System and method for security protection of NAS messages

Abstract

Systems and methods for providing NAS security protection for a mobile network. In one embodiment, when there is no NAS security context, a network element of a mobile network performs an NAS procedure in multiple stages to establish an NAS communication session with a user equipment (UE). For a first stage, the network element receives, from the UE, an initial NAS message populated with a subset of NAS protocol information elements (IEs) specified for security related processing, selects a NAS security algorithm for the NAS security context, and sends a response to the UE indicating the NAS security algorithm. For a second stage, the network element receives, from the UE, a subsequent NAS message having a NAS message container, the NAS message container containing the initial NAS message populated with each of the NAS protocol IEs for the NAS process, and decrypts the NAS message container of the subsequent NAS message using the NAS security algorithm.

Description

[0001] This application is a divisional application of the invention patent application with international application number PCT / FI2019 / 050685, international application date September 24, 2019, entering the Chinese national stage on April 27, 2021, Chinese national application number 201980071244X, and invention name “System and method for security protection of NAS messages”.

[0002] Related Applications

[0003] This non-provisional patent application claims priority to U.S. Provisional Patent Application No. 62 / 735,732, filed on September 24, 2018, which is incorporated herein by reference as if fully set forth. Technical Field

[0004] The present disclosure relates to the field of communication systems, and in particular, to security in networks. Background Art

[0005] Service providers or operators implement mobile networks to provide a large number of voice and data services to end users of mobile phones or other mobile devices / terminals, which are generally referred to as user equipment (UE). Some examples of voice services are voice calls, call forwarding, call waiting, etc. Some examples of data services are Internet access, streaming audio, streaming video, online games, Internet Protocol Television (IP-TV), etc. A mobile network is a type of network where the final link to the end user is wireless. A mobile network typically includes a core network and one or more radio access networks (RANs) that exchange signaling and data with the UE over a radio interface. A typical mobile network is logically divided into a user plane and a control plane. The user plane is a logical plane responsible for carrying user data sent through the network, while the control plane is a logical plane responsible for carrying signaling for establishing communications for the UE. The 3rd Generation Partnership Project (3GPP) specification divides cellular protocols into two layers: non-access stratum (NAS) and access stratum (AS). AS consists of communications between UE and RAN (e.g., eNodeB) via radio frequency (RF) channels. NAS consists of non-radio signaling traffic between the UE and the core network (e.g., the Mobility Management Entity (MME) for LTE or the Access and Mobility Management Function (AMF) for a network-generating network). 3GPP has implemented security procedures to protect control plane messages (e.g., NAS messages) from various attacks. However, it would be advantageous to identify enhanced security procedures that provide further protection for control plane messages. Summary of the invention

[0006] Embodiments described herein provide enhanced protection for NAS messages. NAS procedures (e.g., registration of a UE) include a set of information elements (IEs) that carry information. Embodiments described below describe ways to protect IEs or subsets of IEs sent in NAS messages. As a result, the information carried in the IEs is less susceptible to malicious attacks.

[0007] One embodiment includes a network element of a mobile network. The network element includes a processor and a memory, the memory including computer program code executable by the processor. The processor is configured to cause the network element to perform a NAS process in multiple stages to establish a NAS communication session between the network element and a UE. For the first stage of the NAS process, the processor is further configured to cause the network element to receive an initial NAS message from the UE, wherein the initial NAS message is populated with a subset of NAS protocol IEs designated for security-related processing from the NAS protocol IEs for the NAS process. The processor is further configured to cause the network element to process the subset of the NAS protocol IEs to determine that there is no NAS security context for the UE, select a NAS security algorithm for the NAS security context, and send a response indicating the NAS security algorithm for the NAS security context and a security key set identifier to the UE. For the second stage of the NAS process, the processor is further configured to cause the network element to receive a subsequent NAS message with a NAS message container from the UE, the NAS message container containing the initial NAS message encrypted based on the NAS security algorithm; and decrypt the NAS message container of the subsequent NAS message, wherein the initial NAS message contained in the NAS message container of the subsequent NAS message is populated with each NAS protocol IE for the NAS process.

[0008] In another embodiment, for the first phase, a subset of NAS protocol IEs in the initial NAS message is encrypted using a public key for the UE's Home Public Land Mobile Network (HPLMN).The processor is further configured to cause the network element to initiate decryption of the subset of NAS protocol IEs.

[0009] In another embodiment, the network element comprises an Access and Mobility Management Function (AMF) element of a mobile network.

[0010] In another embodiment, the processor is further configured to cause the network element to send the encrypted subset of NAS protocol IEs to a unified data management (UDM) element to decrypt the subset of NAS protocol IEs based on a private key of the HPLMN.

[0011] In another embodiment, the initial NAS message comprises a Registration Request message.The subset of NAS protocol IEs designated for security related processing consists of the following: the mobile identity of the UE, the UE security capabilities indicating one or more NAS security algorithms supported by the UE, the registration type, and the security key set identifier of the NAS security context.

[0012] In another embodiment, the response includes a Security Mode Command message indicating a NAS security algorithm and a security key set identifier, and a subsequent NAS message received from the UE includes a Security Mode Complete message having a NAS message container including the initial NAS message encrypted based on the NAS security algorithm.

[0013] In another embodiment, the mobile network comprises a fifth generation (5G) network.

[0014] Another embodiment includes a method of performing a NAS procedure to establish a NAS communication session between a UE and a network element of a mobile network. For a first phase of the NAS procedure, the method includes receiving an initial NAS message from the UE at the network element, wherein the initial NAS message is populated with a subset of NAS protocol IEs from NAS protocol IEs for the NAS procedure that are designated for security-related processing. Further for the first phase, the method includes: processing the subset of NAS protocol IEs at the network element to determine that a NAS security context does not exist for the UE, selecting a NAS security algorithm for the NAS security context at the network element, and sending a response from the network element to the UE indicating the NAS security algorithm for the NAS security context and a security key set identifier. For a second phase of the NAS procedure, the method includes receiving a subsequent NAS message from the UE at the network element having a NAS message container, the NAS message container containing the initial NAS message encrypted based on the NAS security algorithm; and decrypting the NAS message container of the subsequent NAS message at the network element, wherein the initial NAS message contained in the NAS message container of the subsequent NAS message is populated with each NAS protocol IE for the NAS procedure.

[0015] In another embodiment, for the first phase, a subset of the NAS protocol IEs in the initial NAS message is encrypted using a public key for the HPLMN of the UE, and the method further includes initiating decryption of the subset of the NAS protocol IEs.

[0016] In another embodiment, the network element comprises an AMF element of the mobile network, and the step of initiating decryption of the subset of NAS protocol IEs comprises sending the encrypted subset of NAS protocol IEs to the UDM element to decrypt the subset of NAS protocol IEs based on a private key of the HPLMN.

[0017] In another embodiment, the initial NAS message includes a Registration Request message, and the subset of NAS protocol IEs designated for security-related processing consists of the following items: the UE's mobile identity, the UE security capabilities indicating one or more NAS security algorithms supported by the UE, the registration type, and the security key set identifier of the NAS security context.

[0018] In another embodiment, the response includes a Security Mode Command message indicating a NAS security algorithm and a security key set identifier, and a subsequent NAS message received from the UE includes a Security Mode Complete message having a NAS message container including the initial NAS message encrypted based on the NAS security algorithm.

[0019] In another embodiment, for the first phase of the NAS procedure, the method includes the following steps at the UE: identifying a subset of NAS protocol IEs for the NAS procedure that are designated for security-related processing, inserting the subset of NAS protocol IEs into an initial NAS message, sending the initial NAS message from the UE to a network element, and receiving a response from the network element indicating a NAS security algorithm for a NAS security context and a security key set identifier. For the second phase of the NAS procedure, the method includes the following steps at the UE: inserting the NAS protocol IEs for the NAS procedure into the initial NAS message, inserting the initial NAS message into a NAS message container of a subsequent NAS message, encrypting the NAS message container of the subsequent NAS message using the NAS security algorithm, and sending the subsequent NAS message from the UE to the network element.

[0020] In another embodiment, for the first phase, the method further includes encrypting, at the UE, a subset of the NAS protocol IEs in the initial NAS message using a public key for the HPLMN of the UE.

[0021] Another embodiment includes a UE, the UE including a processor and a memory, the memory including computer program code executable by the processor. The processor is configured to cause the UE to initiate a NAS process in multiple stages to establish a NAS communication session between the UE and a network element of a mobile network. For the first stage of the NAS process, the processor is further configured to cause the UE to identify a subset of NAS protocol IEs designated for security-related processing from the NAS protocol IEs used for the NAS process. The processor is further configured to cause the UE to insert the subset of NAS protocol IEs into an initial NAS message, send the initial NAS message to the network element, and receive a response from the network element indicating a NAS security algorithm for a NAS security context and a security key set identifier. For the second stage of the NAS process, the processor is further configured to cause the UE to insert the NAS protocol IEs for the NAS process into the initial NAS message, insert the initial NAS message into a NAS message container of a subsequent NAS message, encrypt the NAS message container of the subsequent NAS message using the NAS security algorithm, and send the subsequent NAS message to the network element.

[0022] In another embodiment, for the first stage, the processor is further configured to cause the UE to encrypt a subset of the NAS protocol IEs in the initial NAS message using a public key for the HPLMN of the UE.

[0023] In another embodiment, the processor is further configured to: when the UE has a public key programmed on a UMTS Subscriber Identity Module (USIM), cause the UE to encrypt a subset of the NAS protocol IEs in the initial NAS message using the public key; and when the UE does not have a public key programmed on the USIM, cause the UE to send the initial NAS message to the network element without encrypting the subset of the NAS protocol IEs in the initial NAS message.

[0024] In another embodiment, the initial NAS message includes a Registration Request message, and the subset of NAS protocol IEs designated for security-related processing consists of the following items: the UE's mobile identity, the UE security capabilities indicating one or more NAS security algorithms supported by the UE, the registration type, and the security key set identifier of the NAS security context.

[0025] In another embodiment, the processor is configured to: when the registration type does not indicate emergency, cause the UE to encrypt a subset of the NAS protocol IEs in the initial NAS message using a public key for the HPLMN of the UE; and when the registration type indicates emergency, cause the UE to send the initial NAS message to the network element without encrypting the subset of the NAS protocol IEs in the initial NAS message.

[0026] In another embodiment, the response includes a Security Mode Command message indicating a NAS security algorithm and a security key set identifier, and the subsequent NAS message includes a Security Mode Complete message having a NAS message container containing the initial NAS message encrypted based on the NAS security algorithm.

