Key generation for combined integrity and encryption algorithms

Abstract

A security mechanism between a user equipment and a network (300). In an embodiment, a network (101) is operably coupled to a user equipment (106). When operating as a transmitter (810) of a message (1720) sent to a user equipment, the network element (212 / 1600) comprises: means (1504 / 1606) for identifying a combined integrity and encryption algorithm (1000); means (1504 / 1606) for deriving a combined integrity and encryption key (1010) for a combined integrity and encryption algorithm; and means (1504 / 1606) for applying the combined integrity and encryption algorithm to the transmitted message using the combined integrity and encryption key as input parameters (1002) to provide security protection to the transmitted message.

Description

Technical Field

[0001] The present disclosure relates to the field of communication systems, and in particular to next generation networks. Background Art

[0002] Next generation networks, such as fifth generation (5G), represent the next major stage in mobile telecommunication standards beyond fourth generation (4G) standards. Next generation networks may be enhanced in radio access and network architecture compared to 4G networks. Next generation networks are designed to use new areas of the wireless spectrum for radio access networks (RANs), such as millimeter wave bands.

[0003] As mobile networks become more widely used across the country and around the world, communications may be intercepted or subject to other types of attacks. To ensure security and privacy, the Third Generation Partnership Project (3GPP) has described security mechanisms for 5G mobile networks and security procedures performed within 5G mobile networks. Due to the importance of security in 5G systems and beyond, it is expected that more robust security mechanisms will continue to be developed. Summary of the invention

[0004] Enhanced security mechanisms for 5G systems are described herein. Communications within the 5G system (i.e., signaling or user plane data) can be protected via integrity protection and / or encryption. Previously, separate integrity algorithms and encryption algorithms were implemented. In the embodiments described herein, a combined integrity and encryption algorithm is implemented, which is configured to apply integrity protection and / or encryption using a single key. One technical advantage is that fewer keys are derived for the security mechanism. Another technical advantage is that separate integrity protection algorithms and encryption algorithms do not have to be provided and managed. The encryption process and the calculation of the integrity code (i.e., message authentication code) can also be implemented as a single program.

[0005] In an embodiment (also referred to as an aspect), a network includes: a network element operably coupled to a user equipment (UE). When operating as a sender of a message sent to the user equipment, the network element includes: a component for identifying a combined integrity and encryption algorithm, a component for deriving a combined integrity and encryption key for the combined integrity and encryption algorithm, and a component for applying the combined integrity and encryption algorithm to the sent message using the combined integrity and encryption key as an input parameter to provide security protection to the sent message.

[0006] In an embodiment, when operating as a receiver of a received message from a user equipment, the network element comprises: means for applying a combined integrity and encryption algorithm to the received message using a combined integrity and encryption key as an input parameter to perform at least one of decrypting the received message and verifying the integrity of the received message.

[0007] In an embodiment, the combined integrity and encryption algorithm supports multiple operating modes, the means for identifying includes: means for identifying an operating mode among the multiple operating modes, and the means for applying includes: means for applying the combined integrity and encryption algorithm based on the operating mode.

[0008] In an embodiment, the plurality of operation modes include at least: integrity and encryption mode, integrity mode, encryption mode, and null encryption and null integrity mode.

[0009] In an embodiment, the integrity mode comprises at least one of: an ignore encryption and integrity mode, in which the combined integrity and encryption algorithm is configured to apply integrity protection and encryption to sent messages using a combined integrity and encryption key, but the encrypted data is ignored; and a null encryption and integrity mode, in which the combined integrity and encryption algorithm is configured to apply integrity protection and null encryption to sent messages using a combined integrity and encryption key.

[0010] In an embodiment, the means for deriving at the network comprises: means for deriving the combined integrity and encryption key using an algorithm key derivation function, the algorithm key derivation function using an algorithm type discriminator as an input parameter. The combined integrity and encryption algorithm comprises one of the following: a non-access stratum combination algorithm and an access stratum combination algorithm. The non-access stratum algorithm type discriminator is defined for the non-access stratum combination algorithm, the radio resource control algorithm type discriminator is defined for the access stratum combination algorithm when used for protection of radio resource control signaling, and the user plane algorithm type discriminator is defined for the access stratum combination algorithm when used for protection of user plane traffic.

[0011] In an embodiment, the network element further comprises: means for identifying additional authentication data, and means for identifying additional entropy data. The means for applying the combined integrity and encryption algorithm to the transmitted message comprises: means for applying the combined integrity and encryption algorithm using at least one of the additional authentication data and the additional entropy data as an input parameter to generate a message authentication code.

[0012] In an embodiment, during the security mode command process, at least additional entropy data is shared between the user device and the network.

[0013] In an embodiment, the message sent includes: non-access stratum signaling between a user equipment and an access and mobility management function. The means for identifying includes: means for identifying a non-access stratum combined integrity and encryption algorithm, the means for deriving includes: means for deriving a non-access stratum combined integrity and encryption key for the non-access stratum combined integrity and encryption algorithm, and the means for applying includes: means for applying the non-access stratum combined integrity and encryption algorithm to the non-access stratum signaling using the non-access stratum combined integrity and encryption key as an input parameter.

[0014] In an embodiment, the message sent includes: radio resource control signaling between a user equipment and a radio access network node. The component for identifying includes: a component for identifying an access layer combined integrity and encryption algorithm, the component for deriving includes: a component for deriving a radio resource control combined integrity and encryption key for the access layer combined integrity and encryption algorithm, and the component for applying includes: a component for applying the access layer combined integrity and encryption algorithm to the radio resource control signaling using the radio resource control combined integrity and encryption key as input parameters.

[0015] In an embodiment, the message sent includes: user plane traffic between a user equipment and a wireless access network node. The component for identifying includes: a component for identifying an access layer combined integrity and encryption algorithm, the component for deriving includes: a component for deriving a user plane combined integrity and encryption key for the access layer combined integrity and encryption algorithm, and the component for applying includes: a component for applying the access layer combined integrity and encryption algorithm to the user plane traffic using the user plane combined integrity and encryption key as an input parameter.

[0016] In an embodiment, an apparatus includes: a user device operably coupled to a network. When operating as a sender of a message sent to the network, the user device includes: a component for identifying a combined integrity and encryption algorithm, a component for deriving a combined integrity and encryption key for the combined integrity and encryption algorithm, and a component for applying the combined integrity and encryption algorithm to the sent message using the combined integrity and encryption key as an input parameter to provide security protection for the sent message.

[0017] In an embodiment, when operating as a receiver of a received message from a network, the user equipment comprises: means for applying a combined integrity and encryption algorithm to the received message using a combined integrity and encryption key as an input parameter to perform at least one of decrypting the received message and verifying the integrity of the received message.

[0018] In an embodiment, the means for deriving at the user equipment comprises: means for deriving the combined integrity and encryption key using an algorithm key derivation function, the algorithm key derivation function using an algorithm type discriminator as an input parameter. The combined integrity and encryption algorithm comprises one of the following: a non-access stratum combination algorithm and an access stratum combination algorithm. The non-access stratum algorithm type discriminator is defined for the non-access stratum combination algorithm, the radio resource control algorithm type discriminator is defined for the access stratum combination algorithm when used for protection of radio resource control signaling, and the user plane algorithm type discriminator is defined for the access stratum combination algorithm when used for protection of user plane traffic.

[0019] In an embodiment, the user equipment further comprises: means for identifying additional authentication data and means for identifying additional entropy data. The means for applying the combined integrity and encryption algorithm to the sent message comprises: means for applying the combined integrity and encryption algorithm using at least one of the additional authentication data and the additional entropy data as an input parameter to generate a message authentication code.

[0020] In an embodiment, a method for executing a security mechanism is disclosed. In a communication system including a user device operably coupled to a network, for one of the user device and the network, when operating as a sender of a sent message, the method includes: identifying a combined integrity and encryption algorithm at the sender, deriving a combined integrity and encryption key for the combined integrity and encryption algorithm at the sender, and applying the combined integrity and encryption algorithm to the sent message using the combined integrity and encryption key as an input parameter at the sender to provide security protection to the sent message.

[0021] In an embodiment, for one of a user device and a network, when operating as a receiver of a received message, the method includes: identifying a combined integrity and encryption algorithm at the receiver, deriving a combined integrity and encryption key for the combined integrity and encryption algorithm at the receiver, and applying the combined integrity and encryption algorithm to the received message using the combined integrity and encryption key as an input parameter at the receiver to perform at least one of decrypting the received message and verifying the integrity of the received message.

[0022] In an embodiment, the combined integrity and encryption algorithm supports multiple operating modes, and the method further comprises: identifying an operating mode in the multiple operating modes. Applying the combined integrity and encryption algorithm comprises: applying the combined integrity and encryption algorithm based on the operating mode.

[0023] In an embodiment, the deriving comprises: deriving the combined integrity and encryption key using an algorithm key derivation function, the algorithm key derivation function using an algorithm type discriminator as an input parameter. The combined integrity and encryption algorithm comprises one of the following: a non-access stratum combination algorithm and an access stratum combination algorithm. A non-access stratum algorithm type discriminator is defined for the non-access stratum combination algorithm, a radio resource control algorithm type discriminator is defined for the access stratum combination algorithm when used for protection of radio resource control signaling, and a user plane algorithm type discriminator is defined for the access stratum combination algorithm when used for protection of user plane traffic.

[0024] In an embodiment, the method further comprises: identifying additional authentication data, and identifying additional entropy data. Applying the combined integrity and encryption algorithm to the sent message comprises: applying the combined integrity and encryption algorithm to the sent message using at least one of the additional authentication data and the additional entropy data as an input parameter to generate a message authentication code.

[0025] In an embodiment, the message sent includes: non-access stratum signaling between a user equipment and an access and mobility management function, the identification includes: identifying a non-access stratum combined integrity and encryption algorithm, the export includes: exporting a non-access stratum combined integrity and encryption key for the non-access stratum combined integrity and encryption algorithm, and the application includes: applying the non-access stratum combined integrity and encryption algorithm to the non-access stratum signaling using the non-access stratum combined integrity and encryption key as input parameters.

[0026] In an embodiment, the message sent includes: wireless resource control signaling between a user device and a wireless access network node, the identification includes: identifying an access layer combined integrity and an encryption algorithm, the export includes: exporting a wireless resource control combined integrity and an encryption key for the access layer combined integrity and the encryption algorithm, and the application includes: applying the access layer combined integrity and the encryption algorithm to the wireless resource control signaling using the wireless resource control combined integrity and the encryption key as input parameters.

[0027] In an embodiment, the message sent includes: user plane service between a user device and a wireless access network node, the identification includes: identifying an access layer combined integrity and encryption algorithm, the export includes: exporting a user plane combined integrity and encryption key for the access layer combined integrity and encryption algorithm, and the application includes: applying the access layer combined integrity and encryption algorithm to the user plane signaling using the user plane combined integrity and encryption key as input parameters.

[0028] Other embodiments may include the computer-readable medium, other systems or devices, or other methods described below. Moreover, one or more of the above embodiments may be combined as described herein.

[0029] The above summary of the invention provides a basic understanding of some aspects of the specification. This summary of the invention is not an extensive overview of the specification. It is neither intended to identify the key or important elements of the specification, nor to describe any scope of the specific embodiments of the specification, or any scope of the claims. Its only purpose is to present some concepts of the specification in a simplified form as a preface to a more detailed description presented later. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Some embodiments of the present invention will now be described by way of example only and with reference to the accompanying drawings.On all drawings, the same reference number represents the same element or the same type of element.

[0031] Figure 1 The diagram shows the high-level architecture of a 5G system.

[0032] Figure 2 The diagram illustrates the non-roaming architecture of the 5G system.

[0033] Figure 3 Diagram showing the security mechanisms within the 5G system.

[0034] Figures 4A to 4B Illustrated is a primary authentication process that provides mutual authentication between a user device and a network.

[0035] Figure 5 The diagram illustrates the non-access stratum (NAS) and access stratum (AS) security procedures.

[0036] Figure 6 User plane (UP) security activation is illustrated.

[0037] Figure 7 The diagram shows the key hierarchy of the 5G system.

[0038] Figure 8 The NIA is shown.

[0039] Fig. 9 A cipher or encryption algorithm (NEA) is illustrated.

[0040] Fig. 10A The combining algorithm (NCA) in the illustrative embodiment is illustrated.

[0041] Fig. 10B The NAS combining algorithm (NAS NCA) in an illustrative embodiment is illustrated.

[0042] Fig. 10C The AS combining algorithm (AS NCA) in an illustrative embodiment is illustrated.

[0043] Fig. 10D is a block diagram illustrating different modes of operation of the combining algorithm in an illustrative embodiment.

[0044] Fig.11 An enhanced key hierarchy for a 5G system in an illustrative embodiment is illustrated.

[0045] Fig.12 is a block diagram illustrating an algorithmic key derivation function (KDF) in an illustrative embodiment.

[0046] Fig.13 A table illustrating algorithm type specifiers in an illustrative embodiment is shown.

[0047] Fig.14 is a block diagram of a user equipment (UE) in an illustrative embodiment.

[0048] Fig.15 is a block diagram of an AMF in an illustrative embodiment.

[0049] Fig.16 is a block diagram of a RAN node in an illustrative embodiment.

[0050] Fig.17 The diagram illustrates the NAS functional layer and the AS functional layer of the 5G system in an illustrative embodiment.

[0051] Figures 18A to 18E is a flow chart illustrating a method of performing security mechanisms in a 5G system in an illustrative embodiment.

[0052] Fig.19 The diagram illustrates the NAS functional layer and the AS functional layer in a 5G system in an illustrative embodiment.

[0053] Figures 20A to 20B is a flow chart illustrating a method of negotiating a security mechanism in an illustrative embodiment.

[0054] Fig.21 is a signaling diagram illustrating the negotiation of security mechanisms in an illustrative embodiment.

[0055] Figures 22A to 22B is a flow chart illustrating a method of negotiating a NAS security mechanism in an illustrative embodiment.

[0056] Fig.23 is a signaling diagram illustrating the NAS security procedure between a UE and an AMF of a 5G network in an illustrative embodiment.

[0057] Fig.24 is a block diagram illustrating a NAS security algorithm information element (IE).

[0058] Fig.25 is a block diagram illustrating an extension of the encoding for a NAS security algorithm IE in an illustrative embodiment.

[0059] Fig.26 is a block diagram illustrating the contents of a NAS Security Mode Command message in an illustrative embodiment.

[0060] Fig. 27 is a block diagram illustrating an additional 5G AEAD security information IE in an illustrative embodiment.

[0061] Fig.28 The encoding of the Additional 5G AEAD Security Information IE in an illustrative embodiment is illustrated.

[0062] Figures 29A to 29B is a flow chart illustrating a method of performing an RRC security mechanism in an illustrative embodiment.

[0063] Fig.30 is a signaling diagram illustrating the RRC security procedure between a UE and a gNB in ​​an illustrative embodiment.

[0064] Fig.31 The figure shows the message content of the AS security mode command message.

[0065] Fig.32 A Security Algorithm Configuration IE in an illustrative embodiment is illustrated.

[0066] Figures 33A to 33B is a flow chart illustrating a method of executing a UP security mechanism in an illustrative embodiment.

