Negotiation of security mechanisms enabling combined integrity and cryptographic algorithms

Abstract

A security mechanism is negotiated between a user equipment and a network (300). In one embodiment, an access and mobility management function (212) is operably coupled to a user equipment (106). The access and mobility management functionality comprises means (1504) for identifying security capabilities of the user equipment in supporting one or more non-access stratum combination integrity and encryption algorithms (1050), a means (1504) for selecting a non-access stratum combination integrity and encryption algorithm from the one or more non-access stratum combination integrity and encryption algorithms to protect the non-access stratum signaling, and a means (1502) for sending a non-access stratum security mode command message (2312) indicating the non-access stratum combination integrity and encryption algorithm to the user equipment.

Description

Technical Field

[0001] The present disclosure relates to the field of communication systems, and in particular to next generation networks. Background Art

[0002] Next generation networks, such as the fifth generation (5G), represent the next major phase in mobile telecommunication standards beyond the fourth generation (4G) standards. Compared to 4G networks, next generation networks may be enhanced in terms of radio access and network architecture. Next generation networks intend to utilize new areas of the radio spectrum for radio access networks (RANs), such as the millimeter wave bands.

[0003] As mobile networks become more widely used across the country and around the world, communications may be intercepted or subject to other types of attacks. To ensure security and privacy, the Third Generation Partnership Project (3GPP) has described the security mechanisms of 5G mobile networks and the security procedures performed within 5G mobile networks. Due to the importance of security in 5G systems and other systems, it is expected that more robust security mechanisms will continue to be developed. Summary of the invention

[0004] This article describes an enhanced security mechanism for a 5G system. Communications within a 5G system (i.e., signaling or user plane data) can be protected via integrity protection and / or encryption. Previously, separate integrity algorithms and encryption algorithms were implemented. In the embodiments described herein, a combined integrity and encryption algorithm is implemented, which is configured to apply integrity protection and / or encryption using a single key. One technical advantage is that fewer keys are derived for the security mechanism. Another technical advantage is that there is no need to supply and manage separate integrity protection algorithms and encryption algorithms. The encryption process and the calculation of the integrity code (i.e., message authentication code) can also be completed as a single process.

[0005] In one embodiment (also referred to as an aspect), an access and mobility management function (AMF) is operatively coupled to a user equipment (UE) to negotiate a security mechanism. The access and mobility management function includes a component for identifying the security capabilities of the user equipment in supporting one or more non-access stratum combined integrity and encryption algorithms, a component for selecting a non-access stratum combined integrity and encryption algorithm from the one or more non-access stratum combined integrity and encryption algorithms to protect non-access stratum signaling, and a component for sending a non-access stratum security mode command message indicating the non-access stratum combined integrity and encryption algorithm to the user equipment.

[0006] In one embodiment, the non-access stratum combined integrity and encryption algorithm supports multiple operation modes. The means for selecting includes means for selecting an operation mode for the non-access stratum combined integrity and encryption algorithm from the multiple operation modes, and the means for sending includes means for sending a non-access stratum security mode command message to the user equipment, the non-access stratum security mode command message indicating the non-access stratum combined integrity and encryption algorithm and the operation mode of the non-access stratum combined integrity and encryption algorithm.

[0007] In one embodiment, the plurality of operation modes include at least integrity and encryption mode, integrity mode, encryption mode, and NULL encryption and NULL integrity mode.

[0008] In one embodiment, the integrity mode includes at least one of: an ignore encryption and integrity mode, in which the non-access stratum combined integrity and encryption algorithm is configured to apply integrity protection and encryption to non-access stratum signaling using a non-access stratum combined integrity and encryption key, but encrypted data is ignored; and a NULL encryption and integrity mode, in which the non-access stratum combined integrity and encryption algorithm is configured to apply integrity protection and NULL encryption to non-access stratum signaling using a non-access stratum combined integrity and encryption key.

[0009] In one embodiment, the non-access stratum security mode command message is extended to indicate a non-access stratum combined integrity and encryption algorithm and a selected operation mode for the non-access stratum combined integrity and encryption algorithm from a plurality of operation modes.

[0010] In one embodiment, the non-access stratum combined integrity and encryption algorithm uses at least one of the additional authentication data and the additional entropy data as input parameters to generate a non-access stratum message authentication code.

[0011] In one embodiment, the additional authentication data includes one of a 5G temporary mobile subscriber identity TMSI of the user equipment, a truncated 5G-S-TMSI, or network slice selection assistance information.

[0012] In one embodiment, the additional entropy data comprises a random number generated by an access and mobility management function.

[0013] In one embodiment, the access and mobility management function further comprises a component for identifying the additional authentication data and a component for identifying the additional entropy data. The component for sending comprises a component for sending a non-access stratum security mode command message including at least one of the additional authentication data and the additional entropy data to the user equipment.

[0014] In one embodiment, the non-access stratum security mode command message is extended to include at least one of additional authentication data and additional entropy data.

[0015] In one embodiment, the component for identifying includes a component for receiving a non-access stratum message from a user equipment, the non-access stratum message indicating one or more non-access stratum combined integrity and encryption algorithms supported by the user equipment, and a user equipment security capability information element of the non-access stratum message is extended to indicate one or more non-access stratum combined integrity and encryption algorithms supported by the user equipment.

[0016] In one embodiment, a radio access network node (e.g., a gNB) is operably coupled to a user equipment. The radio access network node includes means for identifying a security capability of the user equipment in supporting one or more access stratum combined integrity and ciphering algorithms, means for selecting an access stratum combined integrity and ciphering algorithm from the one or more access stratum combined integrity and ciphering algorithms to protect radio resource control signaling, and means for sending an access stratum security mode command message indicating the access stratum combined integrity and ciphering algorithm to the user equipment.

[0017] In one embodiment, the access layer combined integrity and encryption algorithm supports multiple operation modes, the component for selecting includes a component for selecting an operation mode selected for the access layer combined integrity and encryption algorithm to protect radio resource control signaling from the multiple operation modes, and the component for sending includes a component for sending an access layer security mode command message to the user equipment, the access layer security mode command message indicating the access layer combined integrity and encryption algorithm, and the operation mode of the access layer combined integrity and encryption algorithm.

[0018] In one embodiment, the security algorithm configuration information element of the access stratum security mode command message is extended to indicate the access stratum combined integrity and encryption algorithm and the operation mode selected for the access stratum combined integrity and encryption algorithm from a plurality of operation modes.

[0019] In one embodiment, the access layer combined integrity and encryption algorithm uses at least one of the additional authentication data and the additional entropy data as input parameters to generate a message authentication code.

[0020] In one embodiment, the additional authentication data comprises at least one of a radio network temporary identifier and a physical cell identifier.

[0021] In one embodiment, the additional entropy data comprises a random number generated by the radio access network node.

[0022] In one embodiment, the radio access network node further comprises means for identifying additional authentication data and means for identifying additional entropy data.The means for sending comprises means for sending an access stratum security mode command message comprising at least one of the additional authentication data and the additional entropy data to the user equipment.

[0023] In one embodiment, the security algorithm configuration information element of the access layer security mode command message is extended to include at least one of additional authentication data and additional entropy data.

[0024] In one embodiment, the radio access network node further comprises means for selecting an access stratum combined integrity and ciphering algorithm for a radio bearer from one or more access stratum combined integrity and ciphering algorithms, and means for sending a radio resource control connection reconfiguration message to the user equipment, the radio resource control connection reconfiguration message indicating the access stratum combined integrity and ciphering algorithm selected for the radio bearer.

[0025] In one embodiment, a user equipment is operably coupled to a network. The user equipment includes a component for receiving a non-access stratum security mode command message from an access and mobility management function, wherein the non-access stratum security mode command message indicates a non-access stratum combined integrity and encryption algorithm selected by the access and mobility management function. The user equipment also includes a component for activating the non-access stratum combined integrity and encryption algorithm indicated in the non-access stratum security mode command message to protect non-access stratum signaling.

[0026] In one embodiment, the user equipment further comprises means for receiving an access stratum security mode command message from the radio access network node, wherein the access stratum security mode command message indicates an access stratum combined integrity and ciphering algorithm selected by the radio access network node. The user equipment further comprises means for activating the access stratum combined integrity and ciphering algorithm indicated in the access stratum security mode command message to protect radio resource control signaling.

[0027] In one embodiment, the user equipment further comprises means for receiving a radio resource control connection reconfiguration message from the radio access network node, wherein the radio resource control connection reconfiguration message indicates an access stratum combined integrity and ciphering algorithm selected by the radio access network node for the radio bearer. The user equipment further comprises means for activating the access stratum combined integrity and ciphering algorithm to protect user plane traffic over the radio bearer.

[0028] In one embodiment, a method for negotiating a security mechanism is disclosed. In a communication system including a user device operably coupled to a network, the method includes identifying, at the network, a security capability of the user device in supporting one or more combined integrity and encryption algorithms, selecting, at the network, a combined integrity and encryption algorithm from the one or more combined integrity and encryption algorithms, and sending, from the network to the user device, a security negotiation message indicating the combined integrity and encryption algorithm.

[0029] In one embodiment, the method further comprises receiving, at the user equipment, a security negotiation message from the network, and activating, at the user equipment, a combined integrity and encryption algorithm indicated in the security negotiation message to protect communications.

[0030] In one embodiment, the selecting comprises selecting an operating mode for the combined integrity and encryption algorithm from a plurality of operating modes, and the sending comprises sending a security negotiation message from the network to the user equipment indicating the combined integrity and encryption algorithm and the operating mode of the combined integrity and encryption algorithm.

[0031] In one embodiment, the method further comprises identifying additional authentication data at the network, and identifying additional entropy data at the network. The sending comprises sending a security negotiation message from the network to the user equipment including at least one of the additional authentication data and the additional entropy data.

[0032] In one embodiment, the security negotiation message comprises a security mode command message.

[0033] In one embodiment, the identification includes receiving a non-access stratum message from the user equipment indicating one or more combined integrity and encryption algorithms supported by the user equipment, and a user equipment security capability information element of the non-access stratum message is extended to indicate one or more combined integrity and encryption algorithms supported by the user equipment.

[0034] In one embodiment, for a non-access stratum security procedure between a user equipment and an access and mobility management function, the selection includes selecting a non-access stratum combined integrity and encryption algorithm from one or more combined integrity and encryption algorithms at the access and mobility management function, and the sending includes sending a non-access stratum security mode command message indicating the non-access stratum combined integrity and encryption algorithm from the access and mobility management function to the user equipment.

[0035] In one embodiment, the receiving includes receiving a non-access stratum security mode command message indicating a non-access stratum combined integrity and encryption algorithm at the user equipment, and the activating includes activating the non-access stratum combined integrity and encryption algorithm at the user equipment to protect the non-access stratum signaling.

[0036] In one embodiment, the Non-Access Stratum Security Algorithm Information Element of the Non-Access Stratum Security Mode Command message is extended to indicate the Non-Access Stratum Combined Integrity and Encryption Algorithm.

[0037] In one embodiment, the non-access stratum combined integrity and encryption algorithm supports multiple operation modes, and the non-access stratum security mode command message is extended to indicate the operation mode selected for the non-access stratum combined integrity and encryption algorithm from the multiple operation modes.

[0038] In one embodiment, a non-access stratum combined integrity and encryption algorithm uses at least one of additional authentication data and additional entropy data as input parameters to generate a non-access stratum message authentication code, and the non-access stratum security mode command message is extended to include at least one of the additional authentication data or the additional entropy data.

[0039] In one embodiment, the additional authentication data includes one of a 5G temporary mobile subscriber identity TMSI of the user equipment, a truncated 5G-S-TMSI, or network slice selection assistance information.

[0040] In one embodiment, the additional entropy data comprises a random number generated by an access and mobility management function.

[0041] In one embodiment, for an access stratum security procedure between a user equipment and a radio access network node, the selection includes selecting an access stratum combined integrity and encryption algorithm from one or more combined integrity and encryption algorithms at the radio access network node, and the sending includes sending an access stratum security mode command message indicating the access stratum combined integrity and encryption algorithm from the radio access network node to the user equipment.

[0042] In one embodiment, the receiving includes receiving an access stratum security mode command message indicating an access stratum combined integrity and encryption algorithm at the user equipment, and the activating includes activating the access stratum combined integrity and encryption algorithm at the user equipment to protect radio resource control signaling.

[0043] In one embodiment, the Security Algorithm Configuration information element of the Access Stratum Security Mode Command message is extended to indicate the access stratum combined integrity and encryption algorithm.

[0044] In one embodiment, the access stratum combined integrity and encryption algorithm supports multiple operation modes, and the security algorithm configuration information element is extended to indicate an operation mode selected for the access stratum combined integrity and encryption algorithm from the multiple operation modes.

[0045] In one embodiment, the access stratum combined integrity and encryption algorithm uses at least one of the additional authentication data and the additional entropy data as input parameters to generate a message authentication code, and the security algorithm configuration information element is extended to include at least one of the additional authentication data and the additional entropy data.

[0046] In one embodiment, the additional authentication data comprises at least one of a radio network temporary identifier and a physical cell identifier.

[0047] In one embodiment, the additional entropy data comprises a random number generated by the radio access network node.

[0048] In one embodiment, after radio resource control security is activated as part of an access stratum security procedure between the user equipment and the radio access network node, the method further comprises selecting, at the radio access network node, an access stratum combined integrity and ciphering algorithm for the radio bearer from one or more combined integrity and ciphering algorithms, and sending, from the radio access network node to the user equipment, a radio resource control connection reconfiguration message indicating the access stratum combined integrity and ciphering algorithm selected for the radio bearer.

[0049] In one embodiment, the method further comprises receiving, at the user equipment, a radio resource control connection reconfiguration message indicating an access stratum combined integrity and ciphering algorithm selected for the radio bearer, and activating, at the user equipment, the access stratum combined integrity and ciphering algorithm to protect user plane traffic over the radio bearer.

[0050] In one embodiment, the security algorithm configuration field of the radio resource control connection reconfiguration message is extended to indicate the access stratum combined integrity and encryption algorithm.

[0051] In one embodiment, the access stratum combined integrity and encryption algorithm supports multiple operation modes, and the security algorithm configuration field is extended to indicate an operation mode selected for the access stratum combined integrity and encryption algorithm from the multiple operation modes.

[0052] In one embodiment, the access layer combined integrity and encryption algorithm uses at least one of the additional authentication data and the additional entropy data as input parameters to generate a message authentication code, and the security algorithm configuration field is extended to include at least one of the additional authentication data and the additional entropy data.

[0053] Other embodiments may include computer readable media, other systems or devices, or other methods as described below. Additionally, one or more of the embodiments described above may be combined as described herein.

[0054] The above summary of the invention provides a basic understanding of some aspects of this specification. This summary of the invention is not a comprehensive overview of this specification. It is neither intended to identify the key or important elements of this specification, nor to define any scope of the specific embodiments of this specification, or any scope of the claims. Its only purpose is to present some concepts of this specification in a simplified form as a preface to a more detailed description later. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Some embodiments of the present invention will now be described by way of example only and with reference to the accompanying drawings.In all drawings, the same reference number represents the same element or the same type of element.