[0027] Another embodiment includes a network element of a mobile network. The network element includes means for causing the network element to perform a NAS procedure in multiple phases to establish a NAS communication session between the network element and a UE. For a first phase of the NAS procedure, the network element includes means for receiving an initial NAS message from the UE, wherein the initial NAS message is populated with a subset of NAS protocol IEs from the NAS protocol IEs for the NAS procedure that are designated for security-related processing. The network element further includes means for processing the subset of the NAS protocol IEs to determine that a NAS security context does not exist for the UE, means for selecting a NAS security algorithm for the NAS security context, and means for sending a response to the UE indicating the NAS security algorithm for the NAS security context and a security key set identifier. For a second phase of the NAS procedure, the network element further includes means for receiving a subsequent NAS message from the UE having a NAS message container, the NAS message container containing the initial NAS message encrypted based on the NAS security algorithm; and means for decrypting the NAS message container of the subsequent NAS message, wherein the initial NAS message contained in the NAS message container of the subsequent NAS message is populated with each NAS protocol IE for the NAS procedure.

[0028] The above summary provides a basic understanding of some aspects of the specification. This summary is not an exhaustive overview of the specification. It is neither intended to identify the key or important elements of the specification, nor to describe any scope of the specific embodiments of the specification or any scope of the claims. Its only purpose is to present some concepts of the specification in a simplified form as a preface to the more detailed description presented later. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Some embodiments of the invention will now be described by way of example only and with reference to the accompanying drawings.On all drawings, the same reference number represents the same element or the same type of element.

[0030] Figure 1 A mobile network in an illustrative embodiment is shown.

[0031] Figure 2 An Evolved Packet Core (EPC) network is shown.

[0032] Figure 3 A non-roaming architecture of a next generation network is shown.

[0033] Figure 4 A roaming architecture for next generation networks is shown.

[0034] Figure 5 The radio protocol stack is shown.

[0035] Figure 6 is a block diagram of a UE in an illustrative implementation.

[0036] Figure 7 is a block diagram of network elements in an illustrative embodiment.

[0037] Figure 8 is a flow chart showing a method of performing a NAS procedure in a UE in an illustrative embodiment.

[0038] Fig. 9 is a flow chart showing a method of performing a NAS process in a network element in an illustrative embodiment.

[0039] Fig.10 is a message diagram showing a NAS procedure when the UE has no security context in an illustrative embodiment.

[0040] Fig.11 is a flow chart illustrating a method of performing NAS procedures in UE 110 in another illustrative embodiment.

[0041] Fig.12 is a flow chart illustrating a method of performing a NAS process in a network element in another illustrative embodiment.

[0042] Fig.13 is a message diagram showing a NAS procedure when the UE has no security context in an illustrative embodiment.

[0043] Fig.14 is a flow chart illustrating a method of performing a NAS procedure in a UE in another illustrative embodiment.

[0044] Fig.15 is a flow chart illustrating a method of performing a NAS process in a network element in another illustrative embodiment.

[0045] Fig.16 is a message diagram showing a NAS registration procedure when the UE has a valid security context in an illustrative embodiment.

[0046] Fig.17 is a message diagram showing a NAS service request procedure when the UE has a valid security context in an illustrative embodiment.

[0047] Fig.18is a message diagram showing a NAS deregistration procedure when the UE has a valid security context in an illustrative embodiment.

[0048] FIG. 19A to FIG. 19B is a flow chart showing a method of performing a NAS procedure in a UE in an illustrative embodiment.

[0049] Fig. 20 is a flow chart showing a method of performing a NAS process in a network element in an illustrative embodiment.

[0050] Fig.21 is a message diagram illustrating a NAS registration procedure when the UE has a NAS security context, but the NAS security context is invalid or not found, in an illustrative embodiment.

[0051] Fig. 22 is a message diagram illustrating a NAS service request procedure when the UE has a NAS security context, but the NAS security context is invalid or not found, in an illustrative embodiment. DETAILED DESCRIPTION

[0052] The accompanying drawings and the following description illustrate specific exemplary embodiments. It should therefore be appreciated that those skilled in the art will be able to envision various arrangements that, although not explicitly described or shown herein, embody the principles of the embodiments and are included within the scope of the embodiments. In addition, any examples described herein are intended to aid in understanding the principles of the embodiments and should be interpreted as not being limited to these specifically enumerated examples and conditions. Therefore, one or more inventive concepts are not limited to the specific embodiments or examples described below, but are defined by the claims and their equivalents.

[0053] Figure 1 A mobile network 100 in an illustrative embodiment is shown. Mobile network 100 (also referred to as a cellular network) is a type of network in which the last link is wireless and provides voice and / or data services to multiple devices. Mobile network 100 may be a third generation (3G), fourth generation (4G), and / or next generation network (e.g., fifth generation (5G)).

[0054] Mobile network 100 is shown as providing communication services to UE 110 (and other UEs not shown). UE 110 may be enabled to obtain voice services, data services, machine-to-machine (M2M) or machine-type communication (MTC) services, and / or other services. UE 110 may be an end-user device such as a mobile phone (e.g., a smart phone), a tablet computer or PDA, a computer with a mobile broadband adapter, and the like.

[0055] The mobile network 100 includes one or more radio access networks (RAN) 120 that communicate with the UE 110 through a radio interface 122. The RAN 120 may support Evolved UMTS Terrestrial Radio Access Network (E-UTRAN) access, Wireless Local Area Network (WLAN) access, fixed access, satellite radio access, new radio access technology (RAT), etc. As an example, the RAN 120 may include an E-UTRAN or a Next Generation RAN (NG-RAN), which includes one or more base stations 124 dispersed over a geographical area. The base station 124 may include an entity that communicates with the UE on a licensed spectrum using radio communication technology and interfaces the UE with the core network. The base station 124 in the E-UTRAN is called an evolved NodeB (eNodeB). The base station 124 in the NG-RAN is called a gNodeB (NR base station) and / or an ng-eNodeB (LTE base station supporting a 5G core network). As another example, the RAN 120 may include a WLAN, which includes one or more wireless access points (WAPs) 125. A WLAN is a network in which a UE can connect to a local area network (LAN) via a wireless (radio) connection. A WAP 125 is a node that uses radio communication technology to communicate with a UE over an unlicensed spectrum and provides UE access to a core network. An example of a WAP 125 is a WiFi access point that operates on a 2.4 GHz or 5 GHz radio frequency band. The term "base station" as used herein may refer to an eNodeB, a gNodeB, an ng-eNodeB, a WAP, etc.

[0056] UE 110 is able to attach to a cell 126 of RAN 120 to access core network 130. Therefore, RAN 120 represents a radio interface between UE 110 and core network 130. Core network 130 is a central part of mobile network 100, which provides various services to customers connected through RAN 120. One example of core network 130 is the Evolved Packet Core (EPC) network recommended by 3GPP for LTE. Another example of core network 130 is the 5G core network recommended by 3GPP. Core network 130 includes network elements 132, which may include servers, devices, equipment or equipment (including hardware) that provide services for UE 110. Network elements 132 in the EPC network may include a mobility management entity (MME), a serving gateway (S-GW), a packet data network gateway (P-GW), etc. Network elements 132 in a 5G network may include an access and mobility management function (AMF), a session management function (SMF), a policy control function (PCF), an application function (AF), a user plane function (UPF), etc.

[0057] Figure 2An evolved packet core (EPC) network 200 is shown, which is a core network for LTE. The EPC network 200 includes a mobility management entity (MME) 214, a serving gateway (S-GW) 215, a packet data network gateway (P-GW) 216, a home subscriber server (HSS) 217, and a policy and charging rules function (PCRF) 218, but may also include other elements not shown, such as an IP multimedia subsystem (IMS) application server. Within the EPC network 200, user data (also referred to as the "user plane") and signaling (also referred to as the "control plane") are separated. The MME 214 handles the control plane in the EPC network 200. For example, the MME 214 handles signaling related to mobility and security for E-UTRAN access. The MME 214 is responsible for tracking and paging UE 110 in idle mode. The S-GW 215 and P-GW 216 handle the user plane. The S-GW 215 and the P-GW 216 transmit data traffic between the UE 110 and the external data network 240 (DN or Packet Data Network (PDN)). The S-GW 215 is the interconnection point between the radio side and the EPC network 200, and serves the UE 110 by routing incoming and outgoing IP packets. The S-GW 215 is also the anchor point for mobility within LTE (i.e., in the case of handover between eNodeBs), and between LTE and other 3GPP accesses. The P-GW 216 is the interconnection point between the EPC network 200 and the external data network 240 (i.e., the entry point or exit point of the data network 240), and routes packets to and from the data network 240. The HSS 217 is a database that stores user-related and subscriber-related information. The PCRF 218 provides a policy and charging control (PCC) solution in the EPC network 200, and is a node or entity of the EPC network 200 that formulates PCC rules for services requested by end users.

[0058] The MME 214 is connected to the RAN 120 (i.e., eNodeB) through an S1-MME interface, and the S-GW 215 is connected to the RAN 120 through an S1-U interface. The MME 214 is connected to the S-GW 215 through an S11 interface, and to the HSS 217 through an S6a interface. The PCRF 218 is connected to the P-GW 216 through a Gx interface, which transfers policy and charging rules from the PCRF 218 to a Policy and Charging Enforcement Function (PCEF) in the P-GW 216. The PCRF 218 is connected to the S-GW 215 through a Gxx interface, and the S-GW 215 is connected to the P-GW 216 through an S5 interface.

[0059] Figure 3 A non-roaming architecture 300 of a next generation network is shown. Figure 3 The architecture in is a reference point representation, as further described in 3GPP TS 23.501 (v15.3.0), which is incorporated by reference as if fully included herein. The architecture 300 includes network functions (NFs) for the core network, and the network functions for the control plane are separated from the user plane. The control plane of the core network includes an authentication server function (AUSF) 310, a unified data management (UDM) 312, a network slice selection function (NSSF) 313, an access and mobility management function (AMF) 314, a session management function (SMF) 316, a policy control function (PCF) 318, and an application function (AF) 320. The user plane of the core network includes one or more user plane functions (UPF) 324 that communicate with the data network 240. The UE 110 is able to access the control plane and the user plane of the core network through the (R)AN 120.

