Method, device and medium for setting security context in wireless communication network

Abstract

The subject matter of the present invention is "Multi-RAT Access Stratum Security". The present disclosure generally relates to the field of security context setup. More specifically, the present disclosure relates to techniques for supporting security context setup in a wireless communication network. A method embodiment relates to supporting security context setup in a wireless communication network, the method comprising initiating (S304) by a radio access network (RAN) element (200) of the wireless communication network an access stratum (AS) security context setup for a first radio access technology (RAT) and a second RAT in a common signaling procedure.

Description

[0001] This application is a divisional application of the patent application filed on December 3, 2015, with application number 201580085791.5 and invention name “Multi-RAT Access Layer Security”. Technical Field

[0002] The present disclosure generally relates to the field of security context setup. More specifically, the present disclosure relates to techniques for supporting security context setup in wireless communication networks. Background Art

[0003] Security is a crucial aspect in today's mobile communication systems. For example, the security design of Long Term Evolution (LTE) provides compartmentalization. Compartmentalization mainly consists of ensuring that if an attacker cracks the security of one function, only that function is compromised. For example, there is one key for encryption of the Radio Resource Control (RRC) protocol and another key for integrity protection of the RRC protocol. RRC is a signaling protocol that uses lower layers for segmentation and reliable and ordered delivery of signaling messages. RRC is suitable for messages of any size that require reliable delivery, such as user equipment (UE) configuration. In LTE and LTE-Advanced (LTE-a), RRC involves the exchange of non-access stratum (NAS) messages between the UE and the Mobility Management Entity (MME) and the provision of various control plane functions on both the UE and the evolved NodeB (eNodeB or eNB for short).

[0004] Access Stratum (AS) security consists of integrity protection of the control plane (i.e., RRC signaling) and encryption of both the control and user planes. If an attacker cracks the RRC encryption key, the attacker can decrypt and read all RRC messages. However, since the integrity key is different from the encryption key, the attacker cannot modify or inject RRC messages. An attacker who has cracked the RRC encryption key cannot use the key to eavesdrop on the data radio bearer (DRB) because they use separate encryption keys (and vice versa). Another part of the out-of-area design is that each eNB uses a separate set of keys. The basic principle is that this ensures that an attacker who hacks into one eNB does not obtain any information about the data transmitted between the UE and another physically different eNB. In order to maintain the property that hacking into one physical radio access network (RAN) node (i.e., eNB) does not help attacking another RAN node, the auxiliary eNB should use its own set of keys separated from the key set used in the anchor eNB, however, it can be derived from the anchor eNB as in LTE dual connectivity.

[0005] Typically, when a new radio access technology (RAT) is standardized, this is done by also introducing a separate core network catering to that RAT, and 3GPP introduces mechanisms to move from one RAT to another via the core network with minimal service interruption. Thus, in any case, moving from one RAT to another means establishing an RRC connection towards the target RAT and removing the RRC connection from the source RAT, and since these RRC connections terminate in different logical nodes anchored in different core networks (i.e. are completely separate UE connections), there is no possibility of coordination between them.

[0006] Signaling bearer and / or data bearer establishment and / or signaling bearer and / or data bearer resumption require a large number of signaling steps, resulting in, for example, signaling overhead and / or long signaling duration. Current signaling procedures for security context setup have not been designed or at least not optimized to support a RAN architecture consisting of multiple air interfaces as in a multi-RAT network. This is the case even when the UE's first RAT and second RAT connections are to be towards the same or, in other words, shared radio node and / or core network node.

[0007] Furthermore, the security context may be different for different RATs (although tightly integrated) or standard releases or UE capabilities or device classes. For example, there may be different length requirements for security keys for different RATs, or network termination may be in separate nodes requiring separate key sets. Summary of the invention

[0008] Therefore, a need exists for improved techniques for supporting security context setup in multi-RAT wireless communication networks.

[0009] According to a first aspect, a method of supporting security context setup in a wireless communication network is provided. The method comprises initiating, by a radio access network (RAN) element of the wireless communication network, access stratum (AS) security context setup for a first radio access technology (RAT) and a second RAT in a common signaling procedure.

[0010] In this way, the signaling for the AS security context setup for the first and second RATs (ie, a multi-RAT environment) is reduced. Therefore, the multi-RAT security context setup can be simplified.

[0011] The term radio access technology (RAT) may be understood as the underlying physical connection technology for a radio-based communication network.A radio access network element may include or be configured as a base station of the radio access network.

[0012] The common signaling process may include an exchange of one or more messages related to both the first RAT and the second RAT.

[0013] The method may include receiving, by a RAN element, first RAN keying material from a core network (CN) element of a wireless communication network. The first RAN keying material enables the RAN element to initiate an AS security context setup for a first RAT. The method further includes receiving, by the RAN element, second RAN keying material from a CN element of the wireless communication network. The second RAN keying material enables the RAN element to initiate an AS security context setup for a second RAT.

[0014] In this case, two separate key materials may be signaled to the RAN, one for the first RAT and one for the second RAT. The key material may be used to set up the security context. The key material received from the CN may, but does not have to, be used directly in the security context setup, e.g., may be used later.

[0015] The method may include receiving, by a RAN element, first RAN keying material from a CN element of a wireless communication network. The first RAN keying material enables the RAN element to initiate an AS security context setup for a first RAT. The method may further include deriving, by the RAN element, second RAN keying material from the received first RAN keying material. The second RAN keying material enables the RAN element to initiate an AS security context setup for a second RAT.

[0016] In this case, the first RAN keying material for the first RAT may be used to derive keying material for the second RAT.The keying material may then be used to set up a security context.

[0017] The step of initiating AS security context setup may comprise directly using the received first RAN keying material to initiate the AS security context setup for the first RAT. Alternatively, the step of initiating AS security context setup may comprise deriving a third RAN keying material from the received first RAN keying material, and initiating the AS security context setup for the first RAN using the derived third RAN keying material. For example, the first RAN keying material received from the CN may, but need not, be used directly in the security context setup, for example, may be used later. For example, the third RAN keying material may be derived from the first RAN keying material, and the third RAN keying material may be used to setup the security context for the first RAT. Since the second RAN keying material is derived from the received first RAN keying material, the signaling of the AS security setup for the first and second RATs (i.e., a multi-RAT environment) is even further reduced. Therefore, the multi-RAT security context setup can be even further simplified.

[0018] In one or more embodiments, the step of initiating AS security context setup may include transmitting, by the RAN element, a common AS security mode command message for the first RAT and the second RAT to a wireless communication device of the wireless communication network.

[0019] The method may include receiving, by the RAN element, an AS security mode complete message notifying the RAN element of completion of the AS security context setup for the first RAT and the second RAT.

[0020] The RAN element may correspond to a RAN element implementing the first RAT. Further, the RAN element may correspond to or may be different from a RAN element implementing the second RAT.

[0021] According to a second aspect, a method for supporting security context setup in a wireless communication network is provided. The method includes informing a radio access network (RAN) element of the wireless communication network by a core network (CN) element of the wireless communication network to initiate access stratum (AS) security context setup for a first radio access technology (RAT) and a second RAT in a common signaling process.

[0022] The method may include receiving, by the CN element, from the wireless communication device information regarding security capabilities of the wireless communication device regarding the first RAT and the second RAT.

[0023] The method may include initiating, by a CN element, non-access stratum (NAS) security context setup for the first RAT and the second RAT in a common signaling procedure.

[0024] In this way, the signaling for NAS security context setup for the first and second RAT (ie a multi-RAT environment) is reduced.Therefore, the multi-RAT security context setup can be simplified even further.

[0025] The common signaling process may include an exchange of one or more messages related to both the first RAT and the second RAT.

[0026] Initiating NAS security context setup may include requesting, by the CN element, that the wireless communication device perform authentication towards the CN element.

[0027] The method may include deriving, by a CN element, CN key material that enables the wireless communication device to perform authentication for a first RAT and that enables the wireless communication device to perform authentication for a second RAT.

[0028] The method may include transmitting, by the CN element, CN key material to the wireless communication device.

[0029] The method may include receiving, by the CN element, an authentication response message from the wireless communication device.

