Handling security keys during conditional primary-secondary cell (PSCell) changes without sending additional radio resource control signaling to user equipment (UE)

Abstract

A user equipment (UE) includes a transceiver and a processor configured to connect the UE with a plurality of radio access network (RAN) nodes via the transceiver, the plurality of radio access network (RAN) nodes including at least a primary node of the UE and at least a first secondary node and a second secondary node of the UE. The processor is configured to receive secondary cell group (SCG) configuration information from the primary node, the secondary cell group (SCG) configuration information including a respective security configuration structure for each of the at least two secondary nodes. After a conditional primary-secondary cell (PSCell) change condition associated with connection to a first secondary node is satisfied, the processor is configured to derive a secondary node security key (KSN) corresponding to the first secondary node using a first security configuration associated with the first secondary node, and updating and communicating a second security configuration structure associated with the second secondary node.

Description

Technical Field

[0001] The present application generally relates to wireless communication systems, including methods and systems for handling security during user equipment (UE) mobility, and in particular handling security keys during multiple primary secondary cell (PSCell) changes without sending additional radio resource control (RRC) signaling to the UE. Background Art

[0002] Wireless mobile communication technologies use various standards and protocols to send data between base stations and wireless communication devices. Wireless communication system standards and protocols may include, for example, the 3rd Generation Partnership Project (3GPP) Long Term Evolution (LTE) (e.g., 4G), 3GPP New Radio (NR) (e.g., 5G), and the IEEE 602.11 standard for wireless local area networks (WLANs) (commonly referred to within industry organizations as WLANs). ).

[0003] As envisioned by 3GPP, different wireless communication system standards and protocols may use various radio access networks (RANs) for communication between base stations (sometimes also collectively referred to as RAN nodes, network nodes, or simply nodes) of the RAN and wireless communication devices, referred to as UEs. The 3GPP RAN may include, for example, Global System for Mobile Communications (GSM), Enhanced Data Rates for GSM Evolution (EDGE) RAN (GERAN), Universal Terrestrial Radio Access Network (UTRAN), Evolved Universal Terrestrial Radio Access Network (E-UTRAN), and / or Next Generation Radio Access Network (NG-RAN).

[0004] Each RAN may use one or more radio access technologies (RATs) to perform communications between base stations and UEs. For example, GERAN implements GSM and / or EDGE RAT, UTRAN implements Universal Mobile Telecommunications System (UMTS) RAT or other 3GPP RAT, E-UTRAN implements LTE RAT (sometimes referred to as LTE), and NG-RAN implements NR RAT (sometimes referred to herein as 5G RAT, 5G NR RAT, or simply NR). In some deployments, E-UTRAN may also implement NR RAT. In some deployments, NG-RAN may also implement LTE RAT.

[0005] The base stations used by the RAN may correspond to the RAN. An example of an E-UTRAN base station is an Evolved Universal Terrestrial Radio Access Network (E-UTRAN) Node B (also commonly denoted as an evolved Node B, enhanced Node B, eNodeB, or eNB). An example of an NG-RAN base station is a Next Generation Node B (sometimes also referred to as a g-Node B or gNB).

[0006] The RAN provides its communication services with external entities through its connection to the Core Network (CN). For example, E-UTRAN may utilize the Evolved Packet Core (EPC) while NG-RAN may utilize the 5G Core Network (5GC). BRIEF DESCRIPTION OF THE DRAWINGS

[0007] To easily identify the discussion of any particular element or action, the most significant digit(s) in a reference number refers to the drawing number that first introduces the element.

[0008] Figure 1 An example wireless communication system is shown in accordance with embodiments described herein.

[0009] Figure 2 The message flow of the traditional cell group (CG) change mechanism is illustrated.

[0010] Figure 3 An example message flow of a CG change mechanism according to the implementation scheme described herein is illustrated.

[0011] Figure 4 Another example message flow of the CG change mechanism according to the implementation scheme described in this article is illustrated.

[0012] Figure 5 Another example message flow of the CG change mechanism according to the implementation scheme described in this article is illustrated.

[0013] Figure 6 An example flow chart illustrating operations performed by a UE according to the embodiments described herein.

[0014] Figure 7 Another example flow diagram illustrating operations performed by a UE according to embodiments described herein.

[0015] Figure 8 An example flow diagram illustrating operations performed by a base station according to embodiments described herein.

[0016] Fig. 9 An example architecture of a wireless communication system according to the embodiments described herein is illustrated.

[0017] Fig.10 A system for performing signaling between a wireless device and a network device according to embodiments described herein is illustrated. DETAILED DESCRIPTION

[0018] In the present disclosure, various embodiments relate to processing security keys during a conditional PSCell change (CPC) procedure in a connected state of a UE. Currently, during each PSCell change in a connected state of a UE, level 3 signaling (e.g., RRC signaling) is used to exchange security keys with the UE. In other words, whenever a PSCell change occurs, the UE is reconfigured for security keys. Various embodiments described herein eliminate the need to reconfigure a UE during a CPC procedure for establishing a secure connection with one or more PSCells, which may also be referred to herein as secondary nodes (SNs). The MN and / or the SN may be a base station.

[0019] In 3GPP Technical Specification (TS) 37.340 Version 17, the Conditional PSCell Addition (CPA) procedure was introduced, and according to the procedure, the network can configure multiple candidate secondary cell groups (SCGs) for the UE for SCG addition. For each candidate SCG, the network and / or the master node (MN) may also provide one or more radio conditions that need to be met to connect to a specific SCG. When the UE performs an evaluation of one or more radio conditions for each candidate SCG, the UE may add a specific SCG when one or more radio conditions configured by the network and / or MN are met. Once the UE adds a specific SCG, the UE releases the configuration associated with all other candidate SCGs. Therefore, the UE needs to be reconfigured so that the UE's subsequent CPA mechanism adds another SCG, or the UE's CPC mechanism switches to another SCG.

[0020] The UE may also perform an intra-SN CPC mechanism, an inter-SN CPC mechanism, and / or an MN / SN initiated CPC mechanism, as described in TS 37.340 Version 17, and according to these mechanisms, the UE may perform an evaluation of one or more radio conditions for the intra-SN CPC mechanism, the inter-SN CPC mechanism, and / or the MN / SN initiated CPC mechanism. When one or more conditions corresponding to the intra-SN CPC mechanism, the inter-SN CPC mechanism, and / or the MN / SN initiated CPC mechanism are met, and when the intra-SN CPC mechanism, the inter-SN CPC mechanism, and / or the MN / SN initiated CPC mechanism are completed, the UE may release the configuration associated with the SCG to which the UE is not currently connected. Therefore, the UE needs to be reconfigured to implement the subsequent intra-SN CPC mechanism, the inter-SN CPC mechanism, and / or the MN / SN initiated CPC mechanism.

[0021] In order to establish a secure connection with the primary cell (PCell), the MN may provide the UE with a security configuration to derive a security key (K gNBAs part of the SN addition procedure and / or SN change procedure, the MN may also provide the UE with the sk_counter corresponding to each candidate SN. The UE may use KgNB and sk_counter to derive K SN , in order to further derive a cipher key (CK) and an integrity key (IK) for establishing a secure bearer connection (e.g., a digital radio bearer (DRB) connection or a signaling radio bearer (SRB)), which is terminated at the SN Packet Data Convergence Protocol (PDCP) layer. The MN also uses KgNB and the corresponding sk_counter corresponding to each SN to derive K SN , and the derived K SN Provided to each corresponding SN (or PSCell). SN uses the received K SN To derive CK and IK for secure bearer connection with UE. In the present disclosure, security configuration may also be referred to as CPC configuration.

[0022] In the traditional cell group (CG) change mechanism, when the CG change mechanism is completed, the UE is forced to release the configuration related to the source CG (including security configuration). Therefore, after applying sk_counter, the UE is forced to release sk_counter, and whenever the SN (or PSCell) changes, the MN needs to provide a new sk_counter to the UE and a new K to each candidate PSCell or SN. SN .

[0023] Even in order to avoid such reconfiguration of the UE every time the SN (or PSCell) changes, if the UE is configured to save the previous configuration corresponding to each SCG, the UE may end up reusing the same K when it returns to the same SN (or PSCell). SN , which may pose a security risk.

[0024] Various embodiments described in this disclosure provide solutions that eliminate the need to reconfigure the UE with a security configuration every time the SN (or PSCell) changes, and also ensure that the UE uses a new K when the UE returns to the same SN (or PSCell) to which the UE may have been previously connected. SN .

[0025] Reference will now be made specifically to the representative embodiments / aspects illustrated in the accompanying drawings. It should be understood that the following description is not intended to limit the embodiments to a preferred embodiment. On the contrary, it is intended to cover alternative forms, combinations, modifications and equivalent forms that may be included in the spirit and scope of the embodiments defined by the appended claims.

[0026] Figure 1 An example wireless communication system according to the embodiments described herein is shown. Figure 1 As shown, the wireless communication system 100 may include a UE 102, a MN 104, and two or more SNs, for example, SN0 106, SN1 108, SN2 110, and / or SN3 112. In the present disclosure, an SN may also be referred to as a PSCell.

[0027] In the dual connectivity mode, UE 102 may be connected to MN 104 and at least one of SNs 106, 108, 110, and 112. For example, UE 102 may initially be connected to MN 104 and SN0 106, as shown in FIG. Figure 1 As shown in step 1 of FIG. 1 , when UE 102 moves, one or more radio conditions at UE 102 may change, which may cause UE 102 to connect to SN2 110, such as Figure 1 And, for example, when the radio conditions at UE 102 change again, UE 102 may connect to SN0 106 again, as shown in step 2 of FIG. Figure 1 as shown in step 3 of .

