Method and apparatus for dynamically updating routing identifier

Abstract

Systems, methods, apparatuses, and computer program products are provided for dynamically updating routing identifiers (IDs). A method may include determining, at a network node, a routing identifier more for at least one user equipment. The method may then include obtaining or generating a new routing identifier and an authentication vector to be assigned to the at least one user equipment, and sending the new routing identifier to an authentication entity.

Description

[0001] This divisional application is a divisional application of Chinese patent application No. 201980043084.8, filed on June 25, 2019, entitled “Method and Apparatus for Dynamically Updating Routing Identifiers”.

[0002] Cross-reference to related applications:

[0003] This application claims priority to U.S. Provisional Patent Application No. 62 / 690,095, filed on June 26, 2018, the contents of which are incorporated herein by reference in their entirety. Technical Field

[0004] Some example embodiments may generally relate to mobile or wireless telecommunication systems, such as Long Term Evolution (LTE) or fifth generation (5G) radio access technology or new radio (NR) access technology, or other communication systems. For example, certain embodiments may relate to redundant transmission in such systems. Background Art

[0005] Examples of mobile or wireless telecommunications systems may include the Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (UTRAN), Evolved UTRAN (E-UTRAN) of Long Term Evolution (LTE), LTE-Advanced (LTE-A), MulteFire, LTE-A Pro, and / or fifth generation (5G) radio access technology or new radio (NR) access technology. Fifth generation (5G) or new radio (NR) wireless systems refer to next generation (NG) radio systems and network architectures. NR is estimated to offer bit rates of 10-20 Gbit / s or higher and will support at least enhanced mobile broadband (eMBB) and ultra-reliable low latency communications (URLLC), as well as massive machine type communications (mMTC). NR is expected to provide ultra-wideband and ultra-robust, low-latency connectivity, as well as large-scale networks to support the Internet of Things (IoT). As the IoT and machine-to-machine (M2M) communications become increasingly popular, there will be an increasing demand for networks that meet the requirements of low power consumption, low data rates, and long battery life. Note that in 5G or NR, a node that can provide radio access functions to a UE (i.e., similar to a Node B in E-UTRAN or an eNB in ​​LTE) can be referred to as a next-generation or 5G Node B (gNB). Summary of the Invention

[0006] One embodiment may be directed to a method that may include: determining, by a network node, to update a routing ID for at least one UE. The method may then include: obtaining or generating a new routing ID to be assigned to the at least one UE. The method may further include: sending the new routing ID to an authentication entity.

[0007] Another embodiment may be directed to an apparatus that may include at least one processor and at least one memory including computer program code. The at least one memory and the computer program code, together with the at least one processor, may be configured to cause the apparatus to at least determine to update a routing ID for at least one UE, obtain a new routing ID to be assigned to the at least one UE, and send the new routing ID to an authentication entity.

[0008] Another embodiment may be directed to a method that may include: receiving, by a network entity, a new routing ID for at least one UE. The method may then include: storing the new routing ID assigned to the at least one UE; encrypting the new routing ID with a specific key; and sending the encrypted new routing ID parameter to a security or access management entity. In one embodiment, the encrypted new routing ID may be sent with an additional integrity signature (MAC-Route ID) to ensure that the content has not been altered during transmission.

[0009] Another embodiment may be directed to an apparatus that may include at least one processor and at least one memory including computer program code. The at least one memory and the computer program code may be configured, together with the at least one processor, to cause the apparatus to at least receive a new routing ID for at least one UE, store the new routing ID assigned to the at least one UE, encrypt the new routing ID using a specific key, and then send the encrypted new routing ID parameters to a security or access management entity. In one embodiment, the encrypted new routing ID may be sent with an additional integrity signature (MAC-Route ID) to ensure that the content has not been altered during transmission.

[0010] Another embodiment may be directed to a method that may include receiving, by a UE from a security or access management entity, an encrypted new routing ID with an attached integrity signature (MAC-Routing ID). The method may then include checking the validity of the MAC routing ID using a key derived from an AKA procedure, and if the MAC routing ID is valid, the method may then include decrypting and storing the new routing ID.

[0011] Another embodiment may be directed to an apparatus that may include at least one processor and at least one memory including computer program code. The at least one memory and the computer program code, together with the at least one processor, may be configured to cause the apparatus to at least receive an encrypted new routing ID (MAC-Routing ID) with an attached integrity signature from security or access management. The MAC-Routing ID is checked for validity using a key derived from an AKA process, and if the MAC-Routing ID is valid, the new routing ID is decrypted and stored. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] For a proper understanding of the exemplary embodiments, reference should be made to the accompanying drawings, in which:

[0013] Figure 1 An example of the format of SUCI is shown;

[0014] Figure 2 illustrates an example signaling diagram of a routing ID update procedure according to certain embodiments;

[0015] Figure 3a An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown;

[0016] Figure 3b An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown;

[0017] Figure 3c An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown;

[0018] Figure 4a An example block diagram of an apparatus according to an embodiment is shown;

[0019] Figure 4b shows an example block diagram of an apparatus according to an embodiment; and

[0020] Figure 4c An example block diagram of an apparatus according to an embodiment is shown. DETAILED DESCRIPTION

[0021] It will be readily understood that the components of certain example embodiments, as generally described and illustrated in the figures herein, may be arranged and designed in a variety of different configurations. Accordingly, the following detailed description of some example embodiments of systems, methods, apparatus, and computer program products for dynamically updating routing identifiers (IDs) is not intended to limit the scope of certain embodiments, but rather represents selected example embodiments.

