Network node, communication system, and communication method

Abstract

A network node is provided with: a control unit which, in order to establish a secure communication path between another network node and a terminal, controls the network node so as to have different values for each type or network slice to which the other network node belongs on the basis of information indicating the type of the other network node or the network slice to which the other network node belongs, thereby establishing a secure communication path between the other network node and the terminal; generating a key for use in the other network node; and a transmission unit that transmits a message including the key to the other network node.

Description

Technical Field

[0001] The present invention relates to a network node, a communication system and a communication method in a wireless communication system. Background Art

[0002] In NR (New Radio) (also called "5G"), which is the successor system to LTE (Long Term Evolution), the network architecture including 5GC (5G Core Network) corresponding to the core network in the network architecture of LTE (Long Term Evolution), namely EPC (Evolved Packet Core), and NG-RAN (Next Generation-Radio Access Network) corresponding to RAN (Radio Access Network) in the network architecture of LTE, namely E-UTRAN (Evolved Universal Terrestrial Radio Access Network) is studied (for example, non-patent document 1 and non-patent document 2).

[0003] In addition, the specifications of 6G, which is the successor system of NR, are being studied. For example, in 6G, a structure for localizing or shortening the transmission path of NAS (Non-Access Stratum) signals is being studied (for example, Non-Patent Document 3).

[0004] Prior art literature

[0005] Non-patent literature

[0006] Non-patent document 1: 3GPP TS23.501V17.5.0 (2022-06)

[0007] Non-patent document 2: 3GPP TS23.502V17.5.0 (2022-06)

[0008] Non-patent document 3: Next G Alliance Report: 6G Technologies, June 2022, Internet <URL: https: / / www.nextgalliance.org / wp-content / uploads / dlm_uploads / 2022 / 07 / TWG-report-6G-technologies.pdf> Summary of the invention

[0009] Problems to be solved by the invention

[0010] In order to localize or shorten the transmission path of the NAS signal, for example, the following structure is considered: the RAN terminates the NAS signal that has a transmission function, and at the same time functions as an endpoint of the communication that guarantees the privacy and integrity protection of the entire NAS signal. However, in this case, there is a problem that the security guarantee in the communication between the RAN and the core network is insufficient for NAS signals other than the NAS signal that has a transmission function. As such, in the prior art, there is a problem that the transmission path of the NAS signal cannot be localized or shortened while ensuring security.

[0011] The present invention has been made in view of the above-mentioned problems, and an object of the present invention is to ensure security and localize or shorten the transmission path of the NAS signal.

[0012] Means for solving problems

[0013] According to the disclosed technology, a network node is provided, which comprises: a control unit, which generates a key used in the other network node based on information indicating the type of the other network node or the network slice to which the other network node belongs, in order to establish a secure communication path between the other network node and a terminal, in a manner that becomes a different value according to the type or the network slice; and a sending unit, which sends a message containing the key to the other network node.

[0014] Effects of the Invention

[0015] According to the disclosed technology, a technology capable of localizing or shortening the transmission path of a NAS signal while ensuring security is provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a diagram for explaining a wireless communication system involved in an embodiment of the present invention.

[0017] Figure 2 This is a diagram showing an example of a configuration of a wireless communication system according to an embodiment of the present invention.

[0018] Figure 3 This is a diagram for explaining a conventional NAS signal transmission path.

[0019] Figure 4 This is a diagram for explaining a structure for dispersing endpoints of a NAS signal.

[0020] Figure 5 This is a sequence diagram showing an example of the flow of the PDU session establishment process involved in Example 1 of the implementation method of the present invention.

[0021] Figure 6 This is a sequence diagram showing an example of the flow of a position information acquisition process according to Example 2 of the embodiment of the present invention.

[0022] Figure 7 This is a sequence diagram showing an example of the flow of the terminal policy setting process according to Example 3 of the embodiment of the present invention.

[0023] Figure 8 This is a diagram showing an example of a functional configuration of a base station according to an embodiment of the present invention.

[0024] Fig. 9 This is a diagram showing an example of a functional configuration of a terminal according to an embodiment of the present invention.

[0025] Fig.10 This is a diagram showing an example of a hardware configuration of a base station or a terminal according to an embodiment of the present invention.

[0026] Fig.11 It is a diagram showing an example of the structure of a vehicle according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In addition, the embodiment described below is only an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0028] In the operation of the wireless communication system of the embodiment of the present invention, existing technologies can be appropriately used. The existing technologies are, for example, existing NR or LTE, but are not limited to existing NR or LTE. In addition, unless otherwise specified, the term "LTE" used in this specification has a broad meaning including LTE-Advanced and subsequent methods (for example: NR).

[0029] In addition, in the embodiments of the present invention described below, the terms SS (Synchronization Signal), PSS (Primary SS), SSS (Secondary SS), PBCH (Physical broadcast channel), PRACH (Physical random access channel), PDCCH (Physical Downlink Control Channel), PDSCH (Physical Downlink Shared Channel), PUCCH (Physical Uplink Control Channel), PUSCH (Physical Uplink Shared Channel), etc. used in the existing LTE are used. These are for the convenience of recording, and the same signals, functions, etc. may also be referred to by other names. In addition, the above terms in NR correspond to NR-SS, NR-PSS, NR-SSS, NR-PBCH, NR-PRACH, etc. However, even signals used for NR are not necessarily clearly recorded as "NR-".

[0030] Furthermore, in the embodiments of the present invention, the duplexing method may be a TDD (Time Division Duplex) method, an FDD (Frequency Division Duplex) method, or other methods (for example, Flexible Duplex, etc.).

[0031] Furthermore, in the embodiments of the present invention, “configuring” wireless parameters and the like may be pre-configuring predetermined values, or may be configuring wireless parameters notified from a base station or a terminal.

[0032] (System Structure)

[0033] Figure 1 It is a diagram for explaining a wireless communication system involved in an embodiment of the present invention.

[0034] like Figure 1 As shown, the wireless communication system involved in the embodiment of the present invention includes a base station 10 and a terminal 20. Figure 1Although one base station 10 and one terminal 20 are shown in each figure, this is only an example and there may be a plurality of base stations 10 and a plurality of terminals 20.

[0035] The base station 10 is a communication device that provides one or more cells and performs wireless communication with the terminal 20. The physical resources of the wireless signal are defined by the time domain and the frequency domain. The time domain can be defined by the number of OFDM (Orthogonal Frequency Division Multiplexing) symbols, and the frequency domain can be defined by the number of subcarriers or resource blocks. In addition, the TTI (Transmission Time Interval) in the time domain can be a time slot, and the TTI can be a subframe.

[0036] The base station 10 sends a synchronization signal and system information to the terminal 20. The synchronization signal is, for example, NR-PSS and NR-SSS. The system information is, for example, sent via NR-PBCH, also called broadcast information. The synchronization signal and system information may also be referred to as SSB (SS / PBCH block). Figure 1 As shown, the base station 10 sends a control signal or data to the terminal 20 via DL (Downlink), and receives a control signal or data from the terminal 20 via UL (Uplink). Both the base station 10 and the terminal 20 can perform beamforming to send and receive signals. In addition, both the base station 10 and the terminal 20 can apply MIMO (Multiple Input Multiple Output)-based communications to DL or UL. In addition, the base station 10 and the terminal 20 can also communicate via a secondary cell (SCell: Secondary Cell) and a primary cell (PCell: Primary Cell) based on CA (Carrier Aggregation). Furthermore, the terminal 20 can also communicate via the primary cell of the base station 10 based on DC (Dual Connectivity) and the primary and secondary cell group cells (PSCell: Primary SCG Cell) of other base stations 10.

[0037] The terminal 20 is a communication device having a wireless communication function, such as a smart phone, a mobile phone, a tablet computer, a wearable terminal, or an M2M (Machine-to-Machine) communication module. Figure 1As shown, the terminal 20 receives a control signal or data from the base station 10 via DL and sends a control signal or data to the base station 10 via UL, thereby utilizing various communication services provided by the wireless communication system. In addition, the terminal 20 receives various reference signals sent from the base station 10 and performs a measurement of the propagation path quality based on the reception result of the reference signal. In addition, the terminal 20 may also be referred to as a UE and the base station 10 may also be referred to as a gNB.

