Local routing in non-terrestrial network (NTN) access

Abstract

Local routing of data packets in a next generation radio access network (NG-RAN). In one embodiment, a non-terrestrial network (NTN) satellite is operably coupled to first and second user equipments (UEs). The NTN satellite is configured to store a UE context mapping between a first UE context of the first UE and a second UE context of the second UE, receive a data packet from the first UE over the first service link, determine whether to perform local routing of the data packet without routing to the terrestrial network, and in response to the determination of performing the local routing, transmit the data packet to the second UE. The data packet is transmitted to the second UE over the second serving link based on the UE context mapping.

Description

Technical Field

[0001] The present disclosure relates to the field of communication systems, in particular to next generation networks. Background Art

[0002] Next generation networks, such as fifth generation (5G), represent the next major stage in mobile telecommunication standards beyond fourth generation (4G) standards. Next generation networks are likely to be enhanced in terms of radio access and network architecture compared to 4G networks. Next generation networks are designed to utilize new areas of the radio spectrum for radio access networks (RANs), such as the millimeter wave bands.

[0003] As mobile networks become more widely used across the country and the world, communications may be intercepted or subject to other types of attacks. To ensure security and privacy, the Third Generation Partnership Project (3GPP) has developed security mechanisms for 5G mobile networks and security procedures performed within 5G mobile networks. Due to the importance of security in 5G systems and beyond, it is expected that more robust security mechanisms will continue to be developed.

[0004] One type of access supported in the Next Generation (NG) RAN is non-terrestrial network (NTN) access. For example, an NTN access may include one or more NTN satellites configured to communicate with a user equipment (UE). There may be situations where the NTN satellite becomes disconnected from the terrestrial network, which may interrupt communications between UEs. Summary of the invention

[0005] This document describes a local routing solution in NG-RAN. Typically, an NG-RAN node (such as an NTN satellite) stores a UE context for a UE that is accessing the NTN satellite (i.e., via a serving link). The NTN satellite may be configured with a UE context mapping that links or relates the UE context of the UE to the UE context of another UE. In response to receiving a data packet from a UE, the NTN satellite may perform local routing of the data packet to another UE based on the UE context mapping without routing the data packet to a terrestrial network. One technical advantage is that the NTN satellite may support communications between UEs even when a radio or feeder link to a terrestrial network is disconnected. Another technical advantage is that the NTN satellite may support security mechanisms to protect data packets based on the UE context for the UE.

[0006] In an embodiment (also referred to as an aspect), an apparatus of a RAN (e.g., NG-RAN) includes a non-terrestrial network (NTN) satellite operatively coupled to a first UE and a second UE. The NTN satellite includes at least one processor and at least one memory, the at least one memory storing instructions that, when executed by the at least one processor, cause the NTN satellite to at least store a UE context mapping between a first UE context of the first UE and a second UE context of the second UE, receive a data packet from the first UE over a first service link, determine whether to perform local routing of the data packet without routing to a terrestrial network, and, in response to determining to perform local routing, send the data packet to the second UE over a second service link based on the UE context mapping.

[0007] In one embodiment, the at least one processor further causes the NTN satellite to at least determine whether a feeder link to a terrestrial network is available and, when the feeder link is not available, decide to perform local routing.

[0008] In one embodiment, the at least one processor further causes the NTN satellite to integrity protect the data packet based on an integrity key indicated in a second UE context of the second UE at least before transmitting to the second UE.

[0009] In one embodiment, the at least one processor further causes the NTN satellite to encrypt the data packet based on an encryption key indicated in a second UE context of the second UE at least before transmitting to the second UE.

[0010] In one embodiment, the data packet comprises one of radio resource control signaling or user plane traffic.

[0011] In one embodiment, the at least one processor further causes the NTN satellite to receive at least a context management message of a context management procedure from an access and mobility management function, the context management message indicating a UE context mapping, wherein the context management procedure comprises an initial context setup procedure.

[0012] In one embodiment, the Initial Context Setup Request message of the Initial Context Setup procedure is extended to include an information element containing a UE context map.

[0013] In one embodiment, the UE context mapping includes a mapping link from the first UE context to the second UE context, and the mapping link includes a radio network temporary identifier assigned to the second UE.

[0014] In one embodiment, the UE context mapping comprises a mapping link from the first UE context to the second UE context, and the mapping link comprises a UE radio access network identifier assigned to the second UE.

[0015] In one embodiment, the at least one processor further causes the NTN satellite to at least identify a handover scenario to another NTN satellite and forward the UE context map to the other NTN via an inter-satellite link.

[0016] In one embodiment, a method of performing local routing in a radio access network includes storing, at an NTN satellite operably coupled to a first UE and a second UE, a UE context mapping between a first UE context of the first UE and a second UE context of the second UE, receiving a data packet from the first UE over a first service link, determining whether to perform local routing of the data packet without routing to a terrestrial network, and in response to determining to perform local routing, sending the data packet from the NTN satellite to the second UE over a second service link based on the UE context mapping.

[0017] In one embodiment, determining whether to perform local routing of the data packet includes determining whether a feeder link to a terrestrial network is available, and deciding to perform local routing when the feeder link is not available.

[0018] In one embodiment, the method further comprises integrity protecting the data packet based on an integrity key indicated in a second UE context of the second UE before sending to the second UE.

[0019] In one embodiment, the method further comprises encrypting the data packet based on an encryption key indicated in a second UE context of the second UE before sending to the second UE.

[0020] In one embodiment, the method further comprises identifying a handover scenario to another NTN satellite, and forwarding the UE context map to the other NTN satellite via an inter-satellite link.

[0021] In one embodiment, an apparatus of a radio access network includes an NTN satellite operably coupled to a first UE and a second UE. The NTN satellite includes means for storing a UE context mapping between a first UE context of the first UE and a second UE context of the second UE, means for receiving a data packet from the first UE over a first service link, means for determining whether to perform local routing of the data packet without routing to a terrestrial network, and means for sending the data packet to the second UE over a second service link based on the UE context mapping in response to determining to perform local routing.

[0022] In one embodiment, the means for determining includes means for determining whether a feeder link to the terrestrial network is available, and means for deciding to perform local routing when the feeder link is not available.

[0023] In one embodiment, the NTN satellite further comprises means for integrity protecting the data packet based on an integrity key indicated in a second UE context of the second UE before transmitting to the second UE.

[0024] In one embodiment, the NTN satellite further comprises means for encrypting the data packet based on an encryption key indicated in a second UE context of the second UE before transmitting to the second UE.

[0025] In one embodiment, the data packet comprises one of radio resource control signaling or user plane traffic.

[0026] In one embodiment, the NTN satellite further comprises means for receiving a context management message of a context management procedure from an access and mobility management function, the context management message indicating a UE context mapping, wherein the context management procedure comprises an initial context setup procedure.

[0027] In one embodiment, the Initial Context Setup Request message of the Initial Context Setup procedure is extended to include an information element containing a UE context map.

[0028] In one embodiment, the UE context mapping includes a mapping link from the first UE context to the second UE context, and the mapping link includes a radio network temporary identifier assigned to the second UE.

[0029] In one embodiment, the UE context mapping comprises a mapping link from the first UE context to the second UE context, and the mapping link comprises a UE radio access network identifier assigned to the second UE.

[0030] In one embodiment, the NTN satellite further comprises means for identifying a handover scenario to another NTN satellite, and means for forwarding the UE context map to another NTN satellite via an inter-satellite link.

[0031] Other embodiments may include computer-readable media, other systems or devices, or other methods as described below. Additionally, one or more of the embodiments described above may be combined as described herein.

[0032] The above summary of the invention provides a basic understanding of some aspects of this specification. The summary of the invention is not an extensive overview of the specification. It is not intended to identify the key or essential elements of the specification, nor to delineate any scope of the specific embodiments of the specification or any scope of the claims. Its only purpose is to present some concepts of the specification in a simplified form as a prelude to a more detailed description later. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Some embodiments of the present invention are now described by way of example only and with reference to the accompanying drawings.In all drawings, the same reference number represents the same element or the same type of element.

[0034] Figure 1 Shown is the high-level architecture of a 5G system.

[0035] Figure 2 The non-roaming architecture of the 5G system is shown.

[0036] Figure 3 The security mechanisms within the 5G system are shown.

[0037] Figures 4A-4B A master authentication process is shown that provides mutual authentication between user equipment and the network.

[0038] Figure 5 Non-access stratum (NAS) and access stratum (AS) security procedures are shown.

[0039] Figure 6 User plane (UP) security activation is shown.

[0040] Figure 7 The key hierarchy of the 5G system is shown.

[0041] Figures 8A-8B The NTN-based NG-RAN architecture is shown.