[0028] As described herein, configurations associated with each candidate SN (or SCG) (e.g., each SN to which the UE can connect in dual connectivity (DC) mode) may be provided to the UE 102. The configurations associated with each candidate SN may also include security configurations, which may include an sk_counter corresponding to the SN and a K corresponding to the MN 104. gNB As described herein, the UE may use sk_counter and K corresponding to a particular SN that satisfies one or more radio conditions at the UE 102. gNB The MN 104 may also use K to derive the CK and IK for establishing a secure bearer connection (e.g., a DRB connection or an SRB connection) that terminates at the SN PDCP layer of the particular SN. The one or more radio conditions may be configured by the MN 104 at the UE 102. The MN 104 may also use K gNB and the corresponding sk_counter corresponding to each SN to derive K SN , and the derived K SN Provided to each corresponding SN (or PSCell). The SN can use the received K SN To derive the CK and IK used to establish a secure bearer connection (eg, a DRB connection or an SRB connection) with the UE.

[0029] like Figure 1As shown in step 1 of FIG. 1 , one or more radio conditions configured by MN 104 for UE 102 to connect to the SN may be satisfied relative to SN0 106. Therefore, UE 102 may use sk_counter associated with SN0 106 and KgNB to derive K SN , to establish a secure bearer connection with SN0 106 in accordance with a random access channel (RACH) procedure performed with SN0 106. UE 102 may then notify MN 104 that UE 102 is now in DC mode with SN0 106 and MN 104, and delete or remove configurations (including security configurations) associated with other candidate SNs (e.g., SN1 108, SN2 110, SN3 112).

[0030] A new configuration associated with each candidate SN (or SCG) may be provided to UE 102. The new configuration associated with each candidate SN may include a security configuration including a new sk_counter corresponding to each candidate SN and a K corresponding to MN 104. gNB As described herein, the UE may use new sk_counter and K corresponding to a particular SN that satisfies one or more radio conditions at the UE 102. gNB derive CK and IK for establishing a secure bearer connection (e.g., a DRB connection or an SRB connection) that is terminated at the SN PDCP layer of the particular SN. As described herein, the one or more radio conditions may be configured by the MN 104 at the UE 102. The MN 104 may also derive K using the KgNB and the corresponding new sk_counter corresponding to each SN. SN , and the derived K SN Provided to each corresponding SN (or PSCell). The SN can use the received K SN To derive the CK and IK used to establish a secure bearer connection with the UE.

[0031] When UE 102 moves, one or more radio conditions configured by MN 104 for UE 102 to connect to SN 110 may be satisfied relative to SN2 110, such as Figure 1 The UE may then initiate and perform a RACH procedure with SN2 110 and use the K derived from the new sk_counter and KgNB corresponding to SN2 110. SN to establish a secure bearer connection with SN2 110. The UE may also remove configurations (including security configurations) related to other SNs (eg, SN1 108, SN0 106, and SN3 112) and notify MN 104 that UE 102 is now in DC mode with MN 104 and SN2 110.

[0032] The new configuration associated with each candidate SN (or SCG) may again be provided to the UE 102. The new configuration associated with each candidate SN may include a security configuration including another new sk_counter corresponding to each SN and a K corresponding to the MN 104. gNB MN 104 can also use KgNB and the current sk_counter corresponding to each SN to derive another K SN , and the derived K SN Provided to each corresponding SN (or PSCell) for establishing a secure bearer connection with the UE.

[0033] like Figure 1 As shown at step 3 in , UE 102 may find that one or more radio conditions are satisfied with respect to SN0 106, thereby requiring the UE to connect again with SN0 106. The UE may repeat the steps as described herein to establish a secure bearer connection with SN0 106.

[0034] As described herein, once the UE is connected to a particular SN in accordance with CPC procedures, the MN 104 needs to reconfigure the UE 102 for each candidate SN for configuration (including security configuration). The MN 104 configures or reconfigures the UE 102 using level 3 signaling, such as RRC signaling.

[0035] Even if UE 102 is configured not to delete or remove security configurations corresponding to other candidate SNs after establishing dual connectivity with MN 104 and at least one SN, when the UE establishes dual connectivity with the SN to which it was previously connected, if MN 104 may have provided new K SN , the UE may be using an invalid K SN , which will result in failure to establish a secure connection with SN, as shown below Figure 2 In some cases, if MN 104 does not provide a new K SN , then the UE and SN may use the same K each time SN to establish a secure connection, which may pose a security risk.

[0036] Figure 2 The message flow of the traditional cell group (CG) change mechanism is illustrated. Figure 2As shown, message flow 200 illustrates messages exchanged between UE 202, MN 204, and two or more SNs (e.g., SN0 206, SN1 208, SN2 210, and SN3 212). As shown at 214 in message flow 200, UE 202 uses the CPA procedure mentioned in the present disclosure to be in dual connectivity (DC) mode with MN 204 and SN0 206. In addition, MN 204 may send configuration and request corresponding to establishing a secure connection with UE 202 to each of the other SNs (SN1 208, SN2 210, and SN3 212), as shown in FIG. Figure 2 As shown at 216, 218 and 220 in FIG.

[0037] As described herein, according to some embodiments, at 224, UE 202 may determine that one or more radio conditions are satisfied with respect to SN2 210, and the UE may perform a CPC procedure to connect to SN2 210, wherein UE 202 may perform a RACH procedure with SN2 210, such as Figure 2 Upon successful completion of the RACH procedure with SN2 210, UE 202 may send an RRC connection reconfiguration complete message to MN 204, such as Figure 2 As shown at 226 in; and MN 204 may also send an RRC connection reconfiguration completion message to SN2 210, such as Figure 2 The RRC connection reconfiguration complete message from UE 202 to MN 204 may indicate to MN 204 that UE 202 is now in DC mode with SN2 210.

[0038] At 224, UE 202 may save the security configuration associated with SN0 206 instead of deleting the security configuration, so that when one or more radio conditions specified by MN 204 are again satisfied with respect to SN0 206, UE 202 may later reuse the security configuration associated with SN0 206 while again connecting with SN0 206. In some cases, UE 202 may also save the security configuration associated with SN1 208 and SN3 212.

[0039] As shown at 230 in the message flow 200, the UE 202 is in DC mode with the MN 204 and the SN2 210, and the security configuration is valid for the SN1 208, SN2 210, and SN3 212, but the security configuration corresponding to the SN0 206 is invalid, as described below. At 230, the MN 204 may send a configuration and a request to establish a secure connection with the UE 202 to each of the other SNs (SN1 208, SN0 206, and SN3 212). However, the configuration and the request sent to the SN0 206 to establish a secure connection between the UE 202 and the SN0 206 may be generated by the MN 204 using a different sn_counter value than the sn_counter value previously used and saved by the UE 202 at 224.

[0040] At 238, UE 202 may determine that if one or more radio conditions are again satisfied with respect to SN0 206, UE 202 may perform a CPC mechanism to connect to SN0 206, and UE 202 may perform a RACH procedure 232 with SN0 206. Upon successful completion of the RACH procedure 232 with SN0 206, UE 202 may send an RRC connection reconfiguration complete message to MN 204, such as Figure 2 As shown at 234 in; and MN 204 may also send an RRC connection reconfiguration completion message to SN0 206, such as Figure 2 However, since SN0 206 and UE 202 each use different sn_counter values ​​to generate K for establishing a secure connection, SN , therefore the RRC connection reconfiguration complete message 236 from MN 204 to SN0 206 will not be successful.

[0041] In some embodiments, even if MN 204 is configured not to transmit new security configurations based on updated sn_counter values ​​to candidate SNs, UE 202 and SN0 206 may subsequently end up using the same K SN To establish a secure connection; since the same K is used each time SN , so this secure connection may not be as secure as expected.

[0042] This article uses the following Figures 3 to 5 to describe various solutions according to some embodiments.

[0043] Figure 3 An example message flow of the CG change mechanism according to the embodiment described herein is illustrated. Figure 3As shown, message flow 300 illustrates messages exchanged between UE 302, MN 304, and two or more SNs (e.g., SN0 306, SN1 308, SN2 310, and SN3 312). As shown at 314 in message flow 300, UE 302 may initially connect with MN 304. MN 304 may determine or identify candidate SNs (e.g., SN0 306, SN1 308, SN2 310, and SN3 312), and may send configuration and request to establish a secure connection with UE 302, respectively. Figure 3 The configuration sent by MN 304 to each of SN0 306, SN1 308, SN2 310, and SN3 312 may include the corresponding K of each of SN0 306, SN1 308, SN2 310, and SN3 312. SN .

[0044] MN 304 may also send to UE 302 Figure 3 The security configuration shown at 324 in FIG. The security configuration sent by MN 304 to UE 302 at 324 may include a secondary node key counter (K SN counter, also referred to as sn_counter in this disclosure) and the secondary node key offset (K SN UE 302 may use the received K associated with the SN SN Counter and / or K SN The offset is used to derive K used to establish a secure connection with the SN. SN , where one or more radio conditions specified by MN 304 are met at UE 302.

[0045] In some embodiments, and by way of non-limiting example, UE 302 may be configured, for example by MN 304, to use K SN Counter to derive K for SN SN Once the UE establishes DC mode with the SN, the UE can use K SN Offset to update K SN counter, and then the updated K SN The counter may be used to establish a subsequent connection with the SN when the UE connects to the same SN after connecting to another SN. Therefore, the UE may use a different K when connecting to the same SN again. SN counter.

[0046] In some embodiments, and by way of non-limiting example, UE 302 may be configured, for example by MN 304, to use K before the UE establishes DC mode with the SN. SN Counter and K SN Offset to derive K for SN SN Therefore, each time a UE connects to the same SN, the UE can generate a unique K for that SN. SN In this case, MN 304 can use the K of each candidate SN SN Offset Update K SN counter to transmit the corresponding K to each candidate SN SN MN 304 can also indicate to the candidate SNs the use of K SN To establish a secure connection with UE302.

[0047] like Figure 3 328 in FIG. 3, UE 302 may determine that one or more radio conditions or CPC procedures specified by MN 304 for connecting to SN are satisfied with respect to SN0 306. Therefore, UE 302 may perform RACH procedure 326 to connect to SN0 306, or establish DC mode with MN 304 and SN0 306. UE 302 may send RRC connection reconfiguration complete 330 to MN 304 to notify MN 304 that the UE is now connected to SN0 306, and MN 304 may send RRC connection reconfiguration complete 332 to SN0 306.

