decrypting, and / or integrity protecting MAC PDUs transmitted between UE 120 and BS 110. Moreover, UE 120 and BS 110 may generate various keys that may be used when encrypting, decrypting, and / or integrity protecting MAC PDUs transmitted between UE 120 and BS 110. In this manner, UE 120 and BS 110 may implement MAC security for MAC PDUs transmitted between UE 120 and BS 110, which increases the security of the MAC PDUs, prevents performance degradation and attacks of the MAC PDUs, and the like.

[0101] As indicated above, Figures 5A-5F are provided as examples. Other examples may differ from those described in Figures 5A-5F The content described.

[0102] Figure 6 is a diagram illustrating an example process 600, performed, for example, by a UE, in accordance with various aspects of the present disclosure. Example process 600 is an example in which a UE (eg, UE 120) performs MAC security.

[0103] like Figure 6 As shown, process 600 may include transmitting information indicating the MAC security capabilities of the UE to the BS (block 610). For example, the UE (e.g., transmit processor 264, controller / processor 280, memory 282, etc.) may transmit information indicating the MAC security capabilities of the UE to a base station (BS), as described above.

[0104] like Figure 6 As further shown in FIG. 6 , process 600 may include receiving, from the BS, a communication including an indication of a MAC security configuration for communications between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on a MAC security capability of the UE (block 620). For example, the UE may receive (e.g., using receive processor 258, controller / processor 280, memory 282, etc.) from the BS a communication including an indication of a MAC security configuration for communications between the UE and the BS, as described above. In some aspects, the indication of the MAC security configuration is based at least in part on the MAC security capability of the UE.

[0105] Process 600 may include additional aspects, such as any single implementation or any combination of aspects described below and / or in conjunction with one or more other processes described elsewhere herein.

[0106] In a first aspect, the indication of the MAC security configuration includes an indication that MAC security is to be used for the entire MAC PDU transmitted between the UE and the BS, an indication that MAC security is to be used for all MAC sub-PDUs including MAC-CE included in the MAC PDU, or an indication that MAC security is to be used for a subset of MAC sub-PDUs including MAC-CE included in the MAC PDU. In a second aspect, alone or in combination with the first aspect, the communication includes one or more parameters unique to a DU of the BS, and the process 600 includes generating a DU key to be used for communication between the UE and the DU based at least in part on the one or more parameters unique to the DU.

[0107] In a third aspect, alone or in combination with one or more of the first or second aspects, generating a DU key includes generating the DU key based at least in part on a BS key associated with the BS. In some aspects, generating the DU key includes using the one or more parameters unique to the DU and the BS key in a key derivation function. In a fourth aspect, alone or in combination with one or more of the first to third aspects, the one or more parameters unique to the DU include at least one of the following: a PCI associated with the DU, a random number randomly generated by the DU, or an alphanumeric string. In a fifth aspect, alone or in combination with one or more of the first to fourth aspects, process 600 includes generating a MAC encryption key associated with the DU and a MAC integrity key associated with the DU based at least in part on the DU key.

[0108] In a sixth aspect, alone or in combination with one or more of the first to fifth aspects, the process 600 includes generating an RRC encryption key associated with the DU, an RRC integrity key associated with the DU, a MAC encryption key associated with the DU, and a MAC integrity key associated with the DU based at least in part on the DU key. In a seventh aspect, alone or in combination with one or more of the first to sixth aspects, the process 600 includes generating a DU encryption key associated with the DU and a DU integrity key associated with the DU based at least in part on the DU key. In an eighth aspect, alone or in combination with one or more of the first to seventh aspects, the process 600 includes decrypting RRC communications received from the DU based at least in part on a decryption algorithm in which the DU encryption key and the RRC input parameters are used, or encrypting RRC communications to be transmitted to the DU based at least in part on an encryption algorithm in which the DU encryption key and the RRC input parameters are used.

[0109] In the ninth aspect, alone or in combination with one or more of the first to eighth aspects, process 600 includes decrypting MAC PDU communications received from the DU based at least in part on a decryption algorithm in which a DU encryption key and MAC input parameters are used, or encrypting MAC PDU communications to be transmitted to the DU based at least in part on an encryption algorithm in which a DU encryption key and MAC input parameters are used.

