Master key change

Abstract

Among other things, a method is disclosed, the method comprising: receiving, from a first network entity, an indicator indicating a group of cells provided by the network entity; determining, based on an indicator indicating that the cell group is provided by the second network entity, whether a master key for establishing a security context with the second network entity via the cell group is to be changed; generating a master key in response to determining that the master key is to be changed; an indication of the master key is sent to a second network entity. It is further disclosed in accordance with an apparatus and a network entity, a computer program and a system.

Description

Technical Field

[0001] The following disclosure relates to the field of communication technology, particularly communication networks, and especially wireless communication networks. This disclosure relates to the supply of master keys in wireless communication networks, particularly master keys used for communication between user equipment and secondary nodes. Background Technology

[0002] Typically, in 5G systems and modern communication technologies, user equipment (UE) needs to access network nodes multiple times. For any access and / or communication session after access, encryption of sent and / or received messages is used to protect communication from attacks by third parties. This encryption requires coordination between the network node and the UE so that they can decrypt encrypted messages received from other corresponding entities. In particular, both parties (UE and network node) need to be informed of the (cryptographic) key used to decrypt messages received from another corresponding entity. Summary of the Invention

[0003] Network nodes in modern wireless communication networks can be configured as primary nodes (MNs) and secondary nodes (SNs). User equipment (UEs) can communicate with the MN alone (so-called single connectivity) and can also communicate with at least one (e.g., serving) SN (so-called dual connectivity). Dual connectivity can specifically refer to multi-RAT dual connectivity (MR-DC), such as EN-DC (E-UTRA-NR dual connectivity), NR-DC (New Radio Dual Connectivity), NGEN-DC (NG-RAN-E-UTRA Dual Connectivity), and NE-DC (NR-E-UTRA Dual Connectivity).

[0004] The following disclosure specifically relates to, but is not limited to, UE access to the MN (particularly during UE handover to the MN and / or selective activation of the MN). When UE access to or communication with the MN is disclosed, UE handover to the MN, particularly selective activation of the MN to which the UE hands over, is also disclosed. The MN may be connected to at least one SN via a network interface, and at least the MN may be connected to the core network.

[0005] A corresponding node can provide at least one or more cells. For example, an MN can provide a primary cell group (MCG) comprising at least one primary cell (PCell) and / or at least one secondary cell (SCell). A PCell can be the cell through which the device performs initial access to the network (e.g., the serving cell). The PCells included in the MCG and the SCells included in the MCG can be combined using carrier aggregation (CA) technology. In a single-connectivity scenario, the MCG may consist only of the serving cell (which can be referred to as a PCell in this scenario because there are no other cells in the MCG), or more generally, the cell group may therefore include only one cell.

[0006] Conditional handover (CHO) procedures enable devices (such as User Equipment (UE)) to autonomously trigger handover when specific conditions (CHO conditions) are met. In Conditional PSCell Addition (CPA) or Conditional PSCell Change (CPC), when a UE selects a target PSCell from candidate cells, it can initiate random access to the selected target PSCell, allowing unused CPC / CPA settings to be released. This prevents the UE from performing subsequent CPCs without network reconfiguration and reinitialization. This can be enhanced by New Radio Dual Connectivity with Selective Activation of Cell Group (NR-DC) or Subsequent Conditional PSCell Addition or Change (S-CPAC), which allows for network reconfiguration and reinitialization of CPC / CPA preparations after changing the SCG.

[0007] The exemplary aspects and embodiments of this disclosure may particularly relate to subsequent CHO (S-CHO) mobility scenarios and / or selective activation of MCG.

[0008] In MSC Selective Activation or S-CHO, successive cell changes by the device can occur, making it possible that the source cell from which a handover to the target cell can be triggered may not be known in advance. The target K_gNB (T-K_gNB) may not be pre-configured for selective activation because it may depend on a previous key, and this is not inherently known; or multiple T-K_gNBs may be configured, but it may be unclear which key to use for the incoming handover. Furthermore, depending on anchor point changes, it may be necessary to determine the change in the master key. In the case of subsequent mobility, it is only known at the time of the cell change whether it is between nodes with the same anchor point or between different points. Therefore, dynamic use of a new key may be required in this situation.