[0048] As described herein, according to some embodiments, after establishing DC mode with SN0 306 and MN 304, UE 302 may use K associated with SN0 306. SN offset to update the K associated with SN0 306 SN Counter. Figure 3 As shown at 334 in FIG. 304 , MN 304 may use K associated with SN0306 based on SN The K associated with SN0 306 with the offset update SN counter to regenerate K for SN0 306 SN , and when UE 302 connects to SN0 306 again after connecting to another SN (e.g., SN2 310), K regenerated for SN0 306 is sent to SN0 306. SN , for establishing a secure connection with UE 302. Additionally or alternatively, MN 304 may also indicate to SN0 306 that the K sent by MN 304 to SN0 306 at 334 is SNIt will not be used during the current connection between SN0306 and UE 302, but will be used for subsequent future connections.

[0049] like Figure 3 338 in FIG, UE 302 may determine that one or more radio conditions or SN changes specified by MN 304 for connecting to SN 310 are satisfied relative to SN2 310. Therefore, UE 302 may perform RACH procedure 336 to connect to SN2 310, or establish DC mode with MN 304 and SN2 310. UE 302 may send RRC connection reconfiguration complete 340 to MN 304 to notify MN 304 that the UE is now connected to SN2 310, and MN 304 may send RRC connection reconfiguration complete 342 to SN2 310.

[0050] UE 302 may use the received K associated with SN2 310 SN Counter and / or K SN The offset is used to derive K for establishing a secure connection with SN2 310 SN As described herein, in some embodiments, and by way of non-limiting example, UE 302 may use K associated with SN2 310. SN counter to derive the K associated with SN2 310 SN , and once UE 302 establishes DC mode with SN2 310, UE 302 may use K associated with SN2 310 SN Offset to update K SN Then, when UE 302 connects to SN2 310 after connecting to another SN (e.g., SN0 306, SN1 308, and / or SN3 312), UE 302 may use the updated K SN The counter is used to establish a subsequent connection with SN2 310. Therefore, UE 302 may use different K counters when connecting with SN2 310. SN counter.

[0051] In some embodiments, and by way of non-limiting example, UE 302 may be configured, for example by MN 304, to use K associated with SN2 310 before the UE establishes DC mode with SN2 310. SN Counter and K SN The offset is used to derive K for establishing a secure connection with SN2 310 SN Therefore, each time UE 302 connects with SN2 310, UE 302 may generate a unique K for SN2 310. SN In this case, the K sent to SN2 310 SNBased on the K associated with SN2 310 SN counter based on the K associated with SN2 310 SN Updated by offset.

[0052] As described herein, according to some embodiments, after establishing DC mode with SN2 310 and MN 304, UE 302 may use K associated with SN2 310. SN The offset is used to update the K associated with SN2 310 SN Counter. Figure 3 As shown at 344 in FIG. 3, MN 304 may use K associated with SN2 310 to SN The K associated with SN2 310 with the offset update SN counter to regenerate K for SN2 310 SN , and when UE 302 is connected to SN2 310 again after being connected to another SN (e.g., SN0 306, SN1 308, and / or SN3 312), K regenerated for SN2 310 is sent to SN2 310. SN , for establishing a secure connection with UE 302. Additionally or alternatively, MN 304 may also indicate to SN2 310 that the K sent by MN 304 to SN2 310 at 344 is SN It will not be used during the current connection between SN2 310 and UE 302, but will be used for subsequent future connections.

[0053] like Figure 3 348 in the figure, UE 302 may determine that one or more radio conditions specified by MN 304 for connecting with SN0 306 are met. Therefore, UE 302 may perform RACH procedure 346 to connect with SN0 306, or establish DC mode with MN 304 and SN0 306. UE 302 may send RRC connection reconfiguration complete 350 to MN 304 to notify MN 304 that the UE is now connected with SN0 306, and MN 304 may send RRC connection reconfiguration complete 352 to SN0 306.

[0054] As described herein, according to some embodiments, at step 328, UE 302 may use K associated with SN0 306. SN Counter and / or K SN The offset is used to derive K for establishing a secure connection with SN0 306. SN Therefore, at 348, UE 302 may generate and use a unique K SN Come connect with SN0306.

[0055] like Figure 3 As shown at 354 in FIG. 304 , MN 304 may use K associated with SN0 306 based on SN Offset updated K associated with SN0306 SN counter to regenerate K for SN0 306 SN , and when UE 302 connects to SN0 306 again after connecting to another SN (e.g., SN1 308, SN2 310, and / or SN3 312), K regenerated for SN0 306 is sent to SN0 306. SN , for establishing a secure connection with UE 302. Additionally or alternatively, MN 304 may also indicate to SN0 306 that the K sent by MN 304 to SN0 306 at 354 is SN It will not be used during the current connection between SN0 306 and UE 302, but will be used for subsequent future connections.

[0056] In some embodiments, and by way of non-limiting example, upon receiving an RRC Connection Reconfiguration Complete from a UE, the MN may update the K for the SN to which the UE is currently connected in DC mode. SN , and the updated K SN The SN is sent to the SN so that the SN has the latest security configuration for establishing a secure connection.

[0057] In some embodiments, and as a non-limiting example, the UE may not delete the security configuration associated with any of the candidate SNs, but may use the K of a particular SN when establishing DC mode with that particular SN. SN offset to update the K of that particular SN SN However, when the UE is handed over to a different PCell or MN, the UE may delete the security configuration, such as K SN Counter and / or K SN Offset. The UE may also delete the security configuration when a radio link failure occurs at the PCell or MN. In some embodiments, and as a non-limiting example, the UE may not delete the security configuration received from the PCell before reestablishment, and delete the security configuration when the new security configuration received from the PCell is different from the previously received security configuration.

[0058] In some embodiments, and as a non-limiting example, the UE may delete the security configuration associated with the specific SN or PSCell where the failure occurred. In some cases, when a failure occurs at any of the candidate SNs, the UE may delete the security configuration associated with all candidate SNs or PSCells.

[0059] In some embodiments, and by way of non-limiting example, the security configuration associated with each SN may have a security policy for K SN Counter and / or K SN Different values ​​of the offset. An example message structure for sending the security configuration associated with each candidate SN using RRC signaling may be as follows:

[0060]

[0061]

[0062] In some embodiments, and by way of non-limiting example, at steps 344 and / or 354, the MN may update security configurations associated with other SNs to which the UE is not connected, such as Figure 4 In other words, at 344, MN 304 may update the security configuration associated with SNs 306, 308, and 312, and at 354, the security configuration associated with SNs 308, 310, and 312 may be updated. Similarly, at 338, the UE may update the security configuration associated with SNs 306, 308, and 312 by using the corresponding K SN Offset updates their corresponding K SN In other words, at 338, the UE may not use the CPC mechanism to update the security configuration associated with SN2 310 to which the UE 302 is currently connected. At 348, the UE 302 may update the security configuration associated with the SN2 310 using the corresponding K counters of the SNs 308, 310, and 312. SN Offset updates their corresponding K SN In other words, at 348, the UE may not use the CPC mechanism to update the security configuration associated with the SN0 306 to which the UE 302 is currently connected.

[0063] Figure 4 Another example message flow of the CG change mechanism according to the embodiment described herein is illustrated. Figure 4 As shown, message flow 400 illustrates messages exchanged between UE 402, MN 404, and two or more SNs (e.g., SN0 406, SN1 408, SN2 410, and SN3 412). As shown at 414 in message flow 400, UE 402 is connected to MN 404 alone. MN 404 may determine or identify candidate SNs (e.g., SN0 406, SN1 408, SN2 410, and SN3 412), and may send configuration and requests corresponding to establishing a secure connection with UE 402, as shown in FIG. Figure 4The configuration sent by MN 404 to each of SN0 406, SN1 408, SN2 410, and SN3 412 may include the corresponding K of each of SN0 406, SN1 408, SN2 410, and SN3 412. SN As described herein, according to some embodiments, the corresponding K of each of SN0 406, SN1 408, SN2 410, and SN3 412 SN It may be generated by MN 404.

[0064] MN 404 may also send to UE 402 Figure 4 The security configuration shown at 424 in FIG. The security configuration sent by MN 404 to UE 402 at 424 may include K corresponding to each candidate SN. SN The counter and K corresponding to each candidate SN SN The UE may use the received K associated with the SN SN Counter and / or K SN The offset is used to derive K used to establish a secure connection with the SN. SN , where one or more radio conditions specified by MN 404 may be satisfied at UE 402.

[0065] In some embodiments, and by way of non-limiting example, UE 402 may be configured, for example by MN 404, to use K SN Counter to derive K for SN SN Once the UE establishes DC mode with the SN, the UE can use K SN Offset to update K SN Then, when UE 402 connects to the same SN after connecting to another SN, the UE may use the updated K SN The counter is used to establish a subsequent connection with the SN, so that the UE can use a different K when connecting to the same SN again. SN counter.

[0066] In some embodiments, and by way of non-limiting example, UE 402 may be configured, for example by MN 404, to use K before the UE establishes DC mode with the SN. SN Counter and K SN Offset to derive K for SN SN Therefore, each time a UE connects to the same SN, the UE can generate a unique K for that SN. SN .

[0067] like Figure 4428 in the figure, UE 402 may determine that one or more radio conditions or SN changes specified by MN 404 for connecting to an SN are satisfied relative to SN0 406. Therefore, UE 402 may perform RACH procedure 426 to connect to SN0 406, or establish DC mode with MN 404 and SN0 406. UE 402 may send RRC connection reconfiguration complete 430 to MN 404 to notify MN 404 that the UE is now connected to SN0 406, and MN 404 may send RRC connection reconfiguration complete 432 to SN0 406.