[0038] Figure 2 1 is a diagram showing an example of a configuration of a wireless communication system according to an embodiment of the present invention. The wireless communication system includes a RAN 10 , a terminal 20 , a core network 30 , and a DN (Data Network) 40 .

[0039] The core network 30 is a network including switches, a subscriber information management device, etc. The core network 30 includes a network node group that realizes the U-Plane function and a network node group that realizes the C-Plane function group.

[0040] The U-Plane function is a function that performs the sending and receiving processing of user data. A network node that implements the U-Plane function is, for example, UPF (User plane function) 380. UPF380 is a network node that has functions such as an external PDU (Protocol Data Unit) session point for interconnection with DN40, routing and forwarding of packets, and QoS (Quality of Service) processing of the user plane. UPF380 controls the sending and receiving of data between DN40 and terminal 20. UPF380 and DN40 can be composed of one or more network slices.

[0041] The C-Plane function group is a function group that performs a series of control processes for establishing communication, etc. The network node group that realizes the C-Plane function group includes, for example, CAMF (Compact Access and Mobility Management Function) 310, UDM (Unified Data Management) 320, NEF (Network Exposure Function) 330, NRF (Network Repository Function) 340, AUSF (Authentication Server Function) 350, PCF (Policy Control Function) 360, SMF (Session Management Function) 370, AF (Application Function) 390, and LMF (Location Management Function) 391.

[0042] CAMF310 is an AF that omits a part of the functions of the existing AMF (Access and Mobility Management Function). The existing AMF is a network node that has functions such as termination of the RAN interface, termination of the NAS (Non-Access Stratum) that assumes the transmission function, registration management, connection management, reachability management, and mobility management. In contrast, CAMF310 is a network node that omits the functions of termination of the RAN interface and termination of the NAS that assumes the transmission function, and is a network node that has functions such as registration management, connection management, reachability management, and mobility management.

[0043] NRF340 is a network node having a function of discovering NF (Network Function) instances that provide services. UDM320 is a network node that manages subscriber data and authentication data. UDM320 includes UDR (User Data Repository) 321 and FE (Front End) 322 that hold the data. FE322 processes subscriber information.

[0044] SMF370 is a network node with functions such as session management, IP (Internet Protocol) address allocation and management of the terminal 20, DHCP (Dynamic Host Configuration Protocol) function, ARP (Address Resolution Protocol) proxy, roaming function, etc. NEF330 is a network node with the function of notifying other NFs (Network Functions) of capabilities and events.

[0045] The PCF 360 is a network node having a function of performing policy control of the network. The PCF 360 may include a UE-PCF 361 . The UE-PCF 361 is a network node having a function of performing policy control of the terminal 20 .

[0046] AF (Application Function) 390 is a network node having a function of controlling an application server.

[0047] The LMF 391 is a network node having a function of managing adjustment and scheduling of resources required for measurement of the position of the terminal 20 that registers or accesses the core network 30 .

[0048] AMF 310 and RAN 10 are communicably connected as an N2 link. UPF 380 and RAN 10 are communicably connected as an N3 link. UPF 380 and SMF 370 are communicably connected as an N4 link. UPF 380 and DN 40 are communicably connected as an N6 link.

[0049] (Past Problems)

[0050] Next, the conventional problems are described. Conventionally, AMF has the function of being an endpoint of a NAS signal that guarantees confidentiality and integrity protection.

[0051] Figure 3 This is a diagram for explaining a conventional NAS signal transmission path. Figure 3 The NFa shown is equivalent to the AMF. NFa functions as an endpoint of the NAS-a signal in the communication with the terminal. Each network node (NFb, NFc or NFx) other than NFa realizes the communication of the NAS-b signal, NAS-c signal or NAS-x signal with the terminal on the layer established by the NAS-a signal.

[0052] In order to localize or shorten the transmission path of the NAS signal, for example, the following structure is considered: the RAN that performs the transmission function terminates the NAS signal and functions as an endpoint of the communication that guarantees the privacy and integrity protection of the entire NAS signal. However, in this case, there is a problem that the security guarantee in the communication between the RAN and the core network is insufficient for NAS signals other than the NAS signal that performs the transmission function.

[0053] Therefore, Non-Patent Document 3 discloses a structure in which each NF that terminates various NAS signals from a terminal functions as an endpoint of communication that ensures concealment and integrity protection of the NAS signal.

[0054] Figure 4 This is a diagram for explaining a structure in which the endpoints of NAS signals are dispersed. Each network node (NFa, NFb, NFc or NFx) functions as an endpoint of communication that guarantees the confidentiality and integrity protection of NAS-a signals, NAS-b signals, NAS-c signals or NAS-x signals. At this time, confidentiality and integrity protection of NAS-a signals, NAS-b signals, NAS-c signals or NAS-x signals are realized separately between a terminal and NFa, between a terminal and NFb, between a terminal and NFc or between a terminal and NFx.

[0055] However, no previous studies have achieved Figure 4 The specific method of such a structure.

[0056] (Overview of this embodiment)

[0057] In order to solve the above-mentioned conventional problems, in this embodiment, an example is described in which each network node functions as an endpoint of an independent NAS signal.

[0058] For example, CAMF 310 (first network node) managing KAMF uses a calculation algorithm shared in advance with the terminal 20 to derive a key (Knfy_a) used by NF-Y (second network node) of network slice A from KAMF. This calculation algorithm makes the value of the key different for the purpose of minimizing the damage in the event of key leakage, so the network slice name (e.g., network slice A or network slice B), NF type name (e.g., NF-Y or NF-Z), etc. may be included in the input parameters. That is, CAMF 310 generates the key (Knfy_a) in a manner that the value becomes different according to the network slice name or NF type name.

[0059] In addition, the information specifying DN40 (for example, DNN (Data Network Name)) can be used as an input parameter instead of or in addition to the network slice.

[0060] CAMF 310 distributes to each NF-Y each key and information indicating terminal security capabilities previously acquired from terminal 20. CAMF 310 may distribute information indicating terminal security capabilities based on a request (ie, security information acquisition request) from NF-Y.

[0061] Each NF-Y starts the security mode indication process to the terminal 20, and establishes a communication path that is concealed and integrity protected with the terminal 20. At this time, each NF-Y uses the concealed and integrity protected communication path between the terminal 20 and the CAMF 310 before the concealed and integrity protected communication path between the terminal 20 and itself is established, for example, during the security mode indication process.

[0062] Next, the operation of the communication system of this embodiment will be described. Hereinafter, as specific examples, Examples 1 to 3 will be described.

[0063] (Example 1)

[0064] In this embodiment, an example of establishing a PDU session between SMF370 and terminal 20 is described.

[0065] Figure 5 This is a sequence diagram showing an example of the flow of the PDU session establishment process according to Example 1 of the embodiment of the present invention. It is assumed that the terminal 20 has completed the initial registration process.

[0066] CAMF 310 stores information indicating the security capability of terminal 20 and key Kamf. In addition, the communication between terminal 20 and CAMF 310 is kept private and integrity protected.

[0067] In order to establish a PDU session in the network slice of S-NSSAI=A, the terminal 20 sends a message indicating a PDU session establishment request to the RAN 10 (step S101). Here, the message terminated by the RAN 10 including the PDU session establishment request includes information indicating whether there is a security establishment request (e.g., "there is a security establishment request") and information specifying the network slice name (e.g., "S-NSSAI=A").

[0068] RAN10 refers to the information indicating whether there is a security establishment request (e.g., "there is a security establishment request") and transmits a message indicating a PDU session establishment request to CAMF310 (step S102). The message terminated by CAMF310 including the PDU session establishment request includes information indicating whether there is a security establishment request (e.g., "there is a security establishment request") and information specifying a network slice name (e.g., "S-NSSAI=A").