[0056] Figure 1 The diagram shows the high-level architecture of the 5G system;

[0057] Figure 2 The diagram shows the non-roaming architecture of the 5G system;

[0058] Figure 3 The diagram shows the security mechanisms within the 5G system;

[0059] Figure 4A-4B illustrates a primary authentication process providing mutual authentication between a user device and a network;

[0060] Figure 5 The diagram shows the non-access stratum (NAS) and access stratum (AS) security processes;

[0061] Figure 6 The diagram illustrates user plane (UP) security activation;

[0062] Figure 7 The key hierarchy of the 5G system is illustrated;

[0063] Figure 8 The integrity algorithm (NIA) is illustrated;

[0064] Fig. 9 A diagram illustrating a ciphering or encryption algorithm (NEA);

[0065] Fig. 10A illustrates a combination algorithm (NCA) in an illustrative embodiment;

[0066] Fig. 10B illustrates a NAS combining algorithm (NAS NCA) in an illustrative embodiment;

[0067] Fig. 10C illustrates an AS combining algorithm (AS NCA) in an illustrative embodiment;

[0068] Fig. 10D is a block diagram illustrating different modes of operation of a combining algorithm in an illustrative embodiment;

[0069] Fig.11 An enhanced key hierarchy for a 5G system in an illustrative embodiment is illustrated;

[0070] Fig.12 is a block diagram illustrating an algorithmic key derivation function (KDF) in an illustrative embodiment;

[0071] Fig.13 A table illustrating algorithm type specifiers in an illustrative embodiment;

[0072] Fig.14 is a block diagram of a user equipment (UE) in an illustrative embodiment;

[0073] Fig.15 is a block diagram of an AMF in an illustrative embodiment;

[0074] Fig.16 is a block diagram of a RAN node in an illustrative embodiment;

[0075] Fig.17 The NAS functional layer and the AS functional layer of the 5G system in an illustrative embodiment are illustrated;

[0076] Figure 18A-18E is a flow chart illustrating a method of performing a security mechanism in a 5G system in an illustrative embodiment;

[0077] Fig.19 illustrates a NAS functional layer and an AS functional layer in a 5G system in an illustrative embodiment;

[0078] Figure 20A-20B is a flow chart illustrating a method of negotiating a security mechanism in an illustrative embodiment;

[0079] Fig.21 is a signaling diagram illustrating negotiation of a security mechanism in an illustrative embodiment;

[0080] Figure 22A-22B is a flow chart illustrating a method of negotiating a NAS security mechanism in an illustrative embodiment;

[0081] Fig.23 is a signaling diagram illustrating a NAS security procedure between a UE and an AMF of a 5G network in an illustrative embodiment;

[0082] Fig.24 is a block diagram illustrating a NAS security algorithm information element (IE);

[0083] Fig.25 is a block diagram illustrating an extension of the encoding for a NAS security algorithm IE in an illustrative embodiment;

[0084] Fig.26 is a block diagram illustrating the contents of a NAS security mode command message in an illustrative embodiment;

[0085] Fig. 27 is a block diagram illustrating an additional 5G AEAD security information IE in an illustrative embodiment;

[0086] Fig.28 illustrates encoding for additional 5G AEAD security information IE in an illustrative embodiment;

[0087] Figure 29A-29B is a flow chart illustrating a method of performing an RRC security mechanism in an illustrative embodiment;

[0088] Fig.30 is a signaling diagram illustrating an RRC security procedure between a UE and a gNB in ​​an illustrative embodiment;

[0089] Fig.31 The diagram shows the message content of the AS security mode command message;

[0090] Fig.32 illustrates a security algorithm configuration IE in an illustrative embodiment;

[0091] Figure 33A-Figure 33B is a flow chart illustrating a method of performing a UP security process in an illustrative embodiment;

[0092] Fig.34 is a signaling diagram illustrating a UP security procedure between a UE and a gNB in ​​an illustrative embodiment;

[0093] Fig.35 illustrates the message content of an RRC connection reconfiguration message in an illustrative embodiment;

[0094] Fig.36 is a block diagram illustrating a UE security capabilities IE;

[0095] Fig.37 is a block diagram illustrating an extension to the encoding of a UE security capability IE in an illustrative embodiment;

[0096] Figure 38A-Figure 38B Two integrity modes in an illustrative embodiment are illustrated;

[0097] Fig.39 is a signaling diagram illustrating NAS and AS security procedures in an illustrative embodiment;

[0098] Fig.40 is a signaling diagram illustrating NAS and AS security procedures in an illustrative embodiment;

[0099] Fig.41 is a signaling diagram illustrating NAS and AS security procedures in an illustrative embodiment; and

[0100] Figure 42A-42B The derivation of additional entropy data in an illustrative embodiment is illustrated. DETAILED DESCRIPTION

[0101] The accompanying drawings and the following description illustrate specific exemplary embodiments. Therefore, it should be understood that those skilled in the art will be able to design various arrangements, which, although not explicitly described or shown herein, embody the principles of the embodiments and are included within the scope of the embodiments. In addition, any examples described herein are intended to help understand the principles of the embodiments and should be interpreted as not being limited to such specifically cited examples and conditions. Therefore, (multiple) inventive concepts are not limited to the specific embodiments or examples described below, but are defined by the claims and their equivalents.

[0102] Figure 1 The high-level architecture of a 5G system 100 is illustrated. The 5G system (5GS) 100 is a communication system (e.g., a 3GPP system) including a 5G access network ((R)AN) 102 (generally referred to herein as a RAN) and a 5G core network (5GC) 104, which communicates with a 5G user equipment (UE) 106. The RAN 102 and the 5GC 104 together may be referred to as a 5G network 101, a 5G mobile network, a 5G communication network, etc. Although the term "5G" is used herein, any next generation network other than 5G is also considered.

[0103] The RAN 102 provides a radio or wireless connection to the UE 106 and connects the UE 106 to the 5GC 104. The RAN 102 may include a next generation radio access network (NG-RAN), a non-3GPP access network, and / or another type of RAN connected to the 5GC 104. The RAN 102 may support Evolved UMTS Terrestrial Radio Access Network (E-UTRAN) access (e.g., through eNodeB (eNB), gNodeB (gNB), and / or ng-eNodeB (ng-eNB)), wireless local area network (WLAN) access, satellite radio access, new radio access technologies (RATs), etc. The 5G access network may also support fixed access. The 5GC 104 interconnects the RAN 102 with a data network (DN) 108. The 5GC 104 consists of a network function (NF) 110, which may be implemented as a network element on dedicated hardware, a software instance running on dedicated hardware, a virtualized function instantiated on an appropriate platform (e.g., a cloud infrastructure), etc. The data network 108 may be a carrier external public or private data network, or a carrier internal data network (e.g., for IP Multimedia Subsystem (IMS) services). The UE 106 (also referred to as a mobile terminal) includes a 5G-capable device configured to register with the 5GC 104 to access services. The UE 106 may include an end-user device such as a mobile phone (e.g., a smartphone), a tablet computer, a computer with a mobile broadband adapter, etc. The UE 106 may be enabled for voice services, data services, machine-to-machine (M2M) or machine type communication (MTC) services, and / or other services.

[0104] Figure 2 A non-roaming architecture 200 of the 5G system 100 is illustrated. Figure 2The architecture 200 in is a service-based representation, as further described in 3GPP TS 23.501 (v18.2.0), which is incorporated herein by reference as if fully included herein. The architecture 200 consists of network functions (NFs) of 5GC 104, and the NFs of the control plane (CP) are separated from the user plane (UP). The control plane of 5GC 104 includes an authentication server function (AUSF) 210, an access and mobility management function (AMF) 212, a session management function (SMF) 214, a policy control function (PCF) 216, a unified data management (UDM) 218, a network slice selection function (NSSF) 220, and an application function (AF) 222. The control plane of 5GC 104 also includes a network exposure function (NEF) 224, a NF repository function (NRF) 226, a service communication proxy (SCP) 228, a network slice admission control function (NSACF) 230, a network slice specific and SNPN authentication and authorization function (NSSAAF) 232, and an edge application server discovery function (EASDF) 234. The user plane of 5GC 104 includes one or more user plane functions (UPF) 240 that communicate with the data network 108. UE 106 is able to access the control plane and user plane of 5GC 104 through RAN 102.

[0105] There are a large number of subscribers who are able to access services from a carrier or home network operator that implements a mobile network (including 5G system 100), such as Figure 1-Figure 2 As shown. The communication between the subscriber (ie, through the UE) and the mobile network is protected by a security mechanism (such as the security mechanism standardized by 3GPP). The subscriber and the carrier expect security guarantees from the security mechanism.

[0106] Figure 3The security mechanisms 300 within the 5G system 100 are illustrated. One of the security mechanisms 300 is a master authentication and key agreement between the network (e.g., AMF 212 / UDM 218) and the UE 106. Other security mechanisms 300 are used to protect signaling between the network and the UE 106. For example, the security mechanism 300 is used to protect the non-access stratum (NAS) signaling between the AMF 212 and the UE 106. Another security mechanism 300 is used to protect the radio resource control (RRC) signaling between the gNB 302 and the UE 106. The security mechanism 300 can also be used to protect the user plane (UP) traffic (also called UP data) between the gNB 302 and the UE 106. Within the network, the security mechanism 300 can be used to protect the IP connection between the gNB 302 and the 5GC 104 (e.g., AMF 212 / UPF 240), such as Internet Protocol Security (IPSec). Yet another security mechanism 300 is used for roaming and interconnect security, such as for protecting control plane signaling between a security edge protection proxy (SEPP) 310 and another network 301 (e.g., a visited 5G network), and / or for protecting user plane data between a UPF 240 and another network 301. Additional security mechanisms 300 may be defined or used, and for the sake of brevity, they are not discussed here.

[0107] Figure 4A-4B A master authentication process is illustrated that provides mutual authentication between a UE 106 and a network (e.g., AMF 212 / UDM 218). The purpose of the master authentication and key agreement process is to enable mutual authentication between the UE 106 and the home network of the UE 106, and to provide key material that can be used between the UE 106 and the serving network in subsequent security procedures (e.g., NAS and AS security procedures). The home network (e.g., a home public land mobile network (HPLMN)) represents an operator network or a carrier network through which a subscriber (e.g., UE 106) subscribes to services. The serving network has a radio access device that is capable of communicating with the UE 106 via radio signals. The key material generated by the master authentication and key agreement process results in an anchor key (referred to as K ) provided by the AUSF 210 of the home network to the Security Anchor Function (SEAF) of the serving network. SEAFKey). SEAF provides authentication functionality via the AMF 212 in the serving network and supports primary authentication using a subscription hidden identifier (SUCI) containing a hidden subscription permanent identifier (SUPI). SUPI is a globally unique 5G identifier assigned to each subscriber in the 5G system 100. SUCI consists of a SUPI type, a home network identifier (HN-ID) identifying the home network of the subscriber, a routing indicator (RID) assigned to the subscriber by the home network operator and provisioned in the universal subscriber identity module (USIM) of the UE 106, a protection scheme identifier, a home network public key identifier, and a scheme output. Anchor key (K SEAF ) is from a AUSF The intermediate key of the key. AUSF Keys are established between the UE 106 and the home network (AUSF 210), which is generated by the main authentication process.

[0108] Figure 4Ais a signaling diagram illustrating the initiation of primary authentication such as described in 3GPP TS 33.501 (v18.2.0), which is incorporated herein by reference as if fully included herein. The UE 106 sends an N1 message 411 (i.e., an initial NAS message), such as a registration request, to the serving network 406 (e.g., the AMF 212 of the serving network 406). In a roaming scenario, the serving network 406 may also be referred to as a serving PLMN, a visited PLMN (VPLMN), etc. The UE 106 uses a SUCI or a 5G globally unique temporary identifier (5G-GUTI) in the registration request. The SEAF 402 of the AMF 212 may initiate authentication with the UE 106 during any process of establishing a signaling connection with the UE 106. The SEAF 402 invokes the Nausf_UEAuthentication service to the home network 404 (e.g., HPLMN) by sending a Nausf_UEAuthentication_Authenticate request message 412 to the AUSF 210 to initiate authentication. The Nausf_UEAuthentication_Authenticate request message 412 includes the SUCI or SUPI, and the service network name (SN-Name). After receiving the Nausf_UEAuthentication_Authenticate request message 412, the AUSF 210 checks whether the requesting SEAF 402 in the service network 406 is authorized to use the service network name (SNN) in the Nausf_UEAuthentication_Authenticate request message 412 by comparing the service network name with the expected service network name. When the service network 406 is authorized to use the service network name, the AUSF 210 sends a Nudm_UEAuthentication_Get request message 413 to the UDM 218 of the home network. The Nudm_UEAuthentication_Get request message 413 includes the SUCI or SUPI, and the service network name. After receiving the Nudm_UEAuthentication_Get request message 413, the UDM 218 identifies the SUPI (if received), or calls a subscription identifier de-hiding function (SIDF) that de-hides the SUPI from the SUCI (if received). The UDM 218 (or the Authentication Credentials Repository and Processing Function (ARPF) of the UDM 218) selects or chooses an authentication method for primary authentication based on the SUPI.

[0109] Figure 4B4 is a signaling diagram illustrating a primary authentication process such as described in 3GPP TS 33.501. In this example, 5G Authentication and Key Agreement (AKA) is described, but similar concepts also apply to Extensible Authentication Protocol AKA-prime (EAP-AKA`). For Nudm_UEAuthentication_Get request 413, UDM 218 creates a 5G Home Environment Authentication Vector (5G HE AV) for the selected authentication method. UDM 218 derives K AUSF The UDM218 creates a key that includes the authentication token (AUTN), the expected response (XRES*), K AUSF The UDM 218 then sends a Nudm_UEAuthentication_Get response message 414 with a 5G HE AV key and a random challenge (RAND) to the AUSF 210 for authentication (e.g., Figure 4B In the case where the SUCI is included in the Nudm_UEAuthentication_Get request 413, the UDM 218 includes the SUPI in the Nudm_UEAuthentication_Get response message 414 after the SUPI is hidden from the SUCI. If the subscriber has an Authentication and Key Management for Applications (AKMA) subscription, the UDM 218 may include the AKMA indication and the RID in the Nudm_UEAuthentication_Get response message 414.

[0110] In response to the Nudm_UEAuthentication_Get response message 414, the AUSF 210 temporarily stores the expected response (XRES*) together with the received SUCI or SUPI. The AUSF 210 then generates a 5G authentication vector (5G AV) based on the 5G HE AV received from the UDM 218 by calculating a hashed expected response (HXRES*) based on the expected response (XRES*) and AUSF Key calculation K SEAF Key, and in 5G HE AV, XRES* is replaced by HXRES* and K AUSF The key is replaced by K SEAF Key. AUSF 210 removes K SEAFThe AUSF 210 uses the key to generate a 5G Service Environment Authentication Vector (5G SE AV), which includes an authentication token (AUTN), a hashed expected response (HXRES*), and a random challenge (RAND). The AUSF 210 sends a Nausf_UEAuthentication_Authenticate response message 415 including the 5G SE AV to the SEAF 402. In response, the SEAF 402 sends the authentication token (AUTN) and the random challenge (RAND) to the UE 106 in a NAS Message Authentication Request message 416.

[0111] although Figure 4B 106 , but UE 106 includes a mobile equipment (ME) and a USIM. The ME receives the authentication token (AUTN) and the random challenge (RAND) in the NAS message Authentication Request message 416, and forwards the authentication token (AUTN) and the random challenge (RAND) to the USIM. The USIM of UE 106 verifies the freshness of the received value by checking whether the authentication token (AUTN) can be accepted. If so, the USIM calculates a response (RES), a cipher key (CK), and an integrity key (IK) based on the random challenge (RAND), and returns the response (RES), the CK key, and the IK key to the ME. The ME of UE 106 calculates RES* based on RES, and calculates K based on CK||IK AUSF key, and according to K AUSF Key calculation K SEAF Key.