[0067] Fig.34 is a signaling diagram illustrating the UP security procedure between the UE and the gNB in ​​an illustrative embodiment.

[0068] Fig.35 The message content of the RRC connection reconfiguration message in an illustrative embodiment is illustrated.

[0069] Fig.36 is a block diagram illustrating a UE security capability IE.

[0070] Fig.37 is a block diagram illustrating an extension to the encoding of a UE security capability IE in an illustrative embodiment.

[0071] Figures 38A to 38B Two integrity modes are illustrated in the illustrative embodiment.

[0072] Fig.39 is a signaling diagram illustrating NAS and AS security procedures in an illustrative embodiment.

[0073] Fig.40 is a signaling diagram illustrating NAS and AS security procedures in an illustrative embodiment.

[0074] Fig.41 is a signaling diagram illustrating NAS and AS security procedures in an illustrative embodiment.

[0075] Figures 42A to 42B The derivation of additional entropy data in an illustrative embodiment is illustrated. DETAILED DESCRIPTION

[0076] The accompanying drawings and the following description illustrate specific exemplary embodiments. Therefore, it will be understood that those skilled in the art will be able to design various arrangements that implement the principles of the embodiments and are included within the scope of the embodiments, although not explicitly described or shown herein. In addition, any examples described herein are intended to help understand the principles of the embodiments and should be interpreted as not being limited to such specifically described examples and conditions. Therefore, (multiple) inventive concepts are not limited to the specific embodiments or examples described below, but are limited by the claims and their equivalents.

[0077] Figure 1 A high-level architecture of a 5G system 100 is illustrated. The 5G system (5GS) 100 is a communication system (e.g., a 3GPP system) that includes a 5G access network ((R)AN) 102 (generally referred to herein as a RAN) and a 5G core network (5GC) 104 that communicate with a 5G user equipment (UE) 106. The RAN 102 and the 5GC 104 together may be referred to as a 5G network 101, a 5G mobile network, a 5G communication network, etc. Although the term "5G" is used herein, any next generation network beyond 5G is also contemplated.

[0078] The RAN 102 provides wireless or radio connectivity to the UE 106 and connects the UE 106 to the 5GC 104. The RAN 102 may include a next generation radio access network (NG-RAN), a non-3GPP access network, and / or another type of RAN connected to the 5GC 104. The RAN 102 may support Evolved UMTS Terrestrial Radio Access Network (E-UTRAN) access (e.g., through eNodeB (eNB), gNodeB (gNB), and / or ng-eNodeB (ng-eNB)), wireless local area network (WLAN) access, satellite radio access, new radio access technologies (RATs), etc. The 5G access network may also support fixed access. The 5GC 104 interconnects the RAN 102 with a data network (DN) 108. The 5GC 104 includes a network function (NF) 110, which may be implemented as a network element on dedicated hardware, a software instance running on dedicated hardware, a virtualized function instantiated on an appropriate platform (e.g., a cloud infrastructure), etc. The data network 108 may be an operator external public or private data network, or an operator intra-data network (e.g., for IP Multimedia Subsystem (IMS) services). The UE 106 (also referred to as a mobile terminal) includes a 5G-capable device configured to register with the 5GC 104 to access services. The UE 106 may include an end-user device such as a mobile phone (e.g., a smartphone), a tablet computer, a computer with a mobile broadband adapter, etc. The UE 106 may be enabled for voice services, data services, machine-to-machine (M2M) or machine type communication (MTC) services, and / or other services.

[0079] Figure 2 A non-roaming architecture 200 of the 5G system 100 is illustrated. Figure 2The architecture 200 in is a service-based representation, as further described in 3GPP TS 23.501 (v18.2.0), which is incorporated by reference as if fully included herein. The architecture 200 includes network functions (NFs) for the 5GC 104, and the NFs for the control plane (CP) are separated from the user plane (UP). The control plane of 5GC 104 includes an authentication server function (AUSF) 210, an access and mobility management function (AMF) 212, a session management function (SMF) 214, a policy control function (PCF) 216, a unified data management (UDM) 218, a network slice selection function (NSSF) 220, and an application function (AF) 222. The control plane of 5GC 104 also includes a network exposure function (NEF) 224, a NF repository function (NRF) 226, a service communication proxy (SCP) 228, a network slice admission control function (NSACF) 230, a network slice specific and SNPN authentication and authorization function (NSSAAF) 232, and an edge application server discovery function (EASDF) 234. The user plane of 5GC 104 includes one or more user plane functions (UPF) 240 that communicate with the data network 108. UE 106 can access the control plane and the user plane of 5GC 104 through RAN 102.

[0080] There are a large number of subscribers able to access services from a carrier or home network operator that implements a mobile network including 5G system 100, such as in Figures 1 to 2 The communication between the subscriber (ie, via the UE) and the mobile network is protected by security mechanisms, such as those standardized by 3GPP. The subscriber and the bearer expect security guarantees from the security mechanisms.

[0081] Figure 3The security mechanisms 300 within the 5G system 100 are illustrated. One of the security mechanisms 300 is primary authentication and key agreement between the network (e.g., AMF 212 / UDM 218) and the UE 106. Other security mechanisms 300 are used to protect signaling between the network and the UE 106. For example, the security mechanism 300 is used to protect non-access stratum (NAS) signaling between the AMF 212 and the UE 106. Another security mechanism 300 is used to protect radio resource control (RRC) signaling between the gNB 302 and the UE 106. The security mechanism 300 can also be used to protect user plane (UP) traffic (also known as UP data) between the gNB 302 and the UE 106. Within the network, the security mechanism 300 can be used to protect IP connectivity, such as Internet Protocol Security (IPSec), between the gNB 302 and the 5GC 104 (e.g., AMF 212 / UPF 240). Yet another security mechanism 300 is used for roaming and interconnect security, such as to protect control plane signaling between a security edge protection proxy (SEPP) 310 and another network 301 (e.g., a visited 5G network), and / or to protect user plane data between a UPF 240 and another network 301. There may be additional security mechanisms 300 defined or used, which are not discussed for the sake of brevity.

[0082] Figures 4A to 4B A primary authentication process is illustrated that provides mutual authentication between a UE 106 and a network (e.g., AMF 212 / UDM 218). The purpose of the primary authentication and key agreement process is to enable mutual authentication between the UE 106 and the home network of the UE 106, and to provide key material that can be used between the UE 106 and the serving network in subsequent security processes (e.g., NAS and AS security processes). The home network (e.g., a Home Public Land Mobile Network (HPLMN)) represents an operator network or carrier network through which a subscriber (e.g., UE 106) subscribes to a service. The serving network has a wireless access device that is capable of communicating with the UE 106 via wireless signals. The key material generated by the primary authentication and key agreement process causes the AUSF 210 of the home network to provide an anchor key (referred to as K SEAFKey). SEAF provides authentication functionality via the AMF 212 in the serving network and supports primary authentication using a Subscription Hidden Identifier (SUCI) containing a Hidden Subscription Permanent Identifier (SUPI). SUPI is a globally unique 5G identifier assigned to each subscriber in the 5G system 100. SUCI consists of a SUPI type, a Home Network Identifier (HN-ID) identifying the home network of the subscriber, a Routing Indicator (RID) assigned to the subscriber by the home network operator and provided in the Universal Subscriber Identity Module (USIM) of the UE 106, a Protection Scheme Identifier, a Home Network Public Key Identifier, and a Scheme Output. Anchor Key (K SEAF ) is from the AUSF The intermediate key of the key is derived. AUSF Keys are established between the UE 106 and the home network (AUSF 210) resulting from the primary authentication process.

[0083] Figure 4Ais a signaling diagram illustrating the initiation of primary authentication, such as described in 3GPP TS 33.501 (v18.2.0), which is incorporated by reference as if fully included herein. The UE 106 sends an N1 message 411 (i.e., an initial NAS message), such as a Registration Request, to the serving network 406 (e.g., the AMF 212 of the serving network 406). In a roaming scenario, the serving network 406 may also be referred to as a serving PLMN, a visited PLMN (VPLMN), etc. The UE 106 uses a SUCI or a 5G Globally Unique Temporary Identifier (5G-GUTI) in the Registration Request. The SEAF 402 of the AMF 212 may initiate authentication with the UE 106 during any process of establishing a signaling connection with the UE 106. The SEAF 402 invokes the Nausf_UEAuthentication service to initiate authentication to the home network 404 (e.g., HPLMN) by sending a Nausf_UEAuthentication_Authenticate request message 412 to the AUSF 210. The Nausf_UEAuthentication_Authenticate request message 412 includes the SUCI or SUPI and the Serving Network Name (SN-Name). Upon receiving the Nausf_UEAuthentication_Authenticate request message 412, the AUSF 210 checks whether the requesting SEAF 402 in the serving network 406 is authorized to use the Serving Network Name (SNN) in the Nausf_UEAuthentication_Authenticate request message 412 by comparing the Serving Network Name with the expected Serving Network Name. When the Serving Network 406 is authorized to use the Serving Network Name, the AUSF 210 sends a Nudm_UEAuthentication_Get request message 413 to the UDM 218 of the home network. The Nudm_UEAuthentication_Get request message 413 includes the SUCI or SUPI and the Serving Network Name. Upon receiving the Nudm_UEAuthentication_Get request message 413, the UDM 218 identifies the SUPI (if received) or calls a subscription identifier de-hiding function (SIDF) to de-hide the SUPI from the SUCI (if received). The UDM 218 (or the authentication credentials repository and processing function (ARPF) of the UDM 218) selects or chooses an authentication method for primary authentication based on the SUPI.

[0084] Figure 4B4 is a signaling diagram illustrating a primary authentication process such as described in 3GPP TS 33.501. In this example, 5G Authentication and Key Agreement (AKA) is described, but similar concepts apply to Extensible Authentication Protocol AKA prime (EAP-AKA`). In response to Nudm_UEAuthentication_Get request 413, UDM 218 creates a 5G Home Environment Authentication Vector (5G HE AV) for the selected authentication method. UDM 218 derives K AUSF The UDM 218 creates a key that includes the authentication token (AUTN), the expected response (XRES*), K AUSF The UDM 218 then sends a Nudm_UEAuthentication_Get response message 414 to the AUSF 210 with the 5G HE AV to be used for authentication (e.g., Figure 4B In the case where SUCI is included in the Nudm_UEAuthentication_Get request 413, after de-hiding SUPI from SUCI, the UDM 218 includes SUPI in the Nudm_UEAuthentication_Get response message 414. If the subscriber has an Authentication and Key Management for Applications (AKMA) subscription, the UDM 218 may include an AKMA indication and a RID in the Nudm_UEAuthentication_Get response message 414.

[0085] In response to the Nudm_UEAuthentication_Get response message 414, the AUSF 210 temporarily stores the expected response (XRES*) together with the received SUCI or SUPI. The AUSF 210 then calculates the hashed expected response (HXRES*) from the expected response (XRES*) and hashes it from K AUSF Key calculation K SEAF Key, and replace XRES* with HXRES* in 5G HE AV, and replace K SEAF Key replacement K AUSF The AUSF 210 removes the K key to generate a 5G authentication vector (5GAV) using the 5G HE AV received from the UDM 218. SEAFThe AUSF 210 sends a Nausf_UEAuthentication_Authenticate response message 415 including the 5G SE AV to the SEAF 402. In response, the SEAF 402 sends the authentication token (AUTN) and the random challenge (RAND) to the UE 106 in a NAS message authentication request message 416.

[0086] Despite Figure 4B 106 , but UE 106 includes a mobile equipment (ME) and a USIM. The ME receives the authentication token (AUTN) and the random challenge (RAND) in the NAS message Authentication Request message 416, and forwards the authentication token (AUTN) and the random challenge (RAND) to the USIM. The USIM of UE 106 verifies the freshness of the received value by checking whether the authentication token (AUTN) can be accepted. If so, the USIM calculates a response (RES), a cipher key (CK), and an integrity key (IK) based on the random challenge (RAND), and returns the response (RES), the CK key, and the IK key to the ME. The ME of UE 106 calculates RES* from RES, and calculates K from CK||IK AUSF Key, and from K AUSF Key calculation K SEAF Key.

[0087] UE 106 sends a NAS message authentication response message 417 including RES* to SEAF 402. In response, SEAF 402 calculates HRES* from RES* and compares HRES* and HXRES*. If they are consistent, SEAF 402 considers authentication successful from the perspective of the serving network. SEAF 402 sends the RES* received from UE 106 to AUSF 210 in a Nausf_UEAuthentication_Authenticate request message 418. When AUSF 210 receives the Nausf_UEAuthentication_Authenticate request message 418 including RES* as authentication confirmation, AUSF 210 stores K based on the policy of the home network operator. AUSFThe AUSF 210 receives the key RES* and compares the received RES* with the stored XRES*. If RES* and XRES* are equal, then the AUSF 210 considers the authentication successful from the perspective of the home network. The AUSF 210 notifies the UDM 218 of the authentication result (not shown). The AUSF 210 also sends a Nausf_UEAuthentication_Authenticate response message 419 to the SEAF 402, which indicates whether the authentication is successful from the perspective of the home network. If the authentication is successful, the K is returned in the Nausf_UEAuthentication_Authenticate response message 419. SEAF The key is sent to the SEAF 402. In case the AUSF 210 receives the SUCI from the SEAF 102 in the authentication request, the AUSF 210 shall include the SUPI in the Nausf_UEAuthentication_Authenticate response message 419 if the authentication is successful.

[0088] As described above, 5G divides UE management into non-access stratum (NAS) and access stratum (AS). The NAS layer protocol manages the connection between UE 106 and 5GC 104 (ie, AMF 212), and the AS layer protocol uses the RRC protocol to manage the radio layer between UE 106 and RAN 102 (eg, gNB 302). NAS security ensures that NAS signaling between UE 106 and AMF 212 is protected on the control plane, and AS security ensures that RRC messages on the control plane and user plane traffic (eg, IP packets) on the user plane are protected.

[0089] Figure 5 NAS and AS security procedures are illustrated (such as described in 3GPP TS 33.501 (Sections 6.4 and 6.7, respectively). For NAS security, a NAS Security Mode Command procedure is performed to establish a NAS security context between the UE 106 and the AMF 212. Each AMF 212 is configured with a list of algorithms allowed to be used via network management. Currently, there is one list for NAS integrity algorithms and one list for NAS ciphering algorithms ranked according to operator-determined priorities. To establish a NAS security context, the AMF 212 selects a NAS ciphering algorithm and a NAS integrity protection algorithm, and derives the NAS integrity key and NAS ciphering key (e.g., K NASint and K NASenc). The AMF 212 initiates the NAS security mode command procedure by sending a NAS security mode command message 511 to the UE 106. The AMF 212 activates NAS integrity protection before sending the NAS security mode command message 511. The NAS security mode command message 511 contains the previously received UE security capabilities, the selected NAS algorithm, the key set identifier (i.e., ngKSI (next generation key set identifier)), and the message authentication code (NAS-MAC) generated by the AMF 212 for integrity protection of the NAS security mode command message 511. The NAS security mode command message 511 is based on the K indicated by the ngKSI. AMF The NAS integrity key of the key is integrity protected (but not encrypted). The AMF 212 activates NAS uplink decryption after sending the NAS Security Mode Command message 511.

