Method and apparatus for dynamically updating routing identifier

Abstract

Systems, methods, apparatuses, and computer program products are provided for dynamically updating routing identifiers (IDs). A method may include determining, at a network node, a routing identifier more for at least one user equipment. The method may then include obtaining or generating a new routing identifier and an authentication vector to be assigned to the at least one user equipment, and sending the new routing identifier to an authentication entity.

Description

[0001] This divisional application is a divisional application of Chinese patent application No. 201980043084.8, filed on June 25, 2019, with the invention name “Method and device for dynamically updating routing identifiers”.

[0002] CROSS-REFERENCE TO RELATED APPLICATIONS:

[0003] This application claims priority to U.S. Provisional Patent Application No. 62 / 690,095, filed on June 26, 2018, the contents of which are incorporated herein by reference in their entirety. Technical Field

[0004] Some example embodiments may generally relate to mobile or wireless telecommunication systems, such as Long Term Evolution (LTE) or fifth generation (5G) radio access technology or new radio (NR) access technology, or other communication systems. For example, certain embodiments may relate to redundant transmission in such systems. Background Art

[0005] Examples of mobile or wireless telecommunication systems may include the Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (UTRAN), Evolved UTRAN (E-UTRAN) of Long Term Evolution (LTE), Advanced LTE (LTE-A), MulteFire, LTE-A Pro and / or fifth generation (5G) radio access technology or new radio (NR) access technology. Fifth generation (5G) or new radio (NR) wireless systems refer to next generation (NG) radio systems and network architectures. It is estimated that NR will provide bit rates of 10-20Gbit / s or higher and will support at least enhanced mobile broadband (eMBB) and ultra-reliable low latency communications (URLLC) and massive machine type communications (mMTC). NR is expected to provide ultra-wideband and ultra-robust, low latency connectivity and large-scale networks to support the Internet of Things (IoT). With the increasing popularity of the Internet of Things and machine-to-machine (M2M) communications, there will be an increasing demand for networks that meet the requirements of low power consumption, low data rates and long battery life. Note that in 5G or NR, a node that can provide radio access functions to a UE (i.e., similar to a Node B in E-UTRAN or an eNB in ​​LTE) may be referred to as a next generation or 5G Node B (gNB). Summary of the invention

[0006] One embodiment may be directed to a method that may include: determining, by a network node, to update a routing ID for at least one UE. Then, the method may include: obtaining or generating a new routing ID to be assigned to the at least one UE. The method may further include: sending the new routing ID to an authentication entity.

[0007] Another embodiment may be directed to an apparatus that may include at least one processor and at least one memory including computer program code. The at least one memory and the computer program code may be configured with the at least one processor to cause the apparatus to at least determine to update a routing ID for at least one UE, obtain a new routing ID to be assigned to the at least one UE, and send the new routing ID to an authentication entity.

[0008] Another embodiment may be directed to a method that may include: receiving, by a network entity, a new routing ID for at least one UE. The method may then include: storing the new routing ID assigned to the at least one UE; encrypting the new routing ID with a specific key; and sending the encrypted new routing ID parameters to a security or access management entity. In one embodiment, the encrypted new routing ID may be sent with an attached integrity signature (MAC-Route ID) to ensure that the content has not been altered during transmission.

[0009] Another embodiment may be directed to an apparatus that may include at least one processor and at least one memory including computer program code. The at least one memory and the computer program code may be configured with the at least one processor to cause the apparatus to at least receive a new routing ID for at least one UE, store the new routing ID assigned to the at least one UE, encrypt the new routing ID using a specific key, and then send the encrypted new routing ID parameters to a security or access management entity. In one embodiment, the encrypted new routing ID may be sent with an attached integrity signature (MAC-Route ID) to ensure that the content has not been altered during transmission.

[0010] Another embodiment may be directed to a method that may include receiving, by a UE from a security or access management entity, an encrypted new routing ID with an attached integrity signature (MAC-routing ID). The method may then include checking the validity of the MAC routing ID using a key derived from the AKA procedure, and if the MAC routing ID is valid, the method may then include decrypting and storing the new routing ID.

[0011] Another embodiment may be directed to an apparatus that may include at least one processor and at least one memory including computer program code. The at least one memory and the computer program code may be configured with the at least one processor to cause the apparatus to at least receive an encrypted new routing ID with an attached integrity signature (MAC-Routing ID) from security or access management. The validity of the MAC-Routing ID is checked using a key derived from an AKA procedure, and if the MAC-Routing ID is valid, the new routing ID is decrypted and stored. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] For a proper understanding of the example embodiments, reference should be made to the accompanying drawings, in which:

[0013] Figure 1 An example of the format of a SUCI is shown;

[0014] Figure 2 illustrates an example signaling diagram of a routing ID update procedure according to certain embodiments;

[0015] Figure 3a An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown;

[0016] Figure 3b An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown;

[0017] Figure 3c An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown;

[0018] Figure 4a An example block diagram of an apparatus according to an embodiment is shown;

[0019] Figure 4b shows an example block diagram of an apparatus according to an embodiment; and

[0020] Figure 4c An example block diagram of an apparatus according to an embodiment is shown. DETAILED DESCRIPTION

[0021] It is readily understood that, as generally described and illustrated in the figures herein, the components of certain example embodiments may be arranged and designed in a variety of different configurations. Therefore, the following detailed description of some example embodiments of systems, methods, devices, and computer program products for dynamically updating routing identifiers (IDs) is not intended to limit the scope of certain embodiments, but rather represents selected example embodiments.