[0112] UE 106 sends a NAS message authentication response message 417 including RES* to SEAF 402. In response, SEAF 402 calculates HRES* based on RES* and compares HRES* and HXRES*. If they are consistent, SEAF 402 considers authentication successful from the perspective of the serving network. SEAF 402 sends the RES* received from UE 106 to AUSF 210 in a Nausf_UEAuthentication_Authenticate request message 418. When AUSF 210 receives the Nausf_UEAuthentication_Authenticate request message 418 including RES* as authentication confirmation, AUSF 210 stores K based on the policy of the home network operator. AUSFThe AUSF 210 receives the received RES* and compares it with the stored XRES*. If RES* and XRES* are equal, the AUSF 210 considers the authentication successful from the perspective of the home network. The AUSF 210 notifies the UDM 218 of the authentication result (not shown). The AUSF 210 also sends a Nausf_UEAuthentication_Authenticate response message 419 to the SEAF 402 to indicate whether the authentication is successful from the perspective of the home network. If the authentication is successful, K SEAF The key is sent to the SEAF 402 in a Nausf_UEAuthentication_Authenticate response message 419. In case the AUSF 210 receives the SUCI from the SEAF 402 in the authentication request, the AUSF 210 shall include the SUPI in the Nausf_UEAuthentication_Authenticate response message 419 if the authentication is successful.

[0113] As described above, 5G divides UE management into non-access stratum (NAS) and access stratum (AS). The NAS layer protocol manages the connection between the UE 106 and the 5GC 104 (ie, AMF 212), and the AS layer protocol uses the RRC protocol to manage the radio layer between the UE 106 and the RAN 102 (e.g., gNB 302). NAS security ensures that the NAS signaling between the UE 106 and the AMF 212 is protected on the control plane, and AS security ensures that the RRC messages on the control plane and the user plane traffic (e.g., IP packets) on the user plane are protected.

[0114] Figure 5 NAS and AS security procedures are illustrated, such as described in 3GPP TS 33.501 (Sections 6.4 and 6.7, respectively). For NAS security, a NAS Security Mode Command procedure is performed to establish a NAS security context between the UE 106 and the AMF 212. Each AMF 212 is configured with a list of algorithms allowed to be used via network management. Currently, there is a list of NAS integrity algorithms and a list of NAS encryption algorithms, which are ordered according to a priority determined by the operator. To establish the NAS security context, the AMF 212 selects a NAS encryption algorithm and a NAS integrity protection algorithm, and derives a NAS integrity key and a NAS encryption key (e.g., K NASint and K NASenc). The AMF 212 initiates the NAS security mode command procedure by sending a NAS security mode command message 511 to the UE 106. The AMF 212 activates NAS integrity protection before sending the NAS security mode command message 511. The NAS security mode command message 511 contains the previously received UE security capabilities, the selected NAS algorithm, the key set identifier (i.e., ngKSI (next generation key set identifier)), and a message authentication code (NAS-MAC) generated by the AMF 212 for integrity protection of the NAS security mode command message 511. The NAS security mode command message 511 uses the NAS integrity protection based on the K indicated by the ngKSI. AMF The NAS integrity key of the key is integrity protected (but not encrypted). The AMF 212 activates NAS uplink decryption after sending the NAS Security Mode Command message 511.

[0115] After receiving the NAS Security Mode Command message 511, the UE 106 uses the indicated NAS integrity algorithm and the K based on the K indicated by ngKSI. AMF 511. The UE 106 verifies the integrity of the NAS security mode command message 511 using the NAS integrity key of the key. The UE 106 generates a NAS integrity key and a NAS cipher key in the same manner as the AMF 212 using the received algorithm. If the verification is successful, the UE 106 starts NAS integrity protection and encryption / decryption using the security context indicated by the ngKSI. The UE 106 sends a NAS security mode complete message 512 to the AMF 212, which is encrypted and integrity protected. If the verification of the NAS security mode command message 511 is unsuccessful, the UE 106 responds with a NAS security mode reject message (not shown).

[0116] The AMF 212 decrypts and integrity checks the received NAS Security Mode Complete message 512 using the key and algorithm indicated in the NAS Security Mode Command message 511. The AMF 212 activates NAS downlink encryption after receiving the NAS Security Mode Complete message 512.

[0117] AS security includes RRC security and user plane (UP) security. For RRC security, RRC integrity protection and RRC confidentiality protection are provided by the Packet Data Convergence Protocol (PDCP) layer between the UE 106 and the gNB 302. For UP security, the SMF 214 provides the gNB 302 (or ng-eNB) with a UP security policy for a Packet Data Unit (PDU) session during a PDU session establishment procedure (not shown). The UP security policy indicates whether UP confidentiality and / or UP integrity protection is activated for the data radio bearers (DRBs) belonging to the PDU session.

[0118] The AS security mode command procedure is performed to establish an AS security context between the UE 106 and the NG-RAN 502. When the AS security context is to be established in the gNB 302, the AMF 212 sends the UE 5G security capabilities with the encryption and integrity protection algorithms and the K in the NG Application Protocol (NGAP) Initial Context Setup message 513 to the NG-RAN 502 (e.g., gNB 302). gNB Keys. Currently, each gNB 302 is configured via network management with a list of algorithms that are allowed to be used. There is a list of integrity algorithms and a list of cipher algorithms, which are ordered according to a priority determined by the operator. The gNB 302 selects the AS integrity algorithm and the AS cipher algorithm from its configured list that have the highest priority and are present in the UE 5G security capabilities received from the AMF 212. The gNB 302 derives the RRC integrity key (K RRCint ), UP integrity key (K UPint ), RRC encryption key (K RRCenc ) and UP encryption key (K UPenc ). gNB 302 starts to perform integrity protection on RRC messages.

[0119] The gNB 302 sends an integrity-protected AS security mode command message 514 to the UE 106, which includes the selected AS integrity algorithm and AS encryption algorithm, and a message authentication code (MAC-I) generated by the gNB 302 for integrity protection of the AS security mode command message 514. RRC downlink encryption at the gNB 302 starts after the AS security mode command message 514 is sent.

[0120] After receiving the AS security mode command message 514, the UE 106 derives an RRC integrity key (K) similar to that of the gNB 302 based on the selected AS integrity algorithm and AS encryption algorithm. RRCint ) and the RRC encryption key (K RRCenc ). UE 106 verifies the integrity of the AS security mode command and, if successful, starts RRC integrity protection and RRC downlink decryption. UE 106 then sends an AS security mode complete message 515 with integrity protection to gNB 302. AS security mode complete message 515 contains a MAC-I generated by UE 106 for integrity protection of AS security mode complete message 515. RRC uplink encryption at UE 106 starts after sending AS security mode complete message 515. The integrity of AS security mode complete message 515 is verified at gNB 302, and gNB 302 starts RRC uplink decryption.

[0121] In addition, as part of AS security, Figure 6 UP security activation is illustrated. AS UP integrity protection and ciphering activation is performed using the RRC connection reconfiguration procedure as part of the DRB addition procedure. The RRC connection reconfiguration procedure for adding DRBs is performed after RRC security is activated as part of the AS security mode command procedure. The gNB 302 sends an RRC connection reconfiguration message 611 to the UE 106 for UP security activation. The RRC connection reconfiguration message 611 contains an indication to activate UP integrity protection and UP ciphering for each DRB in accordance with the security policy. If UP integrity protection is activated for a DRB as shown in the RRC connection reconfiguration message 611 and the gNB 302 does not have K UPint key, gNB 302 obtains K UPint Key, and UP integrity protection for DRBs starts at gNB 302. Similarly, if UP encryption is activated for DRBs as shown in RRC Connection Reconfiguration message 611, and gNB 302 does not have K UPenc key, gNB 302 obtains K UPenc keys, and UP encryption for DRB starts at gNB 302.

[0122] After receiving the RRC connection reconfiguration message 611, the UE 106 verifies the RRC connection reconfiguration integrity protection. If successful, the UE 106 performs the following operations. When UP integrity protection is activated for DRBs as shown in the RRC connection reconfiguration message 611, and the UE 106 does not have K UPint When the key is obtained, UE 106 obtains K UPint The key is used and UP integrity protection for DRBs begins at UE 106. Similarly, when and as shown in RRC connection reconfiguration message 611, UP ciphering is activated for DRBs and UE 106 does not have K UPenc When the key is obtained, UE 106 obtains K UPenc The key is set, and UP encryption for DRB starts at UE 106. UE 106 sends an RRC connection reconfiguration complete message 612 to gNB 302.

[0123] Figure 7 The key hierarchy 700 of the 5G system 100 such as in 3GPP TS 33.501 (Section 6.2) is illustrated. The keys related to authentication include the following keys: K 701 and CK / IK 702. The key hierarchy 700 includes the following keys: K AUSF 703, K SEAF 704, K AMF705, K NASint 706, K NASenc 707, K N3IWF 708, K gNB 709, K RRCint 710, K RRCenc 711, K UPint 712 and K UPenc 713. The keys for AUSF 210 in the home network 404 include K AUSF Key 703, which is derived from CK', IK' by the ME of UE 106 and AUSF 210 in the case of EAP-AKA', or derived from CK, IK 702 by the ME and ARPF of UDM 218 in the case of 5G AKA. SEAF Key 704 is obtained by ME and AUSF 210 from K AUSF The anchor key is derived from key 703. The key of AMF 212 in service network 406 is obtained by ME and SEAF 402 from K SEAF Key 704 results in K AMF Key 705. The keys for NAS signalling (i.e., NAS security context) include the keys obtained by the ME and AMF 212 from K AMF Key 705 results in K NASint Key 706, which is used to protect the integrity of NAS signaling using a specific integrity algorithm. The key for NAS signaling also includes the key obtained by ME and AMF 212 from K AMF Key 705 results in K NASenc Key 707, which is used to encrypt NAS signaling using a specific encryption algorithm. The NG-RAN key is obtained by ME and AMF 212 from K AMF Key 705 results in K gNB Key 709. For the AS security context, the key for RRC signaling includes the key obtained by the ME and gNB 302 from K gNB Key 709 results in K RRCint Key 710, which is used to protect the integrity of RRC signaling using a specific integrity algorithm. The key for RRC signaling also includes the key obtained by ME and gNB 302 from K gNB Key 709 results in K RRCenc Key 711, which is used to encrypt RRC signaling using a specific encryption algorithm. The key for UP services includes the key obtained by ME and gNB 302 from K gNB Key 709 results in K UPintKey 712, which is used to protect the integrity of UP services between the ME and gNB 302 using a specific integrity algorithm. The key for UP services also includes the key obtained by the ME and gNB 302 from K gNB Key 709 results in K UPenc Key 713, which is used to encrypt UP services using a specific encryption algorithm. For non-3GPP access, K N3IWF Key 708 is obtained by ME and AMF 212 for non-3GPP access from K AMF Key 705 is derived. There are other keys as part of the key hierarchy 700 of the 5G system 100, which will not be discussed here for the sake of brevity.

[0124] Figure 8 An integrity algorithm (NIA) 800 is illustrated, such as shown in Annex D.3 of 3GPP TS 33.501. Currently, the input parameters 802 of the integrity algorithm 800 are a 128-bit integrity key named KEY, a 32-bit COUNT, a 5-bit bearer identity named BEARER, a 1-bit transmission direction (i.e., DIRECTION), and an integrity-protected message (i.e., MESSAGE). The DIRECTION bit for the uplink is set to "0" and the DIRECTION bit for the downlink is set to "1". The bit length of MESSAGE is LENGTH. Based on the input parameters 802, the sender 810 uses the integrity algorithm 800 to calculate a 32-bit message authentication code (MAC-I / NAS-MAC) as output 804. The MAC is then attached to the message when it is sent. For the integrity protection algorithm, the receiver 812 calculates the expected MAC (XMAC-I / XNAS-MAC) on the received message as output 804 in the same manner as the sender 810 calculates its MAC on the sent message, and verifies the data integrity of the message by comparing the calculated MAC with the received MAC (i.e., MAC-I / NAS-MAC). Examples of 128-bit integrity algorithms 800 are 128-NIA1, 128-NIA2, and 128-NIA3.

[0125] Fig. 9A ciphering or encryption algorithm (NEA) 900 such as that shown in Annex D.2 of 3GPP TS 33.501 is illustrated. Currently, the input parameters 902 of the encryption algorithm 900 are a 128-bit cryptographic key named KEY, a 32-bit COUNT, a 5-bit bearer identity BEARER, a 1-bit transmission direction (i.e., DIRECTION), and the length of the required key stream (i.e., LENGTH). The DIRECTION bit of the uplink is set to "0", and the DIRECTION bit of the downlink is set to "1". Based on the input parameters 902, the encryption algorithm 900 generates a key stream block (i.e., KEYSTREAM) as an output 904, which is used to encrypt a plaintext block (i.e., PLAINTEXT) to produce a ciphertext block (i.e., CIPHERTEXT). The key stream is applied to the plaintext block using bit-by-bit binary addition (XOR) of the plaintext and the key stream. The plaintext can be recovered by generating the same keystream using the same input parameters 902 and applying bit-by-bit binary addition to the ciphertext. Examples of 128-bit encryption algorithms 900 are 128-NEA1, 128-NEA2, and 128-NEA3.

[0126] The goal is to continue to improve or enhance the security mechanisms of 5G systems 100 and beyond. For example, the security mechanisms can upgrade 128-bit algorithms to 256-bit algorithms. In addition, current security mechanisms utilize separate integrity algorithms (e.g., Figure 8 NIA 800) and encryption algorithms (e.g. Fig. 9 The NEA 900 in FIG. 9A ) each uses a separate integrity code generation and encryption step (which uses a separate key). The embodiments described herein propose an enhanced security mechanism that implements a combined integrity and encryption algorithm to replace or supplement a separate integrity algorithm and encryption algorithm. The combined integrity and encryption algorithm as described herein is configured to apply or provide encryption (ciphering) / encryption and integrity protection using a single key. The combined integrity and encryption algorithm may also be referred to as a combined algorithm, a next generation combined algorithm (NCA), a combined security algorithm, an associated data authenticated encryption (AEAD) algorithm, etc.

[0127] Fig. 10AA combining algorithm (NCA) 1000 in an illustrative embodiment is illustrated. The combining algorithm 1000 is configured to generate an output 1004 based on input parameters 1002. In one embodiment, the input parameters 1002 of the combining algorithm 1000 include a combined integrity and encryption (CIE) key 1010 (e.g., 256 bits), a 32-bit count 1011 (e.g., an uplink (UL) or downlink (DL) count), a 5-bit bearer identity 1012, a message 1013 including plaintext to be encrypted or ciphertext to be decrypted, and a 1-bit direction 1014 (i.e., transmission direction). For example, the direction 1014 may be "0" for an uplink and "1" for a downlink.

[0128] In one embodiment, the input parameters 1002 may also include additional authentication data (AAD) 1015, AAD length 1016, additional entropy data 1017 (EXTRA), and encryption / decryption mode 1018. AAD 1015 includes an identifier or information (e.g., a value between 0 and 232-1 bits) for generating a message authentication code (MAC). AAD 1015 may be known to both the sender 810 and the receiver 812. AAD 1015 may include the actual number of bits that are not filled to a complete bit, and the length is up to 32 bits. AAD length 1016 indicates the length of AAD 1015. Additional entropy data 1017 includes a random number generated by the network (i.e., in 5GC 104 or RAN 102) that is used to generate a MAC. Additional entropy data 1017 may be exchanged or shared with UE 106 during the security mode command process. The length of additional entropy data 1017 may be 6 bytes. The encryption / decryption mode 1018 indicates whether the combined algorithm 1000 is used for encryption or decryption. For example, the encryption / decryption mode 1018 may be a 1-bit value of "0" for encryption and a 1-bit value of "1" for decryption.