[0042] Fig. 9 Local routing of data packets in an illustrative embodiment is shown.

[0043] Fig.10 is a block diagram of an NG-RAN node in an illustrative embodiment.

[0044] Fig.11 is a block diagram of a UE in an illustrative embodiment.

[0045] Fig.12 is a block diagram of an AMF in an illustrative embodiment.

[0046] Fig.13 is a flow chart of a method for performing local routing in NG-RAN in an illustrative embodiment.

[0047] Fig.14 A local routing scenario in an illustrative embodiment is shown.

[0048] Fig.15 is a flow chart of a method of determining whether to perform local routing in an illustrative embodiment.

[0049] Fig.16 Inter-satellite communications in an illustrative embodiment are shown.

[0050] Fig.17 is a flow chart showing a method of forwarding UE context mapping in a mobile scenario in an illustrative embodiment.

[0051] Figures 18A-18B Local routing of control plane messages in an illustrative embodiment is shown.

[0052] Fig.19 A control plane protocol stack in an illustrative embodiment is shown.

[0053] Fig. 20 is a message diagram showing local routing of control plane messages in an illustrative embodiment.

[0054] Figures 21A-21B Local routing of user plane messages in an illustrative embodiment is shown.

[0055] Fig. 22 A user plane protocol stack in an illustrative embodiment is shown.

[0056] Fig.23 is a message diagram showing local routing of user plane messages in an illustrative embodiment.

[0057] Fig.24 An initial context setup process in an illustrative embodiment is shown.

[0058] Fig.25 An initial context setup request message in an illustrative embodiment is shown.

[0059] Fig.26 The UE context modification procedure in an illustrative embodiment is shown.

[0060] Fig. 27 A UE context modification request message in an illustrative embodiment is shown.

[0061] Figures 28A-28C The mapping of UE context in an illustrative embodiment is shown. DETAILED DESCRIPTION

[0062] The accompanying drawings and the following description illustrate specific exemplary embodiments. Therefore, those skilled in the art will be able to design various arrangements, which, although not explicitly described or shown herein, embody the principles of the embodiments and are included within the scope of the embodiments. In addition, any examples described herein are intended to help understand the principles of the embodiments and should be interpreted as not being limited to these specifically enumerated examples and conditions. Therefore, the (multiple) concepts of the present invention are not limited to the specific embodiments or examples described below, but are limited by the claims and their equivalents.

[0063] Figure 1A high-level architecture of a 5G system 100 is shown. A 5G system (5GS) 100 is a communication system (e.g., a 3GPP system) including a 5G access network ((R)AN) 102 (generally referred to herein as a RAN) and a 5G core network (5GC) 104 that communicate with a 5G user equipment (UE) 106. The RAN 102 and the 5GC 104 together may be referred to as a 5G network 101, a 5G mobile network, a 5G communication network, etc. Although the term "5G" is used herein, any next generation network other than 5G is also contemplated.

[0064] The RAN 102 provides radio or wireless connectivity to the UE 106 and connects the UE 106 to the 5GC 104. The RAN 102 may include a next generation radio access network (NG-RAN), a non-3GPP access network, and / or another type of RAN connected to the 5GC 104. The RAN 102 may support Evolved UMTS Terrestrial Radio Access Network (E-UTRAN) access (e.g., through eNodeB (eNB), gNodeB (gNB), and / or ng-eNodeB (ng-eNB)), wireless local area network (WLAN) access, satellite radio access, new radio access technologies (RATs), etc. The 5G access network may also support fixed access. The 5GC 104 interconnects the RAN 102 with a data network (DN) 108. The 5GC 104 consists of network functions (NFs) 110, which may be implemented as network primitives on dedicated hardware, software instances running on dedicated hardware, virtualized functions instantiated on an appropriate platform (e.g., cloud infrastructure), etc. The data network 108 may be an operator-external public or private data network, or an operator-internal data network (e.g., for IP Multimedia Subsystem (IMS) services). The UE 106 (also referred to as a mobile terminal) includes a 5G-capable device configured to register with the 5GC 104 to access services. The UE 106 may include an end-user device such as a mobile phone (e.g., a smart phone), a tablet, a computer with a mobile broadband adapter, etc. The UE 106 may enable voice services, data services, machine-to-machine (M2M) or machine-type communication (MTC) services, and / or other services.

[0065] Figure 2 A non-roaming architecture 200 of a 5G system 100 is shown. Figure 2The architecture 200 in is a service-based representation, as further described in 3GPP TS 23.501 (v18.2.0), which is incorporated herein by reference as if fully included herein. The architecture 200 consists of network functions (NFs) for 5GC 104, and the NFs for the control plane (CP) are separated from the user plane (UP). The control plane of 5GC 104 includes an authentication server function (AUSF) 210, an access and mobility management function (AMF) 212, a session management function (SMF) 214, a policy control function (PCF) 216, a unified data management (UDM) 218, a network slice selection function (NSSF) 220, and an application function (AF) 222. The control plane of 5GC 104 also includes a network exposure function (NEF) 224, a NF repository function (NRF) 226, a service communication proxy (SCP) 228, a network slice admission control function (NSACF) 230, a network slice specific and SNPN authentication and authorization function (NSSAAF) 232, and an edge application server discovery function (EASDF) 234. The user plane of 5GC 104 includes one or more user plane functions (UPF) 240 that communicate with the data network 108. UE 106 is able to access the control plane and the user plane of 5GC 104 through RAN 102.

[0066] A large number of users can access services from operators or home network operators that implement mobile networks including 5G system 100, such as Figure 1-2 The communication between the user (ie, via the UE) and the mobile network is protected by security mechanisms (such as those standardized by 3GPP). Both the subscriber and the operator expect security guarantees from the security mechanisms.

[0067] Figure 3Security mechanisms 300 within the 5G system 100 are shown. One of the security mechanisms 300 is a master authentication and key agreement between the network (e.g., AMF212 / UDM 218) and the UE 106. Other security mechanisms 300 are used to protect signaling between the network and the UE 106. For example, the security mechanism 300 is used to protect the non-access stratum (NAS) signaling between the AMF 212 and the UE 106. Another security mechanism 300 is used to protect the radio resource control (RRC) signaling between the gNB 302 and the UE 106. The security mechanism 300 can also be used to protect the user plane (UP) traffic (also referred to as UP data) between the gNB 302 and the UE 106. Within the network, the security mechanism 300 can be used to protect the IP connectivity 104 (e.g., AMF212 / UPF 240) between the gNB 302 and the 5GC, such as Internet Protocol Security (IPSec). Another security mechanism 300 is used for roaming and interconnect security, such as protecting control plane signaling between a security edge protection proxy (SEPP) 310 and another network 301 (e.g., a visited 5G network), and / or protecting user plane data between a UPF 240 and another network 301. Additional security mechanisms 300 may be defined or used, and for the sake of brevity, are not discussed here.

[0068] Figures 4A-4B A primary authentication process is shown that provides mutual authentication between the UE 106 and the network (e.g., AMF 212 / UDM 218). The purpose of the primary authentication and key agreement process is to achieve mutual authentication between the UE 106 and the home network of the UE 106, and to provide key material that can be used between the UE 106 and the serving network in subsequent security procedures (e.g., NAS and AS security procedures). The home network (e.g., Home Public Land Mobile Network (HPLMN)) represents an operator network or operator network through which a subscriber (e.g., UE 106) has a subscription to a service. The serving network has a radio access equipment capable of communicating with the UE 106 via radio signals. The key material generated by the authentication and key agreement process causes an anchor key (referred to as K ) to be provided by the AUSF 210 of the home network to the Security Anchor Function (SEAF) of the serving network. SEAFKey). SEAF provides authentication functionality via the AMF 212 in the serving network and supports primary authentication using a subscription hidden identifier (SUCI) containing a hidden subscription permanent identifier (SUPI). SUPI is a globally unique 5G identifier assigned to each user in the 5G system 100. SUCI consists of a SUPI type, a home network identifier (HN-ID) that identifies the home network of the subscriber, a routing indicator (RID) assigned to the subscriber by the home network operator and provided in the universal subscriber identity module (USIM) of the UE 106, a protection scheme identifier, a home network public key identifier, and a scheme output. Anchor key (K SEAF ) from the so-called K AUSF The intermediate key of the key is derived. AUSF Keys are established between the UE 106 and the home network (AUSF 210), resulting in a primary authentication process.

