Cellular device radio network temporary identity protection

Abstract

A user equipment (UE) is configured to receive a security message from a network to which the UE is connected, the security message comprising a configuration for a dynamic identifier, where the configuration comprises a plurality of identifiers, each identifier to be used by the UE during a different time period when the UE is connected to the network, and exchange communications with the network, wherein the communication comprises the dynamic identifier.

Description

Technical Field

[0001] The present invention relates to wireless communications, and more particularly to temporary identity protection for cellular device radio networks. Background Art

[0002] In a cellular network (e.g., Long Term Evolution (LTE) New Radio (NR), etc.), a cell radio network temporary identifier (C-RNTI) is assigned to a user equipment (UE) during a radio resource control (RRC) connection establishment procedure. The C-RNTI is used for communications between the network and the UE. For example, if the network wants to address downlink (DL) data to the UE, the network may transmit a DL grant using a downlink control information (DCI) message on a physical downlink control channel (PDCCH). The DCI message includes a C-RNTI value assigned to the UE. Based on the C-RNTI, the UE understands that the DL grant in the DCI is for the UE, and allows the UE to receive DL data based on the information received in the DL grant.

[0003] However, the allocation of C-RNTI during RRC connection establishment is insecure and can be identified by an attacker. There have been instances where attackers have used C-RNTI and other information to obtain a Temporary Mobile Subscriber Identity (TMSI), which is also allocated to the UE during the random access procedure. This would enable an attacker to track data flows addressed to the TMSI within the network and potentially attack the UE. There are also other attack scenarios that an attacker could use when obtaining the C-RNTI of a UE. Therefore, there should be a way to protect C-RNTI from attacks. Summary of the invention

[0004] Some exemplary embodiments relate to a processor of a user equipment (UE) configured to perform operations including: receiving a security message including a configuration for a dynamic identifier from a network to which the UE has a connection, wherein the configuration includes a plurality of identifiers, each identifier to be used by the UE during a different time period when the UE is connected to the network; and exchanging communications with the network, wherein the communications include the dynamic identifier.

[0005] Other exemplary embodiments are directed to a user equipment (UE) having: a transceiver configured to communicate with a network; and a processor communicatively coupled to the transceiver and configured to perform operations. The operations include: receiving a security message including a configuration for a dynamic identifier from a network to which the UE has a connection, wherein the configuration includes a plurality of identifiers, each identifier to be used by the UE during a different time period when the UE is connected to the network; and exchanging communications with the network, wherein the communications include the dynamic identifier.

[0006] Additional exemplary embodiments relate to a processor of a base station, the processor being configured to perform operations including: transmitting a security message including a configuration for a dynamic identifier to a user equipment (UE) to which the base station has a connection, wherein the configuration includes a plurality of identifiers, each identifier to be used by the UE during a different time period when the UE is connected to the base station; and exchanging communications with the UE, wherein the communications include the dynamic identifier.

[0007] Additional exemplary embodiments are directed to a base station having: a transceiver configured to communicate with a user equipment (UE); and a processor communicatively coupled to the transceiver and configured to perform operations. The operations include: transmitting a security message including a configuration for a dynamic identifier to a UE to which the base station has a connection, wherein the configuration includes a plurality of identifiers, each identifier to be used by the UE during a different time period when the UE is connected to the base station; and exchanging communications with the UE, wherein the communications include the dynamic identifier. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 Exemplary network arrangements are shown according to various exemplary embodiments.

[0009] Figure 2 An exemplary UE according to various exemplary embodiments is shown.

[0010] Figure 3 An exemplary base station according to various exemplary embodiments is shown.

[0011] Figure 4 A timing diagram is shown showing the dynamic change of the C-RNTI of an example UE over time according to various exemplary embodiments.

[0012] Figure 5 A signaling diagram illustrating exemplary signaling for configuring a UE with a dynamic C-RNTI according to various exemplary embodiments is shown.

[0013] Figure 6 A timing diagram illustrating an exemplary network-based system frame number (SFN) dynamic C-RNTI frequency hopping scheme according to various exemplary embodiments is shown. DETAILED DESCRIPTION

[0014] The exemplary embodiments may be further understood with reference to the following description and related drawings, wherein like elements are provided with like reference numerals.The exemplary embodiments are directed to protecting a C-RNTI assigned to a UE by dynamically changing the C-RNTI in the time domain based on a configuration received from a network via secure signaling.

[0015] The exemplary embodiments are described with respect to UE. However, reference to UE is provided for illustrative purposes only. The exemplary embodiments may be used with any electronic component that can establish a connection with a network and is configured with hardware, software and / or firmware for exchanging information and data with the network. Therefore, the UE described herein is used to represent any electronic component.

[0016] The exemplary embodiments are also described with reference to 5G New Radio (NR) networks. However, it should be understood that the exemplary embodiments may also be implemented in other types of networks, including but not limited to LTE networks, future evolutions of cellular protocols, or any other type of network that assigns identifiers to devices that are using the network in an unsecured manner.