[0129] At the sender 810, the combined algorithm 1000 calculates a 32-bit MAC 1020 (e.g., MAC-I / NAS-MAC) and / or ciphertext 1022 as output 1004 based on the input parameters 1002. The range of MAC length values ​​allowed in the combined algorithm 1000 is "0" and "4...16". The MAC 1020 is appended to the message when it is sent. For integrity protection, the receiver 812 calculates the expected MAC 1024 (e.g., XMAC-I / XNAS-MAC) on the received message as output 1004 in the same manner as the sender 810 calculates its MAC 1020 on the sent message using the combined algorithm 1000, and verifies the data integrity of the message by comparing the expected MAC 1024 with the received MAC 1020. For encryption protection, the combined algorithm 1000 generates ciphertext 1022 at the sender 810 based on the input parameters 1002. By inputting the encrypted text 1022 into the combined algorithm 1000, the plain text can be recovered at the recipient 812 as decrypted text 1026. One technical advantage is that the combined algorithm 1000 can be used in a security mechanism to replace or supplement individual integrity algorithms and encryption algorithms.

[0130] Fig. 10B The NAS combining algorithm 1050 (NAS NCA) in an illustrative embodiment is shown. The NAS combining algorithm 1050 is Fig. 10A The NAS combination algorithm 1050 is configured to be based on the input parameters 1002 and K NASaead The key is used to generate a NAS-MAC 1052 or an XNAS-MAC 1054 and an encrypted text 1022 or a decrypted text 1026. For the NAS combination algorithm 1050, the count 1011 may include a NAS count. The AAD 1015 may include information or identifiers known to both the AMF 212 and the UE 106. For example, the AAD 1015 may include a 5G temporary mobile subscriber identity (5G-TMSI) 1056, a truncated (i.e., 32-bit) 5G-S-TMSI 1057 (e.g., a truncated AMF set ID, a truncated AMF pointer, and a truncated 5G-TMSI), network slice selection assistance information (S-NSSAI) 1058, etc. The additional entropy data 1017 may include a random number generated by the AMF 212 and exchanged or shared with the UE 106 during the NAS security mode command process. One technical advantage is that the NAS combination algorithm 1050 can be used for NAS security mechanisms to replace or supplement individual integrity algorithms and encryption algorithms.

[0131] Fig. 10CThe AS combination algorithm 1060 (AS NCA) in the illustrative embodiment is shown. The AS combination algorithm 1060 is Fig. 10A The AS combination algorithm 1060 is configured to be based on the input parameters 1002 and K RRCaead Key or K UPaead The key generates MAC-I 1062 or XMAC-I 1064 and the encrypted text 1022 or decrypted text 1026. For the AS combination algorithm 1060, the count 1011 may include a PDCP count. The AAD 1015 may include information or identifiers known to both the gNB 302 and the UE 106. For example, the AAD 1015 may include a radio network temporary identifier (RNTI) 1066, a physical cell identifier (PCI) 1067, a combination of RNTI and PCI, etc. The additional entropy data 1017 may include a random number generated by the gNB 302 and exchanged or shared with the UE 106 during the AS security mode command process. Alternatively, the additional entropy data 1017 may include a random number generated by the AMF 212 and exchanged or shared with the UE 106 during the NAS security mode command process. One technical advantage is that the AS combination algorithm 1060 can be used for RRC or UP security mechanisms to replace or supplement individual integrity algorithms and encryption algorithms.

[0132] In one embodiment, one or more combining algorithms 1000 as described herein may support multiple modes of operation. Fig. 10D1080 is a block diagram of different modes of operation 1080 of the combined algorithm 1000 in an illustrative embodiment. Although the combined algorithm 1000 may be capable of or configured to perform both integrity protection and encryption using a (single) CIE key 1010, the combined algorithm 1000 may be encoded to operate in at least the following modes of operation 1080: an integrity and encryption mode 1081, an integrity mode without encryption 1082, an encryption mode without integrity protection 1083, and a NULL encryption and NULL integrity mode 1084. In the integrity and encryption mode 1081, the combined algorithm 1000 uses the CIE key 1010 to apply both encryption and integrity protection. For example, the combined algorithm 1000 may recursively use encrypted data and non-encrypted data to generate an integrity MAC. In the integrity mode 1082, the combined algorithm 1000 uses the CIE key 1010 to apply integrity protection to plaintext messages, but no encrypted data is sent in the communication. In encryption mode 1083, combined algorithm 1000 applies encryption to plaintext messages using CIE keys 1010, but no MAC is sent in the communication, or if sent, it is ignored by the recipient. In NULL encryption and NULL integrity mode 1084, combined algorithm 1000 applies neither encryption nor integrity protection to the message.

[0133] Depending on the encoding of the combined algorithm 1000, the integrity mode 1082 may include different modes of operation. In one embodiment, the integrity mode 1082 may include ignore encryption and integrity mode 1085, in which the combined algorithm 1000 applies integrity protection and encryption to the plaintext message using the CIE key 1010, but ignores the encrypted data. In one embodiment, the integrity mode 1082 may include NULL encryption and integrity mode 1086, in which the combined algorithm 1000 applies integrity protection and NULL encryption to the plaintext message using the CIE key 1010. Under the NULL encryption setting, the combined algorithm 1000 does not output encrypted data. Although some example modes of operation 1080 are described above, other modes of operation 1080 may also be considered herein. One technical advantage is that the combined algorithm 1000 can be used for different types of protection (e.g., encryption only, integrity protection only, encryption and integrity protection, etc.).

[0134] To maintain the cryptographic isolation principle, the key for the combined algorithm 1000 is different from the individual keys for encryption and integrity protection. Fig.11 An enhanced key hierarchy 1100 of the 5G system 100 in an illustrative embodiment is illustrated. In this embodiment, the keys related to authentication include the following keys: K 701 and CK / IK 702. The key hierarchy 1100 includes the following keys: K AUSF 703, K SEAF 704, KAMF 705, K NASaead 1114, K N3IWF 708, K gNB 709, K RRCaead 1115 and K UPaead 1116. The keys for AUSF 210 in the home network 404 include K AUSF Key 703, which is derived from CK', IK' by the ME of UE 106 and AUSF 210 in the case of EAP-AKA', or derived from CK, IK 702 by the ME and ARPF of UDM 218 in the case of 5G AKA. SEAF Key 704 is obtained by ME and AUSF 210 from K AUSF The anchor key is derived from key 703. The key of AMF 212 in service network 406 is obtained by ME and SEAF 402 from K SEAF Key 704 results in K AMF Key 705. The keys for NAS signalling (i.e., NAS security context) include the keys obtained by the ME and AMF 212 from K AMF Key 705 results in K NASaead Key 1114, which is used to protect NAS signaling between the ME and the gNB 302 using a specific combination algorithm 1000 (e.g., NAS combination algorithm 1050). The key for NG-RAN is obtained by the ME and AMF 212 from K AMF Key 705 results in K gNB Key 709. For the AS security context, the key for RRC signaling includes the key obtained by the ME and gNB 302 from K gNB Key 709 results in K RRCaead Key 1115, which is used to protect the RRC signaling between the ME and the gNB 302 using a specific combination algorithm 1000 (e.g., AS combination algorithm 1060). The key for UP services includes the key obtained by the ME and the gNB 302 from K gNB Key 709 results in K UPaead Key 1116, which is used to protect the UP service between ME and gNB 302 using a specific combination algorithm 1000 (e.g., AS combination algorithm 1060). For non-3GPP access, K N3IWF Key 708 is obtained by ME and AMF 212 from the K AMF Key 705 is derived. Other keys may exist as part of the key hierarchy 1100 of the 5G system 100, which will not be discussed here for the sake of brevity.

[0135] K in the key hierarchy 1100 NASaeadKey 1114, K RRCaead Key 1115 and K UPaead Keys 1116 may be referred to as CIE keys 1010 because they are used to protect communications with the combined (integrity and encryption) algorithm 1000 . Fig.12 1 is a block diagram of an algorithm key derivation function (KDF) 1200 in an illustrative embodiment, which is used to generate or derive a CIE key 1010. The input parameters of the algorithm KDF 1200 and their lengths are concatenated into a string S as follows: S = FC||P0||L0||P1||L1|P2||L2||P3||L3||...||Pn||Ln. FC is used to distinguish different instances of the algorithm. P0...Pn are n+1 input parameter encodings, and L0...Ln are two octet representations of the lengths of the corresponding input parameter encodings P0...Pn. When deriving the CIE key 1010, the following input parameters can be used to form the string S1204 input to the algorithm KDF 1200:

[0136] -fc=0x69,

[0137] -P0 = algorithm type specifier,

[0138] - L0 = length of the algorithm type specifier (i.e., 0x00 0x01),

[0139] - P1 = algorithm identity,

[0140] - L1 = length of the algorithm identity (ie, 0x00 0x01).

[0141] When the CIE key 1010 (i.e., K NASaead When the key 1114 is used, the input key 1206 of the algorithm KDF 1200 is K AMF Key 705. When the CIE key 1010 (i.e., K RRCaead Key 1115 or K UPaead When the key 1116 is used, the input key 1206 of the algorithm KDF 1200 is K gNB Key 709.

[0142] Fig.13A table 1300 of algorithm type specifiers 1302 in an illustrative embodiment is illustrated. For the algorithm KDF 1200 described above, the algorithm type specifier 1302 is "N-NAS-enc-alg" for the NAS encryption algorithm and "N-NAS-int-alg" for the NAS integrity algorithm, as described in 3GPP TS 33.501 Annex A.8 Table A.8-1; and "N-RRC-enc-alg" for the RRC encryption algorithm, "N-RRC-int-alg" for the RRC integrity algorithm, "N-UP-enc-alg" for the UP encryption algorithm, and "N-UP-int-alg" for the UP integrity algorithm. Table 1300 represents an enhancement to Table A.8-1 of Annex A.8 and includes additional algorithm type specifiers 1302 for the combined algorithm 1000. In one embodiment, a NAS algorithm type discriminator 1302-1 (e.g., "N-NAS-AEAD-alg") may be defined for the NAS combining algorithm 1050, an RRC algorithm type discriminator 1302-2 (e.g., "N-RRC-AEAD-alg") may be defined for the AS combining algorithm 1060 for protecting RRC signaling, and a UP algorithm type discriminator 1302-3 (e.g., "N-UP-AEAD-alg") may be defined for the AS combining algorithm 1060 for protecting UP traffic. In this embodiment, the value 1304 of the NAS algorithm type discriminator 1302-1 may be "0x07", the value 1304 of the RRC algorithm type discriminator 1302-2 may be "0x08", and the value 1304 of the UP algorithm type discriminator 1302-3 may be "0x09", although other values ​​are also contemplated herein. One technical advantage is that the new algorithm type discriminator 1302 allows a new CIE key 1010 (i.e., K ) to be derived for the combining algorithm 1000. NASaead Key 1114, K RRCaead Key 1115 and K UPaead Key 1116).

[0143] The enhanced security mechanisms are described in more detail below. Typically, these mechanisms are implemented via one or more 5G network functions (e.g., AMF 212), one or more RAN nodes (e.g., gNB 302), and UE 106. A block diagram of these elements is provided below.

[0144] Fig.1414 is a block diagram of a UE 106 in an illustrative embodiment. From a functional perspective, the UE 106 consists of at least two parts: a mobile equipment (ME) 1400 and a universal subscriber identity module (USIM) 1460. The ME 1400 includes a radio interface component 1402, one or more processors 1404, a memory 1406, and a user interface component 1408. The UE 106 may also include a battery 1410. The radio interface component 1402 is a hardware component or component representing the local radio resources of the UE 106, such as a radio frequency (RF) unit 1420 (e.g., one or more radio transceivers) and one or more antennas 1422. The radio interface component 1402 may be configured for 5G New Radio (NR), Long Term Evolution (LTE), WiFi, Bluetooth, etc. The processor 1404 represents the internal circuit system, logic, hardware, components, etc. that provide the functions of the UE 106. The processor 1404 may be configured to execute instructions 1440 of the software loaded into the memory 1406. Processor 1404 can execute an operating system (OS) 1434 of UE 106 for managing hardware and software resources, and one or more application clients 1435. Processor 1404 can also execute a security controller 1436, which includes components or parts for executing security mechanisms within UE 106 (i.e., within ME 1400). User interface component 1408 is a hardware component for interacting with an end user. For example, user interface component 1408 may include a display 1450, a screen, a touch screen, etc. (e.g., a liquid crystal display (LCD), a light emitting diode (LED) display, etc.). User interface component 1408 may include a keyboard or keypad, a tracking device (e.g., a trackball or trackpad), a speaker, a microphone, etc.

[0145] The USIM 1460 is an integrated circuit that provides security and integrity functions for the UE 106. The USIM 1460 includes or is provisioned with a subscription profile associated with a subscriber's subscription. The subscription profile may include various information, such as subscription credentials (e.g., SUPI) used to uniquely identify the subscription and mutually authenticate the UE 106 and the network.

[0146] UE 106 may include Fig.14 Various other components not specifically shown.

[0147] Fig.151504 is a block diagram of the AMF 212 in an illustrative embodiment. The AMF 212 is a network element or network function configured to provide registration management for a UE. In this embodiment, the AMF 212 includes the following subsystems: a network interface component 1502, and an access and mobility controller 1504 operating on one or more platforms. The network interface component 1502 may include circuit systems, logic, hardware, components, etc. configured to exchange control plane messages or signaling with other network elements and / or UEs. The network interface component 1502 may operate using various protocols or reference points. The access and mobility controller 1504 may include circuit systems, logic, hardware, components, etc. configured to support the operations, processes, or functions of the AMF.

[0148] One or more of the subsystems of AMF 212 may be implemented on a hardware platform comprised of analog and / or digital circuitry. One or more of the subsystems of AMF 212 may be implemented on one or more processors 1530 that execute instructions 1534 (i.e., computer readable code) of software loaded into memory 1532. One or more of the subsystems of AMF 212 may be implemented on a cloud computing platform or another type of processing platform.

[0149] The AMF 212 may include Fig.15 Various other components not specifically shown.

[0150] Fig.16 1 is a block diagram of a RAN node 1600 in an illustrative embodiment. The RAN node 1600 includes servers, devices, apparatuses, equipment (including hardware), systems, network elements, components, etc. of the RAN 102 (or NG-RAN) that provide connectivity between the UE 106 and the 5GC 104. In this embodiment, the RAN node 1600 includes the following subsystems: a radio interface component 1602, a network interface component 1604, and a node controller 1606 operating on one or more platforms. The radio interface component 1602 may include circuit systems, logic, hardware, components, etc. configured to exchange messages or signaling with the UE via an air interface. The radio interface component 1602 may be configured for 5G NR, LTE, WiFi, Bluetooth, etc. The network interface component 1604 may include circuit systems, logic, hardware, components, etc. configured to exchange messages or signaling with other network elements or network functions (such as 5GC 104). The network interface component 1604 may operate using various protocols or reference points. The node controller 1606 may include circuit systems, logic, hardware, components, etc. configured to support operations or processes performed in the RAN node 1600 of the 5G system 100. Fig.16As shown, the RAN node 1600 may represent a gNB 302, a component of a gNB 302 (e.g., a centralized unit (CU), a distributed unit (DU), and / or a radio unit (RU)), or another type of base station or an NG base station.

