NR Mobility-Security Convergence For L1 / L2 Mobility Handover For SpCell

Abstract

A wireless transmit / receive unit (WTRU) may be configured to process first downlink data from a source cell using a first security context. The WTRU may receive configuration information from the source cell, the configuration information indicating one or more candidate cells for Layer 1 or Layer 2 (L1 / L2) triggered mobility (LTM). The WTRU may receive, from the source cell, an LTM indication to perform a handover (HO) to a candidate cell of the one or more candidate cells. The WTRU may determine a second security context associated with the candidate cell. The WTRU may process second downlink data based on the first security context. The WTRU may process third downlink data from the candidate cell using the second security context upon determining that one or more of the conditions are satisfied.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Provisional Application No. 63 / 395,161, filed on August 4, 2022, the entire contents of which are incorporated herein by reference. Background Art

[0003] gNB key (e.g., K gNB ) may be used to derive integrity protection / authentication and encryption / decryption keys for the UP and / or CP and may depend on the physical cell ID (PCI) and frequency of the PCell. In an L3 handover (e.g., receipt of a HO command or execution of a CHO), the wireless transmit / receive unit (WTRU) may be explicitly instructed to update security keys and also re-establish PDCP and RLC. These actions, along with the reset of the MAC, may ensure that the WTRU will not transmit any pending UL data that has been encrypted and / or integrity protected using the old security keys, and that the WTRU may not attempt to use the new security keys to decrypt and / or integrity authenticate DL data that was encrypted and / or integrity protected using the old keys.

[0004] In order to apply the current behavior of security and associated protocol processing during L1 / L2 mobility (e.g., security update, PDC / RLC re-establishment, MAC reset, etc.), the WTRU may be configured with additional reconfigurations that the WTRU may store and apply upon receiving L1 / L2 messages (e.g., stored radio bearers and associated PDCP configurations to set the PDCP re-establishment flag, stored RLF bearer configurations to set the RLF re-establishment flag, etc.). Additionally, PDCP / RLC re-establishment and MAC reset may result in increased latency during the handover process, as packets in transit may be re-sent (after being re-encoded with new security keys), and packets that have been processed at the PDCP / RLC level and are waiting to be sent at the MAC level will be re-processed, which is undesirable, as the main goal of introducing L1 / L2 mobility is latency enhancement. Summary of the invention

[0005] A wireless transmit / receive unit (WTRU) may be configured to: process first downlink data from a source cell using a first security context. The WTRU may receive configuration information from the source cell, the configuration information indicating one or more candidate cells for layer 1 or layer 2 (L1 / L2) triggered mobility (LTM). The WTRU may receive an LTM indication from the source cell to perform a handover (HO) to a candidate cell among the one or more candidate cells. Before receiving the LTM indication to perform the HO, the WTRU may use the first security context to send first uplink data to the source cell. The WTRU may determine a second security context associated with the candidate cell. The WTRU may use the first security context to process second downlink data. The WTRU may use the second security context to process third downlink data from the candidate cell when determining that one or more conditions are met. The conditions may include: determining that a certain time has passed since receiving the LTM indication to perform the HO; determining that integrity verification using one or more old security keys has failed; and / or determining that an end marker packet has been received. After receiving the LTM indication to perform the HO, the WTRU may send second uplink data encrypted using the second security context to the candidate cell.

[0006] The end marker packet may include one or more of the following: a pseudo radio resource control (RRC) message, a packet data convergence protocol (PDCP) control protocol data unit (PDU) including an indication to use the second security context; or a field in a PDCP data PDU header including an indication to use the second security context. The WTRU may be configured to use the first security context to send first uplink data to the source cell before receiving the LTM indication to perform the HO. The WTRU may be configured to send second uplink data encrypted using the second security context to the candidate cell after receiving the LTM indication to perform the HO. The WTRU may be configured to send third uplink data encrypted using the second security context after determining that one or more of the conditions are met. The one or more old security keys may be associated with the first security context. The WTRU may be configured to use the second security context and refrain from using the first security context when determining that one or more of the conditions are met.

[0007] The first security context may include one or more security keys. Determining the second security context may include: deriving a new key for the candidate cell (KgNB); and using the physical cell identity (PCI) and frequency of the primary cell (PCell) to calculate one or more integrity protection keys and decryption keys for use with the candidate cell. Processing the third downlink data may include: performing integrity verification and decryption using the one or more integrity protection keys and decryption keys associated with the second security context. The LTM indication for performing the HO may indicate that the special cell (SpCell) associated with the WTRU will be changed. The WTRU may also be configured to: suppress re-establishment of a radio resource control (RRC) entity, a packet data convergence protocol (PDCP) entity, and a radio link control (RLC) entity. The WTRU may also be configured to: suppress resetting a medium access control (MAC) entity and a physical layer entity.

[0008] Upon receiving an L1 / L2 mobility indication for a change in the SpCell, the WTRU may implicitly trigger PDCP and RLC re-establishment of one or more of the bearers (e.g., all bearers or a subset thereof). Upon receiving an L1 / L2 mobility indication for a change in the SpCell, the WTRU may suppress performing PDCP and RLC re-establishment of the bearer. The WTRU may use the old security key for integrity verification and / or decryption until a certain time has passed after receiving the L1 / L2 mobility indication, until integrity verification using the old key fails, and / or until an end marker packet (e.g., a PDCP control PDU or PDCP data PDU containing a marker indicating the security context switch, etc.) is received. The WTRU may be configured with multiple security contexts and may be commanded (e.g., at the bearer level, at the packet level, for UL or DL, etc.) to use a specific security context.

[0009] In an example, the WTRU may receive an L1 / L2 mobility indication to change the SpCell. The WTRU may refrain from performing the re-establishment of the PDCP entity and the RLC entity. The WTRU may refrain from resetting the MAC entity. The WTRU may calculate a new security context (e.g., derive a new K based on a new PCI and frequency of the new PCell). gNB , and / or based on the new K gNBto calculate the integrity protection key and encryption key for both the UP and the CP). In the UL (PDCP), for any new data to be sent at the PDCP level, the WTRU may use the keys from the new security context to integrity protect and / or encrypt the packets, and for old data that has been integrity protected and / or encrypted using the old security keys, the WTRU may pass the data to the RLC / MAC entity. In the DL (PDCP), the WTRU may continue to use the old security context until one or more of the following conditions are met: a certain time has passed since the L1 / L2 mobility indication was received; the integrity verification using the old security key fails; or an end marker packet is received (e.g., a special / pseudo RRC message, a PDCP control PDU indicating the application of the new security context, a field in the PDCP data PDU header indicating a switch to the new security context, etc.). When one or more of the foregoing conditions are met, the WTRU may delete the old security context and use (e.g., only use) the new security key.

[0010] The WTRU may be configured to have several security contexts simultaneously. (Eg, each) security context may be associated with a given identity. The WTRU may receive an indication of the identity of the security context to be used for a given bearer, a given group, UL or DL, etc.

[0011] Disclosed herein are mechanisms for reducing signaling and latency associated with security-related configurations / actions during L1 / L2 mobility. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1A is a system diagram illustrating an example communication system in which one or more disclosed embodiments may be implemented;

[0013] Figure 1B is an example of an embodiment in which Figure 1A A system diagram of an example wireless transmit / receive unit (WTRU) for use within an illustrated communication system;

[0014] Figure 1C is an example of an embodiment in which Figure 1A A system diagram of an example Radio Access Network (RAN) and an example Core Network (CN) used within the illustrated communication system;

[0015] Figure 1D is an example of a method that can be used according to an embodiment of the present invention. Figure 1A System diagram of another example RAN and another example CN for use within the illustrated communication system.

[0016] Figure 2An example of a handover procedure that may be used in New Radio (NR) is illustrated.

[0017] Figure 3 An example of key hierarchy generation in NR is illustrated.

[0018] Figure 4 Examples of horizontal key derivation (HKD) and vertical key derivation (VKD) are illustrated.

[0019] Figure 5 An example of layer 1 or layer 2 (L1 / L2) inter-cell mobility operation is illustrated.

[0020] Figure 6 An example of L1 / L2 triggered mobility (LTM) using an old security context and / or a new security context is illustrated. DETAILED DESCRIPTION

[0021] Figure 1A 1 is a diagram illustrating an example communication system 100 in which one or more disclosed embodiments may be implemented. The communication system 100 may be a multiple access system that provides content such as voice, data, video, messaging, broadcast, etc. to multiple wireless users. The communication system 100 may enable multiple wireless users to access such content through sharing of system resources (including wireless bandwidth). For example, the communication system 100 may employ one or more channel access methods such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal FDMA (OFDMA), single carrier FDMA (SC-FDMA), zero tail unique word DFT spread OFDM (ZT UW DTS-s OFDM), unique word OFDM (UW-OFDM), resource block filtered OFDM, and filter bank multi-carrier (FBMC), etc.

[0022] like Figure 1AAs shown, the communication system 100 may include wireless transmit / receive units (WTRUs) 102a, 102b, 102c, 102d, RAN 104 / 113, CN 106 / 115, public switched telephone network (PSTN) 108, Internet 110 and other networks 112, but it should be understood that the disclosed embodiments contemplate any number of WTRUs, base stations, networks, and / or network elements. Each of the WTRUs 102a, 102b, 102c, 102d may be any type of device configured to operate and / or communicate in a wireless environment. By way of example, the WTRUs 102a, 102b, 102c, 102d (any of which may be referred to as a “station” and / or “STA”) may be configured to transmit and / or receive wireless signals and may include a wireless transmit receive unit (WTRU), a mobile station, a fixed or mobile subscriber unit, a subscription-based unit, a pager, a cellular phone, a personal digital assistant (PDA), a smart phone, a laptop, a netbook, a personal computer, a wireless sensor, a hotspot or Mi-Fi device, an Internet of Things (IoT) device, a watch or other wearable device, a head-mounted display (HMD), a vehicle, a drone, medical devices and applications (e.g., remote surgery), industrial devices and applications (e.g., robots and / or other wireless devices operating in an industrial and / or automated process chain environment), a consumer electronic device, a device operating on a commercial and / or industrial wireless network, etc. Any of the WTRUs 102a, 102b, 102c, and 102d may be interchangeably referred to as a WTRU.

[0023] The communication system 100 may also include a base station 114a and / or a base station 114b. Each of the base stations 114a, 114b may be any type of device that is configured to wirelessly interface with at least one of the WTRUs 102a, 102b, 102c, 102d to facilitate access to one or more communication networks, such as the CN 106 / 115, the Internet 110, and / or other networks 112. By way of example, the base stations 114a, 114b may be a base transceiver station (BTS), a Node B, an eNode B, a Home Node B, a Home eNode B, a gNB, an NR Node B, a site controller, an access point (AP), a wireless router, and the like. Although the base stations 114a, 114b are each depicted as a single element, it should be appreciated that the base stations 114a, 114b may include any number of interconnected base stations and / or network elements.

[0024] Base station 114a may be part of RAN 104 / 113, which may also include other base stations and / or network elements (not shown), such as base station controllers (BSC), radio network controllers (RNC), relay nodes, etc. Base station 114a and / or base station 114b may be configured to send and / or receive wireless signals on one or more carrier frequencies (which may be referred to as cells (not shown)). These frequencies may be in a licensed spectrum, an unlicensed spectrum, or a combination of a licensed spectrum and an unlicensed spectrum. A cell may provide coverage of wireless services to a specific geographic area, which may be relatively fixed or may change over time. The cell may be further divided into cell sectors. For example, the cell associated with base station 114a may be divided into three sectors. Therefore, in one embodiment, base station 114a may include three transceivers, i.e., one transceiver for each sector of the cell. In an embodiment, base station 114a may employ multiple-input multiple-output (MIMO) technology and may utilize multiple transceivers for each sector of the cell. For example, beamforming may be used to send and / or receive signals in a desired spatial direction.