[0022] The features, structures, or characteristics of the example embodiments described throughout the specification may be combined in any suitable manner in one or more example embodiments. For example, throughout the specification, the use of the phrases "certain embodiments," "some embodiments," or other similar language refers to the fact that a particular feature, structure, or characteristic described in conjunction with an embodiment may be included in at least one embodiment. Thus, throughout the specification, the appearance of the phrases "certain embodiments," "in some embodiments," "in other embodiments," or other similar language does not necessarily all refer to the same set of embodiments, and the described features, structures, or characteristics may be combined in any suitable manner in one or more example embodiments.

[0023] In addition, if desired, the different functions or steps discussed below may be performed in different orders and / or simultaneously with each other. In addition, if desired, one or more functions or steps described may be optional or may be combined. Therefore, the following description should be considered as merely an illustration of the principles and teachings of certain example embodiments, rather than a limitation thereof.

[0024] A User Equipment (UE) may provide the network with an encrypted form of its Subscription Permanent Identifier (SUPI), which is called the Subscription Hidden Identifier (SUCI) (this is the UE ID, see 3GPP TS23.501). When the UE provides the network with the SUCI, a method is needed to discover and select an Authentication Server Function (AUSF) and / or Unified Data Management (UDM) instance that has access to the UE's subscriptions, security credentials and SUCI decryption keys in order to decrypt the SUCI and retrieve the UE's security credentials. This is achieved via a Routing Identifier (ID) parameter that is pre-configured on the UE, provided by the UE to the network in an unencrypted manner in the SUCI, and used in the network to determine the appropriate AUSF and / or UDM instance that can initiate UE authentication after having decrypted the SUCI (and therefore has direct access to security-related storage).

[0025] Operators are expected to store routing ID to AUSF group ID and routing ID to UDM group ID mappings in the network, for example, via operations and management (OA&M) in the Network Repository Function (NRF) or during registration of network functions (UDM and / or AUSF) with the NRF. 3GPP standards allow routing IDs and group IDs to change independently of each other. User migration from one AUSF group to another AUSF group, one UDM group to another UDM group, does not require reconfiguration of SUCI in the UE.

[0026] Figure 1 An example of the format of SUCI is shown. Figure 1 As shown, the SUCI may include a mobile country code, a mobile network code, a routing ID, a protection scheme ID, a home network public key ID, and a scheme output.

[0027] If the Routing ID configuration of one or more UEs changes and / or the configuration of the Routing ID <-> Group ID mapping changes, the current assumption is that the mapping in the NRF for Routing ID <-> Group ID will have to be updated. This is fine as long as the configuration is updated for all associated (millions of) UE devices, but this is not optimal if the change in configuration is only for a subset of one or more UEs.

[0028] One requirement of Routing ID is that Routing ID should map to a group of UEs and should not leak the privacy of UEs. Furthermore, using the same Routing ID value risks leaking information about the UE class to the SUCI catcher. Therefore, a mechanism is needed to update the Routing ID for a single UE, a subset of UEs and / or all UEs assigned a given Routing ID. Furthermore, if the Routing ID value provided by the UE is incorrect, there is a risk that the network has to use trial and error to find the UDM, which may require rerouting.

[0029] Furthermore, the current assumption for Routing IDs is that operators are configuring Routing IDs in UEs using Over-the-Air (OTA) or Open Mobile Alliance Device Management (OMA-DM) configuration. This is a suboptimal option as it requires significant manual intervention. First, operators need to know when this configuration is changing; second, operators need to invoke a dedicated configuration method for this purpose.

[0030] In view of the above, one embodiment provides a method for flexibly allocating routing IDs. For example, certain embodiments provide a mechanism to update the routing ID in the UE (as part of the SUCI) as part of a non-access layer (NAS) process occurring with the UE, such as a registration process, an authentication process, and / or a user equipment configuration update. For example, during a registration process, the network may provide a routing ID update in a registration accept message. As another example, during an authentication process, the network may provide a routing ID update in an authentication accept message. As yet another example, during a UE configuration update, the network may provide an updated routing ID as part of a UE configuration update. Note that these options may be combined in any suitable manner.

[0031] In some embodiments, the update of the routing ID may be performed at least in the following situations: (1) the operator changes the routing ID configuration for one or more UEs, (2) the operator changes the routing ID configuration due to a change in the routing ID mapped to the group ID, and / or (3) the UE provides an incorrect routing ID value (i.e., an out-of-sync situation). In other words, one or more of these scenarios may trigger an update to the routing ID.

[0032] Certain embodiments may also provide security for routing ID assignment. Note that the home public land mobile network (HPLMN) assigns a routing ID to a given UE. Therefore, if the UE is roaming when this update is performed, the routing ID should be provided in a secure manner. When the UE is authenticated in the visited public land mobile network (VPLMN), the AUSF (under the control of the HPLMN) stores a copy of the AUSF key (K AUSF) for future use. This key is only known to the AUSF and the UE. An embodiment may use this key directly, or encrypt it using another encryption key derived from this key, and use a separate integrity key to integrity protect the routing ID information sent to the UE. In any of the above processes, the new routing ID from the HPLMN can be included in a container and encrypted in the message sent to the UE. Since the routing ID information protected by a key known only between the UE and the AUSF is proposed in the HPLMN, any tampering of the routing ID assignment by the VPLMN is prevented (i.e., otherwise, if the VPLMN messes up the value, there is a risk that the UE is provided with an incorrect value, so tampering should be prohibited).