[0151] One or more of the subsystems of the RAN node 1600 may be implemented on a hardware platform consisting of analog and / or digital circuit systems. One or more of the subsystems of the RAN node 1600 may be implemented on one or more processors 1630 that execute instructions 1634 (i.e., computer readable code) of software loaded into the memory 1632. The processor 1630 includes an integrated hardware circuit configured to execute instructions 1634 to provide the functionality of the RAN node 1600. The processor 1630 may include one or more processor sets, or may include a multi-processor core, depending on the specific implementation. The memory 1632 is a non-transitory computer-readable storage medium for data, instructions, applications, etc., and is accessible by the processor 1630. The memory 1632 is a hardware storage device capable of temporarily and / or permanently storing information. The memory 1632 may include a random access memory, or any other volatile or non-volatile storage device.

[0152] The RAN node 1600 may include Fig.16 Various other components not specifically shown.

[0153] Fig.17The NAS function layer 1702 and the AS function layer 1704 of the 5G system 100 in an illustrative embodiment are illustrated. The UE 106 is operably coupled to the 5G network 101. In general, communication 1710 (also referred to as 5G communication) may occur between the UE 106 and the 5G network 101, and the communication 1710 may be protected via the combined algorithm 1000 as described above. The NAS function layer 1702 is located between the UE 106 and the AMF 212 (or mobility management entity (MME)), and thus, NAS signaling 1712 may be exchanged between the UE 106 and the AMF 212. The AS function layer 1704 is located between the UE 106 and the RAN node 1600 (e.g., gNB 302), and thus, RRC signaling 1714 and UP traffic 1716 may be exchanged between the UE 106 and the RAN node 1600. In communication 1710, messages 1720 may be sent from UE 106 to 5G network 101, and vice versa. For example, messages 1720 may include NAS messages 1722 (e.g., NAS signaling messages), RRC messages 1724 (e.g., RRC signaling messages), and UP messages 1726 (e.g., IP packets), etc. Messages 1720 sent by sender 810 may be referred to as "sent" messages, and messages 1720 received by receiver 812 may be referred to as "received" messages. Similar language applies to signaling, user plane data, etc.

[0154] Figure 18A-18E 1 is a flow chart of a method for performing a security mechanism in a 5G system 100 in an illustrative embodiment. Figures 18A-18E The steps of the method in the flowchart described herein are not all-inclusive and may include other steps not shown, and these steps may be performed in an alternative order.

[0155] Fig.18A 1 is a flow chart illustrating a method 1800 for performing a security mechanism on a message 1720 or communication 1710 exchanged between a UE 106 and a 5G network 101 (e.g., an AMF 212 or a RAN node 1600). For the security mechanism, the UE 106 and the 5G network 101 identify a combined algorithm 1000 (step 1802) to protect the message 1720. The UE 106 and the 5G network 101 derive a CIE key 1010 for the combined algorithm 1000 (step 1804). For example, Fig.12As shown (optional step 1812), the UE 106 and the 5G network 101 can use the algorithm KDF 1200 to derive the CIE key 1010. When operating as the sender 810 of the message 1720, the UE 106 or the 5G network 101 uses the CIE key 1010 as an input parameter 1002 to apply the combined algorithm 1000 to the message 1720 (i.e., the message sent) to provide security protection to the message 1720 (step 1806). For example, the sender 810 can use the combined algorithm 1000 to apply integrity protection, encryption, or both. In one embodiment, the combined algorithm 1000 can support multiple operating modes 1080 as described above. Thus, the UE 106 and the 5G network 101 can identify the operating mode 1080 of the combined algorithm 1000 for security protection of the message 1720 (step 1810), and the sender 810 can apply integrity protection, encryption, or both using the combined algorithm 1000 based on the operating mode 1080 selected for the message 1720 (step 1814).

[0156] When operating as a receiver 812 of the message 1720, the UE 106 or 5G network 101 applies the combined algorithm 1000 to the message 1720 (i.e., the received message) using the CIE key 1010 as an input parameter 1002 (step 1808). The receiver 812 applies the combined algorithm 1000 to decrypt the message 1720 and / or verify the integrity of the message 1720, depending on the type of security protection applied by the sender 810. One technical advantage is that the security of the message 1720 is improved using the combined algorithm 1000 configured to perform both integrity protection and encryption.

[0157] Fig.18B 18 is a flow chart illustrating a method 1820 of performing integrity protection of a message 1720. Fig. 10AAs shown, the input parameters 1002 of the combined algorithm 1000 include AAD 1015 and additional entropy data 1017. AAD 1015 and additional entropy data 1017 are used to generate MAC 1020 or XMAC 1024 for integrity protection. Therefore, UE 106 and 5G network 101 identify AAD 1015 (step 1822) and / or additional entropy data 1017 (step 1824). As described above, both UE 106 and 5G network 101 may know AAD 1015, and additional entropy data 1017 may be shared between 5G network 101 and UE 106 during the security mode command process (optional step 1828). UE 106 and 5G network 101 use AAD 1015 and / or additional entropy data 1017 as input parameters 1002 to apply the combined algorithm 1000 to generate MAC 1020 or XMAC 1024 (step 1826). One technical advantage is that the AAD 1015 and / or additional entropy data 1017 make the derivation of the MAC more robust.

[0158] Fig.18C 1840 is a flow chart illustrating a method 1840 for performing a NAS security mechanism on NAS signaling 1712 (e.g., NAS message 1722) exchanged between a UE 106 and an AMF 212. For the NAS security mechanism, the UE 106 and the AMF 212 identify a NAS combining algorithm 1050 (step 1842) to protect the NAS signaling 1712. The UE 106 and the AMF 212 derive a NASCIE key 1010 (e.g., K NASaead Key 1114) (step 1844). When operating as a sender 810 of the NAS signaling 1712, the UE 106 or AMF 212 applies the NAS combining algorithm 1050 to the NAS signaling 1712 (i.e., the sent NAS signaling) using the NAS CIE key 1010 as an input parameter 1002 to provide security protection to the NAS signaling 1712 (step 1846). For example, the sender 810 can apply integrity protection, encryption, or both using the NAS combining algorithm 1050. In one embodiment, the NAS combining algorithm 1050 can support multiple operating modes 1080 as described above. Thus, the UE 106 and the AMF 212 may identify an operating mode 1080 of the NAS combining algorithm 1050 for securing the NAS signaling 1712 (step 1850), and the sender 810 may apply integrity protection, encryption, or both using the NAS combining algorithm 1050 based on the operating mode 1080 selected for the NAS signaling 1712 (step 1852).

[0159] Typically, the NAS Security Mode Command and NAS Security Mode Complete messages are integrity protected but not encrypted. Therefore, if the NAS signaling 1712 includes a NAS Security Mode Command or a NAS Security Mode Complete message, the sender 810 may apply integrity protection (e.g., integrity mode 1082) without encryption. After the NAS Security Mode Command procedure, the NAS signaling 1712 may be integrity protected and encrypted. Therefore, the sender 810 may apply integrity protection and encryption (e.g., integrity and encryption mode 1081) to the NAS signaling 1712 that follows the NAS Security Mode Command procedure.

[0160] When operating as a receiver 812 of NAS signaling 1712, the UE 106 or AMF 212 applies a NAS combining algorithm 1050 to the NAS signaling 1712 (i.e., received NAS signaling) using the NAS CIE key 1010 as an input parameter 1002 (step 1848). The receiver 812 applies the NAS combining algorithm 1050 to decrypt the NAS signaling 1712 and / or verify the integrity of the NAS signaling 1712, depending on the type of security protection applied by the sender 810. One technical advantage is that NAS security procedures are improved using a NAS combining algorithm 1050 that is configured to perform both integrity protection and encryption.

[0161] Fig.18D 1860 is a flow chart illustrating a method 1860 for performing an RRC security mechanism on RRC signaling 1714 exchanged between a UE 106 and a gNB 302. For the RRC security mechanism, the UE 106 and the gNB 302 identify an AS combination algorithm 1060 (step 1862) to protect the RRC signaling 1714. The UE 106 and the gNB 302 derive an RRC CIE key 1010 (e.g., K RRCaeadKey 1115) (step 1864). When operating as a sender 810 of RRC signaling 1714, the UE 106 or gNB 302 applies the AS combining algorithm 1060 to the RRC signaling 1714 (i.e., the transmitted RRC signaling) using the RRC CIE key 1010 as an input parameter 1002 to provide security protection to the RRC signaling 1714 (step 1866). For example, the sender 810 can apply integrity protection, encryption, or both using the AS combining algorithm 1060. In one embodiment, the AS combining algorithm 1060 can support multiple operating modes 1080 as described above. Thus, the UE 106 and the gNB 302 may identify an operating mode 1080 of the AS combining algorithm 1060 for security protection of the RRC signaling 1714 (step 1870), and the sender 810 may apply integrity protection, encryption, or both using the AS combining algorithm 1060 based on the operating mode 1080 selected for the RRC signaling 1714 (step 1872).

[0162] Typically, the AS security mode command and the AS security mode complete message are integrity protected but not encrypted. Therefore, if the RRC signaling 1714 includes the AS security mode command or the AS security mode complete message, the sender 810 can apply integrity protection (e.g., integrity mode 1082) without encryption. After the AS security mode command process, the RRC signaling 1714 can be integrity protected and encrypted. Therefore, the sender 810 can apply integrity protection and encryption (e.g., integrity and encryption mode 1081) to the RRC signaling 1714 that follows the AS security mode command process.

[0163] When operating as a receiver 812 of RRC signaling 1714, the UE 106 or gNB 302 applies the AS combining algorithm 1060 to the RRC signaling 1714 (i.e., received RRC signaling) using the RRC CIE key 1010 as an input parameter 1002 (step 1868). The receiver 812 applies the AS combining algorithm 1060 to decrypt the RRC signaling 1714 and / or verify the integrity of the RRC signaling 1714, depending on the type of security protection applied by the sender 810. One technical advantage is that RRC security procedures are improved using the AS combining algorithm 1060 configured to perform integrity protection and encryption.

[0164] Fig.18E18 is a flow chart illustrating a method 1880 for performing a UP security mechanism on UP traffic 1716 exchanged between a UE 106 and a gNB 302. For the UP security mechanism, the UE 106 and the gNB 302 identify an AS combination algorithm 1060 (step 1882) to protect the UP traffic 1716. The UE 106 and the gNB 302 derive a UP CIE key 1010 (e.g., K UPaead Key 1116) (step 1884). When operating as a sender 810 of UP traffic 1716, the UE 106 or gNB 302 applies the AS combining algorithm 1060 to the UP traffic 1716 using the UP CIE key 1010 as an input parameter 1002 to provide security protection for the UP traffic 1716 (step 1886). For example, the sender 810 may utilize the AS combining algorithm 1060 to apply integrity protection, encryption, or both. In one embodiment, the AS combining algorithm 1060 may support multiple operating modes 1080 as described above. Therefore, the UE 106 and the gNB 302 may identify the operating mode 1080 of the AS combining algorithm 1060 for security protection of the UP traffic 1716 (step 1890), and the sender 810 may utilize the AS combining algorithm 1060 to apply integrity protection, encryption, or both based on the operating mode 1080 selected for the UP traffic 1716 (step 1892).

[0165] Typically, integrity protection and encryption are optional for UP traffic 1716. However, if security protection is applied, the sender 810 may apply encryption (and possibly integrity protection) to the UP traffic 1716.

[0166] When operating as a receiver 812 of UP traffic 1716, the UE 106 or gNB 302 applies the AS combining algorithm 1060 to the UP traffic 1716 (i.e., received UP traffic) using the UP CIE key 1010 as an input parameter 1002 (step 1888). The receiver 812 applies the AS combining algorithm 1060 to decrypt the UP traffic 1716 and / or verify the integrity of the UP traffic 1716, depending on the type of security protection applied by the sender 810. One technical advantage is that UP security procedures are improved using the AS combining algorithm 1060 configured to perform integrity protection and encryption.

[0167] Prior to using the combined algorithm 1000 to protect the message 1720 or the communication 1710 as described above, a negotiation is performed between the UE 106 and the 5G network 101 to provide for the use of the combined algorithm 1000. Fig.19The NAS function layer 1702 and the AS function layer 1704 in the 5G system 100 in the illustrative embodiment are illustrated. In the NAS function layer 1702, a NAS signaling connection 1912 is established between the UE 106 and the 5G network 101 (e.g., AMF 212). In the AS function layer 1704, an RRC signaling connection is established between the UE 106 and the RAN node 1600 (e.g., gNB 302) via one or more SRBs 1913, and a UP connection is established via one or more DRBs 1914.

[0168] Figure 20A-20B is a flow diagram of a method 2000 of negotiating a security mechanism in an illustrative embodiment. Fig.21 is a signaling diagram illustrating the negotiation of a security mechanism in an illustrative embodiment. Fig. 20A In the example, the 5G network 101 identifies the security capabilities of the UE 106 in supporting one or more combined algorithms 1000 (step 2002). In one embodiment, the 5G network 101 may receive a NAS message 2111 from the UE 106 (see Fig.21 ) (optional step 2010), the NAS message indicates the combined algorithm(s) 1000 supported by the UE 106, such as by using the UE security capability indicator 2101 included in the NAS message 21111. Fig. 20A , the 5G network 101 selects a combination algorithm 1000 from one or more combination algorithms 1000 supported by the UE 106 (step 2004). For example, the 5G network 101 may be configured with a list of combination algorithms 1000 allowed for use via network management, and the combination algorithms may be sorted according to a priority determined by the operator. Therefore, the 5G network 101 may select a combination algorithm 1000 from the list based on the capabilities of the UE 106. The 5G network 101 sends a security negotiation message indicating the selected combination algorithm 1000 to the UE 106 (step 2006). Fig.21 As shown, the 5G network 101 sends a security negotiation message 2112 to the UE 106. The security negotiation message 2112 is a type of signaling message that includes one or more security parameters. For example, the security negotiation message 2112 may include a security mode command message. The 5G network 101 may apply integrity protection (without encryption) to the security negotiation message 2112 before sending it to the UE 106. One technical advantage is that the selected combined algorithm 1000 is shared with the UE 106 during the security negotiation process.

[0169] In one embodiment, the 5G network 101 may activate the combined algorithm 1000 (step 2008) after sending the security negotiation message 2112, such as Fig.21However, the 5G network 101 may activate the combined algorithm 1000 before sending the security negotiation message 2112, such as to apply integrity protection (without encryption) to the security negotiation message 2112. In another example, the 5G network 101 may activate the combined algorithm 1000 after receiving the security negotiation complete message 2113 from the UE 106.

[0170] In one embodiment, when the combined algorithm 1000 supports multiple (or multiple) operating modes 1080, the 5G network 101 can select the operating mode 1080 for the combined algorithm 1000 from the operating modes 1080 (optional step 2012). Therefore, the 5G network 101 can send a security negotiation message 2112 indicating the selected combined algorithm 1000 and the selected operating mode 1080 for the combined algorithm 1000 to the UE 106 (optional step 2018). One technical advantage is that the operating mode 1080 of the selected combined algorithm 1000 is shared with the UE 106 during the security negotiation process.

[0171] In one embodiment, the input parameters 1002 of the combined algorithm 1000 selected by the 5G network 101 may include the AAD 1015 and / or the additional entropy data 1017 for generating the MAC 1020 or the XMAC 1024 for integrity protection. Therefore, the 5G network 101 may identify the AAD 1015 (optional step 2014) and / or the additional entropy data 1017 (optional step 2016). Therefore, the 5G network 101 may send a security negotiation message 2112 including the AAD 1015 and / or the additional entropy data 1017 to the UE 106 (optional step 2020). One technical advantage is that the AAD 1015 and / or the additional entropy data 1017 may be shared with the UE 106 during the security negotiation process.