[0030] The method may include deriving, by the CN element, CN key material for integrity protection and encryption of NAS communications.

[0031] The method may include transmitting, by a CN element to a wireless communication device, a NAS security mode command message for a first RAT and a second RAT. The NAS security mode command message causes the wireless communication device to derive CN key material for integrity protection and encryption of NAS communications.

[0032] The method may include receiving, by the CN element, a NAS security mode complete message for the first RAT and the second RAT from the wireless communication device.

[0033] According to a third aspect, a method for supporting security context setup in a wireless communication network is provided. The method includes receiving, by a wireless communication device of the wireless communication network, information from a radio access network (RAN) element of the wireless communication network in a common signaling process that enables wireless communication to setup an access stratum (AS) security context for a first radio access technology (RAT) and a second RAT. The method further includes setting, by the wireless communication device, the AS security context for the first RAT and the second RAT.

[0034] The method may include receiving, by the wireless communication device, a common AS security mode command message for a first RAT and a second RAT from a RAN element of the wireless communication network.

[0035] The method may include transmitting, by the wireless communication device, an AS security mode complete message to the RAN element. The AS security mode complete message may notify the RAN element of the completion of the AS security context setup for the first RAT and the second RAT.

[0036] The method may include transmitting, by the wireless communication device, to a core network (CN) element of the wireless communication network, information regarding security capabilities of the wireless communication device regarding a first RAT and a second RAT.

[0037] The method may include receiving, by the wireless communication device, a request from a CN element to perform authentication towards the CN element.

[0038] The method may include transmitting, by the wireless communication device, an authentication response message to the CN element.

[0039] The method may include receiving, by the wireless communication device, a NAS security mode command message for a first RAT and a second RAT from a CN element. The method may further include deriving, by the wireless communication device, CN key material for integrity protection and encryption of NAS communications for the first RAT and the second RAT from the received NAS security mode command message.

[0040] The method may include transmitting, by the wireless communication device to the CN element, a NAS security mode complete message for the first RAT and the second RAT.

[0041] According to a fourth aspect, a computer program is provided. The computer program comprises a program code portion for causing the steps of any one of the method aspects described herein to be performed when the computer program is run on a computer system or on one or more computing devices. The computer program may be stored on a computer readable recording medium or may be downloadable as a signal.

[0042] According to a fifth aspect, there is provided a radio access network (RAN) element for supporting security context setup in a wireless communication network. The RAN element comprises an initiating component configured to initiate access stratum (AS) security context setup for a first radio access technology (RAT) and a second RAT in a common signaling procedure.

[0043] The RAN element may be or include at least one of a radio access network element implementing a first RAT and a radio access network element implementing a second RAT.

[0044] The RAN element may be configured to perform the method of any method step described herein with respect to the first aspect. The RAN element may include or be configured as, or be part of, a radio base station, a radio network controller (RNC), a NodeB, an eNodeB, a 5G radio unit controller or a 5G base station.

[0045] According to a sixth aspect, a core network (CN) element for supporting security context setup in a wireless communication network is provided. The CN element comprises a notification component configured to notify a radio access network (RAN) element of the wireless communication network to initiate access stratum (AS) security context setup for a first radio access technology (RAT) and a second RAT in a common signaling procedure.

[0046] The CN element may be configured to perform a method of any method step described herein with respect to the second aspect.

[0047] According to a seventh aspect, a wireless communication device for supporting security context setup in a wireless communication network is provided. The wireless communication device includes a receiving component and a setting component. The receiving component is configured to receive information from a radio access network (RAN) element in a common signaling process that enables the wireless communication device to set up an access stratum (AS) security context for a first radio access technology (RAT) and a second RAT. The setting component is configured to set up the AS security context for the first RAT and the second RAT.

[0048] The wireless communication apparatus may be configured to perform the method of any method step described herein with respect to the third aspect.The wireless communication apparatus may include or be configured as, or be part of, a user equipment (UE).

[0049] According to an eighth aspect, a wireless communication system is provided. The wireless communication system comprises a RAN element as described herein, a CN element as described herein and one or more wireless communication devices such as user equipment (UE). The wireless communication system may be configured to perform the steps of any aspect of the method aspects as described herein.

[0050] Generally, the steps of any aspect of the method aspects described herein may also be performed in one or more suitable components, devices or units, for example, in suitable components in a RAN element, a CN element, a wireless communication device and / or a wireless communication system. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In the following, the present disclosure will be further described with reference to exemplary embodiments illustrated in the drawings, in which:

[0052] Figure 1 is a flow chart illustrating signaling steps related to LTE security setup;

[0053] Figure 2 is a schematic diagram of an embodiment of a system including an apparatus embodiment of a wireless communication device, an apparatus embodiment of a radio access network element, and an apparatus embodiment of a core network element;

[0054] Figure 3 It is illustrated in Figure 2 A flowchart of an embodiment of a method executed in a system;

[0055] Figure 4 is a schematic diagram of an inter-node interface for a 5G RAN;

[0056] Figure 5 is a schematic diagram of the protocol architecture for the air interface in the 5G RAN;

[0057] Figure 6It is a diagram that can be Figure 2 A flowchart of a combined attach procedure via a single RAT performed in a system;

[0058] Figure 7 is a block diagram schematically illustrating an embodiment of a radio access network element or a wireless communication device or a core network element;

[0059] Figure 8 is a block diagram schematically illustrating yet another embodiment of a radio access network element;

[0060] Fig. 9 is a block diagram schematically illustrating yet another embodiment of a core network element; and

[0061] Fig.10 is a block diagram schematically illustrating yet another embodiment of a wireless communication device. DETAILED DESCRIPTION

[0062] In the following description, for ease of explanation rather than limitation, specific details are set forth, such as a specific network topology including specific network nodes, in order to provide a thorough understanding of the present disclosure. It will be appreciated by those skilled in the art that the present disclosure may be practiced in other embodiments that depart from these specific details. For example, although the present disclosure is described primarily with reference to Long Term Evolution (LTE) as a specific example of a technology for use in a wireless communication network, the present disclosure may be practiced in any network to which a mobile or fixed user using a corresponding user equipment (UE) may attach. For example, the present disclosure is applicable to other cellular networks such as a Global System for Mobile Communications (GSM) network, a Universal Mobile Telecommunications System (UMTS) network, an LTE-Advanced (LTE-A) network, a 5G network, a WiFi network, or a wireless local area network (WLAN) or similar wireless network and combinations thereof.

[0063] Those skilled in the art will further appreciate that the functions explained herein below may be implemented using separate hardware circuitry, using software running in conjunction with a programmed microprocessor or general purpose computer, using an application specific integrated circuit (ASIC) and / or using one or more digital signal processors (DSP). It will also be appreciated that when the present disclosure is described as a method, it may also be implemented in a computer processor and a memory coupled to the processor, wherein the memory is encoded with one or more programs that, when executed by the processor, cause the processor to perform the method disclosed herein.

[0064] Before explaining the embodiments in detail below, some general information about UE context and security settings is given.

[0065] UE context is a generic term used to refer to a set of parameters and / or information associated with a given UE and / or a UE connection towards a given network node. In the case of LTE, for example, there are several types of UE associations required in the eNB as specified in TS 36.401 V12.2.0 (2015-03). In this case, an "eNB UE context" may be used to store all information required for a UE in a connected state and the association between the UE and the logical S1 and X2 connections for S1 / X2-AP UE association messages.

[0066] More specifically, the eNB UE context may be understood in the sense of 3GPP TS 36.401 V12.2.0 (2015-03) as an information block in the eNB associated to one active UE (e.g. in RRC_CONNECTED state). The information block may contain the necessary information required to maintain E-UTRAN services towards the active UE. For example, one or more of UE state information, security information (e.g. algorithms, security keys and parameters), UE capability information (e.g. carrier support, MIMO, transport format, etc.), UE identity (e.g. C-RNTI, S-TMSI) and the identity of the logical S1-connection associated with the UE may be included in the eNB UE context. The establishment of the eNB UE context may be considered completed when the transition to the active state for the UE is completed, or after the handover resource allocation is completed during handover preparation in the target eNB, such as after the handover to E-UTRAN is completed. In LTE, when a dedicated connection between the E-UTRAN and the UE does not exist, no UE context information is stored in the E-UTRAN. This basically means that when the UE moves from RRC_CONNECTED to RRC_IDLE state, the eNB UE context is discarded.