[0069] Figure 4Ais a signaling diagram illustrating initiation of primary authentication, such as described in 3GPP TS 33.501 (v18.2.0), which is incorporated herein by reference as if fully included herein. The UE 106 sends an N1 message 411 (i.e., an initial NAS message), such as a registration request, to the serving network 406 (e.g., the AMF 212 of the serving network 406). In a roaming scenario, the serving network 406 may also be referred to as a serving PLMN, a visited PLMN (VPLMN), etc. The UE 106 uses a SUCI or a 5G globally unique temporary identifier (5G-GUTI) in the registration request. The SEAF 402 of the AMF 212 may initiate authentication with the UE 106 during any process of establishing a signaling connection with the UE 106. The SEAF 402 initiates authentication by sending a Nausf_UEAuthentication_Authenticate request message 412 to the AUSF 210, thereby invoking the Nausf_UEAuthentication service to the home network 404 (e.g., HPLMN). The Nausf_UEAuthentication_Authenticate request message 412 includes the SUCI or SUPI, and the Serving Network Name (SN-Name). Upon receiving the Nausf_UEAuthentication_Authenticate request message 412, the AUSF 210 checks whether the requesting SEAF 402 in the serving network 406 is authorized to use the Serving Network Name (SNN) in the Nausf_UEAuthentication_Authenticate request message 412 by comparing the Serving Network Name with the expected Serving Network Name. When the serving network 406 is authorized to use the Serving Network Name, the AUSF 210 sends a Nudm_UEAuthentication_Get request message 413 to the UDM 218 of the home network. The Nudm_UEAuthentication_Get request message 413 includes the SUCI or SUPI, and the Serving Network Name. Upon receipt of the Nudm_UEAuthentication_Get request message 413, the UDM 218 identifies the SUPI (if received), or invokes a subscription identifier de-hiding function (SIDF) to de-hide the SUPI from the SUCI (if received). The UDM 218 (or the authentication credentials repository and processing function (ARPF) of the UDM 218) selects or chooses an authentication method for primary authentication based on the SUPI.

[0070] Figure 4B4 is a signaling diagram illustrating a primary authentication process, such as described in 3GPP TS 33.501. In this example, 5G Authentication and Key Agreement (AKA) is described, but similar concepts apply to Extensible Authentication Protocol AKA prime (EAP-AKA'). For Nudm_UEAuthentication_Get request 413, UDM 218 creates a 5G Home Environment Authentication Vector (5G HE AV) for the selected authentication method. UDM 218 derives K AUSF The UDM 218 creates the 5G HE AV, including the authentication token (AUTN), the expected response (XRES*), K AUSF The UDM 218 then sends a Nudm_UEAuthentication_Get response message 414 to the AUSF 210 with the 5G HEAV to be used for authentication (e.g., Figure 4B In the case where SUCI is included in the Nudm_UEAuthentication_Get request 413, the UDM 218 includes the SUPI in the Nudm_UEAuthentication_Get response message 414 after decrypting the SUPI from the SUCI. If the subscriber has an Application Authentication and Key Management (AKMA) subscription, the UDM 218 may include the AKMA indication and the RID in the Nudm_UEAuthentication_Get response message 414.

[0071] In response to the Nudm_UEAuthentication_Get Response message 414, the AUSF 210 temporarily stores the expected response (XRES*) and the received SUCI or SUPI. The AUSF 210 then generates a 5G authentication vector (5G AV) by calculating the hashed expected response (HXRES*) from the expected response (XRES*) and the received SUCI or SUPI from the K AUSF Key calculation K SEAF key, and replace XRES* with HXRES* in 5G HE AV and replace it with K SEAF Key replacement K AUSF Key. AUSF 210 removes K SEAFThe AUSF 210 uses the key to generate a 5G Service Environment Authentication Vector (5G SE AV), which includes an authentication token (AUTN), a hashed expected response (HXRES*), and a random challenge (RAND). The AUSF 210 sends a Nausf_UEAuthentication_Authenticate response message 415 including the 5G SE AV to the SEAF 402. In response, the SEAF 402 sends the authentication token (AUTN) and the random challenge (RAND) to the UE 106 in a NAS message authentication request message 416.

[0072] although Figure 4B 106 , but UE 106 includes a mobile equipment (ME) and a USIM. The ME receives the authentication token (AUTN) and the random challenge (RAND) in the NAS message Authentication Request message 416, and forwards the authentication token (AUTN) and the random challenge (RAND) to the USIM. The USIM of UE 106 verifies the freshness of the received value by checking whether the authentication token (AUTN) can be accepted. If so, the USIM calculates a response (RES), a cipher key (CK), and an integrity key (IK) based on the random challenge (RAND), and returns the response (RES), the CK key, and the IK key to the ME. The ME of UE 106 calculates RES* based on RES, and calculates K from CK||IK AUSF key, and from K AUSF Calculate K in the key SEAF Key.

[0073] UE 106 sends a NAS message authentication response message 417 including RES* to SEAF 402. In response, SEAF 402 calculates HRES* from RES* and compares HRES* and HXRES*. If they are consistent, SEAF 402 considers authentication successful from the perspective of the serving network. SEAF 402 sends the RES* received from UE 106 to AUSF 210 in a Nausf_UEAuthentication_Authenticate request message 418. When AUSF 210 receives the Nausf_UEAuthentication_Authenticate request message 418 including RES* as authentication confirmation, AUSF 210 stores K based on the policy of the home network operator. AUSFThe AUSF 210 receives the received RES* and compares it with the stored XRES*. If RES* and XRES* are equal, the AUSF 210 considers the authentication successful from the perspective of the home network. The AUSF 210 notifies the UDM 218 of the authentication result (not shown). The AUSF 210 also sends a Nausf_UEAuthentication_Authenticate response message 419 to the SEAF 402, indicating whether the authentication is successful from the perspective of the home network. If the authentication is successful, K SEAF The key is sent to the SEAF 402 in a Nausf_UEAuthentication_Authenticate Response message 419. In case the AUSF 210 receives the SUCI from the SEAF 402 in the authentication request, the AUSF 210 includes the SUPI in the Nausf_UEAuthentication_Authenticate Response message 419 if the authentication is successful.

[0074] As described above, 5G divides UE management into non-access stratum (NAS) and access stratum (AS). The NAS layer protocol manages the connection between the UE 106 and the 5GC 104 (i.e., AMF 212), and the AS layer protocol manages the radio layer between the UE 106 and the RAN 102 (e.g., gNB 302) using the RRC protocol. NAS security ensures that the NAS signaling between the UE 106 and the AMF 212 is protected on the control plane, and AS security ensures that the RRC messages on the control plane and the user plane traffic (e.g., IP packets) on the user plane are protected.

[0075] Figure 5 NAS and AS security procedures are shown, such as described in 3GPP TS 33.501 (in sections 6.4 and 6.7, respectively). For NAS security, a NAS Security Mode Command procedure is performed to establish a NAS security context between the UE 106 and the AMF 212. Each AMF 212 is configured with a list of algorithms that are allowed to be used via network management. Currently, there is a list for NAS integrity algorithms and a list for NAS encryption algorithms in Chinese, which are ordered according to a priority determined by the operator. To establish the NAS security context, the AMF 212 selects a NAS encryption algorithm and a NAS integrity protection algorithm, and derives NAS integrity keys and NAS encryption keys (e.g., K ) for the selected algorithms. NASint and K NASenc). AMF 212 initiates the NAS security mode command procedure by sending a NAS security mode command message 511 to UE 106. AMF 212 activates NAS integrity protection before sending the NAS security mode command message 511. The NAS security mode command message 511 contains the previously received UE security capabilities, the selected NAS algorithm, the key set identifier (i.e., ngKSI (next generation key set identifier)), and the message authentication code (NAS-MAC) generated by AMF 212 for integrity protection of the NAS security mode command message 511. The NAS security mode command message 511 uses the K based on the K indicated by ngKSI. AMF The NAS integrity key of the key is integrity protected (but not encrypted). The AMF 212 activates NAS uplink decryption after sending the NAS Security Mode Command message 511.

[0076] Upon receipt of the NAS Security Mode Command message 511, the UE 106 uses the indicated NAS integrity algorithm and the K AMF 511. The UE 106 verifies the integrity of the NAS security mode command message 511 using the NAS integrity key of the key. The UE 106 generates a NAS integrity key and a NAS ciphering key in the same manner as the AMF 212 using the received algorithm. If the verification is successful, the UE 106 starts NAS integrity protection and performs encryption / decryption using the security context indicated by the ngKSI. The UE 106 sends the encrypted and integrity protected NAS security mode complete message 512 to the AMF 212. If the verification of the NAS security mode command message 511 is unsuccessful, the UE 106 replies with a NAS security mode reject message (not shown).