[0110] In a tenth aspect, alone or in combination with one or more of the first to ninth aspects, the process 600 includes generating a message authentication code based at least in part on an integrity algorithm in which a DU integrity key and an RRC input parameter are used. In an eleventh aspect, alone or in combination with one or more of the first to tenth aspects, the process 600 includes generating a message authentication code based at least in part on an integrity algorithm in which a DU integrity key and a MAC input parameter are used. In a twelfth aspect, alone or in combination with one or more of the first to eleventh aspects, the process 600 includes receiving a MAC PDU from a BS, identifying a MAC security CE included in the MAC PDU, and identifying information associated with MAC security of the MAC PDU included in the MAC security CE based at least in part on a MAC security configuration.

[0111] In a thirteenth aspect, alone or in combination with one or more of the first to twelfth aspects, the information associated with the MAC security of the MAC PDU comprises a MAC security sequence number associated with the MAC PDU. In a fourteenth aspect, alone or in combination with one or more of the first to thirteenth aspects, the indication of the MAC security configuration comprises an indication that MAC security is to be used for all MAC sub-PDUs including the MAC-CE included in the MAC PDU. In a fifteenth aspect, alone or in combination with one or more of the first to fourteenth aspects, the information associated with the MAC security of the MAC PDU comprises an indication of the number of all MAC sub-PDUs including the MAC-CE included in the MAC PDU, and an indication of the combined length of all MAC sub-PDUs including the MAC-CE included in the MAC PDU.

[0112] In a sixteenth aspect, alone or in combination with one or more of the first to fifteenth aspects, the indication of the MAC security configuration includes an indication that MAC security will be used for the entire MAC PDU transmitted between the UE and the BS. In a seventeenth aspect, alone or in combination with one or more of the first to sixteenth aspects, the information associated with the MAC security of the MAC PDU includes an indication of the length of the MAC PDU. In an eighteenth aspect, alone or in combination with one or more of the first to seventeenth aspects, the indication of the MAC security configuration includes an indication that MAC security will be used for a subset of MAC sub-PDUs including MAC-CE included in the MAC PDU. In a nineteenth aspect, alone or in combination with one or more of the first to eighteenth aspects, the information associated with the MAC security of the MAC PDU includes an indication of the number of MAC sub-PDUs included in the subset of MAC sub-PDUs, and an indication of the corresponding length of each MAC sub-PDU included in the subset of MAC sub-PDUs.

[0113] In a twentieth aspect, alone or in combination with one or more of the first to nineteenth aspects, the process 600 includes generating a MAC PDU for transmission to the BS, and configuring a MAC security CE included in the MAC PDU based at least in part on the MAC security configuration, wherein the MAC security CE includes information associated with MAC security of the MAC PDU. In a twenty-first aspect, alone or in combination with one or more of the first to twentieth aspects, the information associated with MAC security of the MAC PDU includes a MAC security sequence number associated with the MAC PDU.

[0114] In aspect 22, alone or in combination with one or more of aspects 1 to 21, the indication of the MAC security configuration includes an indication that MAC security will be used for all MAC sub-PDUs including MAC-CE included in the MAC PDU. In aspect 23, alone or in combination with one or more of aspects 1 to 22, the information associated with the MAC security of the MAC PDU includes an indication of the number of all MAC sub-PDUs including MAC-CE included in the MAC PDU, and an indication of the combined length of all MAC sub-PDUs including MAC-CE included in the MAC PDU. In aspect 24, alone or in combination with one or more of aspects 1 to 23, the indication of the MAC security configuration includes an indication that MAC security will be used for the entire MAC PDU transmitted between the UE and the BS. In aspect 25, alone or in combination with one or more of aspects 1 to 24, the information associated with the MAC security of the MAC PDU includes an indication of the length of the MAC PDU.

[0115] In a twenty-sixth aspect, alone or in combination with one or more of the first to twenty-fifth aspects, the indication of the MAC security configuration includes an indication that MAC security is to be used for a subset of MAC sub-PDUs including a MAC-CE included in the MAC PDU. In a twenty-seventh aspect, alone or in combination with one or more of the first to twenty-sixth aspects, the information associated with MAC security of the MAC PDU includes an indication of the number of MAC sub-PDUs included in the subset of MAC sub-PDUs, and an indication of the corresponding length of each MAC sub-PDU included in the subset of MAC sub-PDUs.