[0067] When a UE is switched on and attached to the network, an MME UE context is created. The MME assigns a unique short temporary identity called SAE Temporary Mobile Subscriber Identity (S-TMSI) to the UE, which identifies the UE context in the MME. The UE context holds the user subscription information downloaded from the Home Subscriber Server (HSS). Local storage of subscription data in the MME allows faster execution of procedures such as bearer establishment, as it removes the need to consult the HSS every time. In addition, the UE context also holds dynamic information, such as a list of established bearers and terminal capabilities.

[0068] To reduce overhead in E-UTRAN and processing in the UE, all UE related information in the access network can be released during long periods of data inactivity. The UE is then in the ECM-IDLE state. The MME retains the UE context and information about the bearers established during these idle state periods. To allow the network to contact the ECM-IDLE UE, whenever the UE moves out of its current tracking area (TA), it updates the network about its current new location; this process is called "Tracking Area Update". When the UE is in ECM-IDLE, the MME is responsible for tracking the user location. In this sense, it can be said that the UE location at the TA level is part of the UE context in the MME.

[0069] When there is a need to deliver downlink data to an ECM-IDLE UE, the MME sends a paging message to all eNBs in its current TA, and the eNBs page the UE over the radio interface. Upon receiving the paging message, the UE performs a service request procedure, which causes the UE to be moved to the ECM-CONNECTED state. UE-related information is thereby created in the E-UTRAN, and the bearer is reestablished. The MME is responsible for the reestablishment of the radio bearer and updating the UE context in the eNodeB. This transition between UE states is called an "idle to active transition".

[0070] The MME is responsible for establishing security for control signaling between the UE and the core network. When the UE attaches to the network, mutual authentication of the UE and the network is performed between the UE and the MME / HSS. This authentication function also establishes the security key K ASME , which is the basis for all subsequent keys derived for use in the RAN.

[0071] The security design of LTE provides compartmentalization. Compartmentalization mainly consists of ensuring that if an attacker breaks the security of one function, only that function is compromised. For example, as explained in the threat analysis, there is one key for encryption of the RRC protocol and another key for integrity protection of the RRC protocol.

[0072] Access Stratum (AS) security consists of integrity protection of the control plane (i.e., RRC signaling) and encryption of both the control and user planes. An integrity protection algorithm is applied to signaling radio bearers (SRBs) (e.g., two signaling radio bearers SRB1 and SRB2). An encryption algorithm is applied to radio bearers (e.g., two signaling radio bearers SRB1 and SRB2 and data radio bearers DRB). On the other hand, neither integrity protection nor encryption is applied to another signaling radio bearer (e.g., signaling radio bearer SRB0).

[0073] If an attacker cracks the Radio Resource Control (RRC) encryption key, the attacker can decrypt and read all RRC messages. However, since the integrity key is different from the encryption key, the attacker cannot modify or inject RRC messages. An attacker who has cracked the RRC encryption key also cannot use it to eavesdrop on the DRBs because they use separate encryption keys (and vice versa).

[0074] Another part of the compartmentalized design is that each eNB uses a separate key set. The rationale is that it ensures that an attacker who breaks into one eNB does not gain any information about the data transmitted between the UE and another physically different eNB. To maintain the property that breaking into one physical RAN node (i.e., eNB) does not help to attack another RAN node, the secondary eNB should use its own key set separate from the key set used in the anchor eNB, however, it can be derived from the anchor eNB as in LTE dual connectivity.

[0075] To explain further, security keys in LTE can be ordered in a hierarchy, where keys at lower levels in the hierarchy are derived from keys at the same or higher levels. The top level key is K, and it has a permanent value stored in the Universal Subscriber Identity Module (USIM) and HSS (Authentication Center, AuC). From this K, the cipher key (CK) and integrity key (IK) are derived during the authentication process run between the UE and HSS / MME. From CK / IK, the UE and HSS derive a key called K ASME The HSS forwards K to the MEE ASME In MME from K ASME Derived NAS (between MME and UE) key (K NASint , K NASenc ) and K eNB . In the eNB, the K forwarded by the MME to the eNB eNB Derive AS (between eNB and UE) security key (K RRCint , K RRCenc , K UPenc ).

[0076] Now relative to Figure 1 , describes further details of the security design principles. That is, the following describes and Figure 1 The different steps for security configuration in the EPC are shown in FIG.

[0077] In step 1, the UE attaches to the MME for LTE services. To this end, the MME receives an attach request (UE network capabilities indicating supported LTE security algorithms, IMSI) from the UE to obtain initial access to the network.

[0078] In step 2, the MME authenticates the UE and derives K ASME To do this, the MME requests an authentication vector (AV) associated with the International Mobile Subscriber Identity (IMSI) by sending an authentication data request to the AuC / HSS. ASME After receiving the authentication token (AUTN) (derived from CK, IK and PLMN ID), AuC combines them into an authentication vector (AV=RAND||XRES||K ASME ||AUTN) and sends it to the MME attached within the Authentication Data Response.

[0079] Then, MME retrieves K from AV ASME , Random (RAND), Expected Response (XRES), and AUTN. The MME sends AUTN and RAND along with the Authentication Request to the UE. The UE authenticates the network by checking the received AUTN. It then derives IK, CK (and K from CK / IK) ASME ), RES, AUTN and RAND. It sends a response (RES) together with the authentication response. After receiving the RES, the MME compares it with the XRES, and if it matches, the authentication is considered successful (otherwise, the MME sends an authentication failure to the UE). Then, the MME derives K NASint , K NASenc The input to the key derivation is the specific NAS cipher and integrity algorithm selected by the MME based on the UE network capability information included in the received Attach Request message. Finally, the MME will use the NAS cipher and integrity algorithm selected by the MME based on the UE network capability information included in the received Attach Request message. ASME The downlink NAS counters of NAS messages protected by the derived keys are set to zero and the NAS Security Mode Command (including the K ASME Identifier (KSI ASME ), integrity algorithm, encryption algorithm, UE security capability, NAS-MAC). Here, K NASint The UE generates a NAS-MAC (message authentication code for NAS) for the integrity protection of the entire message using the selected integrity algorithm. After receiving the NAS security mode command, the UE will ASME Identifier (KSI ASME ) is set to its KSI ASME , and use it as the current K ASME Identifier of; calculate K ASME , K eNB , K NASint , K NASenc; and verify the integrity of the Security Mode Command message via XNAS-MAC. The UE then sends a NAS Security Mode Complete to the MME in an integrity protected message (similarly via NAS-MAC).

[0080] MME from K ASME Export K eNB , and sends K to the eNB eNB UE from K ASME Export K eNB , in order to calculate other security keys and activate security.

[0081] In step 3, after receiving the NAS security mode completion from the UE, the MME calculates K eNB , and combine it with additional UE security capabilities and K eNB S1AP Initial Context Setup Request is sent to eNB together with the S1AP Initial Context Setup Request. eNB Then, eNB calculates K from it RRCint , K RRCenc , K UPenc It then sends the AS Security Mode command, which includes the AS integrity and encryption algorithms and the AS security mode command using K RRCint Generate MAC-I (Message Authentication Code for Integrity). Here, the message is integrity protected and not encrypted. After receiving the AS Security Mode Command, the UE identifies the security algorithm; calculates K RRCint , K RRCenc , K UPenc ; and verify the integrity of the security mode command message through XMAC-I. Finally, the UE sends the AS security mode completion message to the eNB under the condition of using MAC-I for integrity protection.

[0082] It should be noted that after the steps given above, most NAS and AS messages will be integrity protected and encrypted, except for user data which will only be encrypted.

[0083] The RRC configuration for the AS security keys will now be described. The RRC configures all PDCP entities associated with it. Specifically, the RRC configures the PDCP entities with encryption keys and configuration data, such as which security algorithms to apply. The key set in the eNB consists of the K eNB , and K UPenc , K RRCenc and K RRCint RRC configures the encryption key K for each PDCP entity used for user plane services (DRB) UPenc , and configure an encryption key K for each PDCP entity used for control plane services (SRB) RRCencand an integrity protection key K RRCint For DRBs used to protect data between the donor eNB and the relay node, RRC also configures the DRB with an integrity protection key K UPint .