[0060] AUSF 310 is configured to support authentication of UE 110. UDM 312 is configured to store subscription data / information of UE 110. UDM 312 can store three types of user data: subscription, policy, and context related to the session (e.g., UE location). AMF 314 is configured to provide UE-based authentication, authorization, mobility management, etc. SMF 316 is configured to provide the following functionality: session management (SM), UE Internet Protocol (IP) address allocation and management, selection and control of UPF, termination of the interface towards PCF 318, policy enforcement and control part of quality of service (QoS), lawful interception, termination of the SM part of NAS messages, downlink data notification (DNN), roaming functionality, processing local execution to apply QoS to service level agreement (SLA), charging data collection and charging interface, etc. If UE 110 has multiple sessions, different SMFs can be assigned to each session to manage them separately and possibly provide different functionality in each session. PCF 318 is configured to support a unified policy framework to manage network behavior and provide policy rules to control plane functions for QoS enforcement, charging, access control, traffic routing, etc. AF 320 provides information about packet flows to PCF 318. Based on the information, PCF 318 is configured to determine policy rules about mobility and session management to enable AMF 314 and SMF 316 to operate normally.

[0061] The UPF 324 supports various user plane operations and functionalities, such as packet routing and forwarding, traffic processing (e.g., QoS enforcement), anchor points for intra-RAT / inter-RAT mobility (when applicable), packet inspection and policy rule enforcement, lawful interception (UP collection), traffic statistics and reporting, etc. The data network 240 is not part of the core network and provides Internet access, operator services, third-party services, etc. For example, the International Telecommunication Union (ITU) divides 5G mobile network services into three categories: enhanced mobile broadband (eMBB), ultra-reliable and low-latency communications (uRLLC), and massive machine type communications (mMTC) or massive Internet of Things (MIoT). eMBB focuses on services with high bandwidth requirements, such as HD video, virtual reality (VR), and augmented reality (AR). uRLLC focuses on latency-sensitive services, such as autonomous driving and remote management. mMTC and MIoT focus on services with high connection density requirements, such as smart cities and smart agriculture. The data network 240 can be configured to provide these and other services.

[0062] The architecture 300 includes the following reference points. The N1 reference point is implemented between the UE 110 and the AMF 314. The N2 reference point is implemented between the (R)AN 120 and the AMF 314. The N3 reference point is implemented between the (R)AN 120 and the UPF 324. The N4 reference point is implemented between the SMF 316 and the UPF 324. The N5 reference point is implemented between the PCF 318 and the AF 320. The N6 reference point is implemented between the UPF 324 and the data network 240. The N7 reference point is implemented between the SMF 316 and the PCF 318. The N8 reference point is implemented between the UDM 312 and the AMF 314. The N9 reference point is implemented between the two UPFs 324. The N10 reference point is implemented between the UDM 312 and the SMF 316. The N11 reference point is implemented between the AMF 314 and the SMF 316. The N12 reference point is implemented between the AMF 314 and the AUSF 310. The N13 reference point is implemented between the UDM 312 and the AUSF 310. The N14 reference point is implemented between two AMFs. The N15 reference point is implemented between the PCF 318 and the AMF 314 in a non-roaming scenario. The N22 reference point is implemented between the NSSF 313 and the AMF 314.

[0063] Figure 4 A roaming architecture 400 for a next generation network is shown. Figure 4The architecture in is a local breakout scenario in a reference point representation, as further described in 3GPP TS23.501 (v15.3.0). In a roaming scenario, a visited public land mobile network (VPLMN) 402 and a home PLMN (HPLMN) 404 are shown. The HPLMN 404 identifies the PLMN in which the profile of the mobile subscriber is saved. The VPLMN is the PLMN to which the mobile subscriber roams when leaving its HPLMN. Users roaming to other networks will receive subscription information from the HPLMN 404. In the local breakout scenario, the PCF 318 (hPCF), UDM 312, and AUSF 310 are located in the HPLMN 404 of the UE 110. Other network functions, including the visited PCF (vPCF) 418, are located in the VPLMN 402.

[0064] Figure 5 A radio protocol stack 500 is shown, for example, for the radio interface 122. As described herein, the user plane 512 includes a set of protocols for transmitting actual user data over the network, and the control plane 514 includes protocols for controlling and establishing user connections and bearers within the network. For the user plane 512 and the control plane 514, the radio protocol stack 500 includes a physical (PHY) layer 501, a medium access control (MAC) layer 502, a radio link control (RLC) layer 503, and a packet data convergence protocol (PDCP) layer 504. The control plane 514 additionally includes a radio resource control (RRC) layer 505 and a non-access stratum (NAS) layer 506.

[0065] The physical layer 501 carries all information from the MAC transport channel on the radio interface. Data and signaling messages are carried on physical channels between different layers of the physical layer 501. Physical channels are divided into physical data channels and physical control channels. Physical data channels may include physical downlink shared channels (PDSCH), physical broadcast channels (PBCH), physical multicast channels (PMCH), physical uplink shared channels (PUSCH) and physical random access channels (PRACH). Physical control channels may include physical control format indicator channels (PCFICH), physical hybrid ARQ indicator channels (PHICH), physical downlink control channels (PDCCH) and physical uplink control channels (PUCCH).

[0066] The MAC layer 502 is responsible for mapping between logical channels and transport channels; multiplexing MAC service data units (SDUs) from one or different logical channels onto transport blocks (TBs) to be delivered to the physical layer on transport channels; demultiplexing MAC SDUs from one or different logical channels from transport blocks delivered from the physical layer on transport channels; scheduling information reporting; error correction through hybrid automatic repeat request (HARQ); priority processing between UEs with the help of dynamic scheduling; priority processing between logical channels of a UE; and logical channel prioritization. The RLC layer 503 is responsible for the transmission of upper layer protocol data units (PDUs), error correction through ARQ, and concatenation, segmentation, and reassembly of RLC SDUs. The RLC layer 503 is also responsible for resegmentation of RLC data PDUs, reordering of RLC data PDUs, duplicate detection, RLC SDU discard, RLC reconstruction, and protocol error detection. The PDCP layer 504 is responsible for header compression and decompression of IP data; transmission of data (user plane or control plane); maintenance of PDCP sequence number (SN); in-sequence delivery of upper layer PDUs when reestablishing the lower layer; duplication deletion of lower layer SDUs when reestablishing the lower layer for radio bearers mapped on RLC acknowledgement mode (AM); encryption and decryption of user plane data and control plane data; integrity protection and integrity verification of control plane data; timer-based discarding; duplicate discarding, etc. The RRC layer 505 is responsible for broadcasting of system information related to NAS; broadcasting of system information related to the access layer (AS); paging, establishment, maintenance and release of the RRC connection between the UE and the RAN; security functions including key management, establishment, configuration, maintenance and release of point-to-point radio bearers (RBs). The NAS layer 506 represents the highest layer of the control plane 514 between the UE and the core network (e.g., MME / AMF), and supports the mobility and session management procedures of the UE to establish and maintain an IP connection between the UE and the core network.

[0067] One of the goals of the network is to improve overall system security. One area of ​​particular concern is the security protection of NAS messages. In the embodiments described herein, UE 110 and network element 132 are enhanced to provide additional security protection for NAS messages.

[0068] Figure 66 is a block diagram of a UE 110 in an illustrative embodiment. The UE 110 includes a radio interface component 602, one or more processors 604, a memory 606, a user interface component 608, and a battery 610. The radio interface component 602 is a hardware component representing the local radio resources of the UE 110, such as an RF unit 620 (e.g., a transceiver) and one or more antennas 622, which are used to wirelessly communicate with a base station (e.g., base station 124) via radio or "air" signals. The processor 604 represents the internal circuit system, logic, hardware, software, etc. that provides the functions of the UE 110. The processor 604 can be configured to execute instructions 640 for software loaded into the memory 606. Depending on the specific implementation, the processor 604 may include a collection of one or more processors, or may include a multi-processor core. The memory 606 is a computer-readable storage medium for data, instructions 640, applications, etc., and is accessible by the processor 604. The memory 606 is a hardware storage device capable of storing information temporarily and / or permanently. The memory 606 may include random access memory or any other volatile or non-volatile storage device. The user interface component 608 is a hardware component for interacting with an end user. For example, the user interface component 608 may include a display 650, a screen, a touch screen, etc. (e.g., a liquid crystal display (LCD), a light emitting diode (LED) display, etc.). The user interface component 608 may include a keyboard or keypad 652, a tracking device (e.g., a trackball or trackpad), a speaker, a microphone, etc. The UE 110 also includes a universal integrated circuit card (UICC) 660, which is a hardware device that provides security and integrity functions for the UE 110. The UICC 660 may host a universal subscriber identity module (USIM) 662, which stores or indicates one or more public keys and other credentials for the HPLMN of the UE 110. The UE 110 may include Figure 6 Various other components not specifically shown.

[0069] The processor 604 may implement one or more applications 630. These applications 630 may access downlink (DL) data through the RAN 120 and the core network 130, and may also generate uplink (UL) data for transmission to a destination through the RAN 120 and the core network 130. The processor 604 also implements a NAS controller 634 configured to control NAS processes, as described in more detail below.

[0070] Figure 7706 is a block diagram of a network element 132 in an illustrative embodiment. The network element 132 is a server, device, equipment, equipment (including hardware), system, component, etc. that handles the security and registration of the UE. For example, the network element 132 may include the MME 214 in the LTE network, the AMF element 314 of the next generation network, etc. In this embodiment, the network element 132 includes the following subsystems running on one or more platforms: a network interface component 702, a security manager 704, and a registration manager 706. The network interface component 702 may include circuit systems, logic, hardware, components, etc. configured to exchange control plane messages or signaling with other network elements and / or UEs (e.g., through the RAN 120). The network interface component 702 may operate using a variety of protocols (including NAS protocols) or reference points. The security manager 704 may include circuit systems, logic, hardware, components, etc., which are configured to handle the authentication and / or security processes of the UE, such as creating a NAS security context, selecting a NAS security algorithm for the NAS security context, etc. The registration manager 706 may include circuitry, logic, hardware, components, etc. configured to handle registration of UEs.

[0071] One or more subsystems of network element 132 may be implemented on a hardware platform comprised of analog and / or digital circuitry. One or more subsystems of network element 132 may be implemented on a processor 730 that executes instructions stored in memory 732. Processor 730 includes integrated hardware circuitry configured to execute instructions, and memory 732 is a non-transitory computer-readable storage medium for data, instructions, applications, etc., and is accessible by processor 730.

[0072] Network element 132 may include Figure 7 Various other components not specifically shown.

[0073] When a NAS security context already exists between the UE and the access security management entity (such as AMF, MME, etc.), the NAS process can be executed or called. The purpose of NAS security is to use NAS security keys to securely transmit NAS messages between the UE and the access security management entity in the control plane. NAS security keys are generated each time the UE is authenticated. After completing the NAS security setup, the UE and the access security management entity will share the NAS encryption key and NAS integrity key, which are used for encryption and integrity protection before NAS message transmission, respectively. NAS processes can also be executed or called when there is no NAS security context. This scenario is described first.