[0116] In a twenty-eighth aspect, alone or in combination with one or more of the first to twenty-seventh aspects, receiving the communication includes receiving the communication based at least in part on a switch between the first DU and the second DU. In a twenty-ninth aspect, alone or in combination with one or more of the first to twenty-eighth aspects, the second DU is associated with the BS and the first DU is associated with the BS or another BS. In a thirtieth aspect, alone or in combination with one or more of the first to twenty-ninth aspects, the communication includes an indication that a DU key associated with the first DU is to be generated. In a certain thirty-first aspect, alone or in combination with one or more of the first to thirtieth aspects, process 600 includes generating a DU key associated with the first DU based at least in part on an indication that a DU key associated with the first DU is to be generated.

[0117] In a thirty-second aspect, alone or in combination with one or more of the first to thirty-first aspects, the handover is an Xn-based handover. In a thirty-third aspect, alone or in combination with one or more of the first to thirty-second aspects, the process 600 includes generating a BS key associated with a BS associated with the first DU, and generating a DU key associated with the first DU based at least in part on the BS key. In a thirty-fourth aspect, alone or in combination with one or more of the first to thirty-third aspects, the communication includes an RRC reconfiguration communication.

[0118] although Figure 6 An example block diagram of process 600 is shown, but in some aspects, process 600 may include Figure 6 Additional blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted in the process 600. Additionally or alternatively, two or more blocks of the process 600 may be executed in parallel.

[0119] Figure 7 is a diagram illustrating an example process 700, performed, for example, by a BS, in accordance with various aspects of the present disclosure. Example process 700 is an example in which a BS (eg, BS 110) performs MAC security.

[0120] like Figure 7 As shown, process 700 may include receiving information indicating MAC security capabilities of the UE from the UE (block 710). For example, the BS may receive information indicating MAC security capabilities of the UE from the UE (e.g., using receive processor 238, controller / processor 240, memory 242, etc.), as described above.

[0121] like Figure 7As further shown in FIG. 7 , process 700 may include transmitting to the UE a communication including an indication of a MAC security configuration for communications between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on a MAC security capability of the UE (block 720). For example, the BS may transmit to the UE (e.g., using transmit processor 220, controller / processor 240, memory 242, etc.) a communication including an indication of a MAC security configuration for communications between the UE and the BS, as described above. In some aspects, the indication of the MAC security configuration is based at least in part on the MAC security capability of the UE.

[0122] Process 700 may include additional aspects, such as any single implementation or any combination of aspects described below and / or in conjunction with one or more other processes described elsewhere herein.

[0123] In a first aspect, the indication of the MAC security configuration includes an indication that MAC security will be used for the entire MAC PDU transmitted between the UE and the BS, an indication that MAC security will be used for all MAC sub-PDUs including MAC-CE included in the MAC PDU, or an indication that MAC security will be used for a subset of MAC sub-PDUs including MAC-CE included in the MAC PDU.

[0124] In a second aspect, alone or in combination with the first aspect, the communication includes one or more parameters unique to the DU of the BS. In a third aspect, alone or in combination with one or more of the first or second aspects, process 700 includes generating a DU key to be used for communication between the UE and the DU based at least in part on the one or more parameters unique to the DU. In some aspects, generating the DU key includes generating the DU key based at least in part on a BS key associated with the BS. In a fourth aspect, alone or in combination with one or more of the first to third aspects, generating the DU key includes using the one or more parameters unique to the DU and the BS key in a key derivation function.

[0125] In a fifth aspect, alone or in combination with one or more of the first to fourth aspects, the one or more parameters unique to the DU include at least one of the following: a PCI associated with the DU, a random number randomly generated by the DU, or an alphanumeric string. In a sixth aspect, alone or in combination with one or more of the first to fifth aspects, process 700 includes generating a MAC encryption key associated with the DU and a MAC integrity key associated with the DU based at least in part on a DU key. In a seventh aspect, alone or in combination with one or more of the first to sixth aspects, process 700 includes generating an RRC encryption key associated with the DU, an RRC integrity key associated with the DU, a MAC encryption key associated with the DU, and a MAC integrity key associated with the DU based at least in part on a DU key.