[0084] AS security activation can be described as follows. The AS security mode command procedure starts security for radio bearers (RBs) between the eNB and the UE. Following this procedure, security is active until the UE or eNB terminates the RRC connection. This implies that when the eNB establishes a new DRB via the RRC reconfiguration procedure, security is already active and the eNB and UE will cipher PDCP packets on the DRB from the beginning.

[0085] As above relative to Figure 1 As described, current signaling procedures have not been designed or at least optimized to support a RAN architecture consisting of multiple air interfaces, where these air interfaces can have some different aspects in their UE context.

[0086] An example may include security contexts that are different for different RATs (although tightly integrated) or standard releases or UE capabilities or device classes. For example, there may be different length requirements for security keys for different RATs, or network termination may be in separate nodes requiring separate key sets.

[0087] As above relative to Figure 1 As explained, signaling bearer establishment and / or data bearer establishment and / or signaling bearer and / or data bearer resumption require a large number of signaling steps, resulting in, for example, signaling overhead and / or long signaling duration, especially when tight integration of multiple air interfaces is adopted. This is the case even when the first RAT and the second RAT connection of the UE are to be towards the same or, in other words, shared radio node and / or core network node.

[0088] Figure 2 An embodiment of a wireless communication system 20 is shown that includes an embodiment of a wireless communication device 100 , an embodiment of a radio access network (RAN) element 200 , and an embodiment of a core network (CN) element 300 .

[0089] The wireless communication apparatus 100 is adapted to support security context setup in a wireless communication network.The wireless communication apparatus 100 may be or include, or be a part of, a user equipment (UE) operable according to LTE or LTE-A.

[0090] The wireless communication device 100 includes a receiving component 120 and a setting component 140. The wireless communication device 100 may further include a transmitting module 160. The receiving component 120 is configured to receive information from a RAN element (e.g., RAN element 200) in a common signaling process that enables the wireless communication device 100 to set up an access stratum (AS) security context for a first radio access technology (RAT) and a second RAT. The setting component 140 is configured to set up the AS security context for the first RAT and the second RAT. The receiving component 120 may be configured to receive additional information from a RAN element, such as RAN element 200, and / or a CN element, such as CN element 300. The transmitting component 160 may be configured to transmit information to a RAN element, such as RAN element 200, and / or a CN element, such as CN element 300.

[0091] The RAN element 200 is adapted to support security context setup in a wireless communication network.The RAN element 200 may be or include an eNodeB, or be part of an eNodeB in the case of LTE or LTE-A.

[0092] The RAN element 200 includes an initiating component 220. The RAN element 200 may further include a receiving component 240 and / or an deriving component 260. The initiating component 220 is configured to initiate access stratum (AS) security context setup for a first radio access technology (RAT) and a second RAT in a common signaling process. The receiving component 240 may be configured to receive information from a wireless communication device (e.g., from the wireless communication device 100) or a CN element (e.g., the CN element 300). The deriving component 260 may be configured to derive certain information, for example, from the received information.

[0093] The CN element 300 is adapted to support security context setup in a wireless communication network. The CN element 300 may be or include a Mobility Management Entity (MME) in the case of LTE or LTE-A, or be a part of an MME.

[0094] The CN element 300 includes a notification component 320. The CN element 300 may further include a receiving component 340 and an exporting component 360. The notification component 320 is configured to notify a RAN element of the wireless communication network, such as the RAN element 200, to initiate access stratum (AS) security context setup for a first radio access technology (RAT) and a second RAT in a common signaling process. The receiving component 240 may be configured to receive information from a wireless communication device (e.g., from the wireless communication device 100) or a RAN element (e.g., the RAN element 200). The exporting component 360 may be configured to, for example, export certain information from the received information.

[0095] The following will be relative to Figure 3The wireless communication device 100 , the RAN element 200 , and the CN element 300 are further described.

[0096] Figure 3 Show that it is possible to Figure 2 In more detail, Figure 3 The first step S302 shows that it is possible to Figure 2 The CN element 300 is implemented in the method embodiment, Figure 3 The second step S304 shows that it is possible to Figure 2 The method embodiment is implemented in the RAN element 200, and Figure 3 The third step S306 and the fourth step S308 show that it is possible to Figure 2 A method embodiment implemented in the wireless communication device 100.

[0097] Figure 3 A method is provided for supporting security context setup in a wireless communication network, the method comprising notifying.

[0098] In step S302, a CN element of the wireless communication network, such as the CN element 300, notifies a RAN element of the wireless communication network, such as the RAN element 200, to initiate AS security context setup for the first RAT and the second RAT in a common signaling procedure. For example, the notification component 320 of the CN element 300 notifies a RAN element of the wireless communication network, such as the RAN element 200, to initiate AS security context setup for the first RAT and the second RAT in a common signaling procedure in step S302.

[0099] In step S304, a RAN element of the wireless communication network, such as the RAN element 200, initiates AS security context setup for the first RAT and the second RAT in a common signaling procedure. For example, the initiating component 220 of the RAN element 200 initiates AS security context setup for the first RAT and the second RAT in a common signaling procedure in step S304.

[0100] In step S306, a wireless communication device, such as the wireless communication device 100, of the wireless communication network receives information from a RAN element, such as the RAN element 200, of the wireless communication network in a common signaling process that enables the wireless communication device, such as the wireless communication device 100, to set up an AS security context for the first RAT and the second RAT. For example, the receiving component 120 of the wireless communication device 100 receives information from a RAN element, such as the RAN element 200, of the wireless communication network in a common signaling process that enables wireless communication, such as the UE 100, to set up an AS security context for the first RAT and the second RAT. In step S308, the wireless communication device, such as the wireless communication device 100, sets up the AS security context for the first RAT and the second RAT. For example, the setting component 140 of the wireless communication device 100 sets up the AS security context for the first RAT and the second RAT in step S308.

[0101] The present disclosure is described below mainly within the context of LTE. It should be understood that the problems and solutions described herein are equally applicable to wireless access networks and user equipment (UE) implementing other access technologies and standards. Therefore, LTE is used as an example technology, in which the proposed technology is suitable, and therefore the use of LTE in the following content is useful for understanding the technology described herein. Therefore, in the following content, for ease of explanation rather than limitation, the radio access network element 200 will be referred to as eNB 200 to illustrate by example that the radio access network element 200 can be configured as a base station, and the technology proposed herein can be used and implemented in LTE. Similarly, the wireless communication device 100 will be referred to as UE 100 to illustrate by example that the technology proposed herein can be used and implemented in LTE. Similarly, the CN element 300 will be referred to as MME 300 to illustrate by example that the CN element 300 can be configured as a mobility management entity, and the technology proposed herein can be used and implemented in LTE.

[0102] Similarly, the context information will be referred to as eNB UE context. The eNB UE context may be understood in the sense of 3GPP TS 36.401 as an information block in the eNB associated to one active UE. The information block may contain the necessary information required to maintain E-UTRAN services towards the active UE. For example, one or more of UE state information, security information, UE capability information, and the identity of the UE-associated logical S1-connection may be included in the eNB UE context. The establishment of the eNB UE context may be considered completed when the transition to the active state for the UE is completed, or after the handover to E-UTRAN is completed in the target eNB.

[0103] Below relative to Figures 6 to 10 , describes further exemplary details about UE 100, eNB 200, MME 300, and system 20 including UE 100, eNB 200, MME 300, and methods performed therein. Before explaining these details, see Figure 4 and 5 Briefly explain some general information about the concepts of 5G RAN architecture.

[0104] To meet 5G requirements in terms of data rates and latency, new air interfaces designed to operate in higher frequencies (e.g., above 6 GHz) are needed. Compared to the current bands allocated to LTE, there are far more challenging propagation conditions, and therefore, coverage of the new air interfaces can be spotty. To overcome the propagation challenges highlighted earlier, extensive use of beamforming, in particular on the network side, is an essential part of high-frequency wireless access. Despite the potential link budget gains, the reliability of systems relying purely on beamforming and operation in higher frequencies may be challenging (coverage may be more sensitive to temporal and / or spatial variations).