[0074] Example 1: No security context

[0075] Figure 88 is a flow chart showing a method 800 for performing NAS procedures in UE 110 in an illustrative embodiment. Figure 6 The steps of method 800 are described with reference to UE 110 in FIG. 1 , but those skilled in the art will appreciate that method 800 may be performed in other networks or architectures. Moreover, the steps of the flowcharts described herein are not all inclusive and may include other steps not shown, and these steps may be performed in an alternative order.

[0076] For this embodiment, it may be assumed that there is no NAS communication session between UE 110 and network element 132. It may be further assumed that UE 110 is in a non-connected mode (e.g., idle mode) and is transitioning to a connected mode. NAS controller 634 in UE 110 initiates a NAS procedure to establish a NAS communication session between UE 110 and network element 132 (step 802). For example, the NAS procedure may include a registration procedure. Each NAS procedure includes a set of mandatory NAS protocol IEs and may also include a set of optional NAS protocol IEs for transmitting information. Thus, NAS controller 634 may identify the NAS protocol IEs (mandatory and optional) for the NAS procedure.

[0077] In this embodiment, the NAS process is performed in multiple stages 831 to 832. For the first stage 831 of the NAS process, the NAS controller 634 identifies a subset of NAS protocol IEs designated for security-related processing (step 804). The subset of NAS protocol IEs designated for security-related processing refers to IEs used to create or establish a NAS security context for the UE. It may be desirable to provide minimal information in the first stage 831, so the subset of NAS protocol IEs may include a minimum number of IEs used for the NAS process to establish a NAS security context. For the registration process, in one example, the subset of NAS protocol IEs may consist of the following items: the UE's mobile identity (e.g., 5G-GUTI or subscription hidden identifier (SUCI)), UE security capabilities indicating one or more security algorithms supported by the UE, the registration type (e.g., initial, mobility, periodic, emergency, etc.), and the security key set identifier of the UE's NAS security context (e.g., ngKSI, eKSI, etc.).

[0078] The NAS controller 634 may format or generate an initial NAS message for a NAS procedure, such as a registration request of type "initial". An initial NAS message refers to the first NAS message sent after the UE transitions from a non-connected mode (e.g., idle mode) to a connected mode. The NAS controller 634 includes or inserts a subset of NAS protocol IEs in the initial NAS message (step 806). In the first stage 831, the initial NAS message is populated with a subset of NAS protocol IEs, and the IEs populated in the initial NAS message are restricted to a subset of NAS protocol IEs selected for security-related processing (i.e., consisting only of or exclusively consisting of). Because the initial NAS message does not include all mandatory NAS protocol IEs for the NAS procedure, the initial NAS message is considered a "partial" message in the first stage 831. Other mandatory NAS protocol IEs excluded from the subset will be included in another NAS message (as part of the second stage 832). The NAS controller 634 then sends the initial NAS message to the network element 132 (step 810).

[0079] Prior to sending the initial NAS message, the NAS controller 634 may optionally encrypt a subset of the NAS protocol IEs in the initial NAS message using a public key for the HPLMN of the UE 110 (optional step 808). Each HPLMN may be assigned a public key according to the Elliptic Curve Encryption Scheme (ECIES). There may be multiple public keys depending on the protection scheme. The public key of the HPLMN is typically provided on the USIM 662 of the UE 110. Thus, the NAS controller 634 is able to encrypt a subset of the NAS protocol IEs identified in the initial NAS message for the first phase 831. The decision as to whether to encrypt the subset of the NAS protocol IEs using a public key may be based on a policy or criteria. For example, when the registration type does not indicate emergency (e.g., Registration Type = Initial), the NAS controller 634 may encrypt the subset of the NAS protocol IEs, and when the registration type indicates emergency, the NAS controller may send the initial NAS message unencrypted. In another example, when UE 110 has a public key programmed on its USIM 662, NAS controller 634 may encrypt a subset of NAS protocol IEs, and when UE 110 does not have a public key programmed on USIM 662, the NAS controller may send an unencrypted initial NAS message.

[0080] Fig. 9 is a flow chart showing a method 900 of performing a NAS process in a network element 132 in an illustrative embodiment. Figure 7 The steps of method 900 are described with reference to network element 132 in FIG. 1 , but those skilled in the art will appreciate that method 900 may be performed in other networks or architectures.

[0081] For the first stage 831, the network interface component 702 of the network element 132 receives an initial NAS message from the UE 110 (step 902). After receiving the initial NAS message, the security manager 704 may optionally process the initial NAS message to determine whether to use the public key of the HPLMN to encrypt the information. When the initial NAS message is encrypted, the security manager 704 may initiate decryption of a subset of the NAS protocol IEs in the initial NAS message (optional step 904). In one example, the security manager 704 may be configured to decrypt the subset of the NAS protocol IEs internally. In another example, the security manager 704 may send the subset of the NAS protocol IEs to another network element (e.g., the UDM element 312) to decrypt the subset of the NAS protocol IEs.

[0082] The security manager 704 processes a subset of the NAS protocol IEs and determines that no NAS security context exists for the UE 110 (step 906). Because no NAS security context exists, the security manager 704 may initiate an authentication process to authenticate the UE 110 (step 908). The authentication process (e.g., Authentication and Key Agreement (AKA)) is used to perform mutual authentication between the UE 110 and the mobile network 100. Although the authentication process may vary, in general, the security manager 704 may send an authentication request along with an authentication token to the UE 110 through the network interface component 702 (optional step 910). In response to the authentication request, the UE 110 processes the authentication steps at its terminal and attempts to verify the authentication token (see Figure 8 812). If successful, UE 110 considers mobile network 100 authenticated. UE 110 calculates a response token and sends an authentication response with the response token, which security manager 704 receives via network interface component 702 (optional step 912). Security manager 704 (or another network element) may then determine whether the response token is valid (e.g., by comparing the response token to an expected response token). If the response token is valid, security manager 704 considers UE 110 authenticated.

[0083] When UE 110 is authenticated, security manager 704 initiates a NAS security procedure to establish a NAS security context (step 914). For the NAS security procedure, security manager 704 selects one or more NAS security algorithms for the NAS security context (step 916) and derives one or more NAS security keys (e.g., K AMF , K ASMEThe NAS security algorithm may include a NAS encryption algorithm and an integrity protection algorithm. The security manager 704 then sends a response to the UE via the network interface component 702, the response indicating or including the NAS security algorithm and security key set identifier selected for the NAS security context (step 918). The response may include a security mode command, the security mode command including the NAS security algorithm, the security key set identifier (e.g., ngKSI, eKSI, etc.), and other information.

[0084] exist Figure 8 8, NAS controller 634 of UE 110 receives a response from network element 132 indicating a NAS security algorithm and a security key set identifier (step 814). Using the information provided in the response from network element 132, a NAS security context is established between UE 110 and network element 132. Thus, subsequent NAS messages between UE 110 and network element 132 may be protected using the NAS security context.

[0085] For the second phase 832 of the NAS procedure, the NAS controller 634 includes or inserts the NAS protocol IEs for the NAS procedure in the initial NAS message (step 816). The initial NAS message is a copy, replication, or the same type of the initial NAS message previously sent to the network element 132 in the first phase 831. In this step, the initial NAS message includes the entire set of NAS protocol IEs (mandatory and optional (if required)) for the NAS procedure. Because the initial NAS message includes every mandatory NAS protocol IE for the NAS procedure, the initial NAS message is considered a "completed" NAS message in the second phase 832.

[0086] NAS controller 634 of UE 110 may format or generate subsequent NAS messages for NAS procedures. For example, the subsequent NAS message may include a security mode complete message. NAS controller 634 includes or inserts the initial NAS message in a NAS message container of the subsequent NAS message (step 818). A NAS message container is an IE for encapsulating a common NAS message. NAS controller 634 encrypts the NAS message container of the subsequent NAS message using a NAS security algorithm (step 820). Thus, the completed initial NAS message is encrypted in the NAS message container of the subsequent NAS message. NAS controller 634 then sends the subsequent NAS message to network element 132 (step 822).

[0087] exist Fig. 9, for the second stage 832, the network interface component 702 receives a subsequent NAS message from the UE 110 (step 920). The security manager 704 decrypts the NAS message container of the subsequent NAS message using the NAS security algorithm (step 922) to access the completed initial NAS message. The security manager 704 or other subsystems of the network element 132 may then process the NAS protocol IEs from the completed initial NAS message to further perform NAS procedures. For example, the registration manager 706 may send a registration accept message to the UE 110 and receive a registration complete message from the UE 110 (optional step 924). One technical benefit of this process is that only the NAS protocol IEs required to establish the NAS security context are sent in unencrypted or encrypted form based on the HPLMN public key in the partial initial NAS message, while the completed initial NAS message is encrypted in the subsequent NAS message, which provides further security protection.

[0088] Fig.10 is a message diagram showing a NAS procedure when the UE has no security context in an illustrative embodiment. Fig.10 The NAS process shown is a registration process, but similar concepts can be applied to other NAS processes. This example is shown in a 5G network, where the network element 132 includes an AMF element 314.

[0089] This NAS process is again performed in multiple stages. For the first stage, UE 110 generates or formats an initial registration request for the NAS registration process. The NAS registration process has a set of NAS protocol IEs (mandatory and optional) for transmitting information. In this embodiment, UE 110 does not fill the initial registration request with a complete set of NAS protocol IEs in the first stage. Instead, UE 110 identifies the NAS protocol IEs that are essential for establishing a NAS security context. Therefore, UE 110 identifies a subset of NAS protocol IEs designated for security-related processing. In this example, the subset of NAS protocol IEs may consist of a 5G globally unique temporary identity (5G-GUTI), UE security capabilities, registration type, and ngKSI. UE 110 inserts the subset of NAS protocol IEs into the initial registration request. Because the initial registration request does not include all mandatory NAS protocol IEs for the NAS registration process, the initial registration request is a "partial" request in the first stage. UE 110 may also insert other information into the initial registration request, such as a SUCI generated by UE 110. In this example, the UE 110 encrypts a subset of the NAS protocol IEs using the HPLMN public key and sends an initial registration request to the AMF element 314 (S1). The protection scheme and public key identifier used for encryption are the same as those indicated in the SUCI. However, as described above, encrypting the subset of the NAS protocol IEs using the HPLMN public key is optional. If the protection scheme of the SUCI is NULL, the subset of the NAS protocol IEs is not encrypted.