[0025] The base stations 114a, 114b may communicate with one or more of the WTRUs 102a, 102b, 102c, 102d over an air interface 116, which may be any suitable wireless communication link (e.g., radio frequency (RF), microwave, centimeter wave, micrometer wave, infrared (IR), ultraviolet (UV), visible light, etc.). The air interface 116 may be established using any suitable radio access technology (RAT).

[0026] More specifically, as noted above, the communication system 100 may be a multiple access system and may employ one or more channel access schemes such as CDMA, TDMA, FDMA, OFDMA, and SC-FDMA. For example, the base station 114a in the RAN 104 / 113 and the WTRUs 102a, 102b, 102c may implement a radio technology such as Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access (UTRA), which may use Wideband CDMA (WCDMA) to establish the air interface 115 / 116 / 117. WCDMA may include communication protocols such as High Speed ​​Packet Access (HSPA) and / or Evolved HSPA (HSPA+). HSPA may include High Speed ​​Downlink (DL) Packet Access (HSDPA) and / or High Speed ​​UL Packet Access (HSUPA).

[0027] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement a radio technology such as Evolved UMTS Terrestrial Radio Access (E-UTRA) that may establish the air interface 116 using Long Term Evolution (LTE) and / or Advanced LTE (LTE-A) and / or Advanced LTE Pro (LTE-A Pro).

[0028] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement a radio technology such as NR radio access, which may establish the air interface 116 using New Radio (NR).

[0029] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement multiple radio access technologies. For example, the base station 114a and the WTRUs 102a, 102b, 102c may together implement LTE radio access and NR radio access, for example using the dual connectivity (DC) principle. Thus, the air interface used by the WTRUs 102a, 102b, 102c may be characterized by multiple types of radio access technologies and / or transmissions transmitted to / from multiple types of base stations (e.g., eNBs and gNBs).

[0030] In other embodiments, the base station 114a and the WTRUs 102a, 102b, 102c may implement radio technologies such as IEEE 802.11 (i.e., Wireless Fidelity (WiFi)), IEEE 802.16 (i.e., Worldwide Interoperability for Microwave Access (WiMAX)), CDMA2000, CDMA2000 1X, CDMA2000 EV-DO, Interim Standard 2000 (IS-2000), Interim Standard 95 (IS-95), Interim Standard 856 (IS-856), Global System for Mobile Communications (GSM), Enhanced Data rates for GSM Evolution (EDGE), and GSM EDGE (GERAN).

[0031] Figure 1AThe base station 114b in may be, for example, a wireless router, a Home NodeB, a Home eNodeB, or an access point, and may utilize any suitable RAT to facilitate wireless connectivity in local areas such as commercial venues, homes, vehicles, campuses, industrial facilities, sky corridors (e.g., for use by drones), and roads. In one embodiment, the base station 114b and the WTRUs 102c, 102d may implement a radio technology (such as IEEE 802.11) to establish a wireless local area network (WLAN). In an embodiment, the base station 114b and the WTRUs 102c, 102d may implement a radio technology (such as IEEE 802.15) to establish a wireless personal area network (WPAN). In yet another embodiment, the base station 114b and the WTRUs 102c, 102d may utilize a cellular-based RAT (e.g., WCDMA, CDMA2000, GSM, LTE, LTE-A, LTE-A Pro, NR, etc.) to establish a picocell or a femtocell. As Figure 1A As shown, base station 114b may have a direct connection to Internet 110. Therefore, base station 114b may not need to access Internet 110 via CN 106 / 115.

[0032] The RAN 104 / 113 may be in communication with the CN 106 / 115, which may be any type of network configured to provide voice, data, applications and / or Voice over Internet Protocol (VoIP) services to one or more of the WTRUs 102a, 102b, 102c, 102d. The data may have different quality of service (QoS) requirements, such as different throughput requirements, latency requirements, error tolerance requirements, reliability requirements, data throughput requirements, mobility requirements, etc. The CN 106 / 115 may provide call control, billing services, mobile location-based services, prepaid calling, Internet connectivity, video distribution, etc., and / or perform high-level security functions, such as user authentication. Although not described in detail in the text and video, the CN 106 / 115 may be configured to provide voice, data, applications and / or Voice over Internet Protocol (VoIP) services to one or more of the WTRUs 102a, 102b, 102c, 102d. The data may have different quality of service (QoS) requirements, such as different throughput requirements, latency requirements, error tolerance requirements, reliability requirements, data throughput requirements, mobility requirements, etc. The CN 106 / 115 may provide call control, billing services, mobile location-based services, prepaid calling, Internet connectivity, video distribution, etc., and / or perform high-level security functions, such as user authentication. Figure 1A Although not shown in the figure, it will be appreciated that the RAN 104 / 113 and / or the CN 106 / 115 may be in direct or indirect communication with other RANs that employ the same RAT as the RAN 104 / 113 or a different RAT. For example, in addition to being connected to the RAN 104 / 113, which may utilize NR radio technology, the CN 106 / 115 may also be in communication with another RAN (not shown) that employs GSM, UMTS, CDMA2000, WiMAX, E-UTRA, or WiFi radio technology.

[0033] The CN 106 / 115 may also act as a gateway for the WTRUs 102a, 102b, 102c, 102d to access the PSTN 108, the Internet 110, and / or other networks 112. The PSTN 108 may include a circuit-switched telephone network that provides plain old telephone service (POTS). The Internet 110 may include a global system of interconnected computer networks and devices that use common communication protocols, such as the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP), and / or the Internet Protocol (IP) in the TCP / IP Internet protocol suite. The networks 112 may include wired communication networks and / or wireless communication networks owned and / or operated by other service providers. For example, the networks 112 may include another CN connected to one or more RANs, which may employ the same RAT as the RAN 104 / 113 or a different RAT.

[0034] Some or all of the WTRUs 102a, 102b, 102c, 102d in the communication system 100 may include multi-mode capabilities (e.g., the WTRUs 102a, 102b, 102c, 102d may include multiple transceivers for communicating with different wireless networks via different wireless links). Figure 1A The illustrated WTRU 102c may be configured to communicate with the base station 114a, which may employ a cellular-based radio technology, and with the base station 114b, which may employ an IEEE 802 radio technology.

[0035] Figure 1B is a system diagram illustrating an example WTRU 102. Figure 1B As shown, the WTRU 102 may include, among other things, a processor 118, a transceiver 120, a transmit / receive element 122, a speaker / microphone 124, a keypad 126, a display / touchpad 128, non-removable memory 130, removable memory 132, a power source 134, a global positioning system (GPS) chipset 136, and / or other peripherals 138. It will be appreciated that the WTRU 102 may include any sub-combination of the foregoing elements while remaining consistent with an embodiment.

[0036] The processor 118 may be a general purpose processor, a special purpose processor, a conventional processor, a digital signal processor (DSP), a plurality of microprocessors, one or more microprocessors associated with a DSP core, a controller, a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) circuit, any other type of integrated circuit (IC) and state machine, etc. The processor 118 may perform signal decoding, data processing, power control, input / output processing, and / or any other functionality that enables the WTRU 102 to operate in a wireless environment. The processor 118 may be coupled to the transceiver 120, which may be coupled to the transmit / receive element 122. Although Figure 1B The processor 118 and the transceiver 120 are depicted as separate components, but it is understood that the processor 118 and the transceiver 120 may be integrated together in an electronic package or chip.

[0037] The send / receive element 122 may be configured to send a signal to a base station (e.g., base station 114a) or receive a signal from a base station via an air interface 116. For example, in one embodiment, the send / receive element 122 may be an antenna configured to send and / or receive an RF signal. In an embodiment, the send / receive element 122 may be a transmitter / detector configured to send and / or receive, for example, an IR, UV or visible light signal. In another embodiment, the send / receive element 122 may be configured to send and / or receive both an RF signal and an optical signal. It should be understood that the send / receive element 122 may be configured to send and / or receive any combination of wireless signals.

[0038] Although the transmit / receive element 122 Figure 1B 1 as a single element, the WTRU 102 may include any number of transmit / receive elements 122. More specifically, the WTRU 102 may employ MIMO technology. Thus, in one embodiment, the WTRU 102 may include two or more transmit / receive elements 122 (e.g., multiple antennas) for transmitting and receiving wireless signals over the air interface 116.

[0039] The transceiver 120 may be configured to modulate signals to be transmitted by the transmit / receive element 122 and to demodulate signals received by the transmit / receive element 122. As noted above, the WTRU 102 may have multi-mode capabilities. For example, the transceiver 120 may include multiple transceivers for enabling the WTRU 102 to communicate via multiple RATs, such as NR and IEEE 802.11.

[0040] The processor 118 of the WTRU 102 may be coupled to and may receive user input data from a speaker / microphone 124, a keypad 126, and / or a display / touchpad 128 (e.g., a liquid crystal display (LCD) display unit or an organic light emitting diode (OLED) display unit). The processor 118 may also output user data to the speaker / microphone 124, the keypad 126, and / or the display / touchpad 128. In addition, the processor 118 may access information from and store data in any type of suitable memory, such as a non-removable memory 130 and / or a removable memory 132. The non-removable memory 130 may include a random access memory (RAM), a read-only memory (ROM), a hard disk, or any other type of memory storage device. The removable memory 132 may include a subscriber identity module (SIM) card, a memory stick, and a secure digital (SD) memory card, among others. In other embodiments, the processor 118 may access information from and store data in a memory that is not physically located on the WTRU 102, such as on a server or a home computer (not shown).

[0041] The processor 118 may receive power from the power source 134, and may be configured to distribute and / or control power to the other components in the WTRU 102. The power source 134 may be any suitable device for powering the WTRU 102. For example, the power source 134 may include one or more dry cell batteries (e.g., nickel cadmium (NiCd), nickel zinc (NiZn), nickel metal hydride (NiMH), lithium ion (Li-ion), etc.), solar cells, fuel cells, etc.

[0042] The processor 118 may also be coupled to the GPS chipset 136, which may be configured to provide location information (e.g., longitude and latitude) regarding the current location of the WTRU 102. In addition to or in lieu of the information from the GPS chipset 136, the WTRU 102 may receive location information from a base station (e.g., base stations 114a, 114b) over the air interface 116 and / or determine its location based on the timing of signals received from two or more nearby base stations. It will be appreciated that the WTRU 102 may acquire location information by any suitable location-determination method while remaining consistent with an embodiment.

[0043] The processor 118 may also be coupled to other peripherals 138, which may include one or more software modules and / or hardware modules that provide additional features, functionality, and / or wired or wireless connectivity. For example, the peripherals 138 may include an accelerometer, an electronic compass, a satellite transceiver, a digital camera (for photos and / or video), a universal serial bus (USB) port, a vibration device, a television transceiver, a hands-free headset, module, FM radio unit, digital music player, media player, video game player module, Internet browser, virtual reality and / or augmented reality (VR / AR) device and activity tracker, etc. Peripheral device 138 may include one or more sensors, which may be one or more of the following: gyroscope, accelerometer, Hall effect sensor, magnetometer, orientation sensor, proximity sensor, temperature sensor, time sensor; geolocation sensor; altimeter, light sensor, touch sensor, magnetometer, barometer, gesture sensor, biometric sensor and / or humidity sensor.

[0044] The WTRU 102 may include a full-duplex radio for which transmission and reception of some or all of the signals (e.g., associated with specific subframes for both UL (e.g., for transmission) and downlink (e.g., for reception)) may be concurrent and / or simultaneous. The full-duplex radio may include an interference management unit 139 for reducing and / or substantially eliminating self-interference via signal processing performed via hardware (e.g., a choke) or via a processor (e.g., a separate processor (not shown) or via the processor 118). In an embodiment, the WRTU 102 may include a half-duplex radio for which transmission and reception of some or all of the signals (e.g., associated with specific subframes for both UL (e.g., for transmission) or downlink (e.g., for reception)) may be concurrent and / or simultaneous. The full-duplex radio may include an interference management unit 139 for reducing and / or substantially eliminating self-interference via hardware (e.g., a choke) or via signal processing performed by a processor (e.g., a separate processor (not shown) or via the processor 118). In an embodiment, the WRTU 102 may include a half-duplex radio for which transmission and reception of some or all of the signals (e.g., associated with specific subframes for both UL (e.g., for transmission) or downlink (e.g., for reception)) may be concurrent and / or simultaneous.