[0126] In an eighth aspect, alone or in combination with one or more of the first to seventh aspects, the process 700 includes generating a DU encryption key associated with the DU and a DU integrity key associated with the DU based at least in part on the DU key. In a ninth aspect, alone or in combination with one or more of the first to third aspects, the process 700 includes decrypting RRC communications received from the DU based at least in part on a decryption algorithm in which the DU encryption key and the RRC input parameters are used, or encrypting RRC communications to be transmitted to the DU based at least in part on an encryption algorithm in which the DU encryption key and the RRC input parameters are used.

[0127] In a tenth aspect, alone or in combination with one or more of the first to ninth aspects, the process 700 includes decrypting a MAC PDU communication received from the DU based at least in part on a decryption algorithm in which the DU encryption key and the MAC input parameters are used, or encrypting a MAC PDU communication to be transmitted to the DU based at least in part on an encryption algorithm in which the DU encryption key and the MAC input parameters are used. In an eleventh aspect, alone or in combination with one or more of the first to tenth aspects, the process 700 includes generating a message authentication code based at least in part on an integrity algorithm in which the DU encryption key and the RRC input parameters are used.

[0128] In a twelfth aspect, alone or in combination with one or more of the first to eleventh aspects, generating a message authentication code is based at least in part on an integrity algorithm in which a DU encryption key and a MAC input parameter are used. In a thirteenth aspect, alone or in combination with one or more of the first to twelfth aspects, the process 700 includes receiving a MAC PDU from a UE, identifying a MAC security CE included in the MAC PDU, and identifying information associated with MAC security of the MAC PDU included in the MAC security CE based at least in part on a MAC security configuration.

[0129] In a fourteenth aspect, alone or in combination with one or more of the first to thirteenth aspects, the information associated with the MAC security of the MAC PDU comprises a MAC security sequence number associated with the MAC PDU. In a fifteenth aspect, alone or in combination with one or more of the first to fourteenth aspects, the indication of the MAC security configuration comprises an indication that MAC security is to be used for all MAC sub-PDUs including the MAC-CE included in the MAC PDU. In a sixteenth aspect, alone or in combination with one or more of the first to fifteenth aspects, the information associated with the MAC security of the MAC PDU comprises an indication of the number of all MAC sub-PDUs including the MAC-CE included in the MAC PDU, and an indication of the combined length of all MAC sub-PDUs including the MAC-CE included in the MAC PDU.

[0130] In the seventeenth aspect, alone or in combination with one or more of the first to sixteenth aspects, the indication of the MAC security configuration includes an indication that MAC security will be used for the entire MAC PDU transmitted between the UE and the BS. In the eighteenth aspect, alone or in combination with one or more of the first to seventeenth aspects, the information associated with the MAC security of the MAC PDU includes an indication of the length of the MAC PDU. In the nineteenth aspect, alone or in combination with one or more of the first to eighteenth aspects, the indication of the MAC security configuration includes an indication that MAC security will be used for a subset of MAC sub-PDUs including MAC-CE included in the MAC PDU. In the twentieth aspect, alone or in combination with one or more of the first to nineteenth aspects, the information associated with the MAC security of the MAC PDU includes an indication of the number of MAC sub-PDUs included in the subset of MAC sub-PDUs, and an indication of the corresponding length of each MAC sub-PDU included in the subset of MAC sub-PDUs.

[0131] In a twenty-first aspect, alone or in combination with one or more of the first to twentieth aspects, the process 700 includes: generating a MAC PDU for transmission to a UE; configuring a MAC security CE included in the MAC PDU based at least in part on the MAC security configuration, wherein the MAC security CE includes information associated with MAC security of the MAC PDU. In a twenty-second aspect, alone or in combination with one or more of the first to twenty-first aspects, the information associated with MAC security of the MAC PDU includes a MAC security sequence number associated with the MAC PDU.