[0017] Additionally, throughout the specification, the term dynamic C-RNTI is used to describe a C-RNTI that can change dynamically over time. As will be described in more detail below, a UE may be assigned multiple dynamic C-RNTIs that are used at different times during the period that the UE is connected to the network. Dynamic C-RNTI is contrasted with a normal C-RNTI that is a single C-RNTI value that is the only C-RNTI used during the period that the UE is connected to the network.

[0018] In addition, the exemplary embodiments are described with reference to C-RNTI. However, those skilled in the art will appreciate that the principles described herein can be extended to any type of identifier used to identify a device in unicast communications between a device and a network. That is, although the examples describe C-RNTI as an identifier, any identifier can be made dynamic in a manner similar to that described herein for C-RNTI, such as a configured scheduled RNTI (CS-RNTI), a channel state information RNTI (CSI-RNTI), etc.

[0019] Figure 1 An exemplary network arrangement 100 according to various exemplary embodiments is shown. The exemplary network arrangement 100 includes a UE 110. Those skilled in the art will appreciate that the UE 110 may be any type of electronic component configured to communicate via a network, such as a mobile phone, a tablet computer, a desktop computer, a smart phone, a phablet, an embedded device, a wearable device, an Internet of Things (IoT) device, etc. It should also be appreciated that an actual network arrangement may include any number of UEs used by any number of users. Therefore, the example of a single UE 110 is provided for illustrative purposes only.

[0020] UE 110 can be configured to communicate with one or more networks. In the example of network configuration 100, the networks with which UE 110 can wirelessly communicate are 5G NR radio access network (RAN) 120, LTE RAN 122, and wireless local area network (WLAN) 124. However, it should be understood that UE 110 can also communicate with other types of networks (e.g., 5G cloud RAN, next generation RAN (NG-RAN), traditional cellular network, etc.), and UE 110 can also communicate with the network through a wired connection. With regard to the exemplary embodiment, UE 110 can establish a connection with 5G NR RAN 120, LTE RAN 122, and / or WLAN 124. Therefore, UE 110 can have a 5G NR chipset for communicating with NR RAN 120, an LTE chipset for communicating with LTE-RAN 122, and an ISM chipset for communicating with WLAN 124.

[0021] 5G NR RAN 120 and LTE-RAN 122 may be part of a cellular network that may be deployed by a network operator (e.g., Verizon, AT&T, T-Mobile, etc.). RAN 120, 122 may include a cell or base station configured to transmit and receive traffic from a UE equipped with an appropriate cellular chipset. In this example, 5G NR RAN 120 includes gNB 120A, and LTE RAN 122 includes eNB 122A. However, reference to gNB and eNB is provided for illustrative purposes only, and any appropriate base station or cell (e.g., Node B, eNodeB, HeNB, eNB, gNB, gNodeB, macro cell, micro cell, small cell, femto cell, etc.) may be deployed. WLAN 124 may include any type of wireless local area network (WiFi, hotspot, IEEE802.11x network, etc.).

[0022] Those skilled in the art will appreciate that any relevant process may be performed for the UE 110 to connect to the 5G NR RAN 120. For example, as described above, the 5G NR RAN 120 may be associated with a particular network operator at which the UE 110 and / or its user has protocol and credential information (e.g., stored on a SIM card). Upon detecting the presence of the 5G NR RAN 120, the UE 110 may send corresponding credential information in order to associate with the 5G NR RAN 120. More specifically, the UE 110 may be associated with a particular cell (e.g., gNB 120A).

[0023] The network arrangement 100 also includes a cellular core network 130, the Internet 140, an IP Multimedia Subsystem (IMS) 150, and a network service backbone 160. The cellular core network 130 manages traffic flowing between the cellular network and the Internet 140. The IMS 150 can be generally described as an architecture for delivering multimedia services to the UE 110 using the IP protocol. The IMS 150 can communicate with the cellular core network 130 and the Internet 140 to provide multimedia services to the UE 110. The network service backbone 160 communicates directly or indirectly with the Internet 140 and the cellular core network 130. The network service backbone 160 can be generally described as a collection of components (e.g., servers, network storage arrangements, etc.) that implement a set of services that can be used to extend the functionality of the UE 110 to communicate with various networks.

[0024] Figure 2 FIG. 1 shows an exemplary UE 110 according to various exemplary embodiments. UE 110 sends information about Figure 1 UE 110 may represent any electronic device and may include a processor 205, a memory arrangement 210, a display device 215, an input / output (I / O) device 220, a transceiver 225, and other components 230. Other components 230 may include, for example, an audio input device, an audio output device, a battery, a data acquisition device, a port for electrically connecting UE 110 to other electronic devices, a sensor for detecting the status of UE 110, and the like.

[0025] The processor 205 may be configured to execute multiple engines of the UE 110. For example, the engine may include a dynamic C-RNTI engine 235. The dynamic C-RNTI engine 235 may perform various operations, such as, but not limited to, receiving configuration information for a dynamic C-RNTI from a network and communicating with the network using the dynamic C-RNTI. Examples of these operations will be described in more detail below.