[0045] Figure 1C 1 is a system diagram illustrating the RAN 104 and the CN 106 in accordance with an embodiment. As noted above, the RAN 104 may employ an E-UTRA radio technology to communicate with the WTRUs 102a, 102b, 102c over the air interface 116. The RAN 104 may also be in communication with the CN 106.

[0046] The RAN 104 may include evolved Node-Bs 160a, 160b, 160c, though it will be appreciated that the RAN 104 may include any number of evolved Node-Bs while remaining consistent with an embodiment. The evolved Node-Bs 160a, 160b, 160c may each include one or more transceivers for communicating with the WTRUs 102a, 102b, 102c over the air interface 116. In one embodiment, the evolved Node-Bs 160a, 160b, 160c may implement MIMO technology. Thus, the evolved Node-B 160a, for example, may use multiple antennas to transmit wireless signals to and / or receive wireless signals from the WTRU 102a.

[0047] Each of the evolved Node Bs 160a, 160b, 160c may be associated with a particular cell (not shown) and may be configured to handle radio resource management decisions, handover decisions, and scheduling of users in the UL and / or DL, among other things. Figure 1C As shown, the eNode-Bs 160a, 160b, 160c may communicate with one another via an X2 interface.

[0048] Figure 1C The illustrated CN 106 may include a mobility management entity (MME) 162, a serving gateway (SGW) 164, and a packet data network (PDN) gateway (or PGW) 166. While each of the foregoing elements is depicted as being part of the CN 106, it should be understood that any of these elements may be owned and / or operated by an entity other than the CN operator.

[0049] The MME 162 may be connected to each of the evolved Node-Bs 162a, 162b, 162c in the RAN 104 via an S1 interface and may serve as a control node. For example, the MME 162 may be responsible for authenticating users of the WTRUs 102a, 102b, 102c, bearer activation / deactivation, and selecting a particular serving gateway during an initial attach of the WTRUs 102a, 102b, 102c. The MME 162 may provide a control plane function for switching between the RAN 104 and other RANs (not shown) that employ other radio technologies, such as GSM and / or WCDMA.

[0050] The SGW 164 may be connected to each of the evolved Node-Bs 160a, 160b, 160c in the RAN 104 via an S1 interface. The SGW 164 may generally route and forward user data packets to / from the WTRUs 102a, 102b, 102c. The SGW 164 may perform other functions, such as anchoring the user plane during an inter-evolved Node-B handover, triggering paging when DL data is available for the WTRUs 102a, 102b, 102c, and managing and storing the context of the WTRUs 102a, 102b, 102c.

[0051] The SGW 164 may be connected to the PGW 166, which may provide the WTRUs 102a, 102b, 102c with access to packet-switched networks, such as the Internet 110, to facilitate communications between the WTRUs 102a, 102b, 102c and IP-enabled devices.

[0052] The CN 106 may facilitate communications with other networks. For example, the CN 106 may provide the WTRUs 102a, 102b, 102c with access to circuit-switched networks, such as the PSTN 108, to facilitate communications between the WTRUs 102a, 102b, 102c and traditional land-line communications devices. For example, the CN 106 may include or may be in communication with an IP gateway (e.g., an IP Multimedia Subsystem (IMS) server) that acts as an interface between the CN 106 and the PSTN 108. In addition, the CN 106 may provide the WTRUs 102a, 102b, 102c with access to other networks 112, which may include other wired networks and / or wireless networks owned and / or operated by other service providers.

[0053] Although the WTRU Figures 1A to 1D Although described as wireless terminals, it is contemplated that in certain representative embodiments, such terminals may (eg, temporarily or permanently) use a wired communications interface with a communications network.

[0054] In a representative embodiment, the other network 112 may be a WLAN.

[0055] A WLAN in infrastructure basic service set (BSS) mode may have an access point (AP) for a BSS and one or more stations (STAs) associated with the AP. The AP may have access or an interface to a distribution system (DS) or another type of wired / wireless network that carries traffic to and / or out of the BSS. Traffic originating from outside the BSS and destined for the STA may be reached by the AP and may be delivered to the STA. Traffic originating from the STA and destined for a target outside the BSS may be transmitted to the AP to be delivered to the corresponding target. Traffic between STAs within the BSS may be transmitted by the AP, for example, wherein the source STA may transmit traffic to the AP, and the AP may deliver traffic to the target STA. Traffic between STAs within the BSS may be considered and / or referred to as point-to-point traffic. Point-to-point traffic may be transmitted between the source STA and the target STA (e.g., directly between them) using a direct link setup (DLS). In certain representative embodiments, the DLS may use 802.11e DLS or 802.11z tunnel DLS (TDLS). A WLAN using an independent BSS (IBSS) mode may not have an AP, and STAs within or using the IBSS (eg, all STAs in the STA) may communicate directly with each other. The IBSS communication mode may sometimes be referred to herein as an "ad hoc" communication mode.

[0056] When using the 802.11ac infrastructure operation mode or a similar operation mode, the AP may send beacons on a fixed channel (such as a primary channel). The primary channel may be a fixed width (e.g., a 20 MHz wide bandwidth) or a width dynamically set via signaling. The primary channel may be an operating channel of the BSS and may be used by the STA to establish a connection with the AP. In certain representative embodiments, carrier sense multiple access / collision avoidance (CSMA / CA) may be implemented, for example, in an 802.11 system. For CSMA / CA, a STA (e.g., each STA) (including the AP) may sense the primary channel. If the primary channel is sensed / detected and / or determined to be busy by a particular STA, the particular STA may back off. One STA (e.g., only one station) may transmit at any given time in a given BSS.

[0057] High throughput (HT) STAs may communicate using a 40 MHz wide channel (eg, via a combination of a primary 20 MHz channel and adjacent or non-adjacent 20 MHz channels) to form a 40 MHz wide channel.

[0058] Very high throughput (VHT) STA can support 20MHz, 40MHz, 80MHz and / or 160MHz wide channels. 40MHz channels and / or 80MHz channels can be formed by combining continuous 20MHz channels. 160MHz channels can be formed by combining 8 continuous 20MHz channels, or by combining two non-continuous 80MHz channels (this can be called 80+80 configuration). For 80+80 configuration, after channel coding, the data can pass through a segment parser that can divide the data into two streams. Each stream can be processed by inverse fast Fourier transform (IFFT) and time domain processing separately. These streams can be mapped to two 80MHz channels, and the data can be sent by sending STA. At the receiver of the receiving STA, the above-mentioned operation for 80+80 configuration can be reversed, and the combined data can be transmitted to the medium access control (MAC).

[0059] 802.11af and 802.11ah support operating modes below 1GHz. Channel operating bandwidths and carriers are reduced in 802.11af and 802.11ah relative to those used in 802.11n and 802.11ac. 802.11af supports 5MHz, 10MHz, and 20MHz bandwidths in the TV White Space (TVWS) spectrum, and 802.11ah supports 1MHz, 2MHz, 4MHz, 8MHz, and 16MHz bandwidths using non-TVWS spectrum. According to a representative embodiment, 802.11ah may support instrument type control / machine type communications, such as MTC devices in macro coverage areas. MTC devices may have certain capabilities, such as limited capabilities, including support for (e.g., only support for) certain bandwidths and / or limited bandwidths. MTC devices may include batteries with battery life above a threshold (e.g., to maintain very long battery life).

[0060] WLAN systems that can support multiple channels and channel bandwidths (such as 802.11n, 802.11ac, 802.11af, and 802.11ah) include channels that can be designated as primary channels. The primary channel may have a bandwidth equal to the maximum common operating bandwidth supported by all STAs in the BSS. The bandwidth of the primary channel may be set and / or limited by a STA (which supports the minimum bandwidth operation mode) from all STAs operating in the BSS. In the example of 802.11ah, for STAs (e.g., MTC-type devices) that support (e.g., only support) 1MHz mode, the primary channel may be 1MHz wide, even if the AP and other STAs in the BSS support 2MHz, 4MHz, 8MHz, 16MHz, and / or other channel bandwidth operation modes. Carrier sensing and / or network allocation vector (NAV) settings may depend on the state of the primary channel. If the primary channel is busy, for example, because a STA (supporting only the 1MHz operation mode) is sending to the AP, the entire available band may be considered busy even if most of the band remains idle and may be available.

[0061] In the United States, the available frequency band for 802.11ah is 902MHz to 928MHz. In South Korea, the available frequency band is 917.5MHz to 923.5MHz. In Japan, the available frequency band is 916.5MHz to 927.5MHz. The total bandwidth available for 802.11ah is 6MHz to 26MHz, depending on the country code.

[0062] Figure 1D 1 is a system diagram illustrating the RAN 113 and the CN 115 in accordance with an embodiment. As noted above, the RAN 113 may employ NR radio technology to communicate with the WTRUs 102a, 102b, 102c over the air interface 116. The RAN 113 may also be in communication with the CN 115.

[0063] The RAN 113 may include gNBs 180a, 180b, 180c, but it will be appreciated that the RAN 113 may include any number of gNBs while remaining consistent with an embodiment. The gNBs 180a, 180b, 180c may each include one or more transceivers for communicating with the WTRUs 102a, 102b, 102c over the air interface 116. In one embodiment, the gNBs 180a, 180b, 180c may implement MIMO technology. For example, the gNBs 180a, 108b may utilize beamforming to send signals to and / or receive signals from the gNBs 180a, 180b, 180c. Thus, the gNB 180a may, for example, use multiple antennas to send wireless signals to and / or receive wireless signals from the WTRU 102a. In an embodiment, the gNBs 180a, 180b, 180c may implement carrier aggregation technology. For example, gNB 180a may transmit multiple component carriers to WTRU 102a (not shown). A subset of these component carriers may be on unlicensed spectrum, while the remaining component carriers may be on licensed spectrum. In an embodiment, gNBs 180a, 180b, 180c may implement coordinated multi-point (CoMP) technology. For example, WTRU 102a may receive coordinated transmissions from gNB 180a and gNB 180b (and / or gNB 180c).

[0064] The WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using transmissions associated with parameter sets that may be scalable. For example, OFDM symbol spacing and / or OFDM subcarrier spacing may vary for different transmissions, different cells, and / or different portions of the wireless transmission spectrum. The WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using subframes or transmit time intervals (TTIs) of varying or scalable lengths (e.g., containing different numbers of OFDM symbols and / or varying absolute time lengths over time).

[0065] The gNBs 180a, 180b, 180c may be configured to communicate with the WTRUs 102a, 102b, 102c in a standalone configuration and / or a non-standalone configuration. In a standalone configuration, the WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c while not accessing other RANs (e.g., such as the eNodeBs 160a, 160b, 160c). In a standalone configuration, the WTRUs 102a, 102b, 102c may use one or more of the gNBs 180a, 180b, 180c as mobility anchor points. In a standalone configuration, the WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using signals in an unlicensed band. In a non-standalone configuration, the WTRUs 102a, 102b, 102c may communicate / connect with the gNB 180a, 180b, 180c while also communicating / connecting with another RAN, such as the eNode-B 160a, 160b, 160c. For example, the WTRUs 102a, 102b, 102c may implement the DC principle to communicate with one or more gNBs 180a, 180b, 180c and one or more eNode-Bs 160a, 160b, 160c substantially simultaneously. In a non-standalone configuration, the eNode-B 160a, 160b, 160c may act as a mobility anchor point for the WTRUs 102a, 102b, 102c, and the gNB 180a, 180b, 180c may provide additional coverage and / or throughput for serving the WTRUs 102a, 102b, 102c.