[0009] The first network entity may, for example, identify several candidate target cells for the device, wherein the candidate target cells may be provided by the first network entity or the second network entity, and configure the network entity (first network entity or second network entity) that provides the candidate target cells, for example, for conditional handover execution by the device (e.g., UE). If the device determines to perform a conditional handover to a (configured) target cell provided by one of the network entities based, for example, on a handover condition (e.g., a measurement exceeding a threshold), the configuration of the remaining candidate target cells (identified and configured by the first network entity) may be maintained by the corresponding network entity that provided the aforementioned candidate target cells. If the device subsequently determines to perform a conditional handover to another (configured) target cell provided by one of the network entities based, for example, on a handover condition (e.g., a measurement exceeding a threshold), it may do so based on the configuration provided by the first network entity. Therefore, the candidate target cells may not be reconfigured after each handover. However, for example, if a master key-based security context needs to be established between the device and the network entity providing the target cells, particularly for subsequent conditional handovers, it may be necessary to prepare the master key before the device performs the handover.

[0010] In view of the above, the example embodiments of this disclosure can have the following effects: enabling the user equipment to securely provide a new master key to the network, allowing subsequent cell handovers, without the UE having to generate a key on each handover. Example aspects and embodiments can enable secure key changes to the master key during subsequent mobility without reconfiguration, and / or enable dynamic use of the new master key, and / or selectively activate master key changes for the primary cell group (MCG) during subsequent mobility. In particular, any example embodiment of this disclosure can allow enhanced signaling.

[0011] According to the first example aspect, an apparatus is disclosed, the apparatus comprising: - A component for receiving from a first network entity an indicator (e.g., master key group ID) that indicates a cell group provided by the network entity; - A component used to determine, based on an indicator provided by a second network entity to the cell group, whether the master key used to establish a security context with the second network entity via the cell group should be changed. - A component used to generate a master key in response to determining that the master key is to be changed; - A component used to send an instruction for the master key to a second network entity.

[0012] The device may be, for example, a mobile entity, or include a mobile entity (e.g., a mobile telecommunications device or a mobile phone or a user equipment (UE) or a terminal device).

[0013] According to the second example aspect, a (first) network entity (e.g., a master node serving a cell or a primary cell group for a device) is disclosed, the network entity comprising: - A component used to identify at least one candidate target cell for the device; - A component for assigning at least one identified candidate target cell to a cell group (e.g., to obtain at least a cell group provided by a second network entity) based on which network entity provides at least one identified candidate target cell and / or based on a PDCP anchor point; - A component for obtaining, based on cell groups, an indicator (e.g., a cell group provided by a second network entity) of an indication cell group (e.g., a cell group provided by a second network entity) (e.g., by assigning different identifiers to candidate target cells provided by candidate target nodes); - A component used to send an indicator to the device indicating a cell group.

[0014] According to the third example aspect, a (second) network entity (e.g., without a master node connected to the device) is disclosed, the network entity comprising: - A component for receiving from the device an instruction for establishing a security context with a second network entity via a cell group provided by the second network entity; - A component for generating a master key for establishing a security context with a first network entity via a cell group provided by the first network entity, based on an instruction for a master key used to establish a security context with a second network entity; - A component for sending an instruction to a first network entity for establishing a security context with the first network entity via a cell group provided by the first network entity.

[0015] A network entity, particularly a network entity according to the first or second example aspect, may be, for example, a server, a server cloud, or a radio access network (RAN) node (such as a gNB) or a portion thereof, or may include a server, a server cloud, or a radio access network (RAN) node (such as a gNB) or a portion thereof.

[0016] The apparatus or network entity in any respect may include at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform at least a specified step.

[0017] The components of the device or network entity can be implemented in hardware and / or software. They may include, for example, at least one processor for executing processor instructions to perform the required functions, at least one memory for storing instructions, or both. Alternatively, they may include, for example, a circuit system designed or configured to perform the required functions, such as implemented in a chipset or chip (e.g., an integrated circuit). Typically, the device may include, for example, one or more processing units or processors.

[0018] The apparatus or network entity according to any aspect may include at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the first apparatus and / or the second apparatus to perform at least a specified step or a step according to any example aspect of the method. For example, the apparatus according to the first example aspect may be an apparatus including at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform at least the following: - Receive an indicator from the first network entity indicating the cell group provided by the network entity; - Based on the indicator provided by the second network entity to the cell group, it is determined whether the master key used to establish a security context with the second network entity via the cell group should be changed. - Generate a master key in response to the determination that the master key needs to be changed; - Instructions to send the master key to the second network entity.