[0033] Figure 2 An example signaling or call flow diagram for a routing ID update process performed as part of an authentication process according to some embodiments is shown. Figure 2 As shown in the example of , when the UDM / Authentication Credentials Storage and Processing Function (ARPF) decides to update the routing ID, it obtains or determines the new routing ID and the authentication vector (AV) to be assigned to the UE at 201. The UDM / ARPF can obtain or determine the new routing ID from a configuration file or by any other implementation-specific means.

[0034] continue Figure 2 In an example, at 202, if the UE needs to update the routing ID (when processing a UE authentication attempt), the AUSF may send a new routing ID parameter to the AUSF, for example, in a Nudm_Authentication_Get response message. At 203, the AUSF may store the new routing ID assigned to the UE. If the UE needs to update the routing ID, the AUSF may send the new routing ID parameter to the Security Anchor Function (SEAF) / Access Management Function (AMF), for example, in a Nausf_UEAuthentication_Authenticate response message, at 205. In one embodiment, K AUSF or another key derived specifically for this purpose to encrypt the new routing ID. The encrypted routing ID is in Figure 2 It is represented as “(encrypted new routing ID)K AUSFIn one embodiment, the information sent to SEAF / AMF at 205 may also contain an additional integrity signature (MAC-Route ID) to ensure that the content has not been altered during transmission.

[0035] According to certain embodiments, the SEAF / AMF may send the new routing ID to the UE, for example as part of the authentication process or in any NAS message after authentication is complete, at 206. The UE may then check the validity of the MAC routing ID using the key obtained from the authentication and key agreement (AKA) process at 207, and if the result is positive, the UE decrypts and stores the new routing ID.

[0036] Figure 3a An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown. In some example embodiments, Figure 3a The flowchart may be executed by a network entity or a network node in a 3GPP system such as LTE or 5G NR. For example, in some example embodiments, Figure 3a The method can be executed by the UDM / ARPF entity, such as Figure 2 as shown in the example.

[0037] In one embodiment, Figure 3a The method may include, at 300, deciding to update a routing ID for at least one UE. For example, in some embodiments, deciding 300 may include deciding to update the routing ID when an operator changes the routing ID configuration of one or more UEs, when an operator changes the routing ID configuration due to a change in a routing ID to group ID mapping, and / or when a UE provides an incorrect routing ID value (i.e., an out-of-sync situation). Once it is decided to update the routing ID, the method may include obtaining or generating a new routing ID and an authentication vector (AV) to be assigned to the UE at 310. In one embodiment, obtaining 310 may include obtaining the new routing ID from a configuration file or by any other implementation-specific means. In certain embodiments, the method may further include, at 320, sending a new routing ID parameter to an authentication server or AUSF, for example in an authentication or registration response message.

[0038] Figure 3b An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown. In some example embodiments, Figure 3b The flowchart may be executed by a network entity or a network node in a 3GPP system such as LTE or 5G NR. Figure 2 As shown in the example, Figure 3b The method can be performed by the authentication server or AUSF.

[0039] In one embodiment, Figure 3b The method may include, at 330, receiving a new routing ID parameter for the UE. For example, receiving 330 may include receiving the new routing ID in an authentication or registration response message from the UDM / ARPF. The method may then include storing the new routing ID assigned to the UE at 340. The method may then include storing the new routing ID assigned to the UE at 350 using K AUSF The method may then include, at 360, sending the encrypted new routing ID parameter to SEAF / AMF, for example in an authentication or registration response message. In one embodiment, sending 360 may include sending the information with an additional integrity signature (MAC-Route ID) to SEAF / AMF at 205 to ensure that the content has not been altered during transmission.

[0040] Figure 3c An example flow chart of a method for dynamically updating a routing ID according to an example embodiment is shown. In some example embodiments, Figure 3c The flowchart can be executed by UE, mobile station, mobile device, IoT device, etc.

[0041] In one embodiment, Figure 3c The method may include receiving an encrypted new routing ID with an attached integrity signature (MAC-Route ID) from SEAF at 370. According to some embodiments, receiving 370 may include receiving the new routing ID as part of an authentication or registration process, or in any NAS message after authentication is complete. In one embodiment, the method may then include checking the validity of the MAC routing ID using a key derived from the AKA process at 380. If the MAC routing ID is valid, the method may then include decrypting and storing the new routing ID at 390.

[0042] Figure 4a An example of a device 10 according to an embodiment is shown. In one embodiment, the device 10 may be a node, a host, or a server in a communication network or serving such a network. For example, the device 10 may be a base station, a node B, an evolved node B (eNB), a 5G node B or access point, a next generation node B (NG-NB or gNB), a CU of a gNB, a WLAN access point, a non-3GPP interworking function (such as N3IWF), a serving gateway (SGW), a mobility management entity (MME), a data management entity (such as UDM), and / or an authentication and processing entity (such as ARPF) associated with a radio access network (such as a GSM network, an LTE network, 5G, or NR).