[0132] In the twenty-third aspect, alone or in combination with one or more of the first to twenty-second aspects, the indication of the MAC security configuration includes an indication that MAC security will be used for all MAC sub-PDUs including MAC-CE included in the MAC PDU. In the twenty-fourth aspect, alone or in combination with one or more of the first to twenty-third aspects, the information associated with the MAC security of the MAC PDU includes an indication of the number of all MAC sub-PDUs including MAC-CE included in the MAC PDU, and an indication of the combined length of all MAC sub-PDUs including MAC-CE included in the MAC PDU. In the twenty-fifth aspect, alone or in combination with one or more of the first to twenty-fourth aspects, the indication of the MAC security configuration includes an indication that MAC security will be used for the entire MAC PDU transmitted between the UE and the BS. In the twenty-sixth aspect, alone or in combination with one or more of the first to twenty-fifth aspects, the information associated with the MAC security of the MAC PDU includes an indication of the length of the MAC PDU.

[0133] In aspect 27, alone or in combination with one or more of aspects 1 to 26, the indication of the MAC security configuration includes an indication that MAC security is to be used for a subset of MAC sub-PDUs including a MAC-CE included in the MAC PDU. In aspect 28, alone or in combination with one or more of aspects 1 to 27, the information associated with MAC security of the MAC PDU includes an indication of the number of MAC sub-PDUs included in the subset of MAC sub-PDUs, and an indication of the corresponding length of each MAC sub-PDU included in the subset of MAC sub-PDUs. In aspect 29, alone or in combination with one or more of aspects 1 to 28, transmitting the communication includes transmitting the communication based at least in part on a switch between the first DU and the second DU.

[0134] In the 30th aspect, alone or in combination with one or more of the first to twenty-ninth aspects, the first DU is associated with the BS and the second DU is associated with the BS or another BS. In the 31st aspect, alone or in combination with one or more of the first to 30th aspects, the communication includes an indication that a DU key associated with the first DU is to be generated. In the 32nd aspect, alone or in combination with one or more of the first to thirty-first aspects, process 700 includes generating a DU key associated with the first DU. In some aspects, the switching is an Xn-based switching. In the 33rd aspect, alone or in combination with one or more of the first to thirty-second aspects, process 700 includes generating a BS key and generating a DU key associated with the first DU based at least in part on the BS key. In the 34th aspect, alone or in combination with one or more of the first to thirty-third aspects, the communication includes an RRC reconfiguration communication.

[0135] although Figure 7 An example block diagram of process 700 is shown, but in some aspects, process 700 may include Figure 7 Additional blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted in the process 700. Additionally or alternatively, two or more blocks of the process 700 may be executed in parallel.

[0136] The foregoing disclosure provides illustration and description, but is not intended to be exhaustive or to limit the aspects to the precise forms disclosed. Modifications and variations may be made in light of the above disclosure or may be acquired by practice of the various aspects.

[0137] As used herein, the term "component" is intended to be broadly interpreted as hardware, firmware, or a combination of hardware and software. As used herein, a processor is implemented with hardware, firmware, or a combination of hardware and software.

[0138] It will be apparent that the systems and / or methods described herein can be implemented in different forms of hardware, firmware, or a combination of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods does not limit the various aspects. Thus, the operation and behavior of these systems and / or methods are described herein without reference to specific software codes—it is understood that software and hardware can be designed to implement these systems and / or methods based at least in part on the description herein.

[0139] Although specific feature combinations are described in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of various aspects. In fact, many of these features can be combined in a manner not specifically described in the claims and / or not disclosed in the specification. Although each dependent claim listed below can be directly subordinate to only one claim, the disclosure of various aspects includes that each dependent claim is combined with each other claim in this group of claims. The phrase quoting "at least one of" a column of items refers to any combination of these items, including single members. As an example, "at least one of a, b or c" is intended to cover: a, b, c, ab, ac, bc, and abc, and any combination with multiple identical elements (for example, aa, aaa, aab, aac, abb, acc, bb, bbb, bbc, cc, and ccc, or any other sorting of a, b and c).