[0019] As used in this application, the term "circuit system" may refer to one or more or all of the following: (a) Hardware circuit implementation only (such as implementation only in analog and / or digital circuit systems); and (b) A combination of hardware circuitry and software, such as (if applicable): (i) A combination of (multiple) analog and / or digital hardware circuits having software / firmware, and (ii) Any part of a hardware processor(s) having software (including (multiple) digital signal processors, software, and (multiple) memories, which work together to enable a device (such as a mobile phone or server) to perform various functions); and (c) (multiple) hardware circuits and / or (multiple) processors, such as (multiple) microprocessors or a portion thereof, which require software (e.g., firmware) to operate, but may be absent when operation is not required.

[0020] This definition of circuit system applies to all uses of the term in this application (including in any claim). As another example, as used in this application, the term circuit system also covers only hardware circuitry or a processor (or multiple processors) or portions of hardware circuitry or a processor and its accompanying software and / or firmware implementation. For example, and if applicable to a particular claim element, the term circuit system also covers baseband integrated circuits or processor integrated circuits for mobile devices, or similar integrated circuits in servers, cellular network devices or other computing or network devices.

[0021] According to the fourth example aspect, a method is disclosed that includes: - Receive an indicator from the first network entity indicating the cell group provided by the network entity; - Based on the indicator provided by the second network entity to the cell group, it is determined whether the master key used to establish a security context with the second network entity via the cell group should be changed. - Generate a master key in response to the determination that the master key needs to be changed; - Instructions to send the master key to the second network entity.

[0022] The first method may include steps, and the apparatus of the first example aspect is configured to perform the steps or has components for the steps. The method may be performed and / or controlled, for example, by an apparatus (according to the apparatus of the first example aspect), such as a mobile entity (e.g., a mobile telecommunications device or mobile phone or user equipment or terminal device).

[0023] According to the fifth example aspect, a method is disclosed that includes: - Identify at least one candidate target cell for the device; - Assign at least one candidate target cell to a cell group based on which network entity provides at least one candidate target cell with an identifier; - Based on obtaining the cell group, obtain the indicator that indicates the cell group; - Send an instruction to the device indicating the cell group.

[0024] The method according to the fifth example aspect may include steps in which the network entity of the second example aspect is configured to perform the steps or has components for the steps. The method may be performed and / or controlled, for example, by a (first) network entity (the network entity according to the second example aspect), such as a server, server cloud, or RAN node or a portion thereof.

[0025] According to the sixth example aspect, a method is disclosed that includes: - Receive from the device a master key for establishing a security context with the second network entity via a cell group provided by the second network entity; - Based on the instruction of the master key used to establish a security context with the second network entity, generate a master key for establishing a security context with the first network entity via a cell group provided by the first network entity; - Send an instruction to the first network entity for establishing a security context with the first network entity via a cell group provided by the first network entity.

[0026] The method according to the sixth example aspect may include steps in which the network entity of the third example aspect is configured to perform the steps or has components for the steps. The method may be performed and / or controlled, for example, by a (second) network entity (the network entity according to the third example aspect), such as a server, server cloud, or RAN node or a portion thereof.

[0027] For example, a network entity can execute both methods according to the fifth and sixth example aspects. For example, a network entity can execute the method according to the fifth example aspect or have components for executing that method, and (for example, after a device establishes a connection to another network entity (e.g., by executing a CHO, a subsequent CHO (S-CHO), a CPAC, or a subsequent CPAC (C-CPAC)), i.e., it deactivates the connection established with the network entity and subsequently re-establishes the connection to the network entity) can execute the method according to the sixth example aspect or have components for executing that method. A network device can also execute the methods according to the fifth and sixth example aspects or have components for executing that method for different devices.

[0028] According to another example aspect, a system is disclosed that includes an apparatus according to a first aspect, a first network entity (e.g., a master node (e.g., in the case of dual connectivity) or a gNB (e.g., in the case of single connectivity)) for providing a service cell for the apparatus according to a second aspect, and at least one second network entity (e.g., providing at least one candidate target cell for the apparatus) according to a third aspect.

[0029] According to another example aspect, a computer program product is disclosed that, when executed by a processor of a device, causes the device to perform a method according to any example aspect, such as at least one of the fourth, fifth, or sixth example aspects.