[0022] The features, structures, or characteristics of the example embodiments described throughout this specification may be combined in any suitable manner in one or more example embodiments. For example, throughout this specification, the use of the phrases "certain embodiments," "some embodiments," or other similar language refers to the fact that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment. Thus, throughout this specification, the appearance of the phrases "in certain embodiments," "in some embodiments," "in other embodiments," or other similar language does not necessarily all refer to the same set of embodiments, and the described features, structures, or characteristics may be combined in any suitable manner in one or more example embodiments.

[0023] In addition, if desired, the different functions or steps discussed below can be performed in a different order and / or simultaneously with each other. In addition, if desired, one or more functions or steps described can be optional or can be combined. Therefore, the following description should be considered as merely illustrative of the principles and teachings of certain example embodiments, and not as a limitation thereof.

[0024] A user equipment (UE) may provide the network with an encrypted form of its subscription permanent identifier (SUPI), known as the subscription concealed identifier (SUCI) (this is the UE ID, see 3GPP TS 23.501). When the UE provides the SUCI to the network, a method is needed to discover and select an authentication server function (AUSF) and / or unified data management (UDM) instance that has access to the UE's subscription, security credentials, and SUCI decryption keys in order to decrypt the SUCI and retrieve the UE's security credentials. This is achieved via a routing identifier (ID) parameter that is pre-configured on the UE, provided by the UE to the network in an unencrypted form in the SUCI, and used in the network to determine the appropriate AUSF and / or UDM instance that, after having decrypted the SUCI, can initiate UE authentication (and therefore have direct access to security-related storage).

[0025] Operators are expected to store the mapping of routing IDs to AUSF group IDs and routing IDs to UDM group IDs in the network, for example, via operations and management (OA&M) in the Network Repository Function (NRF) or during registration of network functions (UDM and / or AUSF) with the NRF. 3GPP standards allow routing IDs and group IDs to change independently of each other. User migration from one AUSF group to another, or from one UDM group to another, does not require reconfiguration of the SUCI in the UE.

[0026] Figure 1 An example of the format of SUCI is shown. Figure 1 As shown, the SUCI may include a mobile country code, a mobile network code, a routing ID, a protection scheme ID, a home network public key ID, and a scheme output.

[0027] If the Routing ID configuration of one or more UEs changes and / or the configuration of the Routing ID <-> Group ID mapping changes, the current assumption is that the mapping in the NRF for Routing ID <-> Group ID will have to be updated. This is fine as long as the configuration is updated for all associated (millions of) UE devices, but this is not optimal if the change in configuration is only for a subset of one or more UEs.

[0028] One requirement of the Routing ID is that it should map to a group of UEs and should not compromise the privacy of the UEs. Furthermore, using the same Routing ID value risks leaking information about the UE class to the SUCI catcher. Therefore, a mechanism is needed to update the Routing ID for a single UE, a subset of UEs, and / or all UEs assigned a given Routing ID. Furthermore, if the Routing ID value provided by the UE is incorrect, there is a risk that the network must use trial and error to find the UDM, which may require rerouting.

[0029] Furthermore, the current assumption for Routing IDs is that operators are configuring Routing IDs in UEs using over-the-air (OTA) or Open Mobile Alliance Device Management (OMA-DM) provisioning. This is a suboptimal option because it requires significant manual intervention. First, operators need to be aware of when this configuration is changing, and second, they need to invoke a dedicated provisioning method for this purpose.

[0030] In view of the above, one embodiment provides a method for flexibly allocating routing IDs. For example, certain embodiments provide a mechanism to update the routing ID in the UE (as part of the SUCI) as part of a non-access stratum (NAS) procedure occurring with the UE, such as a registration procedure, an authentication procedure, and / or a user equipment configuration update. For example, during a registration procedure, the network may provide a routing ID update in a registration accept message. As another example, during an authentication procedure, the network may provide a routing ID update in an authentication accept message. As yet another example, during a UE configuration update, the network may provide an updated routing ID as part of the UE configuration update. Note that these options may be combined in any suitable manner.

[0031] In some embodiments, an update of the routing ID may be performed in at least the following situations: (1) an operator changes the routing ID configuration for one or more UEs, (2) an operator changes the routing ID configuration due to a change in the routing ID mapped to the group ID, and / or (3) a UE provides an incorrect routing ID value (i.e., an out-of-sync situation). In other words, one or more of these scenarios may trigger an update to the routing ID.

[0032] Certain embodiments may also provide security for Routing ID assignment. Note that the Home Public Land Mobile Network (HPLMN) assigns the Routing ID to a given UE. Therefore, if the UE is roaming when this update is performed, the Routing ID should be provisioned in a secure manner. When the UE is authenticated in a Visited Public Land Mobile Network (VPLMN), the AUSF (under the control of the HPLMN) stores a copy of the AUSF key (K AUSF ) for future use. This key is known only to the AUSF and the UE. One embodiment may use this key directly, or encrypt it using another encryption key derived from it, and integrity-protect the Routing ID information sent to the UE using a separate integrity key. In any of the above procedures, the new Routing ID from the HPLMN may be included in a container and encrypted in the message sent to the UE. Because the Routing ID information is presented in the HPLMN, protected by a key known only between the UE and the AUSF, any tampering with the Routing ID assignment by the VPLMN is prevented (i.e., otherwise, if the VPLMN messes with the value, there is a risk that the UE will be provided with an incorrect value, so tampering should be prohibited).