[0043] It should be understood that in some example embodiments, the device 10 may include an edge cloud server as a distributed computing system, where the server and the radio node may be independent devices that communicate with each other via a radio path or via a wired connection, or they may be located in the same entity and communicate via a wired connection. For example, in certain example embodiments where the device 10 represents a gNB, it may be configured in a central unit (CU) and distributed unit (DU) architecture that divides the gNB functionality. In such an architecture, the CU may be a logical node that includes gNB functionality, such as transmission of user data, mobility control, radio access network sharing, positioning and / or session management, etc. The CU may control the operation of the DU via a fronthaul interface. Depending on the functional splitting option, the DU may be a logical node that includes a subset of gNB functionality. It should be noted that a person of ordinary skill in the art will understand that the device 10 may include Figure 4a Components or features not shown.

[0044] like Figure 4a As shown in the example of , the device 10 may include a processor 12 for processing information and executing instructions or operations. The processor 12 may be any type of general-purpose or special-purpose processor. In practice, the processor 12 may include, for example, one or more of a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), and a processor based on a multi-core processor architecture. Although Figure 4a A single processor 12 is shown in the figure, but multiple processors may be utilized according to other embodiments. For example, it should be understood that in some embodiments, the device 10 may include two or more processors that can form a multi-processor system that supports multi-processing (e.g., in this case, the processor 12 may represent a multi-processor). In some embodiments, the multi-processor system may be tightly coupled or loosely coupled (e.g., forming a computer cluster).

[0045] Processor 12 may perform functions associated with the operation of device 10, which may include, for example, precoding of antenna gain / phase parameters, encoding and decoding of individual bits forming communication messages, formatting of information, and overall control of device 10, including processes related to management of communication resources.

[0046] The device 10 may further include or be coupled to a memory 14 (internal or external), which may be coupled to the processor 12 for storing information and instructions that may be executed by the processor 12. The memory 14 may be one or more memories and may be any type of memory suitable for the local application environment and may be implemented using any appropriate volatile or non-volatile data storage technology, such as semiconductor-based storage devices, magnetic storage devices and systems, optical storage devices and systems, fixed memory, and / or removable memory. For example, the memory 14 may be composed of any combination of random access memory (RAM), read-only memory (ROM), static memory such as a magnetic disk or optical disk, a hard disk drive (HDD), or any other type of non-transitory machine or computer readable medium. The instructions stored in the memory 14 may include program instructions or computer program code that, when executed by the processor 12, enables the device 10 to perform the tasks described herein.

[0047] In one embodiment, the device 10 may further include a drive or port, or be coupled to a (internal or external) drive or port, that is configured to accept and read an external computer-readable storage medium, such as an optical disk, a USB drive, a flash drive, or any other storage medium. For example, the external computer-readable storage medium may store a computer program or software executed by the processor 12 and / or the device 10.

[0048] In some embodiments, the device 10 may also include or be coupled to one or more antennas 15 for sending signals and / or data to and receiving signals and / or data from the device 10. The device 10 may further include or be coupled to a transceiver 18 configured to send and receive information. The transceiver 18 may include, for example, a plurality of radio interfaces that may be coupled to the antenna 15. The radio interface may correspond to a variety of radio access technologies, including one or more of GSM, NB-IoT, LTE, 5G, WLAN, Bluetooth, BT-LE, NFC, Radio Frequency Identifier (RFID), Ultra-Wideband (UWB), MulteFire, and the like. The radio interface may include components such as filters, converters (e.g., digital-to-analog converters, etc.), mappers, fast Fourier transform (FFT) modules, and the like to generate symbols for transmission via one or more downlinks and receive symbols (e.g., via an uplink).

[0049] Thus, the transceiver 18 may be configured to modulate information onto a carrier waveform for transmission by the antenna 15, and to demodulate information received via the antenna 15 for further processing by other elements of the device 10. In other embodiments, the transceiver 18 may be capable of directly transmitting and receiving signals or data. Additionally or alternatively, in some embodiments, the device 10 may include input and / or output devices (I / O devices).

[0050] In one embodiment, memory 14 may store software modules that provide functionality when executed by processor 12. These modules may include, for example, an operating system that provides operating system functionality for device 10. Memory may also store one or more functional modules, such as applications or programs, that provide additional functionality for device 10. The components of device 10 may be implemented in hardware or as any suitable combination of hardware and software.

[0051] According to some embodiments, the processor 12 and the memory 14 may be included in or may form part of a processing circuit or a control circuit.Furthermore, in some embodiments, the transceiver 18 may be included in or may form part of a transceiver circuit.

[0052] As used herein, the term "circuitry" may refer to the following: a hardware-only circuit implementation (e.g., analog and / or digital circuitry), a combination of hardware circuitry and software, a combination of analog and / or digital hardware circuitry and software / firmware, any portion of a hardware processor and software (including a digital signal processor) that work together to enable a device (e.g., device 10) to perform various functions, and / or one or more hardware circuits and / or one or more processors or portions thereof that operate using software but that may not be present when the software is not needed for operation. As a further example, as used herein, the term "circuitry" may also cover only an implementation of a hardware circuit or processor (or multiple processors), or a portion of a hardware circuit or processor, and its accompanying software and / or firmware. The term circuitry may also cover, for example, a baseband integrated circuit in a server, cellular network node or device, or other computing or network equipment.