[0140] Elements, actions or instructions used herein should not be interpreted as critical or necessary unless explicitly described as such. Moreover, as used herein, the articles "one" and "a" are intended to include one or more items, and can be used interchangeably with "one or more". In addition, as used herein, the terms "set (set)" and "group" are intended to include one or more items (e.g., related items, non-related items, combinations of related items and non-related items, etc.), and can be used interchangeably with "one or more". In the case of intending to have only one item, the phrase "only one" or similar language is used. Moreover, as used herein, the terms "having", "containing", "including" etc. are intended to be open terms. In addition, the phrase "based on" is intended to mean "based at least in part on", unless otherwise explicitly stated.

Claims

1. A wireless communication method performed by a user equipment (UE), comprising: transmitting information indicating a medium access control (MAC) security capability of the UE to a base station (BS); receiving, from the BS, a communication including an indication of a MAC security configuration for communications between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on a MAC security capability of the UE; generating a distributed unit (DU) key from the BS key based at least in part on the communication; generating a MAC encryption key and a MAC integrity key from the DU key; as well as The MAC encryption key or the MAC integrity key is used to communicate with the BS.

2. The method of claim 1, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for an entire MAC protocol data unit (PDU) transmitted between the UE and the BS, an indication that MAC security is to be used for all MAC sub-PDUs including a MAC Control Element (MAC-CE) included in the MAC PDU, or An indication that MAC security is to be used for a subset of MAC sub-PDUs including a MAC-CE included in the MAC PDU.

3. The method of claim 1, wherein: The communication includes one or more parameters unique to the DU; and The generating of the DU key further comprises: The DU key is generated based at least in part on the one or more parameters unique to the DU.

4. The method of claim 3, wherein: The one or more parameters unique to the DU include at least one of: a physical cell identifier (PCI) associated with the DU, A random number randomly generated by the DU, or Alphanumeric string.

5. The method of claim 3, further comprising: generating, based at least in part on the DU key, at least one of: a radio resource control (RRC) encryption key associated with the DU, an RRC integrity key associated with the DU, the DU encryption key associated with the DU, or The DU integrity key associated with the DU.

6. The method of claim 3, further comprising: Based at least in part on the DU key generation: a DU encryption key associated with the DU, and a DU integrity key associated with the DU; as well as At least one of the following: decrypting a radio resource control (RRC) communication received from the DU based at least in part on a decryption algorithm in which the DU encryption key and RRC input parameters are used, encrypting RRC communications to be transmitted to the DU based at least in part on an encryption algorithm in which the DU encryption key and the RRC input parameters are used, decrypting a MAC protocol data unit (PDU) communication received from the DU based at least in part on a decryption algorithm in which the DU encryption key and MAC input parameters are used, or A MAC PDU communication to be transmitted to the DU is encrypted based at least in part on an encryption algorithm in which the DU encryption key and the MAC input parameters are used.

7. The method of claim 1, further comprising: receiving a MAC protocol data unit (PDU) from the BS; Identify a MAC security control element (CE) included in the MAC PDU; as well as Information associated with MAC security of the MAC PDU included in the MAC security CE is identified based at least in part on the MAC security configuration.

8. The method of claim 7, wherein: The information associated with MAC security of the MAC PDU includes: The MAC security sequence number associated with the MAC PDU.

9. The method of claim 7, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for all MAC sub-PDUs including a MAC-CE included in the MAC PDU; and The information associated with the MAC security of the MAC PDU includes: an indication of the number of all MAC sub-PDUs including a MAC-CE included in said MAC PDU, and An indication of the combined length of all MAC sub-PDUs, including a MAC-CE, included in the MAC PDU.

10. The method of claim 7, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for the entire MAC PDU transmitted between the UE and the BS; and The information associated with the MAC security of the MAC PDU includes: An indication of the length of the MAC PDU.

11. The method of claim 7, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for a subset of MAC sub-PDUs including a MAC-CE included in the MAC PDU; and The information associated with the MAC security of the MAC PDU includes: an indication of the number of MAC sub-PDUs included in the subset of MAC sub-PDUs, and an indication of the respective length of each MAC sub-PDU included in the subset of MAC sub-PDUs.

12. The method of claim 1, further comprising: generating a MAC protocol data unit (PDU) for transmission to the BS; as well as configuring a MAC security control element (CE) included in the MAC PDU based at least in part on the MAC security configuration, The MAC security CE includes information associated with MAC security of the MAC PDU.