[0077] The AMF 212 decrypts using the key and algorithm indicated in the NAS Security Mode Command message 511 and checks the integrity of the received NAS Security Mode Complete message 512. The AMF 212 activates NAS downlink encryption after receiving the NAS Security Mode Complete message 512.

[0078] AS security includes RRC security and user plane (UP) security. For RRC security, RRC integrity protection and RRC confidentiality protection are provided by the Packet Data Convergence Protocol (PDCP) layer between the UE 106 and the gNB 302. For UP security, the SMF 214 provides the UP security policy for the packet data unit (PDU) session to the gNB 302 (or ng-eNB) during the PDU session establishment process (not shown). The UP security policy indicates whether UP confidentiality and / or UP integrity protection is activated for the data radio bearers (DRBs) belonging to the PDU session.

[0079] The AS Security Mode Command procedure is performed to establish an AS security context between the UE 106 and the NG-RAN 502. When the AS security context is to be established in the gNB 302, the AMF 212 sends the UE 5G security capabilities and K with encryption and integrity protection algorithms in the NGAP Initial Context Setup message 513. gNB The keys are sent to the NG-RAN 502 (e.g., gNB 302). Currently, each gNB 302 is configured via network management with a list of algorithms that are allowed to be used. There is a list for integrity algorithms and a list for ciphering algorithms, which are ordered according to a priority determined by the operator. The gNB 302 selects the AS integrity algorithm and the AS ciphering algorithm from its configured list that have the highest priority and are present in the UE 5G security function received from the AMF 212. The gNB 302 derives the RRC integrity key (K RRCint ), UP integrity key (K UPint ), RRC encryption key (K RRCenc ) and UP encryption key (K UPenc ). gNB 302 starts integrity protection of RRC messages.

[0080] The gNB 302 sends an integrity-protected AS Security Mode Command message 514 to the UE 106, which contains the selected AS integrity algorithm and AS encryption algorithm, and a message authentication code (MAC-I) generated by the gNB 302 for integrity protection of the AS Security Mode Command message 514. After sending the AS Security Mode Command message 514, RRC downlink encryption at the gNB 302 begins.

[0081] After receiving the AS security mode command message 514, UE 106 derives the RRC integrity key (K) similar to that of gNB 302 based on the selected AS integrity algorithm and AS encryption algorithm. RRCint ) and the RRC encryption key (K RRCenc ). UE 106 verifies the AS security mode command integrity and, if successful, starts RRC integrity protection and RRC downlink decryption. UE 106 then sends an AS security mode complete message 515 with integrity protection to gNB 302. AS security mode complete message 515 contains a MAC-I generated by UE 106 for integrity protection of the AS security mode complete message 515. After sending the AS security mode complete message 515, RRC uplink encryption at UE 106 begins. The integrity of the AS security mode complete message 515 is verified at gNB 302, and gNB 302 starts RRC uplink decryption.

[0082] In addition, as part of AS security, Figure 6 UP security activation is shown. AS UP integrity protection and ciphering activation is done using the RRC connection reconfiguration procedure as part of the DRB addition procedure. The RRC connection reconfiguration procedure (which is used to add DRBs) is performed after RRC security has been activated as part of the AS security mode command procedure. The gNB 302 sends an RRC connection reconfiguration message 611 to the UE 106 for UP security activation. The RRC connection reconfiguration message 611 contains an indication to activate UP integrity protection and UP ciphering for each DRB in accordance with the security policy. If UP integrity protection is activated for a DRB as indicated in the RRC connection reconfiguration message 611 and the gNB 302 does not have K UPint key, gNB 302 derives K UPint Key, and UP integrity protection for DRBs starts at gNB 302. Similarly, if UP ciphering is activated for DRBs as indicated in RRC Connection Reconfiguration message 611, and gNB 302 does not have K UPenc key, gNB 302 derives K UPenc keys, and UP encryption for DRB starts at gNB 302.

[0083] Upon receipt of the RRC connection reconfiguration message 611, the UE 106 verifies the RRC connection reconfiguration integrity protection. If successful, the UE 106 performs the following. When UP integrity protection is activated for DRBs as indicated in the RRC connection reconfiguration message 611 and the UE 106 does not have K UPint When the key is generated, UE 106 derives K UPint The key is used and UP integrity protection for DRBs begins at UE 106. Similarly, when UP ciphering is activated for DRBs as indicated in RRC connection reconfiguration message 611 and UE 106 does not have K UPenc When the key is generated, UE 106 derives K UPenc The key is set, and UP encryption for DRB starts at UE 106. UE 106 sends an RRC connection reconfiguration complete message 612 to gNB 302.

[0084] Figure 7 A key hierarchy 700 of a 5G system 100 is shown, such as 3GPP TS 33.501 (section 6.2). Authentication-related keys include the following keys: K 701 and CK / IK 702. The key hierarchy 700 includes the following keys: K AUSF 703, K SEAF 704, KAMF 705, K NASint 706, K NASenc 707, K N3IWF 708, K gNB 709, K RRCint 710, K RRCenc 711, K UPint 712 and K UPenc 713. The keys of the AUSF 210 in the home network 404 include K derived from CK', IK' by the ME of the UE 106 and the AUSF 210 in the case of EAP-AKA'. AUSF Key 703, or K derived from CK, IK 702 by the ARPF of ME and UDM 218 in the case of 5G AKA AUSF Key 703. K SEAF Key 704 is obtained by ME and AUSF 210 from K AUSF The anchor key derived from key 703. The key used for AMF 212 in the service network 406 is obtained by ME and SEAF 402 from K SEAF Key 704 derived K AMF Key 705. The keys used for NAS signalling (i.e., NAS security context) include the keys obtained by the ME and AMF 212 from K AMF Key 705 derived K NASint Key 706, which is used to protect the integrity of NAS signaling using a specific integrity algorithm. The keys used for NAS signaling also include the keys obtained by ME and AMF 212 from K AMF Key 705 derived K NASenc Key 707, which is used to encrypt NAS signaling using a specific encryption algorithm. The key used for NG-RAN is obtained by ME and AMF 212 from K AMF Key 705 derived K gNB Key 709. For the AS security context, the keys used for RRC signaling include the keys obtained by the ME and gNB 302 from K gNB Key 709 derived K RRCint Key 710, which is used to perform integrity protection on RRC signaling using a specific integrity algorithm. The key used for RRC signaling also includes the key obtained by ME and gNB 302 from K gNB Key 709 derived K RRCenc Key 711, which is used to encrypt RRC signaling using a specific encryption algorithm. The key used for UP services includes the key obtained by ME and gNB 302 from K gNB Key 709 derived K UPintKey 712, which is used to protect the integrity of UP services between ME and gNB 302 using a specific integrity algorithm. The key used for UP services also includes the key obtained by ME and gNB 302 from K gNB Key 709 derived K UPenc Key 713, which is used to encrypt UP services using a specific encryption algorithm. For non-3GPP access, K N3IWF Key 708 is obtained by ME and AMF 212 from K for non-3GPP access AMF Key 705 is derived. There are other keys in the key hierarchy 700 of the 5G system 100, which will not be discussed here for the sake of brevity.

[0085] As described above, the NG-RAN 502 may support satellite access to the UE 106, which is also referred to as non-terrestrial network (NTN) access. Figures 8A-8B The NTN-based NG-RAN architecture 800 is shown. A non-terrestrial network is a network or network segment that uses airborne or satellite-based aircraft to carry transmission equipment relay nodes or base stations. Figures 8A-8B In the NTN-based NG-RAN architecture 800, the NG-RAN 502 includes an NTN gateway 802, an NTN satellite 804, a feeder link 806 (or a radio link) between the NTN gateway 802 and the NTN satellite 804, and a service link 808 (or a radio link) between the UE 106 and the NTN satellite 804. The NTN gateway 802 includes a ground station or gateway located on the surface of the earth, which provides sufficient radio frequency (RF) power and RF sensitivity to access the NTN satellite 804. The NTN gateway 802 is connected to the 5GC 104. The NTN satellite 804 is a space vehicle placed in a low earth orbit (LEO), a medium earth orbit (MEO), or a geostationary orbit (GEO). The NTN satellite 804 can implement a transparent payload or a regenerative (with onboard processing) payload. The transparent payload performs RF filtering, frequency conversion, and amplification. Therefore, the waveform signal repeated by the transparent payload remains unchanged. The regenerative payload performs RF filtering, frequency conversion and amplification, as well as demodulation / decoding, switching and / or routing, and encoding / modulation. This is effectively equivalent to having all or part of the base station functionality (e.g., gNB) on the NTN satellite 804. Fig. 8A In the NG-RAN 502, the NG-RAN 502 is based on a transparent satellite. Therefore, the NTN satellite 804 implements a transparent payload 822, and the NG-RAN 502 includes a base station located on the ground (referred to as NTN gNB 824 or ground NTN gNB 824). Figure 8BIn the NG-RAN 502, the NG-RAN is based on a regenerative satellite. Therefore, the NTN satellite 804 implements the regenerative payload 832, and the NG-RAN 502 includes a base station (referred to as NTN gNB 834 or onboard NTN gNB 834) located on the NTN satellite 804. The NTN-based NG-RAN architecture is further described in 3GPP TR 38.821 (v16.2.0), which is incorporated herein by reference as if fully included herein.