[0068] As described herein, according to some embodiments, after establishing DC mode with SN0 406 and MN 404, UE 402 may use the corresponding K of SN1 408, SN2 410 and / or SN3 412. SN Offset and K SN The counters are used to update the K associated with these SNs. SN Counter. Figure 4 As shown at 434, 436 and 438 in FIG. 4, MN 304 may be based on the corresponding K of SN1 408, SN2 410 and / or SN3 412. SN Offset and K SN The counter is used to regenerate the corresponding K for each of these SNs SN , and sends the corresponding regenerated K of these SNs to SN1 408, SN2 410 and / or SN3 412 SN .

[0069] like Figure 4 442 in FIG. 4 , UE 402 may determine that one or more radio conditions or CPC procedures specified by MN 404 for connecting to SN 410 are satisfied with respect to SN2 410. Therefore, UE 402 may perform RACH procedure 440 to connect to SN2 410, or establish DC mode with MN 404 and SN2 410. UE 402 may send RRC connection reconfiguration complete 444 to MN 404 to notify MN 404 that the UE is now connected to SN2 410, and MN 404 may send RRC connection reconfiguration complete 446 to SN2 410.

[0070] UE 402 may use the received K associated with SN2 410 SN Counter and / or K SN The offset is used to derive K for establishing a secure connection with SN2 410 SN As described herein, in some embodiments, and by way of non-limiting example, UE 402 may use K associated with SN2 410.SN counter to derive the K associated with SN2 410 SN , and once UE 402 establishes DC mode with SN2 410, UE 402 may use K associated with SN2 410 SN Offset to update K SN counter, and subsequently when UE 402 connects to SN2 410 after connecting to another SN (e.g., SN0 406, SN1 408, and / or SN3 412), the updated K is used. SN The counter is used to establish a subsequent connection with SN2 410. Therefore, UE 402 may use different K counters when connecting with SN2 410. SN counter.

[0071] In some embodiments, and by way of non-limiting example, UE 402 may be configured, for example by MN 404, to use K associated with SN2 410 before the UE establishes DC mode with SN2 410. SN Counter and K SN The offset is used to derive K for establishing a secure connection with SN2 410 SN Therefore, each time UE 402 connects with SN2 410, UE 402 may generate a unique K for SN2 410. SN .

[0072] As described herein, according to some embodiments, after establishing DC mode with SN2 410 and MN 404, UE 402 may use the corresponding K of SN1 408, SN0 406 and / or SN3 412. SN Offset and K SN The counters are used to update the K associated with these SNs. SN Counter. Figure 4 As shown at 448, 450 and 452 in FIG. 4, MN 404 may be based on the corresponding K of SN1 408, SN0 406 and / or SN3 412. SN Offset and K SN The counter is used to regenerate the corresponding K for each of these SNs SN , and sends the corresponding regenerated K of these SNs to SN1 408, SN0 406 and / or SN3 412 SN .

[0073] like Figure 4456 in the figure, UE 402 may determine that one or more radio conditions specified by MN 404 for connecting with SN0 406 are met. Therefore, UE 402 may perform RACH procedure 454 to connect with SN0 406, or establish DC mode with MN 404 and SN0 406. UE 402 may send RRC connection reconfiguration complete 458 to MN 404 to notify MN 404 that UE 402 is now connected with SN0 406, and MN 404 may send RRC connection reconfiguration complete 460 to SN0 406.

[0074] At 462 , MN 404 may repeat the operations performed at 448 , 450 , and 452 , but this time 448 is performed with respect to SN2 410 .

[0075] In some embodiments, and as a non-limiting example, the UE may not delete the security configuration associated with any of the candidate SNs, but may use the K of a particular SN when establishing DC mode with that particular SN. SN offset to update the K of that particular SN SN However, when the UE is handed over to a different PCell or MN, the UE may delete the security configuration, such as K SN Counter and / or K SN Offset. The UE may also delete the security configuration when a radio link failure occurs at the PCell or MN. In some embodiments, and as a non-limiting example, the UE may not delete the security configuration received from the PCell before reestablishment, and delete the security configuration when the new security configuration received from the PCell is different from the previously received security configuration.

[0076] In some embodiments, and as a non-limiting example, the UE may delete the security configuration associated with the specific SN or PSCell where the failure occurred. In some cases, when a failure occurs at any of the candidate SNs, the UE may delete the security configuration associated with all candidate SNs or PSCells.

[0077] In some embodiments, and by way of non-limiting example, the security configuration associated with each SN may have a security policy for K SN Counter and / or K SN The UE may also specify different values ​​of the offset and further indicate whether the UE must use the CPC mechanism to update the security configuration for the SN to which the UE is currently attached, or to update the security configuration for other SNs to which the UE is not currently attached according to the CPC mechanism. An example message structure for sending the security configuration associated with each candidate SN and indicating that the UE needs to use RRC signaling to update the security configuration associated with one or more SNs may be as follows:

[0078]

[0079] like Figure 4 As shown, the MN provides updated security configurations to all candidate SNs except the SN to which the UE is currently connected in DC mode. However, in some embodiments, the MN may provide updated security configurations to all candidate SNs including the SN to which the UE is currently connected in DC mode, such as Figure 5 This is illustrated in the message flow shown.

[0080] Figure 5 Another example message flow of the CG change mechanism according to the embodiment described herein is illustrated. Figure 5 As shown, message flow 500 illustrates messages exchanged between UE 502, MN 504, and two or more SNs (e.g., SN0 506, SN1 508, SN2 510, and SN3 512). As shown at 514 in message flow 500, UE 502 is connected only to MN 504. MN 504 may determine or identify candidate SNs (e.g., SN0 506, SN1 508, SN2 510, and SN3 512), and may send configuration and request corresponding to establishing a secure connection with UE 502, as shown in FIG. Figure 5 The configuration sent by MN 504 to each of SN0 506, SN1 508, SN2 510, and SN3 512 may include the corresponding K of each of SN0 506, SN1 508, SN2 510, and SN3 512. SN .

[0081] MN 504 may also send to UE 502 Figure 5 The security configuration shown at 524 in FIG. 524 is sent by MN 504 to UE 502. The security configuration may include a secondary node key counter (K SN counter) and the secondary node key offset (K SN The UE may use the received K associated with the SN. SN Counter and / or K SN The offset is used to derive K used to establish a secure connection with the SN. SN , where one or more radio conditions specified by MN 504 may be satisfied at UE 502.

[0082] In some embodiments, and by way of non-limiting example, UE 502 may be configured, for example by MN 504, to use K SN Counter to derive K for SNSN Once the UE establishes DC mode with the SN, the UE can use K SN Offset to update K SN counter, and then the updated K SN The counter can be used to establish subsequent future connections with the SN. Therefore, the UE can use a different K when connecting to the same SN again. SN counter.

[0083] In some embodiments, and by way of non-limiting example, the UE 502 may be configured, for example by the MN 504, to use a K-based UE before the UE establishes DC mode with the SN. SN Offset Update K SN Counter to derive K for SN SN Therefore, each time a UE connects to the same SN, the UE can generate a unique K for that SN. SN .

[0084] like Figure 5 As shown at 528 in FIG. 5 , UE 502 may determine that one or more radio conditions or CPC procedures specified by MN 504 for connecting to SN are satisfied with respect to SN0 506. Therefore, UE 502 may perform RACH procedure 526 to connect to SN0 506, or establish DC mode with MN 504 and SN0 506. UE 502 may send RRC connection reconfiguration complete 530 to MN 504 to notify MN 504 that the UE is now connected to SN0 506, and MN 504 may send RRC connection reconfiguration complete 532 to SN0 506.

[0085] As described herein, according to some embodiments, after establishing a DC with SN0 506 and MN 504, UE 502 may use the corresponding K of SN0 506, SN1 508, SN2 510 and / or SN3 512. SN Offset and K SN counter to update the K associated with each candidate SN including these SNs SN A counter is used to establish a future connection with any of the candidate SNs.

[0086] like Figure 5 As shown at 534, 536, 538 and 540 in FIG. 5, MN 504 may be based on the corresponding K of SN0 506, SN1 508, SN2 510 and / or SN3 512. SN Offset and K SN The counter is used to regenerate the corresponding K for each of these SNs SN, and sends the corresponding regenerated K of these SNs to SN0 506, SN1 508, SN2 510 and / or SN3 512 SN .

[0087] like Figure 5 As shown at 544 in FIG. 5 , UE 502 may determine that one or more radio conditions or CPC procedures specified by MN 504 for connecting with SN are satisfied with respect to SN2 510. Therefore, UE 502 may perform RACH procedure 542 to connect with SN2 510, or establish DC mode with MN 504 and SN2 510. UE 502 may send RRC connection reconfiguration complete 546 to MN 504 to notify MN 504 that the UE is now connected with SN2 510, and MN 504 may send RRC connection reconfiguration complete 548 to SN2 510.

[0088] UE 502 may use the received K associated with SN2 510 SN Counter and / or K SN The offset is used to derive K for establishing a secure connection with SN2 510 SN Once UE 502 establishes DC with SN2 510, UE 502 may use K associated with SN2 510 to SN Offset to update K SN counter, and subsequently when the UE 502 connects to SN2 510 after connecting to another SN (e.g., SN0 506, SN1 508, and / or SN3 512), the updated K is used. SN The counter is used to establish subsequent connections with SN2 510. Therefore, UE 502 may use different K counters when connecting with SN2 510. SN counter.

[0089] As described herein, according to some embodiments, after establishing DC with SN2 510 and MN 504, UE 502 may use the corresponding K of SN1 508, SN0 506 and / or SN3 512. SN Offset and K SN The counters are used to update the K associated with these SNs. SN Counter. Figure 5 As shown at 550, 552, 554 and 556 in FIG. 5, MN 504 may be based on the corresponding K of SN0 506, SN1 508, SN2 510 and / or SN3 512. SN Offset and K SN The counter is used to regenerate the corresponding K for each of these SNs SN, and sends the corresponding regenerated K of these SNs to SN0 506, SN1 508, SN2 510 and / or SN3 512 SN .

