Method and apparatus for secure lower layer mobility

Abstract

According to one aspect, an apparatus for performing the following is provided. The apparatus obtains one or more security keys for handover. The apparatus then receives a mobility signaling unit of the first protocol layer and / or the second protocol layer. The mobility signaling unit includes at least one encoded security token that has been encoded using at least one of the one or more security keys. Finally, the apparatus decodes the encoded security token using at least one of the one or more security keys.

Description

Technical Field

[0001] Various example embodiments relate to wireless communications. Background Art

[0002] The fifth generation (5G) New Radio (NR) Release 18 aims to enable so-called Layer 1 / Layer 2 (L1 / 2) mobility, which in practice means that the control of mobility will be moved from the Central Unit (CU) of the access node to the (multiple) distributed units ((multiple) DUs) of the access node. Thus, handovers may be activated, for example, via the Medium Access Control (MAC) layer. One of the possible modes for DU-based mobility is inter-DU mobility, i.e. mobility between cells within the same CU but different DUs. However, current L1 / L2 inter-DU mobility schemes have problems when enabling secure communications when inter-DU mobility occurs. Summary of the invention

[0003] According to one aspect, the subject matter of the independent claims is provided. Embodiments are defined in the dependent claims.

[0004] According to one aspect, there is provided an apparatus comprising:

[0005] at least one processor; and

[0006] at least one transceiver, wherein the at least one processor is configured to:

[0007] obtaining one or more security keys for switching;

[0008] At least one of the transceivers is configured to:

[0009] receiving a mobility signaling unit of the first protocol layer and / or the second protocol layer, wherein the mobility signaling unit comprises: at least one encoded security token that has been encoded using at least one security key of the one or more security keys; and

[0010] At least one of the processors is configured to:

[0011] The encoded security token is decoded using at least one security key of the one or more security keys.

[0012] According to one aspect, there is provided an apparatus comprising:

[0013] at least one processor; and

[0014] at least one transceiver, wherein the at least one processor is configured to:

[0015] generating one or more encoded security tokens for handover and associated one or more token identities based on the one or more security keys,

[0016] At least one of the transceivers is configured to:

[0017] sending at least one first mobility configuration message to a distributed unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens, and one or more token identities; and

[0018] At least one second mobility configuration message is sent to the terminal device via the distributed unit of the access node, wherein the second configuration message includes: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities.

[0019] According to one aspect, there is provided an apparatus comprising:

[0020] at least one processor; and

[0021] At least one transceiver, wherein the at least one transceiver is configured to:

[0022] receiving at least one first mobility configuration message from a central unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens for handover, and associated one or more token identities; and

[0023] In response to receiving at least one second mobility configuration message from the central unit, the at least one second mobility configuration message comprising: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities, forwarding the at least one second mobility configuration message to the terminal device, wherein the at least one processor is configured to:

[0024] Selecting one of the one or more encoded security tokens for switching, wherein at least one transceiver is configured to:

[0025] A mobility signaling unit of the first protocol layer and / or the second protocol layer is sent to the terminal device, wherein the mobility signaling unit includes: the one encoded security token among the one or more encoded security tokens.

[0026] According to one aspect, there is provided a method comprising:

[0027] obtaining one or more security keys for switching;

[0028] receiving a mobility signaling unit of the first protocol layer and / or the second protocol layer, wherein the mobility signaling unit comprises: at least one encoded security token that has been encoded using at least one security key of the one or more security keys; and

[0029] The encoded security token is decoded using at least one security key of the one or more security keys.

[0030] According to one aspect, there is provided a method comprising:

[0031] generating one or more encoded security tokens for handover and associated one or more token identities based on the one or more security keys,

[0032] sending at least one first mobility configuration message to a distributed unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens, and one or more token identities; and

[0033] At least one second mobility configuration message is sent to the terminal device via the distributed unit of the access node, wherein the second configuration message includes: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities.

[0034] According to one aspect, there is provided a method comprising:

[0035] receiving at least one first mobility configuration message from a central unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens for handover, and associated one or more token identities; and

[0036] in response to receiving at least one second mobility configuration message from the central unit, the at least one second mobility configuration message comprising: at least one or all of the one or more security tokens, and / or at least one or all of the one or more token identities, forwarding the at least one second mobility configuration message to the terminal device;

[0037] selecting an encoded security token of the one or more encoded security tokens for switching; and

[0038] A mobility signaling unit of the first protocol layer and / or the second protocol layer is sent to the terminal device, wherein the mobility signaling unit includes: the one encoded security token among the one or more encoded security tokens.

[0039] According to one aspect, a non-transitory computer-readable medium is provided, comprising program instructions for causing an apparatus to at least perform the following:

[0040] obtaining one or more security keys for switching;

[0041] receiving a mobility signaling unit of the first protocol layer and / or the second protocol layer, wherein the mobility signaling unit comprises: at least one encoded security token that has been encoded using at least one security key of the one or more security keys; and

[0042] The encoded security token is decoded using at least one security key of the one or more security keys.

[0043] According to one aspect, a non-transitory computer-readable medium is provided, comprising program instructions for causing an apparatus to at least perform the following:

[0044] generating one or more encoded security tokens for handover and associated one or more token identities based on the one or more security keys,

[0045] sending at least one first mobility configuration message to a distributed unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens, and one or more token identities; and

[0046] At least one second mobility configuration message is sent to the terminal device via the distributed unit of the access node, wherein the second configuration message includes: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities.

[0047] According to one aspect, a non-transitory computer-readable medium is provided, comprising program instructions for causing an apparatus to at least perform the following:

[0048] receiving at least one first mobility configuration message from a central unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens for handover, and associated one or more token identities; and

[0049] in response to receiving at least one second mobility configuration message from the central unit, the at least one second mobility configuration message comprising: at least one or all of the one or more security tokens, and / or at least one or all of the one or more token identities, forwarding the at least one second mobility configuration message to the terminal device;

[0050] selecting an encoded security token of the one or more encoded security tokens for switching; and

[0051] A mobility signaling unit of the first protocol layer and / or the second protocol layer is sent to the terminal device, wherein the mobility signaling unit includes: the one encoded security token among the one or more encoded security tokens.

[0052] According to one embodiment, an apparatus is provided, comprising means for performing the following:

[0053] obtaining one or more security keys for switching;

[0054] receiving a mobility signaling unit of the first protocol layer and / or the second protocol layer, wherein the mobility signaling unit comprises: at least one encoded security token that has been encoded using at least one security key of the one or more security keys; and

[0055] The encoded security token is decoded using at least one security key of the one or more security keys.

[0056] According to one embodiment, an apparatus is provided, comprising: at least one processor; and at least one memory, including computer program code; the at least one memory and the computer program code are configured together with the at least one processor so that the apparatus at least performs:

[0057] obtaining one or more security keys for switching;

[0058] receiving a mobility signaling unit of the first protocol layer and / or the second protocol layer, wherein the mobility signaling unit comprises: at least one encoded security token that has been encoded using at least one security key of the one or more security keys; and

[0059] The encoded security token is decoded using at least one security key of the one or more security keys.

[0060] According to one embodiment, an apparatus is provided, comprising means for performing the following:

[0061] generating one or more encoded security tokens for handover and associated one or more token identities based on the one or more security keys,

[0062] sending at least one first mobility configuration message to a distributed unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens, and one or more token identities; and

[0063] At least one second mobility configuration message is sent to the terminal device via the distributed unit of the access node, wherein the second configuration message includes: one or all of the one or more security tokens and / or at least one or all of the one or more token identities.

[0064] According to one embodiment, an apparatus is provided, comprising: at least one processor; and at least one memory, including computer program code; the at least one memory and the computer program code are configured together with the at least one processor so that the apparatus at least performs:

[0065] generating one or more encoded security tokens for handover and associated one or more token identities based on the one or more security keys,

[0066] sending at least one first mobility configuration message to a distributed unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens, and one or more token identities; and

[0067] At least one second mobility configuration message is sent to the terminal device via the distributed unit of the access node, wherein the second configuration message includes: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities.

[0068] According to one embodiment, an apparatus is provided, comprising means for performing the following:

[0069] receiving at least one first mobility configuration message from a central unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens for handover, and associated one or more token identities; and

[0070] in response to receiving at least one second mobility configuration message from the central unit, the at least one second mobility configuration message comprising: at least one or all of the one or more security tokens, and / or at least one or all of the one or more token identities, forwarding the at least one second mobility configuration message to the terminal device;

[0071] selecting one of the one or more encoded security tokens for switching; and

[0072] A mobility signaling unit of the first protocol layer and / or the second protocol layer is sent to the terminal device, wherein the mobility signaling unit includes: the one encoded security token among the one or more encoded security tokens.