[0066] Each of the gNBs 180a, 180b, 180c may be associated with a specific cell (not shown) and may be configured to handle radio resource management decisions, handover decisions, scheduling of users in UL and / or DL, support of network slicing, dual connectivity, interworking between NR and E-UTRA, routing of user plane data towards a user plane function (UPF) 184a, 184b and routing of control plane information towards an access and mobility management function (AMF) 182a, 182b, etc. Figure 1D As shown, gNBs 180a, 180b, and 180c may communicate with each other via an Xn interface.

[0067] Figure 1DThe CN 115 shown in FIG. 1 may include at least one AMF 182a, 182b, at least one UPF 184a, 184b, at least one session management function (SMF) 183a, 183b, and possible data networks (DNs) 185a, 185b. Although each of the aforementioned elements is depicted as part of the CN 115, it should be understood that any of these elements may be owned and / or operated by an entity other than the CN operator.

[0068] The AMF 182a, 182b may be connected to one or more of the gNBs 180a, 180b, 180c in the RAN 113 via the N2 interface and may act as a control node. For example, the AMF 182a, 182b may be responsible for authenticating users of the WTRU 102a, 102b, 102c, support of network slicing (e.g., handling of different PDU sessions with different requirements), selecting a specific SMF 183a, 183b, management of registration areas, termination of NAS signaling, mobility management, etc. The AMF 182a, 182b may use network slicing in order to customize CN support for the WTRU 102a, 102b, 102c based on the type of services utilized by the WTRU 102a, 102b, 102c. For example, different network slices may be established for different use cases, such as services relying on ultra-reliable low latency (URLLC) access, services relying on enhanced mobile broadband (eMBB) access, and / or services for machine type communication (MTC) access, etc. The AMF 162 may provide a control plane function for switching between the RAN 113 and other RANs (not shown) that employ other radio technologies, such as LTE, LTE-A, LTE-A Pro, and / or non-3GPP access technologies, such as WiFi.

[0069] The SMF 183a, 183b may be connected to the AMF 182a, 182b in the CN 115 via the N11 interface. The SMF 183a, 183b may also be connected to the UPF 184a, 184b in the CN 115 via the N4 interface. The SMF 183a, 183b may select and control the UPF 184a, 184b, and configure traffic routing through the UPF 184a, 184b. The SMF 183a, 183b may perform other functions such as managing and allocating WTRU IP addresses, managing PDU sessions, controlling policy enforcement and QoS, providing downlink data notification, etc. The PDU session type may be IP-based, non-IP-based, Ethernet-based, etc.

[0070] The UPF 184a, 184b may be connected to one or more of the gNBs 180a, 180b, 180c in the RAN 113 via the N3 interface, which may provide the WTRUs 102a, 102b, 102c with access to packet-switched networks, such as the Internet 110, to facilitate communications between the WTRUs 102a, 102b, 102c and IP-enabled devices. The UPF 184, 184b may perform other functions, such as routing and forwarding packets, enforcing user plane policies, supporting multi-homed PDU sessions, handling user plane QoS, buffering downlink packets, and providing mobility anchoring, etc.

[0071] The CN 115 may facilitate communications with other networks. For example, the CN 115 may include or may communicate with an IP gateway (e.g., an IP Multimedia Subsystem (IMS) server) that acts as an interface between the CN 115 and the PSTN 108. In addition, the CN 115 may provide the WTRUs 102a, 102b, 102c with access to other networks 112, which may include other wired networks and / or wireless networks owned and / or operated by other service providers. In one embodiment, the WTRUs 102a, 102b, 102c may be connected to local data networks (DNs) 185a, 185b via the UPF 184a, 184b via the N3 interface to the UPF 184a, 184b and the N6 interface between the UPF 184a, 184b and the DN 185a, 185b.

[0072] Given that Figures 1A to 1D as well as Figures 1A to 1D Corresponding to the description of the present invention, one or more or all of the functions described herein for one or more of the following may be performed by one or more simulation devices (not shown): WTRU102a-102d, base station 114a-114b, evolved Node B 160a-160c, MME 162, SGW 164, PGW 166, gNB 180a-180c, AMF 182a-182ab, UPF 184a-184b, SMF 183a-183b, DN 185a-185b and / or any other device described herein. The simulation device may be one or more devices configured to mimic one or more or all of the functions described herein. For example, the simulation device may be used to test other devices and / or simulate network and / or WTRU functions.

[0073] The simulation device may be designed to implement one or more tests of other devices in a laboratory environment and / or in an operator network environment. For example, one or more simulation devices may perform one or more functions or all functions while being fully or partially implemented and / or deployed as part of a wired and / or wireless communication network in order to test other devices within the communication network. One or more simulation devices may perform one or more functions or all functions while being temporarily implemented / deployed as part of a wired and / or wireless communication network. The simulation device may be directly coupled to another device for testing purposes and / or may use over-the-air wireless communications to perform testing.

[0074] One or more simulation devices can perform one or more (including all) functions without being implemented / deployed as part of a wired and / or wireless communication network. For example, the simulation device can be used in a test scenario in a test lab and / or a non-deployed (e.g., testing) wired and / or wireless communication network to implement testing of one or more components. One or more simulation devices can be test equipment. Direct RF coupling and / or wireless communication via RF circuits (e.g., which can include one or more antennas) can be used by the simulation device to send and / or receive data.

[0075] Figure 2 An example of a handover procedure that may be used in New Radio (NR) is illustrated. Figure 2 As shown, the wireless transmit / receive unit (WTRU) context within the source gNB may contain information about roaming and access restrictions, which may be provided at connection establishment or at a previous timing advance (TA) update. Mobility control information may be provided by the (AMF) to the WTRU, the source gNB, and / or the target gNB. The source gNB may configure the WTRU measurement process, and the WTRU may report according to its measurement configuration. The source gNB may decide to hand over the WTRU based on the received measurement results. The source gNB may send a handover request message to the target gNB, passing transparent RRC container information for preparing the handover on the target side. The information may include at least the target cell ID, K gNB *(e.g., K may be used between the WTRU and the target gNB gNB ), the WTRU’s C-RNTI in the source gNB, RRM configuration including WTRU inactivity time, basic AS configuration including antenna information and DL carrier frequency, current QoS flow to data radio bearer (DRB) mapping rules applied to the WTRU, SIB1 from the source gNB, WTRU capabilities for different RATs, PDU session related information and / or WTRU report measurement information including beam related information (if available).

[0076] Admission control may be performed by the target gNB. If the WTRU is admitted, the target gNB may prepare for the handover using L1 / L2 and may transmit a handover request confirmation to the source gNB, which may include a transparent container to be transmitted to the WTRU as an RRC message to perform the handover. The source gNB may trigger a UMTS air interface (Uu) handover by transmitting an RRCReconfiguration message to the WTRU containing the following information for accessing the target cell: target cell ID, new C-RNTI, target gNB security algorithm identifier for the selected security algorithm, etc. Uu may also be referred to as wideband code division multiple access (W-CDMA) and / or international mobile telecommunications (IMT) direct extension. Uu may include a radio interface between a UMTS terrestrial radio access network (UTRAN) and a WTRU utilizing code division multiple access (CDMA). The information may also include a set of dedicated RACH resources, an association between RACH resources and SSBs, an association between RACH resources and WTRU-specific CSI-RS configurations, common RACH resources, system information of the target cell, etc.

[0077] The source gNB may transmit a SN Status Transfer message to the target gNB to convey the uplink PDCP SN receiver status and downlink PDCP SN transmitter status of the DRBs to which PDCP status preservation (e.g., for RLC AM) is applied. The WTRU may synchronize to the target cell and may complete the RRC handover process by transmitting an RRCReconfigurationComplete message to the target gNB. The target gNB may transmit a Path Switch Request message to the AMF to trigger the 5G Core (5GC) to switch the DL data path towards the target gNB and establish an NG-C interface instance towards the target gNB. The 5GC may switch the DL data path towards the target gNB. The UPF may transmit one or more "End Marker" packets to the source gNB on the old path for each PDU session / tunnel and may then release any U-Plane / TNL resources towards the source gNB. The End Marker Packet may include: a special / pseudo RRC message, a PDCP Control PDU indicating that a new security context is applied, and / or a field in the PDCP Data PDU header indicating a switch to the new security context. The AMF may acknowledge the Path Switch Request message with a Path Switch Request Acknowledge message. Upon receiving the Path Switch Request Ack message from the AMF, the target gNB may transmit a WTRU Context Release to notify the source gNB of the handover success. The source gNB may then release the radio and C-plane related resources associated with the WTRU context. Any ongoing data forwarding may continue.

[0078] Figure 3 An example of security key hierarchy generation / derivation in NR is illustrated. Figure 3As shown, the key hierarchy structure may include one or more of the following keys: K AUSF (Authentication Server Function Key), K SEAF (Security Anchor Function Key), K AMF (Access and Mobility Management Function Key), K NASint (Non-Access Stratum Integrity Key), K NASenc (Non-access layer encryption key), K N3IWF (non-3GPP interworking function key), K gNB (gNode B key), K RRCint (Radio Resource Control Integrity Key), K RRCenc (Radio Resource Control Encryption Key), K UPint (User Plane Integrity Key) and K UPenc (User plane encryption key). One or more of the aforementioned keys may be related to the access layer and / or the non-access layer (NAM). The home public land mobile network (HPLM) may include several parts and / or devices from which keys are derived: unified data management (UDM), authentication credential repository and processing function (ARPF), authentication server function (AUSF), universal subscriber identity module (USIM) and mobile equipment (ME). The service network may include several parts and / or devices from which keys are derived: security anchor function (SEAF), access and mobility management function (AMF), mobile equipment (ME), gNB and non-3GPP interworking function (N3IWF). K can be derived on the network side based on 5G authentication and key agreement (AKA) AUSF On the WTRU side, K can be derived based on the Extensible Authentication Protocol AKA (EAP-AKA'). AUSF .

[0079] K can be the initial key used to derive other keys. CK and IK can be derived from K. The first K AUSF , CK' and IK' can be derived from CK and IK. AUSF Can be derived from CK' and IK'. K SEAF Available from First K AUSF (Network side) and the second K AUSF (WTRU side). AMF Available from K SEAF K N3IWF , K gNB , NH, K NASint , and K NASenc Available from K AMF K RRCint , K RRCenc , 、 K UPint , and K UPencAvailable from K gNB , NH. The secure key hierarchy may include one or more intermediate keys and vector values ​​used during various key derivation processes.

[0080] One or more keys may be associated with a Next Generation Radio Access Network (NG-RAN). gNB It can be from the mobile equipment (ME) and the access and mobility management function (AMF) from K AMF When performing horizontal or vertical key derivation, K can be further derived by the ME and the source gNB. gNB . K gNB Can be used as K between ME and ng-eNB eNB .

[0081] One or more keys may be associated with a user plane (UP) service. UPenc It can be from ME and gNB from K gNB The key derived from the above can be used to protect UP services using a specific encryption algorithm. UPint It can be from ME and gNB from K gNB The key derived from the ME may be used (e.g., only) to protect UP traffic between the ME and the gNB using a specific integrity algorithm.

[0082] One or more keys may be associated with RRC signaling. RRCint It can be done by ME and gNB from K gNB The key derived from K can be used to protect RRC signaling using a specific integrity algorithm. RRCenc It can be from ME and gNB from K gNB The key derived from the ciphertext encryption algorithm can be used to protect RRC signaling using a specific encryption algorithm.

[0083] One or more intermediate keys may be used. For example, the next hop (NH) may be a key derived by the ME and AMF to provide forward security, and K NG-RAN *(If the target is gNB, then K gNb *, or K if the target is an eNB eNB *) can be the key derived by the ME and NG-RAN (e.g., gNB or ng-eNB) when performing horizontal or vertical key derivation.