[0105] To support applications requiring extremely low latency (around 1ms), such as some ultra-reliable machine type communication use cases, a new time domain structure based on shorter transmission time intervals (TTIs) and wider bandwidths for radio resource blocks than those specified for LTE is likely to be defined for the new 5G air interface.

[0106] In parallel with 5G research activities, 3GPP is continuously adding new features to LTE, and it is likely that by the time 5G enters the market, LTE will be able to address many of the 5G requirements. In addition, LTE is also expected to be heavily deployed, and the fact that it operates in a frequency band with better propagation properties makes tight integration of LTE and a new air interface operating in a higher frequency band very attractive.

[0107] Regarding the 5G RAN architecture, there are currently some ongoing discussions among different parties about architectural alternatives to achieve such tight integration. In some discussions, such as in the EU project METIS-II, it is assumed that, unlike the current interworking between different network accesses, there will be common functionality in the RAN protocol stack. In the current system, unlike this assumption, interworking relies on inter-node interfaces for both the user plane (UP) and the control plane (CP). For example, in the case of E-UTRAN and UTRAN interworking, the MME and S-GW are interconnected via the S11 interface. Such an architecture basically allows coverage continuity and load balancing only via hard switching for multiple air interfaces (always involving core network signaling) and semi-independent resource management. The details between the interworking between E-UTRAN and UTRAN can be found in, for example, TS 36.300 V13.1.0 (2015-09) or other versions thereof.

[0108] To achieve tight integration between LTE and the new 5G air interface, such as Figure 5 It is proposed in a logical architecture that relies on a common RRC / PDCP protocol layer as shown in (see "Tight integration of new 5G airinterface and LTE to fulfill 5G requirements", VTCSpring 2015 - 1stInternational Workshop on 5G Architecture, Glasgow, Scotland). "AI" stands for air interface, which is sometimes referred to as NX, 5G NX or simply 5G in the following content.

[0109] Figure 4 A possible embodiment for a common inter-node interface is shown in FIG.

[0110] Now in Figure 6 Explanation Figure 2 and 3 More specifically, as in Figure 6 As illustrated in FIG. 1 , the following contents may be performed by UE 100 and / or eNB 200 and / or MME 300. For the purpose of illustration and not limitation, the first RAT (RAT1) and the second RAT (RAT2) are provided by the same eNB, namely, Figure 62 and 3. The eNB 200 in the embodiment of the present invention supports RAT1 and RAT2. However, this is not to be construed as limiting. On the contrary, RAT1 and RAT2 may be supported by different eNBs, for example, eNB 200 supports RAT1, and different eNBs support RAT2. Therefore, the present disclosure is equally applicable regardless of whether one BS implements two RATs or whether the two RATs are implemented separately in different BSs. It is assumed that there is only one RAN-CN connection per UE for the two RATs. The first RAT and the second RAT can be combined in one BS, or can be distributed to two separate BSs. In the case of separate BSs for the first and second RATs, before the following method, the BS of the second RAT notifies the BS of the first RAT about the security capabilities of the BS for the second RAT. Further, as mentioned above, in the case of separate BSs for the first and second RATs, the BS of the second RAT does not need a connection to the CN.

[0111] In the following it is explained how to handle UE security context via a common procedure (assuming a tightly integrated scenario with multiple air interfaces such as LTE and another RAT) to enable fast, efficient and secure connection establishment for multiple RATs (e.g. 4G and 5G), regardless of which access technology was initially in use (e.g. for the attach procedure). Here, 5G may refer to LTE evolution or another RAT that can be assumed to be 5G.

[0112] The security context may include security capabilities, keys, algorithms and available parameters. For some procedures, a subset of the multi-RAT security context (e.g., security keys, parameters or algorithms) may be the same (for different RATs) to minimize context overhead and processing. However, even if the relevant procedures are the same or similar for different RATs, this may not always be the case. For example, if the RATs are not co-located in a secure physical node, even if the same type of key material and relevant procedures can be reused, a context transformation may be required in order not to destroy the compartmentalization principle mentioned in the background section.

[0113] Accordingly, the UE 100 is capable of attaching as "LTE only" or "5G only" or as "combined LTE and 5G". In the case of a combined 5G and LTE attachment (e.g., via a 5G RAT), the methods included herein include as with respect to Figure 6 One or more of the steps explained in the following.

[0114] Relative to Figure 6In a first step step1, the UE 100 attaches to the CN for both 5G and LTE services. To this end, the UE 100 sends (e.g., in an attach message) its context information about security capabilities for both RAT1 and RAT2 (e.g., supported security algorithms via the UE network capability information available in the attach request) to the CN 300 (referring to the logical CN function and / or CN network element that processes the attach request, such as the MME 300) when it attaches over RAT1 (step S602). Accordingly, the UE 100 is indicated as a LTE+5G UE in the attach request. In other words, when sending an initial L3 message to CN 300 (e.g., ATTACH REQUEST for the purpose of CN attachment; Tracking Area Update (TAU) request for notifying the CN about IDLE mode mobility events via the first RAT), UE 100 notifies CN 300 (in the following content, it will sometimes refer to MME 300, which is generally referred to as a CN element or just CN 300 for short) about its security capabilities in terms of the first RAT and the second RAT.

[0115] As stated above, the UE 100 can include indicators for LTE as well as for 5G services. Thus, the CN 300 can trigger the RAN element 200 to a combined activation as described herein. To complete the security setup description, the UE 100 can include its LTE security capabilities. There are supported encryption and integrity algorithms for different access types. The indication of the attach type can be implicit to the UE which capabilities to include in the attach message. In general, it can be beneficial to maintain the UE security capabilities for all RATs supported by the UE in the CN for future inter-RAT handovers.

[0116] After informing the CN 300 about the UE 100 security capabilities, security setup for NAS (UE-CN for signaling) is performed in step 2. To this end, the CN 300 requests authentication of the UE 100 in a NAS Authentication Request message (step S606), and derives CN key material (common for both RATs or separate for each RAT). The UE verifies the authenticity of the authentication request and replies with an Authentication Response message (step S608), and derives the corresponding CN key material. In other words, the CN 300 authenticates the UE 100 for both 5G and LTE services, and derives CN-level keys (e.g., K ASME). In more detail, the CN 300, such as the MME 300, requests an authentication vector (AV) related to the International Mobile Subscriber Identity (IMSI) by sending an authentication data request to the AuC / HSS 400 (step S604). Here, the AV can be a dual vector related to both 5G and LTE. In addition, the AuC 400 recognizes that the UE 100 is a dual RAT UE 100. The CN retrieves security keys and parameters from the dual AV related to both 5G and LTE. In step S606, the CN 300 sends an authentication request to the UE 100, which is valid for both 5G and LTE. The UE 100 authenticates the CN 300 by checking the received security parameters, deriving security keys and other parameters. The derivation is performed for both NX and LTE. In this way, the UE 100 will run a common or separate authentication algorithm at the same time, and prepare a single message (e.g., an authentication response) in step S608.

[0117] When the UE 100 sends the authentication response message, and when the CN 300 receives the authentication response message, the UE 100 and the CN 300 consider that the authentication is completed for both RATs. The CN 300 derives additional CN key material for integrity protection and encryption of NAS communications, and sends information enabling the UE 100 to derive the additional CN key material to the UE 100 in the NAS Security Mode Command message (step S610). This information may correspond to some information from which the CN key material, the RAN key material, or both can be derived. The message may include an indication that the CN and / or RAN key material is for the first RAT, the second RAT, or both. The UE 100 derives the additional CN and RAN key material, and replies to the CN 300 in the NAS Security Mode Command Complete message (step S612) to confirm to the CN 300 that the process was successfully completed at the UE 100. In this regard, deriving the key material does not necessarily need to be performed immediately, but is typically derived when it is first used (the encryption key does not need to be calculated by the sender before the first message is encrypted).