[0033] Figure 2 An example signaling or call flow diagram for a routing ID update procedure performed as part of an authentication process according to some embodiments is shown. Figure 2 As shown in the example of FIG, when the UDM / Authentication Credentials Storage and Processing Function (ARPF) decides to update the routing ID, it obtains or determines the new routing ID and the authentication vector (AV) to be assigned to the UE at 201. The UDM / ARPF may obtain or determine the new routing ID from a configuration file or by any other implementation-specific means.

[0034] continue Figure 2 For example, at 202, if the UE needs to update the routing ID (when processing the UE authentication attempt), the new routing ID parameter may be sent to the AUSF, for example, in a Nudm_Authentication_Get response message. At 203, the AUSF may store the new routing ID assigned to the UE. If the UE needs to update the routing ID, at 205, the AUSF may send the new routing ID parameter to the Security Anchor Function (SEAF) / Access Management Function (AMF), for example, in a Nausf_UEAuthentication_Authenticate response message. In one embodiment, K AUSF Or another key derived specifically for this purpose to encrypt the new routing ID. The encrypted routing ID is in Figure 2 It is represented as “(encrypted new routing ID)K AUSFIn one embodiment, the information sent to SEAF / AMF at 205 may also contain an additional integrity signature (MAC-Route ID) to ensure that the content has not been changed during transmission.

[0035] According to certain embodiments, the SEAF / AMF may send the new Routing ID to the UE, for example as part of the authentication process or in any NAS message after authentication is complete, at 206. The UE may then check the validity of the MAC Routing ID using the key obtained from the Authentication and Key Agreement (AKA) process at 207, and if the result is positive, the UE decrypts and stores the new Routing ID.

[0036] Figure 3a An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown. In some example embodiments, Figure 3a The flowchart may be executed by a network entity or network node in a 3GPP system such as LTE or 5G NR. For example, in some example embodiments, Figure 3a The method can be executed by the UDM / ARPF entity, such as Figure 2 .

[0037] In one embodiment, Figure 3a The method may include, at 300, deciding to update a routing ID for at least one UE. For example, in some embodiments, deciding 300 may include deciding to update the routing ID when an operator changes the routing ID configuration of one or more UEs, when an operator changes the routing ID configuration due to a change in a routing ID to group ID mapping, and / or when a UE provides an incorrect routing ID value (i.e., an out-of-sync situation). Once the decision to update the routing ID is made, the method may include, at 310, obtaining or generating a new routing ID and an authentication vector (AV) to be assigned to the UE. In one embodiment, obtaining 310 may include obtaining the new routing ID from a configuration file or by any other implementation-specific means. In certain embodiments, the method may further include, at 320, sending a new routing ID parameter to an authentication server or AUSF, for example in an authentication or registration response message.

[0038] Figure 3b An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown. In certain example embodiments, Figure 3b The flowchart may be executed by a network entity or a network node in a 3GPP system such as LTE or 5G NR. Figure 2 As shown in the example, Figure 3b The method can be performed by the authentication server or AUSF.

[0039] In one embodiment, Figure 3b The method may include, at 330, receiving a new routing ID parameter for the UE. For example, receiving 330 may include receiving the new routing ID in an authentication or registration response message from the UDM / ARPF. The method may then include storing the new routing ID assigned to the UE at 340. The method may then include storing the new routing ID assigned to the UE at 350 using K AUSF The method may then include, at 360, sending the encrypted new routing ID parameter to the SEAF / AMF, for example, in an authentication or registration response message. In one embodiment, sending 360 may include, at 205, sending the information with an additional integrity signature (MAC-Route ID) to the SEAF / AMF to ensure that the content has not been altered in transit.

[0040] Figure 3c An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown. In certain example embodiments, Figure 3c The flowchart can be executed by UE, mobile station, mobile device, IoT device, etc.

[0041] In one embodiment, Figure 3c The method may include receiving an encrypted new routing ID with an attached integrity signature (MAC-Route ID) from SEAF at 370. According to some embodiments, receiving 370 may include receiving the new routing ID as part of an authentication or registration process, or in any NAS message after authentication is complete. In one embodiment, the method may then include checking the validity of the MAC routing ID using a key derived from the AKA process at 380. If the MAC routing ID is valid, the method may then include decrypting and storing the new routing ID at 390.

[0042] Figure 4a An example of an apparatus 10 according to an embodiment is shown. In one embodiment, the apparatus 10 may be a node, host, or server in a communication network or serving such a network. For example, the apparatus 10 may be a base station, a node B, an evolved node B (eNB), a 5G node B or access point, a next generation node B (NG-NB or gNB), a CU of a gNB, a WLAN access point, a non-3GPP interworking function (such as N3IWF), a serving gateway (SGW), a mobility management entity (MME), a data management entity (such as UDM), and / or an authentication and processing entity (such as ARPF) associated with a radio access network (such as a GSM network, an LTE network, 5G, or NR).