[0084] Whenever an initial access stratum (AS) security context is to be established between the WTRU and the gNB, the AMF and the WTRU may derive K gNB and next hop (NH) parameters. Available from K AMF K gNBand / or NH parameters. The NH Link Counter (NCC) may be associated with (eg, each) K gNB and / or NH parameters. (For example, each) K gNB Can be associated with an NCC corresponding to the NH value from which it is derived. In the initial setup, it can be directly derived from K AMF K gNB , and can then be considered to be associated with a virtual NH parameter with an NCC value (e.g., equal to 0). At initial setup, the derived NH value can be associated with another NCC value (e.g., 1). At handover, the current active K gNB The K to be used between the WTRU and the target gNB is derived from the NH parameters gNB The basis (called K gNB *). From the currently active K gNB Derivation of K gNB * May be referred to as horizontal key derivation and may be indicated to the WTRU without NCC increment. K is derived from NH parameters gNB* This may be referred to as vertical key derivation and may be indicated to the WTRU and the NCC increased. Finally, a new K gNB Then based on K gNB To derive K RRCint , K RRCenc , K UPint and K UPenc .

[0085] Using this type of key derivation, with K shared with the WTRU gNB A gNB with no knowledge of K may not be able to calculate any previous K that has been used between the same WTRU and a previous gNB gNB , thus providing backward security. Similarly, with K shared with the WTRU gNB A gNB with no knowledge of K may not be able to predict any future K that will be used between the same WTRU and another gNB after n or more handovers. gNB (E.g., because the NH parameter may only be calculated by the WTRU and the AMF.) One or more old security keys may be associated with the old (e.g., first) security context.

[0086] In the case of a handover with vertical key derivation, the NH may use the key in the target gNB as gNB Previously, it was further bound to the target PCI and its frequency absolute radio frequency channel number downlink (ARFCN-DL). When performing a handover using horizontal key derivation, the current active K gNB K in the target gNB gNB Before being further bound to the target PCI and its frequency ARFCN-DL. That is, when deriving KgNB When determining a new (e.g., second) security context, the PCI and ARFCN (e.g., the absolute frequency of the SSB of the target cell) may be used as input to a security key derivation function (KDF). Determining a new (e.g., second) security context may include: deriving new keys for the cell (KgNB); and using the physical cell identity (PCI) and frequency (e.g., ARFCN-DL) of the primary cell (PCell) to calculate one or more integrity protection keys and decryption keys for use with the candidate cell. Processing downlink data may include: performing integrity verification and decryption using the one or more integrity protection keys and decryption keys associated with the second security context.

[0087] Figure 4 Examples of horizontal key derivation (HKD) and vertical key derivation (VKD) are illustrated.

[0088] As described herein, K may be updated during HO (eg, using a key derivation function KDF that uses parameters such as the PCI and frequency of the new PCell and / or other parameters such as the NCC as input). gNB Then, based on the newly derived K gNB To update the integrity protection / authentication and encryption / decryption keys for both the UP and the CP. Determining a security context (e.g., a second security context) may include: deriving a new key for a candidate cell (KgNB); and using the physical cell identity (PCI) and frequency of the primary cell (PCell) to calculate one or more integrity protection keys and decryption keys for use with the candidate cell. Figure 4 As illustrated, at each NCC level (e.g., 0, 1, 2, 3), K is updated based on PCI and DL frequency. gNB When NCC = 0, use K gNB However, when NCC=2 and NCC=3, NH is used to derive the subsequent K gNB . K NG-RAN* Can be used in the intermediate step to derive the updated K gNB Processing the downlink data may include performing integrity verification and decryption using the one or more integrity protection keys and decryption keys associated with the second security context.

[0089] During HO with key change / update, the network may also instruct the WTRU to re-establish one or more (eg, all) Packet Data Convergence Protocol (PDCP) entities and RLC entities of the concerned bearers.

[0090] During RLC re-establishment, the WTRU may discard one or more RLC service data units (SDUs), RLC SDU segments and / or RLC protocol data units (PDUs) (e.g., if any), stop and reset one or more (e.g., all) timers, and / or reset one or more (e.g., all) state variables to their initial values.

[0091] During PDCP re-establishment, the WTRU may perform one or more of the following for a transmitting PDCP entity (e.g., with respect to UL data): for unacknowledged mode (UM) DRBs and acknowledged mode (AM) DRBs, reset the Robust Header Compression (ROHC) protocol for the uplink and, if drb-ContinueROHC is not configured, start in IR state in U mode; for UM DRBs and AM DRBs, reset the EHC protocol for the uplink if drb-ContinueEHC-UL is not configured; for UM DRBs and signaling radio bearers (SRBs), set TX_NEXT to an initial value; for SRBs, discard all stored PDCP SDUs and PDCP PDUs; apply encryption algorithms and keys provided by upper layers during the PDCP entity re-establishment procedure; apply integrity protection algorithms and keys provided by upper layers during the PDCP entity re-establishment procedure; for UM DRBs, for each PDCP SDU that has been associated with a PDCP sequence number (SN) but for which the corresponding PDU has not been previously submitted to lower layers, and for the AM of the Uu interface whose PDCP entity is suspended DRB, starting from the first PDCP SDU whose successful delivery of the corresponding PDCP data PDU has not been confirmed by the lower layer, for each PDCP SDU already associated with the PDCP SN, these PDCP SDUs are considered to be received from the upper layer, and the transmission of the PDCP SDUs is performed in the ascending order of the COUNT value associated with the PDCP SDU before the PDCP is re-established without restarting the discardTimer; and for an AM DRB whose PDCP entity is not suspended, starting from the first PDCP SDU whose successful delivery of the corresponding PDCP data PDU has not been confirmed by the lower layer, all PDCP SDUs already associated with the PDCP SN are performed in the ascending order of the COUNT value associated with the PDCP SDU before the PDCP entity is re-established, and the retransmission or transmission may include: using ROHC and / or using EHC to perform header compression of the PDCP SDU, using the COUNT value associated with the PDCP SDU to perform integrity protection and encryption of the PDCP SDU, and / or submitting the resulting PDCP data PDU to the lower layer.

[0092] During PDCP re-establishment, the WTRU may perform one or more of the following for a receiving PDCP entity (e.g., with respect to UL data): process PDCP data PDUs received from lower layers due to re-establishment of lower layers; for SRBs, discard one or more (e.g., all) stored PDCP SDUs and PDCP PDUs; for SRBs and UM DRBs, if t-Reordering is running, stop and reset t-Reordering, and for UM DRBs, after performing header decompression, deliver one or more (e.g., all) stored PDCP SDUs to upper layers in ascending order of associated COUNT values; for AM DRBs for Uu interface, if drb-ContinueROHC is not configured, perform header decompression using ROHC for one or more (e.g., all) stored PDCP SDUs; for AM DRBs for PC5 interface, use ROHC for one or more (e.g., all) stored PDCP IP The ROHC of the SDU is used to perform header decompression; for AMDRB for Uu interface, if drb-ContinueEHC-DL is not configured, the EHC for one or more (for example, all) stored PDCP SDUs is used to perform header decompression; for UM DRB and AM DRB, if drb-ContinueROHC is not configured, the ROHC protocol for the downlink is reset and started with the NC state in U mode; for UM DRB and AM DRB, if drb-ContinueEHC-DL is not configured, the EHC protocol for the downlink can be reset; for UM DRB and SRB, RX_NEXT and RX_DELV are set to initial values; the encryption algorithm and key provided by the upper layer are applied during the PDCP entity re-establishment process; and / or the integrity protection algorithm and key provided by the upper layer are applied during the PDCP entity re-establishment process.

[0093] The re-establishment process may ensure that data that has been encrypted and / or integrity protected with the previous key will not be sent (e.g., in the UL) or erroneously received in the DL (e.g., the WTRU will not attempt to decrypt or integrity verify old packets that have been encrypted and integrity protected with the old key). The MAC may be reset, thereby ensuring that any pending UL / DL data associated with the old key at the MAC level is also discarded. The WTRU may also refrain from performing a re-establishment of a Radio Resource Control (RRC) entity, a Packet Data Convergence Protocol (PDCP) entity, and a Radio Link Control (RLC) entity. The WTRU may also refrain from resetting a Medium Access Control (MAC) entity and a physical layer entity.

[0094] Inter-cell L1 / L2 mobility may be used to manage beams (e.g., in the case of CA). Mechanisms and / or procedures for L1 / L2-based inter-cell mobility for reducing mobility latency may be specified. Such mechanisms and / or procedures may include: configuration and maintenance for multiple candidate cells to allow rapid application of configurations for candidate cells (e.g., for RAN2 and / or RAN3); dynamic switching mechanisms among candidate serving cells (including SpCells and SCells) for potentially applicable scenarios based on L1 / L2 signaling (e.g., for RAN1 and / or RAN2); L1 enhancements for inter-cell beam management, including L1 measurements and reporting and beam indication (e.g., for RAN1 and / or RAN2); TA management (e.g., for RAN1 and / or RAN2); and / or CU-DU interface signaling for supporting L1 / L2 mobility (e.g., for RAN3). Early RAN2 involvement may be useful, including further clarification of the interaction between L1 enhancements and dynamic switching mechanisms for inter-cell beam management. FR2-specific enhancements (if any) may not be excluded.

[0095] L1 / L2-based inter-cell mobility may be applicable to one or more of the following: a standalone case, a CA case, and a NR-DC case with a serving cell change within (e.g., one) CG; an intra-DU case and an intra-CU inter-DU case (e.g., applicable to standalone and CA: no new RAN interface is expected); both intra-frequency and inter-frequency; both FR1 and FR2; the source cell and the target cell may be synchronized or asynchronous; and the inter-CU case may not be included.

[0096] Inter-cell beam management can address intra-DU scenarios and intra-frequency scenarios. In this case, the serving cell can remain unchanged (for example, it is not possible to change the serving cell using L1 / L2 based mobility). In FR2 deployments, CA can be used to utilize the available bandwidth (for example, to aggregate multiple CCs in one frequency band). These CCs can be transmitted using the same analog beam pair (for example, a gNB beam and a WTRU beam). The WTRU may be configured with TCI states (which may be of a considerable number, such as 64) for receiving PDCCH and PDSCH. (For example, each) TCI state may include an RS or SSB referenced by the WTRU to set its beam. The SSB may be associated with a non-serving PCI. MAC signaling (for example, "TCI state indication for WTRU-specific PDCCH MAC CE") may activate the TCI state for Coreset / PDCCH. Receipt of PDCCH from a non-serving cell may be supported by a MAC CE indicating the TCI state associated with the non-serving PCI. MAC signaling (e.g., "TCI state activation / deactivation for WTRU-specific PDSCH") may activate a subset of (e.g., up to) 8 TCI states for PDSCH reception. The DCI may indicate a specific TCI state among the 8 TCI states. "Unified TCI state" with different update mechanisms (e.g., based on DCI) but without multiple TRPs may be supported. Unified TCI state with multiple TRPs may be supported.

[0097] The overall goal of L1 / L2 inter-cell mobility may be to improve handover latency; for either a regular L3 handover or a conditional handover, the WTRU may first transmit a measurement report using RRC signaling. In response, the network may provide additional measurement configurations and potential conditional handover configurations. With a regular handover, the network may provide a configuration for the target cell after the WTRU uses RRC signaling to report that the cell meets the configured radio quality criteria. For conditional handover, in order to reduce the handover failure rate due to delays in transmitting measurement reports and then receiving RRC reconfiguration, the network may provide (e.g., in advance) a target cell configuration and measurement criteria that may determine when the WTRU should trigger the CHO configuration. However, both L3 methods do suffer from a certain amount of delay due to the transmission of measurement reports and the reception of the target configuration, particularly in the case of a regular (e.g., non-conditional) handover.