[0026] The above-described engine as an application (e.g., program) executed by the processor 205 is merely exemplary. The functions associated with the engine may also be represented as an independent combined component of the UE 110, or may be a modular component coupled to the UE 110, for example, an integrated circuit with or without firmware. For example, an integrated circuit may include an input circuit system for receiving a signal and a processing circuit system for processing signals and other information. The engine may also be embodied as an application or a separate application. In addition, in some UEs, the functions described for the processor 205 are split between two or more processors (such as a baseband processor and an application processor). The exemplary embodiments may be implemented in any of these or other configurations of the UE.

[0027] The memory 210 may be a hardware component configured to store data related to operations performed by the UE 110. The display device 215 may be a hardware component configured to display data to a user, and the I / O device 220 may be a hardware component that enables a user to enter input. The display device 215 and the I / O device 220 may be separate components, or may be integrated together (such as a touch screen). The transceiver 225 may be a hardware component configured to establish a connection with the 5G NR RAN 120, 122 and other types of wireless networks. Thus, the transceiver 225 can operate on a variety of different frequencies or channels (e.g., a continuous set of frequencies).

[0028] Figure 3 An exemplary base station 300 is shown in accordance with various exemplary embodiments. Base station 300 may represent a gNB 120A or any other access node that a UE 110 may use to establish a connection and manage network operations.

[0029] The base station 300 may include a processor 305, a memory arrangement 310, an input / output (I / O) device 315, a transceiver 320, and other components 325. These other components 325 may include, for example, an audio input device, an audio output device, a battery, a data acquisition device, ports for electrically connecting the base station 300 to other electronic devices and / or a power source, and the like.

[0030] Processor 305 may be configured to execute multiple engines of base station 300. For example, these engines may include dynamic C-RNTI engine 330. Dynamic C-RNTI engine 330 may be configured to perform operations such as, but not limited to, sending configuration information for a dynamic C-RNTI to UE 110 and communicating with UE 110 using the dynamic C-RNTI. Each of these operations will be described in more detail below.

[0031] The above-described engine 330 as an application (e.g., program) executed by the processor 305 is merely exemplary. The functions associated with the engine 330 may also be represented as a separate combined component of the base station 300, or may be a modular component coupled to the base station 300, such as an integrated circuit with or without firmware. For example, an integrated circuit may include an input circuit system for receiving a signal and a processing circuit system for processing signals and other information. In addition, in some base stations, the functions described for the processor 305 are split between multiple processors (e.g., a baseband processor, an application processor, etc.). The exemplary embodiments may be implemented in any of these or other configurations of the base station.

[0032] The memory 310 may be a hardware component configured to store data related to operations performed by the base station 300. The I / O device 315 may be a hardware component or port that enables a user to interact with the base station 300. The transceiver 320 may be a hardware component configured to exchange data with the UE 110 and any other UE in the network arrangement 100. The transceiver 320 may operate on a variety of different frequencies or channels (e.g., a continuous set of frequencies). Thus, the transceiver 320 may include one or more components (e.g., radios) to enable data exchange with various networks and UEs.

[0033] As described above, during the radio resource control (RRC) connection establishment procedure performed with 5G NR-RAN 120 via gNB 120A, a C-RNTI is assigned to UE 110. This C-RNTI is used for communications between 5G NR-RAN 120 and UE 110. Additionally, the portion of the RRC connection establishment procedure that assigns the C-RNTI to UE 110 cannot be encrypted because UE 110 would not have the information required to decrypt the RRC message that includes the C-RNTI. Therefore, the C-RNTI is sent over the air by gNB 120A without any encryption, thereby allowing an attacker to intercept the C-RNTI.

[0034] The exemplary embodiments relate to protecting the C-RNTI assigned to the UE 110 by dynamically changing the C-RNTI in the time domain among a list of C-RNTIs assigned to the UE 110 based on a configuration received via secure signaling from the 5G NR-RAN 120. Various examples of dynamically changing the C-RNTI in the time domain and signaling information to the UE to perform the dynamic change are provided below.

[0035] Figure 4 A timing diagram 400 is shown showing the C-RNTI of an exemplary UE dynamically changing over time according to various exemplary embodiments. Figure 4 An example of the general principle that a dynamic C-RNTI for UE 110 may change over time is shown. Figure 4 The example shows two time windows 410 and 450. However, it should be understood that Figure 4 The illustrated changing dynamic C-RNTI may extend over any time period, eg, any number of time windows.

[0036] In time window 410, starting at time (T1), UE 110 uses first identity 415 (e.g., dynamic C-RNTI 1) when communicating with the network. This means that UE 110 and gNB 120A understand that for time (T1) to time (T2), when communications between UE 110 and gNB 120A use dynamic C-RNTIs, the dynamic C-RNTI that should be used is C-RNTI 1. As will be described in more detail below, UE 110 and gNB 120A will understand this based on a configuration shared between UE 110 and gNB 120A.