[0090] like Figure 5 560 in the figure, UE 502 may determine that one or more radio conditions specified by MN 504 for connecting with SN0 506 are met. Therefore, UE 502 may perform RACH procedure 558 to connect with SN0 506, or establish DC mode with MN 504 and SN0 506. UE 502 may send RRC connection reconfiguration complete 562 to MN 504 to notify MN 504 that the UE is now connected with SN0 506, and MN 504 may send RRC connection reconfiguration complete 564 to SN0 506.

[0091] As described herein, according to some embodiments, at 566, the MN 504 may repeat the operations performed at 550, 552, 554, and 556, and the UE 502 may also determine the K value based on the corresponding K value. SN Offset to update the K of each candidate SN SN counter.

[0092] In some embodiments, and as a non-limiting example, the UE may not delete the security configuration associated with any of the candidate SNs, but may use the K of a particular SN when establishing DC mode with that particular SN. SN offset to update the K of that particular SN SN However, when the UE is handed over to a different PCell or MN, the UE may delete the security configuration, such as K SN Counter and / or K SN Offset. The UE may also delete the security configuration when a radio link failure occurs at the PCell or MN. In some embodiments, and as a non-limiting example, the UE may not delete the security configuration received from the PCell before reestablishment, and delete the security configuration when the new security configuration received from the PCell is different from the previously received security configuration.

[0093] In some embodiments, and as a non-limiting example, the UE may delete the security configuration associated with the specific SN or PSCell where the failure occurred. In some cases, when a failure occurs at any of the candidate SNs, the UE may delete the security configuration associated with all candidate SNs or PSCells.

[0094] In some embodiments, and by way of non-limiting example, the security configuration associated with each SN may have a security policy for K SN Counter and / or KSN The UE may also specify different values ​​of the offset and further indicate whether the UE must use the CPC mechanism to update the security configuration for the SN to which the UE is currently attached, or update the security configuration for other SNs to which the UE is not currently attached according to the CPC mechanism. An example message structure for sending the security configuration associated with each candidate SN and indicating that the UE needs to use RRC signaling to update the security configuration associated with each candidate SN may be as follows:

[0095]

[0096]

[0097] therefore, Figure 4 , Figure 5 and Figure 6 The message flows corresponding to five different implementations are illustrated, in which the CPC mechanism can be performed by the UE without sending additional RRC signaling to the UE. As described herein, according to some implementations, as a prerequisite for each of the four implementations, the MN can use the K associated with each candidate SN. SN Counter and K SN Offset to generate the corresponding K SN , and the corresponding K SN Each candidate SN provided to the UE. The MN may also provide the UE with a K associated with each candidate SN. SN Counter and K SN Offset configuration.

[0098] In a first embodiment, when one or more radio conditions are met at the UE relative to one of the candidate SNs, the UE may trigger the CPC mechanism and use the corresponding K SN The counter is used to derive the K corresponding to the candidate SN in the candidate SN. SN After the CPC mechanism is completed, the UE can then use the corresponding K SN The offset is used to update the K corresponding to the one of the candidate SNs to which the UE is currently connected. SN Counter. In one example, K SN The counter can be incremented by K SN In another example, a different formula can be used based on K SN Offset Update K SN After the CPC mechanism is triggered at the UE, the MN may provide updated security configuration to the SN with which the UE is currently in DC mode.

[0099] In a second embodiment, when one or more radio conditions are met at the UE relative to one of the candidate SNs, the UE may trigger the CPC mechanism and use the corresponding K SN Counter and K SN The offset is used to derive the K corresponding to the one of the candidate SNs. SN In one example, K SN The counter can be incremented by K SN In another example, a different formula can be used based on K SN Offset Update K SN After the CPC mechanism is completed, the MN can SN Offset Update K SN The MN generates an updated security configuration by using a counter, and after the CPC mechanism is triggered at the UE, provides the updated security configuration to the SN with which the UE is currently in DC mode. The MN can also indicate to the SN that the updated security configuration is used to establish a future connection with the UE, rather than to establish a current connection with the UE.

[0100] In a third embodiment, when one or more radio conditions are met at the UE relative to one of the candidate SNs, the UE may trigger the CPC mechanism and use the corresponding K SN The counter is used to derive the K corresponding to the candidate SN in the candidate SN. SN After the CPC mechanism is completed, the UE can then use the corresponding K SN The offset is used to update the K corresponding to the candidate SNs to which the UE is not currently connected SN Counter. In one example, K SN The counter can be incremented by K SN In another example, a different formula can be used based on K SN Offset Update K SN After the CPC mechanism is triggered at the UE, the MN may provide updated security configurations to candidate SNs to which the UE is not currently connected in DC mode.

[0101] In a fourth embodiment, when one or more radio conditions are met at the UE relative to one of the candidate SNs, the UE may trigger the CPC mechanism and use the corresponding K SN Counter and K SN The offset is used to derive the K corresponding to the one of the candidate SNs. SN In one example, K SN The counter can be incremented by K SN In another example, a different formula can be used based on K SN Offset Update K SNAfter the CPC mechanism is completed, the UE can use the corresponding K of the candidate SN SN The offset is used to update the K corresponding to the candidate SNs to which the UE is not currently connected SN counter, and after the CPC mechanism is triggered at the UE, when the UE is not currently connected in DC mode, the MN can provide updated security configurations to these SNs.

[0102] In a fifth embodiment, when one or more radio conditions are met at the UE relative to one of the candidate SNs, the UE may trigger the CPC mechanism and use the corresponding K SN The counter is used to derive the K corresponding to the candidate SN in the candidate SN. SN After the CPC mechanism is completed, in one example, the UE can SN The counter increments by the corresponding K SN In other examples, different formulas can be used to update the counter based on K SN Offset Update K SN The MN may similarly update the security configuration corresponding to each of the candidate SNs and provide the updated security configuration to each of the candidate SNs.

[0103] Figure 6 An example flow chart illustrating operations performed by a UE according to an embodiment described herein is illustrated. As shown at 602 in flowchart 600, the UE may receive SCG configuration information for each of at least two SNs from the MN. As described herein, according to some embodiments, the UE may be configured to operate in a DC mode having a connection with the MN and a connection with the SN. Based on one or more radio conditions satisfied at the UE, the UE may have more than one SN to which the UE can be connected. Therefore, as described herein, according to some embodiments, the SCG configuration information may include information about one or more radio conditions that need to be satisfied to trigger the CPC procedure. The SCG configuration information associated with each candidate SN (at least two SNs) may include a security configuration structure corresponding to each candidate SN.

[0104] As described herein, in some embodiments, and by way of non-limiting example, the security configuration structure may include a K associated with each candidate SN. SN Counter and K SN The security configuration structure may also indicate whether the UE needs to update security associated with the SN to which the UE is currently connected according to the CPC procedure, whether security needs to be updated for other candidate SNs to which the UE is not currently connected according to the CPC procedure, or whether security needs to be updated for all candidate SNs. The K associated with each candidate SN may be used.SN Counter and / or K SN The offset is used to derive the K corresponding to each candidate SN SN , to establish a secure bearer connection with the SN.

[0105] At 604, the UE may determine whether one or more radio conditions for triggering a CPC procedure are satisfied relative to an SN in the candidate SNs. For example, in addition to the MN, there may be a first SN and a second SN. The UE may connect to the MN, and the UE may determine at 604 that one or more radio conditions for the UE to trigger a CPC procedure to connect to the first SN are satisfied.

[0106] At 606, the UE may use a security configuration structure associated with the first SN (eg, a first security configuration structure) to derive a K corresponding to the first SN. SN As described herein, according to some embodiments, the K corresponding to the first SN SN Can be used alone K SN In some embodiments, and as a non-limiting example, the K corresponding to the first SN is derived from the counter. SN This can be done by SN Offset Update K SN Counter to export.

[0107] At 608, the UE may perform a RACH procedure (or an initial access procedure) to connect with the first SN. Thus, the UE may establish a DC with the first SN and the MN. The UE may use the derived K corresponding to the first SN. SN To establish a secure connection with the first SN.

[0108] As described herein, according to some embodiments, at 610, the UE may update a security configuration structure associated with the second SN (e.g., a second security configuration structure). As a non-limiting example, the UE may update the security configuration structure associated with the second SN by adding the K of the second security configuration structure. SN Offset to update the second security configuration structure K SN counter, or the UE may use any other formula based on K of the second security configuration structure SN Offset to update the second security configuration structure K SN counter.

[0109] At 612, the UE may communicate the updated security configuration structure associated with the second SN to the MN. As a non-limiting example, the UE may communicate the updated K SN The counter is communicated to the MN so that the MN can update the K SN Therefore, the second SN can have the correct K SN , in order to establish a secure connection with the UE in the future.

[0110] Additionally or alternatively, the UE may save the updated second security configuration structure and the first security configuration structure instead of deleting or removing these security configuration structures from its memory, thereby eliminating the need to reconfigure the UE by using the SCG configuration again using RRC signaling after performing the CPC procedure.

[0111] Figure 7 Another example flowchart of operations performed by a UE according to the embodiments described herein is illustrated. As shown at 702 in flowchart 700, the UE may receive SCG configuration information for each of at least two SNs from the MN. As described herein, according to some embodiments, the UE may be configured to operate in a DC mode having a connection with the MN and a connection with the SN. Based on one or more radio conditions satisfied at the UE, the UE may have more than one SN to which the UE can be connected. Therefore, as described herein, according to some embodiments, the SCG configuration information may include information about one or more radio conditions that need to be satisfied to trigger the CPC procedure. The SCG configuration information associated with each candidate SN (at least two SNs) may include a security configuration structure corresponding to each candidate SN.

[0112] As described herein, in some embodiments, and by way of non-limiting example, the security configuration structure may include a K associated with each candidate SN. SN Counter and K SN The security configuration structure may also indicate whether the UE needs to update security associated with the SN to which the UE is currently connected according to the CPC procedure, whether security needs to be updated for other candidate SNs to which the UE is not currently connected according to the CPC procedure, or whether security needs to be updated for all candidate SNs. The K associated with each candidate SN may be used. SN Counter and / or K SN The offset is used to derive the K corresponding to each candidate SN SN , to establish a secure bearer connection with the SN.