[0098] The purpose of L1 / L2 based inter-cell mobility may be to allow fast application of configuration for candidate cells, including dynamic switching between SCells and switching of PCells (e.g., switching roles between SCells and PCells), without performing RRC signaling. The inter-CU case may not be included, as it may include relocation of the PDCP anchor. Therefore, an RRC based approach may be used to support at least inter-CU handover. One of the purposes of L1 / L2 should also be to allow immediate activation of CA operation when the serving cell changes.

[0099] Figure 5 An example of L1 / L2 inter-cell mobility operation is shown, whereby the candidate cell group is configured through RRC, and dynamic switching of PCell and SCell is achieved using L1 / L2 signaling.

[0100] The WTRU may receive first downlink data from a source cell (e.g., PCell 1 and / or SCell 2) using a first security context. In some cases of the present disclosure, "receiving" data may include "processing" the data. The WTRU may process the first downlink data using the first security context. The WTRU may be configured with cell 1 to cell 4 as candidate cells via RRC and activate PCell 1 and SCell 2. The WTRU may receive configuration information from the source cell indicating one or more candidate cells for layer 1 or layer 2 (L1 / L2) triggered mobility (LTM). The WTRU may receive configuration information indicating multiple mobility candidate cells and multiple measurement configurations. The base station may perform L1 / L2 signaling for Scell ​​activation / deactivation (intra-CU). CHO for Pcell switching (intra-CU or inter-CU) may occur, and the "set" of L1 / L2 candidates may be updated. The WTRU may activate a first measurement configuration among multiple measurement configurations based on the first cell being the current serving cell of the WTRU. The WTRU may also determine that a second measurement configuration among the multiple measurement configurations is deactivated based on the first cell being a current serving cell of the WTRU.

[0101] When the WTRU performs mobility from left to right, the WTRU may switch (e.g., dynamically switch) between cell 2 and cell 3. The WTRU may receive an LTM indication from the source cell to perform a handover (HO) to a candidate cell (e.g., SCell 3) among the one or more candidate cells. The LTM indication to perform the HO may indicate that a special cell (SpCell) associated with the WTRU will be changed. The WTRU may determine a second security context associated with the candidate cell. Determining the second security context may include: deriving a new key for the candidate cell (KgNB); and using a physical cell identity (PCI) and frequency of a primary cell (PCell) to calculate one or more integrity protection keys and decryption keys for use with the candidate cell. The higher frequency and higher bandwidth of cell 3 and cell 4 may be factors (or conditions) in determining a handover to a target cell (e.g., a candidate cell). The WTRU may receive layer 1 or layer 2 (L1 / L2) control signaling indicating that the WTRU is to perform mobility to a second cell, which is one of the multiple mobility candidate cells. The WTRU may still use the first security context to process the second downlink data.

[0102] As the WTRU continues to perform mobility to the right, the WTRU may switch (e.g., dynamically switch) the PCell to cell 2 and switch (e.g., dynamically switch) the SCell to cell 4. The WTRU may determine which of the multiple measurement configurations will be activated and which of the multiple measurement configurations will not be activated when performing mobility to the second cell (e.g., the second cell is a primary cell) based on the second cell being a new serving cell for the WTRU and the mobility to the second cell resulting in activation of a third cell in the multiple mobility candidate cells as a secondary cell. The second measurement configuration may also be determined to be activated. The WTRU may be configured to determine which of the multiple measurement configurations will be activated and which of the multiple measurement configurations will not be activated when performing mobility to the second cell (e.g., PCell 1 to PCell 2) based on one or more conditions being satisfied. The WTRU may also be configured to determine which of the multiple measurement configurations will be activated and which of the multiple measurement configurations will not be activated when performing mobility to the second cell based on a combination of currently active secondary cells (SCells) in the multiple mobility candidate cells.

[0103] exist Figure 5In the present invention, L1 (e.g., DCI activates unified TCI state) or L2 (e.g., MAC CE) signaling may be used to dynamically switch the roles of the four pre-configured cells. The WTRU may receive layer 1 or layer 2 (L1 / L2) control signaling indicating that the WTRU is to perform mobility to a second cell, which is one of the multiple mobility candidate cells. For example, "cell" may refer to a PCell, an SCell, a mobility candidate cell, an activated cell, a deactivated cell, a first cell, a second cell, a third cell, a fourth cell, a fifth cell, an nth cell, or any other cell. The WTRU performing mobility may include the WTRU moving in a certain direction. The WTRU performing mobility may include predictions, estimates, measurements, and / or calculations regarding speed, direction, acceleration, and / or one or more locations related to the WTRU. For example, if the WTRU is moving to the right, the WTRU, layer 1, layer 2, and / or layer 3 may predict where the WTRU will be located within a given amount of time, and activate required measurement configurations and deactivate unneeded measurement configurations. The location of the WTRU within the cell (e.g., the area of ​​the cell where the WTRU is located) may also be used to determine which measurement configurations are activated and deactivated. Figure 5 In the example, when the WTRU is located at the far left of cell 1, the measurement configuration associated with cell 4 may be deactivated because cell 4 is towards the far right of cell 1. When the WTRU is in the middle of cell 1, the measurement configuration associated with cell 3 may be activated because cell 3 is located just above (e.g., close to) the center of cell 1.

[0104] The WTRU may determine which measurement configurations of the plurality of measurement configurations to activate and which measurement configurations of the plurality of measurement configurations to not activate when performing mobility to the second cell based on the second cell being a new serving cell for the WTRU and the mobility to the second cell resulting in activation of a third cell of the plurality of mobility candidate cells as a secondary cell, the second cell being a primary cell, wherein the second measurement configuration is determined to be activated. Figure 5, the WTRU performs mobility from PCell 1 to PCell 2, which results in activation of cell 4 as a secondary cell (SCell 4), where the secondary cell was previously cell 2. Radio resource control (RRC) may be the highest layer in the control plane of the access stratum (AS). The RRC may deliver messages of the non-access stratum (NAS) located above the RRC layer. Additionally, in an embodiment, the network may provide one or more (2 in this example) conditional handover configurations regarding the target cell. The WTRU may be configured to determine which of the multiple measurement configurations will be activated and which of the multiple measurement configurations will not be activated when performing mobility to the second cell based on a combination of currently active secondary cells (SCells) in the multiple mobility candidate cells.

[0105] As of Release 17 of the 3GPP standard, when multiple conditional handover configurations are provided, the WTRU stores these conditional handover configurations and evaluates the triggering conditions in parallel. Using the proposed method, these CHO configurations may not become active immediately upon configuration (e.g., a flag included in the measurement / CHO configuration that can store the relevant configuration) and may be activated in one or more ways (such as using explicit L1 / L2 signaling indicating the activation of the CHO or measurement configuration). Additional activation examples may include when a cell becomes a PCell, when a SCell (e.g., or a set of SCells) is activated, when a SCell (e.g., or a set of SCells) is deactivated, when a PCell / SCell combination becomes active or is deactivated, and at certain changes in the combination (e.g., a change of Pcell1->PCell 2 activates the configuration, but a change of PCell 3->PCell 2 may not activate the configuration).

[0106] In an embodiment, a similar mechanism may be employed to deactivate an active CHO or measurement configuration.Other mechanisms may be employed to release / delete an active or inactive CHO or measurement configuration.

[0107] For example, an implementation scheme may be used in the context of an L3 handover. In an implementation scheme, a CHO or CPAC configuration may be provided, but will not be activated until a SpCell and / or one or more Scells become active, regardless of whether L1 / L2 triggered mobility is used. In an implementation scheme, the WTRU may perform a CPC-based configuration on the active configuration of the current serving cell. In an implementation scheme, the WTRU may activate and begin evaluating a stored CPC configuration, which is associated with a new serving cell, for example. In an implementation scheme, the processes associated with cell changes activated or triggered using explicit L1 / L2 commands may also be applicable to cell changes using L3 RRC reconfiguration or CHO, CPC, or CPA. In some cases, the WTRU may determine that a second measurement configuration among the multiple measurement configurations is deactivated based on the first cell being the current serving cell of the WTRU.

[0108] The first CHO configuration may be provided with a target cell and a measurement event for triggering CHO, such as CondEvent A3 (e.g., the offset of the neighbor becomes better than the SpCell) or CondEvent A5 (e.g., the SpCell becomes worse than Threshold 1 and the neighbor becomes better than Threshold 2). The network may not know in which direction the WTRU will move, so the network may establish targets in multiple directions around the WTRU (e.g., left, right, front, back, up, and down). The WTRU may be configured to activate the first CHO configuration based on cell 1 being a PCell. When the WTRU performs mobility from left to right, the WTRU may switch (e.g., dynamically switch) the Scell ​​between cell 2 and cell 3. As the WTRU continues to move to the right, the WTRU may switch (e.g., dynamically switch) the PCell from cell 1 to cell 2 and switch (e.g., dynamically switch) the SCell from cell 2 to cell 4. When it is determined that one or more conditions are satisfied, the WTRU may use the second security context to process third downlink data from the candidate cell (e.g., PCell 2, SCell 4). Processing the third downlink data may include performing integrity verification and decryption using the one or more integrity protection keys and decryption keys associated with the second security context.

[0109] The WTRU may be configured to use the second security context and refrain from using the first security context upon determining that one or more conditions are met. The one or more conditions may include determining that a certain time has passed since receiving the LTM indication to perform the HO; determining that integrity verification using one or more old security keys has failed; and / or determining that an end marker packet has been received. The end marker packet may include one or more of the following: a pseudo radio resource control (RRC) message, a packet data convergence protocol (PDCP) control protocol data unit (PDU) including an indication to use the second security context; or a field in a PDCP data PDU header including an indication to use the second security context. After determining that one or more conditions are met, the WTRU may send third uplink data encrypted using the second security context. The one or more old security keys may be associated with the first security context. And the first security context may include one or more security keys (e.g., the one or more old security keys).

[0110] The WTRU may perform one or more measurements associated with the second measurement configuration. Figure 5 In the example, similar to the first CHO configuration, a target cell and a measurement event for triggering the CHO may be provided to the second CHO configuration. The second CHO configuration may also be activated based on cell 2 being a PCell (for example, or alternatively, a combination of PCell 1 and SCell 4 may activate the second CHO configuration). The WTRU may evaluate the CHO based on an associated combination of active cells, rather than evaluating all configured CHOs in parallel. This may reduce the processing overhead in the WTRU, so that relevant measurements and evaluations may be performed based on the WTRU location within the L1 / L2 mobility area. This may also reduce resource usage in the network. The WTRU may also suppress re-establishment of a radio resource control (RRC) entity, a packet data convergence protocol (PDCP) entity, and a radio link control (RLC) entity. The WTRU may also suppress resetting a medium access control (MAC) entity and a physical layer entity.

[0111] The network may not need to reserve resources on all configured target CHO cells, but may reserve resources based on the activated CHO configuration, for example, because the network can (for example, using L1 / L2 signaling) control the combination of active cells used by the WTRU, the network also controls the content of the target CHO cells and the currently active CHO configuration in the WTRU. The same or similar methods can also be used to control measurement objects and measurement reports for conventional handover. The WTRU may transmit a measurement report via a second cell based on the measurement associated with the second measurement configuration. For example, as an alternative or in addition to one or more CHO configurations, one or more measurement objects may be configured for measurement reporting and associated with one or more L1 / L2 controlled cell combinations. Additionally, carriers and / or cells (for example, adjacent carriers and cells) currently measured by the WTRU may be associated with L1 / L2 controlled cell combinations.

[0112] The activation measurement configuration and / or conditional reconfiguration may be based on any "condition" that indicates that the WTRU may be located within an L1 / L2 mobility area or within an area corresponding to a set of cells with pre-configured measurements or CHO / CPAC. These conditions may include which PCells and / or SCells are activated, and may include situations where there may be no active SCells and / or SCells may be deactivated for power saving reasons.