[0053] As described above, in some embodiments, the device 10 may be a network node or a RAN node, such as a data management entity (e.g., UDM) and / or an authentication and processing entity (e.g., ARPF). According to some embodiments, the device 10 may be controlled by the memory 14 and the processor 12 to perform functions associated with any of the embodiments described herein. For example, in some embodiments, the device 10 may be configured to perform one or more processes depicted in any flowchart or signaling diagram described herein, such as Figure 2 The signaling diagram shown in or Figure 3aFor example, in some examples, the device 10 may correspond to or represent Figure 2 In some embodiments, the apparatus 10 may be configured to perform a process for dynamically updating a routing ID.

[0054] In one embodiment, the device 10 may be controlled by the memory 14 and the processor 12 to decide to update the routing ID. For example, in some embodiments, the device 10 may be controlled by the memory 14 and the processor 12 to decide to update the routing ID when the operator changes the routing ID configuration for one or more UEs, when the operator changes the routing ID configuration due to a change in the routing ID to group ID mapping, and / or when the UE provides an incorrect routing ID value (i.e., an out-of-sync situation). Once the decision to update the routing ID is made, the device 10 may be controlled by the memory 14 and the processor 12 to obtain or generate a new routing ID to be assigned to the UE and an authentication vector (AV). In one embodiment, the device 10 may be controlled by the memory 14 and the processor 12 to obtain the new routing ID from a configuration file or by any other implementation-specific means. In certain embodiments, the device 10 may be further controlled by the memory 14 and the processor 12 to send the new routing ID parameter to the authentication server or AUSF, for example in an authentication or registration response message.

[0055] Figure 4b An example of an apparatus 20 according to another example embodiment is shown. In an example embodiment, the apparatus 20 may be a node or server associated with a radio access network (e.g., an LTE network, 5G or NR, or other radio systems that may benefit from equivalent procedures). For example, in some embodiments, the apparatus 20 may include an authentication network node or function, such as an authentication server or function (e.g., AUSF).

[0056] In some example embodiments, the apparatus 20 may include one or more processors, one or more computer-readable storage media (e.g., memory, storage, etc.), one or more radio access components (e.g., modems, transceivers, etc.), and / or a user interface. In some example embodiments, the apparatus 20 may be configured to operate using one or more radio access technologies, such as GSM, LTE, LTE-A, NR, 5G, WLAN, WiFi, NB-IoT, MulteFire, and / or any other radio access technology. It should be noted that a person of ordinary skill in the art will understand that the apparatus 20 may include Figure 4b Components or features not shown.

[0057] like Figure 4bAs shown in the example of , the device 20 may include or be coupled to a processor 22 for processing information and executing instructions or operations. The processor 22 may be any type of general or special purpose processor. In practice, the processor 22 may include a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), and a processor based on a multi-core processor architecture. Although in Figure 4b A single processor 22 is shown in FIG. 1 , but according to other example embodiments, multiple processors may be utilized. For example, it should be understood that in some example embodiments, the apparatus 20 may include two or more processors that may form a multiprocessor system that may support multiprocessing (e.g., in which case the processor 22 may represent a multiprocessor). In some example embodiments, the multiprocessor system may be tightly coupled or loosely coupled (e.g., to form a computer cluster).

[0058] Processor 22 may perform functions associated with the operation of device 20, including, for example, precoding of antenna gain / phase parameters, encoding and decoding of individual bits forming communication messages, formatting of information, and overall control of device 20, including processes related to management of communication resources, as some examples.

[0059] The device 20 may further include or be coupled to a memory 24 (internal or external), which may be coupled to the processor 22 for storing information and instructions that can be executed by the processor 22. The memory 24 may be one or more memories and may be of any type suitable for the local application environment and may be implemented using any appropriate volatile or non-volatile data storage technology, such as semiconductor-based storage devices, magnetic storage devices and systems, optical storage devices and systems, fixed memory, and / or removable memory. For example, the memory 24 may include any combination of random access memory (RAM), read-only memory (ROM), static memory such as a magnetic disk or optical disk, a hard disk drive (HDD), or any other type of non-transitory memory or computer-readable medium. The instructions stored in the memory 24 may include program instructions or computer program code that, when executed by the processor 22, enables the device 20 to perform the tasks described herein.

[0060] In an example embodiment, the device 20 may further include or be coupled to a (internal or external) drive or port configured to accept and read an external computer-readable storage medium, such as an optical disk, a USB drive, a flash drive, or other storage medium. For example, the external computer-readable storage medium may store a computer program or software executed by the processor 22 and / or the device 20.

[0061] In an example embodiment, the apparatus 20 may also include or be coupled to one or more antennas 25 for receiving downlink signals and for transmitting from the apparatus 20 via an uplink. The apparatus 20 may also include a transceiver 28 configured to send and receive information. The transceiver 28 may also include a radio interface (e.g., a modem) coupled to the antenna 25. The radio interface may correspond to a variety of radio access technologies, including one or more of GSM, LTE, LTE-A, 5G, NR, WLAN, NB-IoT, BT-LE, RFID, UWB, etc. The radio interface may include other components, such as filters, converters (e.g., digital-to-analog converters, etc.), symbol demappers, signal shaping components, inverse fast Fourier transform (IFFT) modules, etc., to process symbols carried by the downlink or uplink, such as OFDMA symbols.