[0118] Explaining further, the CN 300 verifies the authentication for both 5G and LTE, and derives keys and further parameters based on a security algorithm that can be selected common or separate for both RATs. The CN 300 then sends a NAS Security Command in step S610 with the relevant security parameters, capabilities and integrity protection for both LTE and 5G. Upon receiving a NAS Security Mode Command valid for both RATs, the UE 100 is able to derive further security keys and parameters; and verify the integrity of the Security Mode Command message. The UE 100 then sends a NAS Security Mode Complete to the CN 300 in step S612 with the relevant security parameters, capabilities and integrity protection for both LTE and 5G.

[0119] After the CN key material is derived, security setup for the AS (UE-RAN for signaling and user plane) is performed in step step3. To this end, the CN 300 derives RAN key material (common for both RATs or separate for each RAT) from the CN key material and sends the RAN key material to the RAN element 200 (sometimes also referred to as eNB200 in the following) in step S614, for example in an S1AP UE Initial Context Setup message (at NAS level). If the eNB 200 has not yet received the RAN key material for the second RAT, the eNB 200 derives this RAN key material from the RAN key material for the first RAT. Subsequently, the eNB 200 sends information to the UE 100, for example in an AS Security Mode Command message, enabling the UE 100 to derive the RAN key material and activate AS security for both RATs (step S616). The UE 100 derives this RAN key material and informs the eNB 200 of the first RAT or the eNB 200 of the second RAT in its AS Security Mode Complete message (e.g., piggybacked in an RRC message). If the message is sent to the base station of the second RAT, the base station of the second RAT sends an X2AP indication to the base station of the first RAT. This indication indicates to the base station of the first RAT that security is established for both RATs.

[0120] To further explain, CN 300 is derived from a common (eg, K ASME ) or separate CN-level key material derived for both 5G and LTE security (e.g., K eNB ) or separate RAN-level key material, and sends the derived RAN-level key material to the RAN element 200 (step S614). The UE 100 also derives the same RAN-level key material (e.g., from K ASME Export K eNB) in order to calculate other security keys and activate end-to-end security for both 5G and LTE services. After receiving the NAS security mode completion from the UE 100 in step S612, the CN sends the RAN level key material for both LTE and 5G (e.g., common K ) to the RAN element 200 in step S614 by attaching the UE security capabilities and the S1AP initial context setup request with the LTE and 5G keys or the common RAN level key material for both LTE and 5G. eNB ). In this way, the CN 300 presents a dual security context to the RAN element 200. After receiving the RAN-level key material, the RAN element performs an integrity check and calculates the required AS keys and parameters for both LTE and 5G from it. Subsequently, in step S616 it sends a common AS security mode command with the required security parameters for both LTE and 5G with integrity protection. In this way, combined activation can be achieved. After receiving the AS security mode command, the UE 100 identifies the security algorithm and calculates the AS security keys for both LTE and 5G; and verifies the integrity of the security mode command message. Finally, in step S618, the UE 100 sends a common AS security mode complete to the RAN element with integrity protection.

[0121] RAN element 200 from K eNB NX keys are derived and the 5G keys are used as the basis for any encryption and integrity keys that should be used on 5G. Some variations on the steps given above may be possible. For example, instead of directly deriving 5G and LTE keys or a common K in which the MME 300 eNB (For example, from the shared K ASME ), and provides the derived situation to the RAN element 200, which can also obtain the derived situation from K eNB 5G keys are derived and can be used as a basis for any encryption and integrity keys that should be used on 5G. This may be mandatory especially when 5G and LTE RATs are not co-located (due to compartmentalization principles).

[0122] Note that sending information from which the RAN keys can be derived from the CN element 300 to the UE 100 is one option. Another option is to send such information from the RAN element 200 to the UE 100. It is also possible that both pieces of information are sent and the RAN keys are derived from both of them.

[0123] As described above, if some steps are considered to be transparent to the RAN, for example, in particular when common key material, algorithms are used to set up multiple RAT security, then the CN may need to explicitly indicate to the RAN what is to be done. Similarly, it may be necessary to explicitly confirm to the UE 100 which RAT security is to be activated, for example via a security mode command. The decision on the AS security context to be created and activated can be made at the RAN or CN level. Despite the indication of the dual RAT security capability of the UE 100, the RAN element 200 or the CN element 300 may refuse security setup for a specific RAT. In this case, the MME 300 or the eNB 200 can provide a clear indication of the RAT security to be activated. Figure 6 The one shown in only responds to one RAT (eg RAT1 security), implicitly confirming the rejection of security setup (eg RAT2 security).Alternatively, any rejection or failure message can be signaled within a dedicated signaling procedure.

[0124] exist Figure 6 In a variation of , even if the MME 300 is able to successfully authenticate the UE 100 for both RATs and create the required context, the security activation for a certain RAT and security (e.g., AS security for RAT2) can be postponed. This can be due to mobility, traffic load, security policy or any other reason, for example.

[0125] As explained herein, multi-RAT contexts for security are handled via a common process to enable fast, efficient, and secure connection establishment for multiple RATs. Accordingly, the UE can request multi-RAT security settings, and the network (NW) can run a single process (e.g., security mode command) to activate security for both LTE and 5G. In order to be able to do this, the NW may need to obtain the required information from another network element related to both LTE and 5G for this UE.

[0126] In this document, a mechanism for simultaneous signaling is described regarding security set up between a network and a UE for two or more RATs (e.g., LTE, 5G). Activation of security may or may not be done for both RANs simultaneously. Security is activated for both layers. The first layer is between the UE and a CN node, and the second layer is between the UE and a RAN node. The mechanism includes mutual authentication between the UE and the CN by means of a first single NAS procedure. Further, the second CN node informs the UE whether security will be activated for two or more RATs simultaneously in a single procedure for the first NAS layer. The first and second CN nodes can be the same. The notification may also indicate whether security will be activated for the second layer (AS for two or more RATs). If the notification does not apply to the AS, the RAN node activates security for the AS using the AS procedure.

[0127] Without the procedures described herein, for each UE to CN connection, there may be a security setup between the UE and the CN, and for LTE there may additionally be a separate AS security setup. For example, for LTE and 3G, it would be necessary to run the same Figure 6 In the case where the UE is connected to a 3GPP RAT and is then handed over to a second RAT, the UE and the CN node must first run signaling to establish security for the first RAT, and then during the handover, they need to perform further signaling to establish security for the second RAT. In the case where the UE performs a handover from LTE to 3G, the UE does not perform security establishment for 3G, but trusts the same security parameters used in LTE. In other words, there is no security setup for 3G.

[0128] Through the procedures described herein, security context setup for a UE capable of adopting two RATs can be processed simultaneously for the two RATs in a single process per layer to reduce signaling overhead. Further, the security context setup can include an authentication process, a NAS (CN-UE) activation process, and an AS activation process (RAN-UE), each of which can use a common process for the two RATs. Further, a single AS security mode command request from the BS to the UE for the two RATs can be activated in the UE security for the two RATs. Still further, a single NAS security mode command request from the CN to the UE for the two RATs can be activated in the UE security for the CN keys for the two RATs, and the UE may be informed as to whether the AS security mode command should be applied to one or both of the RATs.

[0129] In this paper, a method is described to handle UE security context via a common process assuming a tightly integrated scenario with multiple air interfaces such as LTE and 5G. The method can be summarized as follows:

[0130] 1. The UE attaches to the CN for both 5G and LTE services.

[0131] 2. The CN authenticates the UE for both 5G and LTE services and derives CN-level keys (e.g., K ASME ).

[0132] 3.a. CN from shared (e.g., K ASME ) or separate CN-level key material derived for both 5G and LTE (e.g., K eNB ) or separate RAN-level key material; and sending the derived RAN-level key material to the RAN element. The UE similarly derives the same key material (e.g., from K ASME Export K eNB ) in order to calculate other security keys and activate end-to-end security for both NX / 5G and LTE services.

[0133] b. RAN components from K eNB NX / 5G keys are derived and the 5G keys are used as the basis for any encryption and integrity keys that should be used on 5G.

[0134] Here, CN refers to a logical CN function and / or a CN network element, eg handling an attach request, and a RAN element indicates a RAN node or a logical function where a multi-RAT connection (like a common RRC entity) is terminated on the network side.