[0073] According to one embodiment, an apparatus is provided, comprising: at least one processor; and at least one memory, including computer program code; the at least one memory and the computer program code are configured together with the at least one processor so that the apparatus at least performs:

[0074] receiving at least one first mobility configuration message from a central unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens for handover, and associated one or more token identities; and

[0075] in response to receiving at least one second mobility configuration message from the central unit, the at least one second mobility configuration message comprising: at least one or all of the one or more security tokens, and / or at least one or all of the one or more token identities, forwarding the at least one second mobility configuration message to the terminal device;

[0076] selecting one of the one or more encoded security tokens for switching; and

[0077] A mobility signaling unit of the first protocol layer and / or the second protocol layer is sent to the terminal device, wherein the mobility signaling unit includes: the one encoded security token among the one or more encoded security tokens.

[0078] According to one aspect, there is provided a computer program comprising instructions for causing an apparatus to at least perform the following:

[0079] obtaining one or more security keys for switching;

[0080] receiving a mobility signaling unit of the first protocol layer and / or the second protocol layer, wherein the mobility signaling unit comprises: at least one encoded security token that has been encoded using at least one security key of the one or more security keys; and

[0081] The encoded security token is decoded using at least one security key of the one or more security keys.

[0082] According to one aspect, there is provided a computer program comprising instructions for causing an apparatus to at least perform the following:

[0083] generating one or more encoded security tokens for handover and associated one or more token identities based on the one or more security keys,

[0084] sending at least one first mobility configuration message to a distributed unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens, and one or more token identities; and

[0085] At least one second mobility configuration message is sent to the terminal device via the distributed unit of the access node, wherein the second configuration message includes: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities.

[0086] According to one aspect, there is provided a computer program comprising instructions for causing an apparatus to at least perform the following:

[0087] receiving at least one first mobility configuration message from a central unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens for handover, and associated one or more token identities; and

[0088] in response to receiving at least one second mobility configuration message from the central unit, the at least one second mobility configuration message comprising: at least one or all of the one or more security tokens, and / or at least one or all of the one or more token identities, forwarding the at least one second mobility configuration message to the terminal device;

[0089] selecting one of the one or more encoded security tokens for switching; and

[0090] A mobility signaling unit of the first protocol layer and / or the second protocol layer is sent to the terminal device, wherein the mobility signaling unit includes: the one encoded security token among the one or more encoded security tokens.

[0091] One or more examples of implementations are set forth in greater detail in the drawings and the description that follows. Other features will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] Below, example embodiments will be described in more detail with reference to the accompanying drawings, in which

[0093] Figure 1 An exemplary wireless communication system is shown;

[0094] Figure 2A , Figure 2B and Figure 2C An exemplary process according to an embodiment is shown;

[0095] Figure 3 An example of a medium access control element (MAC CE) structure for a mobility signaling element according to an embodiment is shown;

[0096] Figure 4 shows signalling between a terminal device, a first (source) distributed unit of an access node, a second (target) distributed unit of the access node and a central unit of the access node according to an embodiment; and

[0097] Figure 5 An apparatus according to an embodiment is shown. DETAILED DESCRIPTION

[0098] The following embodiments are presented as examples only. Although this specification may refer to "one", "an" or "some" embodiments and / or examples at several locations in the text, this does not necessarily mean that each reference refers to the same (multiple) embodiments or (multiple) examples, or that a particular feature applies only to a single embodiment and / or example. Individual features of different embodiments and / or examples may also be combined to provide other embodiments and / or examples.

[0099] The terms "layer 1", "layer 2", and "layer 3" (abbreviated as L1, L2, and L3) used in this application refer to the layers of the Open Systems Interconnection (OSI) model. In the OSI model, layer 1 corresponds to the physical layer, layer 2 corresponds to the data link layer, and layer 3 corresponds to the network layer. The term "L1 / 2" (e.g., "L1 / 2 mobility" or "L1 / 2-based switching") used hereinafter may mean an operation on layer 1 or layer 2 or both layer 1 and layer 2.

[0100] In the following, different exemplary embodiments will be described using a radio access architecture based on Long Term Evolution Advanced (LTE Advanced, LTE-A) or New Radio (NR, 5G) as an example of an access architecture to which these embodiments can be applied, but the embodiments are not limited to such an architecture. It is obvious to a person skilled in the art that these embodiments can also be applied to other types of communication networks with appropriate components by appropriately adjusting parameters and processes. Some examples of other options for suitable systems are for Universal Mobile Telecommunications System (UMTS) Radio Access Network (UTRAN or E-UTRAN), Long Term Evolution (LTE, which is basically the same as E-UTRA), Wireless Local Area Network (WLAN or WiFi), Worldwide Interoperability for Microwave Access (WiMAX), Personal Communications Service (PCS), Wideband Code Division Multiple Access (WCDMA), systems using Ultra-Wideband (UWB) technology, sensor networks, mobile ad hoc networks (MANETs), and Internet Protocol Multimedia Subsystem (IMS), or any combination thereof.

[0101] Figure 1 Depicts an example of a simplified system architecture showing some elements and functional entities, which are logical units and whose implementation may differ from what is shown. Figure 1 The connections shown are logical connections; the actual physical connections may be different. It will be apparent to those skilled in the art that the system typically also includes Figure 1 Other functions and structures than those shown.

[0102] However, the embodiments are not limited to the systems given as examples, but a person skilled in the art may apply the solution to other communication systems provided with the necessary properties.

[0103] Figure 1 The example of FIG. 1 shows a portion of an exemplary wireless access network.

[0104] Figure 1 Shown is a user equipment 100 and 102 configured to be wirelessly connected to an access node (such as (e / g) NodeB) 104 providing a cell on one or more communication channels in a cell. The physical link from the user equipment to the (e / g) NodeB is called an uplink or reverse link, and the physical link from the (e / g) NodeB to the user equipment is called a downlink or forward link. It should be understood that the (e / g) NodeB or its functions can be implemented by using any node, host, server or access point entity suitable for such a purpose.

[0105] The communication system usually includes more than one (e / g)NodeB, in which case the (e / g)NodeB can also be configured to communicate with each other through wired or wireless links designed for this purpose. These links can be used for signaling purposes. (e / g)NodeB is a computing device configured to control the radio resources of the communication system to which it is coupled. NodeB can also be referred to as a base station, an access point or any other type of interface device, including a relay station capable of operating in a wireless environment. (e / g)NodeB includes or is coupled to a transceiver. From the transceiver of the (e / g)NodeB, a connection is provided to an antenna unit, which establishes a bidirectional radio link to a user equipment. The antenna unit may include multiple antennas or antenna elements. (e / g)NodeB is also connected to a core network 110 (CN or next generation core NGC). Depending on the system, the counterpart on the CN side may be a serving gateway (S-GW, routing and forwarding user data packets), a packet data network gateway (P-GW) (for providing user equipment (UE) connectivity to an external packet data network), or a mobile management entity (MME), etc.

[0106] User equipment (also referred to as UE, user equipment, user terminal, terminal device, etc.) shows a device to which resources on the air interface are allocated and assigned, and therefore, any features described herein with user equipment can be implemented using corresponding devices (such as relay nodes). An example of such a relay node is a layer 3 relay (self-backhaul relay) toward a base station.

[0107] User equipment generally refers to portable computing devices, including wireless mobile communication devices that operate with or without a subscriber identity module (SIM), including but not limited to the following types of devices: mobile stations (mobile phones), smart phones, personal digital assistants (PDAs), mobile phones, devices using wireless modems (alarm or measurement devices, etc.), laptop computers and / or touch screen computers, tablet computers, game consoles, notebook computers, and multimedia devices. It should be understood that user equipment can also be almost exclusively uplink devices, one example of which is a camera or video camera that loads images or video clips to the network. User equipment can also be a device with the ability to operate in an Internet of Things (IoT) network, which is a scenario in which objects are provided with the ability to transmit data over a network without human-to-human or human-to-computer interaction. A user device (or in some embodiments, a layer 3 relay node) is configured to perform one or more functions of a user equipment function. A user device may also be referred to as a subscriber unit, a mobile station, a remote terminal, an access terminal, a user terminal, or a user equipment (UE), to name just a few names or devices.

[0108] The various techniques described herein can also be applied to cyber-physical systems (CPS) (systems of cooperating computing elements that control physical entities). CPS can enable the implementation and utilization of a large number of interconnected ICT devices (sensors, actuators, processor microcontrollers, etc.) embedded in physical objects in different locations. Mobile cyber-physical systems are a subcategory of cyber-physical systems in which the physical system in question has inherent mobility. Examples of mobile physical systems include mobile robots and electronic devices transported by humans or animals.

[0109] It should be understood that Figure 1 In the figure, for the sake of clarity only, the user equipment is depicted as comprising 2 antennas. The number of receiving and / or transmitting antennas may naturally vary depending on the current implementation.

[0110] Additionally, although the apparatus is depicted as a single entity, different units, processors and / or memory units ( Figure 1 not all shown) can be implemented.