[0037] At time (T2), UE 110 will use second identity 420 (e.g., dynamic C-RNTI 2) when communicating with the network. This will continue during time window 410 until time (Tn), at which time UE 110 will use n identity 425 (e.g., dynamic C-RNTI n) when communicating with the network. When time (Tn) ends, time window 410 ends and time window 450 begins. Figure 4 As can be seen in FIG. 4 , during time window 450 , UE 110 may reuse the dynamic C-RNTI 415 , 420 , 425 as described above for time window 410 .

[0038] The duration of time windows 410 and 450 and the duration of each time block (e.g., from T1 to T2) can be pre-configured based on values ​​written into a cellular standard (e.g., a 3GPP standard), or can be set based on a configuration between UE 110 and the network when a dynamic C-RNTI is configured. For example, the duration of time window 410 can be based on the number of dynamic C-RNTIs assigned to the UE. In another example, the duration of each time block can be based on the type of frequency hopping scheme used, such as a system frame number (SFN), a subframe-based scheme, a slot-based scheme, etc. For example, if the frequency hopping scheme is a SFN-based scheme, the length of each time block can be an integer value of the SFN. Examples of these frequency hopping schemes will be provided in more detail below.

[0039] Figure 5 A signaling diagram 500 is shown for configuring UE 110 with a dynamic C-RNTI according to various exemplary embodiments. The signaling is shown between UE 110 and gNB 120A.

[0040] Block 510 represents signaling between UE 110 and gNB 120 for the RRC connection establishment process. Those skilled in the art will appreciate that there may be multiple messages exchanged between devices during the RRC connection establishment process 510. However, to simplify the illustration, it may be considered that one of the messages 515 may include gNB 120A assigning a C-RNTI to UE 110. As described above, this message would be an unsecured message during the RRC connection establishment process 510.

[0041] Block 520 represents signaling to establish an access stratum (AS) security context between UE 110 and gNB 120. Again, one skilled in the art will appreciate that during the access stratum (AS) security process 520, there may be multiple messages exchanged between devices. However, to simplify the illustration, this signaling is shown as including signaling 525. Figure 5 As shown, this signaling may use the C-RNTI assigned to UE 110 during the RRC connection establishment process 510. Upon completion of the AS security procedure 520, UE 110 and gNB 120A will have information that allows the devices to exchange secure encrypted messages.

[0042] In some exemplary embodiments, these secure messages may be used to configure UE 110 with a dynamic C-RNTI. This signaling is shown as box 530 secure C-RNTI list allocation. This secure signaling may be in the form of secure RRC messages exchanged between UE 110 and gNB 120A. For example, gNB 120A may transmit a secure RRC message request 535 to UE 110. In one example, this message may be an RRC reconfiguration request. However, the exemplary embodiments are not limited to this type of message. The secure RRC message request 535 may include configuration information for the dynamic C-RNTI to be implemented by UE 110. Examples of the type of configuration information included in the secure RRC message request 535 are provided below. However, in general, it may be considered to allow UE 110 and gNB 120A to understand the dynamic C-RNTI to be used at any particular time when the connection is active (e.g., such as Figure 4 The information of the dynamic C-RNTI) shown in FIG.

[0043] UE 110 may indicate via secure RRC message response 540 that UE 110 has been configured with the dynamic C-RNTI as included in secure RRC message request 535. Thus, after completing secure C-RNTI list allocation 530, UE 110 and gNB 120A may exchange messages using the dynamic C-RNTI. This means that the original C-RNTI allocated during RRC connection establishment procedure 510 is no longer used for communication exchanges between UE 110 and gNB 120A. Thus, even if an attacker has the original C-RNTI, it cannot be used to monitor the message exchanges between UE 110 and gNB 120A because the message exchanges use the dynamic C-RNTI instead of the originally allocated C-RNTI.

[0044] To provide a specific example, signaling diagram 500 includes a block 550 illustrating a DL data exchange between gNB 120A and UE 110 using a dynamic C-RNTI configured during secure C-RNTI list allocation 530. gNB 120A may have DL data for UE 110. gNB 120A may transmit a DL grant using a downlink control information (DCI) message on a physical downlink control channel (PDCCH). The DCI message includes a dynamic C-RNTI value assigned to UE 110. Since UE 110 has been configured with a dynamic C-RNTI, UE 110 understands that the DL grant in the DCI is for UE 110 and allows UE 110 to receive DL data 560 based on the information received in the DL grant. It should be understood that DL data exchange 550 is exemplary only and any message exchange between UE 110 and gNB 120A using a C-RNTI may use a dynamic C-RNTI (e.g., uplink (UL) data exchange, etc.).

[0045] It should also be appreciated that secure C-RNTI list allocation 530 may be performed multiple times while UE 110 is connected to the network. That is, the network may decide to change any parameters related to configuring the dynamic C-RNTI for UE 110. For example, the change may be based on additional UEs connected to gNB 120A, a timer (e.g., changing the dynamic C-RNTI configuration after a redefined time period), etc. Likewise, the network may use any type of message for this reconfiguration, such as an RRC reconfiguration request.