[0090] In response to receiving the initial registration request, the AMF element 314 routes the information to the UE's home UDM for decryption based on the UE's PLMN ID and routing ID. Therefore, the AMF element 314 formats or generates an authentication request (i.e., Nausf_UEAuthentication_Authenticate request) and inserts the encrypted subset of the NAS protocol IE into the authentication request together with other information (e.g., SUCI and serving network name). The AMF element 314 then sends the authentication request to the AUSF element 310 (S2). In response to receiving the authentication request, the AUSF element 310 formats or generates an authentication request (i.e., Nudm_UEAuthentication_Get request) and inserts the encrypted subset of the NAS protocol IE into the authentication request together with other information. The AUSF element 310 then sends the authentication request to the UDM element 312 (S3).

[0091] In response to the authentication request, the UDM element 312 decrypts the subset of the NAS protocol IE using the HPLMN private key (i.e., using information according to the protection scheme selected for the SUCI) so that the subset of the NAS protocol IE is readable. The UDM element 312 also hosts functions related to the authentication credential repository and processing function (ARPF), which selects the authentication method and calculates authentication data and key material (e.g., token) for the AUSF element 310 (if necessary). The UDM element 312 formats or generates an authentication response (i.e., Nudm_UEAuthentication_Get response) for the AUSF element 310, and inserts the decrypted subset of the NAS protocol IE, the authentication vector (AV), and other information into the authentication response. The UDM element 312 then sends the authentication response to the AUSF element 310 (S4). In response to receiving the authentication response, the AUSF element 310 formats or generates an authentication response (i.e., Nuasf-_UEAuthentication_Authenticate response) for the AMF element 314, and inserts the decrypted subset of the NAS protocol IE, the AV, and other information into the authentication response. Then, the AUSF component 310 sends the authentication response to the AMF component 314 (S5).

[0092] The AMF element 314 is configured to perform an authentication process for the UE 110 using information provided by the UDM / AUSF. For example, the AMF element 314 sends an authentication request together with an authentication token (S6) from the AV to the UE 110, and the UE 110 attempts to verify the authentication token. If successful, the UE 110 calculates a response token and sends an authentication response with the response token, which is received by the AMF element 314 (S7). The AMF element 314 formats or generates another authentication request (i.e., a Nausf_UEAuthentication_Auth enticate request) and inserts the response token from the UE 110 into the authentication request together with other information. Then, the AMF element 314 sends the authentication request to the AUSF element 310 (S8). The AUSF element 310 verifies whether the response token from the UE 110 matches the expected response token, and sends an authentication response (i.e., a Nausf_UEAuthentication_Authenticate response) indicating authentication success / failure to the AMF element 314.

[0093] When UE 110 is authenticated to the network, AMF element 314 initiates a NAS security process to establish a NAS security context. AMF element 314 selects a NAS security algorithm (or multiple algorithms) for encryption and integrity protection. AMF element 314 formats or generates a security mode command message, and inserts an indicator of the NAS security algorithm, ngKSI and other information into the security mode command message. Then, AMF element 314 sends the security mode command message to UE 110 (S10).

[0094] For the second phase of the NAS process, the UE 110 uses the ngKSI and the NAS security algorithm to derive the corresponding keys for protecting subsequent NAS messages. Thus, a NAS security context is established between the UE 110 and the AMF element 314. The UE 110 includes or inserts the NAS protocol IEs for the NAS registration process in an initial registration request, which is a copy, replication, or the same type of message of the initial registration request previously sent in the first phase. The initial registration request includes all mandatory NAS protocol IEs, as well as any optional NAS protocol IEs used to transport information. Additional NAS protocol IEs may include: non-current native NAS key set identifier, 5G mobility management (MM) capabilities, requested network slice selection assistance information (NSSAI), last visited registration tracking area identifier (TAI), S1 UE network capabilities, uplink data status, PDU session status, mobile initiated connection only (MICO) indication, UE status, additional GUTI, allowed PDU session status, UE usage settings, requested discontinuous reception (DRX) parameters, EPS NAS message container, and payload container. Therefore, the initial registration request is a "completed" request in the second phase because it includes all mandatory NAS protocol IEs. UE 110 formats or generates a security mode complete message and inserts the completed initial registration request into the NAS message container of the security mode complete message. UE 110 encrypts the NAS message container of the security mode complete message using the NAS security algorithm of the NAS security context. Therefore, the completed initial registration request is encrypted in the NAS message container of the security mode complete message. Then, UE 110 sends the security mode complete message to AMF element 314 (S11).

[0095] The AMF element 314 receives the security mode complete message from the UE 110 and decrypts the NAS message container of the security mode complete message to access the NAS protocol IE according to the completed initial registration request. Then, the AMF element 314 continues the registration process (S12), for example, by sending a registration accept message to the UE 110. The UE 110 replies to the AMF element 314 with a registration complete message (S13), at which point the UE 110 registers with the network to access the service.

[0096] Example 2: No security context

[0097] In another example of a NAS process when no security context exists, Fig.11 1 is a flow chart showing a method 1100 for performing a NAS procedure in a UE 110 in an illustrative embodiment. A NAS controller 634 in the UE 110 initiates a NAS procedure to establish a NAS communication session between the UE 110 and the network element 132 (step 1102). The NAS controller 634 identifies NAS protocol IEs (mandatory and optional) for the NAS procedure (step 1104). The NAS controller 634 may format or generate a first initial NAS message for the NAS procedure and include or insert the NAS protocol IEs in the first initial NAS message (step 1106). In this step, the first initial NAS message includes the entire set of NAS protocol IEs (mandatory and optional (if required)) for the NAS procedure. Because the first initial NAS message includes each mandatory NAS protocol IE for the NAS procedure, the first initial NAS message is considered a "completed" NAS message.

[0098] NAS controller 634 also formats or generates a second initial NAS message as a copy of the first initial NAS message (step 1108). A duplicate message refers to a message of the same type used for a NAS procedure. For example, if the first initial NAS message is a registration request, the second initial NAS message is also a registration request. However, the IEs populated in the duplicate message may be different from the original message. NAS controller 634 includes or inserts the first initial NAS message in a NAS message container of the second initial NAS message (step 1110). NAS controller 634 encrypts the NAS message container of the second initial NAS message using the public key of the HPLMN for UE 110 (step 1112). Thus, the completed first initial NAS message is encrypted in the NAS message container of the second initial NAS message. NAS controller 634 then sends the second initial NAS message to network element 132 (step 1114).

[0099] Fig.121 is a flow chart illustrating a method 1200 for performing a NAS process in a network element 132 in an illustrative embodiment. The network interface component 702 of the network element 132 receives a second initial NAS message from the UE 110 (step 1202). When the NAS message container is encrypted as in this example, the security manager 704 initiates decryption of the NAS message container (step 1204) to access the first initial NAS message. In one example, the security manager 704 can be configured to decrypt the NAS message container. In another example, the security manager 704 can send the NAS message container to another network element (e.g., the UDM element 312) to decrypt the NAS message container.

[0100] With the NAS message container decrypted, the security manager 704 may access the first initial NAS message. The first initial NAS message is populated with NAS protocol IEs for the NAS process. The security manager 704 may process the NAS protocol IEs and determine that no NAS security context exists for the UE 110 (step 1206). Because no NAS security context exists, the security manager 704 may initiate an authentication process to authenticate the UE 110 (step 1208). For the authentication process, the security manager 704 may send an authentication request along with an authentication token to the UE 110 via the network interface component 702 (optional step 1210). In response to the authentication request, the UE 110 processes the authentication step at its terminal and attempts to verify the authentication token (see Fig.11 116). If successful, UE 110 considers mobile network 100 authenticated. UE 110 calculates a response token and sends an authentication response with the response token, which security manager 704 receives via network interface component 702 (optional step 1212). Security manager 704 (or another network element) may then determine whether the response token is valid (e.g., by comparing the response token to an expected response token). If the response token is valid, security manager 704 considers UE 110 authenticated.

[0101] When UE 110 is authenticated, security manager 704 initiates a NAS security procedure to establish a NAS security context (step 1214). For the NAS security procedure, security manager 704 selects one or more NAS security algorithms for the NAS security context (step 1216) and derives one or more NAS security keys (e.g., K AMF , K ASMEThen, the security manager 704 formats or generates a security mode command and sends the security mode command to the UE 110 through the network interface component 702, wherein the security mode command indicates or includes the NAS security algorithm and security key set identifier selected for the NAS security context (step 1218).

[0102] exist Fig.11 , NAS controller 634 of UE 110 receives a security mode command from network element 132 indicating a NAS security algorithm (step 1118). Using the information provided in the security mode command, a NAS security context is established between UE 110 and network element 132. Thus, the NAS security context may be used to protect subsequent NAS messages between UE 110 and network element 132. NAS controller 634 of UE 110 may then format or generate a security mode complete message and send the security mode complete message to network element 132 (step 1120). Fig.12 In step 1220, the network interface component 702 receives the security mode completion from the UE 110. The security manager 704 can decrypt any subsequent NAS messages using the NAS security algorithm. A technical benefit of this process is that only the NAS protocol IEs required to establish the NAS security context are inserted in an unencrypted form in the partial initial NAS message, while the completed initial NAS message is encrypted in the partial initial NAS message, which provides further security protection.

[0103] Fig.13 is a message diagram showing a NAS procedure when the UE has no security context in an illustrative embodiment. Fig.13 The NAS procedure shown is a registration procedure, but similar concepts can be applied to other NAS procedures. UE 110 generates or formats a registration request for the NAS registration procedure. In this embodiment, UE 110 fills the registration request with the entire NAS protocol IE set. Therefore, the registration request is a completed registration request.

[0104] UE 110 also generates or formats another Registration Request that is a copy of the completed Registration Request. The other Registration Request is of type "initial" and is therefore an initial Registration Request. Instead of populating each mandatory NAS protocol IE in the completed Registration Request, UE 110 inserts the completed Registration Request into the NAS message container of the initial Registration Request. UE 110 may also insert other information into the initial Registration Request, such as a SUCI generated by UE 110. In this example, UE 110 encrypts the NAS message container of the initial Registration Request using the HPLMN public key and sends the initial Registration Request to AMF element 314 (S1).