[0111] 5G enables the use of multiple-input multiple-output (MIMO) antennas, many more base stations or nodes than LTE (the so-called small cell concept), including macro sites operating in cooperation with smaller sites, and adopting various radio technologies depending on service requirements, use cases and / or available spectrum. 5G mobile communications support a wide range of use cases and related applications, including video streaming, augmented reality, different ways of data sharing and various forms of machine-type applications, including vehicle safety, different sensors and real-time control. 5G is expected to have multiple radio interfaces, namely below 6GHz, centimeter wave and millimeter wave, and can also be integrated with existing traditional radio access technologies (such as LTE). At least in the early stages, integration with LTE can be implemented as a system in which macro coverage is provided by LTE and 5G radio interface access comes from small cells aggregated to LTE. In other words, 5G plans to support both inter-RAT operability (such as LTE-5G) and inter-RI operability (inter-radio interface operability, such as below 6GHz-centimeter wave, below 6GHz-centimeter wave-millimeter wave). One of the concepts being considered for use in 5G networks is network slicing, in which multiple independent and dedicated virtual subnets (network instances) can be created within essentially the same infrastructure to run services with different requirements for latency, reliability, throughput, and mobility.

[0112] The current architecture in LTE networks is fully distributed in the radio and fully centralized in the core network. Low-latency applications and services in 5G require bringing content close to the radio, giving rise to local breakthroughs and multi-access edge computing (MEC). 5G enables analytics and knowledge generation to occur at the data source. This approach requires leveraging resources that may not be continuously connected to the network, such as laptops, smartphones, tablets, and sensors. MEC provides a distributed computing environment for application and service hosting. It also has the ability to store and process content close to cellular subscribers for faster response times. Edge computing covers a wide range of technologies such as wireless sensor networks, mobile data collection, mobile signature analysis, collaborative distributed peer-to-peer self-organizing networks and processing, and can also be categorized as local cloud / fog computing and grid / mesh computing, dew computing, mobile edge computing, thin cloud, distributed data storage and retrieval, autonomous self-healing networks, remote cloud services, augmented reality and virtual reality, data caching, Internet of Things (massive connectivity and / or latency critical), critical communications (autonomous vehicles, traffic safety, real-time analysis, time-critical control, healthcare applications).

[0113] The communication system can also communicate with or utilize services provided by other networks, such as the public switched telephone network or the Internet 112. The communication network can also support the use of cloud services, for example, at least part of the core network operations can be performed as a cloud service (this is in the Figure 1114). The communication system may also include a central control entity or the like, providing facilities for cooperation (eg, in terms of spectrum sharing) between networks of different operators.

[0114] Edge cloud can be introduced into the radio access network (RAN) by leveraging network function virtualization (NVF) and software defined networking (SDN). Using edge cloud may mean that access node operations are at least partially performed in a server, host or node that is operationally coupled to a remote radio head or base station including radio components. Node operations may also be distributed among multiple servers, nodes or hosts. The application of cloudRAN architecture enables RAN real-time functions to be performed on the RAN side (in the distributed unit DU 104), while non-real-time functions can be performed in a centralized manner (in the central or centralized unit CU108).

[0115] It should also be understood that the division of labor between core network operations and base station operations may be different from LTE or even non-existent. Some other technological advances that may be used are big data and all-IP, which may change the way networks are built and managed. 5G (or New Radio NR) networks are being designed to support multiple hierarchical structures, where MEC servers can be placed between the core and the base station or nodeB (gNB). It should be understood that MEC can also be applied to 4G networks.

[0116] 5G can also make use of satellite communications to enhance or supplement the coverage of 5G services, for example by providing backhaul. Possible use cases are to provide service continuity for machine-to-machine (M2M) or Internet of Things (IoT) devices or passengers on board, or to ensure service availability for critical communications and future railway / maritime / aeronautical communications. Satellite communications can make use of geostationary orbit (GEO) satellite systems as well as low earth orbit (LEO) satellite systems, in particular mega constellations (systems in which hundreds of (nano) satellites are deployed). At least one satellite 106 in a mega constellation can cover several satellite network entities creating a ground cell. The ground cell can be created by a ground relay node 104 or by a gNB located on the ground or in a satellite.

[0117] It is obvious to a person skilled in the art that the depicted system is only an example of a part of a radio access system, and in practice the system may include multiple (e / g)NodeBs, user equipment may have access to multiple radio cells, and the system may also include other devices, such as physical layer relay nodes or other network elements. At least one (e / g)NodeB may be a home (e / g)nodeB. In addition, in a geographical area of ​​the radio communication system, multiple different types of radio cells as well as multiple radio cells may be provided. A radio cell may be a macro cell (or umbrella cell), which is a large cell typically having a diameter of up to tens of kilometers, or a smaller cell, such as a micro, femto or pico cell. Figure 1 The (e / g)NodeB in the cellular radio system can provide any type of these cells. The cellular radio system can be implemented as a multi-layer network including several types of cells. Usually, in a multi-layer network, one access node provides one or more types of cells, so multiple (e / g)NodeBs are needed to provide such a network structure.

[0118] In order to meet the needs of improving the deployment and performance of communication systems, the concept of "plug and play" (e / g) NodeB has been introduced. Generally, a network that can use "plug and play" (e / g) NodeB includes a home (e / g) NodeB (H(e / g)nodeB) and a home NodeB gateway or HNB-GW ( Figure 1 The HNB Gateway (HNB-GW), which is usually installed in the operator’s network, can aggregate traffic from a large number of HNBs back to the core network.

[0119] The sixth generation (6G) network is expected to adopt flexible decentralized and / or distributed computing systems and architectures and ubiquitous computing, leveraging local spectrum licensing, spectrum sharing, infrastructure sharing and intelligent automation management based on mobile edge computing, artificial intelligence, short packet communications and blockchain technology. The key features of 6G include management and control functions for intelligent connectivity, programmability, integrated sensing and communications, reduced energy footprint, trusted infrastructure, scalability and affordability. In addition to this, 6G also targets new use cases, covering the integration of positioning and sensing capabilities into system definitions to unify user experience in the physical and digital worlds.

[0120] The (access node) function can be implemented in several different ways. Figure 1In some systems, the CU 108 and DU 104 are divided. For example, the CU 108 may host the radio resource control (RRC) and packet data convergence protocol (PDCP) layers for the control plane and the service data application protocol (SDAP) and PDCP layers for the user plane, while the DU 104 may host the radio link control (RLC) and MAC layers and the layer 1 / physical layer (L1 / PHY). In other systems (e.g., future 6G systems), the RLC may be divided between the CU 108 and the DU 104.

[0121] Figure 1 The system may be a (5G NR or 6G) communication system configured to support L1 / L2 mobility or more specifically at least L1 / L2 inter-cell mobility. In L1 / L2 mobility, the control of mobility moves from the CU to the DU and may therefore be activated, for example, via the MAC layer or the PHY layer. There are two modes for DU-based mobility: 1) intra-DU mobility (i.e., mobility between cells within the same DU) and 2) inter-DU mobility (i.e., mobility between cells within the same CU but different DUs). For intra-DU mobility, the DU has all the information required to decide on a serving cell change. The embodiments to be discussed below are specifically directed to inter-DU mobility and overcome certain problems associated therewith (to be discussed below). However, these embodiments are equally applicable to intra-DU mobility scenarios.

[0122] In contrast to the Layer 3 (L3) mobility procedure, where the handover between two cells is decided by the RRC layer, L1 / 2 inter-cell mobility may be performed (primarily) by the MAC layer terminating in the DU.

[0123] The main steps of an exemplary execution of L1 / L2 inter-cell mobility between an (initial) serving cell provided by a first distributed unit (DU1) of an access node (gNB) and a target cell provided by a second distributed unit (DU2) are summarized in the following items:

[0124] 1) Initially, the terminal device (UE) sends a measurement report containing cell quality measurements of the serving cell and neighboring cells to the central unit (CU) of the access node via DU1. The terminal device can be configured by the serving cell (i.e., by DU1) to send the measurement report as early as possible while there is still a good connection with the serving cell (i.e., with DU1).

[0125] 2) Using the reported cell quality measurements, the CU is able to identify a potential set of candidate target cells to which the terminal device can be handed over. In this example, the CU identifies candidate target cells served by DU1 (which also controls the serving DU / cell) and another DU2 controlled by the same CU.

[0126] 3) CU requests the preparation of the candidate target cell controlled by DU1 by sending a UE Context Setup Request message to DU1.

[0127] 4) In response to receiving the UE Context Setup Request, DU1 sends information about the configuration of the terminal device to the CU in a UE Context Setup Response message containing a container.

[0128] 5) Steps 3)-4) are performed in a similar manner between CU and DU2 to prepare the target cell(s) controlled by DU2.

[0129] 6) After receiving the configuration of the terminal device for (multiple) candidate target cells, the CU generates an RRC reconfiguration, which is sent from the CU to the terminal device (via DU1). The RRC reconfiguration message may include at least the measurement report configuration for L1 / 2 handover, i.e., the configuration on how to report the L1 beam measurement of the serving and target cells and the configuration of the prepared (multiple) candidate cells that the terminal device needs to execute when it receives a MAC CE command to change the serving cell (perform handover).