[0043] It should be understood that in some example embodiments, the device 10 may include an edge cloud server as a distributed computing system, where the server and the radio node may be independent devices that communicate with each other via a radio path or via a wired connection, or they may be located in the same entity and communicate through a wired connection. For example, in certain example embodiments where the device 10 represents a gNB, it may be configured in a central unit (CU) and distributed unit (DU) architecture that divides the gNB functionality. In such an architecture, the CU may be a logical node that includes gNB functionality such as transmission of user data, mobility control, radio access network sharing, positioning and / or session management. The CU may control the operation of the DU via a fronthaul interface. Depending on the functional split option, the DU may be a logical node that includes a subset of the gNB functionality. It should be noted that a person skilled in the art will understand that the device 10 may include Figure 4a Components or features not shown.

[0044] like Figure 4a As shown in the example of FIG, the device 10 may include a processor 12 for processing information and executing instructions or operations. The processor 12 may be any type of general-purpose or special-purpose processor. In practice, the processor 12 may include, for example, one or more of a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), and a processor based on a multi-core processor architecture. Although Figure 4a A single processor 12 is shown in FIG. 1 , but multiple processors may be utilized according to other embodiments. For example, it should be understood that in some embodiments, apparatus 10 may include two or more processors that may form a multiprocessor system that supports multiprocessing (e.g., in which case processor 12 may represent a multiprocessor). In some embodiments, the multiprocessor system may be tightly coupled or loosely coupled (e.g., forming a computer cluster).

[0045] Processor 12 may perform functions associated with the operation of device 10, which may include, for example, precoding of antenna gain / phase parameters, encoding and decoding of individual bits forming communication messages, formatting of information, and overall control of device 10, including processes related to management of communication resources.

[0046] The apparatus 10 may further include or be coupled to a memory 14 (internal or external), which may be coupled to the processor 12 for storing information and instructions that may be executed by the processor 12. The memory 14 may be one or more memories and may be any type of memory suitable for the local application environment and may be implemented using any appropriate volatile or non-volatile data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and / or removable memory. For example, the memory 14 may be comprised of any combination of random access memory (RAM), read-only memory (ROM), static memory such as a magnetic or optical disk, a hard disk drive (HDD), or any other type of non-transitory machine or computer-readable medium. The instructions stored in the memory 14 may include program instructions or computer program code that, when executed by the processor 12, enables the apparatus 10 to perform the tasks described herein.

[0047] In one embodiment, the device 10 may further include a drive or port, or be coupled to a drive or port (internal or external), configured to accept and read an external computer-readable storage medium, such as an optical disc, a USB drive, a flash drive, or any other storage medium. For example, the external computer-readable storage medium may store a computer program or software executed by the processor 12 and / or the device 10.

[0048] In some embodiments, the device 10 may also include or be coupled to one or more antennas 15 for transmitting and receiving signals and / or data to and from the device 10. The device 10 may further include or be coupled to a transceiver 18 configured to transmit and receive information. The transceiver 18 may include, for example, a plurality of radio interfaces that may be coupled to the antennas 15. The radio interfaces may correspond to a variety of radio access technologies, including one or more of GSM, NB-IoT, LTE, 5G, WLAN, Bluetooth, BT-LE, NFC, radio frequency identifier (RFID), ultra-wideband (UWB), MulteFire, and the like. The radio interfaces may include components such as filters, converters (e.g., digital-to-analog converters, etc.), mappers, fast Fourier transform (FFT) modules, and the like to generate symbols for transmission via one or more downlinks and receive symbols (e.g., via an uplink).

[0049] Thus, the transceiver 18 can be configured to modulate information onto a carrier waveform for transmission by the antenna 15, and to demodulate information received via the antenna 15 for further processing by other components of the apparatus 10. In other embodiments, the transceiver 18 may be capable of directly transmitting and receiving signals or data. Additionally or alternatively, in some embodiments, the apparatus 10 may include input and / or output devices (I / O devices).

[0050] In one embodiment, memory 14 may store software modules that provide functionality when executed by processor 12. These modules may include, for example, an operating system that provides operating system functionality for device 10. Memory may also store one or more functional modules, such as applications or programs, that provide additional functionality for device 10. The components of device 10 may be implemented in hardware or as any suitable combination of hardware and software.

[0051] According to some embodiments, the processor 12 and the memory 14 may be included in or may form part of a processing circuit or a control circuit.Furthermore, in some embodiments, the transceiver 18 may be included in or may form part of a transceiver circuit.

[0052] As used herein, the term "circuitry" may refer to the following: a hardware-only circuit implementation (e.g., analog and / or digital circuitry), a combination of hardware circuitry and software, a combination of analog and / or digital hardware circuitry and software / firmware, a hardware processor and any portion of software (including a digital signal processor) that work together to enable a device (e.g., device 10) to perform various functions, and / or one or more hardware circuits and / or one or more processors or portions thereof that use software to operate but that software may not be present when not required for operation. As a further example, as used herein, the term "circuitry" may also cover only an implementation of a hardware circuit or processor (or multiple processors), or a portion of a hardware circuit or processor, and its accompanying software and / or firmware. The term circuitry may also cover, for example, a baseband integrated circuit in a server, cellular network node or device, or other computing or network equipment.