[0046] As described above, there may be various ways to configure a dynamic C-RNTI. Some examples of configuration for a dynamic C-RNTI are provided below. However, before describing examples of configuration, a sample Abstract Syntax Notation One (ASN.1) data structure that may be included in a secure RRC message request 535 for configuration of a dynamic C-RNTI is described. Also, as described above, in one example, the secure RRC message request 535 may be an RRC reconfiguration request, but it is not limited to this type of message.

[0047] An example ASN.1 data structure may be as follows:

[0048]

[0049] Reference will be made to Figure 4 The configuration of the dynamic C-RNTI shown describes each field in the example data structure. However, those skilled in the art will understand how to configure these fields for further examples of dynamic C-RNTI described below. The first field CRNTI-List indicates the dynamic CRNTI assigned to UE 110. For example, Figure 4 C-RNTI 415, 420, 425.

[0050] The next field, CRNTI-hoppingID, indicates the frequency hopping sequence to be applied by UE 110. Figure 4 In the example of , the frequency hopping scheme is simply linear hopping of identities 1...n. However, as will be described below, the frequency hopping scheme may be a system frame number (SFN)-based scheme, a subframe-based scheme, a time slot-based scheme, etc. That is, UE 110 may be able to perform any number of frequency hopping schemes, and CRNTI-hoppingID may identify a specific frequency hopping scheme to be used for this current connection (e.g., frequency hopping scheme 1, frequency hopping scheme 2, frequency hopping scheme N). Different types of frequency hopping schemes may be written into cellular standards (e.g., 3GPP standards), and UE 110 may be able to perform one or more of these frequency hopping schemes. In some exemplary embodiments, UE 110 may signal the network in a UE capability message to indicate the dynamic C-RNTI frequency hopping scheme supported by UE 110. In other exemplary embodiments, UE 110 may generally indicate, through a UE capability message, that UE 110 supports the use of dynamic C-RNTI.

[0051] The next field, windowLength, indicates the length of the window in which the same C-RNTI should be used. Figure 4In the example of , this means that the time length of C-RNTI 1415 is used, such as the time length from T1 to T2. In the following examples, various equations will be provided for different frequency hopping schemes. In these equations, windowLength is the value of "X" used in the equation.

[0052] In the first example of a dynamic C-RNTI hopping scheme, an SFN-based scheme is described. Those skilled in the art understand that each frame within a network has an SFN. In LTE and 5G networks, the SFN cycles from 0 to 1023 and is a number known to both the network and the UE. As described below, the value of the SFN can be used to implement a dynamic C-RNTI hopping scheme. For example, an SFN-based scheme can be defined as follows: (1) If {Floor(SFN / X) mod N} is equal to 0, CRNTI#0 is used; (2) If {Floor(SFN / X) mod N} is equal to 1, CRNTI#1 is used; and (3) If {Floor(SFN / X) mod N} is equal to (N-1), CRNTI#N-1 is used. As described above with reference to the example ASN.1 data structure, "X" is the number of consecutive SFNs for which a dynamic C-RNTI is to be used. The value "N" is the number of allocated C-RNTIs, for example, 1...N.

[0053] Figure 6 A timing diagram 600 illustrating a dynamic C-RNTI frequency hopping scheme based on a network's system frame number (SFN) is shown in accordance with various exemplary embodiments. Figure 6 In the example of , it can be considered that there are three (3) UEs 610, 620, and 630 configured with a dynamic C-RNTI SFN frequency hopping scheme. In addition, in this example, it can be considered that the dynamic C-RNTI is used for one SFN, such as X=1. Finally, as Figure 6As shown in , it may be considered that three (3) C-RNTI values ​​are allocated to each UE 610, 620, 630, e.g., N=3. UE 610 is allocated dynamic C-RNTI values ​​90 (C-RNTI 0), 180 (C-RNTI 1), and 1 (C-RNTI 2), UE 620 is allocated dynamic C-RNTI values ​​1 (C-RNTI 0), 12 (C-RNTI 1), and 90 (C-RNTI 2), and UE 630 is allocated dynamic C-RNTI values ​​12 (C-RNTI 0), 90 (C-RNTI 1), and 12 (C-RNTI 2). These examples show that the dynamic C-RNTI values ​​may be repeated for different UEs, e.g., C-RNTI 0 of UE 610 and C-RNTI 2 of UE 620 both have a value of 90. Furthermore, the dynamic C-RNTI value may be repeated for the same UE, e.g., C-RNTI 0 and C-RNTI 2 of UE 630 both have a value of 12. However, it should be understood that this is merely exemplary and does not require that the dynamic C-RNTI value be repeated for the same UE or for different UEs.

[0054] At time (T1), the UEs 610, 620, 630 and gNB 120A configured with the dynamic C-RNTI SFN hopping scheme will perform the calculation {Floor(SFN / X) mod N}. Because the value of SFN (e.g., 0-1023) is common to all devices (e.g., UEs 610, 620, 630 and gNB 120A), each device will end up with the same result, e.g., SFN mod 3 = 0. Therefore, according to the rules defined above for the dynamic C-RNTI SFN hopping scheme, the UEs 610, 620, 630 will use the dynamic C-RNTI value for C-RNTI 0, e.g., UE 610 will use a value of 90, UE 620 will use a value of 1 and UE 630 will use a value of 12. When the timing diagram advances to the next SFN (i.e., the SFN starting at time (T2)), the device will calculate {Floor(SFN / X) mod N} again based on the new SFN number. Figure 6 As shown, this can continue as SFNs are added and as long as each UE maintains their connection to the network.