[0086] In the embodiments described herein, the NG-RAN 502 (e.g., NTN satellite 804) and / or 5GC 104 are enhanced to provide local routing or local switching of data packets (e.g., signaling and / or user plane traffic) between UEs 106 via the NTN satellite 804. Fig. 9 1 shows local routing of data packets in an illustrative embodiment. A service link 808-1 is established between a UE 106-1 (i.e., a first UE) and an NTN satellite 804, and a service link 808-2 is established between another UE 106-2 (i.e., a second UE) and the NTN satellite 804. When the UE 106-1 issues or sends a data packet 940 to the NTN satellite 804, for example, via the service link 808-1, the NTN satellite 804 is configured to perform local routing by sending or forwarding the data packet 940 directly to the UE 106-2 on the service link 808-2, without routing the data packet 940 to the 5GC 104. In an embodiment, when the feeder link 806 to the NTN gateway 802 is unavailable, the NTN satellite 804 can be configured to perform local routing between the UEs 106-1 and 106-2.

[0087] Local routing via the NTN satellite 804 will be described in more detail below. Typically, these mechanisms are implemented via the NG-RAN node (e.g., NTN satellite 804), AMF 212, and UE 106. A block diagram of these elements is provided below.

[0088] Fig.101 is a block diagram of an NG-RAN node 1000 in an illustrative embodiment. An example of an NG-RAN node 1000 is an NTN satellite 804. In an embodiment, the NTN satellite 804 may include the following subsystems: a transponder 1002 and a communication controller 1004 operating on one or more platforms. The transponder 1002 may include circuitry, logic, hardware, components, etc. configured to send and receive wireless or radio signals. In an embodiment, the transponder 1002 includes one or more transmit (Tx) antennas 1010 configured to send wireless signals for reception by UE 106, NTN gateway 802, etc. The transponder 1002 also includes one or more receive (Rx) antennas 1012 configured to receive wireless signals sent by UE 106, NTN gateway 802, etc. The communication controller 1004 may include circuitry, logic, hardware, components, etc. configured to support operations, processes, or functions of the NTN satellite 804. For example, the communication controller 1004 may implement the regeneration payload 832. In one embodiment, the regeneration payload 832 may include the NTN gNB 834, the onboard NTN UPF 1028, etc.

[0089] One or more subsystems of the NTN satellite 804 may be implemented on a hardware platform comprised of analog and / or digital circuitry. One or more subsystems of the NTN satellite 804 may be implemented on one or more processors 1030 that execute instructions 1034 (i.e., computer readable code) for software loaded into memory 1032. The NTN satellite 804 may include Fig.10 Various other components not specifically shown in the figure. Another example of the NG-RAN node 1000 is a terrestrial network (TN) node.

[0090] Fig.111 is a block diagram of a UE 106 in an illustrative embodiment. From a functional perspective, the UE 106 consists of at least two parts: a mobile equipment (ME) 1100 and a universal subscriber identity module (USIM) 1160. The ME 1100 includes a radio interface component 1102, one or more processors 1104, a memory 1106, and a user interface component 1108. The UE 106 may also include a battery 1110. The radio interface component 1102 is a hardware component or component representing the local radio resources of the UE 106, such as a radio frequency (RF) unit 1120 (e.g., one or more radio transceivers) and one or more antennas 1122. The radio interface component 1102 may be configured for 5G New Radio (NR), Long Term Evolution (LTE), WiFi, Bluetooth, etc. The processor 1104 represents the internal circuit system, logic, hardware, components, etc. that provide the functions of the UE 106. The processor 1104 may be configured to execute instructions 1140 for software loaded into the memory 1106. The processor 1104 may execute an operating system (OS) 1134 and one or more application clients 1135 of the UE 106 for managing hardware and software resources. The processor 1104 may also execute a security controller 1136, which includes components or devices for executing security mechanisms within the UE 106 (i.e., within the ME 1100). The user interface component 1108 is a hardware component for interacting with an end user. For example, the user interface component 1108 may include a display 1150, a screen, a touch screen, etc. (e.g., a liquid crystal display (LCD), a light emitting diode (LED) display, etc.). The user interface component 1108 may include a keyboard or keypad, a tracking device (e.g., a trackball or a touchpad), a speaker, a microphone, etc.

[0091] The USIM 1160 is an integrated circuit that provides security and integrity functions for the UE 106. The USIM 1160 includes or is configured with a subscription profile associated with a subscriber's subscription. The subscription profile may include various information, such as subscription credentials (e.g., SUPI) used to uniquely identify the subscription and mutually authenticate the UE 106 and the network.

[0092] UE 106 may include Fig.11 Various other components not specifically shown.

[0093] Fig.122 is a block diagram of the AMF 212 in an illustrative embodiment. The AMF 212 is a network element or network function configured to provide registration management for the UE. In this embodiment, the AMF 212 includes the following subsystems: a network interface component 1202 and an access and mobility controller 1204 operating on one or more platforms. The network interface component 1202 may include circuit systems, logic, hardware, components, etc., configured to exchange control plane messages or signaling with other network elements and / or UEs. The network interface component 1202 may operate using various protocols or reference points. The access and mobility controller 1204 may include circuit systems, logic, hardware, components, etc., configured to support the operations, processes or functions of the AMF.

[0094] One or more subsystems of AMF 212 may be implemented on a hardware platform consisting of analog and / or digital circuits. One or more subsystems of AMF 212 may be implemented on one or more processors 1230 that execute instructions 1234 (i.e., computer readable code) for software loaded into memory 1232. One or more subsystems of AMF 212 may be implemented on a cloud computing platform or another type of processing platform.

[0095] The AMF 212 may include Fig.12 Various other components not specifically shown.

[0096] Fig.13 is a flow chart showing a method 1300 of performing local routing in the NG-RAN 502 in an illustrative embodiment. Fig.13 The steps of method 1300 will refer to Fig.10 The NTN satellite 804 shown in is described. Those skilled in the art will appreciate that the method 1300 may be performed in other systems, devices, or network functions. For example, the method 1300 may be performed in a terrestrial RAN node of the NG-RAN 502. The steps of the flowchart described herein are not all inclusive and may include other steps not shown, and these steps may be performed in an alternative order.

[0097] For method 1300, NTN satellite 804 is operatively or communicatively coupled to UE 106-1 and UE 106-2 via service links 808 (ie, service links 808-1 and 808-2). Fig.14A local routing scenario in an illustrative embodiment is shown. The communication controller 1004 of the NTN satellite 804 stores a UE context 1402 for each UE 106-1 and 106-2, which is indicated as UE context 1402-1 and UE context 1402-2. The UE context 1402 is an information block associated with (one) active UE 106. The information block may contain information required to maintain 5G services for the active UE 106. For example, the UE context 1402 may contain UE state information, security information, UE capability information, identification, etc.

[0098] exist Fig.13 , the communication controller 1004 of the NTN satellite 804 receives and / or stores a UE context mapping 1404 between the UE context 1402-1 of the UE 106-1 and the UE context 1402-2 of the UE 106-2 (step 1302). For example, the communication controller 1004 may receive a context management message indicating the UE context mapping 1404 from the AMF 212 (optional step 1303). The UE context mapping 1404 (also referred to as UE context mapping information, UE context mapping configuration, etc.) includes information that associates one UE context 1402 with another UE context 1402. The UE context mapping 1404 may be stored in / with the UE context 1402. For example, a UE context mapping 1404 to the UE context 1402-2 associated with the UE 106-2 may be stored in the UE context 1402-1 associated with the UE 106-1, and vice versa.

[0099] Communications controller 1004 receives an incoming communication including one or more data packets 940 from UE 106-1 via service link 808-1 (step 1304). Data packet 940 is addressed or destined for UE 106-2. For example, data packet 940 may include RRC signaling 1410 or UP traffic 1412. In response to receiving data packet 940, communications controller 1004 may verify the integrity of data packet 940 (if integrity protected) based on an integrity key indicated in UE context 1402-1 of UE 106-1, and / or decrypt data packet 940 (if encrypted) based on an encryption key indicated in UE context 1402-1 of UE 106-1 (optional step 1306).