[0053] As described above, in some embodiments, the apparatus 10 may be a network node or a RAN node, such as a data management entity (e.g., UDM) and / or an authentication and processing entity (e.g., ARPF). According to some embodiments, the apparatus 10 may be controlled by the memory 14 and the processor 12 to perform functions associated with any embodiment described herein. For example, in some embodiments, the apparatus 10 may be configured to perform one or more processes depicted in any flowchart or signaling diagram described herein, such as Figure 2 The signaling diagram shown in or Figure 3aFor example, in some examples, the apparatus 10 may correspond to or represent Figure 2 In some embodiments, the apparatus 10 may be configured to perform a process for dynamically updating a routing ID.

[0054] In one embodiment, the device 10 may be controlled by the memory 14 and the processor 12 to decide to update the routing ID. For example, in some embodiments, the device 10 may be controlled by the memory 14 and the processor 12 to decide to update the routing ID when the operator changes the routing ID configuration for one or more UEs, when the operator changes the routing ID configuration due to a change in the routing ID to group ID mapping, and / or when the UE provides an incorrect routing ID value (i.e., an out-of-sync situation). Once the decision to update the routing ID is made, the device 10 may be controlled by the memory 14 and the processor 12 to obtain or generate a new routing ID and an authentication vector (AV) to be assigned to the UE. In one embodiment, the device 10 may be controlled by the memory 14 and the processor 12 to obtain the new routing ID from a configuration file or by any other implementation-specific means. In certain embodiments, the device 10 may be further controlled by the memory 14 and the processor 12 to send the new routing ID parameter to the authentication server or AUSF, for example, in an authentication or registration response message.

[0055] Figure 4b An example of an apparatus 20 according to another example embodiment is shown. In an example embodiment, the apparatus 20 may be a node or server associated with a radio access network (e.g., an LTE network, 5G or NR, or other radio systems that may benefit from equivalent procedures). For example, in some embodiments, the apparatus 20 may include an authentication network node or function, such as an authentication server or function (e.g., AUSF).

[0056] In some example embodiments, the apparatus 20 may include one or more processors, one or more computer-readable storage media (e.g., memory, storage, etc.), one or more radio access components (e.g., modems, transceivers, etc.), and / or a user interface. In some example embodiments, the apparatus 20 may be configured to operate using one or more radio access technologies, such as GSM, LTE, LTE-A, NR, 5G, WLAN, WiFi, NB-IoT, MulteFire, and / or any other radio access technology. It should be noted that persons of ordinary skill in the art will appreciate that the apparatus 20 may include Figure 4b Components or features not shown.

[0057] like Figure 4bAs shown in the example of FIG, the apparatus 20 may include or be coupled to a processor 22 for processing information and executing instructions or operations. The processor 22 may be any type of general-purpose or special-purpose processor. In practice, the processor 22 may include a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), and a processor based on a multi-core processor architecture. Although in Figure 4b A single processor 22 is shown in FIG. 1 , but according to other example embodiments, multiple processors may be utilized. For example, it should be understood that in some example embodiments, apparatus 20 may include two or more processors that may form a multiprocessor system that may support multiprocessing (e.g., in which case processor 22 may represent a multiprocessor). In some example embodiments, the multiprocessor system may be tightly coupled or loosely coupled (e.g., to form a computer cluster).

[0058] Processor 22 may perform functions associated with the operation of device 20, including, for example, precoding of antenna gain / phase parameters, encoding and decoding of individual bits forming communication messages, formatting of information, and overall control of device 20, including processes related to management of communication resources, as some examples.

[0059] The device 20 may further include or be coupled to a memory 24 (internal or external), which may be coupled to the processor 22 for storing information and instructions that can be executed by the processor 22. The memory 24 may be one or more memories and may be of any type suitable for the local application environment and may be implemented using any appropriate volatile or non-volatile data storage technology, such as semiconductor-based storage devices, magnetic storage devices and systems, optical storage devices and systems, fixed memory and / or removable memory. For example, the memory 24 may include any combination of random access memory (RAM), read-only memory (ROM), static memory such as a magnetic disk or optical disk, a hard disk drive (HDD), or any other type of non-transitory memory or computer-readable medium. The instructions stored in the memory 24 may include program instructions or computer program code that, when executed by the processor 22, enables the device 20 to perform the tasks described herein.

[0060] In an example embodiment, the apparatus 20 may further include or be coupled to a (internal or external) drive or port configured to accept and read an external computer-readable storage medium, such as an optical disc, a USB drive, a flash drive, or other storage medium. For example, the external computer-readable storage medium may store a computer program or software executed by the processor 22 and / or the apparatus 20.

[0061] In an example embodiment, the apparatus 20 may further include or be coupled to one or more antennas 25 for receiving downlink signals and for transmitting from the apparatus 20 via an uplink. The apparatus 20 may further include a transceiver 28 configured to transmit and receive information. The transceiver 28 may further include a radio interface (e.g., a modem) coupled to the antenna 25. The radio interface may correspond to a variety of radio access technologies, including one or more of GSM, LTE, LTE-A, 5G, NR, WLAN, NB-IoT, BT-LE, RFID, UWB, etc. The radio interface may include other components, such as filters, converters (e.g., digital-to-analog converters, etc.), symbol demappers, signal shaping components, inverse fast Fourier transform (IFFT) modules, etc., to process symbols carried in the downlink or uplink, such as OFDMA symbols.