[0062] For example, in one example embodiment, the transceiver 28 may be configured to modulate information onto a carrier waveform for transmission by the antenna 25, and demodulate information received via the antenna 25 for further processing by other elements of the device 20. In other example embodiments, the transceiver 28 is capable of directly sending and receiving signals or data. Additionally or alternatively, in some example embodiments, the device 10 may include input and / or output devices (I / O devices). In some examples, the device 20 may further include a user interface, such as a graphical user interface or a touch screen.

[0063] In an example embodiment, the memory 24 stores software modules that provide functionality when executed by the processor 22. These modules may include, for example, an operating system that provides operating system functionality for the device 20. The memory may also store one or more functional modules, such as applications or programs, to provide additional functionality for the device 20. The components of the device 20 may be implemented in hardware or in any suitable combination of hardware and software. According to an example embodiment, the device 20 may optionally be configured to communicate with the device 10 via a wireless or wired communication link 70 according to any radio access technology such as NR. For example, in an example embodiment, the link 70 may represent an Xn interface.

[0064] According to some example embodiments, the processor 22 and the memory 24 may be included in or may form part of a processing circuit or a control circuit. In addition, in some example embodiments, the transceiver 28 may be included in or may form part of a transceiver circuit.

[0065] As described above, according to example embodiments, the apparatus 20 may be a network node or function, such as an authentication server or function. According to some examples, the apparatus 20 may be controlled by the memory 24 and the processor 22 to perform functions associated with the example embodiments described herein. For example, in some example embodiments, the apparatus 20 may be configured to perform one or more of the processes depicted in any of the diagrams or signaling flow diagrams described herein, such as Figure 2 and Figure 3b For example, the apparatus 20 may correspond to Figure 2 In an example embodiment, the apparatus 20 may be configured to perform a process for dynamically updating a routing ID.

[0066] According to certain embodiments, the apparatus 20 may be controlled by the memory 24 and the processor 22 to receive a new routing ID parameter of the UE. For example, the apparatus 20 may be controlled by the memory 24 and the processor 22 to receive a new routing ID in an authentication or registration response message from the UDM / ARPF. In one embodiment, the apparatus 20 may then be controlled by the memory 24 and the processor 22 to store the new routing ID assigned to the UE. According to some embodiments, the apparatus 20 may also be controlled by the memory 24 and the processor 22 to, for example, utilize K AUSF The new routing ID may be encrypted using a key or another key derived specifically for this purpose. In some embodiments, the device 20 may also be controlled by the memory 24 and the processor 22 to send the encrypted new routing ID parameter to the SEAF / AMF, for example, in an authentication or registration response message. In one embodiment, the device 20 may be controlled by the memory 24 and the processor 22 to send this information to the SEAF / AMF with an additional integrity signature (MAC-Route ID) to ensure that the content has not been altered during transmission.

[0067] Figure 4c An example of a device 30 according to another example embodiment is shown. In an example embodiment, the device 30 may be a node or element in a communication network or associated with the network, such as a UE, a mobile equipment (ME), a mobile station, a mobile device, a fixed device, an IoT device, or other device. As described herein, a UE may alternatively be referred to as, for example, a mobile station, a mobile device, a mobile unit, a mobile device, a user equipment, a subscriber station, a wireless terminal, a tablet, a smart phone, an oT device or a NB-IoT device, a connected car, etc. As an example, the apparatus 30 may be implemented in, for example, a wireless handheld device, a wireless plug-in accessory, etc.

[0068] In some example embodiments, the apparatus 30 may include one or more processors, one or more computer-readable storage media (e.g., memory, storage device, etc.), one or more radio access components (e.g., modem, transceiver, etc.), and / or a user interface. In some example embodiments, the apparatus 30 may be configured to operate using one or more radio access technologies, such as GSM, LTE, LTE-A, NR, 5G, WLAN, WiFi, NB-IoT, MulteFire, and / or any other radio access technology. It should be noted that a person of ordinary skill in the art will understand that the apparatus 30 may include Figure 4c Components or features not shown.

[0069] like Figure 4c As shown in the example of , the device 30 may include or be coupled to a processor 32 for processing information and executing instructions or operations. The processor 32 may be any type of general-purpose or special-purpose processor. In practice, the processor 32 may include one or more general-purpose computers, special-purpose computers, microprocessors, digital signal processors (DSPs), field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), and processors based on multi-core processor architectures. Although in Figure 4c A single processor 32 is shown in FIG. 1 , but according to other example embodiments, multiple processors may be utilized. For example, it should be understood that in some example embodiments, apparatus 30 may include two or more processors that may form a multiprocessor system that supports multiprocessing (e.g., in which case processor 32 may represent a multiprocessor). In some example embodiments, the multiprocessor system may be tightly coupled or loosely coupled (e.g., to form a computer cluster).

[0070] Processor 32 may perform functions associated with the operation of device 30, including, as some examples, precoding of antenna gain / phase parameters, encoding and decoding of individual bits that form communication messages, formatting of information, and overall control of device 30, including processes related to management of communication resources.