[0069] In order to accommodate the SMF370 of the network slice specified by the information specifying the network slice name (e.g., "S-NSSAI=A"), CAMF310 generates a key Ksmf_a based on the key Kamf. Here, information indicating the type of the network node (e.g., "NF type=SMF") and information specifying the network slice (e.g., "S-NSSAI=A") are included in the input of the key derivation function.

[0070] CAMF310 transmits a message indicating a PDU session establishment request to SMF370 (step S103). Here, the message terminated by SMF370 including the PDU session establishment request includes information indicating the security capability of the terminal 20, the key Ksmf_a, information indicating whether there is a security establishment request (e.g., "there is a security establishment request"), and information specifying the network slice name (e.g., "S-NSSAI=A").

[0071] The SMF 370 generates a confidentiality key Ksmf_a_nas_enc and an integrity protection key Ksmf_a_nas_int based on the key Ksmf_a. Then, the SMF 370 transmits a message indicating a security mode instruction to the terminal 20 via the CAMF 310 (step S104).

[0072] The terminal 20 generates the encryption key Ksmf_a_nas_enc and the integrity protection key Ksmf_a_nas_int using a calculation algorithm shared in advance.

[0073] Next, the terminal 20 sends a message indicating that the security mode is completed to the SMF 370 via the CAMF 310 (step S105). The message between the terminal 20 and the RAN 10 indicating that the security mode is completed includes information indicating that the security mode is completed. In addition, the message between the RAN 10 and the CAMF 310 and the message between the CAMF 310 and the SMF 370 include information indicating the endpoint on the RAN side.

[0074] The SMF 370 transmits a message indicating the acceptance of the PDU session establishment to the RAN 10 (RAN-side endpoint) without passing through the CAMF 310 (step S106 ).

[0075] Subsequent communications between the terminal 20 and the SMF 370 do not go through the CAMF 310 .

[0076] According to this embodiment, when establishing a PDU session with the terminal 20, the SMF 370 functions as a communication endpoint that guarantees concealment and integrity protection of NAS signals. This makes it possible to localize or shorten the transmission path of NAS signals while ensuring security.

[0077] (Example 2)

[0078] In this embodiment, an example of communication between LMF391 and terminal 20 for obtaining position information is described.

[0079] Figure 6 This is a sequence diagram showing an example of the flow of the position information acquisition process according to Example 2 of the embodiment of the present invention. It is assumed that the terminal 20 has completed the initial registration process.

[0080] CAMF 310 stores information indicating the security capability of terminal 20 and key Kamf. In addition, the communication between terminal 20 and CAMF 310 is kept private and integrity protected.

[0081] The LMF 391 accommodating the network slice of S-NSSAI=B sends a message indicating a security information acquisition request to the CAMF 310 (step S201). Here, the message indicating the security information acquisition request includes information specifying the network slice (for example, "S-NSSAI=B").

[0082] In order to accommodate the LMF391 of the specified network slice (e.g., "S-NSSAI=B"), CAMF310 generates a key Klmf_b based on the key Kamf. Here, information indicating the type of the network node (e.g., "NF type=LMF") and information specifying the network slice (e.g., "S-NSSAI=B") are included in the input of the key derivation function.

[0083] The CAMF 310 transmits a message indicating a security information acquisition response to the LMF 391 (step S202). Here, the message indicating a security information acquisition response includes information indicating the security capability of the terminal 20 and the key Klmf_b.

[0084] The LMF 391 generates a concealment key Klmf_b_nas_enc and an integrity protection key Klmf_b_nas_int from the key Klmf_b. Then, the LMF 391 transmits a message indicating a security mode instruction to the terminal 20 via the CAMF 310 (step S203).

[0085] The terminal 20 generates the concealment key Klmf_b_nas_enc and the integrity protection key Klmf_b_nas_int using a calculation algorithm shared in advance.

[0086] Next, the terminal 20 sends a message indicating that the security mode is completed to the LMF 391 via the CAMF 310 (step S204). The message between the terminal 20 and the RAN 10 indicating that the security mode is completed includes information indicating that the security mode is completed. In addition, the message between the RAN 10 and the CAMF 310 and the message between the CAMF 310 and the LMF 391 include information indicating the endpoint on the RAN side.

[0087] The LMF 391 transmits a message indicating DL position acquisition to the RAN 10 (RAN-side endpoint) without passing through the CAMF 310 (step S205 ).

[0088] Subsequent communications between the terminal 20 and the LMF 391 do not go through the CAMF 310 .

[0089] According to the present embodiment, when LMF391 communicates information associated with the location of the terminal 20 with the terminal 20, it functions as an endpoint of communication that ensures the confidentiality and integrity protection of the NAS signal. As a result, the transmission path of the NAS signal can be localized or shortened while ensuring security.

[0090] (Example 3)

[0091] In this embodiment, an example in which the UE-PCF 361 and the terminal 20 perform communication for setting a terminal policy will be described.

[0092] Figure 7 This is a sequence diagram showing an example of the flow of the terminal policy setting process according to Example 3 of the embodiment of the present invention. It is assumed that the terminal 20 has completed the initial registration process.

[0093] CAMF 310 stores information indicating the security capability of terminal 20 and key Kamf. In addition, the communication between terminal 20 and CAMF 310 is kept private and integrity protected.

[0094] UE-PCF 361 accommodating the network slice of S-NSSAI=C sends a message indicating a security information acquisition request to CAMF 310 (step S301). Here, the message indicating the security information acquisition request includes information specifying the network slice (for example, "S-NSSAI=C").

[0095] In order to accommodate the UE-PCF361 of the specified network slice (e.g., "S-NSSAI=C"), CAMF310 generates the key Kuepcf_c based on the key Kamf. Here, information indicating the type of the network node (e.g., "NF type=UE-PCF") and information specifying the network slice (e.g., "S-NSSAI=C") are included in the input of the key derivation function.

[0096] CAMF 310 transmits a message indicating a security information acquisition response to UE-PCF 361 (step S302). Here, the message indicating a security information acquisition response includes information indicating the security capability of terminal 20 and key Kuepcf_c.

[0097] The UE-PCF 361 generates a concealment key Kuepcf_c_nas_enc and an integrity protection key Kuepcf_c_nas_int from the key Kuepcf_c. Then, the UE-PCF 361 transmits a message indicating a security mode instruction to the terminal 20 via the CAMF 310 (step S303).

[0098] The terminal 20 generates the concealment key Kuepcf_c_nas_enc and the integrity protection key Kuepcf_c_nas_int using a calculation algorithm shared in advance.

[0099] Next, the terminal 20 sends a message indicating that the security mode is completed to the UE-PCF 361 via the CAMF 310 (step S304). The message between the terminal 20 and the RAN 10 indicating that the security mode is completed includes information indicating that the security mode is completed. In addition, the message between the RAN 10 and the CAMF 310 and the message between the CAMF 310 and the UE-PCF 361 include information indicating the endpoint on the RAN side.

[0100] The UE-PCF 361 sends a message indicating the terminal policy container to the RAN 10 (RAN-side endpoint) without passing through the CAMF 310 (step S305 ).

[0101] Subsequent communications between the terminal 20 and the UE-PCF 361 do not go through the CAMF 310 .

[0102] According to this embodiment, when the UE-PCF 361 communicates information related to the policy control of the terminal 20 with the terminal 20, it functions as an endpoint of the communication that guarantees the confidentiality and integrity protection of the NAS signal. As a result, the transmission path of the NAS signal can be localized or shortened while ensuring security.

[0103] According to this embodiment, each network node functions as an endpoint of a separate NAS signal, thereby making it possible to localize or shorten the transmission path of the NAS signal while ensuring security.