[0062] For example, in one example embodiment, transceiver 28 may be configured to modulate information onto a carrier waveform for transmission by antenna 25, and to demodulate information received via antenna 25 for further processing by other components of apparatus 20. In other example embodiments, transceiver 28 may be capable of directly transmitting and receiving signals or data. Additionally or alternatively, in some example embodiments, apparatus 10 may include input and / or output devices (I / O devices). In some examples, apparatus 20 may further include a user interface, such as a graphical user interface or a touch screen.

[0063] In an example embodiment, memory 24 stores software modules that provide functionality when executed by processor 22. These modules may include, for example, an operating system that provides operating system functionality for device 20. Memory may also store one or more functional modules, such as applications or programs, to provide additional functionality for device 20. The components of device 20 may be implemented in hardware or in any suitable combination of hardware and software. According to an example embodiment, device 20 may optionally be configured to communicate with device 10 via a wireless or wired communication link 70 based on any radio access technology, such as NR. For example, in an example embodiment, link 70 may represent an Xn interface.

[0064] According to some example embodiments, the processor 22 and the memory 24 may be included in or may form part of a processing circuit or a control circuit. In addition, in some example embodiments, the transceiver 28 may be included in or may form part of a transceiver circuit.

[0065] As described above, according to example embodiments, apparatus 20 may be a network node or function, such as an authentication server or function. According to some examples, apparatus 20 may be controlled by memory 24 and processor 22 to perform functions associated with example embodiments described herein. For example, in some example embodiments, apparatus 20 may be configured to perform one or more of the processes depicted in any of the figures or signaling flow diagrams described herein, such as Figure 2 and Figure 3b For example, the apparatus 20 may correspond to Figure 2 In an example embodiment, the apparatus 20 may be configured to perform a process for dynamically updating a routing ID.

[0066] According to certain embodiments, the apparatus 20 may be controlled by the memory 24 and the processor 22 to receive a new routing ID parameter for the UE. For example, the apparatus 20 may be controlled by the memory 24 and the processor 22 to receive a new routing ID in an authentication or registration response message from the UDM / ARPF. In one embodiment, the apparatus 20 may then be controlled by the memory 24 and the processor 22 to store the new routing ID assigned to the UE. According to some embodiments, the apparatus 20 may also be controlled by the memory 24 and the processor 22 to, for example, utilize K AUSF The new routing ID is encrypted using a key or another key derived specifically for this purpose. In some embodiments, the apparatus 20 may also be controlled by the memory 24 and processor 22 to send the encrypted new routing ID parameter to the SEAF / AMF, for example, in an authentication or registration response message. In one embodiment, the apparatus 20 may be controlled by the memory 24 and processor 22 to send this information to the SEAF / AMF along with an additional integrity signature (MAC-Route ID) to ensure that the content has not been altered during transmission.

[0067] Figure 4c An example of a device 30 according to another example embodiment is shown. In an example embodiment, the device 30 may be a node or element in a communication network or associated with the network, such as a UE, a mobile equipment (ME), a mobile station, a mobile device, a fixed device, an IoT device, or other device. As described herein, a UE may alternatively be referred to as, for example, a mobile station, a mobile device, a mobile unit, a mobile device, a user equipment, a subscriber station, a wireless terminal, a tablet, a smartphone, an oT device or NB-IoT device, a connected car, etc. As an example, the apparatus 30 may be implemented in, for example, a wireless handheld device, a wireless plug-in accessory, etc.

[0068] In some example embodiments, the apparatus 30 may include one or more processors, one or more computer-readable storage media (e.g., memory, storage, etc.), one or more radio access components (e.g., modems, transceivers, etc.), and / or a user interface. In some example embodiments, the apparatus 30 may be configured to operate using one or more radio access technologies, such as GSM, LTE, LTE-A, NR, 5G, WLAN, WiFi, NB-IoT, MulteFire, and / or any other radio access technology. It should be noted that persons of ordinary skill in the art will appreciate that the apparatus 30 may include Figure 4c Components or features not shown.

[0069] like Figure 4c As shown in the example of FIG, the device 30 may include or be coupled to a processor 32 for processing information and executing instructions or operations. The processor 32 may be any type of general-purpose or special-purpose processor. In practice, the processor 32 may include one or more general-purpose computers, special-purpose computers, microprocessors, digital signal processors (DSPs), field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), and processors based on multi-core processor architectures. Although in Figure 4c A single processor 32 is shown in FIG. 1 , but according to other example embodiments, multiple processors may be utilized. For example, it should be understood that in some example embodiments, apparatus 30 may include two or more processors that may form a multiprocessor system that supports multiprocessing (e.g., in which case processor 32 may represent multiple processors). In some example embodiments, the multiprocessor system may be tightly coupled or loosely coupled (e.g., to form a computer cluster).

[0070] Processor 32 may perform functions associated with the operation of device 30, including, as some examples, precoding of antenna gain / phase parameters, encoding and decoding of individual bits that form communication messages, formatting of information, and overall control of device 30, including processes related to management of communication resources.