[0130] 7) The terminal device receives / obtains the RRC reconfiguration message and sends an RRC reconfiguration complete message back to the CU (via DU1).

[0131] 8) The terminal device starts to periodically report the L1 beam measurements of the serving and candidate target cells.

[0132] 9) When it is determined that there is a target candidate cell with better radio link / beam measurement than the serving cell, for example, the L1 reference signal received power (RSRP) measured by the target beam is greater than the sum of the L1-RSRP measured by the serving beam and an offset for a certain amount of time (e.g., trigger time (TTT)), DU1 sends a MAC CE or L1 message to the terminal device to trigger a cell change to the target candidate cell.

[0133] 10) Finally, the terminal device may perform a handover from the serving cell to the target cell.

[0134] As described above in conjunction with step 9), L1 / 2 mobility can be performed via a MAC CE sent to the terminal device. However, this solution has a serious disadvantage: the MAC CE is sent in plain text, i.e. without any encryption or integrity protection. This means that once the terminal device is configured with L1 / 2 mobility, a rogue access node (rogue gNB) can start sending L1 / 2 mobility commands to the terminal device and cause a DoS attack or force the terminal device to perform additional (unwanted) processes. It should be noted that there is no such problem with L3 mobility, because the RRC commands are both encrypted and integrity protected, so it is not possible to easily forge L3 mobility commands. In addition, encryption and integrity protection are performed in the Packet Data Convergence Protocol (PDCP) layer. Therefore, even for this purpose, it is not desirable to repeat those encryption and integrity protection functions in the MAC layer. Similarly, if any layer below PDCP is used for L1 / 2 mobility purposes, such as RLC, MAC or PHY / L1, the same problem exists.

[0135] The embodiments discussed in detail below are directed to overcoming or alleviating at least some of the problems discussed above with respect to (L1 / 2) mobility's vulnerability to network attacks (eg, DoS attacks).

[0136] Figure 2A , 2B 2C show processes performed (in parallel) by a terminal device, a central unit (CU) of an access node, and a distributed unit (DU) of an access node. Here, it is assumed that the terminal device is at least communicatively connected to the DU, the DU is communicatively connected to both the terminal device and the CU, and the CU is at least communicatively connected to the DU (and the core network). The DU may be a DU that specifically provides a serving cell used at the beginning of each process for serving the terminal device. The terminal device, the DU, and the CU may correspond to Figure 1 One of the terminal devices 100 and 102, Figure 1 DU 104 and Figure 1 CU 108. In the following, Figure 2A , 2B Any definition provided in relation to one of 2C may also apply to Figure 2A , 2B and other definitions in 2C.

[0137] refer to Figure 2A , it may be initially assumed that the terminal device is served via a serving cell provided by a DU of the access node. The terminal device may operate in RRC connected mode (with said DU).

[0138] In block 201, the terminal device obtains one or more security keys for switching (i.e., to be used for switching or at least a switching attempt). The switching here may correspond to at least a switching based on the first protocol layer and / or the second protocol layer. The first protocol layer and the second protocol layer may respectively include (or be) the physical layer of the 3PGG protocol architecture and the MAC layer of the 3GPP protocol architecture. The first protocol layer and the second protocol layer may respectively correspond to OSI layers 1 and 2 (L1 and L2), i.e., the physical layer and the data link layer. Alternatively, each of the first protocol layer and the second protocol layer may correspond to or include any of the layers or sublayers defined by 3GPP, for example, PHY / L1, MAC, RLC, PDCP, and RRC. One or more security keys may be used to decode the associated encoded security token. Before decoding the encoded security token, one or more security keys may have been configured using the RRC protocol.

[0139] In some embodiments, the obtaining in block 201 may include receiving information suitable for deriving the one or more security keys (e.g., from the DU providing the serving cell or from the CU), and then deriving the one or more security keys based on the information. The information suitable for deriving the one or more security keys may be sent as part of a (second) mobility configuration message for a (L1 / 2) mobility configuration of the terminal device (e.g., in conjunction with a UE message). Figure 2B In particular, said information suitable for deriving said one or more security keys may be or include one or more (security) token identities.

[0140] In some embodiments, the one or more security keys include: one or more security keys for one or more signaling radio bearers (SRBs), and / or one or more security keys for one or more data radio bearers (DRBs).

[0141] The terminal device receives a mobility signaling unit of the first protocol layer and / or the second protocol layer in block 202. The mobility signaling unit may be a mobility command or form part of a mobility command. For example, the mobility signaling unit may be an L1 / 2 mobility signaling unit. The mobility signaling unit includes: an encoded security token that has been encoded (e.g., encrypted and / or integrity protected) using at least one of one or more security keys. The transmission and subsequent reception of the mobility signaling unit may indicate that (L1 / 2) mobility to a specific target cell is to be performed as determined by the access node (or specifically by the DU). The target cell may specifically be a cell provided by another DU of the same access node (i.e., connected to the same CU), or a cell provided by the same DU of the same access node.

[0142] In some embodiments, the first protocol layer and / or the second protocol layer associated with the mobility signaling element includes or consists of one or both of a physical layer, a MAC layer and an RLC layer.

[0143] In other embodiments, the first protocol layer and / or the second protocol layer associated with the mobility signaling unit includes one or both of the following items, or consists of one or both of the following items: a physical layer, a MAC layer, an RLC layer, and a PDCP layer.

[0144] In other embodiments, the first protocol layer and / or the second protocol layer associated with the mobility signaling unit includes one or two of the following items, or consists of one or two of the following items: a physical layer, a MAC layer, an RLC layer, a PDCP layer, and an RRC layer.

[0145] In some embodiments, the mobility signaling unit may be a MAC CE or include a MAC CE. In some alternative embodiments, the mobility signaling unit may be downlink control information (DCI) or include downlink control information (DCI). The DCI may be provided by a physical downlink control channel (PDCCH) of the physical layer (L1).

[0146] The encoded security token included in the mobility signaling unit (e.g., MAC CE) may be a PDCP protocol data unit (PDU) or correspond to a PDCP protocol data unit (PDU). The PDCP PDU may be a data PDU or a control PDU. In such an embodiment, the terminal device may forward the PDCP PDU (i.e., the encoded security token) to the PDCP layer after receiving the mobility signaling unit. The decoding (i.e., block 203) may then be performed by the PDCP layer.

[0147] In some alternative embodiments, the encoded security token included in the mobility signaling unit (e.g., MAC CE) may be or correspond to an encoded message authentication code for integrity protection check (e.g., an encoded message authentication code for integrity MAC-I). In some examples, the encoded message authentication code may be checked by the PDCP layer for integrity protection.

[0148] The encoded and / or decoded security token may include random data (i.e., random bits), predefined data (provided via RRC), or additional control information. The additional control information may be control information provided by the CU to the terminal device. The additional control information may relate to, for example, control information related to mobility execution (e.g., related to DRB security keys and / or related to a target cell for handover).

[0149] In some embodiments, the mobility signaling unit or at least the security token may have been scrambled (by the DU or CU) using a radio network temporary identifier (RNTI) to indicate that at least a portion of the payload or mobility signaling unit has been encrypted and / or integrity protected. In this case, the security key includes the RNTI.

[0150] In block 203, the terminal device decodes the encoded security token using the at least one security key of the one or more security keys. The decoding may be performed exclusively using a PDCP entity of the terminal device. Information identifying the at least one security key of the one or more security keys (i.e., information for determining which of the one or more security keys should be used for the decoding in block 203) may be included in a mobility signaling unit. For example, a mobility signaling unit (e.g., a MAC CE) may include a token identity (also referred to as a security token identity). The token identity (or token identity field) is used to identify which of the one or more security keys is to be used for decoding the encoded security token.

[0151] When the RNTI is used to scramble the mobility signaling unit or at least a part of the mobility signaling unit (eg, an encoded security token), the RNTI may not be explicitly indicated in the mobility signaling unit (eg, MAC CE).The decoding may be done in the MAC layer (L2).

[0152] The decoding in block 203 may accordingly include decrypting and / or verifying the integrity of the encrypted and / or integrity protected security token. Both decryption and integrity verification may be performed in the PDCP. The decoding in block 203 may additionally or alternatively include descrambling the mobility signaling unit or a portion of the mobility signaling unit (e.g., the encoded security token) to obtain at least the security token.

[0153] After successful decoding in block 203, the terminal device can trigger or cause the execution of a handover from the serving cell to the target cell (the target cell is specified in, for example, a mobility signaling unit). Specifically, the terminal device can (initially) indicate the (L1 / 2) handover execution to the RRC and / or MAC layer from the PDCP entity or other entity that performs the integrity verification. The indication sent of the (L1 / 2) handover execution may include a mobility command. In some examples, the (encoded) security token may be provided in a mobility signaling unit (e.g., MAC CE) that is the same as or different from the actual mobility / handover command. In other words, for example, the (encoded) security token and the actual mobility / handover command may be sent as separate MAC CEs or within the same MAC CE.