[0113] At 704, the UE may determine whether one or more radio conditions for triggering a CPC procedure are satisfied relative to an SN in the candidate SNs. For example, in addition to the MN, there may be a first SN and a second SN. The UE may connect to the MN, and the UE may determine at 704 that one or more radio conditions for the UE to trigger a CPC procedure to connect to the first SN are satisfied.

[0114] At 706, the UE may use a security configuration structure associated with the first SN (eg, a first security configuration structure) to derive a K corresponding to the first SN. SNAs described herein, according to some embodiments, the K corresponding to the first SN SN Can be used alone K SN In some embodiments, and as a non-limiting example, the K corresponding to the first SN is derived from the counter. SN This can be done by SN Offset Update K SN Counter to export.

[0115] At 708, the UE may perform a RACH procedure (or an initial access procedure) to connect with the first SN. Thus, the UE may establish a DC mode with the first SN and the MN. The UE may use the derived K corresponding to the first SN. SN To establish a secure connection with the first SN.

[0116] As described herein, according to some embodiments, at 710, the UE may update a security configuration structure associated with the first SN (e.g., a first security configuration structure). As a non-limiting example, the UE may update the security configuration structure associated with the first SN by adding the K of the first security configuration structure. SN Offset to update the first security configuration structure K SN counter, or the UE may use any other formula based on K of the first security configuration structure SN Offset to update the first security configuration structure K SN counter.

[0117] At 712, the UE may communicate the updated security configuration structure associated with the first SN to the MN. As a non-limiting example, the UE may communicate the updated K SN The counter is communicated to the MN so that the MN can update the K SN Therefore, the first SN can have the correct K SN , in order to establish a secure connection with the UE in the future.

[0118] Additionally or alternatively, the UE may save the updated first security configuration structure and the second security configuration structure instead of deleting or removing these security configuration structures from its memory, thereby eliminating the need to reconfigure the UE by using the SCG configuration again using RRC signaling after performing the CPC procedure.

[0119] Figure 8An example flow chart illustrating operations performed by a base station according to an embodiment described herein is illustrated. As shown at 802 in flowchart 800, a base station (or MN) may send SCG configuration information for each of at least two candidate SNs to a UE. As described herein, according to some embodiments, the UE may be configured to operate in a DC mode having a connection with the MN and a connection with the SN. Based on one or more radio conditions satisfied at the UE, the UE may have more than one SN to which the UE can be connected. Therefore, as described herein, according to some embodiments, the SCG configuration information may include information about one or more radio conditions that need to be satisfied to trigger a CPC procedure. The SCG configuration information associated with each candidate SN (at least two SNs) may include a security configuration structure corresponding to each candidate SN.

[0120] As described herein, in some embodiments, and by way of non-limiting example, the security configuration structure may include a K associated with each candidate SN. SN Counter and / or K SN The security configuration structure may also indicate whether the UE needs to update security associated with the SN to which the UE is currently connected according to the CPC procedure, whether security needs to be updated for other candidate SNs to which the UE is not currently connected according to the CPC procedure, or whether security needs to be updated for all candidate SNs. The K associated with each candidate SN may be used. SN Counter and / or K SN The offset is used to derive the K corresponding to each candidate SN SN , to establish a secure bearer connection with the SN.

[0121] At 804, the MN may also send a K corresponding to each candidate SN to each candidate SN. SN , where K corresponding to each candidate SN SN The corresponding K of each candidate SN can be SN Counter and / or K SN Derived by offset.

[0122] At 806, the MN may receive updated K of one or more SNs from the UE. SN As a non-limiting example, a UE connected to a MN and a first SN may send an updated K counter of a second SN in accordance with the CPC procedure. SN The counter is used to establish a DC mode with the MN and the second SN. Therefore, the MN can receive the updated K of the second SN from the UE. SN In some cases, as described herein, according to some embodiments, the MN may receive updated K of the first SN or all candidate SNs in accordance with the CPC procedure. SN Counter to establish DC mode with the MN and the second SN.

[0123] At 808, the MN may recalculate the K with respect to one or more candidate SNs (the MN has received the updated K with respect to the one or more candidate SNs at 806). SN Counter) corresponding to K SN , and at 810, the recalculated K corresponding to the one or more candidate SNs is sent to the corresponding one or more candidate SNs. SN Therefore, after the UE performs the CPC procedure, the MN may not need to reconfigure the UE using the SCG configuration.

[0124] In some embodiments, and by way of non-limiting example, the MN may send a security configuration structure to each candidate SN, the security configuration structure including K SN Counter and K SN The MN can also instruct each candidate SN how to use K SN Counter and / or K SN Offset to derive K SN , to establish a secure connection with the UE after the UE performs the CPC procedure with respect to any of the candidate SNs. When the UE connected to the SN is no longer connected to the SN after performing the CPC procedure, the candidate SN may update its corresponding K SN .

[0125] Embodiments contemplated herein include an apparatus having components for performing one or more elements of method 600, 700, or 800 and / or message flow 300, 400, or 500. In the context of method 600 or 700 and / or message flow 300, 400, or 500, the apparatus may be, for example, an apparatus of a UE (such as wireless device 1002 as a UE, as described herein). In the context of method 800 and / or message flow 300, 400, or 500, the apparatus may be, for example, an apparatus of a base station (such as network device 1020 as a base station, as described herein).

[0126] Embodiments contemplated herein include one or more non-transitory computer-readable media storing instructions that, when executed by one or more processors of an electronic device, cause the electronic device to perform one or more elements of method 600, 700, or 800 and / or message flow 300, 400, or 500. In the context of method 600 or 700 and / or message flow 300, 400, or 500, the non-transitory computer-readable medium may be, for example, a memory of a UE (such as memory 1006 of wireless device 1002 as a UE, as described herein). In the context of method 800 and / or message flow 300, 400, or 500, the non-transitory computer-readable medium may be, for example, a memory of a base station (such as memory 1024 of network device 1020 as a base station, as described herein).

[0127] Embodiments contemplated herein include an apparatus having logical components, modules, or circuits for performing one or more elements of the method 600, 700, or 800 and / or the message flow 300, 400, or 500. In the context of the method 600 or 700 and / or the message flow 300, 400, or 500, the apparatus may be, for example, an apparatus of a UE (such as the wireless device 1002 as a UE, as described herein). In the context of the method 800 and / or the message flow 300, 400, or 500, the apparatus may be, for example, an apparatus of a base station (such as the network device 1020 as a base station, as described herein).

[0128] Embodiments contemplated herein include an apparatus having one or more processors and one or more computer-readable media using or storing instructions that, when executed by the one or more processors, cause the one or more processors to perform one or more elements of the method 600, 700, or 800 and / or the message flow 300, 400, or 500. In the context of the method 600 or 700 and / or the message flow 300, 400, or 500, the apparatus may be, for example, an apparatus of a UE (such as the wireless device 1002 as a UE, as described herein). In the context of the method 800 and / or the message flow 300, 400, or 500, the apparatus may be, for example, an apparatus of a base station (such as the network device 1020 as a base station, as described herein).

[0129] Embodiments contemplated herein include a signal as described in or associated with one or more elements of method 600 , 700 , or 800 and / or message flow 300 , 400 , or 500 .

[0130] Embodiments contemplated herein include a computer program or computer program product having instructions, wherein the program, when executed by a processor, causes the processor to perform one or more elements of the method 600, 700, or 800 and / or the message flow 300, 400, or 500. In the context of the method 600 or 700 and / or the message flow 300, 400, or 500, the processor may be a processor of a UE (such as the processor 1004 of the wireless device 1002 as a UE, as described herein), and the instructions may be located, for example, in the processor and / or on a memory of the UE (such as the memory 1006 of the wireless device 1002 as a UE, as described herein). In the context of method 800 and / or message flows 300, 400, or 500, the processor may be a processor of a base station (such as processor 1022 of network device 1020 as a base station, as described herein), and the instructions may be located, for example, in the processor and / or in a memory of the base station (such as memory 1024 of network device 1020 as a base station, as described herein).

[0131] Fig. 9 An example architecture of a wireless communication system according to the embodiments described herein is illustrated. The description provided below is for an example wireless communication system 900 operating in conjunction with the LTE system standard and / or the 5G or NR system standard provided in the 3GPP technical specifications.

[0132] like Fig. 9 As shown, wireless communication system 900 includes UE 902 and UE 904 (although any number of UEs may be used). In this example, UE 902 and UE 904 are illustrated as smartphones (e.g., handheld touch screen mobile computing devices capable of connecting to one or more cellular networks), but may also include any mobile or non-mobile computing device configured for wireless communication.

[0133] UE 902 and UE 904 may be configured to be communicatively coupled to RAN 906. In an embodiment, RAN 906 may be NG-RAN, E-UTRAN, etc. UE 902 and UE 904 utilize connections (or channels) (shown as connection 908 and connection 910, respectively) with RAN 906, where each connection (or channel) includes a physical communication interface. RAN 906 may include one or more base stations, such as base station 912 and base station 914, to implement connection 908 and connection 910.

[0134] In this example, connection 908 and connection 910 are air interfaces that enable such communicative coupling and may conform to the RAT used by the RAN 906 , such as, for example, LTE and / or NR.

[0135] In some embodiments, UE 902 and UE 904 may also communicate data directly via side link interface 916. UE 904 is shown as being configured to access an access point (shown as AP 918) via connection 920. As an example, connection 920 may include a local wireless connection, such as a connection conforming to any IEEE 802.11 protocol, wherein AP 918 may include In this example, AP 918 may be connected to another network (eg, the Internet) without going through CN 924.

[0136] In an embodiment, UE 902 and UE 904 may be configured to communicate with each other or with base station 912 and / or base station 914 over a multi-carrier communication channel using orthogonal frequency division multiplexing (OFDM) communication signals according to various communication techniques, such as, but not limited to, orthogonal frequency division multiple access (OFDMA) communication techniques (e.g., for downlink communication) or single carrier frequency division multiple access (SC-FDMA) communication techniques (e.g., for uplink and ProSe or sidelink communication), although the scope of the embodiments is not limited in this respect. The OFDM signal may include multiple orthogonal subcarriers.