[0055] It should be noted that in the above examples, no precise value of SFN is provided. As described above, a specific value of SFN is known to each device (e.g., UE 610, 620, 630 and gNB 120A), and this value may be used to determine the value of the dynamic C-RNTI. Furthermore, the value of N may be based on any number of factors, including, but not limited to, the number of UEs connected to gNB 120A, the planned capacity of UEs in RRC connected mode of gNB 120A, etc. Thus, gNB 120A (or 5G NR-RAN 120) may perform various operations to select values ​​of X, N, and / or a frequency hopping scheme to be implemented based on any number of factors.

[0056] In a second example of a dynamic C-RNTI hopping scheme, a subframe-based scheme is described. The subframe-based scheme can be defined as follows: (1) If {Floor((SFN*10+Sub-frame) / X)mod N} is equal to 0, CRNTI#0 is used; (2) If {Floor((SFN*10+Sub-frame) / X)mod N} is equal to 1, CRNTI#1 is used; and (3) If {Floor((SFN*10+Sub-frame) / X)mod N} is equal to (N-1), CRNTI#N-1 is used. In these equations, X is the number of consecutive subframes in which the dynamic C-RNTI is to be used, and N is the number of dynamic C-RNTIs allocated. This example does not provide a diagram, but it should be understood that the timing diagram of this example will be similar to Figure 6 600, except that each time block will be a subframe instead of a SFN.

[0057] In the third example of a dynamic C-RNTI hopping scheme, a timeslot-based scheme is described. The timeslot-based scheme can be defined as follows: (1) If {Floor(((SFN*10+Sub-frame)*SlotPerSubframe)+Slot) / X)modN} is equal to 0, CRNTI#0 is used; (2) If {Floor(((SFN*10+Sub-frame)*SlotPerSubframe)+Slot) / X)mod N} is equal to 1, CRNTI#1 is used; and (3) If {Floor((((SFN*10+Sub-frame)*)+Slot) / X)mod N} is equal to (N-1), CRNTI#N-1 is used. In these equations, X is the number of consecutive timeslots for which the dynamic C-RNTI is to be used, and N is the number of dynamic C-RNTIs allocated. This example does not provide a diagram, but it should be understood that the timing diagram of this example will be similar to Figure 6600, except that each time block will be a time slot instead of a SFN.

[0058] In some exemplary embodiments, one of the configured dynamic C-RNTIs (e.g., the C-RNTI with index zero) may be considered a primary C-RNTI that may be used to identify UE 110 at the network side. For example, this primary dynamic C-RNTI may identify UE 110 in a process such as connection reestablishment, where the primary dynamic C-RNTI may be used to retrieve UE context.

[0059] The secure dynamic C-RNTI may be considered a critical configuration that may require synchronization between the UE and the network regarding the application configuration, for example, similar to operations that may need to avoid resource block (RB) hyperframe number (HFN) reuse, such as changing security keys. An intra-cell handover may be triggered to achieve this synchronization. During intra-cell handover random access, the C-RNTI to be used is the initial access C-RNTI allocated during connection establishment or within a handover (HO) information element (IE) (e.g., MobilityControlInfo / ReconfigWithSync IE). In other examples, the network may allocate a different C-RNTI only for the purpose of this synchronous random access procedure. In other examples, the previously configured primary C-RNTI (or any other previously allocated C-RNTI that is not part of the newly allocated dynamic C-RNTI list) may be used for the synchronous random access procedure. Once the random access procedure is successful, the UE may begin applying the new configuration and begin using the allocated secure dynamic C-RNTI.

[0060] Example

[0061] In a first embodiment, a method performed by a user equipment (UE), the method comprising: receiving a security message including a configuration for a dynamic identifier from a network to which the UE has a connection, wherein the configuration includes a plurality of identifiers, each identifier to be used by the UE during a different time period when the UE is connected to the network; and exchanging communications with the network, wherein the communications include the dynamic identifier.

[0062] In a second embodiment, the method according to the first embodiment, wherein the plurality of identifiers comprises a plurality of cell radio network temporary identifiers (C-RNTIs).

[0063] In a third embodiment, the method according to the first embodiment, wherein the configuration further comprises a frequency hopping scheme that identifies when each of the plurality of identifiers is to be used.

[0064] In a fourth embodiment, the method according to the third embodiment, wherein the frequency hopping scheme is based on at least a system frame number (SFN), a subframe number, or a time slot number of the network.

[0065] In a fifth embodiment, the method according to the first embodiment, wherein the configuration further includes a time period during which each of the plurality of identifiers is to be used.

[0066] In a sixth embodiment, the method according to the first embodiment, wherein the safety message comprises a radio resource control (RRC) message.