[0154] After a failed decoding ( Figure 2A(not shown), the terminal device can indicate to the RRC layer (L1 / 2) that the handover has failed (from the PDCP entity or other entity performing integrity verification). In this case, the encoded security token can be simply discarded.

[0155] In some embodiments, the terminal device may cause the transmission of one or more RRC messages to one or more distributed units of one or more access nodes (e.g., to old and / or new serving distributed units) indicating that the decoding was successful (or, if this is the case, that the decoding was unsuccessful). The RRC messages may be sent via a MAC CE.

[0156] refer to Figure 2B , it can be assumed that the CU of the access node is initially configured with one or more security keys.

[0157] In block 211, the CU generates one or more encoded security tokens for handover and associated one or more token identities based on one or more security keys. Here, the generation of one or more encoded security tokens may include encryption and / or integrity protection of one or more security tokens.

[0158] In block 212, the CU sends a first (L1 / 2) mobility configuration message to the DU of the access node (or multiple DUs of the access node), the first mobility configuration message including: one or more encoded security tokens, and one or more token identities. The DU is configured to store the one or more encoded security tokens and the one or more token identities in at least one memory to configure (multiple) terminal devices based on them, and use them to trigger (L1 / 2) handover in a data-secure manner, as described below in conjunction with Figure 2C is described.

[0159] In some alternative embodiments, multiple (first) mobility messages may be sent from the CU to the DU to transmit one or more encoded security tokens, and one or more token identities to the DU. For example, one or more token identities may be transmitted in an initial first mobility message, and one or more security tokens may be transmitted in a subsequent first mobility message.

[0160] In block 213, the CU sends a second (L1 / 2) mobility configuration message for the first protocol layer and / or second protocol layer (e.g., L1 / 2) mobility of the terminal device to the terminal device via the DU (specifically, the DU of the service cell providing the terminal device). The second (L1 / 2) mobility configuration message can be sent via RRC signaling. The second mobility configuration message includes: at least one or all of one or more security tokens, and / or at least one or all of one or more token identities. It may be particularly beneficial if one or more token identities (but not the one or more security tokens themselves) are included in the second mobility configuration message sent, because the sending of one or more security tokens may make the solution vulnerable to plaintext attacks. The decision about which security tokens and / or token identities are sent to the terminal device can be based on the RRC configuration of the terminal device.

[0161] In some alternative embodiments, multiple (second) mobility messages may be sent from the CU to the terminal device via the DU for transmitting at least one or all of the one or more security tokens and at least one or all of the one or more token identities. For example, one or more token identities (or at least some of them) may be transmitted in an initial second mobility message, and one or more security tokens (or at least some of them) may be transmitted in a subsequent second mobility message.

[0162] To give an example of terminal device operation. Assume that the terminal device is configured with RRC signalling (i.e. using the second mobility configuration message) such that it knows that there is a security token with RNTI=12 (decimal number) which is associated with a token identity=5 (decimal number). Assume that these correspond to a particular encoded token=0xa12317300 (hexadecimal number). The terminal device then receives (as part of a mobility signalling unit) a token identity equal to 5, where the security token is equal to 0xa12317300. Based on the RRC configuration, the terminal device is able to understand that the token identity having a value of 5 is associated with an RNTI having a value of 12 (or generally, with a particular security key comprising said RNTI), and it can therefore decode the security token value to check whether it contains the correct RNTI.

[0163] refer to Figure 2C , it may be initially assumed that the DU of the access node is initially communicatively connected to a terminal device operating in RRC connected mode.

[0164] In block 221, the DU receives a first mobility configuration message (or at least one first mobility configuration message) from a central unit of the access node, the first mobility configuration message including: one or more encoded security tokens for handover, and one or more associated token identities (as described above in conjunction with block 212). In other words, the CU configures the one or more encoded security tokens and the associated one or more token identities for the DU to be used for handover (e.g., L1 / 2 based handover). The DU may store the one or more encoded security tokens and the associated one or more token identities in at least one memory ( Figure 2C not shown).

[0165] In block 222, the DU receives a second mobility configuration message (or at least one second mobility configuration message) from the central unit of the access node, and then forwards it to the terminal device in block 222, for first protocol layer and / or second protocol layer (e.g., L1 / 2) mobility of the terminal device. The (at least one) second mobility configuration message includes at least one or more token identities.

[0166] In block 223, the DU selects one of the one or more encoded security tokens for handover (i.e., to be used for handover or at least a handover attempt). The selection in block 223 may be triggered after completion of a process for evaluating a radio channel between the terminal device and a current serving cell provided by the DU to one or more radio channels between the terminal device and one or more target cells provided by one or more other DUs of the same CU. The evaluation may be based on measurement results obtained from all cells. The evaluation may be based on, for example, measurements of reference signal received power (RSRP) and / or reference signal received quality (RSRQ). The conditions for triggering the selection in block 223 will be combined with Figure 3 is described in further detail.

[0167] The DU sends a mobility signaling unit (e.g., L1 / 2 mobility MAC CE) to the terminal device in block 224. The mobility signaling unit includes: the selected one of the one or more encoded security tokens. The mobility signaling unit may be part of the mobility command or form part of the mobility command. The mobility signaling unit may be combined with the above Figure 2A The block 202 is defined as described above.

[0168] Figure 3 FIG. 4 shows an exemplary MACCE structure for a mobility signaling unit sent from a DU of a serving cell to a terminal device. In other words, Figure 3 The MAC CE structure shown in FIG. 1 corresponds to the MAC CE structure shown in FIG. 1 according to an embodiment. Figure 2A received in block 202 and Figure 2C The mobility signaling unit sent in block 224 of .

[0169] refer to Figure 3 , the MAC CE may include at least one of the following fields (exemplary sizes indicated in brackets): a reserved (R) field (e.g., 1 bit), a (security) token identity field (e.g., 4 bits), a cell identity field (e.g., 3 bits), and a security token field (e.g., N×8 bits, N being any positive integer). Figure 3 The sizes of the fields shown in should be considered exemplary and thus may differ in other embodiments from the fields described / illustrated herein. Figure 3 The first octet shown in is the header of the MAC CE created by the DU. The remaining octets include (or consist of) the (encoded) security token. Although Figure 3 The MAC CE that may be used in conjunction with the embodiments is specifically shown, but mobility signaling elements other than the MAC CE (eg, DCI) may also include any of the fields discussed herein.

[0170] The cell identity field indicates the target cell of mobility (or handover). The terminal device may be configured to cause the execution of a handover (based on L1 / 2) based on the cell identity field (i.e., cause the execution of a handover to the target cell specified by the cell identity field) in response to a successful decoding. The cell identity field may include a physical cell identifier (PCI). Alternatively, the cell identity field may include an indirect indication of a stored handover command (such as a conditional handover identifier (CHO ID)), or an indirect indication of the target cell of the handover based on the RRC configuration of the terminal device.

[0171] The token identity field (also referred to as the security token identity field) indicates which security key the terminal device should use to decode the encoded security token (see next paragraph). The terminal device may be configured to select at least one of the one or more security keys to be used for decryption based on the token identity field. The token identity field is used by the terminal to derive a security key for decoding (e.g., for decryption and / or integrity verification) of the security token field. In the example shown, the token identity field may have a size of 4 bits, but other (particularly larger) sizes (such as 16 bits) are also feasible. Alternatively or additionally, the token identity field may include an encoded SRB or DRB identifier that can be used by the terminal device to determine the PDCP entity that can be used to decode the security token.

[0172] The Security Token field is an encoded (ie, encrypted and / or integrity protected) field consisting of N octets. The Security Token field includes a security token in an encoded format. The Security Token field may correspond to a PDCP PDU.

[0173] The security token field may be generated by the CU based on the security key derived for SRB1 (or any other SRB or DRB). The generation of the security token field may be performed in a manner similar to the secondary node key (S-KgNB) derivation for New Radio Dual Connectivity (NR-DC). That is, the token identity field may be used as a so-called SK counter (i.e., a counter for ensuring the freshness of the derived key) for S-KgNB type key derivation. The token identity field may be indicated by the terminal device to the PDCP layer for security key derivation.

[0174] As described above, the PDCP PDU included in the security token field may be a (empty) data PDU (D-PDU) or a (empty) control PDU (C-PDU). However, in either case, the content of the PDCP PDU may be random bits, predefined information provided via RRC, or additional control information about the mobile execution provided by the CU to the terminal device (e.g., related to the DRB security key).

[0175] In some embodiments, Figure 3 One or more of the fields shown in the Token Identity field may be omitted. For example, in some embodiments, the Cell Identity field may be omitted (and if the associated information is not already available, the associated information may be transmitted separately to the terminal device). As another example, if the RNTI is used for scrambling / encoding, the Token Identity field may be omitted.