[0090] Upon receiving the NAS Security Mode Command message 511, UE 106 uses the indicated NAS integrity algorithm and the K based on the K indicated by ngKSI. AMF 511. The UE 106 verifies the integrity of the NAS security mode command message 511 using the NAS integrity key of the key. The UE 106 generates a NAS integrity key and a NAS cipher key in the same manner as the AMF 212 using the received algorithm. If the verification is successful, the UE 106 starts NAS integrity protection and encryption / decryption using the security context indicated by the ngKSI. The UE 106 sends an encrypted and integrity-protected NAS security mode complete message 512 to the AMF 212. If the verification of the NAS security mode command message 511 is unsuccessful, the UE 106 replies with a NAS security mode reject message (not shown).

[0091] The AMF 212 decrypts the received NAS Security Mode Complete message 512 and checks its integrity using the key and algorithm indicated in the NAS Security Mode Command message 511. The AMF 212 activates NAS downlink encryption after receiving the NAS Security Mode Complete message 512.

[0092] AS security includes RRC security and user plane (UP) security. For RRC security, RRC integrity protection and RRC confidentiality protection are provided by the packet data convergence protocol (PDCP) layer between the UE 106 and the gNB 302. For UP security, the SMF 214 provides the gNB 302 (or ng-eNB) with a UP security policy for a packet data unit (PDU) session during a PDU session establishment procedure (not shown). The UP security policy indicates whether UP confidentiality and / or UP integrity protection is activated for the data radio bearers (DRBs) belonging to the PDU session.

[0093] The AS security mode command procedure is performed to establish an AS security context between the UE 106 and the NG-RAN 502. When the AS security context is to be established in the gNB 302, the AMF 212 sends the UE 5G security capabilities with the encryption and integrity protection algorithms and the K in the NG Application Protocol (NGAP) Initial Context Setup message 513 to the NG-RAN 502 (e.g., gNB 302). gNB Keys. Currently, each gNB 302 is configured via network management with a list of algorithms that are allowed to be used. There is one list for integrity algorithms and one list for ciphering algorithms ordered according to operator-determined priorities. The gNB 302 selects the AS integrity algorithm and AS ciphering algorithm from its configured lists that have the highest priority and are present in the UE5G security capabilities received from the AMF 212. The gNB 302 derives the RRC integrity key (K RRCint ), UP integrity key (K UPint ), RRC encryption key (K RRCenc ) and UP encryption key (K UPenc ). gNB 302 starts integrity protection for RRC messages.

[0094] The gNB 302 sends an integrity protected AS security mode command message 514 to the UE 106, which contains the selected AS integrity algorithm and AS encryption algorithm and a message authentication code (MAC-I) generated by the gNB 302 for integrity protection of the AS security mode command message 514. RRC downlink encryption at the gNB 302 starts after the AS security mode command message 514 is sent.

[0095] Upon receiving the AS security mode command message 514, the UE 106 derives an RRC integrity key (K) similar to that of the gNB 302 based on the selected AS integrity algorithm and the AS encryption algorithm. RRCint ) and the RRC encryption key (K RRCenc ). UE 106 verifies the AS security mode command integrity and, if successful, starts RRC integrity protection and RRC downlink decryption. UE 106 then sends an AS security mode complete message 515 with integrity protection to gNB 302. AS security mode complete message 515 contains a MAC-I generated by UE 106 for integrity protection of AS security mode complete message 515. RRC uplink ciphering at UE 106 starts after sending AS security mode complete message 515. The integrity of AS security mode complete message 515 is verified at gNB 302 and gNB 302 starts RRC uplink decryption.

[0096] Furthermore, as part of AS security, Figure 6 UP security activation is illustrated. AS UP integrity protection and ciphering activation is done as part of the DRB addition procedure using the RRC connection reconfiguration procedure. The RRC connection reconfiguration procedure used to add DRBs is performed after RRC security is activated as part of the AS security mode command procedure. The gNB 302 sends an RRC connection reconfiguration message 611 to the UE 106 for UP security activation. The RRC connection reconfiguration message 611 contains an indication of UP integrity protection and UP ciphering for each DRB activated in accordance with the security policy. If UP integrity protection is activated for a DRB as indicated in the RRC connection reconfiguration message 611 and the gNB 302 does not have K UPint key, gNB 302 derives K Upint Key, and UP integrity protection for DRBs starts at gNB 302. Similarly, if UP encryption is activated for DRBs as indicated in RRC Connection Reconfiguration message 611, and gNB 302 does not have K UPenc key, gNB 302 derives K UPenc keys, and UP encryption for DRB starts at gNB 302.

[0097] Upon receiving the RRC connection reconfiguration message 611, the UE 106 verifies the RRC connection reconfiguration integrity protection. If successful, the UE 106 performs the following operations. As indicated in the RRC connection reconfiguration message 611, when UP integrity protection is activated for DRBs and the UE 106 does not have K UPint When the key is generated, UE 106 derives K Upint The key is used and UP integrity protection for DRBs begins at UE 106. Similarly, as indicated in RRC Connection Reconfiguration message 611, when UP ciphering is activated for DRBs and UE 106 does not have K UPenc When the key is generated, UE 106 derives K UPenc The key is set, and UP encryption for DRB starts at UE 106. UE 106 sends an RRC connection reconfiguration complete message 612 to gNB 302.

[0098] Figure 7 The key hierarchy 700 of the 5G system 100 (such as in 3GPP TS 33.501 (Section 6.2)) is illustrated. The keys related to authentication include the following keys: K 701 and CK / IK 702. The key hierarchy 700 includes the following keys: K AUSF 703, K SEAF704, K AMF 705, K NASint 706, K NASenc 707, K N3IWF 708, K gNB 709, K RRCint 710, K RRCenc 711, K UPint 712 and K UPenc 713. The keys for AUSF 210 in the home network 404 include: K derived from CK', IK' (in the case of EAP-AKA') by the ME of UE 106 and AUSF 210, or K derived from CK, IK 702 (in the case of 5G AKA) by the ME and ARPF of UDM 218. AUSF Key 703. K SEAF Key 704 is obtained by ME and AUSF 210 from K AUSF The anchor key derived from key 703. The key for AMF 212 in the service network 406 is obtained by ME and SEAF 402 from K SEAF Key 704 derived K AMF Key 705. The keys for NAS signalling (i.e., NAS security context) include the keys obtained by the ME and AMF 212 from K AMF Key 705 derived K NASint Key 706, which is used for integrity protection of NAS signaling with a specific integrity algorithm. The keys used for NAS signaling also include the keys obtained by ME and AMF 212 from K AMF Key 705 derived K NASenc Key 707, which is used for encryption of NAS signaling with a specific encryption algorithm. The key used for NG-RAN is obtained by ME and AMF 212 from K AMF Key 705 derived K gNB Key 709. For the AS security context, the key used for RRC signaling includes the key obtained by ME and gNB 302 from K gNB Key 709 derived K RRCint Key 710, which is used for integrity protection of RRC signaling with a specific integrity algorithm. The key used for RRC signaling also includes the key obtained by ME and gNB 302 from K gNB Key 709 derived K RRCenc Key 711, which is used for encryption of RRC signaling with a specific encryption algorithm. The key used for UP services includes the key obtained by ME and gNB 302 from K gNB Key 709 derived K UPintKey 712, which is used to protect the integrity of UP services between the ME and gNB 302 using a specific integrity algorithm. The key for UP services also includes the key obtained by the ME and gNB 302 from K gNB Key 709 derived K UPenc Key 713, which is used to encrypt UP services with a specific encryption algorithm. For non-3GPP access, K N3IWF Key 708 is obtained by ME and AMF 212 from K for non-3GPP access AMF Key 705 is derived. There are other keys that are part of the key hierarchy 700 of the 5G system 100, which are not discussed for the sake of brevity.

[0099] Figure 8 An integrity algorithm (NIA) 800 is illustrated (such as shown in Annex D.3 of 3GPP TS 33.501). Currently, the input parameters 802 to the integrity algorithm 800 are a 128-bit integrity key called KEY, a 32-bit COUNT, a 5-bit bearer identity called BEARER, a 1-bit direction of transmission (i.e., DIRECTION), and the integrity protected message (i.e., MESSAGE). The DIRECTION bit is set to "0" for the uplink and to "1" for the downlink. The bit length of MESSAGE is LENGTH. Based on the input parameters 802, the transmitter 810 uses the integrity algorithm 800 to calculate a 32-bit message authentication code (MAC-I / NAS-MAC) as output 804. The MAC is then attached to the message when it is sent. For the integrity protection algorithm, the receiver 812 calculates the expected MAC (XMAC-I / XNAS-MAC) on the received message as output 804 in the same manner as the transmitter 810 calculates its MAC on the sent message, and verifies the data integrity of the message by comparing the calculated MAC with the received MAC (i.e., MAC-I / NAS-MAC). Examples of 128-bit integrity algorithms 800 are 128-NIA1, 128-NIA2, and 128-NIA3.

[0100] Fig. 9An encryption or integrity algorithm (NEA) 900 is illustrated (such as shown in Annex D.2 of 3GPP TS 33.501). Currently, the input parameters 902 to the encryption algorithm 900 are a 128-bit cryptographic key called KEY, a 32-bit COUNT, a 5-bit bearer identity BEARER, a 1-bit direction of transmission (i.e., DIRECTION), and the length of the required key stream (i.e., LENGTH). The DIRECTION bit is set to "0" for the uplink and is set to "1" for the downlink. Based on the input parameters 902, the encryption algorithm 900 generates a key stream block (i.e., KEYSTREAM) as an output 904, which is used to encrypt a plaintext block (i.e., PLAINTEXT) to produce a ciphertext block (i.e., CIPHERTEXT). The key stream is applied to the plaintext block using a bit-by-bit binary addition (XOR) of the plaintext and the key stream. The plaintext can be recovered by generating the same key stream using the same input parameters 902 and applying bit-by-bit binary addition using the ciphertext. Examples of 128-bit encryption algorithms 900 are 128-NEA1, 128-NEA2, and 128-NEA3.

[0101] There is a goal to continue to improve or enhance the security mechanisms in 5G systems 100 and higher systems. For example, the security mechanism can upgrade the 128-bit algorithm to a 256-bit algorithm. Further, the existing security mechanism utilizes a separate integrity algorithm (e.g., Figure 8 NIA 800) and encryption algorithms (e.g. Fig. 9 The NEA 900 in FIG. 9A ) each uses separate integrity code generation and encryption steps (using separate keys). The embodiments described herein set forth an enhanced security mechanism that implements a combined integrity and encryption algorithm in place of or in addition to a separate integrity algorithm and encryption algorithm. The combined integrity and encryption algorithm described herein is configured to apply or provide encryption / encryption and integrity protection using a single key. The combined integrity and encryption algorithm may also be referred to as a combined algorithm, a next generation combined algorithm (NCA), a combined security algorithm, an associated data authenticated encryption (AEAD) algorithm, and the like.

[0102] Fig. 10AA combining algorithm (NCA) 1000 in an illustrative embodiment is illustrated. The combining algorithm 1000 is configured to generate an output 1004 based on input parameters 1002. In an embodiment, the input parameters 1002 to the combining algorithm 1000 include a combined integrity and encryption (CIE) key 1010 (e.g., 256 bits), a 32-bit count 1011 (e.g., an uplink (UL) or downlink (DL) count), a 5-bit bearer identity 1012, a message 1013 including plaintext to be encrypted or ciphertext to be decrypted, and a 1-bit direction 1014 (i.e., transmission direction). For example, the direction 1014 may be "0" for an uplink and "1" for a downlink.

[0103] In an embodiment, the input parameters 1002 may also include additional authentication data (AAD) 1015, AAD length 1016, additional entropy data 1017 (EXTRA), and encryption / decryption mode 1018. AAD 1015 includes an identifier or information (e.g., a value between 0 and 232-1 bits) for generating a message authentication code (MAC). AAD 1015 may be known to both the transmitter 810 and the receiver 812. AAD 1015 may include an actual number of bits without filling to all bits, and may have a maximum length of 32 bits. AAD length 1016 indicates the length of AAD 1015. Extra entropy data 1017 includes a random number generated by the network (i.e., in 5GC 104 or RAN 102), which is used for the generation of MAC. Extra entropy data 1017 may be exchanged or shared with UE 106 during the security mode command process. The length of extra entropy data 1017 may be 6 bytes. The encryption / decryption mode 1018 indicates whether the combined algorithm 1000 is used for encryption or decryption. For example, the encryption / decryption mode 1018 may be a 1-bit value of "0" for encryption and "1" for decryption.

[0104] At the transmitter 810, the combined algorithm 1000 calculates a 32-bit MAC 1020 (e.g., MAC-I / NAS-MAC) and / or ciphertext 1022 as output 1004 based on the input parameters 1002. The range of MAC length values ​​allowed in the combined algorithm 1000 is "0" and "4...16". The MAC 1020 is appended to the message when it is sent. For integrity protection, the receiver 812 calculates the expected MAC 1024 (e.g., XMAC-I / XNAS-MAC) on the received message as output 1004 in the same manner as the transmitter 810 calculates its MAC 1020 on the message sent using the combined algorithm 1000, and verifies the data integrity of the message by comparing the expected MAC 1024 with the received MAC 1020. For encryption protection, the combined algorithm 1000 generates ciphertext 1022 at the transmitter 810 based on the input parameters 1002. By inputting the encrypted text 1022 into the combined algorithm 1000, the plaintext can be recovered as decrypted text 1026 at the receiver 812. One technical advantage is that the combined algorithm 1000 can be used in a security mechanism in place of or in addition to separate integrity algorithms and encryption algorithms.

[0105] Fig. 10B The NAS combining algorithm 1050 (NASNCA) in an illustrative embodiment is shown. The NAS combining algorithm 1050 is Fig. 10A The NAS combination algorithm 1050 is configured based on the input parameters 1002 and K NASaead The key is used to generate NAS-MAC 1052 or XNAS-MAC 1054 and encrypted text 1022 or decrypted text 1026. For the NAS combination algorithm 1050, the count 1011 may include a NAS count. AAD 1015 may include information or identifiers known to both AMF 212 and UE 106. For example, AAD 1015 may include 5G Temporary Mobile Subscriber Identity (5G-TMSI) 1056, truncated (i.e., 32-bit) 5G-S-TMSI 1057 (e.g., truncated AMF set ID, truncated AMF pointer, and truncated 5G-TMSI), network slice selection assistance information (S-NSSAI) 1058, etc. The additional entropy data 1017 may include a random number generated by AMF 212 and exchanged or shared with UE 106 during the NAS security mode command process. One technical advantage is that the NAS combination algorithm 1050 can be used for NAS security mechanisms instead of or in addition to a separate integrity algorithm and encryption algorithm.