[0172] exist Fig. 20B , UE 106 receives a security negotiation message 2112 indicating the selected combined algorithm 1000 from 5G network 101 (step 2022). When security negotiation message 2112 is integrity protected, UE 106 verifies the integrity of security negotiation message 2112. For example, UE 106 may calculate a MAC based on security negotiation message 2112 and compare the calculated MAC with the MAC received in security negotiation message 2112. UE 106 activates the combined algorithm 1000 indicated in security negotiation message 2112 to protect communication 1710 (step 2024). In other words, UE 106 activates the combined algorithm 1000 selected by 5G network 101 to protect subsequent or future communications with 5G network 101, such as integrity protection, encryption, or both. UE 106 may also send a security negotiation completion message 2113 to 5G network 101 (see Fig.21 ).

[0173] In one embodiment, when the UE 106 receives the operating mode 1080 in the security negotiation message 2112, the UE 106 activates the combined algorithm 1000 using the selected operating mode 1080 (optional step 2026). In other words, the UE 106 activates the combined algorithm 1000 to perform integrity protection, encryption, or both based on the selected operating mode 1080. In one embodiment, when the UE 106 receives the AAD 1015 and / or the additional entropy data 1017 in the security negotiation message 2112, the UE 106 may extract the AAD 1015 (optional step 2028) and / or the additional entropy data 1017 (optional step 2030) from the security negotiation message 2112. The UE 106 stores the AAD 1015 and the additional entropy data 1017 and may use the AAD 1015 and / or the additional entropy data 1017 as input parameters 1002 of the selected combined algorithm 1000 to generate a MAC.

[0174] One technical advantage of method 2000 is that the 5G network 101 is able to share the selected combined algorithm 1000 and other information (e.g., operating mode 1080, AAD 1015, additional entropy data 1017, etc.) with the UE 106 when negotiating security parameters.

[0175] Figure 22A-22B is a flow diagram illustrating a method 2200 of negotiating a NAS security mechanism in an illustrative embodiment. Fig.23 is a signaling diagram of a NAS security procedure between a UE 106 and an AMF 212 of a 5G network 101 in an illustrative embodiment. Fig.22A In the example of FIG. 220 , the AMF 212 of the 5G network 101 identifies the security capabilities of the UE 106 in supporting one or more NAS combining algorithms 1050 (step 2202). In one embodiment, the AMF 212 may receive a NAS message 2311 from the UE 106 indicating the NAS combining algorithm(s) 1050 supported by the UE 106 (see FIG. 231 ). Fig.23 ) (optional step 2210), such as using the UE security capability indicator 2101 contained in the NAS message 2311. The NAS message 2311 may include the following: Figure 4A The AMF 212 sends a NAS security mode command message indicating the selected NAS combination algorithm 1050 to the UE 106 (step 2206). Fig.23As shown, the AMF 212 sends a NAS security mode command message 2312 to the UE 106. The AMF 212 may apply integrity protection (no encryption) to the NAS security mode command message 2312 before sending it to the UE 106. One technical advantage is that the selected NAS combining algorithm 1050 is shared with the UE 106 during the NAS security mode command procedure.

[0176] In one embodiment, the AMF 212 may activate the NAS combining algorithm 1050 (step 2208) after sending the NAS security mode command message 2312, such as Fig.23 However, the AMF 212 may activate the NAS combining algorithm 1050 before sending the NAS security mode command message 2312, such as to apply integrity protection (without encryption) to the NAS security mode command message 2312. In another example, the AMF 212 may activate the NAS combining algorithm 1050 after receiving the NAS security mode complete message 2313 from the UE 106.

[0177] In one embodiment, when the NAS combining algorithm 1050 supports multiple operation modes 1080, the AMF 212 may select the operation mode 1080 for the NAS combining algorithm 1050 from the operation modes 1080 (optional step 2212). Accordingly, the AMF 212 may send a NAS security mode command message 2312 indicating the selected NAS combining algorithm 1050 and the selected operation mode 1080 to the UE 106 (optional step 2218). One technical advantage is that the operation mode 1080 of the selected NAS combining algorithm 1050 is shared with the UE 106 in the NAS security mode command procedure.

[0178] In one embodiment, the input parameters 1002 of the NAS combining algorithm 1050 may include the AAD 1015 and / or the additional entropy data 1017 for generating the NAS-MAC 1052 or the XNAS-MAC 1054 for integrity protection. Therefore, the AMF 212 may identify the AAD 1015 (optional step 2214) and / or the additional entropy data 1017 (optional step 2212). Therefore, the AMF 212 may send a NAS security mode command message 2312 containing the AAD 1015 and / or the additional entropy data 1017 to the UE 106 (optional step 2220). Examples of the AAD 1015 may include the 5G-TMSI 1056, the truncated 5G-S-TMSI 1057, the S-NSSAI 1058, etc. The additional entropy data 1017 may include a random number generated by the AMF 212. One technical advantage is that the AAD 1015 and / or the additional entropy data 1017 are shared with the UE 106 during the NAS security mode command procedure.

[0179] exist Fig. 22B , the UE 106 receives a NAS security mode command message 2312 indicating the selected NAS combining algorithm 1050 from the AMF 212 (step 2222). When the NAS security mode command message 2312 is integrity protected, the UE 106 verifies the integrity of the NAS security mode command message 2312. The UE 106 activates the NAS combining algorithm 1050 indicated in the NAS security mode command message 2312 to protect the NAS signaling 1712 (step 2224). In other words, the UE 106 activates the NAS combining algorithm 1050 selected by the AMF 212 to protect subsequent or future NAS signaling 1712, such as integrity protection, ciphering, or both. The UE 106 also sends a NAS security mode complete message 2313 to the AMF 212 (see Fig.23 ).

[0180] In one embodiment, when the UE 106 receives the operating mode 1080 in the NAS security mode command message 2312, the UE 106 activates the NAS combining algorithm 1050 to protect the NAS signaling 1712 using the selected operating mode 1080 (optional step 2226). In other words, the UE 106 activates the NAS combining algorithm 1050 to perform integrity protection, ciphering, or both based on the selected operating mode 1080. In one embodiment, when the UE 106 receives the AAD 1015 and / or the additional entropy data 1017 in the NAS security mode command message 2312, the UE 106 may extract the AAD 1015 (optional step 2228) and / or the additional entropy data 1017 from the NAS security mode command message 2312 (optional step 2230). The UE 106 stores the AAD 1015 and the additional entropy data 1017 and may use the AAD 1015 and / or the additional entropy data 1017 as input parameters 1002 of the selected NAS combining algorithm 1050 to generate a NAS-MAC 1052 or an XNAS-MAC 1054 .

[0181] One technical advantage of method 2200 is that the AMF 212 is able to share the selected NAS combining algorithm 1050 and other information (e.g., operating mode 1080, AAD 1015, additional entropy data 1017, etc.) with the UE 106 during the NAS security mode command process.

[0182] In one embodiment, the NAS Security Mode Command procedure may be extended to indicate the selected NAS combined algorithm 1050. As shown in 3GPP TS24.501 Section 8.2.25, the message content of the NAS Security Mode Command includes a "Selected NAS Security Algorithm" Information Element (IE) of data type "NAS Security Algorithm". The Selected NAS Security Algorithm IE is used in the NAS Security Mode Command to indicate the 5G algorithm to be used for encryption and integrity protection. In the embodiments described herein, the NAS Security Algorithm IE may be extended to include one or more NAS combined algorithms 1050. Fig.24 2 is a block diagram illustrating a NAS security algorithm IE 2402 as described in Section 9.11.3.34 of 3GPP TS 24.501. The NAS security algorithm IE 2402 includes a NAS security algorithm IE identifier (IEI) 2404 (in octet 1), a type of encryption algorithm parameter 2406, and a type of integrity algorithm parameter 2408 (in octet 2). The NAS security algorithm IE 2402 is encoded based on the information defined in 3GPP TS 24.501 Table 9.11.3.34.1. Fig.2525 is a block diagram of an extension of the encoding 2500 for the NAS security algorithm IE 2402 in an illustrative embodiment. In this embodiment, one or more NAS combination algorithms 1050 are defined for the NAS security algorithm IE 2402. For example, a value of "1000" is defined for the "5G-C00" NAS combination algorithm 1050, a value of "1001" is defined for the "256-5G-CA1" NAS combination algorithm 1050, a value of "1010" is defined for the "256-5G-CA2" NAS combination algorithm 1050, and a value of "1011" is defined for the "256-5G-CA3" NAS combination algorithm 1050. These values ​​and specific NAS combination algorithms 1050 are provided as examples, and other values ​​and algorithms are contemplated herein. One technical advantage is that the NAS security mode command message 2312 can indicate the NAS combination algorithm 1050 of the NAS security context.

[0183] As described above, one or both of the AAD 1015 and the additional entropy data 1017 may be shared with the UE 106 during the NAS security mode command procedure. Thus, the NAS security mode command message 2312 may be extended to include the AAD 1015 and / or the additional entropy data 1017. Fig.26 2600 is a block diagram illustrating the NAS security mode command message content 2600 in an illustrative embodiment. Fig.26 The NAS security mode command message content 2600 shown represents an extension to Table 8.2.25.1.1 of 3GPP TS 24.501. In this embodiment, the NAS security mode command message content 2600 also includes one or more additional combined algorithm security information IEs 2601-2602. The purpose of the additional combined algorithm security information IEs 2601-2602 is to provide additional security parameters to the UE 106. One of the additional combined algorithm security information IEs 2601 labeled "Additional 5G AEAD security information (plain text)" is of the "Additional 5G AERD security information" type, although the name can be changed as needed. Fig. 27 2700 in an illustrative embodiment. The additional 5G AEAD security information IE 2700 includes an additional 5G AEAD security information IEI 2702, a length 2704 of the additional 5G AEAD security information content, additional entropy data 1017 (i.e., additional IV), a length 2708 of the AAD, and the AAD 1015.

[0184] The purpose of the Additional 5G AEAD Security Information IE 2700 is to provide additional security parameters (e.g., additional IV and AAD) to the UE 106 during the security mode command process. The UE 106 uses these additional security parameters to complete the security mode process. Fig.28 As shown, the additional 5G AEAD security information IE 2700 is encoded. Fig.28 The encoding for the Additional 5G AERD Security Information IE 2800 in an illustrative embodiment is illustrated. One technical advantage is that the NAS Security Mode Command message 2312 can include additional security information for a NAS security context.

[0185] As described above, the NAS combining algorithm 1050 selected by the AMF 212 may support a plurality of operation modes 1080, and the AMF 212 may select an operation mode 1080 for the selected NAS combining algorithm 1050 from the operation modes 1080 (see Fig.22A In one embodiment, the NAS security mode command message 2312 may be extended to include an operating mode indicator. Fig.26 As shown, the NAS security mode command message content 2600 may also include an operation mode indicator IE 2603. The purpose of the operation mode indicator IE 2603 is to provide the UE 106 with the operation mode 1080 for the NAS combined algorithm 1050 selected by the AMF 212. The operation mode indicator IE 2603 may have a desired data type. The operation mode indicator IE 2603 may include an IE type identifier and a 4-bit value field to indicate the operation mode 1080. One technical advantage is that the NAS security mode command message 2312 can indicate the operation mode 1080 selected for the NAS combined algorithm 1050.

[0186] Figure 29A-29B 2900 is a flowchart of method 2900 for executing an RRC security mechanism in an illustrative embodiment to establish RRC security between UE 106 and gNB 302 in a 5G network 101. Fig.30 is a signaling diagram of the RRC security procedure between UE 106 and gNB 302 in an illustrative embodiment. Fig.29A In the embodiment, the gNB 302 of the 5G network 101 identifies the security capabilities of the UE 106 in supporting one or more AS combination algorithms 1060 (step 2902). In one embodiment, the gNB 302 may receive an NGAP initial context setup message 513 from the AMF 212 indicating the (multiple) AS combination algorithms 1060 supported by the UE 106 (see Figure 5) (optional step 2910). gNB 302 selects an AS combination algorithm 1060 from one or more AS combination algorithms 1060 supported by UE 106 (step 2904). gNB 302 sends an AS security mode command message 3011 indicating the selected AS combination algorithm 1060 to UE 106 (see Fig.30 )(Step 2906). Fig.30 As shown, the AMF 212 sends an AS security mode command message 3011 to the UE 106. The gNB 302 may apply integrity protection (without encryption) to the AS security mode command message 3011 before sending it to the UE 106. One technical advantage is that the selected AS combining algorithm 1060 is shared with the UE 106 during the AS security mode command process.

[0187] In one embodiment, gNB 302 may activate AS combination algorithm 1060 (step 2908) after sending AS security mode command message 3011, such as Fig.30 However, the gNB 302 may activate the AS combining algorithm 1060 before sending the AS security mode command message 3011, such as to apply integrity protection (without encryption) to the AS security mode command message 3011. In another example, the gNB 302 may activate the AS combining algorithm 1060 after receiving the AS security mode complete message 3012 from the UE 106.

[0188] In one embodiment, when the AS combining algorithm 1060 supports multiple operation modes 1080, the gNB 302 may select the operation mode 1080 for the AS combining algorithm 1060 from the operation modes 1080 (optional step 2912). Therefore, the gNB 302 may send an AS security mode command message 3011 indicating the selected AS combining algorithm 1060 and the selected operation mode 1080 to the UE 106 (optional step 2918). One technical advantage is that the operation mode 1080 of the selected AS combining algorithm 1060 is shared with the UE 106 in the AS security mode command process.

[0189] In one embodiment, the input parameters 1002 of the AS combining algorithm 1060 may include the AAD 1015 and / or the additional entropy data 1017 for generating a MAC-I 1062 or an XMAC-I 1064 for integrity protection. Accordingly, the gNB 302 may identify the AAD 1015 (optional step 2914) and / or the additional entropy data 1017 (optional step 2916). Accordingly, the gNB 302 may send an AS security mode command message 3011 including the AAD 1015 and / or the additional entropy data 1017 to the UE 106 (optional step 2920). Examples of the AAD 1015 may include the RNTI 1066, the PCI 1067, a combination of the RNTI and the PCI, etc. The additional entropy data 1017 may include a random number generated by the gNB 302. One technical advantage is that the AAD 1015 and / or the additional entropy data 1017 are shared with the UE 106 during the AS security mode command process.

[0190] exist Fig.29B , UE 106 receives an AS security mode command message 3011 indicating the selected AS combining algorithm 1060 from gNB 302 (step 2922). When the AS security mode command message 3011 is integrity protected, UE 106 verifies the integrity of the AS security mode command message 3011. UE 106 activates the AS combining algorithm 1060 indicated in the AS security mode command message 3011 to protect RRC signaling 1714 (step 2924). In other words, UE 106 activates the AS combining algorithm 1060 selected by gNB 302 to protect subsequent or future RRC signaling 1714, such as integrity protection, encryption, or both. UE 106 also sends an AS security mode complete message 3012 to gNB 302 (see Fig.30 ).

[0191] In one embodiment, when the UE 106 receives the operating mode 1080 in the AS security mode command message 3011, the UE 106 activates the AS combination algorithm 1060 using the selected operating mode 1080 to protect the RRC signaling 1714 (optional step 2926). In other words, the UE 106 activates the AS combination algorithm 1060 to perform integrity protection, encryption, or both based on the selected operating mode 1080. In one embodiment, when the UE 106 receives the AAD 1015 and / or the additional entropy data 1017 in the AS security mode command message 3011, the UE 106 can extract the AAD 1015 (optional step 2928) and / or the additional entropy data 1017 (optional step 2930) from the AS security mode command message 3011. The UE 106 stores the AAD 1015 and the additional entropy data 1017 and may use the AAD 1015 and the additional entropy data 1017 as input parameters 1002 to the selected AS combining algorithm 1060 to generate a MAC-I 1062 or an XMAC-I 1064 .