[0176] Figure 4 The signaling between a terminal device, a first distributed unit of an access node (first DU or DU1), a second distributed unit of the access node (second DU or DU2), and a central unit (CU) of the access node according to one embodiment is shown. Here, the first DU may correspond to an initial serving distributed unit for the terminal device, and the second DU may correspond to a target distributed unit for a (potential) handover. The first and second DU may be distributed units of the same access node (and therefore connected to the same CU). The terminal device, the first and / or second DU, and the CU may correspond to Figure 1 One of the terminal devices 100 and 102, Figure 1 DU 104 and Figure 1 CU 108.

[0177] Figure 4 The process shown in corresponds to combining Figure 2A , 2B A more detailed implementation of the process discussed in 2C. Figure 2A , 2B and 2C and Figure 3Any definitions provided in relation also apply here, but must be modified accordingly.

[0178] refer to Figure 4 , it may be initially assumed that the terminal device operates in RRC connected mode and is served via a serving cell provided by the first CU. In some other embodiments, the terminal device may initially operate in (RRC) inactive mode.

[0179] In block 401, the CU generates one or more encoded security tokens for (L1 / 2-based) handover and associated one or more token identities based on one or more security keys. The one or more security keys may be predefined. The encoding may include encryption and / or integrity protection herein and below. As described above, the one or more encoded security tokens may be, for example, encoded PDCP security tokens.

[0180] The CU sends a first (L1 / 2) mobility configuration message to the first DU in message 402 , the mobility configuration message including: one or more encoded security tokens, and one or more token identities. In some embodiments, only one or more encoded security tokens may be sent in message 402 .

[0181] The first DU receives the one or more encoded security tokens and the one or more token identities in the first mobility configuration message in block 403 and stores them in at least one memory also in block 403 .

[0182] The CU also sends a second (L1 / 2) mobility configuration message to the terminal device via the first DU in elements 404 to 406, the second (L1 / 2) mobility configuration message including: at least one or all of one or more encoded security tokens, and / or one or more token identities. In other words, the CU sends the second mobility configuration message to the first DU in message 404, and then the first DU forwards the second mobility configuration message to the terminal device after receiving the second mobility configuration message in block 405. In some embodiments, message 404 can be omitted (because the same information has been transmitted in message 402).

[0183] The terminal device receives a second (L1 / 2) mobility configuration message from the first DU in block 407. Subsequently, the terminal device configures itself according to the received second mobility configuration message in block 407. If the second mobility configuration message does not include a security token (but includes one or more token identities), the configuration in block 407 may include first generating one or more security tokens based on the one or more token identities included in the second mobility configuration message. The configuration in block 407 may also include: deriving (or generating) one or more security keys based on the one or more token identities included in the second mobility configuration message or generated by the terminal device. Thereafter, the terminal device may operate using the (L1 / 2) mobility process defined in the second mobility configuration message.

[0184] The terminal device may perform one or more (radio) measurements on the target cell provided by the second DU in message 408. The terminal device may generate a measurement report for the target cell based on the one or more measurements in block 409 and send the measurement report for the target cell to the first DU in message 410 for evaluation.

[0185] The first DU may receive the measurement report in block 411 and evaluate, based at least on the measurement report, whether it is necessary to perform a (L1 / 2-based) handover from a serving cell provided by the first DU to a target cell provided by the second DU in block 411. In some embodiments, the evaluation in block 411 may take into account one or more additional measurement reports related to the target cell and / or one or more measurement reports related to the serving cell.

[0186] In response to the result of the evaluation indicating the need to perform (L1 / 2-based) switching in block 412, the first DU may select one or more encoded security tokens (i.e., one of the one or more encoded security tokens configured by the CU to the terminal device) for use in the (L1 / 2-based) switching in block 413.

[0187] The first DU sends a mobility signaling unit of the first protocol layer and / or the second protocol layer (e.g., L1 / 2) to the terminal device in a message 414. The mobility signaling unit may be similarly referred to as a mobility command or included in a mobility command. The mobility signaling unit includes: the selected one of the one or more encoded security tokens. As discussed in conjunction with the above embodiments, the mobility signaling unit may be, for example, a MAC CE or an RRC message.

[0188] The terminal device receives the mobility signaling unit in block 415. If the mobility signaling unit is a MAC CE including a PDCP PDU corresponding to the encoded security token, the terminal device may forward the PDCP PDU to the PDCP layer for decoding in block 415.

[0189] In block 416, the terminal device decodes (e.g., decrypts and / or verifies integrity) the encoded security token included in the mobility signaling unit using at least one security key of the one or more security keys configured to the terminal device in block 407 (the same as the security key used for encoding).

[0190] If the decoding is successful in block 416, the terminal device (or its PDCP entity) may indicate handover execution to the RRC layer in block 417. In other words, if the decoding is successful, the terminal device may cause or trigger execution of the handover.

[0191] If the decoding is unsuccessful in block 416, the terminal device (or its PDCP entity) may indicate a handover failure to the RRC layer in block 417. In some embodiments, the failure indication may be omitted.

[0192] In some embodiments, when decoding is unsuccessful, the terminal device may switch from RRC connection mode to RRC idle or inactive mode. Additionally or alternatively, when decoding is unsuccessful, the terminal device may trigger an RRC reconstruction process. Additionally or alternatively, when decoding is unsuccessful, the terminal device may indicate the decoding failure to the network (i.e., the first DU and / or the second DU) through the RRC layer. Based on the indication, the network (e.g., the first DU or the second DU or the CU of the access node) may check whether the associated MAC CE for mobility (i.e., message 414) is sent by it. This may also allow the network to securely update security configurations via RRC.

[0193] The terminal device may also optionally indicate the mobility success or failure to the first DU and / or the second DU via (multiple) MAC CEs in (multiple) messages 418. This may allow the network to determine whether or how to resend the mobility signaling unit (or mobility command). The first DU and the second DU receive the indication in blocks 419, 420. In some embodiments, the indication 418 may also be sent to the CU (e.g., using RRC signaling).

[0194] In an embodiment, the PDCP entity of the CU of the access node (e.g., of SRB1 or any other SRB or DRB) is configured to encode the MAC-I based on the MAC CE content that can be used to indicate mobility. In other words, the DU of the access node can be configured to generate a MAC CE and provide it to the CU of the access node (or specifically to its given PDCP entity) for MAC-I generation. The resulting MAC-I is then combined with the above (e.g., Figure 3 ) is embedded in the MAC CE in a similar manner as discussed for the PDCP PDU. Similarly, the terminal device can then be configured to provide the entire MAC CE and the embedded MAC-I to the PDCP entity of the terminal device for integrity verification. In this alternative, only the integrity check of the network will be performed. In addition, in this case, the MAC CE should also introduce some kind of token identity, which can be changed for each MAC CE to avoid using the same MAC-I multiple times.

[0195] In an embodiment, if RNTI is used for scrambling / coding of mobile signaling units, decoding may be performed on the MAC layer (L2). The MAC layer may decide whether the decoding is considered successful and thus decide whether to send the decoding result to the RRC layer.

[0196] In an embodiment, the distributed unit of the access node may be configured to send a MAC CE for a mobility command without any security material (e.g., without PDCP PDU / MAC-I, security token, etc.). This may occur in particular when one or more control plane (CP) and / or user plane (UP) packets are sent by the distributed unit to the terminal device together with the same MAC PDU as the MAC CE for the mobility command. In this case, the terminal device may be configured to determine the integrity of the network based on the received one or more CP and / or UP packets.

[0197] The above-mentioned Figure 2A , 2B The blocks, related functions and information exchanges (messages) described in , 2C and 4 are not absolutely arranged in chronological order, some of them can be executed simultaneously or in an order different from the given order. Other functions can also be executed between or within them, and other information can be sent and / or other rules can be applied. Some blocks or parts of blocks or one or more information can also be omitted or replaced by corresponding blocks or parts of blocks or one or more information.

[0198] Figure 5 An apparatus 501 according to some embodiments is provided. Specifically, Figure 5An apparatus 501 configured to perform at least some of the above functions related to performing (lower layer) mobility in a secure manner may be shown. The apparatus may be or form part of a terminal device, a distributed unit of a distributed access node or a central unit of a distributed access node.

[0199] The apparatus 501 may include one or more control circuit systems 520, such as at least one processor, and / or at least one memory 530, including one or more algorithms 531, such as computer program code (software), wherein the at least one memory and the computer program code (software) are configured together with the at least one processor to enable the apparatus 501 to perform any of the exemplary functions of a terminal device, a distributed unit of an access node, or a central unit of an access node. The at least one memory 530 may also include at least one database 532.