[0137] In some embodiments, all or part of the base station 912 or the base station 914 may be implemented as one or more software entities running on a server computer as part of a virtual network. In addition, or in other embodiments, the base station 912 or the base station 914 may be configured to communicate with each other via the interface 922. In an embodiment where the wireless communication system 900 is an LTE system (e.g., when the CN 924 is an EPC), the interface 922 may be an X2 interface. The X2 interface may be defined between two or more base stations (e.g., two or more eNBs, etc.) connected to the EPC and / or between two eNBs connected to the EPC. In an embodiment where the wireless communication system 900 is an NR system (e.g., when the CN 924 is a 5GC), the interface 922 may be an Xn interface. The Xn interface is defined between two or more base stations (e.g., two or more gNBs, etc.) connected to the 5GC, between the base station 912 (e.g., gNB) and the eNB connected to the 5GC, and / or between two eNBs connected to the 5GC (e.g., CN 924).

[0138] The RAN 906 is shown communicatively coupled to the CN 924. The CN 924 may include one or more network elements 926 configured to provide various data and telecommunication services to customers / subscribers (e.g., UE 902 and users of UE 904) connected to the CN 924 via the RAN 906. The components of the CN 924 may be implemented in one physical device or separate physical devices including components for reading and executing instructions from a machine-readable or computer-readable medium (e.g., a non-transitory machine-readable storage medium).

[0139] In an embodiment, CN 924 may be an EPC, and RAN 906 may be connected to CN 924 via an S1 interface 928. In an embodiment, S1 interface 928 may be divided into two parts: an S1 user plane (S1-U) interface that carries service data between base station 912 or base station 914 and a serving gateway (S-GW); and an S1-MME interface that is a signaling interface between base station 912 or base station 914 and a mobility management entity (MME).

[0140] In an embodiment, CN 924 may be a 5GC, and RAN 906 may be connected to CN 924 via an NG interface 928. In an embodiment, NG interface 928 may be divided into two parts: an NG user plane (NG-U) interface, which carries service data between base station 912 or base station 914 and a user plane function (UPF); and an S1 control plane (NG-C) interface, which is a signaling interface between base station 912 or base station 914 and an access and mobility management function (AMF).

[0141] Generally, the application server 930 may be an element that provides applications that use Internet Protocol (IP) bearer resources with the CN 924 (e.g., packet-switched data services). The application server 930 may also be configured to support one or more communication services (e.g., VoIP sessions, group communication sessions, etc.) for the UE 902 and UE 904 via the CN 924. The application server 930 may communicate with the CN 924 via an IP communication interface 932.

[0142] Fig.10 A system 1000 for performing signaling 1038 between a wireless device 1002 and a network device 1020 according to an embodiment described herein is illustrated. The system 1000 may be part of a wireless communication system as described herein. The wireless device 1002 may be, for example, a UE of a wireless communication system. The network device 1020 may be, for example, a base station (e.g., an eNB or gNB) of a wireless communication system.

[0143] The wireless device 1002 may include one or more processors 1004. The processor 1004 may execute instructions to perform various operations of the wireless device 1002, as described herein. The processor 1004 may include one or more baseband processors implemented using, for example, a central processing unit (CPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a controller, a field programmable gate array (FPGA) device, another hardware device, a firmware device, or any combination thereof configured to perform the operations described herein.

[0144] The wireless device 1002 may include a memory 1006. The memory 1006 may be a non-transitory computer-readable storage medium that stores instructions 1008 (which may include, for example, instructions executed by the processor 1004). The instructions 1008 may also be referred to as program code or a computer program. The memory 1006 may also store data used by the processor 1004 and results computed by the processor.

[0145] The wireless device 1002 may include one or more transceivers 1010, which may include radio frequency (RF) transmitter and / or receiver circuitry that uses an antenna 1012 of the wireless device 1002 to facilitate signaling (e.g., signaling 1038) to and / or from the wireless device 1002 with other devices (e.g., network device 1020) in accordance with a corresponding RAT.

[0146] The wireless device 1002 may include one or more antennas 1012 (e.g., one, two, four, or more). For embodiments with multiple antennas 1012, the wireless device 1002 may take advantage of the spatial diversity of these multiple antennas 1012 to transmit and / or receive multiple different data streams on the same time-frequency resources. This behavior may be referred to as, for example, multiple-input multiple-output (MIMO) behavior (referring to the multiple antennas used at each of the transmitting device and the receiving device to implement this aspect). MIMO transmission by the wireless device 1002 may be implemented based on precoding (or digital beamforming) applied at the wireless device 1002, which multiplexes the data streams between the antennas 1012 based on known or assumed channel characteristics, so that each data stream is received with appropriate signal strength relative to the other streams and at a desired location in the spatial domain (e.g., the location of the receiver associated with the data stream). Some embodiments may use a single-user MIMO (SU-MIMO) approach (where data streams are all directed to a single receiver) and / or a multi-user MIMO (MU-MIMO) approach (where separate data streams may be directed to separate (different) receivers in different locations in the spatial domain).

[0147] In some embodiments with multiple antennas, the wireless device 1002 may implement analog beamforming techniques whereby the phases of signals transmitted by antennas 1012 are relatively adjusted so that the (joint) transmissions of antennas 1012 can be directed (this is sometimes referred to as beam steering).

[0148] The wireless device 1002 may include one or more interfaces 1014. The interfaces 1014 may be used to provide input to or output from the wireless device 1002. For example, a wireless device 1002 that is a UE may include an interface 1014, such as a microphone, a speaker, a touch screen, buttons, etc., to allow a user of the UE to provide input and / or output to the UE. Other interfaces of such a UE may consist of transmitters, receivers, and other circuits (e.g., in addition to the transceiver 1010 / antenna 1012 already described), which allow communication between the UE and other devices and may be performed according to known protocols (e.g., etc.) to perform the operation.

[0149] The wireless device 1002 may include a CPC module 1016. The CPC module 1016 may be implemented via hardware, software, or a combination thereof. For example, the CPC module 1016 may be implemented as a processor, circuits, and / or instructions 1008 stored in the memory 1006 and executed by the processor 1004. In some examples, the CPC module 1016 may be integrated within the processor 1004 and / or the transceiver 1010. For example, the CPC module 1016 may be implemented by a combination of software components (e.g., executed by a DSP or general purpose processor) and hardware components (e.g., logic gates and circuits) within the processor 1004 or the transceiver 1010.

[0150] From the perspective of the UE, the CPC module 1016 may be used in various aspects of the present disclosure, for example, Figures 3 to 8 As described herein, according to some embodiments, CPC module 1016 may be configured to receive configuration information, for example, from a base station, and perform CPC procedures.

[0151] The network device 1020 may include one or more processors 1022. The processor 1022 may execute instructions to perform various operations of the network device 1020, as described herein. The processor 1022 may include one or more baseband processors implemented using, for example, a CPU, a DSP, an ASIC, a controller, an FPGA device, another hardware device, a firmware device, or any combination thereof configured to perform the operations described herein.

[0152] The network device 1020 may include a memory 1024. The memory 1024 may be a non-transitory computer-readable storage medium that stores instructions 1026 (which may include, for example, instructions executed by the processor 1022). The instructions 1026 may also be referred to as program code or a computer program. The memory 1024 may also store data used by the processor 1022 and results calculated by the processor.

[0153] The network device 1020 may include one or more transceivers 1028, which may include RF transmitter and / or receiver circuits that use the antenna 1030 of the network device 1020 to facilitate signaling (e.g., signaling 1038) to and / or from the network device 1020 with other devices (e.g., wireless device 1002) according to the corresponding RAT.

[0154] The network device 1020 may include one or more antennas 1030 (e.g., one, two, four, or more). In embodiments with multiple antennas 1030, the network device 1020 may perform MIMO, digital beamforming, analog beamforming, beam steering, etc. as described.

[0155] The network device 1020 may include one or more interfaces 1032. The interface 1032 may be used to provide input to or output from the network device 1020. For example, the network device 1020 as a base station may include an interface 1032 consisting of a transmitter, a receiver, and other circuits (e.g., in addition to the transceiver 1028 / antenna 1030 already described), which enables the base station to communicate with other equipment in the core network and / or enables the base station to communicate with external networks, computers, databases, etc., for the purpose of operating, managing, and maintaining the base station or other equipment that can be operably connected to the base station.

[0156] The network device 1020 may include a CPC module 1034. The CPC module 1034 may be implemented via hardware, software, or a combination thereof. For example, the CPC module 1034 may be implemented as a processor, circuits, and / or instructions 1026 stored in the memory 1024 and executed by the processor 1022. In some examples, the CPC module 1034 may be integrated within the processor 1022 and / or the transceiver 1028. For example, the CPC module 1034 may be implemented by a combination of software components (e.g., executed by a DSP or general purpose processor) and hardware components (e.g., logic gates and circuits) within the processor 1022 or the transceiver 1028.

[0157] From the perspective of the base station, the CPC module 1034 may be used in various aspects of the present disclosure, for example, Figures 3 to 8As described herein, according to some embodiments, the CPC module 1034 may be configured to, for example, send a configuration to a UE and a candidate SN.

[0158] For one or more embodiments, at least one of the components set forth in one or more of the foregoing figures may be configured to perform one or more operations, techniques, processes, and / or methods as described herein. For example, a baseband processor as described herein in conjunction with one or more of the foregoing figures may be configured to operate according to one or more of the examples set forth herein. For another example, circuits associated with a UE, a base station, a network element, etc. as described above in conjunction with one or more of the foregoing figures may be configured to operate according to one or more of the examples set forth herein.

[0159] Unless otherwise expressly stated, any of the above embodiments may be combined with any other embodiment (or combination of embodiments). The foregoing description of one or more specific implementations provides illustration and description, but is not intended to be exhaustive or to limit the scope of the embodiments to the precise form disclosed. In view of the above teachings, modifications and variations are possible or can be obtained from the practice of various embodiments.