[0100] The communication controller 1004 determines whether to perform local routing of the data packet 940 (step 1308) without routing to the network (e.g., 5GC 104). For example, the communication controller 1004 may process the UE context 1402 for the UE 106-1 and / or the UE 106-2 to determine whether local routing is allowed or available, may determine the status or availability of the feeder link 806, may determine the status or availability of the service link 808-2 to the UE 106-2, may process local configuration or policy, and / or may process other information to determine whether to perform local routing. In response to the determination not to perform local routing, the communication controller 1004 routes, sends, or forwards the data packet 940 to the network (e.g., NTN gateway 802, 5GC 104, etc.) via the feeder link 806 (step 1310).

[0101] In response to determining to perform local routing, the communications controller 1004 routes, sends, or forwards the data packet 940 to the UE 106-2 via the service link 808-2 based on the UE context mapping 1404 (step 1314). When local routing is performed in this manner, the communications controller 1004 does not route the data packet 940 to the network because the data packet 940 is routed directly to the UE 106-2 via the service link 808-2. When routing the data packet 940 directly, the communications controller 1004 may perform integrity protection on the data packet 940 based on the integrity key indicated in the UE context 1402-2 of the UE 106-2, and / or may perform encryption on the data packet 940 based on the encryption key indicated in the UE context 1402-2 of the UE 106-2 (optional step 1312).

[0102] In one embodiment, the communication controller 1004 determines whether to perform local routing based on the status of the feeder link 806 . Fig.15 1502. The communication controller 1004 determines whether a feeder link 806 to a network (e.g., 5GC 104) is available (step 1502). The feeder link 806 may become unavailable or disconnected due to movement of the NTN satellite 804, hardware or software outages, weather, and / or other conditions. When the feeder link 806 is unavailable, the communication controller 1004 makes a determination or decision to perform local routing (step 1504). When the feeder link 806 is available, the communication controller 1004 makes a determination or decision to perform home network routing by routing the data packet 940 to the network through the feeder link 806 (step 1506).

[0103] In one embodiment, the NTN satellite 804 is configured to forward the UE context map 1404 to another NTN satellite 804 for mobile scenarios. For example, the NTN satellite 804 may be moving and / or the UE 106 may be moving, such that the NTN satellite 804 cannot serve the UE 106. Fig.16 Inter-satellite communications in an illustrative embodiment are shown. Fig.16 It is assumed that the NTN satellite 804 hands over the sessions of UEs 106 - 1 and 106 - 2 to the target NTN satellite 1604 . Fig.17 1 is a flow chart illustrating a method 1700 of forwarding a UE context map 1404 in a mobile scenario in an illustrative embodiment. The communication controller 1004 identifies a scenario for handover to another (target) NTN satellite 1604 (step 1702). For example, when the UE's coverage of UEs 106-1 and 106-2 has decreased below a threshold, the communication controller 1004 may initiate a handover to the target NTN satellite 1604. The communication controller 1004 forwards the UE context map 1404 to the target NTN satellite 1604 (step 1704). For example, the communication controller 1004 may forward the UE context map 1404 to the target NTN satellite 1604 via an inter-satellite link 1610. In another example, the communication controller 1004 may forward the UE context map 1404 to the target NTN satellite 1604 via a feeder link 806 (i.e., feeder links 806-1 and 806-2) and an NTN gateway 802. The communications controller 1004 may forward the UE context 1402 for the UE 106 to the target NTN satellite 1604 (in step 1704 ), which also includes the UE context map 1404 .

[0104] Control Plane

[0105] Figures 18A-18B FIG. 1 shows local routing of control plane messages in an illustrative embodiment. Fig.18A, UE 106-1 sends an (uplink) control plane message 1840 (e.g., RRC signaling 1410) to NTN satellite 804 via service link 808-1. NTN gNB 834 of NTN satellite 804 receives control plane message 1840 and may verify the integrity of control plane message 1840 (if integrity is protected) based on the integrity key indicated in UE context 1402-1 of UE 106-1. NTN gNB 834 may also decrypt control plane message 1840 (if encrypted) based on the encryption key indicated in UE context 1402-1 of UE 106-1. NTN gNB 834 determines whether to perform local routing of control plane message 1840. For example, NTN gNB 834 determines whether feeder link 806 to ground network 1804 (e.g., NTN gateway 802 and / or 5GC 104) is available. In this embodiment, the feeder link 806 is available, so the NTN gNB 834 forwards the control plane message 1840 to the ground network 1804 (e.g., AMF 212) via the feeder link 806. The NTN gNB 834 may integrity protect and / or cipher the control plane message 1840 based on the integrity key and ciphering key indicated in the UE context 1402-1 of the UE 106-1 before sending it via the feeder link 806. The AMF 212 processes the control plane message 1840 and sends the control plane message 1840 to the NTN gNB 834 via the feeder link 806. The NTN gNB 834 receives the control plane message 1840 and may verify the integrity of the control plane message 1840 based on the integrity key indicated in the UE context 1402-2 of the UE 106-2 (if integrity protection is protected). The NTN gNB 834 may also decrypt the control plane message 1840 (if encrypted) based on the encryption key indicated in the UE context 1402-2 of the UE 106-2. The NTN gNB 834 forwards the (downlink) control plane message 1840 to the UE 106-2 via the service link 808-2. The NTN gNB 834 may integrity protect and / or encrypt the control plane message 1840 based on the integrity key and the encryption key indicated in the UE context 1402-2 of the UE 106-2 before sending it via the service link 808-2.

[0106] exist Fig.18B1402-2 of the UE context 1402-2. A technical advantage is that the NTN satellite 804 can route the control plane message 1840 directly to the UE 106-2 without passing through the ground network 1804.

[0107] Fig.19 A control plane protocol stack 1900 in an illustrative embodiment is shown. The control plane protocol stack 1900 allows a 5G access network (5G-AN) (e.g., NTN gNB 834 on NTN satellite 804) to locally route control plane messages 1840 between two UEs 106. The control plane protocol stack 1900 may include enhancements or extensions to 3GPP TS 23.501 (section 8.2).

[0108] Fig. 20 2 is a message diagram illustrating local routing of control plane messages in an illustrative embodiment. UE 106-2 (also referred to as UE#2) performs primary authentication and sends a local routing support indicator 2001 to the network during an initial registration process, and may also send location information. Local routing support indicator 2001 indicates whether the UE supports local routing of data packets, whether a subscription associated with the UE allows local routing, etc. Local routing support indicator 2001 may also be referred to as a DATA_EXCHANGE_AT_SAT_LEVEL flag, a LOCAL_DATA_EXCHANGE support flag, etc. When the primary authentication of UE 106-2 succeeds, UDM 218 authorizes satellite-level data exchange. Similarly, UE 106-1 (also referred to as UE#1) performs primary authentication and sends a local routing support indicator 2001 to the network during an initial registration process, and may also send location information. When the primary authentication of UE 106-1 succeeds, UDM 218 authorizes satellite-level data exchange.

[0109] The network configures the NTN satellite 804 with a UE context mapping 1404 between the UE context 1402-1 of the UE 106-1 and the UE context 1402-2 of the UE 106-2. For example, the AMF 212 may send a context management message to the NTN satellite 804 indicating the UE context mapping 1404, such as an initial context setup request. The UE 106-1 and the UE 106-2 establish separate RRC connections with the NTN satellite 804 for data exchange. The NTN satellite 804 will enable local data exchange based on the UE context mapping 1404.

[0110] When UE 106-1 initiates communication of data packets with UE 106-2, UE 106-1 uses the RRC key for UE 106-1 (ie, K RRCint Key 710 and K RRCenc The data packet is encrypted and integrity protected using the key 711. The UE 106-1 sends the encrypted data packet (ie, the RRC data packet) to the NTN satellite 804 via the service link 808-1.

[0111] In response to receiving the data packet, the NTN satellite 804 (i.e., the NTN gNB 834) verifies the integrity of the data packet based on the RRC integrity key and decrypts the data packet based on the RRC encryption key indicated in the UE context 1402-1 of the UE 106-1. The NTN satellite 804 determines whether to perform local routing of the data packet. When the feeder link 806 is not available, the NTN satellite 804 determines that local routing or local switching of the data packet has been activated or enabled based on the UE context mapping 1404. The NTN satellite 804 integrity protects the data packet based on the RRC integrity key and encrypts the data packet based on the RRC encryption key indicated in the UE context 1402-2 of the UE 106-2. Then, the NTN satellite 804 routes, sends, or forwards the data packet to the UE 106-2 via the service link 808-2 based on the UE context mapping 1404. When local routing is performed in this manner, the NTN satellite 804 does not route data packets to the network because the data packets are routed directly to the UE 106-2 via the service link 808-2. The UE 106-2 verifies the integrity of the data packets and decrypts the data packets based on the RRC key. One technical advantage is that the NTN satellite 804 routes the data packets directly to the UE 106-2 without passing through the network. Therefore, even if the feeder link 806 is disconnected, the data packets can be routed to the UE 106-2.