[0200] refer to Figure 5 , the one or more communication control circuit systems 520 of the apparatus 501 include at least one mobility circuit system 521, which is configured to perform secure mobility functions according to an embodiment. The mobility circuit system 521 can be configured to use one or more separate circuit systems to perform functions related to the above-mentioned terminal device, (first and / or second) distributed unit or central unit, for example, by Figure 2A , 2B , 2C, 3 and 4.

[0201] refer to Figure 5 , memory 530 may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, flash memory, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory.

[0202] refer to Figure 5 , the device 501 may also include different interfaces 510, such as one or more communication interfaces (TX / RX), including hardware and / or software for implementing communication connections according to one or more communication protocols. Specifically, one or more communication interfaces 510 may include, for example, interfaces that provide connections to the Internet and the core network of a wireless communication network. For example, one or more communication interfaces 510 may provide the device with communication capabilities to communicate in a cellular communication system and enable communication and / or communication interfaces with user equipment (terminal equipment) and different network nodes or elements (e.g., distributed and / or central units of access nodes) to enable communication between different network nodes or elements. One or more communication interfaces 510 may include standard well-known components, such as amplifiers, filters, frequency converters, (de)modulators and encoder / decoder circuit systems, and one or more antennas controlled by corresponding control units.

[0203] As used in this application, the term "circuitry" may refer to one or more or all of the following: (a) hardware circuitry implementations only, such as implementations in analog and / or digital circuitry only, and (b) combinations of hardware circuitry and software (and / or firmware), such as (as applicable): (i) a combination of analog and / or digital hardware circuitry and software / firmware, and (ii) any portion of a hardware processor(s) with software, including a digital signal processor(s), software, and memory(s), which work together to enable an apparatus (such as a terminal device or access node) to perform various functions, and (c) hardware circuitry and processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), which requires software (e.g., firmware) to operate, but which may not be present when the software is not required for operation. This definition of "circuitry" applies to all uses of the term in this application, including any claims. As a further example, as used in this application, the term "circuitry" also covers implementations of hardware circuitry or processor(s) or a portion of a hardware circuitry or processor and its (or their) accompanying software and / or firmware. The term "circuitry" also covers, for example, a baseband integrated circuit for an access node or terminal device or other computing or networking equipment, if applicable to a particular claim element.

[0204] In an embodiment, Figure 2A , 2B At least some of the processes described in , 2C, 3 and 4 may be performed by a device including corresponding components for performing at least some of the processes. Some example components for performing these processes may include at least one of the following items: a detector, a processor (including dual-core and multi-core processors), a digital signal processor, a controller, a (radio) receiver, a (radio) transmitter, a (radio) transceiver, an encoder, a decoder, a memory, a RAM, a ROM, software, firmware, a display, a user interface, a display circuit system, a user interface circuit system, a user interface software, a display software, a circuit, an antenna, an antenna circuit system and a circuit system. In some embodiments, the components include at least at least one processor and a (radio) transceiver.

[0205] In some embodiments, at least one processor, memory, and computer program code form a processing component or include one or more computer program code portions for performing one or more operations according to any of the embodiments of 2A, 2B, 2C, 3, and 4 or their operations.

[0206] According to one embodiment, an apparatus (e.g., a terminal device or a portion thereof) is provided, comprising means for performing the following:

[0207] obtaining one or more security keys for switching;

[0208] receiving a mobility signaling unit of a first protocol layer and / or a second protocol layer (eg, L1 / 2), wherein the mobility signaling unit comprises: at least one encoded security token that has been encoded using at least one security key of the one or more security keys; and

[0209] The encoded security token is decoded using at least one security key of the one or more security keys.

[0210] According to one embodiment, an apparatus (e.g., a terminal device or a part thereof) is provided, comprising: at least one processor; and at least one memory, including computer program code; the at least one memory and the computer program code are configured together with the at least one processor so that the apparatus at least performs:

[0211] obtaining one or more security keys for switching;

[0212] receiving a mobility signaling unit of a first protocol layer and / or a second protocol layer (eg, L1 / 2), wherein the mobility signaling unit comprises: at least one encoded security token that has been encoded using at least one security key of the one or more security keys; and

[0213] The encoded security token is decoded using at least one security key of the one or more security keys.

[0214] According to one embodiment, there is provided an apparatus (e.g., a central unit of an access node or a part thereof) comprising means for performing the following:

[0215] generating one or more encoded security tokens for handover and associated one or more token identities based on the one or more security keys;

[0216] sending at least one first mobility configuration message to a distributed unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens, and one or more token identities; and

[0217] At least one second mobility configuration message is sent to the terminal device via the distributed unit of the access node, wherein the at least one second mobility configuration message includes: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities.

[0218] According to one embodiment, there is provided an apparatus (e.g., a central unit of an access node or a part thereof), comprising: at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code are configured together with the at least one processor so that the apparatus at least performs:

[0219] generating one or more encoded security tokens for handover and associated one or more token identities based on the one or more security keys;

[0220] sending at least one first mobility configuration message to a distributed unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens, and one or more token identities; and

[0221] At least one second mobility configuration message is sent to the terminal device via the distributed unit of the access node, wherein the at least one second mobility configuration message includes: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities.

[0222] According to one embodiment, there is provided an apparatus (e.g., a distributed unit of an access node or a portion thereof) comprising means for performing the following:

[0223] receiving at least one first mobility configuration message from a central unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens for handover, and associated one or more token identities; and

[0224] in response to receiving at least one second mobility configuration message from the central unit, the at least one second mobility configuration message comprising: at least one or all of the one or more security tokens, and / or at least one or all of the one or more token identities, forwarding the at least one second mobility configuration message to the terminal device;

[0225] selecting one of the one or more encoded security tokens for switching; and

[0226] A mobility signaling unit of a first protocol layer and / or a second protocol layer (eg, L1 / 2) is sent to a terminal device, wherein the mobility signaling unit includes: the one encoded security token among the one or more encoded security tokens.

[0227] According to one embodiment, there is provided an apparatus (e.g., a distributed unit of an access node or a portion thereof), comprising: at least one processor; and at least one memory, including computer program code; the at least one memory and the computer program code are configured with the at least one processor so that the apparatus at least performs:

[0228] receiving at least one first mobility configuration message from a central unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens for handover, and associated one or more token identities; and

[0229] in response to receiving at least one second mobility configuration message from the central unit, the at least one second mobility configuration message comprising: at least one or all of the one or more security tokens, and / or at least one or all of the one or more token identities, forwarding the at least one second mobility configuration message to the terminal device;

[0230] selecting one of the one or more encoded security tokens for switching; and

[0231] A mobility signaling unit of a first protocol layer and / or a second protocol layer (eg, L1 / 2) is sent to a terminal device, wherein the mobility signaling unit includes: the one encoded security token among the one or more encoded security tokens.

[0232] The embodiments may also be implemented in the form of a computer process defined by a computer program or part thereof. Figure 2A , 2B , 2C, 3 and 4 The embodiments of the methods described can be performed by executing at least a portion of a computer program including corresponding instructions. The computer program can be provided as a computer-readable medium including program instructions stored thereon or as a non-transient computer-readable medium including program instructions stored thereon. The computer program can be in source code form, object code form, or some intermediate form, and can be stored in a carrier, which can be any entity or device capable of carrying the program. For example, the computer program can be stored on a computer program distribution medium readable by a computer or processor. For example, the computer program medium can be, for example, but not limited to, a recording medium, a computer memory, a read-only memory, an electrical carrier signal, a telecommunication signal, and a software distribution package. The computer program medium can be a non-transient medium. The software coding used to execute the illustrated and described embodiments is entirely within the scope of ordinary technicians in the field.

[0233] Although the embodiments have been described above with reference to the examples in the accompanying drawings, it is clear that the embodiments are not limited thereto, but can be modified in various ways within the scope of the appended claims. Therefore, all words and expressions should be interpreted broadly, and they are intended to illustrate rather than limit the embodiments. It will be apparent to those skilled in the art that, with the advancement of technology, the inventive concept can be implemented in various ways. In addition, it is apparent to those skilled in the art that the embodiments can (but not necessarily) be combined with other embodiments in various ways.

Claims

1. A device comprising: at least one processor; as well as at least one transceiver, wherein the at least one processor is configured to: obtaining one or more security keys for switching; wherein the at least one transceiver is configured to: receiving a mobility signaling unit of a first protocol layer and / or a second protocol layer, wherein the mobility signaling unit comprises: at least one encoded security token that has been encoded using at least one security key of the one or more security keys; as well as wherein the at least one processor is configured to: The encoded security token is decoded using the at least one security key of the one or more security keys.

2. The apparatus of claim 1, wherein the decoding comprises: Decryption and / or integrity verification is performed on the encoded security token, and / or the encoded security token that has been encrypted and / or integrity protected using the at least one of the one or more security keys.

3. The apparatus according to claim 1 or 2, wherein the mobility signaling unit comprises: Media Access Control MAC control element CE, or downlink control information DCI.

4. The apparatus according to any preceding claim, wherein the at least one processor is configured to: When the encoded security token is successfully decoded, execution of a handover to a target cell is caused.