[0105] In response to receiving the initial registration request, the AMF element 314 routes the information to the UE's home UDM for decryption based on the UE's PLMN ID and routing ID. Therefore, the AMF element 314 formats or generates an authentication request (i.e., Nausf_UEAuthentication_Authenticate request) and inserts the encrypted NAS message container of the initial registration request into the authentication request together with other information. Then, the AMF element 314 sends the authentication request to the AUSF element 310 (S2). In response to receiving the authentication request, the AUSF element 310 formats or generates an authentication request (i.e., Nudm_UEAuthentication_Get request) and inserts the encrypted NAS message container into the authentication request together with other information. Then, the AUSF element 310 sends the authentication request to the UDM element 312 (S3).

[0106] In response to the authentication request, the UDM element 312 decrypts the encrypted NAS message container using the HPLMN private key so that the completed registration request is readable. The UDM element 312 also selects an authentication method and calculates authentication data and key material (e.g., token) for the AUSF element 310 (if necessary). The UDM element 312 formats or generates an authentication response (i.e., Nudm_UEAuthentication_Get response) for the AUSF element 310 and inserts the decrypted NAS message container, authentication vector (AV), and other information into the authentication response. The UDM element 312 then sends the authentication response to the AUSF element 310 (S4). In response to receiving the authentication response, the AUSF element 310 formats or generates an authentication response (i.e., Nuasf-_UEAuthentication_Authenticate response) for the AMF element 314 and inserts the decrypted NAS message container, AV, and other information into the authentication response. The AUSF element 310 then sends the authentication response to the AMF element 314 (S5).

[0107] The AMF element 314 is configured to perform an authentication process for the UE 110 using information provided by the UDM / AUSF. For example, the AMF element 314 sends an authentication request together with an authentication token (S6) from the AV to the UE 110, and the UE 110 attempts to verify the authentication token. If successful, the UE 110 calculates a response token and sends an authentication response with the response token, which is received by the AMF element 314 (S7). The AMF element 314 formats or generates another authentication request (i.e., a Nausf_UEAuthentication_Auth enticate request) and inserts the response token from the UE 110 into the authentication request together with other information. Then, the AMF element 314 sends the authentication request to the AUSF element 310 (S8). The AUSF element 310 verifies whether the response token from the UE 110 matches the expected response token, and sends an authentication response (i.e., a Nausf_UEAuthentication_Authenticate response) indicating authentication success / failure to the AMF element 314.

[0108] When UE 110 is authenticated to the network, AMF element 314 initiates a NAS security process to establish a NAS security context. AMF element 314 selects a NAS security algorithm (or multiple algorithms) for encryption and integrity protection. AMF element 314 formats or generates a security mode command message, and inserts the indicator, ngKSI and other information of the NAS security algorithm into the security mode command message. Then, AMF element 314 sends the security mode command message to UE 110 (S10). UE 110 uses ngKSI and NAS security algorithm to derive the corresponding key for protecting subsequent NAS messages. Therefore, a security context is established between UE 110 and AMF element 314. UE 110 formats or generates a security mode completion message, and sends the security mode completion message to AMF element 314 (S11).

[0109] The AMF element 314 continues the registration process (S12), for example, by sending a Registration Accept message to the UE 110. The UE 110 replies to the AMF element 314 with a Registration Complete message (S13), at which point the UE 110 is registered with the network to access the service.

[0110] Example 3: Security context exists – Security context is valid

[0111] In another example, when a NAS security context already exists between the UE and an access security management entity (eg, AMF, MME, etc.), the NAS process may be performed or invoked. The following provides an example of a NAS process when a NAS security context exists.

[0112] Fig.14 14 is a flow chart showing a method 1400 for performing a NAS procedure in a UE 110 in an illustrative embodiment. A NAS controller 634 in the UE 110 initiates a NAS procedure to establish (or reestablish) a NAS communication session between the UE 110 and the network element 132 (step 1402). The NAS controller 634 identifies a subset of NAS protocol IEs specified for security-related processing (step 1404). The NAS controller 634 formats or generates a first NAS message for the NAS procedure, such as a registration request of type "mobility", "periodic", etc. The NAS controller 634 includes or inserts the subset of NAS protocol IEs in the first NAS message (step 1406).

[0113] The NAS controller 634 also formats or generates a second NAS message that is a copy of the first NAS message. The NAS controller 634 includes or inserts the NAS protocol IEs for the NAS procedures in the second NAS message (step 1408). In this step, the second NAS message includes the entire set of NAS protocol IEs (mandatory and optional (if required)) for the NAS procedures. Because the second NAS message includes every mandatory NAS protocol IE for the NAS procedures, the second NAS message is considered a "completed" NAS message.

[0114] NAS controller 634 includes or inserts the second NAS message in the NAS message container of the first NAS message (step 1410). NAS controller 634 encrypts the NAS message container of the first NAS message using the NAS security algorithm of the NAS security context (step 1412). Thus, the completed second NAS message is encrypted in the NAS message container of the first NAS message. NAS controller 634 then sends the first NAS message to network element 132 (step 1414).

[0115] Fig.151 is a flow chart showing a method 1500 for performing a NAS process in a network element 132 in an illustrative embodiment. The network interface component 702 of the network element 132 receives a first NAS message from the UE 110 (step 1502). The security manager 704 processes a subset of the NAS protocol IEs in the first NAS message to identify a NAS security context for the UE 110 (step 1504). The security manager 704 then decrypts the NAS message container of the first NAS message using the NAS security context to access a second NAS message contained in the NAS message container (step 1506). In the case where the NAS message container in the first NAS message is decrypted, the security manager 704 can access the decrypted second NAS message. The second NAS message is populated with the NAS protocol IEs for the NAS process. Therefore, the security manager 704 can process the NAS protocol IEs in the second NAS message to continue further processing of the NAS process (step 1508). One technical benefit of this process is that only the NAS protocol IEs required to identify the NAS security context are sent in an unencrypted form in the first NAS message, while the completed second NAS message is encrypted in the first NAS message, which provides further security protection.

[0116] Fig.16 is a message diagram illustrating a NAS registration process when the UE has a valid security context in an illustrative embodiment. UE 110 generates or formats a first registration request for a NAS registration process. In this embodiment, UE 110 populates the first registration request with a subset of NAS protocol IEs specified for security-related processing. This information is used to indicate the NAS security context to AMF element 314. For example, the subset of NAS protocol IEs may include 5G-GUTI, registration type, and ngKSI. UE 110 also formats or generates a second registration request, which is a copy of the first registration request. UE 110 includes or inserts the NAS protocol IEs used for the NAS registration process in the second registration request. In this step, the second registration request includes the entire set of NAS protocol IEs (mandatory and optional (if required)) for the NAS registration process. Because the second registration request includes each mandatory NAS protocol IE for the NAS registration process, the second registration request is considered a "completed" registration request.

[0117] UE 110 includes or inserts the second registration request in the NAS message container of the first registration request, and encrypts the NAS message container of the first registration request using the NAS security algorithm of the NAS security context. Thus, the completed second registration request is encrypted in the NAS message container of the first registration request. Then, UE 110 sends the first registration request to AMF element 314 (S1).

[0118] In response to receiving the first registration request, the AMF element 314 identifies or retrieves the NAS security context based on a subset of the NAS protocol IE included in the first registration request. Then, the AMF element 314 decrypts the encrypted NAS message container of the first registration request using the NAS security context so that the second registration request is readable. Therefore, the AMF element 314 is able to process the entire NAS protocol IE set for the NAS registration process and continues the processing of the NAS registration process. For example, the AMF element 314 sends a registration acceptance message to the UE 110 (S2). The UE 110 replies to the AMF element 314 (S3) with a registration completion message, at which point the UE 110 registers with the network to access the service.

[0119] Fig.17 is a message diagram showing a NAS service request process when the UE has a valid security context in an illustrative embodiment. UE 110 generates or formats a first service request for the NAS service request process. In this embodiment, UE 110 fills the first service request with a subset of NAS protocol IEs specified for security-related processing, and the subset of NAS protocol IEs is used to indicate the NAS security context to AMF element 314. In this example, the subset of NAS protocol IEs may include 5G-S-TMSI and ngKSI. UE 110 also formats or generates a second service request, which is a copy of the first service request. UE 110 includes or inserts the NAS protocol IEs used for the NAS service request process in the second service request. In this step, the second service request includes the entire NAS protocol IE set (mandatory and optional (if necessary)) for the NAS service request process. Because the second service request includes each mandatory NAS protocol IE for the NAS service request process, the second service request is considered a "completed" service request.

[0120] UE 110 includes or inserts the second service request in the NAS message container of the first service request, and encrypts the NAS message container of the first service request using the NAS security algorithm of the NAS security context. Thus, the completed second service request is encrypted in the NAS message container of the first service request. Then, UE 110 sends the first service request to AMF element 314 (S1).

[0121] In response to receiving the first service request, the AMF element 314 identifies or retrieves a NAS security context based on a subset of the NAS protocol IEs included in the first service request. The AMF element 314 then decrypts the encrypted NAS message container of the first service request using the NAS security context so that the second service request is readable. Therefore, the AMF element 314 is able to process the entire NAS protocol IE set for the NAS service request process and continues processing the NAS service request process. For example, the AMF element 314 sends a service acceptance message to the UE 110 (S2).

[0122] Fig.18 is a message diagram illustrating a NAS deregistration procedure when the UE has a valid security context in an illustrative embodiment. UE 110 generates or formats a first deregistration request for a NAS deregistration procedure. In this embodiment, UE 110 populates the first deregistration request with a subset of NAS protocol IEs specified for security-related processing, the subset of NAS protocol IEs being used to indicate the NAS security context to AMF element 314. In this example, the subset of NAS protocol IEs may include 5G-S-TMSI and ngKSI. UE 110 also formats or generates a second deregistration request, which is a copy of the first deregistration request. UE 110 includes or inserts the NAS protocol IEs for the NAS deregistration procedure in the second deregistration request. In this step, the second deregistration request includes the entire set of NAS protocol IEs (mandatory and optional (if required)) for the NAS deregistration procedure. Because the second deregistration request includes each mandatory NAS protocol IE for the NAS deregistration procedure, the second deregistration request is considered a "completed" deregistration request.

[0123] UE 110 includes or inserts the second deregistration request in the NAS message container of the first deregistration request, and encrypts the NAS message container of the first deregistration request using the NAS security algorithm of the NAS security context. Thus, the completed second deregistration request is encrypted in the NAS message container of the first deregistration request. Then, UE 110 sends the first deregistration request to AMF element 314 (S1).

[0124] In response to receiving the first deregistration request, the AMF element 314 identifies or retrieves a NAS security context based on a subset of the NAS protocol IEs included in the first deregistration request. The AMF element 314 then decrypts the encrypted NAS message container of the first deregistration request using the NAS security context so that the second deregistration request is readable. Thus, the AMF element 314 is able to process the entire set of NAS protocol IEs for the NAS deregistration procedure and continues processing the NAS deregistration procedure. For example, the AMF element 314 sends a deregistration accept message to the UE 110 (S2).