[0135] Thus, signaling for the security of the second RAT is reduced, e.g. to a minimum. Compartmentalization of RAN keying material at the same security level as LTE dual connectivity can be ensured. That is, an attacker who obtains keying material for the second RAT will not have access to keying material for the first RAT, but an attacker who obtains keying material for the first RAT will be able to derive keying material for the second RAT.

[0136] By the techniques described herein, a more efficient way of handling security contexts and related security procedures for multiple RATs is provided. Therefore, its signaling overhead and energy consumption can be reduced. The signaling reduction occurs when the UE sets up dual or multiple connectivity in dual or multiple RATs, respectively, so that the security context of the second RAT is already prepared. The security parameters for the second RAT can be piggybacked on the security procedures applied for the first RAT.

[0137] Creating the security context for dual / multi RATs in advance also means that the user plane can be enabled faster when switching from one RAT to another.

[0138] Relative to Figure 7 To summarize the above relative to Figures 2 to 6 Explain the details. Figure 7 is a block diagram schematically illustrating an apparatus embodiment of a network element 2 supporting security context setup in a wireless communication network.

[0139] As an example, the network element 2 is described as implementing Figure 2 The functionality of the radio access network element 200 of an embodiment of the invention is shown. The radio access network element 2 comprises a memory 4 and a processor 6 coupled to each other. The radio access network element may further comprise an optional interface coupled to the processor 6. The memory 4 contains control instructions executable by the processor 6.

[0140] The processor 6 is configured to initiate access stratum (AS) security context setup for the first radio access technology (RAT) and the second RAT in a common signaling process. The interface may be configured to perform any communication with other components of the communication network. For example, the interface may transmit information to other components of the communication network and / or may receive information from other components of the communication network.

[0141] Alternatively, the network element 2 is described as implementing the Figure 2 The functionality of the core network element 300 of an embodiment of the present invention. The radio access network element 2 includes a memory 4 and a processor 6 coupled to each other. The radio access network element may further include an optional interface coupled to the processor 6. The memory 4 contains control instructions executable by the processor 6. The processor 6 is configured to notify a radio access network (RAN) element of the wireless communication network to initiate an access stratum (AS) security context setting for a first radio access technology (RAT) and a second RAT in a common signaling process. The interface may be configured to perform any communication with other components of the communication network. For example, the interface may transmit information to other components of the communication network and / or may receive information from other components of the communication network.

[0142] Alternatively, the network element 2 is described as implementing the Figure 1Functionality of the wireless communication device 100 of an embodiment of the present invention. The radio access network element 2 includes a memory 4 and a processor 6 coupled to each other. The radio access network element may further include an optional interface coupled to the processor 6. The memory 4 contains control instructions executable by the processor 6. The processor 6 is configured to receive information from a radio access network (RAN) element of a wireless communication network in a common signaling process, enabling wireless communication to set up an access stratum (AS) security context for a first radio access technology (RAT) and a second RAT. The processor is further configured to set up the AS security context for the first RAT and the second RAT.

[0143] Figure 8 FIG. 2 is a functional block diagram of a radio access network element 20 configured according to the principles of the present disclosure as described above. The functional blocks of the network element 20 may be implemented by hardware, software, or a combination of hardware and software to perform the principles of the present disclosure. Those skilled in the art will appreciate that in Figure 8 The functional blocks described in the embodiment can be combined in one or more blocks, or separated into sub-blocks to implement the principles of the present disclosure as described above. Therefore, the description herein can support any possible combination or separation or other definitions of the functional blocks described herein.

[0144] Figure 8 The radio access network element 20 is configured to support security context setup in a wireless communication network. The network element 20 comprises an initiating module 22 for initiating access stratum (AS) security context setup for a first radio access technology (RAT) and a second RAT in a common signaling procedure.

[0145] The network element 20 may include a receiving module 24. The receiving module is configured to receive, by the RAN element, a first RAN key material from a core network (CN) element of the wireless communication network. The first RAN key material enables the RAN element to initiate an AS security context setup for a first RAT. The receiving module is further configured to receive, by the RAN element, a second RAN key material from a CN element of the wireless communication network. The second RAN key material enables the RAN element to initiate an AS security context setup for a second RAT.

[0146] The receiving module may be used to receive, by the RAN element, a first RAN keying material from a CN element of the wireless communication network. The first RAN keying material enables the RAN element to initiate an AS security context setup for a first RAT. The network element 20 may further include an exporting module for exporting, by the RAN element, a second RAN keying material from the received first RAN keying material. The second RAN keying material enables the RAN element to initiate an AS security context setup for a second RAT.

[0147] The network element 20 may further include a transmitting module 26 for transmitting, by the RAN element, the common AS security mode command message for the first RAT and the second RAT to a wireless communication device of the wireless communication network.

[0148] The receiving module may be further configured to receive, by the RAN element, an AS security mode complete message notifying the RAN element of completion of the AS security context setup for the first RAT and the second RAT.

[0149] Network element 20 may correspond to a RAN element that implements a first RAT, and may correspond to or be different from a RAN element that implements a second RAT.

[0150] Fig. 9 1 is a functional block diagram of a core network element 40 configured according to the principles of the present disclosure as described above. The functional blocks of the network element 40 may be implemented by hardware, software, or a combination of hardware and software to perform the principles of the present disclosure. Fig. 9 The functional blocks described in the embodiment can be combined in one or more blocks, or separated into sub-blocks to implement the principles of the present disclosure as described above. Therefore, the description herein can support any possible combination or separation or other definitions of the functional blocks described herein.

[0151] Fig. 9 The core network element 40 supports security context setup in a wireless communication network. The core network element 40 includes a notification module 42 for notifying a radio access network (RAN) element of the wireless communication network to initiate access stratum (AS) security context setup for a first radio access technology (RAT) and a second RAT in a common signaling process.

[0152] The core network element 40 may include a receiving module 44 for receiving, by the CN element, information from the wireless communication device regarding security capabilities of the wireless communication device regarding the first RAT and the second RAT.

[0153] The core network element 40 may include an initiating component 46 for initiating, by the CN element, non-access stratum (NAS) security context setup for the first RAT and the second RAT in a common signaling procedure.

[0154] The initiating module may be further configured to initiate NAS security context setup, including requesting, by the CN element, that the wireless communication device perform authentication with the CN element.

[0155] The core network element 40 may include a derivation module 48 for deriving, by the CN element, CN key material that enables the wireless communication device to perform authentication for the first RAT and that enables the wireless communication device to perform authentication for the second RAT.

[0156] The core network element 40 may include a transmission module 50 for transmitting CN key material from the CN element to the wireless communication device.

[0157] The receiving module may be further configured to receive, by the CN component, an authentication response message from the wireless communication device.

[0158] The export module may be further configured to export CN key material used for integrity protection and encryption of NAS communications by the CN element.

[0159] The transmitting module may be further operable to transmit, by the CN element to the wireless communication device, a NAS security mode command message for the first RAT and the second RAT, the NAS security mode command message enabling the wireless communication device to derive CN key material for integrity protection and encryption of NAS communications.

[0160] The receiving module may be further configured to receive, by the CN element, a NAS security mode complete message for the first RAT and the second RAT from the wireless communication device.

[0161] Fig.10 1 is a functional block diagram of a wireless communication device 60 configured according to the principles of the present disclosure as described above. The functional blocks of the wireless communication device 6 may be implemented by hardware, software, or a combination of hardware and software to perform the principles of the present disclosure. Fig.10 The functional blocks described in the embodiment can be combined in one or more blocks, or separated into sub-blocks to implement the principles of the present disclosure as described above. Therefore, the description herein can support any possible combination or separation or other definitions of the functional blocks described herein.

[0162] Fig.10 The wireless communication device 60 supports security context setup in a wireless communication network. The wireless communication device 60 includes a receiving module 62 for receiving information enabling wireless communication to setup an access stratum (AS) security context for a first radio access technology (RAT) and a second RAT from a radio access network (RAN) element of the wireless communication network in a common signaling process. The wireless communication device 60 further includes a setup module 64 for setting the AS security context for the first RAT and the second RAT.

[0163] The receiving module may be further configured to receive, by the wireless communication device, a common AS security mode command message for the first RAT and the second RAT from a RAN element of the wireless communication network.