[0160] Embodiments and implementations of the systems and methods described herein may include various operations that may be embodied in machine executable instructions to be executed by a computer system. A computer system may include one or more general or special purpose computers (or other electronic devices). A computer system may include hardware components that include specific logic components for performing operations; or may include a combination of hardware, software, and / or firmware.

[0161] It should be appreciated that the systems described herein include descriptions of specific embodiments. These embodiments may be combined into a single system, partially combined into other systems, separated into multiple systems, or otherwise divided or combined. In addition, it is contemplated that parameters, attributes, aspects, etc. of another embodiment may be used in one embodiment. For clarity, these parameters, attributes, aspects, etc. are described only in one or more embodiments, and it should be appreciated that these parameters, attributes, aspects, etc. may be combined with or substituted for parameters, attributes, aspects, etc. of another embodiment unless expressly stated herein.

[0162] It is understood that the use of personally identifiable information should be subject to privacy policies and practices that are generally recognized to meet or exceed industry or government requirements for maintaining user privacy. Specifically, personally identifiable information data should be managed and processed to minimize the risk of unintentional or unauthorized access or use, and the nature of the authorized use should be clearly stated to users.

[0163] Although the foregoing has been described in considerable detail for the sake of clarity, it will be apparent that changes and modifications may be made without departing from the principles of the invention. It should be noted that there are many alternative ways to implement both the processes and the apparatus described herein. Therefore, the embodiments of the present invention should be regarded as illustrative rather than restrictive, and the specification is not limited to the details given herein, but may be modified within the scope and equivalents of the appended claims.

Claims

1. A user equipment (UE), the user equipment (UE) comprising: Transceiver; and A processor, the processor being configured to: connecting the UE via the transceiver with a plurality of radio access network (RAN) nodes, the plurality of radio access network (RAN) nodes including at least one RAN node configured as a primary node for the UE and at least two RAN nodes configured as secondary nodes for the UE; receiving, from the primary node and via the transceiver, secondary cell group (SCG) configuration information including a respective security configuration structure for each of the at least two secondary nodes; and After a conditional primary secondary cell (PSCell) change condition associated with being connected to a first secondary node among the at least two secondary nodes is satisfied: A secondary node security key (K) corresponding to the first secondary node is derived using a first security configuration structure associated with the first secondary node. SN ); Using the derived K SN to perform an initial access procedure with the first secondary node; updating a second security configuration structure associated with the second secondary node; as well as The updated second security configuration structure associated with the second secondary node is communicated to the primary node.

2. The UE according to claim 1, wherein the corresponding security configuration structure for each of the at least two secondary nodes comprises a corresponding secondary node key counter (K SN counter) and the corresponding secondary node key offset (K SN offset).

3. The UE according to claim 2, wherein the K SN is the corresponding K using the corresponding security configuration structure associated with the first secondary node SN Counter to export.

4. The UE according to claim 2, wherein the second security configuration structure associated with the second secondary node is generated by SN The offset updates the corresponding K of the corresponding security configuration structure associated with the second secondary node SN The counter is updated.

5. The UE according to claim 4, wherein: Communicating the updated second security configuration structure associated with the second secondary node to the primary node includes: communicating the corresponding K associated with the second secondary node to the primary node. SN The counter is communicated to the master node.

6. The UE according to claim 2, wherein: The processor is configured to: Using the corresponding K of the corresponding security configuration structure associated with the first secondary node SN offset to update the corresponding K of the corresponding security configuration structure associated with the first secondary node SN counter.

7. The UE according to claim 2, wherein: The processor is further configured to: After a conditional primary secondary cell (PSCell) change condition associated with connecting to the second secondary node is satisfied: The K corresponding to the second secondary node is derived using the second security configuration structure associated with the second secondary node. SN ; Using the derived K SN to perform an initial access procedure with the second secondary node; updating the first security configuration structure associated with the first secondary node; as well as The updated first security configuration structure associated with the first secondary node is communicated to the primary node.

8. The UE according to claim 7, wherein based on the corresponding K associated with the first secondary node SN offset, the updated first security configuration structure associated with the first secondary node includes the corresponding K offset of the corresponding security configuration structure associated with the first secondary node SN counter.

9. The UE according to claim 8, wherein: The processor is configured to: According to the corresponding K of the corresponding security configuration structure associated with the first secondary node or the second secondary node, respectively SN offset to increment the corresponding K of the corresponding security configuration structure associated with the first secondary node or the second secondary node SN counter.

10. The UE according to claim 7, wherein: The processor is further configured to: The corresponding K of the corresponding security configuration structure associated with the first secondary node SN The offset is added to the corresponding K of the corresponding security configuration structure associated with the first secondary node. SN counter.

11. The UE according to claim 7, wherein: The processor is further configured to: The corresponding K of the corresponding security configuration structure associated with the second secondary node SN The offset is added to the corresponding K of the corresponding security configuration structure associated with the second secondary node. SN counter.

12. The UE according to claim 7, wherein: The master node is a first master node; and The processor is configured to: When the UE is handed over to a primary cell having a second primary node different from the first primary node, releasing the corresponding K of the corresponding security configuration structure corresponding to each of the at least two secondary nodes SN counter and the corresponding K SN Offset.

13. The UE according to claim 7, wherein: The master node is a first master node; and The processor is configured to: When a radio link failure occurs at a primary cell having the first primary node, releasing the corresponding K of the corresponding security configuration structure corresponding to each of the at least two secondary nodes SN counter and the corresponding K SN Offset.

14. The UE according to claim 7, wherein: The processor is configured to: When a secondary cell group (SCG) failure corresponding to any one of the at least two secondary nodes occurs, releasing the corresponding K of the corresponding security configuration structure corresponding to each of the at least two secondary nodes SN counter and the corresponding K SN Offset.

15. The UE according to claim 7, wherein: The processor is configured to: When a secondary cell group (SCG) failure associated with a secondary node among the at least two secondary nodes occurs, releasing the corresponding K of the corresponding security configuration structure corresponding to the secondary node SN counter and the corresponding K SN Offset.

16. A user equipment (UE), the user equipment (UE) comprising: Transceiver; and A processor, the processor being configured to: connecting the UE via the transceiver with a plurality of radio access network (RAN) nodes, the plurality of radio access network (RAN) nodes including at least one RAN node configured as a primary node for the UE and at least two RAN nodes configured as secondary nodes for the UE; A secondary cell group (SCG) configuration information is received from the primary node and via the transceiver, the secondary cell group (SCG) configuration information including a secondary node key counter (K) corresponding to each of at least two secondary nodes. SN counter) and a secondary node key offset (K SN offset); and After a conditional primary secondary cell (PSCell) change condition associated with being connected to a first secondary node among the at least two secondary nodes is satisfied: Using the K associated with the first secondary node SN counter to derive a secondary node security key (K SN ); Using the derived K SN to perform an initial access procedure with the first secondary node; According to the K associated with the first secondary node SN offset to update the K associated with the first secondary node SN counter; and The updated K associated with the first secondary node SN The counter is communicated to the master node.

17. The UE according to claim 16, wherein: The processor is further configured to: After a conditional primary secondary cell (PSCell) change condition associated with connecting to the second secondary node is satisfied: Using the K associated with the second secondary node SN The counter is used to derive the K corresponding to the second auxiliary node. SN ; Using the derived K corresponding to the second secondary node SN to perform an initial access procedure with the second secondary node; According to the K associated with the second secondary node SN offset to update the K associated with the second secondary node SN counter; and The updated K associated with the second secondary node SN The counter is communicated to the master node.

18. The UE according to claim 16, wherein: The processor is configured to: By SN An offset is added to the K associated with the first secondary node. SN counter to derive the K corresponding to the first secondary node SN .

19. The UE according to claim 16, wherein: The master node is a first master node; and The processor is further configured to: When the UE is handed over to a primary cell having a second primary node different from the first primary node, releasing the K corresponding to each of the at least two secondary nodes SN counter and the K SN Offset; When a radio link failure occurs at a primary cell having the first primary node, releasing the K corresponding to each of the at least two secondary nodes SN counter and the K SN Offset; When a secondary cell group (SCG) corresponding to any one of the at least two secondary nodes fails, the K corresponding to each of the at least two secondary nodes is released. SN counter and the K SN Offset; or When a secondary cell group (SCG) failure associated with a secondary node among the at least two secondary nodes occurs, releasing the K corresponding to the secondary node SN counter and the K SN Offset.

20. A base station, comprising: Transceiver; and A processor, the processor being configured to: Sending secondary cell group (SCG) configuration information to a user equipment (UE) and via the transceiver, the secondary cell group (SCG) configuration information including a secondary node key counter (K) corresponding to each of at least two secondary nodes in a plurality of radio access network (RAN) nodes. SN counter), the base station being a master node among the multiple RAN nodes; A secondary node security key (K) corresponding to each of the at least two secondary nodes is sent to each of the at least two secondary nodes and via the transceiver. SN ), the K corresponding to each of the at least two secondary nodes SN is based on the K SN Counter to calculate; After a conditional primary secondary cell (PSCell) change condition associated with being connected to a first secondary node among the at least two secondary nodes is satisfied: receiving, from the UE and via the transceiver, the K associated with a second secondary node SN The counter is updated, the K associated with the second secondary node SN The counter is calculated by the UE according to the secondary node key offset (K SN Offset) to update; Using the updated K associated with the second secondary node SN counter to recalculate the K associated with the second secondary node SN ; as well as Sending the recalculated K associated with the second secondary node to the second secondary node SN ;in: The SCG configuration information sent to the UE also includes whether the UE needs to update the K corresponding to the secondary node of the at least two secondary nodes or each of the at least two secondary nodes in response to satisfying the conditional PSCell change condition relative to the first secondary node or the second secondary node. SN counter; and The K associated with the first secondary node or the second secondary node SN The offset is derived by the UE based on a physical cell ID (PCI) and / or an absolute radio frequency channel number (ARFCN), or is sent to the UE in the SCG configuration information.

Images