[0125] Example 4: Security context exists – Security context is invalid or not found

[0126] FIG. 19A to FIG. 19B 1 is a flow chart showing a method 1900 for performing a NAS procedure in UE 110 in an illustrative embodiment. NAS controller 634 in UE 110 initiates a NAS procedure to establish (or reestablish) a NAS communication session between UE 110 and network element 132 (step 1902). For a first phase 1931 of the NAS procedure, NAS controller 634 identifies a subset of NAS protocol IEs specified for security-related processing (step 1904). NAS controller 634 formats or generates a first NAS message for the NAS procedure and includes or inserts the subset of NAS protocol IEs in the first NAS message (step 1906).

[0127] The NAS controller 634 also formats or generates a second NAS message that is a copy of the first NAS message. The NAS controller 634 includes or inserts the NAS protocol IEs for the NAS procedures in the second NAS message (step 1908). In this step, the second NAS message includes the entire set of NAS protocol IEs (mandatory and optional (if required)) for the NAS procedures. Because the second NAS message includes each mandatory NAS protocol IE for the NAS procedures, the second NAS message is considered a "completed" NAS message.

[0128] NAS controller 634 includes or inserts the second NAS message in the NAS message container of the first NAS message (step 1910). NAS controller 634 encrypts the NAS message container of the first NAS message using the NAS security algorithm of the NAS security context (step 1912). Thus, the completed second NAS message is encrypted in the NAS message container of the first NAS message. NAS controller 634 then sends the first NAS message to network element 132 (step 1914).

[0129] Fig. 201 is a flow chart showing a method 2000 of performing a NAS process in a network element 132 in an illustrative embodiment. For the first stage 1931 of the NAS process, the network interface component 702 of the network element 132 receives a first NAS message from the UE 110 (step 2002). The security manager 704 processes a subset of the NAS protocol IEs in the first NAS message and fails to identify a valid NAS security context for the UE 110 (step 2004). For example, even if a NAS security context exists, the security manager 704 may not be able to identify the NAS security context based on the subset of the NAS protocol IEs provided in the first NAS message, the NAS security context identified based on the subset of the NAS protocol IEs is invalid, etc. Because a valid NAS security context is not found, the security manager 704 initiates an authentication process to authenticate the UE 110 (step 2006). Even though the authentication process may have been previously performed, when a valid NAS security context is not found, the security manager 704 performs the authentication process again. As part of the authentication process, the security manager 704 may send an authentication request along with an authentication token to the UE 110 via the network interface component 702 (optional step 2008). In response to the authentication request, the UE 110 attempts to verify the authentication token (see Fig.19A 1916). If successful, UE 110 considers mobile network 100 authenticated. UE 110 calculates a response token and sends an authentication response with the response token, which security manager 704 receives via network interface component 702 (optional step 2010). Security manager 704 (or another network element) may then determine whether the response token is valid (e.g., by comparing the response token to an expected response token). If the response token is valid, security manager 704 considers UE 110 authenticated.

[0130] In the case where UE 110 has been authenticated, security manager 704 initiates a NAS security procedure to establish a new NAS security context (step 2012). For the NAS security procedure, security manager 704 selects one or more NAS security algorithms for the new NAS security procedure (step 2014) and derives one or more NAS security keys. Security manager 704 then sends a response to UE 110 via network interface component 702 (step 2016), the response indicating or including the NAS security algorithm and security key set identifier selected for the new NAS security context. The response may include a security mode command, the security mode command including the NAS security algorithm, the security key set identifier (e.g., ngKSI, eKSI, etc.), and other information.

[0131] exist Fig.19ANAS controller 634 receives a response from network element 132 indicating the NAS security algorithm and the security key set identifier (step 1918). Using the information provided in the response from network element 132, a new NAS security context is established between UE 110 and network element 132. Thus, subsequent NAS messages between UE 110 and network element 132 may be protected using the new NAS security context.

[0132] for Fig.19B In the second phase 1932 of the NAS process in UE 110, NAS controller 634 of UE 110 may then format or generate a subsequent NAS message for the NAS process. For example, the subsequent NAS message may include a security mode complete message. NAS controller 634 includes or inserts the second NAS message for the NAS process into the NAS message container of the subsequent NAS message (step 1920). As described above, the second NAS message includes the entire set of NAS protocol IEs (mandatory and optional (if required)) for the NAS process and is considered a "completed" NAS message. NAS controller 634 encrypts the NAS message container of the subsequent NAS message using the NAS security algorithm of the new NAS security context (step 1922). NAS controller 634 then sends the subsequent NAS message to network element 132 (step 1924).

[0133] exist Fig. 20 In the second stage 1932, the network interface component 702 receives a subsequent NAS message from the UE 110 (step 2018). The security manager 704 decrypts the NAS message container of the subsequent NAS message using the NAS security algorithm of the new NAS security context (step 2020) to access the completed second NAS message. The security manager 704 or other subsystems of the network element 132 can then process the NAS protocol IEs from the completed second NAS message to provide further processing of the NAS process. One technical benefit of this process is that only the NAS protocol IEs required to identify the NAS security context are sent in an unencrypted form in the first NAS message. When a valid NAS security context is not found, a new NAS security context is established and the completed NAS message is encrypted in a subsequent NAS message according to the new NAS security context, thereby providing further security protection.

[0134] Fig.21is a message diagram illustrating a NAS registration process when the UE has a NAS security context, but the NAS security context is invalid or not found in an illustrative embodiment. For the first phase of the NAS process, the UE 110 generates or formats a first registration request for the NAS registration process. In this embodiment, the UE 110 fills the first registration request with a subset of NAS protocol IEs specified for security-related processing. This information is used to indicate the NAS security context to the AMF element 314. For example, the subset of NAS protocol IEs may include 5G-GUTI, registration type, and ngKSI. The UE 110 also formats or generates a second registration request, which is a copy of the first registration request. The UE 110 includes or inserts the NAS protocol IEs for the NAS registration process into the second registration request. In this step, the second registration request includes the entire set of NAS protocol IEs (mandatory and optional (if required)) for the NAS registration process. Because the second registration request includes each mandatory NAS protocol IE for the NAS registration process, the second registration request is considered a "completed" registration request.

[0135] UE 110 includes or inserts the second registration request in the NAS message container of the first registration request, and encrypts the NAS message container of the first registration request using the NAS security algorithm of the NAS security context. Thus, the completed second registration request is encrypted in the NAS message container of the first registration request. Then, UE 110 sends the first registration request to AMF element 314 (S1).

[0136] In response to receiving the first registration request, the AMF element 314 attempts to identify or retrieve a NAS security context based on a subset of the NAS protocol IEs included in the first registration request. In this example, the AMF element 314 cannot identify a valid NAS security context for UE 110. Therefore, the AMF element 314 cannot decrypt the NAS message container of the first registration request. In order to allow secure communication, the AMF element 314 initiates a new authentication process to create a new NAS security context. The AMF element 314 formats or generates an authentication request (i.e., Nausf_UEAuthentication_Authenticate request) and sends the authentication request to the AUSF element 310 (S2). In response to receiving the authentication request, the AUSF element 310 formats or generates an authentication request (i.e., Nudm-_UEAuthentication_Get request) and sends the authentication request to the UDM element 312 (S3).

[0137] In response to the authentication request, the UDM component 312 de-hides the SUCI and sends an authentication response (i.e., Nudm_UEAuthentication_Get response) to the AUSF component 310 (S4). In response to receiving the authentication response, the AUSF component 310 formats or generates an authentication response (i.e., Nuasf-_UEAuthentication_Authenticate response) for the AMF component 314 and sends the authentication response to the AMF component 314 (S5).

[0138] The AMF element 314 is configured to perform an authentication process for the UE 110 using information provided by the UDM / AUSF. For example, the AMF element 314 sends an authentication request together with an authentication token to the UE 110 (S6), and the UE 110 attempts to verify the authentication token. If successful, the UE 110 calculates a response token and sends an authentication response with the response token, which is received by the AMF element 314 (S7). The AMF element 314 formats or generates another authentication request (i.e., a Nausf_UEAuthentication_Authenticate request) and inserts the response token from the UE 110 into the authentication request together with other information. Then, the AMF element 314 sends the authentication request to the AUSF element 310 (S8). The AUSF element 310 verifies whether the response token from the UE 110 matches the expected response token, and sends an authentication response indicating authentication success / failure (i.e., a Nausf_UEAuthentication_Authenticate response) to the AMF element 314.

[0139] When UE 110 is authenticated to the network, AMF element 314 initiates a NAS security process to establish a new NAS security context. AMF element 314 selects a NAS security algorithm (or multiple algorithms) for encryption and integrity protection. AMF element 314 formats or generates a security mode command message and inserts an indicator of the NAS security algorithm, ngKSI and other information into the security mode command message. Then, AMF element 314 sends the security mode command message to UE 110 (S10).

[0140] For the second phase of the NAS process, UE 110 uses ngKSI and NAS security algorithms to derive corresponding keys for protecting subsequent NAS messages. Therefore, a new NAS security context is established between UE 110 and AMF element 314. UE 110 formats or generates a security mode complete message and inserts the second registration request into the NAS message container of the security mode complete message. As described above, the second registration request includes the entire NAS protocol IE set (mandatory and optional (if necessary)) for the NAS registration process and is regarded as a "completed" NAS message. UE 110 uses the NAS security algorithm of the new NAS security context to encrypt the NAS message container of the security mode complete message. Therefore, the second registration request is encrypted in the NAS message container of the security mode complete message. Then, UE 110 sends the security mode complete message to AMF element 314 (S11).

[0141] The AMF element 314 receives the security mode complete message from the UE 110 and decrypts the NAS message container of the security mode complete message to access the NAS protocol IE according to the second registration request. Then, the AMF element 314 continues the NAS registration process (S12), for example, by sending a registration accept message to the UE 110. The UE 110 replies to the AMF element 314 with a registration complete message (S13), at which time the UE 110 registers with the network to access the service.