[0112] When the feeder link 806 is available, the NTN satellite 804 determines that the local routing or local switching of the data packets is inactive or disabled, and the home network routing is activated. The NTN satellite 804 determines that the local routing or local switching of the data packets is inactive or disabled, and the home network routing is activated. NASint 706) integrity protects the data packet and based on the NAS encryption key (e.g., K NASenc 707) encrypts the data packet. NTN satellite 804 then routes, sends or forwards the data packet to AMF 212 via feeder link 806. AMF 212 verifies the integrity of the data packet based on the NAS integrity key, and decrypts the data packet based on the NAS encryption key indicated in UE context 1402-1 of UE 106-1. AMF 212 then integrity protects the data packet based on the NAS integrity key, encrypts the data packet based on the NAS encryption key indicated in UE context 1402-2 of UE 106-2, and sends the data packet to NTN satellite 804 via feeder link 806. NTN satellite 804 verifies the integrity of the data packet based on the NAS integrity key indicated in UE context 1402-2 of UE 106-2, and encrypts the data packet based on the RRC encryption key indicated in UE context 1402-2 of UE 106-2. The NTN satellite 804 then routes, sends, or forwards the data packet to the UE 106-2 via the service link 808-2. The UE 106-2 verifies the integrity of the data packet based on the RRC and NAS keys and decrypts the data packet.

[0113] User Plane

[0114] Figures 21A-21B FIG. 1 shows local routing of user plane messages in an illustrative embodiment. Fig.21A, UE 106-1 sends an (uplink) user plane message 2140 (e.g., UP service 1412) to NTN satellite 804 via service link 808-1. NTN gNB 834 of NTN satellite 804 receives user plane message 2140 and forwards user plane message 2140 to NTN UPF 1028. NTN UPF 1028 may verify the integrity of user plane message 2140 based on the integrity key indicated in UE context 1402-1 of UE 106-1 (if integrity is protected). NTN UPF 1028 may also decrypt user plane message 2140 based on the encryption key indicated in UE context 1402-1 of UE 106-1 (if encrypted). NTN UPF 1028 determines whether to perform local routing of user plane message 2140. For example, the NTN UPF 1028 determines whether a feeder link 806 to the ground network 1804 (e.g., the NTN gateway 802 and / or the 5GC 104) is available. In this embodiment, the feeder link 806 is available, so the NTN UPF 1028 forwards the user plane message 2140 to the ground network 1804 (e.g., the UPF 240) via the feeder link 806. The NTN UPF 1028 may integrity protect and / or encrypt the user plane message 2140 based on the integrity key and encryption key indicated in the UE context 1402-1 of the UE 106-1 before sending it via the feeder link 806. The UPF 240 processes the user plane message 2140 and sends the user plane message 2140 to the NTN UPF 1028 via the feeder link 806. The NTN UPF 1028 receives the user plane message 2140 and may verify the integrity of the user plane message 2140 (if integrity protected) based on the integrity key indicated in the UE context 1402-2 of the UE 106-2. The NTN UPF 1028 may also decrypt the user plane message 2140 (if encrypted) based on the encryption key indicated in the UE context 1402-2 of the UE 106-2. The NTN UPF 1028 forwards the (downlink) user plane message 2140 to the UE 106-2 over the service link 808-2. The NTN UPF 1028 may integrity protect and / or encrypt the user plane message 2140 based on the integrity key and encryption key indicated in the UE context 1402-2 of the UE 106-2 before sending over the service link 808-2.

[0115] exist Fig. 21BIn the example embodiment, the feeder link 806 is not available, so the NTN UPF 1028 forwards the (downlink) user plane message 2140 to the UE 106-2 via the service link 808-2. The NTN UPF 1028 may perform integrity protection and / or encryption on the user plane message 2140 based on the integrity key and encryption key indicated in the UE context 1402-2 of the UE 106-2 before sending it via the service link 808-2. One technical advantage is that the NTN satellite 804 may route the user plane message 2140 directly to the UE 106-2 without passing through the ground network 1804.

[0116] Fig. 22 A user plane protocol stack 2200 in an illustrative embodiment is shown. The user plane protocol stack 2200 allows a 5G-AN (e.g., NTN UPF 1028 on NTN satellite 804) to locally route user plane messages between two UEs 106. The 5G-AN shown twice is the same instance, but for clarity, is shown as two 5G-ANs towards two UEs. The user plane protocol stack 2200 may include enhancements or extensions to 3GPP TS 23.501 (section 8.2).

[0117] Fig.23 2 is a message diagram illustrating local routing of user plane messages in an illustrative embodiment. When UE 106-1 initiates communication of a data packet (i.e., user plane data packet 2140) to UE 106-2, UE 106-1 uses the UP key for UE 106-1 (i.e., K UPint Key 712 and K UPenc The data packets are encrypted and integrity protected using the key 713. The UE 106-1 sends the encrypted data packets to the NTN satellite 804 via the service link 808-1.

[0118] In response to receiving the data packet, the NTN satellite 804 (i.e., the NTN UPF 1028) verifies the integrity of the data packet based on the UP integrity key and decrypts the data packet based on the UP encryption key indicated in the UE context 1402-1 of the UE 106-1. The NTN satellite 804 determines whether to perform local routing of the data packet. When the feeder link 806 is not available, the NTN satellite 804 determines that local routing or local switching of the data packet has been activated or enabled based on the UE context mapping 1404. The NTN satellite 804 integrity protects the data packet based on the UP integrity key and encrypts the data packet based on the UP encryption key indicated in the UE context 1402-2 of the UE 106-2. Then, the NTN satellite 804 routes, sends, or forwards the data packet to the UE 106-2 via the service link 808-2 based on the UE context mapping 1404. When local routing is performed in this manner, the NTN satellite 804 does not route data packets to the terrestrial network because the data packets are routed directly to the UE 106-2 via the service link 808-2. The UE 106-2 verifies the integrity of the data packets and decrypts the data packets based on the UP key. One technical advantage is that the NTN satellite 804 routes the data packets directly to the UE 106-2 without passing through the network. Therefore, even if the feeder link 806 is disconnected, the data packets can be routed to the UE 106-2.

[0119] When the feeder link 806 is available, the NTN satellite 804 determines that the local routing or local switching of the data packet is inactive or disabled, and the home network routing is activated. The NTN satellite 804 integrity protects and encrypts the data packet based on the UP key indicated in the UE context 1402-1 of the UE 106-1. The NTN satellite 804 then routes, sends, or forwards the data packet to the UPF 240 via the feeder link 806. The UPF 240 verifies the integrity of the data packet based on the UP integrity key, and decrypts the data packet based on the UP encryption key indicated in the UE context 1402-1 of the UE 106-1. The UPF 240 then integrity protects the data packet based on the UP integrity key, and encrypts the data packet based on the UP encryption key indicated in the UE context 1402-2 of the UE 106-2, and sends the data packet to the NTN satellite 804 via the feeder link 806. NTN satellite 804 verifies the integrity of the data packet based on the UP integrity key indicated in UE context 1402-2 of UE 106-2, and encrypts the data packet based on the UP encryption key indicated in UE context 1402-2 of UE 106-2. NTN satellite 804 then forwards, sends, or routes the data packet to UE 106-2 via service link 808-2. UE 106-2 verifies the integrity of the data packet based on the UP key and decrypts the data packet.

[0120] Mapping Configuration

[0121] The AMF 212 of the 5G system 100 may configure the NTN satellite 804 (or other NG-RAN node 1000) using the UE context map 1404, such as by sending a context management message to the NTN satellite 804. For example, the AMF 212 may use the UE context management procedure as described in 3GPP TS 38.413 (v17.6.0), which is incorporated herein by reference as if fully included herein, to provide the UE context map 1404 to the NG-RAN node 1000. Fig.24The initial context setup procedure in an illustrative embodiment is shown. In one embodiment, the initial context setup procedure described in section 8.3.1.1 of 3GPP TS 38.413 may be extended to indicate a UE context mapping 1404. The purpose of the initial context setup procedure is to establish the necessary overall initial UE context at the NG-RAN node 1000, including PDU session context, security keys, mobility restriction list, UE radio capabilities, and UE security capabilities, etc., when needed. The AMF 212 sends an initial context setup request message 2411 to the NG-RAN node 1000 (e.g., NTN satellite 804). In one embodiment, the initial context setup request message 2411 contains a UE context mapping 1404 between UE contexts 1402. Upon receipt of the initial context setup request message 2411, the NG-RAN node 1000 stores the UE context mapping 1404 in the UE context 1402 of the applicable UE 106. The UE context map 1404 may be used when the feeder link 806 towards the AMF 212 or 5GC 104 is lost or unavailable in the case of the NTN satellite 804. The UE context map 1404 may also be used for terrestrial networks. Upon successful operation, the NG-RAN node 1000 responds to the AMF 212 with an initial context setup response message 2412. One technical advantage is that the AMF 212 is able to configure the NG-RAN node 1000 with the UE context map 1404 using an enhanced initial context setup procedure.