[0030] According to another example aspect, an apparatus is disclosed that is configured to perform and / or control a method according to any example aspect or includes corresponding components for performing and / or controlling the method. According to another example aspect, an apparatus is disclosed that includes at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the first apparatus to at least perform the method according to any example aspect.

[0031] The apparatus disclosed in any aspect may be a module or component for a device, such as a chip. Alternatively, the apparatus disclosed in any aspect may be a device, such as a server, server cloud, RAN node, or user equipment. The apparatus disclosed in any aspect may include only the disclosed components, such as parts, processors, and memory, or may also include one or more additional components.

[0032] According to another example aspect, a computer program is disclosed that, when executed by a processor, causes a device (e.g., a server) to perform and / or control actions according to a method based on any example aspect (e.g., at least one of the fourth, fifth, or sixth example aspects).

[0033] According to another example aspect, a computer-readable storage medium is disclosed, which includes any one of the disclosed computer program products or computer programs.

[0034] Any disclosure relating to any example aspect herein should be understood as equally applicable to any subject matter pursuant to the corresponding example aspect, such as that relating to apparatus, method, computer program, and computer-readable medium. Thus, for example, disclosure of method steps should also be considered as disclosure of components used to perform and / or be caused to perform the corresponding method steps. Similarly, disclosure of components used to perform and / or be caused to perform the method steps should also be considered as disclosure of the method steps themselves. This also applies to any paragraph describing at least one processor; and at least one memory comprising instructions; the at least one memory and the instructions being configured, together with the at least one processor, such that the apparatus performs at least one step.

[0035] The following sections will describe in more detail example features and example implementations of all aspects.

[0036] The master key can be a (secure) key used to establish a security context with a network entity via a cell group provided by the network entity. For example, it can be used to establish a security context with a network node via any cell in the cell group.

[0037] Master key (e.g., K)gNB The master key can be generated by a network entity or device, wherein when generated based on the same method using the same parameters, both the device and the network entity can derive the same master key. For example, the master key can be generated based on at least one of the following: the physical cell identifier of the cells in the cell group, the frequency of the cells in the first cell group, the unused next-hop link count of the first network node, and the master key used to establish a security context with the first network entity via the cell group provided by the first network entity. The master key can be generated based on a non-access stratum (NAS) level key.

[0038] Instructions for the master key or generator key may include information about which parameters and / or methods to use, or these parameters and methods may be predefined by the network so that, for example, a network entity receiving the master key instruction can generate a master key based on that instruction. Therefore, instructions for the master key enable a network entity to generate a master key.

[0039] Similarly, sending the master key or generator key can simply refer to an instruction to send the master key and generator key respectively. This allows the receiving entity to generate the master key or generator key based on the corresponding instruction.

[0040] The indicator for a cell group can be an identifier for the cell group, such as a unique identifier (at least in the current radio environment of the device). This indicator can be a Master-key-Group ID or Key-change-Ind=Group-change.

[0041] A security context can allow the use of a security key (e.g., a master key) to communicate between a device and a network entity, which is used to encrypt and decrypt transmissions from the device to the network entity and vice versa.

[0042] A secure environment can be used for a limited number of transmissions, such as a single transmission from the device to a network entity. Transmissions using a secure environment can allow for authentication of the device.

[0043] Security headers can be security-specific headers. Security headers can be exchanged between a device (e.g., a mobile device or UE) and a network entity (e.g., a network node) to specify security details of communication between the device and the network entity. Security headers can allow device authentication, for example, so that a network entity can verify whether the device provides a master key. Security headers can include indicators (e.g., flags) indicating that the master key used to establish a security context with a second network entity via a cell group will be changed. By receiving an indicator in the security header, a network entity can assume that the received master key has been authenticated by the device. Alternatively, security headers can include a master key or an indication of a master key.

[0044] An apparatus can perform a conditional handover to a candidate target cell (CHO) or a conditional PCell change (CPAC) to a candidate target PCell of a group of candidate target cells. In either CHO or CPAC, the apparatus may have a pre-prepared set of potential target cells by the current serving network entity (i.e., the network entity providing the cells to which the apparatus connects to the network). The apparatus may receive and store a set of handover commands for each candidate target cell or group of cells. The apparatus may determine whether predefined conditions are met (such as measured signal quality exceeding a predefined quality threshold) and perform a handover (CHO or CPAC) when the condition is determined to be met.