[0106] Fig. 10CThe AS combination algorithm 1060 (AS NCA) in the illustrative embodiment is shown. The AS combination algorithm 1060 is Fig. 10A The AS combination algorithm 1060 is configured to be based on the input parameters 1002 and K RRCaead Key or K UPaead The key generates MAC-I 1062 or XMAC-I 1064 and the encrypted text 1022 or decrypted text 1026. For the AS combination algorithm 1060, the count 1011 may include a PDCP count. The AAD 1015 may include information or identifiers known to both the gNB 302 and the UE 106. For example, the AAD 1015 may include a radio network temporary identifier (RNTI) 1066, a physical cell identifier (PCI) 1067, a combination of RNTI and PCI, etc. The additional entropy data 1017 may include a random number generated by the gNB 302 and exchanged or shared with the UE 106 during the AS security mode command process. Alternatively, the additional entropy data 1017 may include a random number generated by the AMF 212 and exchanged or shared with the UE 106 during the NAS security mode command process. One technical advantage is that the AS combination algorithm 1060 can be used for RRC or UP security mechanisms instead of or in addition to a separate integrity algorithm and encryption algorithm.

[0107] In an embodiment, one or more of the combined algorithms 1000 described herein may support multiple modes of operation. Fig. 10D1080 is a block diagram illustrating different modes of operation 1080 of the combined algorithm 1000 in an illustrative embodiment. Although the combined algorithm 1000 may be capable of or configured to perform both integrity protection and encryption using a (single) CIE key 1010, the combined algorithm 1000 may be encoded to operate in at least the following modes of operation 1080: an integrity and encryption mode 1081, an integrity mode without encryption 1082, an encryption mode without integrity protection 1083, and a null encryption and null integrity mode 10804. In the integrity and encryption mode 1081, the combined algorithm 1000 uses the CIE key 1010 to apply both encryption and integrity protection. For example, the combined algorithm 1000 may recursively use encrypted data and non-encrypted data to generate an integrity MAC. In the integrity mode 1082, the combined algorithm 1000 uses the CIE key 1010 to apply integrity protection to plaintext messages, but no encrypted data is sent in the communication. In encryption mode 1083, the combined algorithm 1000 applies encryption to the plaintext message using the CIE key 1010, but no MAC is sent in the communication, or if a MAC is sent, it is ignored by the receiver. In null encryption and null integrity mode 1084, the combined algorithm 1000 applies neither encryption nor integrity protection to the message.

[0108] The integrity mode 1082 may include different modes of operation, depending on the encoding of the combined algorithm 1000. In an embodiment, the integrity mode 1082 may include ignore encryption and integrity mode 1085, in which the combined algorithm 1000 applies integrity protection and encryption to the plaintext message using the CIE key 1010, but the encrypted data is ignored. In an embodiment, the integrity mode 1082 may include null encryption and integrity mode 1086, in which the combined algorithm 1000 applies integrity protection and null encryption to the plaintext message using the CIE key 1010. In the case of the null encryption setting, the combined algorithm 1000 does not output encrypted data. Although some example modes of operation 1080 are described above, other modes of operation 1080 may be considered herein. One technical advantage is that the combined algorithm 1000 can be used for different types of protection (e.g., encryption only, integrity protection only, encryption and integrity protection, etc.).

[0109] In order to maintain the cryptographic isolation principle, the key used for combining algorithm 1000 is different from the separate keys used for encryption and for integrity protection. Fig.11 An enhanced key hierarchy 1100 of the 5G system 100 in an illustrative embodiment is illustrated. In this embodiment, the keys related to authentication include the following keys: K 701, and CK / IK 702. The key hierarchy 1100 includes the following keys: K AUSF 703, K SEAF 704, KAMF 705, K NASaead 1114, K N3IWF 708, K gNB 709, K RRCaead 1115, and K UPaead 1116. The keys for AUSF 210 in the home network 404 include K derived from CK', IK' (in the case of EAP-AKA') by the ME of UE 106 and AUSF 210, or from CK, IK 702 (in the case of 5G AKA) by the ME and ARPF of UDM 218. AUSF Key 703. K SEAF Key 704 is obtained by ME and AUSF 210 from K AUSF The anchor key derived from key 703. The key for AMF 212 in the service network 406 is obtained by ME and SEAF 402 from K SEAF Key 704 derived K AMF Key 705. The keys for NAS signalling (i.e., NAS security context) include the keys obtained by the ME and AMF 212 from K AMF Key 705 derived K NASaead Key 1114, which is used to protect NAS signaling between ME and gNB 302 using a specific combination algorithm 1000 (e.g., NAS combination algorithm 1050). The key used for NG-RAN is obtained by ME and AMF 212 from K AMF Key 705 derived K gNB Key 709. For the AS security context, the key used for RRC signaling includes the key obtained by ME and gNB 302 from K gNB Key 709 derived K RRCaead Key 1115, which is used to protect the RRC signaling between the ME and the gNB 302 using a specific combination algorithm 1000 (e.g., AS combination algorithm 1060). The key used for UP services includes the key obtained by the ME and the gNB 302 from K gNB Key 709 derived K UPaead Key 1116, which is used to protect UP signaling between ME and gNB 302 using a specific combining algorithm 1000 (e.g., AS combining algorithm 1060). For non-3GPP access, K N3IWF Key 708 is obtained by ME and AMF 212 from K for non-3GPP access AMF Key 705 is derived. There are other keys that are part of the key hierarchy 1100 of the 5G system 100, which are not discussed for the sake of brevity.

[0110] K in the key hierarchy 1100 NASaeadKey 1114, K RRCaead Key 1115 and K UPaead Keys 1116 may be referred to as CIE keys 1010 because they are used to protect communications with the combined (integrity and encryption) algorithm 1000 . Fig.12 1 is a block diagram illustrating an algorithm key derivation function (KDF) 1200 in an illustrative embodiment, which is used to generate or derive a CIE key 1010. The input parameters of the algorithm KDF 1200 and their lengths are concatenated into a string S as follows: S=FC||P0||L0||P1||L1||P2||L2||P3||L3||...||Pn||Ln. FC is used to distinguish different instances of the algorithm. P0...Pn are n+1 input parameter encodings, and L0...Ln are two octet representations of the lengths of the corresponding input parameter encodings P0...Pn. When deriving the CIE key 1010, the following input parameters may be used to form a string S1204 that is input to the algorithm KDF 1200:

[0111] -fc=0x69,

[0112] -P0 = algorithm type specifier,

[0113] - L0 = length of the algorithm type specifier (i.e., 0x00 0x01),

[0114] - P1 = algorithm identity,

[0115] - L1 = length of the algorithm identity (ie, 0x00 0x01).

[0116] When deriving the CIE key 1010 (i.e., K NASaead When the key 1114 is used, the input key 1206 to the algorithm KDF 1200 is K AMF Key 705. When deriving the CIE key 1010 (i.e., K RRCaead Key 1115 or K UPaead Key 1116), the input key 1206 to the algorithm KDF1200 is K gNB Key 709.

[0117] Fig.13A table 1300 of algorithm type specifiers 1302 in an illustrative embodiment is illustrated. For the algorithm KDF 1200 described above, the algorithm type specifier 1302 is "N-NAS-enc-alg" for the NAS encryption algorithm and "N-NAS-int-alg" for the NAS integrity algorithm, and "N-RRC-enc-alg" for the RRC encryption algorithm, "N-RRC-int-alg" for the RRC integrity algorithm, "N-UP-enc-alg" for the UP encryption algorithm, and "N-UP-int-alg" for the UP integrity algorithm, as described in Table A.8-1 of Annex A.8 of 3GPP TS 33.501. Table 1300 represents an enhancement to Table A.8-1 of Annex A.8 and includes additional algorithm type specifiers 1302 for the combined algorithm 1000. In an embodiment, a NAS algorithm type discriminator 1302-1 (e.g., "N-NAS-AEAD-alg") may be defined for a NAS combining algorithm 1050, an RRC algorithm type discriminator 1302-2 (e.g., "N-RRC-AEAD-alg") may be defined for an AS combining algorithm 1060 for protecting RRC signaling, and a UP algorithm type discriminator 1302-3 (e.g., "N-UP-AEAD-alg") may be defined for an AS combining algorithm 1060 for protecting UP traffic. In this embodiment, the value 1304 for the NAS algorithm type discriminator 1302-1 may be "0x07", the value 1304 for the RRC algorithm type discriminator 1302-2 may be "0x008", and the value 1304 for the UP algorithm type discriminator 1302-3 may be "0x09", although other values ​​are contemplated herein. One technical advantage is that the new algorithm type specifier 1302 allows the derivation of a new CIE key 1010 (i.e., K NASaead Key 1114, K RRCaead Key 1115 and K UPaead Key 1116).

[0118] The enhanced security mechanisms are described in further detail below. Typically, these mechanisms are implemented via one or more 5G network functions (e.g., AMF 212), one or more RAN nodes (e.g., gNB 302), and UE 106. A block diagram of these elements is provided below.

[0119] Fig.1414 is a block diagram of a UE 106 in an illustrative embodiment. From a functional perspective, the UE 106 consists of at least two parts: a mobile equipment (ME) 1400 and a universal subscriber identity module (USIM) 1460. The ME 1400 includes a radio interface component 1402, one or more processors 1404, a memory 1406, and a user interface component 1408. The UE 106 may also include a battery 1410. The radio interface component 1402 is a hardware component or component representing the local radio resources of the UE 106, such as a radio frequency (RF) unit 1420 (e.g., one or more radio transceivers) and one or more antennas 1422. The radio interface component 1402 may be configured for 5G New Radio (NR), Long Term Evolution (LTE), WiFi, Bluetooth, etc. The processor 1404 represents the internal circuit system, logic, hardware, components, etc. that provide the functions of the UE 106. The processor 1404 may be configured to execute instructions 1440 for software loaded into the memory 1406. The processor 1404 may execute an operating system (OS) 1434 of the UE 106 for managing hardware and software resources, and one or more application clients 1435. The processor 1404 may also execute a security controller 1436, which includes components or parts for executing security mechanisms within the UE 106 (i.e., within the ME 1400). The user interface component 1408 is a hardware component for interacting with an end user. For example, the user interface component 1408 may include a display 1450, a screen, a touch screen, etc. (e.g., a liquid crystal display (LCD), a light emitting diode (LED) display, etc.). The user interface component 1408 may include a keyboard or keypad, a tracking device (e.g., a trackball or trackpad), a speaker, a microphone, etc.

[0120] The USIM 1460 is an integrated circuit that provides security and integrity functions for the UE 106. The USIM 1460 includes or is provided with a subscription profile associated with a subscriber's subscription. The subscription profile may include various information, such as subscription credentials (e.g., SUPI) used to uniquely identify the subscription and mutually authenticate the UE 106 and the network.

[0121] UE 106 may include Fig.14 Various other components specifically illustrated in FIG.

[0122] Fig.151504 is a block diagram of the AMF 212 in an illustrative embodiment. The AMF 212 is a network element or network function configured to provide registration management for UEs. In this embodiment, the AMF 212 includes the following subsystems: a network interface component 1502, and an access and mobility controller 1504 operating on one or more platforms. The network interface component 1502 may include circuit systems, logic, hardware, components, etc. configured to exchange control plane messages or signaling with other network elements and / or UEs. The network interface component 1502 may operate using various protocols or reference points. The access and mobility controller 1504 may include circuit systems, logic, hardware, components, etc. configured to support the operations, processes, or functions of the AMF.

[0123] One or more of the subsystems of AMF 212 may be implemented on a hardware platform including analog and / or digital circuitry. One or more of the subsystems of AMF 212 may be implemented on one or more processors 1530 that execute instructions 1534 (i.e., computer readable code) for software loaded into memory 1532. One or more of the subsystems of AMF 212 may be implemented on a cloud computing platform or another type of processing platform.

[0124] AMF 212 may include Fig.15 Various other components specifically illustrated in FIG.

[0125] Fig.16 1 is a block diagram of a RAN node 1600 in an illustrative embodiment. The RAN node 1600 includes servers, devices, apparatuses, equipment (including hardware), systems, network elements, components, etc. of the RAN 102 (or NG-RAN) that provide connectivity between the UE 106 and the 5GC 104. In this embodiment, the RAN node 1600 includes the following subsystems: a radio interface component 1602, a network interface component 1604, and a node controller 1606 operating on one or more platforms. The radio interface component 1602 may include circuit systems, logic, hardware, components, etc. configured to exchange messages or signaling with the UE via an air interface. The radio interface component 1602 may be configured for 5G NR, LTE, WiFi, Bluetooth, etc. The network interface component 1604 may include circuit systems, logic, hardware, components, etc. configured to exchange messages or signaling with other network elements or network functions (such as the 5GC 104). The network interface component 1604 may operate using various protocols or reference points. The node controller 1606 may include circuit systems, logic, hardware, components, etc. configured to support operations or processes performed in the RAN node 1600 of the 5G system 100. Fig.16As illustrated, the RAN node 1600 may represent a gNB 302, a component of a gNB 302 (e.g., a centralized unit (CU), a distributed unit (DU) and / or a radio unit (RU)), or another type of base station or an NG base station.

[0126] One or more of the subsystems of the RAN node 1600 may be implemented on a hardware platform including analog and / or digital circuit systems. One or more of the subsystems of the RAN node 1600 may be implemented on one or more processors 1630 that execute instructions 1634 (i.e., computer readable code) for software loaded into the memory 1632. The processor 1630 includes an integrated hardware circuit configured to execute instructions 1634 to provide the functions of the RAN node 1600. The processor 1630 may include a collection of one or more processors, or may include a multi-processor core, depending on the specific implementation. The memory 1632 is a non-transitory computer-readable storage medium for data, instructions, applications, etc., and is accessible by the processor 1630. The memory 1632 is a hardware storage device capable of temporarily and / or permanently storing information. The memory 1632 may include a random access memory, or any other volatile or non-volatile storage device.

[0127] The RAN node 1600 may include Fig.16 Various other components specifically illustrated in FIG.

[0128] Fig.17The NAS function layer 1702 and the AS function layer 1704 of the 5G system 100 in an illustrative embodiment are illustrated. The UE 106 is operably coupled to the 5G network 101. In general, communication 1710 (also referred to as 5G communication) may occur between the UE 106 and the 5G network 101, and the communication 1710 may be protected via the above-described combined algorithm 1000. The NAS function layer 1702 is located between the UE 106 and the AMF 212 (or mobility management entity (MME)), and thus, NAS signaling 1712 may be exchanged between the UE 106 and the AMF 212. The AS function layer 1704 is located between the UE 106 and the RAN node 1600 (e.g., the gNB 302), and thus, RRC signaling 1714 and UP traffic 1716 may be exchanged between the UE 106 and the RAN node 1600. In communication 1710, a message 1720 may be sent from UE 106 to 5G network 101, or vice versa. For example, message 1720 may include NAS message 1722 (e.g., NAS signaling message), RRC message 1724 (e.g., RRC signaling message), UP message 1726 (e.g., IP packet), etc. Message 1720 sent by transmitter 810 may be referred to as a "sent" message, and message 1720 received by receiver 812 may be referred to as a "received" message. Similar language applies to signaling, user plane data, etc.

[0129] Figures 18A to 18E 1 is a flowchart illustrating a method of performing a security mechanism in a 5G system 100 in an illustrative embodiment. Figures 18A to 18E The steps of the method in the flowchart described herein are not all-inclusive and may include other steps not shown, and these steps may be performed in an alternative order.