[0164] The wireless communication device 60 may further include a transmitting module 66 for transmitting, by the wireless communication device, an AS security mode complete message to the RAN element, wherein the AS security mode complete message notifies the RAN element of the completion of the AS security context setup for the first RAT and the second RAT.

[0165] The transmitting module may be further configured to transmit, by the wireless communication device, information about security capabilities of the wireless communication device regarding the first RAT and the second RAT to a core network CN element of the wireless communication network.

[0166] The receiving module may be further configured to receive, by the wireless communication device, a request from the CN element to perform authentication towards the CN element.

[0167] The transmitting module may be further configured to transmit an authentication response message from the wireless communication device to the CN element.

[0168] The receiving module may be further configured to receive, by the wireless communication device, a NAS security mode command message for the first RAT and the second RAT from the CN element, and to derive, by the wireless communication device, CN key material for integrity protection and encryption of NAS communications for the first RAT and the second RAT from the received NAS security mode command message.

[0169] The transmitting module may be further configured to transmit, by the wireless communication device to the CN element, a NAS security mode complete message for the first RAT and the second RAT.

[0170] From the foregoing description, the many advantages of the present disclosure will be fully appreciated, and it will be apparent that various changes may be made in the form, construction and arrangement of the units and devices without departing from the scope of the present disclosure and / or without sacrificing all of its advantages. Since the present disclosure can be varied in many ways, it will be appreciated that the present disclosure should be limited only by the scope of the appended claims.

Claims

1. A method implemented by a base station to support security context setup in a wireless communication network, wherein a wireless communication device in the wireless communication network is capable of communicating using a first radio access technology (RAT) and a second RAT different from the first RAT, the method comprising: obtaining, by the base station, key materials for the first RAT and the second RAT from a core network (CN) element of the wireless communication network; as well as Access stratum AS security context setup for the first RAT and the second RAT is initiated by the base station in a single signaling procedure based on the key material.

2. The method of claim 1, wherein: Obtaining the key material for the first RAT and the second RAT includes: receiving, by the base station from a core network (CN) element of the wireless communication network, first RAN keying material, the first RAN keying material enabling the base station to initiate the AS security context setup for the first RAT; and Second RAN keying material is received by the base station from the CN element of the wireless communication network, the second RAN keying material enabling the base station to initiate the AS security context setup for the second RAT.

3. The method of claim 2, wherein: Initiating the AS security context setup includes directly using the received first RAN keying material for initiating the AS security context setup for the first RAT.

4. The method of claim 2, wherein: Initiating the AS security context setup includes deriving third RAN keying material from the received first RAN keying material and using the derived third RAN keying material for initiating the AS security context setup for the first RAT.

5. The method of claim 1, wherein: Obtaining the key material for the first RAT and the second RAT includes: receiving, by the base station from a core network (CN) element of the wireless communication network, first RAN keying material, the first RAN keying material enabling the base station to initiate the AS security context setup for the first RAT; and Second RAN keying material is derived by the base station from the received first RAN keying material, the second RAN keying material enabling the base station to initiate the AS security context setup for the second RAT.

6. The method of claim 1, wherein: Initiating the AS security context setup includes transmitting, by the base station, a single AS security mode command message for the first RAT and the second RAT to the wireless communication device of the wireless communication network.

7. A base station for supporting security context setup in a wireless communication network, wherein a wireless communication device in the wireless communication network is capable of communicating using a first radio access technology (RAT) and a second RAT different from the first RAT, the base station comprising: Memory circuit; as well as a processing circuit operatively connected to the memory circuit and configured to: obtaining key material for the first RAT and the second RAT from a core network (CN) element of the wireless communication network; and Access stratum AS security context setup for the first RAT and the second RAT is initiated in a single signaling procedure based on the key material.

8. The base station according to claim 7, wherein: To obtain the key material for the first RAT and the second RAT, the processing circuit is configured to: receiving first RAN keying material from a core network (CN) element of the wireless communication network, the first RAN keying material enabling the base station to initiate the AS security context setup for the first RAT; as well as Second RAN keying material is received from the CN element of the wireless communication network, the second RAN keying material enabling the base station to initiate the AS security context setup for the second RAT.

9. The base station according to claim 8, wherein: To initiate the AS security context setup, the processing circuit is configured to directly use the first RAN keying material to initiate the AS security context setup for the first RAT.

10. The base station according to claim 8, wherein: To initiate the AS security context setup, the processing circuit is configured to derive third RAN keying material from the first RAN keying material and to initiate the AS security context setup for the first RAT using the derived third RAN keying material.

11. The base station according to claim 7, wherein: To obtain the key material for the first RAT and the second RAT, the processing circuit is configured to: receiving first RAN keying material from a core network (CN) element of the wireless communication network, the first RAN keying material enabling the base station to initiate the AS security context setup for the first RAT; as well as Second RAN keying material is derived from the received first RAN keying material, the second RAN keying material enabling the base station to initiate the AS security context setup for the second RAT.

12. The base station according to claim 7, wherein: To initiate the AS security context setup, the processing circuit is configured to transmit a single AS security mode command message for the first RAT and the second RAT to the wireless communication device.

13. A non-transitory computer readable medium having stored thereon a computer program which, when executed by a processing circuit of a base station, causes the base station to perform the method according to any one of claims 1 to 6.

14. A method for supporting security context setup in a wireless communication network implemented by a wireless communication device, the wireless communication device being capable of communicating using a first radio access technology (RAT) and a second RAT different from the first RAT, the method comprising: receiving, by the wireless communication device from a base station of the wireless communication network in a single signaling process, information enabling the wireless communication device to set up access stratum AS security contexts for the first RAT and the second RAT; as well as The AS security context for the first RAT and the second RAT is set, by the wireless communication device, based on the information.

15. The method of claim 14, further comprising receiving, by the wireless communication device from the base station, a single AS security mode command message for the first RAT and the second RAT. 16 . The method of claim 14 , further comprising transmitting, by the wireless communication device to a core network (CN) element of the wireless communication network, information indicating security capabilities of the wireless communication device regarding the first RAT and the second RAT.

17. The method of claim 16, further comprising receiving, by the wireless communication device, a request from the CN element to perform authentication on the CN element.

18. The method of claim 17, further comprising transmitting, by the wireless communication device, an authentication response message to the CN element.

19. The method of claim 14, further comprising: Receiving, by the wireless communication device, a non-access stratum (NAS) security mode command message for the first RAT and the second RAT from a core network (CN) element of the wireless communication network; as well as Core network (CN) key material for integrity protection and encryption of NAS communications of the first RAT and the second RAT is derived by the wireless communication device from the received NAS security mode command message.

20. A wireless communication device for supporting security context setup in a wireless communication network, the wireless communication device having a first connection established through a first radio access technology (RAT) and a second connection established through a second RAT different from the first RAT, and the wireless communication device comprising: Memory circuit; as well as a processing circuit operatively connected to the memory circuit and configured to: receiving, from a base station of the wireless communication network, information enabling the wireless communication device to set up access stratum AS security contexts for the first RAT and the second RAT in a single signaling process; as well as The AS security context for the first RAT and the second RAT is set based on the information.

21. The wireless communication device according to claim 20, wherein: The processing circuit is further configured to receive a single AS security mode command message for the first RAT and the second RAT.

22. The wireless communication device according to claim 20, wherein: The processing circuit is further configured to transmit information indicating security capabilities of the wireless communication device regarding the first RAT and the second RAT to a core network (CN) element of the wireless communication network.

23. The wireless communication device according to claim 22, wherein: The processing circuit is further configured to receive a request from the CN element to perform authentication on the CN element.

24. The wireless communication device according to claim 23, wherein: The processing circuit is further configured to transmit an authentication response message to the CN element.

25. The wireless communication device according to claim 20, wherein: The processing circuit is further configured to: receiving a non-access stratum (NAS) security mode command message for the first RAT and the second RAT from a core network (CN) element of the wireless communication network; as well as CN key material for integrity protection and encryption of NAS communications of the first RAT and the second RAT is derived from the received NAS Security Mode Command message.

26. A non-transitory computer readable medium having stored thereon a computer program which, when executed by a processing circuit of a wireless communication device, causes the wireless communication device to perform the method according to any one of claims 14 to 19.

Images