[0104] (Device Structure)

[0105] Next, the functional configuration examples of the base station 10, the terminal 20, and various network nodes that implement the above-mentioned processing and actions will be described. The base station 10, the terminal 20, and various network nodes include functions for implementing the above-mentioned embodiments. However, the base station 10, the terminal 20, and various network nodes may each only have a part of the functions in the embodiments.

[0106] <Base Station 10 and Network Node>

[0107] Figure 8 1 is a diagram showing an example of the functional configuration of the base station 10. Figure 8 As shown, the base station 10 includes a transmission unit 110 , a reception unit 120 , a setting unit 130 , and a control unit 140 . Figure 8 The functional structure shown is only an example. As long as the actions of the embodiments of the present invention can be implemented, the functional division and the name of the functional unit can be arbitrary. In addition, the network node can also have the same functional structure as the base station 10. In addition, a network node having multiple different functions in the system architecture can also be composed of multiple network nodes separated by function.

[0108] The transmitter 110 includes a function of generating a signal to be sent to the terminal 20 or other network nodes and transmitting the signal by wire or wirelessly. The receiver 120 includes a function of receiving various signals sent from the terminal 20 or other network nodes and obtaining, for example, higher layer information from the received signals.

[0109] The setting unit 130 stores in a storage device the setting information set in advance and various setting information to be transmitted to the terminal 20, and reads out from the storage device as needed. The content of the setting information is, for example, setting related to communication using the NTN.

[0110] As described in the embodiment, the control unit 140 performs processing related to communication using the NTN. In addition, the control unit 140 performs processing related to communication with the terminal 20. In addition, the control unit 140 performs processing related to geographical location verification of the terminal 20. The functional unit related to signal transmission in the control unit 140 may be included in the transmission unit 110, and the functional unit related to signal reception in the control unit 140 may be included in the reception unit 120.

[0111] <Terminal 20>

[0112] Fig. 9 2 is a diagram showing an example of the functional structure of the terminal 20. Fig. 9 As shown, the terminal 20 includes a transmitting unit 210 , a receiving unit 220 , a setting unit 230 , and a control unit 240 . Fig. 9The functional structure shown is only an example. As long as the operation of the embodiment of the present invention can be implemented, the functional division and the name of the functional unit can be arbitrary. The USIM installed in the terminal 20 can also have a transmitting unit 210, a receiving unit 220, a setting unit 230, and a control unit 240 in the same manner as the terminal 20.

[0113] The transmitting unit 210 generates a transmission signal according to the transmission data and transmits the transmission signal wirelessly. The receiving unit 220 receives various signals wirelessly and obtains a higher layer signal from the received physical layer signal. In addition, the receiving unit 220 has a function of receiving NR-PSS, NR-SSS, NR-PBCH, DL / UL control signals, reference signals, etc. sent from the network node.

[0114] The setting unit 230 stores various setting information received from the network node by the receiving unit 220 in a storage device, and reads it from the storage device as needed. In addition, the setting unit 230 also stores pre-set setting information.

[0115] The network node or communication system of this embodiment may also be configured as the network node or communication system shown in the following items. In addition, the following communication method may also be implemented.

[0116] <Structure Related to This Embodiment>

[0117] (Item 1)

[0118] A network node, comprising:

[0119] a control unit for generating, based on information indicating a type of the other network node or a network slice to which the other network node belongs, a key used in the other network node in a manner that has different values ​​depending on the type or the network slice, in order to establish a secure communication path between the other network node and the terminal; and

[0120] A sending unit is configured to send a message including the key to the other network nodes.

[0121] (Item 2)

[0122] A network node, comprising:

[0123] a receiving unit that receives, from another network node, a message containing a key for establishing a secure communication path with the terminal;

[0124] a control unit that generates a key for concealment and a key for integrity protection based on the key; and

[0125] A sending unit is configured to send a message indicating an instruction of a security mode to the terminal by using a secure communication path between the other network node and the terminal.

[0126] (Item 3)

[0127] A communication system comprises a first network node and a second network node, wherein:

[0128] The first network node has:

[0129] a control unit that generates, based on information indicating a type of the second network node or a network slice to which the second network node belongs, a key used in the second network node in a manner that has different values ​​depending on the type or the network slice in order to establish a secure communication path between the second network node and the terminal; and

[0130] a sending unit, configured to send a message including the key to the second network node,

[0131] The second network node has:

[0132] a receiving unit, configured to receive a message including the key from the first network node;

[0133] a control unit that generates a key for concealment and a key for integrity protection based on the key; and

[0134] A sending unit is configured to send a message indicating an instruction of a security mode to the terminal by using a secure communication path between the first network node and the terminal.

[0135] (Item 4)

[0136] A communication method performed by a network node, comprising the following steps:

[0137] In order to establish a secure communication path between the other network node and the terminal, based on information indicating the type of the other network node or the network slice to which the other network node belongs, a key used in the other network node is generated in a manner that becomes a different value according to the type or the network slice; and

[0138] A message including the key is sent to the other network node.

[0139] (Item 5)

[0140] A communication method performed by a network node, comprising the following steps:

[0141] receiving, from another network node, a message containing a key for establishing a secure communication path with the terminal;

[0142] Generate a key for concealment and a key for integrity protection based on the key; and

[0143] A message indicating an indication of a security mode is sent to the terminal using a secure communication path between the other network node and the terminal.

[0144] (Item 6)

[0145] A communication method performed by a communication system comprising a first network node and a second network node, wherein:

[0146] The first network node generates a key used in the second network node based on information indicating a type of the second network node or a network slice to which the second network node belongs in order to establish a secure communication path between the second network node and the terminal, so that the key becomes a different value according to the type or the network slice, and sends a message including the key to the second network node.

[0147] The second network node receives a message including the key from the first network node, generates a key for concealment and a key for integrity protection based on the key, and sends a message indicating a security mode to the terminal using a secure communication path between the first network node and the terminal.

[0148] According to any one of the above structures, a technology is provided that can localize or shorten the transmission path of the NAS signal while ensuring security. According to item 1, in order to establish a secure communication path between other network nodes and a terminal, based on information indicating the type of the other network node or the network slice to which the other network node belongs, a message containing a key used in the other network node generated as a different value according to the type or network slice can be sent to the other network node. According to item 2, based on the key, a key for concealment and a key for integrity protection can be generated, and a message indicating an indication of a security mode can be sent to the terminal using a secure communication path between the other network node and the terminal.

[0149] (Hardware Structure)

[0150] The block diagram used in the description of the above embodiment ( Figure 8 and Fig. 9) shows blocks in units of functions. These functional blocks (structural parts) are implemented by any combination of at least one of hardware and software. In addition, there is no particular limitation on the implementation method of each functional block. That is, each functional block can be implemented using a device that is physically or logically combined, or two or more physically or logically separated devices can be directly or indirectly connected (for example, using wires, wirelessly, etc.) and implemented using these multiple devices. The functional blocks can also be implemented by combining software in the above-mentioned one device or the above-mentioned multiple devices.

[0151] Functions include judging, determining, judging, calculating, calculating, processing, deriving, investigating, searching, confirming, receiving, sending, outputting, accessing, solving, selecting, selecting, establishing, comparing, assuming, expecting, regarding, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating, mapping, assigning, etc., but are not limited to these. For example, a functional block (structural unit) that enables the transmission function is called a transmitting unit or a transmitter. In short, as mentioned above, there is no particular limitation on the implementation method.

[0152] For example, the network node, the terminal 20, etc. in one embodiment of the present disclosure may also function as a computer that performs the processing of the wireless communication method of the present disclosure. Fig.10 1 is a diagram showing an example of the hardware structure of the base station 10 and the terminal 20 involved in one embodiment of the present disclosure. The network node may have the same hardware structure as the base station 10. The USIM may also have the same hardware structure as the terminal 20. The base station 10 and the terminal 20 may also be configured as a computer device that physically includes a processor 1001, a storage device 1002, an auxiliary storage device 1003, a communication device 1004, an input device 1005, an output device 1006, and a bus 1007.