[0130] Fig.18A 1 is a flow chart illustrating a method 1800 for executing a security mechanism for messages 1720 or communications 1710 exchanged between a UE 106 and a 5G network 101 (e.g., an AMF 212 or a RAN node 1600). For the security mechanism, the UE 106 and the 5G network 101 identify a combined algorithm 1000 (step 1802) to protect the message 1720. The UE 106 and the 5G network 101 derive a CIE key 1010 for the combined algorithm 1000 (step 1804). For example, the UE 106 and the 5G network 101 may utilize the algorithm KDF 1200 to derive a CIE key 1010 such as Fig.121720 (optional step 1812). When operating as a transmitter 810 of message 1720, UE 106 or 5G network 101 applies the combined algorithm 1000 to message 1720 (i.e., the message being sent) using CIE key 1010 as input parameter 1002 to provide security protection to message 1720 (step 1806). For example, the transmitter 810 may apply integrity protection, encryption, or both using the combined algorithm 1000. In an embodiment, the combined algorithm 1000 may support the above-mentioned multiple operating modes 1080. Therefore, UE 106 and 5G network 101 may identify the operating mode 1080 of the combined algorithm 1000 for security protection of message 1720 (step 1810), and the transmitter 810 may apply integrity protection, encryption, or both using the combined algorithm 1000 based on the operating mode 1080 selected for message 1720 (step 1814).

[0131] When operating as a receiver 812 of message 1720, UE 106 or 5G network 101 applies combined algorithm 1000 to message 1720 (i.e., the received message) using CIE key 1010 as input parameter 1002 (step 1808). Receiver 812 applies combined algorithm 1000 to decrypt message 1720 and / or verify the integrity of message 1720, depending on the type of security protection applied by sender 810. One technical advantage is that the security of message 1720 is improved using combined algorithm 1000 configured to perform both integrity protection and encryption.

[0132] Fig.18B 18 is a flow chart illustrating a method 1820 for performing integrity protection on a message 1720. Fig. 10A As described in , the input parameters 1002 to the combined algorithm 1000 include AAD 1015 and additional entropy data 1017. AAD 1015 and additional entropy data 1017 are used to generate MAC 1020 or XMAC 1024 for integrity protection. Therefore, UE 106 and 5G network 101 identify AAD 1015 (step 1822) and / or additional entropy data 1017 (step 1824). As described above, AAD 1015 can be known by UE 106 and 5G network 101, and additional entropy data 1017 can be shared between 5G network 101 and UE 106 during the security mode command process (optional step 1828). The UE 106 and the 5G network 101 apply the combined algorithm 1000 using the AAD 1015 and / or the additional entropy data 1017 as input parameters 1002 to generate a MAC 1020 or an XMAC 1024 (step 1826). One technical advantage is that the AAD 1015 and / or the additional entropy data 1017 make the derivation of the MAC more robust.

[0133] Fig.18C 18 is a flow chart illustrating a method 1840 for performing a NAS security mechanism on NAS signaling 1712 (e.g., NAS message 1722) exchanged between a UE 106 and an AMF 212. For the NAS security mechanism, the UE 106 and the AMF 212 identify a NAS combining algorithm 1050 (step 1842) to protect the NAS signaling 1712. The UE 106 and the AMF 212 derive a NAS CIE key 1010 (e.g., K NASaead 1044). When operating as a transmitter 810 of the NAS signaling 1712, the UE 106 or AMF 212 applies the NAS combining algorithm 1050 to the NAS signaling 1712 (i.e., the NAS signaling being sent) using the NAS CIE key 1010 as an input parameter 1002 to provide security protection to the NAS signaling 1712 (step 1846). For example, the transmitter 810 may utilize the NAS combining algorithm 1050 to apply integrity protection, encryption, or both. In an embodiment, the NAS combining algorithm 1050 may support the above-described multiple modes of operation 1080. Thus, the UE 106 and the AMF 212 may identify an operating mode 1080 of the NAS combining algorithm 1050 for security protection of the NAS signaling 1712 (step 1850), and the transmitter 810 may apply integrity protection, encryption, or both using the NAS combining algorithm 1050 based on the operating mode 1080 selected for the NAS signaling 1712 (step 1852).

[0134] Typically, NAS security mode command and NAS security mode complete messages are integrity protected but not encrypted. Therefore, if NAS signaling 1712 includes a NAS security mode command or a NAS security mode complete message, then the transmitter 810 may apply integrity protection (e.g., integrity mode 1082) without encryption. After the NAS security mode command procedure, the NAS signaling 1712 may be integrity protected and encrypted. Therefore, the transmitter 810 may apply integrity protection and encryption (e.g., integrity and encryption mode 1081) to the NAS signaling 1712 following the NAS security mode command procedure.

[0135] When operating as a receiver 812 of NAS signaling 1712, the UE 106 or AMF 212 applies the NAS combining algorithm 1050 to the NAS signaling 1712 (i.e., the received NAS signaling) using the NAS CIE key 1010 as an input parameter 1002 (step 1848). The receiver 812 applies the NAS combining algorithm 1050 to decrypt the NAS signaling 1712 and / or verify the integrity of the NAS signaling 1712, depending on the type of security protection applied by the sender 810. One technical advantage is that NAS security procedures are improved using the NAS combining algorithm 1050 configured to perform both integrity protection and encryption.

[0136] Fig.18D 18 is a flow chart illustrating a method 1860 for performing an RRC security mechanism on RRC signaling 1714 exchanged between a UE 106 and a gNB 302. For the RRC security mechanism, the UE 106 and the gNB 302 identify an AS combination algorithm 1060 (step 1862) to protect the RRC signaling 1714. The UE 106 and the gNB 302 derive an RRC CIE key 1010 (e.g., K RRCaead Key 1115) (step 1864). When operating as a transmitter 810 of RRC signaling 1714, the UE 106 or gNB 302 applies the AS combining algorithm 1060 to the RRC signaling 1714 (i.e., the RRC signaling being transmitted) using the RRC CIE key 1010 as an input parameter 1002 to provide security protection to the RRC signaling 1714 (step 1866). For example, the transmitter 810 can apply integrity protection, encryption, or both using the AS combining algorithm 1060. In an embodiment, the AS combining algorithm 1060 can support the above-mentioned multiple operating modes 1080. Thus, the UE 106 and the gNB 302 may identify an operating mode 1080 of the AS combining algorithm 1060 for security protection of the RRC signaling 1714 (step 1870), and the transmitter 810 may apply integrity protection, encryption, or both using the AS combining algorithm 1060 based on the operating mode 1080 selected for the RRC signaling 1714 (step 1872).

[0137] Typically, the AS security mode command and the AS security mode complete message are integrity protected but not encrypted. Therefore, if the RRC signaling 1714 includes the AS security mode command or the AS security mode complete message, the transmitter 810 can apply integrity protection (e.g., integrity mode 1082) without encryption. After the AS security mode command process, the RRC signaling 1714 can be integrity protected and encrypted. Therefore, the transmitter 810 can apply integrity protection and encryption (e.g., integrity and encryption mode 1081) to the RRC signaling 1714 that follows the AS security mode command process.

[0138] When operating as a receiver 812 of RRC signaling 1714, the UE 106 or gNB 302 applies the AS combining algorithm 1060 to the RRC signaling 1714 (i.e., the received RRC signaling) using the RRC CIE key 1010 as an input parameter 1002 (step 1868). The receiver 812 applies the AS combining algorithm 1060 to decrypt the RRC signaling 1714 and / or verify the integrity of the RRC signaling 1714, depending on the type of security protection applied by the transmitter 810. One technical advantage is that the RRC security process is improved using the AS combining algorithm 1060 configured to perform both integrity protection and encryption.

[0139] Fig.18E 18 is a flow chart illustrating a method 1880 for performing a UP security mechanism on UP traffic 1716 exchanged between a UE 106 and a gNB 302. For the UP security mechanism, the UE 106 and the gNB 302 identify an AS combining algorithm 1060 (step 1882) to protect the UP traffic 1716. The UE 106 and the gNB 302 derive a UP CIE key 1010 (e.g., K UPaead Key 1116) (step 1884). When operating as a transmitter 810 of UP service 1716, the UE 106 or gNB 302 applies the AS combining algorithm 1060 to the UP service 1716 using the UP CIE key 1010 as an input parameter 1002 to provide security protection for the UP service 1716 (step 1886). For example, the transmitter 810 can use the AS combining algorithm 1060 to apply integrity protection, encryption, or both. In an embodiment, the AS combining algorithm 1060 can support the above-mentioned multiple operating modes 1080. Therefore, the UE 106 and the gNB 302 can identify the operating mode 1080 of the AS combining algorithm 1060 for security protection of the UP service 1716 (step 1890), and the transmitter 810 can use the AS combining algorithm 1060 to apply integrity protection, encryption, or both based on the operating mode 1080 selected for the UP service 1716 (step 1892).

[0140] Typically, integrity protection and encryption are optional for UP traffic 1716. However, if security protection is applied, then the transmitter 810 may apply encryption (and possibly integrity protection) to the UP traffic 1716.

[0141] When operating as a receiver 812 of UP traffic 1716, the UE 106 or gNB 302 applies the AS combining algorithm 1060 to the UP traffic 1716 (i.e., the received UP traffic) using the UP CIE key 1010 as an input parameter 1002 (step 1888). The receiver 812 applies the AS combining algorithm 1060 to decrypt the UP traffic 1716 and / or verify the integrity of the UP traffic 1716, depending on the type of security protection applied by the transmitter 810. One technical advantage is that the UP security process is improved using the AS combining algorithm 1060 configured to perform both integrity protection and encryption.

[0142] As described above, before using the combining algorithm 1000 to protect the message 1720 or the communication 1710, a negotiation is performed between the UE 106 and the 5G network 101 to provide for the use of the combining algorithm 1000. Fig.19 The NAS function layer 1702 and the AS function layer 1704 in the 5G system 100 in the illustrative embodiment are illustrated. In the NAS function layer 1702, a NAS signaling connection 1912 is set up between the UE 106 and the 5G network 101 (e.g., AMF 212). In the AS function layer 1704, an RRC signaling connection is set up between the UE 106 and the RAN node 1600 (e.g., gNB 302) via one or more SRBs 1913, and a UP connection is set up via one or more DRBs 1914.

[0143] Figures 20A to 20B is a flow chart illustrating a method 2000 of negotiating a security mechanism in an illustrative embodiment. Fig.21 is a signaling diagram illustrating the negotiation of a security mechanism in an illustrative embodiment. Fig. 20A In the embodiment, the 5G network 101 identifies the security capabilities of the UE 106 when supporting one or more combination algorithms 1000 (step 2002). In an embodiment, the 5G network 101 can receive a NAS message 2111 (see FIG. 2112 ) from the UE 106 indicating the (multiple) combination algorithms 1000 supported by the UE 106. Fig.21 ) (optional step 2010), such as together with the UE security capability indicator 2101 included in the NAS message 2110. Fig. 20A, the 5G network 101 selects a combination algorithm 1000 from one or more combination algorithms 1000 supported by the UE 106 (step 2004). For example, the 5G network 101 may be configured with a list of combination algorithms 1000 allowed for use via network management, and the combination algorithms may be ranked according to a priority determined by the operator. The 5G network 101 may therefore select a combination algorithm 1000 from the list based on the capabilities of the UE 106. The 5G network 101 sends a security negotiation message indicating the selected combination algorithm 1000 to the UE 106 (step 2006). Fig.21 As shown in , the 5G network 101 sends a security negotiation message 2112 to the UE 106. The security negotiation message 2112 is a type of signaling message that includes one or more security parameters. For example, the security negotiation message 2112 may include a security mode command message. The 5G network 101 may apply integrity protection (without encryption) to the security negotiation message 2112 before sending it to the UE 106. One technical advantage is that the selected combined algorithm 1000 is shared with the UE 106 during the security negotiation process.

[0144] In an embodiment, the 5G network 101 may activate the combined algorithm 1000 (step 2008) after sending the security negotiation message 2112, such as Fig.21 However, the 5G network 101 may activate the combined algorithm 1000 before sending the security negotiation message 2112, such as applying integrity protection (without encryption) to the security negotiation message 2112. In another example, the 5G network 101 may activate the combined algorithm 1000 after receiving the security negotiation completion message 2113 from the UE 106.

[0145] In an embodiment, when the combined algorithm 1000 supports multiple (or multiple) operating modes 1080, the 5G network 101 can select the operating mode 1080 from the operating modes 1080 for the combined algorithm 1000 (optional step 2012). The 5G network 101 can therefore send a security negotiation message 2112 indicating the selected combined algorithm 1000 and the selected operating mode 1080 for the combined algorithm 1000 to the UE 106 (optional step 2018). One technical advantage is that the operating mode 1080 of the selected combined algorithm 1000 is shared with the UE 106 during the security negotiation process.

[0146] In an embodiment, the input parameters 1002 of the combined algorithm 1000 selected by the 5G network 101 may include the AAD 1015 and / or the additional entropy data 1017 used in generating the MAC 1020 or XMAC 1024 for integrity protection. Therefore, the 5G network 101 may identify the AAD 1015 (optional step 2014) and / or the additional entropy data 1017 (optional step 2016). The 5G network 101 may therefore send a security negotiation message 2112 containing the AAD 1015 and / or the additional entropy data 1017 to the UE 106 (optional step 2020). One technical advantage is that the AAD 1015 and / or the additional entropy data 1017 may be shared with the UE 106 during the security negotiation process.

[0147] exist Fig. 20B , UE 106 receives a security negotiation message 2112 indicating a selected combined algorithm 1000 from 5G network 101 (step 2022). When security negotiation message 2112 is integrity protected, UE 106 verifies the integrity of security negotiation message 2112. For example, UE 106 may calculate a MAC from security negotiation message 2112 and compare the calculated MAC with the MAC received in security negotiation message 2112. UE 106 activates the combined algorithm 1000 indicated in security negotiation message 2112 to protect communication 1710 (step 2024). In other words, UE 106 activates the combined algorithm 1000 selected by 5G network 101 to protect subsequent or future communications with the 5G network, such as integrity protection, encryption, or both. UE 106 may also send a security negotiation completion message 2113 to 5G network 101 (see Fig.21 ).

[0148] In an embodiment, when the UE 106 receives the operating mode 1080 in the security negotiation message 2112, the UE 106 activates the combined algorithm 1000 using the selected operating mode 1080 (optional step 2026). In other words, the UE 106 activates the combined algorithm 1000 to perform integrity protection, encryption, or both based on the selected operating mode 1080. In an embodiment, when the UE 106 receives the AAD 1015 and / or the additional entropy data 1017 in the security negotiation message 2112, the UE 106 may extract the AAD 1015 (optional step 2028) and / or the additional entropy data 1017 (optional step 2030) from the security negotiation message 2112. The UE 106 stores the AAD 1015 and the additional entropy data 1017 and may use the AAD 1015 and / or the additional entropy data 1017 as input parameters 1002 of the selected combined algorithm 1000 to generate a MAC.

[0149] One technical advantage of method 2000 is that the 5G network 101 is able to share the selected combined algorithm 1000 and other information (e.g., operating mode 1080, AAD 1015, additional entropy data 1017, etc.) with the UE 106 when negotiating security parameters.