[0113] In each instance of "X" and "Y" having at least one "mobility area index", a "mobility area index" may be introduced and configured. In an embodiment, "X" may include anything that may be activated / deactivated based on the location of the WTRU, such as: TCI state, non-serving PCI (e.g., within "NumberOfAdditionalPCI"), PCell / SCell combination, active bandwidth part (BWP), SCell activation state, satisfaction of measurement event trigger conditions, DL synchronization trigger for candidate cells, RA of PDCCH command towards candidate cells, and / or enabling of radio link monitoring (RLM) or beam failure detection (BFD) for the target cell. In some examples, if the TCI state associated with the non-serving PCI is activated, the PCI may be activated.

[0114] "Y" may include anything that supports measurement / mobility, such as a configured measurement configuration, a configured conditional reconfiguration, and / or a channel state information (CSI) reporting configuration, a BFR configuration, and / or a neighbor carrier / cell list. The configured measurement configuration may include an L3 measurement object, an L1 or L3 measurement event, a CSI measurement configuration, and / or an L1 or L3 measurement RS configuration (e.g., an SSB or CSI-RS resource for the current or neighbor cell). The configured measurement configuration may include a PCI or logical ID, an SMTC location, a frequency location, and / or an SCS.

[0115] Based on the above, it is contemplated that examples of possible behaviors may include, for example, that if "X" is activated, then any "Y" with the same "mobility area index" configured for X is also activated. In some examples, if there is no activated "X" with the same "mobility area index", then Y may be deactivated. In some examples, explicit activation / deactivation or switching of the "mobility area index" may occur, which may activate / deactivate the corresponding X and / or Y.

[0116] An example of a "mobility area index" may be one or more indices or identifiers that associate "X" (e.g., anything that can be activated / deactivated based on the location of the WTRU) with "Y" (e.g., anything that supports measurement / mobility). For example, the WTRU may be configured with one or more measurement configurations, each with an index. Additionally, the WTRU may be configured with one or more conditions (e.g., SpCell / SCell combinations) and / or a list of one or more indices that identify measurement configurations that are enabled when the one or more conditions are met. Each of the configured conditions may be associated with the same or a different subset of the measurement configurations. In this way, it may not be necessary to repeat the measurement configuration for every possible SpCell / SCell combination, but each of the combinations to which the measurement configuration applies (e.g., a SpCell / Scell ​​combination configured as an L1 / L2 mobility candidate configuration) may use an index or identifier to reference the measurement configuration (e.g., configured in a list or structure independent of the L1 / L2 mobility candidate configurations). Additionally, this also allows configuring (eg, via RRC) more measurements than would be applicable to any given SpCell / SCell combination (eg, activated or triggered by a MAC CE).

[0117] As used herein, the L1 / L2 mobility indication may be any L1 / L2 signaling (e.g., PHY DCI, MAC CE, etc.). Unless otherwise specified, the embodiments disclosed herein are equally applicable to the case of single connectivity (e.g., only MCG is configured) and the case of dual connectivity (DC) (e.g., where SCG is also configured). In the case of DC, the L1 / L2 mobility indication for the SCG may be received from the MCG or the SCG.

[0118] As described herein, L1 / L2 mobility indications may change (eg, simultaneously or sequentially) the PCell, the PSCell, and / or both.

[0119] The term "concerned cell group" may refer to the cell group referred to by the L1 / L2 mobility indication (e.g., the primary cell group (MCG) if the L1 / L2 mobility indication is changing the PCell, and the secondary cell group (SCG) if the L1 / L2 indication is changing the SCell). When used to refer to a bearer, the bearer of the concerned cell group may be a bearer to which the PDCP is associated / terminated at the cell group. For example, if the L1 / L2 mobility indication is regarding an MCG (e.g., a PCell change), the concerned bearer may be an MCG-terminated MCG bearer, an MCG-terminated split bearer, or an MCG-terminated SCG bearer. Similarly, if the L1 / L2 mobility indication is regarding an SCG (e.g., a PSCell change), the concerned bearer may be an SCG-terminated SCG bearer, an SCG-terminated split bearer, or an SCG-terminated MCG bearer.

[0120] The terms "security context" and "security key" are used interchangeably herein.

[0121] The term "packets associated with a particular security key / context" may refer to packets that are integrity protected and / or encrypted using the relevant security key.

[0122] PDCP / RLC re-establishment may be triggered. Upon receiving an L1 / L2 mobility indication for a change of SpCell, the WTRU may implicitly trigger the re-establishment of the PDCP entities for all radio bearers. It should be noted that in legacy NR, PDCP re-establishment for a given bearer may be triggered (e.g., only) upon receiving an explicit indication in the PDCP configuration related to the bearer (e.g., in the case of HO, the network may indicate to the WTRU for each bearer to re-establish the associated PDCP entity). The implicit re-establishment of the PDCP entity may also trigger the re-establishment of the RLC associated with the bearers of the relevant cell group.

[0123] If the WTRU is configured with split bearers, the implicit re-establishment of the PDCP entity may also trigger the re-establishment of one or more (e.g., all) of the RLC entities associated with the bearers concerned (including those for other cell groups). For example, an L1 / L2 mobility indication for a change of PCell may cause the WTRU to re-establish PDCP for one or more (e.g., all) of the bearers of the MCG, the RLC associated with these bearers in the MCG, and any RLC associated with these bearers in the SCG (e.g., for split bearers).

[0124] The L1 / L2 mobility indication may include a flag that explicitly indicates whether the PDCP and RLC for the bearers of the relevant cell group should be reestablished. In one example, a value of 0 may indicate that the PDCP and RLC for one or more (e.g., all) of the bearers of the relevant cell group should be reestablished. In another example, a value of 1 may indicate that the PDCP and RLC for one or more (e.g., all) of the bearers should be reestablished. Alternatively, the L1 / L2 mobility indication may include a separate flag indicating whether the PDCP should be reestablished and a separate flag indicating whether the RLC should be reestablished. The L1 / L2 mobility indication may include multiple flags, each of which is associated with one or more bearers and indicates whether the PDCP and / or RLC associated with the bearer is to be reestablished.

[0125] In some cases, a MAC reset may be triggered. Upon receiving an L1 / L2 mobility indication for a change in SpCell, the WTRU may implicitly trigger a reset of the MAC entity associated with the relevant cell group. Upon receiving an L1 / L2 mobility indication for a change in PCell, (e.g., if DC is configured) the WTRU may implicitly trigger a reset of the MAC entity associated with the SCG. Upon receiving an L1 / L2 mobility indication for a change in PCell, such as (e.g., only) when the WTRU is configured with split bearers, (e.g., if DC is configured) the WTRU may implicitly trigger a reset of the MAC entity associated with the SCG.

[0126] The L1 / L2 mobility indication for a changed SpCell may include a flag indicating whether the MAC associated with the relevant cell group should be reset. In an example, a value of 0 may indicate that the MAC entity is to be reset and a value of 1 may indicate that the MAC entity should be reset. If the WTRU is configured with DC, receiving an L1 / L2 mobility indication indicating a reset of the MCG MAC may implicitly indicate that the SCG MAC should also be reset. The L1 / L2 mobility indication for a changed PCell may include an explicit flag indicating whether the MAC associated with the SCG should be reset.

[0127] One or more of the solutions described herein may be performed without triggering a PDCP / RLC re-establishment and / or a MAC reset. Upon receiving an L1 / L2 mobility indication for a changed SpCell, the WTRU may refrain from performing a re-establishment of the PDCP entity and the RLC entity and / or calculating a new security context (e.g., deriving a new KgNB based on a new PCI and frequency for the new PCell, deriving a new KgNB based on a new KgNB, gNB to calculate the integrity protection keys and encryption keys for both UP and CP). In the UL, for any new data to be sent at the PDCP level, the WTRU may use the new keys to integrity protect and / or encrypt the packets, and for old data that has been integrity protected and / or encrypted using the old security keys, the WTRU may pass the data to the RLC / MAC entity. In the DL, at the PDCP level, the WTRU may first attempt to perform integrity verification on the received packets using the old security keys. If the integrity verification is unsuccessful, the WTRU may attempt to verify the integrity of the data using the new security keys. If the integrity verification of the data using the new security keys is successful, the WTRU may delete the old security context and use the new security keys from then on; if not, the WTRU may trigger a radio link failure.

[0128] A sequence of parity bits may be included in the PDCP header. These parity bits may consist of a known sequence that is pre-configured (e.g., in the standard) or derived (e.g., from the cell ID, WTRU-ID, or other variable parameters known to the transmitter and receiver). The purpose of the parity bits may be to enable integrity verification testing of security keys so that the receiver may perform integrity verification of the parity bits using the old key and the new key to determine which is the correct key (e.g., if the result of applying the currently used / tested security key to the sequence of parity bits matches the expected outcome, then it may be determined that the currently used / tested key is the key used at the transmitter and the WTRU may continue to use that key to process the remainder of the PDU).

[0129] Upon receiving the L1 / L2 mobility indication, the WTRU may start a timer (e.g., the value of the timer may be configured by the network or based on the WTRU specific implementation). Until the timer expires, the WTRU may continue to operate in the same manner as described herein (e.g., first using the old key, and if the use of the old key is unsuccessful, then using the new key). When the timer expires, the WTRU may delete the old security context and (e.g., only) use the new security context from then on.

[0130] When integrity verification using the old key fails but verification using the new security key succeeds for the first time, the WTRU may start a security context switch timer (e.g., the value of the timer may be configured by the network or based on WTRU specific implementation). Until the timer expires, the WTRU may keep operating in the same manner (e.g., first using the old key, and if the use of the old key is unsuccessful, then using the new key). When the timer expires, the WTRU may delete the old security context and use the new security context from then on.

[0131] When integrity verification using the old key fails but verification using the new security key succeeds, the WTRU may further check the PDCP sequence number (SN) of the packet in question. If the packets are received in sequence (e.g., no packets with a lower SN than the current packet are lost), the WTRU may delete the old security context. If the packets are not received in sequence (e.g., one or more packets with a lower SN than the current packet have not yet been received), the WTRU may retain the old security context. The old security context may be used to perform integrity verification and decryption on the lost packets, while the new security context may be used to perform integrity verification and decryption on new packets (e.g., packets with a greater SN than the current packet). Once (e.g., all) of the lost packets are received, the WTRU may delete the old security context.

[0132] Since integrity protection is an optional feature of the WTRU, in some cases the WTRU may not be able to detect the moment when the security context is fully switched.

[0133] The network may transmit a fake RRC message associated with the new security key (e.g., because RRC messages are always integrity protected). The WTRU may interpret this as an indication that the new security key may be used (e.g., only) from then on or after a certain time has passed after receiving the fake RRC packet. In an example, the WTRU may refrain from transmitting any RRC completion message associated with the fake RRC message.

[0134] The network may transmit a security context switch indicator (eg, or an end marker) (eg, a PDCP control PDU) instructing the WTRU to switch security context from then on (eg, or start a security context switch timer as disclosed herein).

[0135] The WTRU may determine whether to use a new security context or an old security context based on information in a PDCP data PDU header (e.g., one or more reserved bits in the PDCP data PDU header). For example, a value of 1 in one of the reserved bits may indicate the PDCP PDU, and any PDU with an SN greater than that of the PDU may be associated with the new security context.

[0136] Whenever a security key changes, a bit in the PDU header may switch between two values ​​(e.g., "0" and "1"), such that one or more (e.g., all) PDUs generated using a first security key (e.g., before a PCell change) indicate the first value in the PDU header, and one or more (e.g., all) PDUs generated using a second security key (e.g., after a PCell change) indicate the second value in the PDU header. In this way, one or more (e.g., each) PDU header may contain an indication of which PDUs use the old key and the new key, which may be used at the receiver (particularly in the case of out-of-order delivery) to determine which security key to apply. Alternatively, this may be a plurality of bits, such as a counter value that may be incremented each time a security key is changed, or an index to one of a plurality of security keys. This may provide additional benefits (e.g., in the case where a PCell changes multiple times in rapid succession), such that it is possible to receive data out of order using more than two different security keys.