[0153] In the following description, the word "device" may be replaced by "circuit", "device", "unit", etc. The hardware configuration of the base station 10 and the terminal 20 may include one or more of the devices shown in the figure, or may exclude some of the devices.

[0154] Each function in the base station 10 and the terminal 20 is implemented by the following method: predetermined software (program) is read into hardware such as the processor 1001 and the storage device 1002, so that the processor 1001 performs calculations and controls the communication of the communication device 1004 or controls at least one of the reading and writing of data in the storage device 1002 and the auxiliary storage device 1003.

[0155] The processor 1001 controls the entire computer by, for example, operating an operating system. The processor 1001 may also be composed of a central processing unit (CPU) including an interface with peripheral devices, a control device, a computing device, registers, etc. For example, the control unit 140, the control unit 240, etc. may also be implemented by the processor 1001.

[0156] In addition, the processor 1001 reads a program (program code), a software module, or data from at least one of the auxiliary storage device 1003 and the communication device 1004 to the storage device 1002, and performs various processes accordingly. As a program, a program that causes the computer to execute at least a part of the actions described in the above embodiments is used. For example, Figure 8 The control unit 140 of the base station 10 shown may also be implemented by a control program stored in the storage device 1002 and executed in the processor 1001. For example, Fig. 9 The control unit 240 of the terminal 20 shown can also be implemented by a control program stored in the storage device 1002 and operated in the processor 1001. Although it is described that the above-mentioned various processes are performed by one processor 1001, the above-mentioned various processes can also be performed simultaneously or sequentially by more than two processors 1001. The processor 1001 can also be implemented by more than one chip. In addition, the program can also be sent from the network via a telecommunication line.

[0157] The storage device 1002 is a computer-readable recording medium, and may be composed of at least one of ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), RAM (Random Access Memory), etc. The storage device 1002 may also be referred to as a register, a cache, a main memory (main storage device), etc. The storage device 1002 can store executable programs (program codes), software modules, etc. for implementing the communication method involved in one embodiment of the present disclosure.

[0158] The auxiliary storage device 1003 is a computer-readable recording medium, and may be composed of at least one of an optical disk such as a CD-ROM (CompactDisc ROM), a hard disk drive, a floppy disk, a magneto-optical disk (e.g., a compact disk, a digital versatile disk, a Blu-ray (registered trademark) disk, a smart card, a flash memory (e.g., a card, a stick, a key drive), a Floppy (registered trademark) disk, a magnetic strip, etc. The above-mentioned storage medium may be, for example, a database, a server, and other appropriate media including at least one of the storage device 1002 and the auxiliary storage device 1003.

[0159] The communication device 1004 is hardware (transceiver device) for communicating between computers via at least one of a wired network and a wireless network, and may also be referred to as a network device, a network controller, a network card, a communication module, etc. The communication device 1004 may also be configured to include, for example, a high-frequency switch, a duplexer, a filter, a frequency synthesizer, etc., to implement at least one of frequency division duplex (FDD: Frequency Division Duplex) and time division duplex (TDD: Time Division Duplex). For example, a transceiver antenna, an amplifier, a transceiver, a transmission path interface, etc. may also be implemented by the communication device 1004. The transceiver may also be implemented by physically or logically separating the transmitter and the receiver.

[0160] The input device 1005 is an input device that receives input from the outside (e.g., a keyboard, a mouse, a microphone, a switch, a button, a sensor, etc.). The output device 1006 is an output device that implements output to the outside (e.g., a display, a speaker, an LED light, etc.). In addition, the input device 1005 and the output device 1006 may also be integrally formed (e.g., a touch panel).

[0161] In addition, the processor 1001 and the storage device 1002 and other devices are connected via a bus 1007 for communicating information. The bus 1007 may be configured by a single bus or may be configured by different buses between devices.

[0162] In addition, the base station 10 and the terminal 20 may be configured to include hardware such as a microprocessor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), or an FPGA (Field Programmable Gate Array), and a part or all of each functional block may be implemented by the hardware. For example, the processor 1001 may also be implemented using at least one of these hardware.

[0163] Fig.11 FIG. 2 shows a structural example of a vehicle 2001. Fig.11 As shown, the vehicle 2001 includes a driving unit 2002, a steering unit 2003, an accelerator pedal 2004, a brake pedal 2005, a shift lever 2006, front wheels 2007, rear wheels 2008, an axle 2009, an electronic control unit 2010, various sensors 2021 to 2029, an information service unit 2012, and a communication module 2013. Each form / embodiment described in the present disclosure may also be applied to a communication device mounted on the vehicle 2001, for example, may also be applied to the communication module 2013.

[0164] The driving unit 2002 is composed of, for example, an engine, a motor, or a hybrid of an engine and a motor. The steering unit 2003 includes at least a steering wheel (also referred to as a steering wheel), and is configured to steer at least one of the front wheels and the rear wheels based on the operation of the steering wheel operated by a user.

[0165] The electronic control unit 2010 is composed of a microprocessor 2031, a memory (ROM, RAM) 2032, and a communication port (IO port) 2033. Signals from various sensors 2021 to 2029 included in the vehicle 2001 are input to the electronic control unit 2010. The electronic control unit 2010 may also be referred to as an ECU (Electronic Control Unit).

[0166] As signals from various sensors 2021~2029, there are current signals from the current sensor 2021 that monitors the current of the motor, speed signals of the front wheels and rear wheels obtained by the speed sensor 2022, air pressure signals of the front wheels and rear wheels obtained by the air pressure sensor 2023, vehicle speed signals obtained by the vehicle speed sensor 2024, acceleration signals obtained by the acceleration sensor 2025, accelerator pedal depression amount signals obtained by the accelerator pedal sensor 2029, brake pedal depression amount signals obtained by the brake pedal sensor 2026, shift lever operation signals obtained by the shift lever sensor 2027, detection signals for detecting obstacles, vehicles, pedestrians, etc. obtained by the object detection sensor 2028, and the like.

[0167] The information service unit 2012 is composed of various devices such as a car navigation system, an audio system, a speaker, a television, and a radio for providing (outputting) various information such as driving information, traffic information, and entertainment information, and one or more ECUs for controlling these devices. The information service unit 2012 uses information obtained from external devices via the communication module 2013 and the like to provide various multimedia information and multimedia services to passengers of the vehicle 2001.

[0168] The information service unit 2012 may include input devices for receiving input from the outside (such as keyboards, mice, microphones, switches, buttons, sensors, touch panels, etc.), and may also include output devices for implementing output to the outside (such as displays, speakers, LED lights, touch panels, etc.).

[0169] The driving assistance system unit 2030 is composed of various devices for preventing accidents or reducing the driver's driving load, such as millimeter wave radar, LiDAR (Light Detection and Ranging), camera, positioning device (such as GNSS, etc.), map information (such as high-definition (HD) map, autonomous driving vehicle (AV) map, etc.), gyroscope system (such as IMU (Inertial Measurement Unit), INS (Inertial Navigation System), etc.), AI (Artificial Intelligence) chip, AI processor, and one or more ECUs that control these devices. In addition, the driving assistance system unit 2030 sends and receives various information via the communication module 2013 to realize the driving assistance function or the autonomous driving function.

[0170] The communication module 2013 can communicate with the microprocessor 2031 and the components of the vehicle 2001 via the communication port. For example, the communication module 2013 can send and receive data with the drive unit 2002, the steering unit 2003, the accelerator pedal 2004, the brake pedal 2005, the shift lever 2006, the front wheel 2007, the rear wheel 2008, the axle 2009, the microprocessor 2031 in the electronic control unit 2010, the memory (ROM, RAM) 2032, and the sensors 2021 to 29 via the communication port 2033.

[0171] The communication module 2013 can be controlled by the microprocessor 2031 of the electronic control unit 2010, and is a communication device that can communicate with an external device. For example, various information can be sent and received with the external device via wireless communication. The communication module 2013 can be located inside or outside the electronic control unit 2010. The external device can also be, for example, a base station, a mobile station, etc.