[0192] One technical advantage of method 2900 is that the gNB 302 is able to share the selected AS combining algorithm 1060 and other information (e.g., operating mode 1080, AAD 1015, additional entropy data 1017, etc.) with the UE 106 during the AS security mode command process.

[0193] In one embodiment, the AS security mode command procedure may be extended to indicate at least one of the selected AS combination algorithm 1060, AAD 1015, additional entropy data 1017, and operation mode 1080. Section 6.2 of 3GPP TS 38.331 (v17.5.0) specifies the message structure and message definitions of RRC messages, which is incorporated herein by reference as if fully included herein. Fig.31 The message content 3100 of the AS security mode command message 3011 as shown in Section 6.2.2 of 3GPP TS 38.331 is illustrated. In particular, the AS security mode command message 3011 includes a security algorithm configuration IE 3102 for configuring the AS integrity protection algorithm and the AS encryption algorithm for radio bearers (i.e., SRBs and DRBs). An extension to the security algorithm configuration IE 3102 defined in Section 6.3.2 of 3GPP TS 38.331 is described herein. Fig.32The security algorithm configuration IE 3102 in an illustrative embodiment is illustrated. In one embodiment, one or more of the following new fields are defined for the security algorithm configuration IE 3102: a combined algorithm field 3202 (i.e., “combinedAlgorithm”), an additional entropy data field 3203 (i.e., “extra_iv”), an AAD field 3204 (i.e., “aad”), and an operating mode field 3205 (i.e., “operatingMode”). The combined algorithm field 3202 indicates the AS combining algorithm 1060 used for SRB and / or DRB. The additional entropy data field 3203 indicates additional entropy data 1017 (e.g., a random number generated by the gNB 302). The AAD field 3204 indicates the AAD 1015, which may include RNTI 1066, PCI 1067, a combined RNTI and PCI, etc. The operating mode field 3205 indicates the selected operating mode 1080 for the AS combining algorithm 1060.

[0194] Figure 33A-Figure 33B 3300 is a flowchart of a method for performing a UP security process to establish UP security between a UE 106 and a gNB 302 in a 5G network 101 in an illustrative embodiment. Fig.34 is a signaling diagram of a UP security procedure between a UE 106 and a gNB 302 in an illustrative embodiment. UP security is activated as part of a DRB addition procedure, where an RRC connection reconfiguration procedure is used to add one or more DRBs for a PDU session. The RRC connection reconfiguration procedure is described in 3GPP TS 36.331 (v.17.5.0), which is incorporated herein by reference as if fully incorporated herein. The purpose of the RRC connection reconfiguration procedure is, at least in part, to modify the RRC connection (e.g., to establish, modify, or release a radio bearer). Fig.33A In the process, gNB302 initiates an RRC connection reconfiguration procedure (step 3302). As a prerequisite, RRC security has been activated as part of the AS security mode command process. The gNB 302 of the 5G network 101 identifies the security capabilities of the UE 106 in supporting one or more AS combination algorithms 1060 (step 3304) (if not already performed in a previous security process). The gNB 302 selects an AS combination algorithm 1060 for the DRB from one or more AS combination algorithms 1060 supported by the UE 106 (step 3306). The gNB 302 sends an RRC connection reconfiguration message to the UE 106 indicating the selected AS combination algorithm 1060 (step 3308). As Fig.34As shown, gNB 302 sends an RRC connection reconfiguration message 3411 to UE 106. gNB 302 can apply integrity protection to the RRC connection reconfiguration message 3411 before sending it to UE 106. One technical advantage is that the AS combining algorithm 1060 selected for the DRB is shared with UE 106 during the RRC connection reconfiguration process.

[0195] In one embodiment, Fig.34 As shown, the gNB 302 may activate the AS combining algorithm 1060 for the DRB 1914 after sending the RRC connection reconfiguration message 3411 (step 3310). However, the gNB 302 may activate the AS combining algorithm 1060 before sending the RRC connection reconfiguration message 3411, such as to apply integrity protection (no encryption) to the RRC connection reconfiguration message 3411. In another example, the gNB 302 may activate the AS combining algorithm 1060 after receiving the RRC connection reconfiguration complete message 3412 from the UE 106.

[0196] In one embodiment, when the AS combining algorithm 1060 supports multiple operation modes 1080, the gNB 302 may select the operation mode 1080 for the AS combining algorithm 1060 from the operation modes 1080 (optional step 3312). Accordingly, the gNB 302 may send an RRC connection reconfiguration message 3411 indicating the selected AS combining algorithm 1060 and the selected operation mode 1080 to the UE 106 (optional step 3318). One technical advantage is that the operation mode 1080 of the selected AS combining algorithm 1060 is shared with the UE 106 during the RRC connection reconfiguration process.

[0197] In one embodiment, the input parameters 1002 of the AS combining algorithm 1060 may include AAD 1015 and / or additional entropy data 1017 for generating MAC-I 1062 or XMAC-I 1064 for integrity protection. Therefore, the gNB 302 may identify the AAD 1015 (optional step 3314) and / or the additional entropy data 1017 (optional step 3316). Therefore, the gNB 302 may send an RRC connection reconfiguration message 3411 including the AAD 1015 and / or the additional entropy data 1017 to the UE 106 (optional step 3320). Examples of the AAD 1015 may include RNTI 1066, PCI 1067, a combination of RNTI and PCI, etc. The additional entropy data 1017 may include a random number generated by the gNB 302. One technical advantage is that the AAD 1015 and / or the additional entropy data 1017 are shared with the UE 106 during the RRC connection reconfiguration process.

[0198] exist Fig.33B , UE 106 receives an RRC connection reconfiguration message 3411 indicating the selected AS combining algorithm 1060 from gNB 302 (step 3322). When the RRC connection reconfiguration message 3411 is integrity protected by gNB 302, UE 106 verifies the integrity of the RRC connection reconfiguration message 3411. UE 106 activates the AS combining algorithm 1060 indicated in the RRC connection reconfiguration message 3411 to protect the UP service 1716 on DRB 1914 (step 3324). In other words, UE 106 activates the AS combining algorithm 1060 selected by gNB 302 to protect subsequent or future UP services 1716 on DRB 1914, such as integrity protection, encryption, or both. UE 106 also sends an RRC connection reconfiguration complete message 3412 to gNB 302 (see Fig.34 ).

[0199] In one embodiment, when UE 106 receives the operation mode 1080 in the RRC connection reconfiguration message 3411, UE 106 activates the AS combination algorithm 1060 to protect UP traffic 1716 using the selected operation mode 1080 (optional step 3326). In other words, UE 106 activates the AS combination algorithm 1060 based on the selected operation mode 1080 to perform integrity protection, encryption, or both.

[0200] In one embodiment, when UE 106 receives AAD 1015 and / or additional entropy data 1017 in RRC connection reconfiguration message 3411, UE 106 may extract AAD 1015 (optional step 3328) and additional entropy data 1017 (optional step 3330) from RRC connection reconfiguration message 3411. UE 106 stores AAD 1015 and / or additional entropy data 1017 and may use AAD 1015 and additional entropy data 1017 as input parameters 1002 of AS combining algorithm 1060 to generate MAC-I 1062 or XMAC-I 1064.

[0201] The method 3300 may be used to activate UP security for multiple DRBs 1914. One technical advantage is that the gNB 302 can share the selected AS combining algorithm 1060 and other information (e.g., operation mode 1080, AAD 1015, additional entropy data 1017, etc.) with the UE 106 during the RRC connection reconfiguration process for the individual DRBs 1914. However, it should be understood that UP security may be configured during the AS security mode command process as described above.

[0202] In one embodiment, the RRC connection reconfiguration procedure may be extended to indicate or include at least one of the selected AS combining algorithm 1060, AAD 1015, additional entropy data 1017, and operation mode 1080. Section 6.2 of 3GPP TS 36.331 (v17.5.0) specifies the message structure and message definitions of RRC messages, which is incorporated herein by reference as if fully included herein. Fig.35 The message content 3500 of the RRC connection reconfiguration message 3411 in an illustrative embodiment is illustrated. In particular, the RRC connection reconfiguration message 3411 includes a security algorithm configuration field 3501 for configuring a UP integrity protection algorithm and a UP encryption algorithm for a radio bearer (i.e., a DRB). An extension of the security algorithm configuration field 3501 of the RRC connection reconfiguration message 3411 defined in 3GPP TS 36.331 is described herein. In one embodiment, one or more of the following new fields are defined: a combined algorithm field 3502 (i.e., "combinedAlgorithm"), an additional entropy data field 3503 (i.e., "extra_iv"), an additional authentication data field 3504 (i.e., "aad"), and an operating mode field 3505 (i.e., "operatingMode"). The combined algorithm field 3502 indicates the AS combining algorithm 1060 to be used for the DRB (the AS combining algorithm 1060 can be selected for each DRB 1914). The additional entropy data field 3503 indicates additional entropy data 1017 (e.g., a random number generated by the gNB 302). The additional authentication data field 3504 indicates the AAD 1015, which may include RNTI 1066, PCI 1067, combined RNTI and PCI, etc. The operation mode field 3505 indicates the selected operation mode 1080 for the AS combination algorithm 1060.

[0203] In one embodiment, UE 106 may report UE security capabilities to 5G network 101 in a NAS message. Fig.21 As shown, for example, UE 106 may include UE security capability indicator 2101 in NAS message 2111 to 5G network 101. An example of NAS message 2111 is a NAS registration request such as described in Section 8.2.6 of 3GPP TS 24.501. The message content of the NAS registration request includes a "UE security capability" information element (IE) of a data type of "UE security capability". Therefore, the UE security capability IE may represent the UE security capability indicator 2101. In the embodiments described herein, the UE security capability IE may be extended to include one or more combined algorithms 1000. Fig.363GPP TS24.501, Section 9.11.3.54, is a block diagram illustrating a UE security capability IE 3600. The UE security capability IE 3600 includes a UE security capability IEI 3602 (octet 1), a length 3604 of the UE security capability content (octet 2), and a plurality of security algorithm parameters indicating the legacy encryption (e.g., 5G-EA0) and integrity protection (e.g., 5G-IA0) algorithms supported by the UE 106 (octets 3-6). In this embodiment, the UE security capability IE 3600 is extended to also include one or more security algorithm parameters 3606 (octet 7*) indicating the combined algorithm 1000 (e.g., 5G-CA0) supported by the UE 106. The UE security capability IE 3600 is encoded based on the information defined in Table 9.11.3.54.1 of 3GPP TS24.501. Fig.37 3600 is a block diagram illustrating an extension of the encoding of the UE security capability IE 3600 in an illustrative embodiment. As an example, Fig.37 An extension to the encoding of octet "7" of the UE Security Capability IE 3600 is illustrated. One technical advantage is that the UE 106 can report the capabilities of the combined algorithm 1000 using a NAS message.

[0204] As mentioned above Fig. 10D As described, the combined algorithm 1000 may support multiple operating modes 1080 , such as an integrity mode 1082 . Figure 38A-Figure 38B Two integrity modes 1082 are illustrated in the illustrative embodiment. Fig.38A 1085 is a block diagram of an encoding of an encryption-ignoring and integrity mode 1085 in an illustrative embodiment. For this encoding, the combined algorithm 1000 includes an encryption algorithm 3802 (NEA) and an integrity algorithm 3804 (NIA) that use a single CIE key 1010. The integrity algorithm 3804 generates a MAC based on input parameters 1002 including a plaintext message 1013, an AAD 1015, and additional entropy data 1017. When the function parameter 3810 of the combined algorithm 1000 is set to a specific value (e.g., "1"), the ciphertext 1022 output from the encryption algorithm 3802 is ignored and not sent in the communication (i.e., the plaintext message is sent). Therefore, the communication has integrity protection, but is not encrypted.

[0205] Fig.38B1086 in an illustrative embodiment. For this encoding, the combined algorithm 1000 again includes an encryption algorithm 3802 (NEA) and an integrity algorithm 3804 (NIA), which use a single CIE key 1010. The integrity algorithm 3804 generates a MAC based on the input parameters 1002 including the ciphertext 1022, the AAD 1015, and the additional entropy data 1017. When the function parameter 3810 of the combined algorithm 1000 is set to a specific value (e.g., "1"), the encryption algorithm 3802 applies NULL encryption, and the output of the encryption algorithm 3802 is not encrypted. Therefore, the communication has integrity protection, but is not encrypted.

[0206] Based on the different operation modes 1080 for the combined algorithm 1000, the 5G network 101 may activate the combined algorithm 1000 in integrity mode 1082 to apply integrity protection to an initial security negotiation message 2112 (such as a NAS security mode command message 2312). After a security procedure (e.g., a NAS security context) has been established, the 5G network 101 may activate the combined algorithm 1000 in integrity and encryption mode 1081 to apply integrity protection and encryption to subsequent messages. For example, in Fig.38A In , the function parameter can be set to "0" so that the encrypted text 1022 from the encryption algorithm 3802 is not ignored. For example, in Fig.38B In, the function parameter can be set to "0" so that the encryption algorithm 3802 outputs the encrypted text 1022.

[0207] In one embodiment, the combined algorithm 1000 may be used to protect a secure mode command message. Fig.39 1050, derives a NAS CIE key 1010 (e.g., K 1014 ) of the selected NAS combining algorithm 1050, and derives a NAS CIE key 1010 (e.g., K 1015 ) of the selected NAS combining algorithm 1050. NASaead1050) and identifies / generates AAD 1015 and extra entropy data 1017 (e.g., NAS Extra_IV). The AMF 212 initiates the NAS security mode command procedure by sending a NAS security mode command message 2312 to the UE 106, wherein the NAS security mode command message 2312 indicates the selected NAS combining algorithm 1050 and contains the AAD 1015 and extra entropy data 1017 used in generating NAS-MAC. The AMF 212 activates NAS integrity protection before sending the NAS security mode command message 2312, and thus the NAS security mode command message 2312 is integrity protected (but not encrypted) using the NAS combining algorithm 1050. The AMF 212 activates NAS uplink decryption after sending the NAS security mode command message 2312.

[0208] After receiving the NAS security mode command message 2312, the UE 106 verifies the integrity of the NAS security mode command message 2312 using the indicated NAS combined algorithm 1050, the AAD 1015 and the additional entropy data 1017 provided in the NAS security mode command message 2312, and the NAS CIE key 1010 derived by the UE 106. If the verification is successful, the UE 106 starts NAS integrity protection and encryption / decryption using the NAS combined algorithm 1050. The UE 106 sends a NAS security mode complete message 2313 to the AMF 212, which is encrypted and integrity protected using the NAS combined algorithm 1050. The AMF 212 decrypts the received NAS security mode complete message 2313 and checks its integrity protection, and activates NAS downlink encryption after receiving the NAS security mode complete message 2313.

[0209] The AS security mode command procedure is performed to establish an AS security context between the UE 106 and the NG-RAN 502. When the AS security context is to be established in the gNB 302, the AMF 212 sends an NGAP initial context setup message 3914 to the NG-RAN 502 (e.g., gNB 302). The gNB 302 selects an AS combining algorithm 1060, derives an RRC CIE key 1010 (e.g., K RRCaeadKey 115), and identifies / generates AAD 1015 and additional entropy data 1017 (e.g., AS Extra_IV). gNB 302 starts integrity protection and encryption of RRC signaling. Therefore, gNB 302 sends an integrity protected and encrypted AS Security Mode Command message 3011 to UE 106, which indicates the selected AS combining algorithm 1060 and contains AAD 1015 and additional entropy data 1017 used in generating MAC-I. RRC downlink encryption at gNB 302 starts after sending AS Security Mode Command message 3011.