[0071] The device 30 may further include or be coupled to a memory 34 (internal or external), which may be coupled to the processor 32 for storing information and instructions that may be executed by the processor 32. The memory 34 may be one or more memories and may be any type of memory suitable for the local application environment, and may be implemented using any appropriate volatile or non-volatile data storage technology, such as semiconductor-based storage devices, magnetic storage devices and systems, optical storage devices and systems, fixed memory, and / or removable memory. For example, the memory 34 may include any combination of random access memory (RAM), read-only memory (ROM), static memory such as a magnetic disk or optical disk, a hard disk drive (HDD), or any other type of non-transitory memory or computer-readable medium. The instructions stored in the memory 34 may include program instructions or computer program code, which, when executed by the processor 32, enables the device 30 to perform the tasks described herein.

[0072] In an example embodiment, the device 30 may further include or be coupled to a (internal or external) drive or port configured to accept and read an external computer-readable storage medium, such as an optical disk, a USB drive, a flash drive, or any other storage medium. For example, the external computer-readable storage medium may store a computer program or software executed by the processor 32 and / or the device 30.

[0073] In some example embodiments, the apparatus 30 may also include or be coupled to one or more antennas 35 for receiving downlink signals and transmitting from the apparatus 30 via an uplink. The apparatus 30 may also include a transceiver 38 configured to send and receive information. The transceiver 38 may also include a radio interface (e.g., a modem) coupled to the antenna 35. The radio interface may correspond to a variety of radio access technologies, including one or more of GSM, LTE, LTE-A, 5G, NR, WLAN, NB-IoT, BT-LE, RFID, UWB, etc. The radio interface may include other components, such as filters, converters (e.g., digital-to-analog converters, etc.), symbol demappers, signal shaping components, inverse fast Fourier transform (IFFT) modules, etc., to process symbols carried by the downlink or uplink, such as OFDMA symbols.

[0074] For example, the transceiver 38 may be configured to modulate information onto a carrier waveform for transmission by the antenna 35, and demodulate information received via the antenna 35 for further processing by other elements of the device 30. In other example embodiments, the transceiver 38 may be capable of directly sending and receiving signals or data. Additionally or alternatively, in some example embodiments, the device 30 may include input and / or output devices (I / O devices). In certain example embodiments, the device 30 may further include a user interface, such as a graphical user interface or a touch screen.

[0075] In an example embodiment, the memory 34 stores software modules that provide functionality when executed by the processor 32. These modules may include, for example, an operating system that provides operating system functionality for the device 30. The memory may also store one or more functional modules, such as applications or programs, to provide additional functionality to the device 30. The components of the device 30 may be implemented in hardware, or in any suitable combination of hardware and software. According to an example embodiment, according to any radio access technology, such as NR, the device 30 may optionally be configured to communicate with the device 10 via a wireless or wired communication link 71 and / or communicate with the device 20 via a wireless or wired communication link 72.

[0076] According to some example embodiments, the processor 32 and the memory 34 may be included in or may form part of a processing circuit or a control circuit. In addition, in some example embodiments, the transceiver 38 may be included in or may form part of a transceiver circuit.

[0077] As described above, according to some example embodiments, the apparatus 30 may be, for example, a UE, a mobile device, a mobile station, a ME, an IoT device, and / or a NB-IoT device. According to some example embodiments, the apparatus 30 may be controlled by the memory 34 and the processor 32 to perform functions associated with the example embodiments described herein. For example, in some embodiments, the apparatus 30 may be configured to perform one or more processes depicted in any of the diagrams or signaling flow diagrams described herein, such as Figure 2 and Figure 3c As an example, the device 30 may correspond to Figure 2 One or more UEs are shown.

[0078] According to some embodiments, the device 30 may be controlled by the memory 34 and the processor 32 to receive an encrypted new routing ID and an optional integrity signature (MAC-Route ID) from the SEAF. According to some embodiments, the device 30 may be controlled by the memory 34 and the processor 32 to receive the new routing ID as part of the authentication or registration process or in any NAS message after the authentication is completed. In one embodiment, the device 30 may be controlled by the memory 34 and the processor 32 to check the validity of the MAC routing ID using a key derived from the AKA process. If the MAC routing ID is valid, the device 30 may be controlled by the memory 34 and the processor 32 to decrypt and store the new routing ID.

[0079] Therefore, certain example embodiments provide several technical improvements, enhancements and / or advantages. For example, certain embodiments allow flexible configuration of routing IDs in an operator network. In addition, some example embodiments also provide the ability to seamlessly correct out-of-sync configurations using dynamic signaling, even in situations such as network reconfiguration. In addition, certain embodiments are capable of performing the allocation of routing IDs in a secure, tamper-proof manner. In this way, example embodiments can improve the performance, latency and / or throughput of networks and network nodes including, for example, access points, base stations / eNBs / gNBs, and mobile devices or UEs. Therefore, the use of certain example embodiments results in improved functionality of communication networks and their nodes.

[0080] In some example embodiments, the functionality of any method, process, signaling diagram, algorithm, or flow chart described herein may be implemented by software and / or computer program code or portion of code stored in a memory or other computer readable or tangible medium, and executed by a processor.

[0081] In some example embodiments, an apparatus may include or be associated with at least one software application, module, unit, or entity configured for arithmetic operations or configured as a program or portion thereof (including added or updated software routines) executed by at least one computing processor. Programs, also referred to as program products or computer programs, including software routines, applets, and macros, may be stored in any readable device data storage medium and include program instructions for performing specific tasks.