[0137] The WTRU may transmit a security context switch indicator (or end marker) (e.g., a PDCP control PDU) to indicate to the network that it has started using the new security key. The WTRU may indicate to the network that it has started using the new security key by setting a marker in a PDCP data PDU header (e.g., one or more reserved bits in the PDCP data PDU header). The WTRU may transmit a pseudo RRC message to the network associated with the new security key to indicate to the network that the WTRU has started using the new security key. The network or the WTRU may transmit the end marker at another layer different from PDCP (e.g., RLC control PDU, MAC CE, etc.).

[0138] As disclosed herein, the WTRU may make a decision to change the security context for one bearer at a time. For example, if PDCP control PDUs are used, the control PDUs are transmitted for (e.g., each) PDCP (e.g., each bearer). Alternatively, as disclosed herein, the WTRU may make a decision to change the security context for one or more (e.g., all) bearers at a time. For example, if the WTRU has detected that a new key is applicable to packets of a particular bearer, the WTRU may start using the new key (e.g., or start a security context switch timer as disclosed herein) even for packets belonging to other bearers other than the relevant packets in which the security context switch was detected.

[0139] The WTRU may maintain multiple security contexts at a given time. For example, the WTRU may generate a security context for any candidate cell that is part of the L1 / L2 mobility cell and may use the L1 / L2 mobility indication to upgrade to the PCell (e.g., assuming the candidate cell is the PCell, generate a K gNB and associated integrity verification keys and encryption keys). (Each) security context may be associated with an identifier (e.g., a serving cell index of the candidate cell). (Each) PDU header may include: an identifier (e.g., a serving cell index) so that the receiver can determine which security context was used to generate the received PDU; or a bit (e.g., the bit is toggled whenever the security context changes) indicating whether a security context associated with a previous PCell or a security context associated with a current PCell was used to generate the PDU.

[0140] The WTRU may be configured to use a given security context for a particular bearer (e.g., as opposed to using one security context for all bearers). The WTRU may be configured to use different security contexts in the UL and DL for a given bearer. The WTRU may be configured to change the security context for a given bearer from one packet to another. For example, a PDCP data PDU header may include an indication of the security context ID to be used for a given packet (e.g., a security context ID indicated via one or more reserved bits of the PDCP data PDU header).

[0141] Figure 6An example of L1 / L2 triggered mobility (LTM) using an old security context and / or a new security context as disclosed above is illustrated. At 602, a WTRU may process first downlink data from a source cell using a first security context. The WTRU may receive configuration information from the source cell indicating one or more candidate cells for layer 1 or layer 2 (L1 / L2) triggered mobility (LTM). The WTRU may be configured with one or more of: one or more candidate cells for performing L1 / L2 triggered mobility (LTM); and one or more conditions for stopping using a security context associated with the source cell (e.g., old security context, first security context) and starting using a security context associated with a target cell (e.g., new security context, second security context) during HO. The one or more conditions may include: a specific time after receiving an LTM command / indication to perform HO, a failure of integrity verification using the old security context, and / or receiving an end marker. The end marker packet may include one or more of: a pseudo radio resource control (RRC) message, a packet data convergence protocol (PDCP) control protocol data unit (PDU) including an indication to use the second security context, and / or a field in a PDCP data PDU header including an indication to use the second security context.

[0142] The one or more old security keys may be associated with the first security context. And the first security context may include one or more security keys (e.g., the one or more old security keys). Determining the second security context may include: deriving a new key for the candidate cell (KgNB); and using a physical cell identifier (PCI) and frequency of a primary cell (PCell) to calculate one or more integrity protection keys and decryption keys for use with the candidate cell. Processing the third downlink data may include: performing integrity verification and decryption using the one or more integrity protection keys and decryption keys associated with the second security context.

[0143] At 604, the WTRU may receive an LTM command / indication from the source cell to perform a HO to a candidate cell of one or more candidate cells. The LTM indication to perform the HO may indicate that a special cell (SpCell) associated with the WTRU is to be changed. Prior to receiving the LTM indication to perform the HO, the WTRU may send first uplink data to the source cell using the first security context. After receiving the LTM indication to perform the HO, the WTRU may send second uplink data encrypted using the second security context to the candidate cell.

[0144] The WTRU may determine a second security context associated with the candidate cell at 606. The WTRU may derive a security context associated with the target cell while maintaining a security context associated with the source cell.

[0145] For uplink (UL) data, the WTRU may use the new security context to integrity protect and / or cipher new data arriving at the Packet Data Convergence Protocol (PDCP) at 608. For old data that has been integrity protected and / or ciphered using the old security context, the WTRU may send the data as is.

[0146] At 610, the WTRU may determine whether one or more conditions for switching to new security are met.

[0147] At 612, if one or more conditions for switching to the new security context are met, the WTRU may release the old security context and begin using the new security context for integrity verification and decryption. The WTRU may use the second security context and refrain from using the first security context when determining that one or more of the conditions are met. The WTRU may use the second security context to process third downlink data from the candidate cell when determining that one or more of the conditions are met. The one or more conditions may include: determining that a certain time has passed since receiving the indication to perform the LTM HO; determining that integrity verification using one or more old security keys has failed; or determining that an end marker packet has been received. The one or more old security keys may be associated with the first security context. In some cases, the WTRU may use the first security context (or the second security context) to perform integrity verification and / or decryption on data already in a WTRU buffer (e.g., a PDCP buffer and / or a MAC buffer). After determining that one or more of the conditions are met, the WTRU may send third uplink data encrypted using the second security context.

[0148] At 614, if one or more of the conditions for switching to the new security context are not met, the WTRU may use the old security context for integrity verification and decryption. That is, the WTRU may use the first security context to process the second downlink data. The handover initiated by LTM may have several benefits. In some cases, the WTRU may suppress or limit the re-establishment of the radio resource control (RRC) entity, the packet data convergence protocol (PDCP) entity, and the radio link control (RLC) entity. The WTRU may also suppress or limit the resetting of the medium access control (MAC) entity and the physical layer entity.

[0149] The processes and approaches described herein may be applied in any combination, may be applied to other wireless technologies, and may be used for other services.

[0150] The WTRU may refer to an identity of a physical device, or to an identity of a user, such as a subscription-related identity, for example, an MSISDN, a SIP URI, etc. The WTRU may refer to an application-based identity, such as a user name that may be used for each application.

[0151] The processes described above may be implemented in a computer program, software, and / or firmware incorporated in a computer-readable medium for execution by a computer and / or processor. Examples of computer-readable media include, but are not limited to, electronic signals (sent via wired and / or wireless connections) and / or computer-readable storage media. Examples of computer-readable storage media include, but are not limited to, read-only memory (ROM), random access memory (RAM), registers, cache memory, semiconductor memory devices, magnetic media (such as, but not limited to, built-in hard disks and removable disks), magneto-optical media, and / or optical media (such as CD-ROM disks and / or digital versatile disks (DVDs)). A processor associated with the software may be used to implement a radio frequency transceiver for a WTRU, terminal, base station, RNC, and / or any host computer.

Claims

1. A wireless transmit receive unit (WTRU), the wireless transmit receive unit (WTRU) comprising: A processor, the processor being configured to: processing first downlink data from the source cell using the first security context; receiving configuration information from the source cell, the configuration information indicating one or more candidate cells for layer 1 or layer 2 (L1 / L2) triggered mobility (LTM); receiving, from the source cell, an LTM indication to perform a handover (HO) to a candidate cell among the one or more candidate cells; determining a second security context associated with the candidate cell; processing second downlink data using the first security context; as well as When it is determined that one or more conditions are satisfied, the third downlink data from the candidate cell is processed using the second security context, wherein the conditions include: determining that a certain time has elapsed since receiving the LTM indication to perform the HO; determining that integrity verification using one or more old security keys has failed; or Determine that an end marker packet is received.

2. The WTRU of claim 1, wherein the end marker packet comprises one or more of: a pseudo radio resource control (RRC) message, a packet data convergence protocol (PDCP) control protocol data unit (PDU) including an indication to use the second security context, or a field in a PDCP data PDU header including an indication to use the second security context.

3. The WTRU of claim 1 , wherein the processor is configured to: before receiving the LTM indication to perform the HO, sending first uplink data to the source cell using the first security context; After receiving the LTM indication to perform the HO, sending second uplink data encrypted using the second security context to the candidate cell; as well as After determining that one or more of the conditions are satisfied, third uplink data encrypted using the second security context is sent.

4. The WTRU of claim 1 , wherein the one or more old security keys are associated with the first security context.

5. The WTRU of claim 1 , wherein the processor is configured to use the second security context and refrain from using the first security context upon determining that one or more of the conditions are satisfied.

6. The WTRU of claim 1 , wherein the first security context comprises one or more security keys.

7. The WTRU of claim 1 , wherein determining the second security context comprises: deriving a new key for the candidate cell (KgNB); and calculating one or more integrity protection keys and decryption keys using a physical cell identity (PCI) and a frequency of a primary cell (PCell).

8. The WTRU of claim 7, wherein processing the third downlink data comprises: Integrity verification and decryption are performed using the one or more integrity protection keys and decryption keys associated with the second security context.

9. The WTRU of claim 1, wherein the LTM indication to perform the HO indicates that a special cell (SpCell) associated with the WTRU is to be changed.

10. The WTRU of claim 1 , wherein the processor is further configured to: refraining from performing re-establishment of a radio resource control (RRC) entity, a packet data convergence protocol (PDCP) entity, and a radio link control (RLC) entity; and Suppresses resetting of the Medium Access Control (MAC) entity and the Physical layer entity.

11. A method performed in a wireless transmit receive unit (WTRU), the method comprising: processing first downlink data from the source cell using the first security context; receiving configuration information from the source cell, the configuration information indicating one or more candidate cells for layer 1 or layer 2 (L1 / L2) triggered mobility (LTM); receiving, from the source cell, an LTM indication to perform a handover (HO) to a candidate cell among the one or more candidate cells; determining a second security context associated with the candidate cell; processing second downlink data using the first security context; as well as When it is determined that one or more conditions are satisfied, the third downlink data from the candidate cell is processed using the second security context, wherein the conditions include: determining that a certain time has elapsed since receiving the LTM indication to perform the HO; Determining that integrity verification using one or more old security keys has failed; or Determine that an end marker packet is received.

12. The method of claim 11, wherein the end marker packet comprises one or more of: a pseudo radio resource control (RRC) message, a packet data convergence protocol (PDCP) control protocol data unit (PDU) including an indication to use the second security context, or a field in a PDCP data PDU header including an indication to use the second security context.

13. The method according to claim 11, further comprising: before receiving the LTM indication to perform the HO, sending first uplink data to the source cell using the first security context; After receiving the LTM indication to perform the HO, sending second uplink data encrypted using the second security context to the candidate cell; as well as After determining that one or more of the conditions are satisfied, third uplink data encrypted using the second security context is sent.

14. The method of claim 11, wherein the one or more old security keys are associated with the first security context.

15. The method according to claim 11, further comprising: The second security context is used and use of the first security context is suppressed upon determining that one or more of the conditions are satisfied. The method of claim 11 , wherein the first security context comprises one or more security keys.

17. The method of claim 11, wherein determining the second security context comprises: deriving a new key for the candidate cell (KgNB); and using a physical cell identity (PCI) and a frequency of a primary cell (PCell) to calculate one or more integrity protection keys and decryption keys used by the candidate cell.

18. The method of claim 17, wherein processing the third downlink data comprises: Integrity verification and decryption are performed using the one or more integrity protection keys and decryption keys associated with the second security context.

19. The method of claim 11, wherein the LTM indication to perform the HO indicates that a special cell (SpCell) associated with the WTRU is to be changed.

20. The method according to claim 11, further comprising: refraining from performing re-establishment of a radio resource control (RRC) entity, a packet data convergence protocol (PDCP) entity, and a radio link control (RLC) entity; as well as Suppresses resetting of the Medium Access Control (MAC) entity and the Physical layer entity.

Images