[0071] The apparatus 30 may further include or be coupled to a memory 34 (internal or external), which may be coupled to the processor 32 for storing information and instructions that may be executed by the processor 32. The memory 34 may be one or more memories and may be any type of memory suitable for the local application environment and may be implemented using any appropriate volatile or non-volatile data storage technology, such as semiconductor-based storage devices, magnetic storage devices and systems, optical storage devices and systems, fixed memory, and / or removable memory. For example, the memory 34 may include any combination of random access memory (RAM), read-only memory (ROM), static memory such as a magnetic disk or optical disk, a hard disk drive (HDD), or any other type of non-transitory memory or computer-readable medium. The instructions stored in the memory 34 may include program instructions or computer program code that, when executed by the processor 32, enable the apparatus 30 to perform the tasks described herein.

[0072] In an example embodiment, the apparatus 30 may further include or be coupled to a (internal or external) drive or port configured to accept and read an external computer-readable storage medium, such as an optical disc, a USB drive, a flash drive, or any other storage medium. For example, the external computer-readable storage medium may store a computer program or software executed by the processor 32 and / or the apparatus 30.

[0073] In some example embodiments, the apparatus 30 may further include or be coupled to one or more antennas 35 for receiving downlink signals and transmitting them from the apparatus 30 via an uplink. The apparatus 30 may further include a transceiver 38 configured to transmit and receive information. The transceiver 38 may further include a radio interface (e.g., a modem) coupled to the antenna 35. The radio interface may correspond to a variety of radio access technologies, including one or more of GSM, LTE, LTE-A, 5G, NR, WLAN, NB-IoT, BT-LE, RFID, UWB, etc. The radio interface may include other components, such as filters, converters (e.g., digital-to-analog converters, etc.), symbol demappers, signal shaping components, inverse fast Fourier transform (IFFT) modules, etc., to process symbols carried in the downlink or uplink, such as OFDMA symbols.

[0074] For example, the transceiver 38 may be configured to modulate information onto a carrier waveform for transmission by the antenna 35, and to demodulate information received via the antenna 35 for further processing by other elements of the apparatus 30. In other example embodiments, the transceiver 38 may be capable of directly transmitting and receiving signals or data. Additionally or alternatively, in some example embodiments, the apparatus 30 may include input and / or output devices (I / O devices). In certain example embodiments, the apparatus 30 may further include a user interface, such as a graphical user interface or a touch screen.

[0075] In an example embodiment, memory 34 stores software modules that provide functionality when executed by processor 32. These modules may include, for example, an operating system that provides operating system functionality for device 30. Memory may also store one or more functional modules, such as applications or programs, to provide additional functionality for device 30. Components of device 30 may be implemented in hardware, or in any suitable combination of hardware and software. According to an example embodiment, device 30 may optionally be configured to communicate with device 10 via a wireless or wired communication link 71 and / or with device 20 via a wireless or wired communication link 72, based on any radio access technology, such as NR.

[0076] According to some example embodiments, the processor 32 and the memory 34 may be included in or may form part of a processing circuit or a control circuit. In addition, in some example embodiments, the transceiver 38 may be included in or may form part of a transceiver circuit.

[0077] As described above, according to some example embodiments, the apparatus 30 may be, for example, a UE, a mobile device, a mobile station, a ME, an IoT device, and / or an NB-IoT device. According to some example embodiments, the apparatus 30 may be controlled by the memory 34 and the processor 32 to perform functions associated with the example embodiments described herein. For example, in some embodiments, the apparatus 30 may be configured to perform one or more processes depicted in any of the figures or signaling flow diagrams described herein, such as Figure 2 and Figure 3c As an example, the device 30 may correspond to Figure 2 One or more UEs are shown.

[0078] According to certain embodiments, the apparatus 30 may be controlled by the memory 34 and the processor 32 to receive an encrypted new routing ID and an optional integrity signature (MAC-Route ID) from the SEAF. According to some embodiments, the apparatus 30 may be controlled by the memory 34 and the processor 32 to receive the new routing ID as part of the authentication or registration process, or in any NAS message after authentication is complete. In one embodiment, the apparatus 30 may be controlled by the memory 34 and the processor 32 to check the validity of the MAC-Route ID using a key derived from the AKA process. If the MAC-Route ID is valid, the apparatus 30 may be controlled by the memory 34 and the processor 32 to decrypt and store the new routing ID.

[0079] Thus, certain example embodiments provide several technical improvements, enhancements, and / or advantages. For example, certain embodiments allow for flexible configuration of routing IDs within a carrier network. Additionally, certain example embodiments provide the ability to seamlessly correct out-of-sync configurations using dynamic signaling, even in situations such as network reconfiguration. Furthermore, certain embodiments can perform routing ID assignment in a secure, tamper-proof manner. Thus, example embodiments can improve the performance, latency, and / or throughput of networks and network nodes, including, for example, access points, base stations / eNBs / gNBs, and mobile devices or UEs. Consequently, use of certain example embodiments results in improved functionality of communication networks and their nodes.

[0080] In some example embodiments, the functionality of any method, process, signaling diagram, algorithm, or flow chart described herein may be implemented by software and / or computer program code or portions of code stored in a memory or other computer-readable or tangible medium, and executed by a processor.

[0081] In some example embodiments, an apparatus may include or be associated with at least one software application, module, unit, or entity configured to perform arithmetic operations or configured as a program or portion thereof (including added or updated software routines) executed by at least one computing processor. A program, also referred to as a program product or computer program, including software routines, applets, and macros, may be stored in any readable device data storage medium and includes program instructions for performing specific tasks.