[0082] A computer program product may include one or more computer executable components that are configured to perform some example embodiments when the program is run. The one or more computer executable components may be at least one software code or a portion thereof. Modifications and configurations required to implement the functions of the example embodiments may be performed as routines, which may be implemented as added or updated software routines. The software routines may be downloaded to a device.

[0083] For example, the software or computer program code or part thereof may be in source code form, object code form or some intermediate form and may be stored in some carrier, distribution medium or computer readable medium. It may be any entity or device capable of carrying the program, for example, such carriers may include recording media, computer memory, read-only memory, optical and / or electrical carrier signals, telecommunication signals and software distribution packages. Depending on the required processing power, the computer program may be executed in a single electronic digital computer or distributed among many computers. The computer readable medium or computer readable storage medium may be a non-transitory medium.

[0084] In other example embodiments, the function may be performed by hardware or circuitry included in a device (e.g., device 10 or device 20 or device 30), such as by using an application specific integrated circuit (ASIC), a programmable gate array (PGA), a field programmable gate array (FPGA), or any other combination of hardware and software. In another example embodiment, the function may be implemented as a signal, a non-tangible means that may be carried by an electromagnetic signal downloaded from the Internet or other network.

[0085] According to example embodiments, an apparatus such as a node, a device or a corresponding component may be configured as a circuit, a computer or a microprocessor, such as a single-chip computer element, or as a chipset, including at least a memory for providing storage capacity for arithmetic operations and an operation processor for performing arithmetic operations.

[0086] Those skilled in the art will readily appreciate that the exemplary embodiments described above may be implemented with steps in a different order and / or hardware elements in a configuration different from that disclosed. Therefore, although some embodiments have been described based on these exemplary preferred embodiments, it is apparent to those skilled in the art that certain modifications, variations, and alternative configurations will be apparent while remaining within the spirit and scope of the exemplary embodiments.

Claims

1. A mobile device, configured to: Receive a new routing identifier with integrity signature from the Access Management Function (AMF), wherein the new routing identifier is received in a non-access stratum (NAS) message after authentication with the mobile network, using a key to check whether the integrity signature is valid; and In case the integrity signature is valid, the new routing identifier is stored.

2. The mobile device of claim 1, wherein the key used for the checking whether the integrity signature is valid is obtained from an Authentication and Key Agreement (AKA) procedure.

3. A mobile device according to any one of claims 1 or 2, wherein the key used for the checking whether the integrity signature is valid is known to the mobile device and a node of a Home Public Land Mobile Network (HPLMN) of the mobile device.

4. The mobile device of any one of claims 1 to 3, wherein the new routing identifier is encrypted, and wherein the mobile device is configured to cryptographically decipher the encrypted new routing identifier if the integrity signature is valid.

5. The mobile device according to any one of claims 1 to 4, Wherein decrypting the encrypted new routing identifier comprises decrypting the encrypted new routing identifier using an encryption key separate from the key used for checking whether the integrity signature is valid.

6. The mobile device of claim 5, wherein the encryption key is known to the device and a node of a Home Public Land Mobile Network (HPLMN) of the device.

7. The mobile device of any one of claims 1 to 6, wherein the new routing identifier is contained within a container.

8. The mobile device of any one of claims 1 to 7, wherein the new routing identifier is assigned by a Home Public Land Mobile Network (HPLMN) of the mobile device.

9. The mobile device according to any one of claims 1 to 8, wherein the new routing identifier indicates an authentication server function (AUSF) and / or unified data management (UDM) instance for decrypting a user hidden identity (SUCI) of the mobile device.

10. A method in a mobile device, comprising: Receive a new routing identifier with integrity signature from the Access Management Function (AMF), wherein the new routing identifier is received in a non-access stratum (NAS) message after authentication with the mobile network, using a key to check whether the integrity signature is valid; and In case the integrity signature is valid, the new routing identifier is stored.

11. The method according to claim 10, The key used for checking whether the integrity signature is valid is obtained from an Authentication and Key Agreement (AKA) process.

12. The method according to claim 10 or 11, wherein the key used for said checking whether the integrity signature is valid is known to the mobile device and a node of a home public land mobile network of the mobile device.

13. The method according to any one of claims 10 to 12, wherein the new routing identifier is encrypted, and The method further comprises decrypting the encrypted new routing identifier if the integrity signature is valid.

14. The method of any one of claims 10 to 13, wherein decrypting the encrypted new routing identifier further comprises decrypting the encrypted new routing identifier using an encryption key separate from the key used for the checking whether the integrity signature is valid.

15. The method of claim 14, wherein the encryption key is known to the device and a node of a Home Public Land Mobile Network (HPLMN) of the device.

16. The method of any one of claims 10 to 15, wherein the new routing identifier is contained within a container.

17. The method of any one of claims 10 to 16, wherein the new routing identifier is assigned by a Home Public Land Mobile Network (HPLMN) of the mobile device.

18. The method according to any one of claims 10 to 17, wherein the new routing identifier indicates an authentication server function (AUSF) and / or unified data management (UDM) instance for decrypting a user concealed identity (SUCI) of the mobile device.

19. A computer readable medium comprising instructions which, when executed by an apparatus, cause the apparatus to perform the method according to any one of claims 10 to 18.

Images