13. The method of claim 12, wherein: The information associated with MAC security of the MAC PDU includes: The MAC security sequence number associated with the MAC PDU.

14. The method of claim 12, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for all MAC sub-PDUs including a MAC-CE included in the MAC PDU; and The information associated with the MAC security of the MAC PDU includes: an indication of the number of all MAC sub-PDUs including a MAC-CE included in said MAC PDU, and An indication of the combined length of all MAC sub-PDUs, including a MAC-CE, included in the MAC PDU.

15. The method of claim 12, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for the entire MAC PDU transmitted between the UE and the BS; and The information associated with the MAC security of the MAC PDU includes: An indication of the length of the MAC PDU.

16. The method of claim 12, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for a subset of MAC sub-PDUs including a MAC-CE included in the MAC PDU; and The information associated with the MAC security of the MAC PDU includes: an indication of the number of MAC sub-PDUs included in the subset of MAC sub-PDUs, and an indication of the respective length of each MAC sub-PDU included in the subset of MAC sub-PDUs.

17. A wireless communication method performed by a base station (BS), comprising: receiving, from a user equipment (UE), information indicating a medium access control (MAC) security capability of the UE; transmitting, to the UE, a communication including an indication of a MAC security configuration for communications between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on a MAC security capability of the UE; generating a distributed unit (DU) key from the BS key based at least in part on the communication; generating a MAC encryption key and a MAC integrity key from the DU key; as well as The MAC encryption key or the MAC integrity key is used to communicate with the UE.

18. The method of claim 17, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for an entire MAC protocol data unit (PDU) transmitted between the UE and the BS, an indication that MAC security is to be used for all MAC sub-PDUs including a MAC Control Element (MAC-CE) included in the MAC PDU, or An indication that MAC security is to be used for a subset of MAC sub-PDUs including a MAC-CE included in the MAC PDU.

19. The method of claim 17, wherein: The communication includes one or more parameters unique to the DU; and The generating of the DU key further comprises: The DU key is generated based at least in part on the one or more parameters unique to the DU.

20. The method of claim 19, wherein: The one or more parameters unique to the DU include at least one of: a physical cell identifier (PCI) associated with the DU, A random number randomly generated by the DU, or Alphanumeric string.

21. The method of claim 19, further comprising: generating, based at least in part on the DU key, at least one of: a radio resource control (RRC) encryption key associated with the DU, an RRC integrity key associated with the DU, the DU encryption key associated with the DU, or The DU integrity key associated with the DU.

22. The method of claim 19, further comprising: Based at least in part on the DU key generation: a DU encryption key associated with the DU, and a DU integrity key associated with the DU; as well as At least one of the following: decrypting a radio resource control (RRC) communication received from the DU based at least in part on a decryption algorithm in which the DU encryption key and RRC input parameters are used, encrypting RRC communications to be transmitted to the DU based at least in part on an encryption algorithm in which the DU encryption key and the RRC input parameters are used, decrypting a MAC protocol data unit (PDU) communication received from the DU based at least in part on a decryption algorithm in which the DU encryption key and MAC input parameters are used, or A MAC PDU communication to be transmitted to the DU is encrypted based at least in part on an encryption algorithm in which the DU encryption key and the MAC input parameters are used.

23. The method of claim 17, further comprising: receiving a MAC protocol data unit (PDU) from the UE; Identify a MAC security control element (CE) included in the MAC PDU; as well as Information associated with MAC security of the MAC PDU included in the MAC security CE is identified based at least in part on the MAC security configuration.

24. The method of claim 23, wherein: The information associated with MAC security of the MAC PDU includes: The MAC security sequence number associated with the MAC PDU.

25. The method of claim 23, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for all MAC sub-PDUs including a MAC-CE included in the MAC PDU; and The information associated with the MAC security of the MAC PDU includes: an indication of the number of all MAC sub-PDUs including a MAC-CE included in said MAC PDU, and An indication of the combined length of all MAC sub-PDUs, including a MAC-CE, included in the MAC PDU.

26. The method of claim 23, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for the entire MAC PDU transmitted between the UE and the BS; and The information associated with the MAC security of the MAC PDU includes: An indication of the length of the MAC PDU.