[0172] The communication module 2013 may also transmit at least one of the signals from the various sensors 2021-2029 input to the electronic control unit 2010, the information obtained based on the signals, and the information based on the input from the outside (user) obtained via the information service unit 2012 to an external device via wireless communication. The electronic control unit 2010, the various sensors 2021-2029, the information service unit 2012, etc. may also be referred to as an input unit that receives input. For example, the PUSCH transmitted by the communication module 2013 may include information based on the above input.

[0173] The communication module 2013 receives various information (traffic information, signal information, vehicle-to-vehicle information, etc.) sent from an external device, and displays it on the information service unit 2012 of the vehicle 2001. The information service unit 2012 may also be referred to as an output unit that outputs information (for example, outputs information to a display, a speaker, etc. based on the PDSCH received by the communication module 2013 (or data / information decoded from the PDSCH)).

[0174] In addition, the communication module 2013 stores various information received from the external device in the memory 2032 that can be used by the microprocessor 2031. The microprocessor 2031 can also control the drive unit 2002, the steering unit 2003, the accelerator pedal 2004, the brake pedal 2005, the shift lever 2006, the front wheel 2007, the rear wheel 2008, the axle 2009, the sensors 2021 to 2029, etc. of the vehicle 2001 based on the information stored in the memory 2032.

[0175] (Supplementary Implementation Methods)

[0176] The above is a description of the embodiments of the present invention, but the disclosed invention is not limited to such an embodiment, and those skilled in the art should understand various variations, modifications, substitutions, replacements, etc. In order to facilitate the understanding of the invention, specific numerical examples are used for description, but unless otherwise specified, these numerical values ​​are only examples, and any appropriate value may also be used. The item distinction in the above description is not essential to the present invention, and the items recorded in more than two items can be combined and used as needed, and the items recorded in a certain item can be applied to the items recorded in another item (as long as there is no contradiction). The boundaries of the functional units or processing units in the functional block diagram do not necessarily correspond to the boundaries of the physical components. The actions of multiple functional units can be performed by one physical component, or the actions of one functional unit can be performed by multiple physical components. Regarding the processing steps described in the embodiment, the order of processing can be swapped if there is no contradiction. In order to facilitate the description of the processing, the base station 10 and the terminal 20 are described using a functional block diagram, but such a device can also be implemented by hardware, software, or a combination thereof. The software that operates according to the implementation mode of the present invention through the processor of the base station 10 and the software that operates according to the implementation mode of the present invention through the processor of the terminal 20 can also be stored in random access memory (RAM), flash memory, read-only memory (ROM), EPROM, EEPROM, registers, hard disk (HDD), removable disk, CD-ROM, database, server and any other appropriate storage medium.

[0177] In addition, the notification of information is not limited to the form / implementation method described in the present disclosure, and other methods may also be used. For example, the notification of information may be implemented through physical layer signaling (e.g., DCI (Downlink Control Information), UCI (Uplink Control Information)), upper layer signaling (e.g., RRC (Radio Resource Control) signaling, MAC (Medium Access Control) signaling, broadcast information (MIB (Master Information Block), SIB (System Information Block)), other signals or a combination thereof. In addition, RRC signaling may also be referred to as an RRC message, for example, an RRC Connection Setup message, an RRC Connection Reconfiguration message, etc.

[0178] Each form / embodiment described in the present disclosure may also be applied to a mobile communication system using LTE (Long Term Evolution), LTE-A (LTE-Advanced), SUPER 3G, IMT-Advanced, 4G (4th generation mobile communication system), 5G (5th generation mobile communication system), 6th generation mobile communication system (6G), xth generation mobile communication system (xG) (xG (x is, for example, an integer or a decimal)), FRA (Future Radio Access), NR (new Radio), New Radio Access (NX), Future Generation Radio Access (FX), W-CDMA (registered trademark), GSM (registered trademark), CDMA2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE At least one of 802.20, UWB (Ultra-WideBand), Bluetooth (registered trademark), other appropriate systems, and next-generation systems that are expanded, modified, created, and specified based on these systems. In addition, multiple systems may be combined (for example, a combination of at least one of LTE and LTE-A and 5G, etc.) for application.

[0179] The processing steps, timing, and flow of each form / implementation described in this specification may be reversed in order if there is no contradiction. For example, the method described in this disclosure uses the order of examples to indicate the elements of various steps, but is not limited to the specific order indicated.

[0180] In this specification, specific actions performed by the base station 10 are sometimes also performed by its upper node according to the situation. In a network composed of one or more network nodes having the base station 10, various actions performed for communicating with the terminal 20 can be performed by at least one of the base station 10 and other network nodes other than the base station 10 (for example, MME or S-GW, etc., but not limited to these). In the above, the case where there is one other network node other than the base station 10 is illustrated, but the other network node may also be a combination of multiple other network nodes (for example, MME and S-GW).

[0181] The information or signals described in the present disclosure can be output from a higher layer (or a lower layer) to a lower layer (or a higher layer), and can also be input or output via a plurality of network nodes.

[0182] The input or output information can be stored in a specific location (e.g., a memory) or managed using a management table. The input or output information can be rewritten, updated, or appended. The output information can also be deleted. The input information can also be sent to other devices.

[0183] The determination in the present disclosure may be performed by a value represented by 1 bit (0 or 1), by a Boolean value (Boolean: true or false), or by comparison of numerical values ​​(for example, comparison with a predetermined value).

[0184] Software, whether referred to as software, firmware, middleware, microcode, hardware description language, or by other names, shall be interpreted broadly to refer to commands, sets of commands, codes, code segments, program codes, programs, subroutines, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, execution threads, procedures, functions, etc.

[0185] In addition, software, commands, information, etc. may also be sent and received via a transmission medium. For example, when software is sent from a web page, server, or other remote source using at least one of wired technology (coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), etc.) and wireless technology (infrared, microwave, etc.), at least one of these wired technology and wireless technology is included in the definition of transmission medium.

[0186] The information, signals, etc. described in the present disclosure may also be represented by any of a variety of different technologies. For example, the data, commands, instructions, information, signals, bits, symbols, chips, etc. that may be involved in the above description as a whole may also be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, light fields or photons, or any combination of these.

[0187] In addition, the terms described in the present disclosure and the terms required for understanding the present disclosure may also be replaced with terms having the same or similar meanings. For example, at least one of a channel and a symbol may also be a signal (signaling). In addition, a signal may also be a message. In addition, a component carrier (CC) may also be referred to as a carrier frequency, a cell, a frequency carrier, etc.

[0188] As used in this disclosure, the terms "system" and "network" are used interchangeably.

[0189] In addition, the information, parameters, etc. described in the present disclosure may be represented by absolute values, relative values ​​to predetermined values, or other corresponding information. For example, wireless resources may also be indicated by indexes.

[0190] The names used for the above parameters are non-restrictive in any respect. Furthermore, the formulas etc. using these parameters may sometimes differ from those explicitly disclosed in the present disclosure. Various channels (e.g., PUCCH, PDCCH, etc.) and information elements may be identified by all appropriate names, and therefore the various names assigned to these various channels and information elements are non-restrictive in any respect.

[0191] In the present invention, the terms "base station (BS)," "wireless base station", "base station", "fixed station", "NodeB", "eNodeB (eNB)", "gNodeB (gNB)", "access point", "transmission point", "reception point", "transmission / reception point", "cell", "sector", "cell group", "carrier", "component carrier" and the like can be used interchangeably. Sometimes, the base station is also referred to as macro cell, small cell, micro-micro cell, micro-micro cell and the like.

[0192] A base station can accommodate one or more (for example, 3) cells. When a base station accommodates multiple cells, the overall coverage area of ​​the base station can be divided into multiple smaller areas, and each smaller area can also provide communication services through a base station subsystem (for example, a small base station RRH: Remote Radio Head for indoor use). Terms such as "cell" or "sector" refer to a part or the entirety of the coverage area of ​​at least one of the base station and the base station subsystem that provide communication services within the coverage area.