[0045] According to an example embodiment of the first example aspect, the device further includes: - A component used to determine, after receiving an indicator, whether to establish a connection to a second network entity via a cell group (e.g., based on an assessment of CHO or CPAC conditions); - A component for establishing communication with a second network entity using a security context (based on a master key, where the master key may be a master key generated by the device in response to determining that the master key needs to be changed, or a master key generated by the first network entity for establishing communication with the second network entity (e.g., based on determining that the master key needs to be changed)).

[0046] According to an example embodiment of the first example aspect, the device further includes: - A component for receiving, for example, a generator key for generating a secure environment for a cell group from a first network entity (using a secure header); The component used to send the master key indication is a component used to send the master key indication using a secure environment based on the generator key.

[0047] According to an example embodiment of the first example aspect, the device further includes: - A component used to generate a secure header based on the generator key; The secure environment is based on the secure header.

[0048] According to an example embodiment of the first example aspect, the security header includes an indicator (e.g., a key change flag) indicating that the master key is to be changed. The instruction to send the master key using a secure environment based on the generator key includes: an instruction to send the master key to the second network entity, and an instruction to send a secure header to the second network entity.

[0049] According to an example embodiment of the first example aspect, the device further includes: - A component used to send a network identifier (e.g., a temporary identifier for a cell radio network, such as a key change C-RNTI) to a second network entity, specifically based on the determination that the master key is to be changed.

[0050] According to an example embodiment of the first example aspect, the device further includes: - A component for sending a network identifier (e.g., a temporary identifier for the cell radio network, such as a key change C-RNTI) to the second network entity after a connection to the second network entity has been established via the cell group. The temporary identifier may optionally be included in the radio resource control reconfiguration completion message; or Additionally, according to the apparatus of claim 5, the security header is sent after a connection to the second network entity has been established via a cell group.

[0051] According to an example embodiment of the first example aspect, the device further includes: - A component for performing at least one measurement on a reference signal received via a cell group (e.g., via a candidate target cell included in the cell group); - A component for sending a report about at least one measurement to a first network entity; wherein a receive indicator responds to sending the report.

[0052] According to an example embodiment of the first example aspect, the device further includes: - A component for receiving group change indicators (e.g., Key-change-Ind set to "Group-change") from a first network entity; - A component for receiving from a first network entity another indicator indicating a first cell group provided by the first network entity or a third network entity, wherein the indicator indicating a cell group provided by a network entity is an indicator indicating a second cell group provided by a second network entity; - A component for determining, after receiving an indicator indicating a second cell group, another indicator indicating a first cell group, and a group change indicator, whether to establish a connection to a second network entity via the second cell group (e.g., based on an assessment of CHO or CPAC conditions); - A component used to establish communication (based on the master key) with a second network entity using a security context. - Components for (subsequently) determining, based on a group change indicator, whether to establish a connection to a first network entity or a third network entity via cells of a first cell group (e.g., based on an evaluation of CHO or CPAC conditions) (e.g., depending on whether the first or third network entity provides the first cell group); wherein optionally, determining whether to establish a connection via cells of the first cell group is based on a group change indicator, and instructing a second network entity to generate / update a master key for establishing communication via the first cell group when establishing communication with the device; and The device may also optionally include at least one of the following: - A component for determining whether the master key used to establish a security context with the first network entity or the third network entity via the first cell group should be changed based on an additional indicator provided by the first network entity or the third network entity to indicate the cell group; - A component used to generate another master key for establishing a security context with a first network entity or a third network entity in response to determining that the master key is to be changed; - A component used to establish communication with a third network entity using a security context based on a master key (e.g., another master key generated by the device or a master key generated / updated by a second network entity).

[0053] According to an example embodiment of the second example aspect, identifying at least one candidate target cell for the device includes: receiving from the device a report of at least one reference signal received via a candidate target cell included in a cell group.

[0054] According to an example embodiment of the second example aspect, the network entity further includes: - A component for generating a generator key, which is used to generate a secure environment for a cell group provided by a second network entity (e.g., for generating a secure header). - A component used to send the generator key to the device; - A component used to send the generator key to a second network entity.

[0055] According to an example embodiment of the second example aspect, the network entity further includes: - A component for determining whether a master key change is required, wherein the determination of whether a master key change is required is based on whether the candidate target cell is provided by a network entity different from the first network entity; The acquisition indicator is based on determining that a master key change is required; and optionally, the network entity also includes: - A component for generating a master key (for establishing communication with a network entity different from the first network entity, such as a second network entity) based on the determination that a master key change is required; - A component for sending a master key or a master key instruction to a network entity that is different from the first network entity (e.g., a second network entity).