27. The method of claim 23, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for a subset of MAC sub-PDUs including a MAC-CE included in the MAC PDU; and The information associated with the MAC security of the MAC PDU includes: an indication of the number of MAC sub-PDUs included in the subset of MAC sub-PDUs, and an indication of the respective length of each MAC sub-PDU included in the subset of MAC sub-PDUs.

28. The method of claim 17, further comprising: generating a MAC protocol data unit (PDU) for transmission to the UE; as well as configuring a MAC security control element (CE) included in the MAC PDU based at least in part on the MAC security configuration, The MAC security CE includes information associated with MAC security of the MAC PDU.

29. The method of claim 28, wherein: The information associated with MAC security of the MAC PDU includes: The MAC security sequence number associated with the MAC PDU.

30. The method of claim 28, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for all MAC sub-PDUs including a MAC-CE included in the MAC PDU; and The information associated with the MAC security of the MAC PDU includes: an indication of the number of all MAC sub-PDUs including a MAC-CE included in said MAC PDU, and An indication of the combined length of all MAC sub-PDUs, including a MAC-CE, included in the MAC PDU.

31. The method of claim 28, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for the entire MAC PDU transmitted between the UE and the BS; and The information associated with the MAC security of the MAC PDU includes: An indication of the length of the MAC PDU.

32. The method of claim 28, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for a subset of MAC sub-PDUs including a MAC-CE included in the MAC PDU; and The information associated with the MAC security of the MAC PDU includes: an indication of the number of MAC sub-PDUs included in the subset of MAC sub-PDUs, and an indication of the respective length of each MAC sub-PDU included in the subset of MAC sub-PDUs.

33. A user equipment (UE) for wireless communication, comprising: Memory; as well as one or more processors operatively coupled to the memory, the memory and the one or more processors being configured to: transmitting information indicating a medium access control (MAC) security capability of the UE to a base station (BS); receiving, from the BS, a communication including an indication of a MAC security configuration for communications between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on a MAC security capability of the UE; generating a distributed unit (DU) key from the BS key based at least in part on the communication; generating a MAC encryption key and a MAC integrity key from the DU key; as well as The MAC encryption key or the MAC integrity key is used to communicate with the BS.

34. The UE according to claim 33, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for an entire MAC protocol data unit (PDU) transmitted between the UE and the BS, an indication that MAC security is to be used for all MAC sub-PDUs including a MAC Control Element (MAC-CE) included in the MAC PDU, or An indication that MAC security is to be used for a subset of MAC sub-PDUs including a MAC-CE included in the MAC PDU.

35. The UE according to claim 33, wherein: The communication includes one or more parameters unique to a distributed unit (DU) of the BS; and Wherein, the one or more processors are further configured to: A DU key is generated based at least in part on the one or more parameters unique to the DU to be used for communications between the UE and the DU.

36. A base station (BS) for wireless communication, comprising: Memory; as well as one or more processors operatively coupled to the memory, the memory and the one or more processors being configured to: receiving, from a user equipment (UE), information indicating a medium access control (MAC) security capability of the UE; transmitting, to the UE, a communication including an indication of a MAC security configuration for communications between the UE and the BS, wherein the indication of the MAC security configuration is based at least in part on a MAC security capability of the UE; generating a distributed unit (DU) key from the BS key based at least in part on the communication; generating a MAC encryption key and a MAC integrity key from the DU key; as well as The MAC encryption key or the MAC integrity key is used to communicate with the UE.

37. The BS of claim 36, wherein: The indication of the MAC security configuration comprises: an indication that MAC security is to be used for an entire MAC protocol data unit (PDU) transmitted between the UE and the BS, an indication that MAC security is to be used for all MAC sub-PDUs including a MAC Control Element (MAC-CE) included in the MAC PDU, or An indication that MAC security is to be used for a subset of MAC sub-PDUs including a MAC-CE included in the MAC PDU.

38. The BS of claim 36, wherein: The communication includes one or more parameters unique to the DU; and Wherein, the one or more processors are further configured to: The DU key is generated based at least in part on the one or more parameters unique to the DU.

Images