[0193] In the present disclosure, the base station sending information to the terminal may also be replaced by the base station instructing the terminal to perform a control / action based on the information.

[0194] In the present disclosure, terms such as “mobile station (MS)”, “user terminal (user terminal)”, “user equipment (UE)”, and “terminal” can be used interchangeably.

[0195] For mobile stations, those skilled in the art sometimes also use the following terms: subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, or some other appropriate terms.

[0196] At least one of the base station and the mobile station may also be referred to as a transmitting device, a receiving device, a communication device, etc. In addition, at least one of the base station and the mobile station may also be a device mounted on a mobile body, the mobile body itself, etc. The mobile body refers to an object that can move, and the moving speed is arbitrary. In addition, of course, it also includes the case where the mobile body stops. The mobile body includes, for example, vehicles, transport vehicles, cars, motorcycles, bicycles, connected cars, shovel cars, bulldozers, wheel loaders, dump trucks, forklifts, trains, buses, trailers (rear cars), rickshaws, ships (ships and other watercraft), airplanes, rockets, artificial satellites, drones (registered trademark), multi-rotor helicopters (multicopters), quadcopters (quadcopters), balloons and objects mounted on them, and are not limited to these. In addition, the mobile body may also be a mobile body that drives autonomously based on operating instructions. It can be a means of transportation (such as a car, airplane, etc.), a mobile body that moves in an unmanned manner (such as a drone, an autonomous car, etc.), or a robot (manned or unmanned). In addition, at least one of the base station and the mobile station also includes a device that does not necessarily move during communication. For example, at least one of the base station and the mobile station may also be an IoT (Internet of Things) device such as a sensor.

[0197] In addition, the base station in the present disclosure may also be replaced by a user terminal. For example, a structure in which the communication between a base station and a user terminal is replaced by the communication between multiple terminals 20 (for example, it may also be referred to as D2D (Device-to-Device), V2X (Vehicle-to-Everything), etc.) may also apply various forms / implementations of the present disclosure. In this case, it may also be configured that the terminal 20 has the functions possessed by the above-mentioned base station 10. In addition, terms such as "uplink" and "downlink" may also be replaced by terms corresponding to communication between terminals (for example, "side"). For example, uplink channels, downlink channels, etc. may also be replaced by side channels.

[0198] Likewise, the user terminal in the present disclosure may also be replaced by a base station. In this case, the base station may also have the functions of the user terminal.

[0199] The terms "determining" and "determining" used in the present disclosure sometimes also include a variety of actions. "Determining" and "determining" may include, for example, considering matters that have been judged, calculated, calculated, processed, derived, investigated, searched (for example, searched in a table, database or other data structure), confirmed (ascertaining) as matters that have been "determined" or "determined", etc. In addition, "determining" and "determining" may include matters that have been received (for example, receiving information), transmitted (for example, transmitting information), input, output, accessed (for example, accessing data in a memory) as matters that have been "determined" or "determined", etc. In addition, "determining" and "determining" may include matters that have been resolved (resolving), selected (selecting), chosen (choosing), established (establishing), compared (comparing), etc. as matters that have been "determined" or "determined". That is, "judgment" and "decision" may include certain actions that are considered to be "judged" or "decided". In addition, "judgment (decision)" may also be replaced by "assuming", "expecting", "considering", etc.

[0200] The terms "connected", "coupled" or all variations of these terms are intended to indicate any direct or indirect connection or combination between two or more elements, and may include the presence of one or more intermediate elements between two elements that are "connected" or "coupled" to each other. The combination or connection between elements may be a physical combination or connection, a logical combination or connection, or a combination of these. For example, "access" may be used instead of "connection". In the context of the present disclosure, two elements may be considered to be "connected" or "coupled" to each other using at least one of one or more wires, cables, and printed electrical connections, and as some non-limiting and non-inclusive examples, electromagnetic energy having wavelengths in the wireless frequency domain, microwave region, and light (including both visible and invisible) region may be used to "connect" or "couple" to each other.

[0201] The reference signal may be referred to as RS (Reference Signal) for short, or may be referred to as a pilot signal (Pilot) according to the applied standard.

[0202] The phrase "according to" used in the present disclosure does not mean "only according to" unless otherwise expressly stated. In other words, the phrase "according to" means both "only according to" and "at least according to".

[0203] Any reference to an element using the designations "first," "second," etc. used in this disclosure does not necessarily limit the number or order of these elements. These designations may be used in this disclosure as a convenient method of distinguishing between two or more elements. Therefore, a reference to a first element and a second element does not mean that only two elements can be taken or that the first element must precede the second element in any form.

[0204] The “unit” in the configuration of each of the above-mentioned devices may be replaced with a “section”, “circuit”, “device” or the like.

[0205] When the terms "include", "including" and their variations are used in the present disclosure, these terms are intended to be inclusive like the term "comprising". Furthermore, the term "or" used in the present disclosure does not mean an exclusive or.

[0206] A radio frame may be composed of one or more frames in the time domain. In the time domain, one or more frames may be referred to as a subframe. A subframe may also be composed of one or more time slots in the time domain. A subframe may also be a fixed time length (e.g., 1 ms) that is independent of a numerology.

[0207] A parameter set may be a communication parameter applied to at least one of the transmission and reception of a certain signal or channel. The parameter set may, for example, represent at least one of subcarrier spacing (SCS), bandwidth, symbol length, cyclic prefix length, transmission time interval (TTI), number of symbols per TTI, radio frame structure, specific filtering processing performed by the transceiver in the frequency domain, specific windowing processing performed by the transceiver in the time domain, and the like.

[0208] A slot may be composed of one or more symbols (OFDM (Orthogonal Frequency Division Multiplexing) symbols, SC-FDMA (Single Carrier Frequency Division Multiple Access) symbols, etc.) in the time domain. A slot may be a time unit based on a parameter set.

[0209] A time slot may contain multiple mini-slots. Each mini-slot may be composed of one or more symbols in the time domain. In addition, a mini-slot may also be referred to as a sub-slot. A mini-slot may be composed of fewer symbols than a time slot. A PDSCH (or PUSCH) transmitted in units of time greater than a mini-slot may be referred to as a PDSCH (or PUSCH) mapping type A. A PDSCH (or PUSCH) transmitted using a mini-slot may be referred to as a PDSCH (or PUSCH) mapping type B.

[0210] A radio frame, a subframe, a time slot, a mini-time slot, and a symbol all represent time units for transmitting signals. A radio frame, a subframe, a time slot, a mini-time slot, and a symbol may be referred to by other corresponding names.

[0211] For example, one subframe may be referred to as a transmission time interval (TTI), multiple consecutive subframes may be referred to as a TTI, and one time slot or one mini time slot may be referred to as a TTI. That is, at least one of a subframe and a TTI may be a subframe (1ms) in existing LTE, a period shorter than 1ms (e.g., 1-13 symbols), or a period longer than 1ms. In addition, the unit representing a TTI may be referred to as a time slot, a mini time slot, etc. instead of a subframe.

[0212] Here, TTI refers to, for example, the minimum time unit for scheduling in wireless communication. For example, in the LTE system, the base station performs scheduling to allocate wireless resources (frequency bandwidth, transmission power, etc. that can be used in each terminal 20) to each terminal 20 in units of TTI. In addition, the definition of TTI is not limited to this.

[0213] TTI can be a transmission time unit of data packets (transport blocks), code blocks, code words, etc. after channel coding, or a processing unit such as scheduling and link adaptation. In addition, when TTI is given, the time interval (e.g., the number of symbols) to which the transport block, code block, code word, etc. is actually mapped can also be shorter than the TTI.

[0214] In addition, when one time slot or one mini time slot is called TTI, one or more TTIs (i.e., one or more time slots or one or more mini time slots) may also be the minimum time unit for scheduling. In addition, the number of time slots (mini time slots) constituting the minimum time unit for scheduling may also be controlled.