[0056] As an example, according to the network entity of the second example aspect, the generator key is generated based on at least one of the following: the physical cell identifier of the cell of the cell group, the frequency of the cell of the first cell group, the unused next-hop link count of the first network node, and the master key for establishing a security context with the first network entity via the cell group provided by the first network entity.

[0057] According to an example embodiment of the second example aspect, the network entity further includes: - A component for sending an indication to the second network entity and / or the device of an unused next-hop link count value (so that the second network entity and / or the device can generate a master key based on the unused next-hop link count value).

[0058] According to an example embodiment of the second example aspect, the network entity further includes: - Components for configuring a second network entity to establish communication with the device via a candidate target cell (included in a second cell group), for example, components for providing a conditional handover configuration to the second network entity; and optionally further including: - Components for configuring a first network entity to establish communication with the device via candidate target cells (included in a first cell group), for example, components for storing conditional handover configurations (for candidate target cells provided by the first network entity).

[0059] This configuration allows the device to establish communication with (first or second) network entities.

[0060] According to the example embodiment of the third example aspect, the network entity also includes: - A component for receiving, from a first network entity, a generator key for generating a secure environment for a cell group; The component for receiving the master key instruction is a component for receiving the master key instruction using a secure environment generated using the generator key.

[0061] According to the example of the network entity in the third example aspect, the security environment is based on a security header, and the security header includes an indicator (e.g., a key change flag) that indicates that the master key is to be changed. The instruction to receive the master key using a secure environment based on the access key includes: an instruction to receive the master key from the device, and an instruction to receive a security header from the device; the network entity may also optionally include: - A component used to authenticate the master key based on the security header.

[0062] According to the example embodiment of the third example aspect, the network entity also includes: - Components for receiving network identifiers, particularly cell radio network temporary identifiers (e.g., key change C-RNTIs), from the device; and optionally... - A component used to authenticate the master key based on the network identifier.

[0063] According to the example embodiment of the third example aspect, the network entity also includes: - A component for indicating the unused next-hop link count value received from the first network entity; The indication for generating the master key for establishing a security context with the first network entity via a cell group provided by the first network entity is based on the indication of the unused next-hop link count value.

[0064] According to an example embodiment of the third example aspect, the generation of a master key for establishing a security context with the first network entity via a cell group provided by the first network entity, based on an indication of a master key for establishing a security context with the second network entity, further includes a group change indicator; the network entity according to the third example aspect also includes: - A component used to receive group change indicators from the first network entity.

[0065] The apparatus according to the first example aspect may include at least one of the following: - Components for establishing communication with a first network entity, such as components for performing a random access procedure to the first network entity, or components for performing a (subsequent) conditional handover to the first network entity (e.g., in the case of determining, based on a group change indicator, whether to establish a connection to the first network entity or a third network entity via a cell of the first cell group after establishing communication with a second network entity). - A component for establishing communication with a second network entity using a security context based on a master key generated by the device and / or based on a master key generated by a first network entity (e.g., an indication that can be received from the first network entity in response to sending a report on at least one measurement); - A component for performing a conditional handover (e.g., CHO or CPAC) to a cell in a cell group upon receiving an indicator; or - A component for performing a subsequent conditional handover (e.g., CHO or CPAC) to a cell in a cell group when a connection to a first network entity or another network entity is determined to be established via a cell group provided by a first network entity or another network entity (e.g., when the device has already established communication or connection with a second network entity and / or when a connection to a first network entity or another network entity is determined to be established via a cell group).

[0066] The network entity according to the second example may also include at least one of the following: - A component for sending an indicator to a second network entity so that the second network entity can generate (updated) a master key for the same cell group identified by the first network entity and send an indicator to the network entity that provides these cell groups; - A component for receiving at least one measurement of a reference signal received via a cell group; - Components for generating a master key for a cell group (provided by a second network entity), and optionally components for instructing the device and / or the second network entity to send the master key; - A component for determining whether the master key for the cell group needs to be changed based on the received measurement report, and a component for generating a master key for the cell group based on the determination that the master key for the cell group needs to be changed; - A component for sending a group change indicator (e.g., a Key-change-Ind set to “Group-change”) to a second network entity and / or the device, particularly after identifying at least one candidate target cell for the device.