[0082] A computer program product may include one or more computer-executable components that, when executed, are configured to implement some exemplary embodiments. The one or more computer-executable components may be at least one software code or a portion thereof. Modifications and configurations required to implement the functionality of the exemplary embodiments may be performed as routines, which may be implemented as added or updated software routines. The software routines may be downloaded to a device.

[0083] For example, software or computer program code, or portions thereof, may be in source code form, object code form, or some intermediate form, and may be stored on some carrier, distribution medium, or computer-readable medium. This may be any entity or device capable of carrying the program, including, for example, recording media, computer memory, read-only memory, optical and / or electrical carrier signals, telecommunications signals, and software distribution packages. Depending on the required processing power, a computer program may be executed on a single electronic digital computer or distributed across many computers. A computer-readable medium or computer-readable storage medium may be non-transitory.

[0084] In other example embodiments, the functionality may be performed by hardware or circuitry included in a device (e.g., device 10 or device 20 or device 30), such as by using an application specific integrated circuit (ASIC), a programmable gate array (PGA), a field programmable gate array (FPGA), or any other combination of hardware and software. In another example embodiment, the functionality may be implemented as a signal, a non-tangible means that may be carried by an electromagnetic signal downloaded from the Internet or other network.

[0085] According to example embodiments, an apparatus such as a node, a device or a corresponding component may be configured as a circuit, a computer or a microprocessor, such as a single-chip computer element, or as a chipset, including at least a memory for providing storage capacity for arithmetic operations and an operation processor for performing arithmetic operations.

[0086] Those skilled in the art will readily appreciate that the exemplary embodiments described above may be implemented with steps in a different order and / or hardware components in a configuration different from that disclosed. Therefore, although some embodiments have been described based on these exemplary preferred embodiments, it will be apparent to those skilled in the art that certain modifications, variations, and alternative configurations will be apparent while remaining within the spirit and scope of the exemplary embodiments.

Claims

1. A mobile device, configured to: Receive a new routing identifier with integrity signature from the Access Management Function (AMF), wherein the new routing identifier is received in a non-access stratum (NAS) message after authentication with the mobile network, and wherein the new routing identifier indicates an authentication server function (AUSF) and / or unified data management (UDM) instance for decrypting a user concealed identity (SUCI) of the mobile device; using a key to check whether the integrity signature is valid; and In case the integrity signature is valid, the new routing identifier is stored.

2. The mobile device of claim 1, wherein the key used for the checking whether the integrity signature is valid is obtained from an Authentication and Key Agreement (AKA) procedure.

3. A mobile device according to any one of claims 1 or 2, wherein the key used for the checking whether the integrity signature is valid is known to the mobile device and a node of a Home Public Land Mobile Network (HPLMN) of the mobile device.

4. The mobile device of any one of claims 1 to 3, wherein the new routing identifier is encrypted, and wherein the mobile device is configured to cryptographically decipher the encrypted new routing identifier if the integrity signature is valid.

5. The mobile device according to any one of claims 1 to 4, Wherein decrypting the encrypted new routing identifier comprises decrypting the encrypted new routing identifier using an encryption key separate from the key used for checking whether the integrity signature is valid.

6. The mobile device of claim 5, wherein the encryption key is known to the device and a node of a Home Public Land Mobile Network (HPLMN) of the device.

7. The mobile device of any one of claims 1 to 6, wherein the new routing identifier is contained within a container.

8. The mobile device of any one of claims 1 to 7, wherein the new routing identifier is assigned by a Home Public Land Mobile Network (HPLMN) of the mobile device.

9. A method in a mobile device, comprising: Receive a new routing identifier with integrity signature from the Access Management Function (AMF), wherein the new routing identifier is received in a non-access stratum (NAS) message after authentication with the mobile network, and wherein the new routing identifier indicates an authentication server function (AUSF) and / or unified data management (UDM) instance for decrypting a user concealed identity (SUCI) of the mobile device; using a key to check whether the integrity signature is valid; and In case the integrity signature is valid, the new routing identifier is stored.

10. The method according to claim 9, The key used for checking whether the integrity signature is valid is obtained from an Authentication and Key Agreement (AKA) process.

11. The method according to claim 9 or 10, wherein the key used for said checking whether the integrity signature is valid is known to the mobile device and a node of a home public land mobile network of the mobile device.

12. The method according to any one of claims 9 to 11, wherein the new routing identifier is encrypted, and The method further comprises decrypting the encrypted new routing identifier if the integrity signature is valid.

13. The method of any one of claims 9 to 12, wherein decrypting the encrypted new routing identifier further comprises decrypting the encrypted new routing identifier using an encryption key separate from the key used for the checking whether the integrity signature is valid.

14. The method of claim 13, wherein the encryption key is known to the device and a node of a Home Public Land Mobile Network (HPLMN) of the device.

15. The method of any one of claims 9 to 14, wherein the new routing identifier is contained within a container.

16. The method of any one of claims 9 to 15, wherein the new routing identifier is assigned by a Home Public Land Mobile Network (HPLMN) of the mobile device.

17. A computer readable medium comprising instructions which, when executed by an apparatus, cause the apparatus to perform the method according to any one of claims 9 to 16.

Images