[0210] After receiving the AS security mode command message 3011, the UE 106 verifies the integrity of the AS security mode command message 3011 and decrypts the AS security mode command message 3011 using the indicated AS combination algorithm 1060, the AAD 1015 and the additional entropy data 1017 provided in the AS security mode command message 3011, and the RRC CIE key 1010 derived by the UE 106. If the verification is successful, the UE 106 activates RRC integrity protection and performs encryption / decryption using the AS combination algorithm 1060. The UE 106 sends an AS security mode complete message 3012 encrypted and integrity protected using the AS combination algorithm 1060 to the gNB 302. The AMF 212 decrypts the received AS security mode complete message 3012 and checks its integrity, and activates RRC downlink encryption after receiving the AS security mode complete message 3012.

[0211] In one embodiment, the 5G network 101 and the UE 106 may support traditional encryption and integrity algorithms, as well as the new combined algorithm 1000. The 5G network 101 may activate the traditional integrity algorithm 800 to apply integrity protection to the initial security negotiation message 2112 (such as the NAS security mode command message 2312 or the AS security mode command message 3011) without encryption. After the initial security negotiation message 2112, the 5G network 101 and the UE 106 may activate the combined algorithm 1000 to apply integrity protection and encryption to subsequent messages.

[0212] Fig.401015 is a signaling diagram illustrating NAS and AS security procedures in an illustrative embodiment. For the NAS security context, the AMF 212 applies integrity protection to the NAS security mode command message 2312 using the legacy integrity algorithm 800 (e.g., AES-256 / SNOW-256 / ZUC-256). The NAS security mode command message 2312 includes the newly selected NAS combining algorithm 1050, additional entropy data 1017 (NAS Extra_IV), and AAD 1015. The UE 106 verifies the integrity of the NAS security mode command message 2312 using the legacy integrity algorithm 800. The UE 106 receives an indication of the selected NAS combining algorithm 1050, additional entropy data 1017, and AAD 1015, and activates the NAS combining algorithm 1050 to protect subsequent NAS signaling, such as the NAS security mode complete message 2313.

[0213] Similarly, for the AS security context, the gNB 302 applies integrity protection to the AS security mode command message 3011 using the legacy integrity algorithm 800 (e.g., AES-256 / SNOW-256 / ZUC-256). The AS security mode command message 3011 includes the newly selected AS combining algorithm 1060, additional entropy data 1017 (AS Extra_IV), and AAD 1015. The UE 106 verifies the integrity of the AS security mode command message 3011 using the legacy integrity algorithm 800. The UE 106 receives an indication of the selected AS combining algorithm 1060, additional entropy data 1017, and AAD 1015, and activates the AS combining algorithm 1060 to protect subsequent RRC signaling, such as the AS security mode complete message 3012.

[0214] In the above embodiment, the 5G network 101 provides the additional entropy data 1017 to the UE 106, such as in the NAS security mode command message 2312 or the AS security mode command message 3011. In one embodiment, the UE 106 can derive the additional entropy data 1017 instead of receiving the additional entropy data 1017 from the 5G network 101. Fig.41 23 is a signaling diagram illustrating NAS and AS security procedures in an illustrative embodiment. In this embodiment, the AMF 212 does not send additional entropy data 1017 to the UE 106 in the NAS Security Mode Command message 2312. Instead, the UE 106 derives additional entropy data 1017 for the NAS security context. Similarly, the gNB 302 does not send additional entropy data 1017 to the UE 106 in the AS Security Mode Command message 3011. Instead, the UE 106 derives additional entropy data 1017 for the AS security context.

[0215] Figure 42A-42BThe derivation of additional entropy data 1017 in an illustrative embodiment is illustrated. Fig.42A , the AMF 212 uses RAND 4202 (i.e., reused from the primary authentication) and NAS COUNT 4204 as input parameters to the derivation function 4206 to derive additional entropy data 1017 for the NAS security context. The AMF 212 sends a NAS security mode command message 2312 to the UE 106, where the selected NAS combining algorithm 1050 is indicated in plain text and the other parameters are encrypted. The UE 106 derives the additional entropy data 1017 in the same manner as the AMF 212, using RAND 4202 and NAS COUNT 4204 as input parameters to the derivation function 4206. The UE 106 is able to verify the integrity of the NAS security mode command message 2312 and decrypt the parameters.

[0216] exist Fig.42B , gNB 302 uses RAND 4202 and RNTI 1066, PCI 1067, a combination of RNTI and PCI, etc. as input parameters to the derivation function 4206 to derive additional entropy data 1017 for the AS security context. gNB 302 sends an AS security mode command message 3011 to UE 106, in which the AS combination algorithm 1060 is indicated in plain text and the other parameters are encrypted. UE 106 derives additional entropy data 1017 in the same manner as gNB 302 using RAND 4202 and RNTI 1066, PCI 1067, a combination of RNTI and PCI, etc. as input parameters to the derivation function 4206. UE 106 is able to verify the integrity of the AS security mode command message 3011 and decrypt the parameters.

[0217] One technical advantage of deriving the additional entropy data 1017 at the sender 810 and the receiver 812 is that the additional entropy data 1017 does not need to be shared during the secure mode command process.

[0218] Any of the various elements or modules shown in the figure or described herein can be implemented as hardware, software, firmware or some combination of these.For example, an element can be implemented as special hardware.The special hardware element can be referred to as "processor", "controller" or some similar term.When provided by a processor, the function can be provided by a single special processor, a single shared processor or a plurality of individual processors (some of which can be shared).In addition, the explicit use of the term "processor" or "controller" should not be interpreted as referring only to the hardware capable of executing software, but can implicitly include but not limited to digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC) or other circuit system, field programmable gate array (FPGA), read-only memory (ROM), random access memory (RAM), non-volatile memory, logic or some other physical hardware component or module for storing software.

[0219] In addition, the element can be implemented as an instruction that is executable by a processor or computer to perform the function of the element. Some examples of instructions are software, program code, and firmware. The instructions are operable to direct the processor to perform the function of the element when executed by the processor. The instructions can be stored on a storage device readable by the processor. Some examples of storage devices are digital or solid-state memory, magnetic storage media such as disks and tapes, hard drives, or optically readable digital data storage media.

[0220] As used in this application, the term "circuitry" may refer to one, more, or all of the following:

[0221] (a) Pure hardware circuit implementation (such as implementation in analog and / or digital circuit systems only)

[0222] now);

[0223] (b) a combination of hardware circuitry and software such as (where applicable):

[0224] (i) a combination of analog and / or digital hardware circuits and software / firmware; and

[0225] (ii) any portion of hardware processor(s) (including digital signal processor(s)) with software, software and memory(s) that work together to enable a device such as a mobile phone or server to perform various functions; and

[0226] (c) Hardware circuit(s) and / or processor(s), such as microprocessor(s) or portion(s) of microprocessor(s), which requires software (e.g., firmware)

[0227] But when the operation is not needed, the software may not exist.

[0228] This definition of circuitry applies to all uses of the term in this application, including in any claims. As another example, as used in this application, the term circuitry also covers an implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its accompanying software and / or firmware. For example, if applicable to a particular claim element, the term circuitry also includes a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0229] Although specific embodiments are described herein, the scope of the present disclosure is not limited to these specific embodiments.The scope of the present disclosure is defined by the following claims and any equivalents thereof.

Claims

1. A network (101) device, the device comprising: an access and mobility management function (212) operatively coupled to the user equipment (106) to negotiate a security mechanism (300); The access and mobility management functions include: means (1504) for identifying the security capabilities of the user equipment in supporting one or more non-access stratum combined integrity and encryption algorithms (1050); means (1504) for selecting a non-access stratum combined integrity and encryption algorithm from the one or more non-access stratum combined integrity and encryption algorithms to protect non-access stratum signaling (1712); and Means (1502) for sending a non-access stratum security mode command message (2312) indicating the non-access stratum combined integrity and encryption algorithm to the user equipment.

2. The device according to claim 1, wherein: The non-access stratum combined integrity and encryption algorithm supports multiple operation modes (1080); The means for selecting includes: means for selecting an operating mode (1080) for the non-access stratum combined integrity and encryption algorithm from the plurality of operating modes; and The component for sending includes: a component for sending the non-access stratum security mode command message to the user equipment, wherein the non-access stratum security mode command message indicates the non-access stratum combined integrity and encryption algorithm and the operation mode of the non-access stratum combined integrity and encryption algorithm.

3. The device according to claim 2, wherein: The multiple operation modes include at least: Integrity and encryption modes (1081); Integrity Mode (1082); Encryption mode (1083); and NULL encryption and NULL integrity mode (1084).

4. The device according to claim 3, wherein: The integrity mode includes at least one of the following: an ignore encryption and integrity mode (1085), wherein the non-access stratum combined integrity and encryption algorithm is configured to apply integrity protection and encryption to the non-access stratum signaling using a non-access stratum combined integrity and encryption key (1114), but encrypted data is ignored; as well as NULL encryption and integrity mode (1086), wherein the non-access stratum combined integrity and encryption algorithm is configured to apply integrity protection and NULL encryption to the non-access stratum signaling using the non-access stratum combined integrity and encryption key.

5. The device according to any one of claims 2 to 4, wherein: The non-access stratum security mode command message is extended to indicate the non-access stratum combined integrity and encryption algorithm and the operation mode selected for the non-access stratum combined integrity and encryption algorithm from among the plurality of operation modes.

6. The device according to any one of claims 1 to 5, wherein: The non-access stratum combined integrity and encryption algorithm uses at least one of the additional authentication data (1015) and the additional entropy data (1017) as input parameters (1002) to generate a non-access stratum message authentication code (1052).

7. The device according to claim 6, wherein: The additional authentication data includes one of the following: A 5G temporary mobile subscriber identity TMSI (1056) of the user equipment; Truncated 5G-S-TMSI (1057); or Network slice selection auxiliary information (1058).

8. The device according to any one of claims 6 to 7, wherein: The additional entropy data comprises a random number generated by the access and mobility management function.

9. The device according to any one of claims 6 to 8, wherein: The access and mobility management functions also include: means (1504) for identifying said additional authentication data (1015); and means (1504) for identifying said additional entropy data (1017); The means for sending includes: a means for sending the non-access stratum security mode command message including at least one of the additional authentication data and the extra entropy data to the user equipment.

10. The device according to any one of claims 6 to 9, wherein: The non-access stratum security mode command message is extended to include at least one of the additional authentication data and the additional entropy data.

11. The device according to any one of claims 1 to 10, wherein: The means for identifying comprises: means (1502) for receiving a non-access stratum message (2311) from the user equipment, the non-access stratum message indicating the one or more non-access stratum combined integrity and encryption algorithms supported by the user equipment; and The User Equipment Security Capabilities Information Element (3600) of the non-access stratum message is extended to indicate the one or more non-access stratum combined integrity and encryption algorithms supported by the user equipment.

12. A device of a network (101), the device comprising: A radio access network node (1600) operatively coupled to a user equipment (106) to negotiate a security mechanism (300); The radio access network node comprises: means (1606) for identifying the security capabilities of the user equipment in supporting one or more access stratum combined integrity and encryption algorithms (1060); means for selecting an access stratum combined integrity and ciphering algorithm from the one or more access stratum combined integrity and ciphering algorithms to protect radio resource control signaling (1606); and Means (1602) for sending an access stratum security mode command message (3011) indicating the access stratum combined integrity and encryption algorithm to the user equipment.

13. The device according to claim 12, wherein: The access layer combines integrity and encryption algorithms to support multiple operation modes (1080); The means for selecting includes: means for selecting, from the plurality of operating modes, an operating mode (1080) selected for protecting the radio resource control signaling for the access stratum combined integrity and encryption algorithm; and The component for sending includes: a component for sending the access layer security mode command message to the user equipment, the access layer security mode command message indicating the access layer combined integrity and encryption algorithm and the operation mode of the access layer combined integrity and encryption algorithm.

14. The device according to claim 13, wherein: The multiple operation modes include at least: Integrity and encryption modes (1081); Integrity Mode (1082); Encryption mode (1083); and NULL encryption and NULL integrity mode (1084).

15. The device according to claim 14, wherein: The integrity mode includes at least one of the following: an ignored encryption and integrity mode (1085) wherein the access layer combined integrity and encryption algorithm is configured to apply integrity protection and encryption, but encrypted data is ignored; as well as NULL encryption and integrity mode (1086), wherein the access layer combined integrity and encryption algorithm is configured to apply integrity protection and NULL encryption.

16. The device according to any one of claims 13 to 15, wherein: The security algorithm configuration information element (3102) of the access layer security mode command message is extended to indicate the access layer combined integrity and encryption algorithm and the operation mode selected for the access layer combined integrity and encryption algorithm from the multiple operation modes.

17. The device according to any one of claims 12 to 16, wherein: The access layer combined integrity and encryption algorithm uses at least one of the additional authentication data (1015) and the additional entropy data (1017) as input parameters (1002) to generate a message authentication code (1062).

18. The device according to claim 17, wherein: The additional authentication data includes at least one of the following: Radio Network Temporary Identifier (1066); and Physical cell identifier (1067).

19. The device according to any one of claims 17 to 18, wherein: The additional entropy data comprises a random number generated by the radio access network node.

20. The device according to any one of claims 17 to 19, wherein: The radio access network node further comprises: means (1606) for identifying said additional authentication data (1015); and means (1606) for identifying said additional entropy data (1017); The means for sending includes: a means for sending the access layer security mode command message including at least one of the additional authentication data and the additional entropy data to the user equipment.

21. The device according to any one of claims 17 to 20, wherein: The security algorithm configuration information element (3102) of the access layer security mode command message is extended to include at least one of the additional authentication data and the additional entropy data.

22. The device according to any one of claims 12 to 21, wherein: The radio access network node further comprises: means for selecting an access stratum combined integrity and ciphering algorithm for a radio bearer from the one or more access stratum combined integrity and ciphering algorithms (1606); and Means (1602) for sending a radio resource control connection reconfiguration message (3411) to said user equipment, said radio resource control connection reconfiguration message indicating said access stratum combined integrity and ciphering algorithm selected for said radio bearer.

23. An apparatus operatively coupled to a network (101), the apparatus comprising: The user equipment (106) comprises: means (1402) for receiving a non-access stratum security mode command message (2312) from an access and mobility management function (212), wherein the non-access stratum security mode command message indicates a non-access stratum combined integrity and encryption algorithm (1050) selected by the access and mobility management function; and Means (1404) for activating said non-access stratum combined integrity and encryption algorithm indicated in said non-access stratum security mode command message to protect non-access stratum signaling (1712).

24. The apparatus according to claim 23, wherein the user equipment further comprises: means (1402) for receiving an access stratum security mode command message from a radio access network node (1600), wherein the access stratum security mode command message indicates an access stratum combined integrity and encryption algorithm (1060) selected by the radio access network node; as well as Means (1404) for activating the access stratum combined integrity and encryption algorithm indicated in the access stratum security mode command message to protect radio resource control signaling (1714).

25. The apparatus according to claim 24, wherein the user equipment further comprises: means (1402) for receiving a radio resource control connection reconfiguration message (3411) from the radio access network node, wherein the radio resource control connection reconfiguration message indicates an access stratum combined integrity and encryption algorithm selected by the radio access network node for a radio bearer (1914); as well as Means (1404) for activating the access stratum combined integrity and encryption algorithm to protect user plane traffic (1716) over the radio bearer.

Images