5. The apparatus according to any preceding claim, wherein the at least one transceiver is configured to: A message is sent to the access node, or to a distributed unit of the access node, indicating whether the decoding of the mobility signalling unit is successful.

6. An apparatus according to any preceding claim, wherein the at least one processor is configured to: When the decoding of the encoded security token is successful, indicating to a radio resource control (RRC) layer that the handover is to be performed; and / or When the decoding of the encoded security token is unsuccessful, indicating the handover failure to the RRC layer.

7. The apparatus of any preceding claim, wherein when the decoding is unsuccessful, the at least one processor is configured to: Switching from RRC connected mode to RRC idle or RRC inactive mode; and / or Trigger the RRC re-establishment process.

8. The apparatus of any preceding claim, wherein the receiving of the mobility signaling unit comprises: The mobility signaling unit is received from an access node, or a distributed unit of an access node.

9. An apparatus according to any preceding claim, wherein the encoded security token and / or the decoded security token comprises: Random data, predefined data, or additional control information.

10. The apparatus of any preceding claim, wherein the mobility signaling unit further comprises: Token identity and / or cell identity.

11. The apparatus of claim 10, wherein the at least one processor is configured to: The at least one security key of the one or more security keys for decoding the encoded security token is selected based on the token identity included in the mobility signaling element.

12. An apparatus according to any preceding claim, wherein the encoded security token comprises: Packet Data Convergence Protocol PDCP, Protocol Data Unit PDU, or Encoded Message Authentication Code MAC-I for integrity.

13. An apparatus according to any preceding claim, wherein the mobility signaling unit has been scrambled at least in part using a radio network temporary identifier (RNTI) for indicating that a payload of the mobility signaling unit has been encrypted and / or integrity protected, and the at least one of the one or more security keys includes the RNTI.

14. An apparatus as claimed in any preceding claim, wherein the one or more security keys have been configured using the RRC protocol.

15. An apparatus according to any preceding claim, wherein the one or more security keys comprise: One or more security keys for one or more signaling radio bearers, and / or one or more security keys for one or more data radio bearers.

16. The apparatus according to any preceding claim, wherein the first protocol layer and / or the second protocol layer comprises or consists of one or both of the following: Physical layer, MAC layer, and Radio Link Control RLC layer.

17. The apparatus according to any one of claims 1 to 15, wherein the first protocol layer and / or the second protocol layer comprises one or both of the following items, or consists of one or both of the following items: Physical layer, MAC layer, RLC layer, and PDCP layer.

18. An apparatus comprising: at least one processor; as well as at least one transceiver, wherein the at least one processor is configured to: generating one or more encoded security tokens for handover and associated one or more token identities based on the one or more security keys, wherein the at least one transceiver is configured to: sending at least one first mobility configuration message to a distributed unit of an access node, the at least one first mobility configuration message comprising: the one or more encoded security tokens, and the one or more token identities; and At least one second mobility configuration message is sent to the terminal device via the distributed unit of the access node, wherein the at least one second configuration message includes: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities.

19. The apparatus of claim 18, wherein the generating of the one or more encoded security tokens comprises: Encryption and / or integrity protection of one or more security tokens.

20. The apparatus of claim 18 or 19, wherein the one or more encoded security tokens comprise, in encoded form: Random data, predefined data, or additional control information.

21. The apparatus of any one of claims 18 to 20, wherein the one or more security keys include: One or more security keys for one or more signaling radio bearers, and / or one or more security keys for one or more data radio bearers.

22. An apparatus comprising: at least one processor; as well as at least one transceiver, wherein the at least one transceiver is configured to: receiving at least one first mobility configuration message from a central unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens for handover, and associated one or more token identities; and in response to receiving at least one second mobility configuration message from the central unit, the at least one second mobility configuration message comprising: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities, forwarding the at least one second mobility configuration message to the terminal device, wherein the at least one processor is configured to: selecting one of the one or more encoded security tokens for switching, wherein the at least one transceiver is configured to: A mobility signaling unit of the first protocol layer and / or the second protocol layer is sent to the terminal device, wherein the mobility signaling unit includes: the one encoded security token among the one or more encoded security tokens.

23. The apparatus of claim 22, wherein the one or more encoded security tokens are encrypted and / or integrity protected security tokens.

24. The apparatus according to claim 22 or 23, wherein the mobility signaling unit comprises a MAC CE or a DCI.

25. The apparatus of any one of claims 22 to 24, wherein the at least one processor is configured to: evaluating a need to perform a handover from the serving cell to the target cell based on one or more measurement reports relating to the serving cell and / or the target cell; and Responsive to a result of evaluating indicating said need for said performance of said switching, said selecting of said one of said one or more encoded security tokens for switching is performed.

26. The apparatus according to any one of claims 22 to 25, wherein the at least one transceiver is configured to: A message is received from the terminal device indicating whether decoding of the mobility signaling unit at the terminal device was successful.

27. The apparatus according to any one of claims 22 to 26, wherein the mobility signaling unit further comprises: Token identity and / or cell identity.

28. The apparatus of any one of claims 22 to 27, wherein the encoded security token is a PDCP PDU or a MAC-I.

29. The apparatus of any one of claims 22 to 28, wherein the at least one processor is configured to: The mobility signaling unit is at least partially scrambled using the RNTI prior to transmission for indicating that a payload of the mobility signaling unit has been encrypted and / or integrity protected.

30. The apparatus of any one of claims 22 to 29, wherein the at least one processor is configured to: The one or more encoded security tokens, and the associated one or more token identities are stored to at least one memory.

31. The apparatus according to any one of claims 22 to 30, wherein the first protocol layer and / or the second protocol layer comprises or consists of one or both of the following: Physical layer, MAC layer, and RLC layer.

32. The apparatus according to any one of claims 22 to 30, wherein the first protocol layer and / or the second protocol layer comprises or consists of one or both of the following: Physical layer, MAC layer, RLC layer, and PDCP layer.

33. A method comprising: obtaining one or more security keys for switching; receiving a mobility signaling unit of a first protocol layer or a second protocol layer, wherein the mobility signaling unit comprises: at least one encoded security token that has been encoded using at least one security key of the one or more security keys; as well as The encoded security token is decoded using the at least one security key of the one or more security keys.

34. A method comprising: generating one or more encoded security tokens for handover and associated one or more token identities based on the one or more security keys, sending at least one first mobility configuration message to a distributed unit of an access node, the at least one first mobility configuration message comprising: the one or more encoded security tokens, and the one or more token identities; and At least one second mobility configuration message is sent to a terminal device via the distributed unit of the access node, wherein the second configuration message includes: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities.

35. A method comprising: receiving at least one first mobility configuration message from a central unit of an access node, the at least one first mobility configuration message comprising: one or more encoded security tokens for handover, and associated one or more token identities; and in response to receiving at least one second mobility configuration message from the central unit, the at least one second mobility configuration message comprising: at least one or all of the one or more security tokens, and / or at least one or all of the one or more token identities, forwarding the at least one second mobility configuration message to the terminal device; selecting one of the one or more encoded security tokens for switching; and A mobility signaling unit of a first protocol layer and / or a second protocol layer is sent to the terminal device, wherein the mobility signaling unit includes: the one encoded security token among the one or more encoded security tokens.

36. A non-transitory computer readable medium comprising program instructions for causing an apparatus to at least perform the following: obtaining one or more security keys for switching; Receiving a mobility signaling unit of a first protocol layer and / or a second protocol layer, wherein the mobility signaling unit comprises: at least one encoded security token that has been encoded using at least one of the one or more security keys; as well as The encoded security token is decoded using the at least one security key of the one or more security keys.

37. A non-transitory computer readable medium comprising program instructions for causing an apparatus to at least perform the following: generating one or more encoded security tokens for handover and associated one or more token identities based on the one or more security keys, Sending at least one first mobility configuration message to a distributed unit of an access node, the at least one first mobility configuration message comprising: the one or more encoded security tokens, and the one or more token identities; as well as At least one second mobility configuration message is sent to a terminal device via the distributed unit of the access node, wherein the second configuration message includes: at least one or all of the one or more security tokens and / or at least one or all of the one or more token identities.

38. A non-transitory computer readable medium comprising program instructions for causing an apparatus to at least perform the following: Receiving at least one first mobility configuration message from a central unit of an access node, the at least one first mobility configuration message comprising: One or more encoded security tokens for switching, and associated one or more token identities; in response to receiving at least one second mobility configuration message from the central unit, the at least one second mobility configuration message comprising: at least one or all of the one or more security tokens, and / or at least one or all of the one or more token identities, forwarding the at least one second mobility configuration message to the terminal device; selecting one of the one or more encoded security tokens for switching; and A mobility signaling unit of the first protocol layer and / or the second protocol layer is sent to the terminal device, wherein the mobility signaling unit includes: the one encoded security token among the one or more encoded security tokens.

Images