[0150] Figures 22A to 22B is a flow chart illustrating a method 2200 of negotiating a NAS security mechanism in an illustrative embodiment. Fig.23 is a signaling diagram illustrating a NAS security procedure between a UE 106 and an AMF 212 of a 5G network 101 in an illustrative embodiment. Fig.22A In the embodiment, the AMF 212 of the 5G network 101 identifies the security capabilities of the UE 106 when supporting one or more NAS combination algorithms 1050 (step 2202). In an embodiment, the AMF 212 may receive a NAS message 2311 (see FIG. 230 ) from the UE 106 indicating the NAS combination algorithm(s) 1050 supported by the UE 106. Fig.23 ) (optional step 2210), such as together with the UE security capability indicator 2101 included in the NAS message 2310. The NAS message 2311 may include Figure 4A The AMF 212 sends a NAS security mode command message indicating the selected NAS combination algorithm 1050 to the UE 106 (step 2206). Fig.23 As shown in FIG. 2 , the AMF 212 sends a NAS security mode command message 2312 to the UE 106. The AMF 212 may apply integrity protection (without encryption) to the NAS security mode command message 2312 before sending to the UE 106. One technical advantage is that the selected NAS combining algorithm 1050 is shared with the UE 106 in the NAS security mode command procedure.

[0151] In an embodiment, the AMF 212 may activate the NAS combining algorithm 1050 (step 2208) after sending the NAS security mode command message 2312, such as Fig.23 However, the AMF 212 may activate the NAS combining algorithm 1050 before sending the NAS security mode command message 2312, such as applying integrity protection (without encryption) to the NAS security mode command message 2312. In another example, the AMF 212 may activate the NAS combining algorithm 1050 after receiving the NAS security mode complete message 2312 from the UE 106.

[0152] In an embodiment, when the NAS combining algorithm 1050 supports multiple operation modes 1080, the AMF 212 may select the operation mode 1080 from the operation modes 1080 for the NAS combining algorithm 1050 (optional step 2212). The AMF 212 may therefore send a NAS security mode command message 2312 indicating the selected NAS combining algorithm 1050 and the selected operation mode 1080 to the UE 106 (optional step 2218). One technical advantage is that the operation mode 1080 of the selected NAS combining algorithm 1050 is shared with the UE 106 in the NAS security mode command procedure.

[0153] In an embodiment, the input parameters 1002 to the NAS combining algorithm 1050 may include the AAD 1015 and / or the additional entropy data 1017 used when generating the NAS-MAC 1052 or XNAS-MAC 1054 for integrity protection. Therefore, the AMF 212 may identify the AAD 1015 (optional step 2214) and / or the additional entropy data 1017 (optional step 2216). The AMF 212 may therefore send a NAS security mode command message 2312 containing the AAD 1015 and / or the additional entropy data 1017 to the UE 106 (optional step 2220). Examples of the AAD 1015 may include the 5G-TMSI 1056, the truncated 5G-S-TMSI 1057, the S-NSSAI 1058, etc. The additional entropy data 1017 may include a random number generated by the AMF 212. One technical advantage is sharing the AAD 1015 and / or additional entropy data 1017 with the UE 106 during the NAS security mode command procedure.

[0154] exist Fig. 22B , the UE 106 receives a NAS security mode command message 2312 indicating the selected NAS combining algorithm 1050 from the AMF 212 (step 2222). When the NAS security mode command message 2312 is integrity protected, the UE 106 verifies the integrity of the NAS security mode command message 2312. The UE 106 activates the NAS combining algorithm 1050 indicated in the NAS security mode command message 2312 to protect the NAS signaling 1712 (step 2224). In other words, the UE 106 activates the NAS combining algorithm 1050 selected by the AMF 212 to protect subsequent or future NAS signaling 1712, such as integrity protection, encryption, or both. The UE 106 also sends a NAS security mode complete message 2313 to the AMF 212 (see Fig.23 ).

[0155] In an embodiment, when the UE 106 receives the operating mode 1080 in the NAS security mode command message 2312, the UE 106 activates the NAS combining algorithm 1050 to protect the NAS signaling 1712 using the selected operating mode 1080 (optional step 2226). In other words, the UE 106 activates the NAS combining algorithm 1050 to perform integrity protection, ciphering, or both based on the selected operating mode 1080. In an embodiment, when the UE 106 receives the AAD 1015 and / or the additional entropy data 1017 in the NAS security mode command message 2312, the UE 106 may extract the AAD 1015 (optional step 2228) and / or the additional entropy data 1017 from the NAS security mode command message 2312 (optional step 2230). The UE 106 stores the AAD 1015 and the additional entropy data 1017 and may use the AAD 1015 and / or the additional entropy data 1017 as input parameters 1002 of the selected NAS combining algorithm 1050 to generate a NAS-MAC 1052 or an XNAS-MAC 1054 .

[0156] One technical advantage of method 2200 is that the AMF 212 is able to share the selected NAS combining algorithm 1050 and other information (e.g., operating mode 1080, AAD 1015, additional entropy data 1017, etc.) with the UE 106 during the NAS security mode command process.

[0157] In an embodiment, the NAS Security Mode Command procedure may be extended to indicate a selected NAS combined algorithm 1050. As indicated in Section 8.2.25 of 3GPP TS 24.501, the message content of the NAS Security Mode Command includes a "Selected NAS Security Algorithm" Information Element (IE) of data type "NAS Security Algorithm". The Selected NAS Security Algorithm IE is used in the NAS Security Mode Command to indicate the 5G algorithm to be used for encryption and integrity protection. In the embodiments described herein, the NAS Security Algorithm IE may be extended to include one or more NAS combined algorithms 1050. Fig.24 2 is a block diagram illustrating a NAS security algorithm IE 2402 described in Section 9.11.3.34 of 3GPP TS 24.501. The NAS security algorithm IE 2402 includes a NAS security algorithm IE identifier (IEI) 2404 (in octet 1), and the type of the encryption algorithm parameter 2406 and the type of the integrity algorithm parameter 2408 (in octet 2). The NAS security algorithm IE 2402 is encoded based on the information defined in Table 9.11.3.34.1 of 3GPP TS 24.501. Fig.252 is a block diagram illustrating an extension of the encoding 2500 of the NAS security algorithm IE 2402 in an illustrative embodiment. In this embodiment, one or more NAS combination algorithms 1050 are defined for the NAS security algorithm IE 2402. For example, a value of "1000" is defined for the "5G-CA0" NAS combination algorithm 1050, a value of "1001" is defined for the "256-5G-CA1" NAS combination algorithm 1050, a value of "1010" is defined for the "256-5G-CA2" NAS combination algorithm 1050, and a value of "1011" is defined for the "256-5G-CA3" NAS combination algorithm 1050. These values ​​and specific NAS combination algorithms 1050 are provided as examples, and other values ​​and algorithms are contemplated herein. One technical advantage is that the NAS security mode command message 2312 can indicate the NAS combination algorithm 1050 used for the NAS security context.

[0158] One or both of the AAD 1015 and the additional entropy data 1017 may be shared with the UE 106 during the above-described NAS security mode command process. Thus, the NAS security mode command message 2312 may be extended to include the AAD 1015 and / or the additional entropy data 1017. Fig.26 is a block diagram illustrating NAS security mode command message content 2600 in an illustrative embodiment. Fig.26 The NAS security mode command message content 2600 in represents an extension to Table 8.2.25.1.1 of 3GPP TS24.501. In this embodiment, the NAS security mode command message content 2600 also includes one or more additional combined algorithm security information IEs 2601 to 2602. The purpose of the additional combined algorithm security information IEs 2601 to 2602 is to provide additional security parameters to the UE 106. The type of one of the combined algorithm security information IEs 2601 in the additional combined algorithm security information IE 2601 labeled as "Additional 5G AEAD security information (plain text)" is "Additional 5G AEAD security information", although the name may change as desired. Fig. 27 2700 in an illustrative embodiment. The additional 5G AEAD security information IE 2700 includes the additional 5G AEAD security information IEI 2702, the length 2704 of the additional 5G AEAD security information content, the additional entropy data 1017 (ie, the additional IV), the length 2708 of the AAD, and the AAD 1015.

[0159] The purpose of the Additional 5G AEAD Security Information IE 2700 is to provide additional security parameters (e.g., additional IV and AAD) to the UE 106 during the security mode command process. The UE 106 uses these additional security parameters to complete the security mode process. Fig.28 The additional 5G AEAD security information IE 2700 is encoded as shown in Fig.28 An encoding 2800 for the additional 5G AEAD security information IE 2700 in an illustrative embodiment is illustrated. One technical advantage is that the NAS security mode command message 2312 can include additional security information for a NAS security context.

[0160] As described above, the NAS combining algorithm 1050 selected by the AMF 212 may support multiple operation modes 1080, and the AMF 212 may select the operation mode 1080 from the operation modes 1080 for the selected NAS combining algorithm 1050 (see Fig.22A In an embodiment, the NAS security mode command message 2312 may be extended to include an operating mode indicator. Fig.26 As shown in , the NAS security mode command message content 2600 may also include an operation mode indicator IE 2603. The purpose of the operation mode indicator IE 2603 is to provide the UE 106 with the operation mode 1080 for the NAS combined algorithm 1050 selected by the AMF 212. The operation mode indicator IE 2603 may have a desired data type. The operation mode indicator IE 2603 may include an IE type identifier and a 4-bit value field for indicating the operation mode 1080. One technical advantage is that the NAS security mode command message 2312 can indicate the selected operation mode 1080 for the NAS combined algorithm 1050.

[0161] Figures 29A to 29B is a flow chart illustrating a method 2900 of executing an RRC security mechanism to set up RRC security between a UE 106 and a gNB 302 of a 5G network 101 in an illustrative embodiment. Fig.30 is a signaling diagram illustrating the RRC security procedure between UE 106 and gNB 302 in an illustrative embodiment. Fig.29A In the embodiment, the gNB 302 of the 5G network 101 identifies the security capabilities of the UE 106 when supporting one or more AS combination algorithms 1060 (step 2902). In an embodiment, the gNB 302 may receive an NGAP initial context setup message 513 (see AMF 212) indicating the (multiple) AS combination algorithms 1060 supported by the UE 106. Figure 5) (optional step 2910). gNB 302 selects an AS combination algorithm from one or more AS combination algorithms 1060 supported by UE 106 (step 2904). gNB 302 sends an AS security mode command message 3011 indicating the selected AS combination algorithm 1060 to UE 106 (see Fig.30 )(Step 2906). Fig.30 As shown in , the AMF 212 sends an AS security mode command message 3011 to the UE 106. The gNB 302 may apply integrity protection (without encryption) to the AS security mode command message 3011 before sending to the UE 106. One technical advantage is that the selected AS combining algorithm 1060 is shared with the UE 106 during the AS security mode command process.

[0162] In an embodiment, the gNB 302 may activate the AS combination algorithm 1060 (step 2908) after sending the AS security mode command message 3011, such as Fig.30 However, the gNB 302 may activate the AS combination algorithm 1060 before sending the AS security mode command message 3011, such as applying integrity protection (without encryption) to the AS security mode command message 3011. In another example, the gNB 302 may activate the AS combination algorithm 1060 after receiving the AS security mode complete message 3012 from the UE 106.

[0163] In an embodiment, when the AS combining algorithm 1060 supports multiple operation modes 1080, the gNB 302 may select the operation mode 1080 from the operation modes 1080 for the AS combining algorithm 1060 (optional step 2912). The gNB 302 may therefore send an AS security mode command message 3011 indicating the selected AS combining algorithm 1060 and the selected operation mode 1080 to the UE 106 (optional step 2918). One technical advantage is that the operation mode 1080 of the selected AS combining algorithm 1060 is shared with the UE 106 in the AS security mode command procedure.

[0164] In an embodiment, the input parameters 1002 to the AS combining algorithm 1060 may include the AAD 1015 and / or the additional entropy data 1017 used in generating the MAC-I 1062 or XMAC-I 1064 for integrity protection. Accordingly, the gNB 302 may identify the AAD 1015 (optional step 2914) and / or the additional entropy data 1017 (optional step 2916). The gNB 302 may therefore send an AS security mode command message 3011 containing the AAD 1015 and / or the additional entropy data 1017 to the UE 106 (optional step 2920). Examples of the AAD 1015 may include the RNTI 1066, the PCI 1067, a combination of the RNTI and the PCI, etc. The additional entropy data 1017 may include a random number generated by the gNB 302. One technical advantage is that the AAD 1015 and / or the additional entropy data 1017 are shared with the UE 106 during the AS security mode command process.

[0165] exist Fig.29B , UE 106 receives an AS security mode command message 3011 indicating a selected AS combining algorithm 1060 from gNB 302 (step 2922). When the AS security mode command message 3011 is integrity protected, UE 106 verifies the integrity of the AS security mode command message 3011. UE 106 activates the AS combining algorithm 1060 indicated in the AS security mode command message 3011 to protect RRC signaling 1714 (step 2924). In other words, UE 106 activates the AS combining algorithm 1060 selected by gNB 302 to protect subsequent or future RRC signaling 1714, such as integrity protection, encryption, or both. UE 106 also sends an AS security mode complete message 3012 to gNB 302 (see Fig.30 ).

[0166] In an embodiment, when the UE 106 receives the operating mode 1080 in the AS security mode command message 3011, the UE 106 activates the AS combination algorithm 1060 using the selected operating mode 1080 to protect the RRC signaling 1714 (optional step 2926). In other words, the UE 106 activates the AS combination algorithm 1060 based on the selected operating mode 1080 to perform integrity protection, encryption, or both. In an embodiment, when the UE 106 receives the AAD 1015 and / or the additional entropy data 1017 in the AS security mode command message 3011, the UE 106 can extract the AAD 1015 (optional step 2928) and / or the additional entropy data 1017 (optional step 2930) from the AS security mode command message 3011. The UE 106 stores the AAD 1015 and the additional entropy data 1017 and may use the AAD 1015 and the additional entropy data 1017 as input parameters 1002 of the selected AS combining algorithm 1060 to generate a MAC-I 1062 or an XMAC-I 1064 .

[0167] One technical advantage of method 2900 is that the gNB 302 is able to share the selected AS combining algorithm 1060 and other information (e.g., operating mode 1080, AAD 1015, additional entropy data 1017, etc.) with the UE 106 during the AS security mode command process.

[0168] In an embodiment, the AS security mode command procedure may be extended to indicate at least one of the selected AS combining algorithm 1060, AAD 1015, additional entropy data 1017, and operating mode 1080. Section 6.2 of 3GPP TS 38.331 (v 17.5.0) specifies the message structure and message definitions of RRC messages, which is incorporated by reference as if fully included herein. Fig.31 The message content 3100 of the AS security mode command message 3011 indicated in Section 6.2.2 of 3GPP TS 38.331 is illustrated. Specifically, the AS security mode command message 3011 includes a security algorithm configuration IE 3102, which is used to configure the AS integrity protection algorithm and the AS encryption algorithm for the radio bearer (i.e., SRB and DRB). The extension of the security algorithm configuration IE 3102 defined in Section 6.3.2 of 3GPP TS 38.331 is described herein. Fig.32The security algorithm configuration IE 3102 in an illustrative embodiment is illustrated. In an embodiment, one or more of the following new fields are defined for the security algorithm configuration IE 3102: a combined algorithm field 3202 (i.e., “combinedAlgorithm”), an additional entropy data field 3203 (i.e., “extra_iv”), an AAD field 3204 (i.e., “aad”), and an operating mode field 3205 (i.e., “operatingMode”). The combined algorithm field 3202 indicates the AS combining algorithm 1060 used for SRB and / or DRB. The additional entropy data field 3203 indicates additional entropy data 1017 (e.g., a random number generated by the gNB 302). The AAD field 3204 indicates AAD 1015, which may include RNTI 1066, PCI 1067, a combined RNTI and PCI, etc. The operating mode field 3205 indicates the selected operating mode 1080 for the AS combining algorithm 1060.