[0067] In a seventh embodiment, according to the method described in the first embodiment, the method also includes establishing a connection with the network, wherein the establishment includes receiving an identifier from the network using unsecured communication and establishing a security context with the network using the identifier, wherein the security message is exchanged based on the security context, and wherein the UE does not communicate with the network using the identifier after receiving the security message.

[0068] In an eighth embodiment, the method according to the first embodiment, wherein the communication includes downlink (DL) communication from the network and uplink (UL) communication to the network.

[0069] In a ninth embodiment, according to the method of the first embodiment, the method further includes receiving another security message including an updated configuration for the dynamic identifier, and updating the UE with the updated configuration for the dynamic identifier.

[0070] In a tenth embodiment, according to the method of the first embodiment, the method further includes transmitting a capability message including an indication that the UE supports the dynamic identifier to the network.

[0071] In an eleventh embodiment, according to the method of the tenth embodiment, the indication includes an identifier of a frequency hopping scheme supported by the UE.

[0072] In a twelfth embodiment, according to the method of the first embodiment, the communication comprises unicast communication between the network and the UE.

[0073] In a thirteenth embodiment, according to the method described in the first embodiment, the method also includes: performing a random access procedure with the network during intra-cell switching, the random access procedure including: sending an unsecure message including a random access identifier; and in response to performing the random access procedure, receiving an additional plurality of identifiers from the network, each identifier to be used by the UE for subsequent communications with the network during different time periods, wherein the random access identifier is not included in the additional plurality of identifiers.

[0074] In a fourteenth embodiment, a processor of a user equipment (UE) is configured to perform any of the operations described in the first to thirteenth embodiments.

[0075] In a fifteenth embodiment, a user equipment (UE) includes: a transceiver configured to communicate with a network; and a processor communicatively coupled to the transceiver and configured to perform any of the operations described in the first to thirteenth embodiments.

[0076] In a sixteenth embodiment, a processor of a base station is configured to perform the following operations, the operations comprising: transmitting a security message including a configuration for a dynamic identifier to a user equipment (UE) to which the base station is connected, wherein the configuration includes multiple identifiers, each identifier to be used by the UE during different time periods when the UE is connected to the base station; and exchanging communications with the UE, wherein the communications include the dynamic identifier.

[0077] In a seventeenth embodiment, the method according to the sixteenth embodiment, wherein the plurality of identifiers comprises a plurality of cell radio network temporary identifiers (C-RNTIs).

[0078] In an eighteenth embodiment, the method according to the sixteenth embodiment, wherein the configuration further comprises a frequency hopping scheme that identifies when each of the plurality of identifiers is to be used.

[0079] In a nineteenth embodiment, the method according to the eighteenth embodiment, wherein the frequency hopping scheme is based on at least a system frame number (SFN), a subframe number, or a time slot number of the network.

[0080] In a twentieth embodiment, the method of the sixteenth embodiment, wherein the configuration further comprises a time period during which each of the plurality of identifiers is to be used.

[0081] In a twenty-first embodiment, the method according to the sixteenth embodiment, wherein the safety message comprises a radio resource control (RRC) message.

[0082] In a twenty-second embodiment, according to the method described in the sixteenth embodiment, the method also includes: establishing a connection with the UE, wherein the establishment includes: transmitting the identifier using unsecure communication; and establishing a security context with the UE using the identifier, wherein the security message is exchanged based on the security context, wherein after receiving the security message, the UE does not use the identifier for communication.

[0083] In a twenty-third embodiment, the method according to the sixteenth embodiment, wherein the communication includes downlink (DL) communication from the base station and uplink (UL) communication to the base station.

[0084] In a twenty-fourth embodiment, according to the method of the sixteenth embodiment, the method further includes transmitting another security message including an updated configuration for the dynamic identifier.

[0085] In a twenty-fifth embodiment, the method according to the twenty-fourth embodiment, wherein the updated configuration is transmitted after a predetermined period of time.

[0086] In a twenty-sixth embodiment, according to the method of the sixteenth embodiment, the method further includes receiving a capability message from the UE including an indication that the UE supports the dynamic identifier.

[0087] In a twenty-seventh embodiment, according to the method of the twenty-sixth embodiment, the indication includes an identifier of a frequency hopping scheme supported by the UE.

[0088] In a twenty-eighth embodiment, according to the method of the sixteenth embodiment, the communication comprises unicast communication between the base station and the UE.

[0089] In a twenty-ninth embodiment, a processor of a base station is configured to perform any operation of the operations described in the twenty-sixth to twenty-eighth embodiments.

[0090] In a thirtieth embodiment, a base station includes: a transceiver configured to communicate with a user equipment (UE); and a processor communicatively coupled to the transceiver and configured to perform any of the operations described in accordance with the twenty-sixth to twenty-eighth embodiments.

[0091] Those skilled in the art will appreciate that the exemplary embodiments described above can be implemented in any suitable software configuration or hardware configuration or combination thereof. Exemplary hardware platforms for implementing the exemplary embodiments may include, for example, Intel x86-based platforms with compatible operating systems, Windows OS, Mac platforms and MAC OS, mobile devices with operating systems such as iOS, Android, etc. In other examples, the exemplary embodiments of the above methods may be embodied as a program including lines of code stored on a non-transitory computer-readable storage medium, which, when compiled, can be executed on a processor or microprocessor.