[0122] Fig.25 An initial context setup request message 2411 in an illustrative embodiment is shown. As shown in section 9.2.2.1 of 3GPP TS 38.413, the message content of the initial context setup request message 2411 includes information elements (IEs) such as message type, AMF UE NG application protocol (NGAP) ID, RAN UE NGAP ID, etc. In an embodiment, the initial context setup request message 2411 may be extended to include a UE context mapping IE 2502 that carries or includes the UE context mapping 1404. One technical advantage is that the initial context setup request message 2411 can indicate the UE context mapping 1404 to the NG-RAN node 1000.

[0123] Fig.26A UE context modification procedure in an illustrative embodiment is shown. In an embodiment, the UE context modification procedure described in section 8.3.4.2 of 3GPP TS 38.413 may be extended to indicate a UE context mapping 1404. The purpose of the UE context modification procedure is to partially modify an established UE context and use signaling associated with the UE. The AMF 212 sends a UE context modification request message 2611 to the NG-RAN node 1000 (e.g., NTN satellite 804). In an embodiment, the UE context modification request message 2611 contains an update or modification to the UE context mapping 1404. For example, if a feeder link 806 is present, the AMF 212 may disable the UE context mapping 1404 between the two UE contexts (i.e., indicate that the mapping is "not allowed"). Upon successful operation, the NG-RAN node 1000 responds to the AMF 212 with a UE context modification response 2612. One technical advantage is that the AMF 212 is able to modify the UE context mapping 1404 in the NG-RAN node 1000 using an enhanced UE context modification procedure.

[0124] Fig. 27 A UE context modification request message 2611 in an illustrative embodiment is shown. As shown in section 9.2.2.7 of 3GPP TS 38.413, the message content of the UE context modification request message 2611 includes IEs such as message type, AMF UE NGAP ID, RAN UE NGAP ID, etc. In an embodiment, the UE context modification request message 2611 may be extended to include a UE context mapping IE 2702 that modifies the UE context mapping 1404. One technical advantage is that the UE context modification request message 2611 is able to modify the UE context mapping 1404 at the NG-RAN node 1000.

[0125] Figures 28A-28C A mapping of UE context 1402 in an illustrative embodiment is shown. Figures 28A-28C UE contexts 1402 for UE 106-1 and UE 106-2 (i.e., UE context A and UE context B) are shown. A UE context mapping 1404 is stored in each UE context 1402. For example, the UE context mapping 1404 may indicate whether local routing is allowed for the corresponding UE 106, whether mapping is available, and if so, a mapping link 2810 or mapping configuration to another UE context 1402. For example, in Fig.28A In , the mapping link 2810 may include a radio network temporary identifier (RNTI) 2812 associated with another UE context 1402 or assigned to another UE 106. For example, in Fig.28BIn the example, the mapping link 2810 may include a UE RAN ID 2814 (i.e., RANUE NGAP ID) associated with or assigned to another UE context 1402. Fig.28B In the example, the mapping link 2810 may include a UE RAN ID 2814 (i.e., RAN UE NGAP ID) associated with or assigned to another UE context 1402. Fig.28C In the example, mapping link 2810 may include a newly defined mapping ID 2816 associated with another UE context 1402 or assigned to another UE 106. Figures 28A-28C , but UE context 1402 and UE context map 1404 may contain other information as needed.

[0126] Any of the various elements or modules shown in the figure or described herein can be implemented as hardware, software, firmware or some combination of these. For example, an element can be implemented as special hardware. Special hardware elements can be referred to as "processors", "controllers" or some similar terms. When provided by a processor, functions can be provided by a single special processor, a single shared processor or a plurality of separate processors, some of which can be shared. In addition, the explicit use of the term "processor" or "controller" should not be interpreted as referring only to hardware capable of executing software, and may implicitly include but is not limited to digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC) or other circuit systems, field programmable gate array (FPGA), read-only memory (ROM) for storing software, random access memory (RAM), non-volatile memory, logic or some other physical hardware components or modules.

[0127] In addition, the element can be implemented as an instruction that can be executed by a processor or computer to perform the function of the element. Some examples of instructions are software, program code, and firmware. The instructions are operable when executed by the processor to instruct the processor to perform the function of the element. The instructions can be stored on a storage device that can be read by the processor. Some examples of storage devices are digital or solid-state memory, magnetic storage media (such as disks and tapes), hard drives, or optically readable digital data storage media.

[0128] As used in this application, the term "circuitry" may refer to one or more or all of the following:

[0129] (a) hardware circuit implementation only (such as implementation only in analog and / or digital circuitry);

[0130] (b) a combination of hardware circuitry and software such as (where applicable):

[0131] (i) a combination of analog and / or digital hardware circuits and software / firmware; and

[0132] (ii) any portion of hardware processor(s) with software (including digital signal processor(s), software and memory(s) that work together to enable a device (such as a mobile phone or server) to perform various functions; and

[0133] (c) Hardware circuits and / or processor(s), such as microprocessor(s) or portions of microprocessor(s), that require software (e.g., firmware) to operate, but the software may not be present when the software is not required for operation.

[0134] This definition of circuitry applies to all uses of the term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example, a baseband integrated circuit or processor integrated circuit of a mobile device or a similar integrated circuit in a server, cellular network device, or other computing or network device, if applicable to the particular claim element.

[0135] Although specific embodiments are described herein, the scope of the disclosure is not limited to those specific embodiments.The scope of the disclosure is defined by the following claims and any equivalents thereof.

Claims

1. A device for a radio access network, the device comprising: a non-terrestrial network satellite operably coupled to the first user device and the second user device; The non-terrestrial network satellite includes components for: storing a user equipment context mapping between a first user equipment context of the first user equipment and a second user equipment context of the second user equipment; receiving a data packet from a first user equipment via a first service link; determining whether to perform local routing of the data packet without routing to a terrestrial network; as well as In response to determining to perform local routing, the data packet is sent to the second user equipment over a second service link based on the user equipment context mapping.

2. The apparatus according to claim 1, further comprising means for: determining whether a feeder link to the terrestrial network is available; and When the feeder link is unavailable, it is decided to perform the local routing.

3. The apparatus of claim 1, further comprising means for: Before sending to the second user equipment, the data packet is integrity protected based on an integrity key indicated in the second user equipment context of the second user equipment.

4. The apparatus of claim 1, further comprising means for: Before sending to the second user equipment, the data packet is encrypted based on an encryption key indicated in the second user equipment context of the second user equipment.

5. The apparatus of claim 1, further comprising means for: Identify handoff scenarios to another non-terrestrial network satellite; and The user equipment context map is forwarded to the other non-terrestrial network satellite via an inter-satellite link.

6. A method for performing local routing in a radio access network, the method comprising: storing, at a non-terrestrial network satellite operably coupled to a first user equipment and a second user equipment, a user equipment context mapping between a first user equipment context of the first user equipment and a second user equipment context of the second user equipment; receiving, at the non-terrestrial network satellite, a data packet from the first user equipment via a first service link; determining, at the non-terrestrial network satellite, whether to perform local routing of the data packet without routing to a terrestrial network; as well as In response to determining to perform local routing, the data packet is sent from the non-terrestrial network satellite to the second user equipment over a second serving link based on the user equipment context mapping.

7. The method of claim 6, wherein the determining whether to perform local routing of the data packet comprises: determining whether a feeder link to the terrestrial network is available; as well as When the feeder link is unavailable, it is decided to perform the local routing.

8. The method according to claim 6, further comprising: Before sending to the second user equipment, the data packet is integrity protected based on an integrity key indicated in the second user equipment context of the second user equipment.

9. The method according to claim 6, further comprising: Before sending to the second user equipment, the data packet is encrypted based on an encryption key indicated in the second user equipment context of the second user equipment.

10. The method according to claim 6, further comprising: Identify handover scenarios to another non-terrestrial network satellite; as well as The user equipment context map is forwarded to the other non-terrestrial network satellite via an inter-satellite link.

Images