[0169] Figures 33A to 33B is a flowchart illustrating a method 3300 of performing a UP security process to set up UP security between a UE 106 and a gNB 302 in a 5G network 101 in an illustrative embodiment. Fig.34 is a signaling diagram illustrating a UP security procedure between a UE 106 and a gNB 302 in an illustrative embodiment. UP security is activated as part of a DRB addition procedure, where an RRC connection reconfiguration procedure is used to add one or more DRBs for a PDU session. The RRC connection reconfiguration procedure is described in 3GPP TS 36.331 (v.17.5.0), which is incorporated by reference as if fully incorporated herein. The purpose of the RRC connection reconfiguration procedure is, at least in part, to modify the RRC connection (e.g., to establish, modify, or release radio bearers). Fig.33A In the process, gNB 302 initiates an RRC connection reconfiguration procedure (step 3302). The premise is that RRC security has been activated as part of the AS security mode command process. The gNB 302 of the 5G network 101 identifies the security capability of UE 106 when supporting one or more AS combination algorithms 1060 (step 3304), if it has not been performed in the previous security process. The gNB 302 selects an AS combination algorithm from one or more AS combination algorithms 1060 supported by the UE 106 for DRB 1914 (step 3306). The gNB 302 sends an RRC connection reconfiguration message to the UE 106 indicating the selected AS combination algorithm 1060 (step 3308). As Fig.34As shown in , gNB 302 sends an RRC connection reconfiguration message 3411 to UE 106. gNB 302 may apply integrity protection to the RRC connection reconfiguration message 3411 before sending to UE 106. One technical advantage is that the selected AS combining algorithm 1060 for DRB 1914 is shared with UE 106 during the RRC connection reconfiguration process.

[0170] In an embodiment, gNB 302 may activate AS combining algorithm 1060 for DRB 1914 after sending RRC connection reconfiguration message 3411 (step 3310), as shown in FIG. Fig.34 However, the gNB 302 may activate the AS combining algorithm 1060 before sending the RRC connection reconfiguration message 3411, such as applying integrity protection (without encryption) to the RRC connection reconfiguration message 3411. In another example, the gNB 302 may activate the AS combining algorithm 1060 after receiving the RRC connection reconfiguration complete message 3412 from the UE 106.

[0171] In an embodiment, when the AS combining algorithm 1060 supports multiple operation modes 1080, the gNB 302 may select the operation mode 1080 from the operation modes 1080 for the AS combining algorithm 1060 (optional step 3312). The gNB 302 may therefore send an RRC connection reconfiguration message 3411 indicating the selected AS combining algorithm 1060 and the selected operation mode 1080 to the UE 106 (optional step 3318). One technical advantage is that the operation mode 1080 of the selected AS combining algorithm 1060 is shared with the UE 106 during the RRC connection reconfiguration process.

[0172] In an embodiment, the input parameters 1002 of the AS combining algorithm 1060 may include the AAD 1015 and / or the additional entropy data 1017 used in generating the MAC-I 1062 or XMAC-I 1064 for integrity protection. Therefore, the gNB 302 may identify the AAD 1015 (optional step 3314) and / or the additional entropy data 1017 (optional step 3316). The gNB 302 may therefore send an RRC connection reconfiguration message 3411 containing the AAD 1015 and / or the additional entropy data 1017 to the UE 106 (optional step 3320). Examples of the AAD 1015 may include the RNTI 1066, the PCI 1067, a combination of the RNTI and the PCI, etc. The additional entropy data 1017 may include a random number generated by the gNB 302. One technical advantage is that the AAD 1015 and / or the additional entropy data 1017 are shared with the UE 106 during the RRC connection reconfiguration process.

[0173] exist Fig.33B , UE 106 receives an RRC connection reconfiguration message 3411 indicating the selected AS combining algorithm 1060 from gNB 302 (step 3322). When the RRC connection reconfiguration message 3411 is integrity protected by gNB 302, UE 106 verifies the integrity of the RRC connection reconfiguration message 3411. UE 106 activates the AS combining algorithm 1060 indicated in the RRC connection reconfiguration message 3411 to protect the UP service 1716 on DRB 1914 (step 3324). In other words, UE 106 activates the AS combining algorithm 1060 selected by gNB 302 to protect subsequent or future UP services 1716 on DRB 1914, such as integrity protection, encryption, or both. UE 106 also sends an RRC connection reconfiguration complete message 3412 to gNB 302 (see Fig.34 ).

[0174] In an embodiment, when UE 106 receives the operation mode 1080 in the RRC connection reconfiguration message 3411, UE 106 activates the AS combination algorithm 1060 to protect UP traffic 1716 using the selected operation mode 1080 (optional step 3326). In other words, UE 106 activates the AS combination algorithm 1060 based on the selected operation mode 1080 to perform integrity protection, encryption, or both.

[0175] In an embodiment, when UE 106 receives AAD 1015 and / or additional entropy data 1017 in RRC connection reconfiguration message 3411, UE 106 may extract AAD 1015 (optional step 3328) and additional entropy data 1017 (optional step 3330) from RRC connection reconfiguration message 3411. UE 106 stores AAD 1015 and / or additional entropy data 1017 and may use AAD 1015 and additional entropy data 1017 as input parameters 1002 of AS combining algorithm 1060 to generate MAC-I 1062 or XMAC-I 1064.

[0176] The method 3300 may be used to activate UP security for multiple DRBs 1914. One technical advantage is that the gNB 302 can share the selected AS combining algorithm 1060 and other information (e.g., operation mode 1080, AAD 1015, additional entropy data 1017, etc.) with the UE 106 during the RRC connection reconfiguration process for each DRB 1914. However, it should be understood that UP security may be configured during the AS security mode command process discussed above.

[0177] In an embodiment, the RRC connection reconfiguration procedure may be extended to indicate or include at least one of the selected AS combining algorithm 1060, AAD 1015, additional entropy data 1017, and operation mode 1080. Section 6.2 of 3GPP TS 36.331 (v17.5.0) specifies the message structure and message definitions of RRC messages, which is incorporated by reference as if fully included herein. Fig.35 The message content 3500 of the RRC connection reconfiguration message 3411 in an illustrative embodiment is illustrated. Specifically, the RRC connection reconfiguration message 3411 includes a security algorithm configuration field 3501, which is used to configure the UP integrity protection algorithm and the UP encryption algorithm for the radio bearer (i.e., DRB). An extension of the security algorithm configuration field 3501 of the RRC connection reconfiguration message 3411 defined in 3GPP TS 36.331 is described herein. In an embodiment, one or more of the following new fields are defined: a combined algorithm field 3502 (i.e., "combinedAlgorithm"), an additional entropy data field 3503 (i.e., "extra_iv"), an additional authentication data field 3504 (i.e., "aad"), and an operating mode field 3505 (i.e., "operatingMode"). The combined algorithm field 3502 indicates the AS combining algorithm 1060 used for the DRB (each DRB 1914 can select the AS combining algorithm 1060). The additional entropy data field 3503 indicates additional entropy data 1017 (e.g., a random number generated by the gNB 302). The additional authentication data field 3504 indicates AAD 1015, which may include RNTI 1066, PCI 1067, combined RNTI and PCI, etc. The operation mode field 3505 indicates the selected operation mode 1080 for the AS combining algorithm 1060.

[0178] In an embodiment, UE 106 may report UE security capabilities to 5G network 101 in a NAS message. Fig.21 As shown in , for example, UE 106 may include a UE security capability indicator 2101 in a NAS message 2111 to 5G network 101. An example of a NAS message 2111 is a NAS registration request such as described in Section 8.2.6 of 3GPP TS 24.501. The message content of the NAS registration request includes a "UE security capability" information element (IE) of a data type of "UE security capability". The UE security capability IE may therefore represent the UE security capability indicator 2101. In the embodiments described herein, the UE security capability IE may be extended to include one or more combined algorithms 1000. Fig.363GPP TS24.501, Section 9.11.3.54, is a block diagram illustrating a UE security capability IE 3600 described in Section 9.11.3.54 of 3GPP TS24.501. The UE security capability IE 3600 includes a UE security capability IEI 3602 (in octet 1), a length 3604 of the UE security capability content (in octet 2), and multiple security algorithm parameters (in octets 3 to 6) indicating conventional encryption (e.g., 5G-EA0) and integrity protection (e.g., 5G-IA0) algorithms supported by the UE 106. In this embodiment, the UE security capability IE 3600 is extended to also include one or more security algorithm parameters 3606 (in octet 7*) indicating a combined algorithm 1000 (e.g., 5G-CA0) supported by the UE 106. The UE security algorithm IE 3600 is encoded based on the information defined in Table 9.11.3.54.1 of 3GPP TS24.501. Fig.37 3600 is a block diagram illustrating an extension of the encoding of the UE security capabilities IE 3600 in an illustrative embodiment. As an example, Fig.37 An extension to the encoding of octet "7" of the UE Security Capability IE 3600 is illustrated. One technical advantage is that the UE 106 can report the capability of the combined algorithm 1000 with a NAS message.

[0179] As above for Fig. 10D As described, the combined algorithm 1000 may support multiple operating modes 1080 , such as an integrity mode 1082 . Figures 38A to 38B Two integrity modes 1082 are illustrated in the illustrative embodiment. Fig.38A 1 is a block diagram illustrating an encoding for ignoring encryption and integrity mode 1085 in an illustrative embodiment. For this encoding, the combined algorithm 1000 includes an encryption algorithm 3802 (NEA) and an integrity algorithm 3804 (NIA) using a single CIE key 1010. The integrity algorithm 3804 generates a MAC based on input parameters 1002 including a plaintext message 1013, an AAD 1015, and additional entropy data 1017. When the function parameter 3810 of the combined algorithm 1000 is set to a specific value (e.g., "1"), the ciphertext 1022 output from the encryption algorithm 3802 is ignored and not sent in the communication (i.e., the plaintext message is sent). Therefore, the communication has integrity protection, but is not encrypted.

[0180] Fig.38B1086 is a block diagram illustrating an encoding for null encryption and integrity mode 1086 in an illustrative embodiment. For this encoding, the combined algorithm 1000 again includes an encryption algorithm 3802 (NEA) and an integrity algorithm 3804 (NIA) using a single CIE key 1010. The integrity algorithm 3804 generates a MAC based on input parameters 1002 including ciphertext 1022, AAD 1015, and additional entropy data 1017. When the function parameter 3810 of the combined algorithm 1000 is set to a specific value (e.g., "1"), the encryption algorithm 3802 applies null encryption, and the output of the encryption algorithm 3802 is not encrypted. Therefore, the communication has integrity protection, but is not encrypted.

[0181] Based on the different operation modes 1080 for the combined algorithm 1000, the 5G network 101 may activate the combined algorithm 1000 in integrity mode 1082 to apply integrity protection to initial security negotiation messages 2112, such as NAS security mode command messages 2312. After the security procedures (e.g., NAS security context) have been established, the 5G network 101 may activate the combined algorithm 1000 in integrity and encryption mode 1081 to apply integrity protection and encryption to subsequent messages. For example, in Fig.38A In , the function parameter can be set to "0" so that the encrypted text 1022 from the encryption algorithm 3802 is not ignored. Fig.38B For example, the function parameter can be set to "0" so that the encryption algorithm 3802 outputs the encrypted text 1022.

[0182] In an embodiment, the combined algorithm 1000 may be used to protect a secure mode command message. Fig.39 1050, derives a NASCIE key 1010 (e.g., K 1014 ) for the selected NAS combining algorithm 1050, and derives a NAS security context 1015 (e.g., K 1016 ) for the selected NAS combining algorithm 1050. NASaead1050), and identifies / generates AAD 1015 and additional entropy data 1017 (e.g., NAS Extra_IV). The AMF 212 initiates the NAS security mode command procedure by sending a NAS security mode command message 2312 to the UE 106, wherein the NAS security mode command message 2312 indicates the selected NAS combining algorithm 1050 and contains the AAD 1015 and additional entropy data 1017 used in the generation of NAS-MAC. The AMF 212 activates NAS integrity protection before sending the NAS security mode command message 2312, and thus the NAS security mode command message 2312 is integrity protected (but not encrypted) using the NAS combining algorithm 1050. The AMF 212 activates NAS uplink decryption after sending the NAS security mode command message 2312.

[0183] Upon receiving the NAS security mode command message 2312, the UE 106 verifies the integrity of the NAS security mode command message 2312 using the indicated NAS combined algorithm 1050, the AAD 1015, the additional entropy data 1017 provided in the NAS security mode command message 2312, and the NAS CIE key 1010 derived by the UE 106. If the verification is successful, the UE 106 starts NAS integrity protection and encryption / decryption using the NAS combined algorithm 1050. The UE 106 sends a NAS security mode complete message 2313 to the AMF 212, which is encrypted and integrity protected using the NAS combined algorithm 1050. The AMF 212 decrypts the received NAS security mode complete message 2313 and checks its integrity protection, and activates NAS downlink encryption after receiving the NAS security mode complete message 2313.

[0184] The AS security mode command procedure is performed to establish an AS security context between the UE 106 and the NG-RAN 502. When the AS security context is to be established in the gNB 302, the AMF 212 sends an NGAP initial context setup message 3914 to the NG-RAN 502 (e.g., gNB 302). The gNB 302 selects an AS combining algorithm 1060, derives the RRCCIE key 1010 (e.g., K RRCaead106), and identifies / generates AAD 1015 and additional entropy data 1017 (e.g., ASExtra_IV). gNB 302 begins integrity protection and ciphering for RRC signaling. Thus, gNB 302 sends an integrity protected and ciphered AS security mode command message 3011 to UE 106, which indicates the selected AS combining algorithm 1060 and contains the AAD 1015 and additional entropy data 1017 used in generating MAC-I. After sending the AS security mode command message 3011, RRC downlink ciphering at gNB 302 begins.

[0185] Upon receiving the AS security mode command message 3011, the UE 106 verifies the integrity of the AS security mode command message 3011 using the indicated AS combination algorithm 1060, AAD 1015, and the additional entropy data 1017 provided in the AS security mode command message 3011, and the RRCCIE key 1010 derived by the UE 106, and decrypts the AS security mode command message 3011. If the verification is successful, the UE 106 activates RRC integrity protection and encryption / decryption using the AS combination algorithm 1060. The UE 106 sends an AS security mode complete message 3012 to the gNB 302, which is encrypted and integrity protected using the AS combination algorithm 1060. The AMF 212 decrypts the received AS security mode complete message 3012 and checks its integrity, and activates RRC downlink encryption after receiving the AS security mode complete message 3012.