[0092] Although this application describes various embodiments, each having different features in various combinations, those skilled in the art will understand that any feature of one embodiment may be combined with features of other embodiments in any manner that is not specifically negated or that is not functionally or logically inconsistent with the operation of the device or the prescribed function of the disclosed embodiment.

[0093] It is understood that the use of personally identifiable information should be subject to privacy policies and practices that are generally recognized to meet or exceed industry or government requirements for maintaining user privacy. Specifically, personally identifiable information data should be managed and processed to minimize the risk of unintentional or unauthorized access or use, and the nature of the authorized use should be clearly stated to users.

[0094] It is obvious to those skilled in the art that various modifications may be made to the present disclosure without departing from the spirit or scope of the present disclosure. Therefore, it is intended that the present disclosure covers the modifications and variations of the present disclosure as long as they come within the scope of the appended claims and their equivalents.

Claims

1. A processor of a user equipment (UE), the processor being configured to perform the following operations, the operations comprising: receiving a security message from a network to which the UE has a connection, the security message comprising a configuration for a dynamic identifier, wherein the configuration comprises a plurality of identifiers, each identifier to be used by the UE during a different time period while the UE is connected to the network; and Communications are exchanged with the network, wherein the communications include the dynamic identifier. 2 . The processor of claim 1 , wherein the plurality of identifiers comprises a plurality of cell radio network temporary identifiers (C-RNTIs).

3. The processor of claim 1 , wherein the configuration further comprises a frequency hopping scheme that identifies when each of the plurality of identifiers is to be used, wherein the frequency hopping scheme is based on at least a system frame number (SFN), a subframe number, or a time slot number of the network. 4 . The processor of claim 1 , wherein the configuration further comprises a time period during which each of the plurality of identifiers is to be used.

5. The processor of claim 1, wherein the safety message comprises a radio resource control (RRC) message.

6. The processor of claim 1, wherein the operations further comprise: establishing a connection with the network, wherein the establishing comprises receiving an identifier from the network using unsecured communications; as well as establishing a security context with the network using the identifier, wherein the security messages are exchanged based on the security context, After receiving the security message, the UE does not communicate with the network using the identifier.

7. The processor of claim 1, wherein the communications include unicast downlink (DL) communications from the network and unicast uplink (UL) communications to the network.

8. The processor of claim 1, wherein the operations further comprise: receiving another security message including an updated configuration for the dynamic identifier; as well as The UE is updated with the updated configuration for the dynamic identifier.

9. The processor of claim 1 , wherein the operations further comprise: A capability message including an indication that the UE supports the dynamic identifier is transmitted to the network, wherein the indication includes an identification of a frequency hopping scheme supported by the UE.

10. The processor of claim 1, wherein the operations further comprise: performing a random access procedure with the network during an intra-cell handover, the random access procedure comprising: sending an unsecured message including a random access identifier; and In response to performing the random access procedure, receiving a further plurality of identifiers from the network, each identifier to be used by the UE for subsequent communications with the network during a different time period, wherein the random access identifier is not included in the further plurality of identifiers.

11. A processor of a base station, the processor being configured to perform operations comprising: transmitting a security message including a configuration for a dynamic identifier to a user equipment (UE) to which the base station has a connection, wherein the configuration includes a plurality of identifiers, each identifier to be used by the UE during a different time period when the UE is connected to the base station; and Communications are exchanged with the UE, wherein the communications include the dynamic identifier.

12. The processor of claim 11, wherein the plurality of identifiers comprises a plurality of cell radio network temporary identifiers (C-RNTIs).

13. The processor of claim 11, wherein the configuration further comprises a frequency hopping scheme that identifies when each of the plurality of identifiers is used, wherein the frequency hopping scheme is based on at least a system frame number (SFN), a subframe number, or a time slot number of a network.

14. The processor of claim 11, wherein the configuration further comprises a time period during which each of the plurality of identifiers is to be used.

15. The processor of claim 11, wherein the safety message comprises a radio resource control (RRC) message.

16. The processor of claim 11, wherein the operations further comprise: establishing a connection with the UE, wherein the establishing comprises transmitting an identifier using unsecured communications; as well as establishing a security context with the UE using the identifier, wherein the security message is exchanged based on the security context, After receiving the security message, the UE does not use the identifier for communication.

17. The processor of claim 11, wherein the communications comprise unicast downlink (DL) communications from the base station and unicast uplink (UL) communications to the base station.

18. The processor of claim 11, wherein the operations further comprise: Another secure message is transmitted including an updated configuration for the dynamic identifier, wherein the updated configuration is transmitted after a predetermined time period.

19. The processor of claim 11, wherein the operations further comprise: A capability message is received from the UE including an indication that the UE supports the dynamic identifier.

20. The processor of claim 19, wherein the indication comprises an identification of a frequency hopping scheme supported by the UE.

Images