[0142] Fig. 22 1 is a message diagram illustrating a NAS service request process when the UE has a NAS security context, but the NAS security context is invalid or not found in an illustrative embodiment. For the first phase of the NAS process, the UE 110 generates or formats a first service request for the NAS service request process. In this embodiment, the UE 110 fills the first service request with a subset of the NAS protocol IEs specified for security-related processing. This information is used to indicate the NAS security context to the AMF element 314. For example, the subset of the NAS protocol IEs may include 5G-S-TMSI and ngKSI. The UE 110 also formats or generates a second service request, which is a copy of the first service request. The UE 110 includes or inserts the NAS protocol IEs used for the NAS service request process into the second service request. In this step, the second service request includes the entire NAS protocol IE set (mandatory and optional (if necessary)) for the NAS service request process. Because the second service request includes each mandatory NAS protocol IE for the NAS service request process, the second service request is considered a "completed" service request.

[0143] UE 110 includes or inserts the second service request in the NAS message container of the first service request, and encrypts the NAS message container of the first service request using the NAS security algorithm of the NAS security context. Thus, the completed second service request is encrypted in the NAS message container of the first service request. Then, UE 110 sends the first service request to AMF element 314 (S1).

[0144] In response to receiving the first service request, the AMF element 314 attempts to identify or retrieve a NAS security context based on a subset of the NAS protocol IEs included in the first service request. In this example, the AMF element 314 cannot identify a valid NAS security context for UE 110. Therefore, the AMF element 314 cannot decrypt the NAS message container of the first service request. In order to allow secure communication, the AMF element 314 initiates a new authentication process to create a new NAS security context. The AMF element 314 formats or generates an authentication request (i.e., Nausf_UEAuthentication_Authenticate request) and sends the authentication request to the AUSF element 310 (S2). In response to receiving the authentication request, the AUSF element 310 formats or generates an authentication request (i.e., Nudm-_UEAuthentication_Get request) and sends the authentication request to the UDM element 312 (S3).

[0145] In response to the authentication request, the UDM component 312 de-hides the SUCI and sends an authentication response (i.e., Nudm_UEAuthentication_Get response) to the AUSF component 310 (S4). In response to receiving the authentication response, the AUSF component 310 formats or generates an authentication response (i.e., Nuasf-_UEAuthentication_Authenticate response) for the AMF component 314 and sends the authentication response to the AMF component 314 (S5).

[0146] The AMF element 314 is configured to perform an authentication process for the UE 110 using information provided by the UDM / AUSF. For example, the AMF element 314 sends an authentication request together with an authentication token to the UE 110 (S6), and the UE 110 attempts to verify the authentication token. If successful, the UE 110 calculates a response token and sends an authentication response with the response token, which is received by the AMF element 314 (S7). The AMF element 314 formats or generates another authentication request (i.e., a Nausf_UEAuthentication_Authenticate request) and inserts the response token from the UE 110 into the authentication request together with other information. Then, the AMF element 314 sends the authentication request to the AUSF element 310 (S8). The AUSF element 310 verifies whether the response token from the UE 110 matches the expected response token, and sends an authentication response indicating authentication success / failure (i.e., a Nausf_UEAuthentication_Authenticate response) to the AMF element 314.

[0147] When UE 110 is authenticated to the network, AMF element 314 initiates a NAS security process to establish a new NAS security context. AMF element 314 selects a NAS security algorithm (or multiple algorithms) for encryption and integrity protection. AMF element 314 formats or generates a security mode command message and inserts an indicator of the NAS security algorithm, ngKSI and other information into the security mode command message. Then, AMF element 314 sends the security mode command message to UE 110 (S10).

[0148] For the second phase of the NAS process, UE 110 uses ngKSI and NAS security algorithms to derive corresponding keys for protecting subsequent NAS messages. Therefore, a new NAS security context is established between UE 110 and AMF element 314. UE 110 formats or generates a security mode complete message and inserts the second service request into the NAS message container of the security mode complete message. As described above, the second service request includes the entire NAS protocol IE set (mandatory and optional (if necessary)) for the NAS service request process and is regarded as a "completed" NAS message. UE 110 uses the NAS security algorithm of the new NAS security context to encrypt the NAS message container of the security mode complete message. Therefore, the second service request is encrypted in the NAS message container of the security mode complete message. Then, UE 110 sends the security mode complete message to AMF element 314 (S11).

[0149] The AMF element 314 receives the security mode complete message from the UE 110 and decrypts the NAS message container of the security mode complete message to access the NAS protocol IE according to the second service request. Then, the AMF element 314 continues the NAS service request process (S12), for example, by sending a registration accept message to the UE 110. The UE 110 replies to the AMF element 314 with a registration complete message (S13).

[0150] Any of the various elements or modules shown in the drawings or described herein can be implemented as hardware, software, firmware or some combination of these. For example, an element can be implemented as dedicated hardware. The dedicated hardware element can be referred to as a "processor", "controller" or some similar terms. When provided by a processor, the function can be provided by a single dedicated processor, a single shared processor or a plurality of separate processors, some of which can be shared. In addition, the explicit use of the term "processor" or "controller" should not be interpreted as specifically referring to hardware capable of executing software, and may implicitly include but is not limited to digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC) or other circuit system, field programmable gate array (FPGA), read-only memory (ROM) for storing software, random access memory (RAM), non-volatile storage device, logic or some other physical hardware components or modules.

[0151] Moreover, the elements may be implemented as instructions that can be executed by a processor or computer to perform the functions of the elements. Some examples of instructions are software, program code, and firmware. The instructions are operable when executed by the processor to direct the processor to perform the functions of the elements. The instructions may be stored on a storage device readable by the processor. Some examples of storage devices are digital or solid-state memories, such as magnetic storage media of disks and tapes, hard drives, or optically readable digital data storage media.

[0152] As used in this application, the term "circuitry" may refer to one, more, or all of the following:

[0153] (a) Pure hardware circuit implementation (e.g., implementation in analog circuits and / or digital circuit systems only);

[0154] (b) a combination of hardware circuitry and software, such as (where applicable):

[0155] (i) a combination of analog hardware circuits and / or digital hardware circuits and software / firmware; and

[0156] (ii) any portion of a hardware processor with software (including a digital signal processor, software and memory that work together to enable a device such as a mobile phone or server to perform various functions); and

[0157] (c) Hardware circuits and or processors, such as a microprocessor or portion of a microprocessor, that require software (eg, firmware) to operate, but which may not be present when the software is not required for operation.

[0158] This definition of "circuitry" applies to all uses of this term in this application, including in any claims. As another example, as used in this application, the term "circuitry" also covers an implementation of only a hardware circuit or processor (or multiple processors) or a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term "circuitry" also covers (for example and where applicable to a particular claim element) a baseband integrated circuit or processor integrated circuit of a mobile device or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0159] Although specific embodiments are described herein, the scope of the present disclosure is not limited to those specific embodiments.The scope of the present disclosure is defined by the following claims and any equivalents thereof.

Claims

1. A network element of a mobile network, the network element comprising: at least one processor; as well as at least one memory including computer program code executable by the processor; The processor is configured to cause the network element to perform non-access stratum (NAS) procedures in a plurality of stages to establish a NAS communication session between the network element and a user equipment (UE); For the first stage of the NAS process, the processor is further configured to cause the network element to: receiving an initial NAS message from the UE, wherein the initial NAS message is populated with a subset of NAS protocol information elements (IEs) for the NAS procedure that are designated for security-related processing; processing the subset of the NAS protocol IEs to determine that no NAS security context exists for the UE; selecting a NAS security algorithm for the NAS security context; as well as sending a response indicating the NAS security algorithm and a security key set identifier for the NAS security context to the UE; For the second stage of the NAS process, the processor is further configured to cause the network element to: receiving, from the UE, a subsequent NAS message having a NAS message container, the NAS message container including the initial NAS message encrypted based on the NAS security algorithm; as well as The NAS message container of the subsequent NAS message is decrypted, wherein the initial NAS message contained in the NAS message container of the subsequent NAS message is populated with each of the NAS protocol IEs used for the NAS procedure.

2. The network element of claim 1, wherein: For the first phase, encrypting the subset of the NAS protocol IEs in the initial NAS message using a public key for a Home Public Land Mobile Network (HPLMN) of the UE; and The processor is further configured to cause the network element to initiate decryption of the subset of the NAS protocol IEs.

3. The network element of claim 2, wherein: The network elements include Access and Mobility Management Function (AMF) elements of the mobile network.

4. The network element of claim 3, wherein: The processor is further configured to cause the network element to send the subset of encrypted NAS protocol IEs to a unified data management (UDM) element to decrypt the subset of NAS protocol IEs based on a private key of the HPLMN.

5. The network element of claim 1, wherein: The initial NAS message includes a registration request message; and The subset of the NAS protocol IEs designated for security-related processing consists of the following items: the mobile identity of the UE, the UE security capabilities indicating one or more NAS security algorithms supported by the UE, the registration type, and the security key set identifier of the NAS security context.

6. The network element of claim 1, wherein: The response includes a security mode command message indicating the NAS security algorithm and the security key set identifier; and The subsequent NAS message received from the UE includes a security mode complete message having the NAS message container including the initial NAS message encrypted based on the NAS security algorithm.

7. The network element of claim 1, wherein: The mobile network includes a fifth generation (5G) network.

8. A method of performing non-access stratum (NAS) procedures to establish a NAS communication session between a user equipment (UE) and a network element of a mobile network, the method comprising: For the first stage of the NAS process: receiving, at the network element, an initial NAS message from the UE, wherein the initial NAS message is populated with a subset of NAS protocol information elements (IEs) for the NAS procedure that are designated for security-related processing; processing the subset of the NAS protocol IEs at the network element to determine that no NAS security context exists for the UE; selecting, at the network element, a NAS security algorithm for the NAS security context; as well as sending, from the network element to the UE, a response indicating the NAS security algorithm for the NAS security context and a security key set identifier; For the second phase of the NAS process: receiving, at the network element, from the UE a subsequent NAS message having a NAS message container, the NAS message container including the initial NAS message encrypted based on the NAS security algorithm; as well as The NAS message container of the subsequent NAS message is decrypted at the network element, wherein the initial NAS message contained in the NAS message container of the subsequent NAS message is populated with each of the NAS protocol IEs used for the NAS procedure.

9. The method of claim 8, wherein: for the first phase, encrypting the subset of the NAS protocol IEs in the initial NAS message using a public key for a Home Public Land Mobile Network (HPLMN) of the UE; and The method further comprises: Initiate decryption of the subset of the NAS protocol IEs.

10. The method of claim 9, wherein: The network element comprises an access and mobility management function (AMF) element of the mobile network; and Initiating decryption of the subset of the NAS protocol IEs includes sending the encrypted subset of the NAS protocol IEs to a unified data management (UDM) element to decrypt the subset of the NAS protocol IEs based on a private key of the HPLMN.

Images