[0186] In an embodiment, the 5G network 101 and the UE 106 may support traditional encryption and integrity algorithms, as well as the new combined algorithm 1000. The 5G network 101 may activate the traditional integrity algorithm 800 to apply integrity protection to an initial security negotiation message 2112 without encryption, such as a NAS security mode command message 2312 or an AS security mode command message 3011. After the initial security negotiation message 2112, the 5G network 101 and the UE 106 may activate the combined algorithm 1000 to apply integrity protection and encryption to subsequent messages.

[0187] Fig.401015 is a signaling diagram illustrating NAS and AS security procedures in an illustrative embodiment. For the NAS security context, the AMF 212 uses the legacy integrity algorithm 800 (e.g., AES-256 / SNOW-256 / ZUC-256) to apply integrity protection to the NAS security mode command message 2312. The NAS security mode command message 2312 includes the newly selected NAS combining algorithm 1050, additional entropy data 1017 (NAS Extra_IV), and AAD 1015. The UE 106 verifies the integrity of the NAS security mode command message 2312 using the legacy integrity algorithm 800. The UE 106 receives an indication of the selected NAS combining algorithm 1050, additional entropy data 1017, and AAD 1015, and activates the NAS combining algorithm 1050 to protect subsequent NAS signaling, such as a NAS security mode complete message 2313.

[0188] Similarly, for the AS security context, the gNB 302 uses the legacy integrity algorithm 800 (e.g., AES-256 / SNOW-256 / ZUC-256) to apply integrity protection to the AS security mode command message 3011. The AS security mode command message 3011 includes the newly selected AS combining algorithm 1060, additional entropy data 1017 (AS Extra_IV), and AAD 1015. The UE 106 uses the legacy integrity algorithm 800 to verify the integrity of the AS security mode command message 3011. The UE 106 receives an indication of the selected AS combining algorithm 1060, additional entropy data 1017, and AAD 1015, and activates the AS combining algorithm 1060 to protect subsequent RRC signaling, such as the AS security mode complete message 3012.

[0189] In the above embodiment, the 5G network 101 provides the additional entropy data 1017 to the UE 106, such as in the NAS security mode command message 2312 or the AS security mode command message 3011. In an embodiment, the UE 106 can derive the additional entropy data 1017 instead of receiving the additional entropy data 1017 from the 5G network 101. Fig.41 is a signaling diagram illustrating NAS and AS security procedures in an illustrative embodiment. In this embodiment, the AMF 212 does not send additional entropy data 1017 to the UE 106 in the NAS Security Mode Command message 2312. Instead, the UE 106 derives additional entropy data 1017 for the NAS security context. Similarly, the gNB 302 does not send additional entropy data 1017 to the UE 106 in the AS Security Mode Command message 3011. Instead, the UE 106 derives additional entropy data 1017 for the AS security context.

[0190] Figures 42A to 42BThe derivation of additional entropy data 1017 in an illustrative embodiment is illustrated. Fig.42A , the AMF 212 uses the RAND 4202 (i.e., reused from the primary authentication) and the NAS COUNT 4204 as input parameters of the derivation function 4206 to derive additional entropy data 1017 for the NAS security context. The AMF 212 sends a NAS security mode command message 2312 to the UE 106, in which an indication of the selected NAS combining algorithm 1050 in plain text and other parameters are encrypted. The UE 106 derives the additional entropy data 1017 in the same manner as the AMF 212, using the RAND 4202 and the NAS COUNT 4204 as input parameters of the derivation function 4206. The UE 106 is able to verify the integrity of the NAS security mode command message 2312 and decrypt the parameters.

[0191] exist Fig.42B , the gNB 302 uses RAND 4202 and RNTI 1066, PCI 1067, a combination of RNTI and PCI, etc. as input parameters to the derivation function 4206 to derive additional entropy data 1017 for the AS security context. The gNB 302 sends an AS security mode command message 3011 to the UE 106, in which the indication of the AS combination algorithm 1060 in plain text and other parameters are encrypted. The UE 106 derives additional entropy data 1017 in the same manner as the gNB 302 using RAND 4202 and RNTI 1066, PCI 1067, a combination of RNTI and PCI, etc. as input parameters to the derivation function 4206. The UE 106 is able to verify the integrity of the AS security mode command message 3011 and decrypt the parameters.

[0192] One technical advantage of deriving the additional entropy data 1017 at the transmitter 810 and the receiver 812 is that the additional entropy data 1017 does not need to be shared during the secure mode command process.

[0193] Any of the various elements or modules shown in the accompanying drawings or described herein can be implemented as hardware, software, firmware or some combination of these.For example, an element can be implemented as special hardware.Special hardware elements can be referred to as "processors", "controllers" or some similar terms.When provided by a processor, functions can be provided by a single special processor, by a single shared processor, or by a plurality of separate processors that can be shared in some of them.In addition, the explicit use of the term "processor" or "controller" should not be interpreted as specifically referring to hardware that can execute software, and can implicitly include but are not limited to digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC) or other circuit systems, field programmable gate array (FPGA), read-only memory (ROM) for storing software, random access memory (RAM), non-volatile storage, logic or some other physical hardware components or modules.

[0194] Moreover, the element can be implemented as an instruction that is executable by a processor or computer to perform the function of the element. Some examples of instructions are software, program code, and firmware. The instruction is operable when executed by the processor to instruct the processor to perform the function of the element. The instruction can be stored on a storage device readable by the processor. Some examples of storage devices are digital or solid-state memory, magnetic storage media (such as disks and tapes), hard drives, or optically readable digital data storage media.

[0195] As used in this application, the term "circuitry" may refer to one or more or all of the following:

[0196] (a) Pure hardware circuit implementation (such as implementation in analog and / or digital circuitry only);

[0197] (b) a combination of hardware circuitry and software such as (where applicable):

[0198] (i) a combination of analog and / or digital hardware circuits and software / firmware; and

[0199] (ii) any portion of hardware processor(s) (including digital signal processor(s)), software and memory(s) with software that work together to enable a device (such as a mobile phone or server) to perform various functions; and

[0200] (c) Hardware circuit(s) and / or processor(s), such as microprocessor(s) or portion(s) of microprocessor(s), that require software (e.g., firmware) to operate, but which may not be present when the software is not required for operation.

[0201] This definition of circuitry applies to all uses of the term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. For example, if applicable to a particular claim element, the term circuitry also covers a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0202] Although specific embodiments are described herein, the scope of the present disclosure is not limited to these specific embodiments.The scope of the present disclosure is defined by the following claims and any equivalents thereof.

Claims

1. A network (101) device, the device comprising: A network element (212 / 1600) operatively coupled to a user device (106); When operating as a sender (810) of a message (1720) sent to the user equipment, the network element comprises: A means (1504 / 1606) for identifying a combined integrity and encryption algorithm (1000); means (1504 / 1606) for deriving a combined integrity and encryption key (1010) for said combined integrity and encryption algorithm; and Means (1504 / 1606) for applying said combined integrity and encryption algorithm to said transmitted message using said combined integrity and encryption key as an input parameter (1002) to provide security protection to said transmitted message.

2. The device according to claim 1, wherein: When operating as a receiver (812) of a received message (1720) from the user equipment, the network element comprises: Means (1504 / 1606) for applying the combined integrity and encryption algorithm to the received message using the combined integrity and encryption key as an input parameter to perform at least one of decrypting the received message and verifying the integrity of the received message.

3. The device according to any one of claims 1 and 2, wherein: The combined integrity and encryption algorithm supports multiple modes of operation (1080); The means for identifying includes: means for identifying an operating mode among the plurality of operating modes; and The means for applying comprises means for applying the combined integrity and encryption algorithm based on the operating mode.

4. The device according to claim 3, wherein: The multiple operation modes include at least: Integrity and encryption modes (1081); Integrity Mode (1082); Encryption mode (1083); and Null encryption and null integrity mode (1084).

5. The device according to claim 4, wherein: The integrity mode includes at least one of the following: an ignore encryption and integrity mode (1085), wherein the combined integrity and encryption algorithm is configured to apply integrity protection and encryption to the sent message using the combined integrity and encryption key, but encrypted data is ignored; as well as Null encryption and integrity mode (1086), wherein the combined integrity and encryption algorithm is configured to apply integrity protection and null encryption to the sent message using the combined integrity and encryption key.

6. The device according to any one of claims 1 to 5, wherein: The means for deriving comprises: means for deriving the combined integrity and encryption key using an algorithm key derivation function (1200), the algorithm key derivation function (1200) using an algorithm type specifier (1300) as an input parameter (1204); The combined integrity and encryption algorithm comprises one of: a non-access stratum combined algorithm (1050) and an access stratum combined algorithm (1060); and A non-access layer algorithm type discriminator (1302-1) is defined for the non-access layer combination algorithm, a radio resource control algorithm type discriminator (1302-2) is defined for the access layer combination algorithm when used for protection of radio resource control signaling (1714), and a user plane algorithm type discriminator (1302-3) is defined for the access layer combination algorithm when used for protection of user plane services (1716).

7. The apparatus according to any one of claims 1 to 6, wherein the network element further comprises: means (1504 / 1606) for identifying additional authentication data (1015); as well as means (1504 / 1606) for identifying additional entropy data (1017); The means for applying the combined integrity and encryption algorithm to the sent message comprises means for applying the combined integrity and encryption algorithm using at least one of the additional authentication data and the additional entropy data as input parameters (1002) to generate a message authentication code (1020).

8. The device according to claim 7, wherein: During a security mode command procedure, at least the additional entropy data is shared between the user equipment and the network element.

9. The device according to claim 1, wherein: The sent message includes: non-access stratum signaling (1712) between the user equipment and the access and mobility management function (212); The means for identifying include: means for identifying a non-access stratum combined integrity and encryption algorithm (1050); The means for deriving includes: means for deriving a non-access stratum combined integrity and encryption key (1114) for the non-access stratum combined integrity and encryption algorithm; and The means for applying comprises means for applying the non-access stratum combined integrity and encryption algorithm to the non-access stratum signaling using the non-access stratum combined integrity and encryption key as the input parameter.

10. The device according to claim 1, wherein: The sent message includes: radio resource control signaling (1714) between the user equipment and the radio access network node (1600); The means for identifying include: means for identifying an access layer combined integrity and encryption algorithm (1060); The means for deriving includes: means for deriving a radio resource control combined integrity and ciphering key (1115) for the access stratum combined integrity and ciphering algorithm; and The means for applying comprises means for applying the access stratum combined integrity and ciphering algorithm to the radio resource control signaling using the radio resource control combined integrity and ciphering key as the input parameter.

11. The device according to claim 1, wherein: The sent message includes: a user plane service (1716) between the user equipment and the radio access network node (1600); The means for identifying include: means for identifying an access layer combined integrity and encryption algorithm (1060); The means for deriving includes: means for deriving a user plane combined integrity and encryption key (1116) for the access stratum combined integrity and encryption algorithm; and The means for applying comprises means for applying the access stratum combined integrity and encryption algorithm to the user plane traffic using the user plane combined integrity and encryption key as the input parameter.

12. An apparatus operatively coupled to a network (101), the apparatus comprising: User equipment (106); When operating as a sender (810) of a message (1720) sent to the network, the user equipment comprises: means (1404) for identifying a combined integrity and encryption algorithm (1000); means (1404) for deriving a combined integrity and encryption key (1010) for said combined integrity and encryption algorithm; and Means (1404) for applying the combined integrity and encryption algorithm to the transmitted message using the combined integrity and encryption key as an input parameter (1002) to provide security protection to the transmitted message.

13. The device according to claim 12, wherein: When operating as a receiver (812) of a received message (1720) from the network, the user equipment comprises: Means for applying the combined integrity and encryption algorithm to the received message using the combined integrity and encryption key as an input parameter to perform at least one of decrypting the received message and verifying the integrity of the received message (1404).

14. The device according to any one of claims 12 and 13, wherein: The combined integrity and encryption algorithm supports multiple modes of operation (1080); The means for identifying includes: means for identifying an operating mode among the plurality of operating modes; and The means for applying comprises means for applying the combined integrity and encryption algorithm based on the operating mode.

15. The device according to claim 14, wherein: The multiple operation modes include at least: Integrity and encryption modes (1081); Integrity Mode (1082); Encryption mode (1083); and Null encryption and null integrity mode (1084).

16. The device according to claim 15, wherein: The integrity mode includes at least one of the following: an ignore encryption and integrity mode (1085), wherein the combined integrity and encryption algorithm is configured to apply integrity protection and encryption to the sent message using the combined integrity and encryption key, but encrypted data is ignored; as well as Null encryption and integrity mode (1086), wherein the combined integrity and encryption algorithm is configured to apply integrity protection and null encryption to the sent message using the combined integrity and encryption key.

17. The device according to any one of claims 12 to 16, wherein: The means for deriving comprises: means for deriving the combined integrity and encryption key using an algorithm key derivation function (1200), the algorithm key derivation function (1200) using an algorithm type specifier (1300) as an input parameter (1204); The combined integrity and encryption algorithm comprises one of: a non-access stratum combined algorithm (1050) and an access stratum combined algorithm (1060); and A non-access layer algorithm type discriminator (1302-1) is defined for the non-access layer combination algorithm, a radio resource control algorithm type discriminator (1302-2) is defined for the access layer combination algorithm when used for protection of radio resource control signaling (1714), and a user plane algorithm type discriminator (1302-3) is defined for the access layer combination algorithm when used for protection of user plane services (1716).

18. The apparatus according to any one of claims 12 to 17, wherein the user equipment further comprises: means (1404) for identifying additional authentication data (1015); as well as means (1404) for identifying additional entropy data (1017); The means for applying the combined integrity and encryption algorithm to the sent message comprises means for applying the combined integrity and encryption algorithm using at least one of the additional authentication data and the additional entropy data as input parameters (1002) to generate a message authentication code (1020).

19. The device according to claim 18, wherein: During a security mode command procedure, at least the additional entropy data is shared between the user equipment and the network.

20. The apparatus of claim 12, wherein: The sent message includes: non-access stratum signaling (1712) between the user equipment and the access and mobility management function (212); The means for identifying include: means for identifying a non-access stratum combined integrity and encryption algorithm (1050); The means for deriving includes: means for deriving a non-access stratum combined integrity and encryption key (1114) for the non-access stratum combined integrity and encryption algorithm; and The means for applying comprises means for applying the non-access stratum combined integrity and encryption algorithm to the non-access stratum signaling using the non-access stratum combined integrity and encryption key as the input parameter.

21. The apparatus of claim 12, wherein: The sent message includes: radio resource control signaling (1714) between the user equipment and the radio access network node (1600); The means for identifying include: means for identifying an access layer combined integrity and encryption algorithm (1060); The means for deriving includes: means for deriving a radio resource control combined integrity and ciphering key (1115) for the access stratum combined integrity and ciphering algorithm; and The means for applying comprises means for applying the access stratum combined integrity and ciphering algorithm to the radio resource control signaling using the radio resource control combined integrity and ciphering key as the input parameter.

22. The apparatus of claim 12, wherein: The sent message includes: a user plane service (1716) between the user equipment and the radio access network node (1600); The means for identifying include: means for identifying an access layer combined integrity and encryption algorithm (1060); The means for deriving includes: means for deriving a user plane combined integrity and encryption key (1116) for the access stratum combined integrity and encryption algorithm; and The means for applying comprises means for applying the access stratum combined integrity and encryption algorithm to the user plane traffic using the user plane combined integrity and encryption key as the input parameter.

Images