[0215] A TTI with a time length of 1 ms is also called a normal TTI (TTI in LTE Rel.8-12), a normal TTI, a long TTI, a normal subframe, a normal subframe, a long subframe, a time slot, etc. A TTI shorter than a normal TTI may also be called a shortened TTI, a short TTI, a partial or fractional TTI, a shortened subframe, a short subframe, a mini-time slot, a sub-time slot, a time slot, etc.

[0216] In addition, for a long TTI (for example, a normal TTI, a subframe, etc.), it can be understood as a TTI with a time length exceeding 1ms, and for a short TTI (for example, a shortened TTI, etc.), it can be understood as a TTI with a TTI length less than that of a long TTI (long TTI) and greater than 1ms.

[0217] A resource block (RB) is a resource allocation unit in the time domain and the frequency domain. In the frequency domain, it may include one or more consecutive subcarriers. The number of subcarriers included in an RB may be the same regardless of the parameter set, for example, it may be 12. The number of subcarriers included in an RB may also be determined according to the parameter set.

[0218] In addition, the time domain of an RB may include one or more symbols, and may be the length of one slot, one mini slot, one subframe, or one TTI. One TTI, one subframe, etc. may be composed of one or more resource blocks, respectively.

[0219] In addition, one or more RBs may also be referred to as a physical resource block (PRB: Physical RB), a sub-carrier group (SCG: Sub-Carrier Group), a resource element group (REG: Resource Element Group), a PRB pair, an RB pair, etc.

[0220] In addition, a resource block may be composed of one or more resource elements (REs). For example, one RE may be a radio resource region of one subcarrier and one symbol.

[0221] A bandwidth part (BWP) (also referred to as partial bandwidth, etc.) may also represent a subset of contiguous common RBs (common resource blocks) for a parameter set in a carrier. Here, the common RBs may be identified by the index of the RBs relative to the common reference point of the carrier. PRBs may be defined in a BWP and numbered within the BWP.

[0222] The BWP may include a BWP for UL (UL BWP) and a BWP for DL ​​(DL BWP). One or more BWPs may be configured for the terminal 20 within one carrier.

[0223] At least one of the set BWPs may be active, and it is not assumed that the terminal 20 transmits and receives a predetermined signal / channel outside the activated BWP. In addition, "cell", "carrier" and the like in the present disclosure may be replaced with "BWP".

[0224] The above structures of radio frames, subframes, time slots, mini-time slots, and symbols are merely examples. For example, the number of subframes included in a radio frame, the number of time slots per subframe or radio frame, the number of mini-time slots included in a time slot, the number of symbols and RBs included in a time slot or mini-time slot, the number of subcarriers included in an RB, the number of symbols in a TTI, the symbol length, and the cyclic prefix (CP) length may be changed in various ways.

[0225] In the present disclosure, when an article is added by translation, such as a, an, and the in English, for example, the present disclosure also includes the case where the noun following the article is in plural form.

[0226] In the present disclosure, the term "A and B are different" may mean "A and B are different from each other". In addition, the term may mean "A and B are different from C, respectively". The terms "separate" and "combined" may also be interpreted in the same way as "different".

[0227] Each form / implementation described in the present disclosure may be used alone or in combination, and may be switched depending on the execution. In addition, notification of scheduled information is not limited to being performed explicitly (e.g., notification of "yes X"), but may also be performed implicitly (e.g., notification of the scheduled information is not performed).

[0228] The present disclosure is described in detail above, but it should be clear to those skilled in the art that the present disclosure is not limited to the embodiments described in the present disclosure. The present disclosure can be implemented as a modification and variation without departing from the subject matter and scope of the present disclosure as determined by the claims. Therefore, the purpose of the description of the present disclosure is to illustrate and not to have any limiting meaning on the present disclosure.

[0229] Description of symbols

[0230] 10 Base Station (RAN)

[0231] 11 Satellite

[0232] 110 Sending Department

[0233] 120 Receiving Department

[0234] 130 Setting Department

[0235] 140 Control Department

[0236] 20 Terminal

[0237] 30 Core Network

[0238] 40DN

[0239] 210 Sending Department

[0240] 220 Receiving Department

[0241] 230 Setting Department

[0242] 240 Control Department

[0243] 310CAMF

[0244] 320UDM

[0245] 330NEF

[0246] 340NRF

[0247] 350AUSF

[0248] 360PCF

[0249] 361UE-PCF

[0250] 370SMF

[0251] 380UPF

[0252] 390AF

[0253] 391LMF

[0254] 1001 Processor

[0255] 1002 Storage Device

[0256] 1003 Auxiliary storage device

[0257] 1004 Communication device

[0258] 1005 Input Device

[0259] 1006 Output Device

[0260] 2001 Vehicles

[0261] 2002 Drive Department

[0262] 2003 Steering

[0263] 2004 Accelerator pedal

[0264] 2005 Brake Pedal

[0265] 2006 Gear Lever

[0266] 2007 Front wheel

[0267] 2008 Rear wheel

[0268] 2009 Axle

[0269] 2010 Electronic Control Department

[0270] 2012 Information Services Department

[0271] 2013 Communication Module

[0272] 2021 Current Sensor

[0273] 2022 Speed ​​Sensor

[0274] 2023 Air Pressure Sensor

[0275] 2024 Vehicle speed sensor

[0276] 2025 Accelerometer

[0277] 2026 Brake pedal sensor

[0278] 2027 Gear lever sensor

[0279] 2028 Object Detection Sensor

[0280] 2029 Accelerator pedal sensor

[0281] 2030 Driving Assistance Systems Division

[0282] 2031 Microprocessor

[0283] 2032 memory (ROM, RAM)

[0284] 2033 communication port (IO port)

Claims

1. A network node, comprising: a control unit for generating, based on information indicating a type of the other network node or a network slice to which the other network node belongs, a key used in the other network node in a manner that has different values ​​depending on the type or the network slice, in order to establish a secure communication path between the other network node and the terminal; and A sending unit is configured to send a message including the key to the other network nodes.

2. A network node, comprising: a receiving unit that receives, from another network node, a message containing a key for establishing a secure communication path with the terminal; a control unit that generates a key for concealment and a key for integrity protection based on the key; and A sending unit is configured to send a message indicating an instruction of a security mode to the terminal by using a secure communication path between the other network node and the terminal.

3. A communication system comprising a first network node and a second network node, wherein: The first network node has: a control unit that generates, based on information indicating a type of the second network node or a network slice to which the second network node belongs, a key used in the second network node in a manner that has different values ​​depending on the type or the network slice in order to establish a secure communication path between the second network node and the terminal; and a sending unit, configured to send a message including the key to the second network node, The second network node has: a receiving unit, configured to receive a message including the key from the first network node; a control unit that generates a key for concealment and a key for integrity protection based on the key; and A sending unit is configured to send a message indicating an instruction of a security mode to the terminal by using a secure communication path between the first network node and the terminal.

4. A communication method performed by a network node, comprising the following steps: In order to establish a secure communication path between the other network node and the terminal, based on information indicating the type of the other network node or the network slice to which the other network node belongs, a key used in the other network node is generated in a manner that becomes a different value according to the type or the network slice; and A message including the key is sent to the other network node.

5. A communication method performed by a network node, comprising the following steps: receiving, from another network node, a message containing a key for establishing a secure communication path with the terminal; Generate a key for concealment and a key for integrity protection based on the key; and A message indicating an indication of a security mode is sent to the terminal using a secure communication path between the other network node and the terminal.

6. A communication method performed by a communication system comprising a first network node and a second network node, wherein: The first network node generates a key used in the second network node based on information indicating a type of the second network node or a network slice to which the second network node belongs in order to establish a secure communication path between the second network node and the terminal, so that the key becomes a different value according to the type or the network slice, and sends a message including the key to the second network node. The second network node receives a message including the key from the first network node, generates a key for concealment and a key for integrity protection based on the key, and sends a message indicating a security mode to the terminal using a secure communication path between the first network node and the terminal.

Images