[0067] According to the third example, the network entity may also include at least one of the following: - A component for providing the device with at least one candidate target cell, for example, at least one candidate target cell is part of a group of cells provided by a second network entity; - A component used to establish communication with the device using a security context within a cell group.

[0068] According to an example embodiment of the fourth example aspect, the method further includes: - After receiving the indicator, determine whether to establish a connection to the second network entity via the cell group; - Establish a connection to a second network entity using a security context.

[0069] According to an example embodiment of the fourth example aspect, the method further includes: - Receive the generator key from the first network entity for creating a secure environment for the cell group; The sending of the master key includes a secure environment based on the generator key.

[0070] According to an example embodiment of the fourth example aspect, the method further includes: - Generate secure headers based on the generator key; The secure environment is based on the secure header.

[0071] According to an example embodiment of the fourth example aspect, the method of the fourth example aspect includes an indicator indicating that the master key is to be changed; Sending the master key using a secure environment based on the generator key includes: sending an instruction to the second network entity to send the master key, and sending a secure header to the second network entity.

[0072] According to an example embodiment of the fourth example aspect, the method further includes: - Send a network identifier, particularly a temporary identifier for a cell radio network, to a second network entity, especially based on the determination that the master key is to be changed.

[0073] According to an example embodiment of the fourth example aspect, the method further includes: - After establishing a connection to the second network entity via the cell group, a network identifier, specifically a temporary identifier for the cell radio network, is sent to the second network entity. The temporary identifier may optionally include a radio resource control reconfiguration completion message; or In the method of an example embodiment according to the fourth example aspect, the security header is sent after a connection to the second network entity is determined to be established via a cell group.

[0074] According to an example embodiment of the fourth example aspect, the method further includes: - Perform at least one measurement on the reference signal received via the cell group; - Send a report about at least one measurement to a first network entity; wherein a receive indicator responds to sending the report.

[0075] According to an example embodiment of the fifth example aspect, the method of the fifth example aspect, wherein identifying at least one candidate target cell for the device includes: receiving from the device a report of at least one reference signal received via a candidate target cell included in a cell group.

[0076] According to an example embodiment of the fifth example aspect, the method further includes: - Generate a generator key, which is used to generate a secure environment for a cell group provided by a second network entity; - Send the generator key to the device; - Send the generator key to the second network entity.

[0077] According to an example embodiment of the fifth example aspect, the method further includes: - Determine whether a master key change is needed, wherein the determination of whether a master key change is needed is based on whether the candidate target cell is provided by a network entity different from the first network entity; The acquisition indicator is based on the determination that the master key needs to be changed.

[0078] According to an example embodiment of the fifth example aspect, the method of the fifth example aspect, wherein the generator key is generated based on at least one of the following: the physical cell identifier of the cell of the cell group, the frequency of the cell of the first cell group, the unused next-hop link count value of the first network node, and the master key for establishing a security context with the first network entity via the cell group provided by the first network entity.

[0079] According to an example embodiment of the fifth example aspect, the method further includes: - Send an indication of the unused next-hop link count value to the second network entity.

[0080] According to an example embodiment of the sixth example aspect, the method further includes: - Receive the generator key from the first network entity for creating a secure environment for the cell group; The instructions for receiving the master key include: instructions to receive the master key using a secure environment generated using the generator key.

[0081] According to an example embodiment of the sixth example aspect, the method of the sixth example aspect, wherein the security environment is based on a security header, and the security header includes an indicator indicating that the master key is to be changed; The instruction to receive the master key using a secure environment based on the access key includes: an instruction to receive the master key from the device, and an instruction to receive a security header from the device; the method may also optionally include: - Authenticate the master key based on the security header.

[0082] According to an example embodiment of the sixth example aspect, the method further includes: - Receive network identifiers, particularly temporary identifiers for cell radio networks, from the device; - A component used to authenticate the master key based on the network identifier.

[0083] According to an example embodiment of the sixth example aspect, the method further includes: - An indication of receiving the unused next-hop link count value from the first network entity; The indication for generating the master key for establishing a security context with the first network entity via a cell group provided by the first network entity is based on the indication of the unused next-hop link count value.

[0084] The above features and example embodiments are also applicable to different aspects. For example, components for performing method steps may also disclose the method steps, and vice versa. For example, method steps related to the fourth example aspect may also disclose corresponding components for performing the method steps by the apparatus according to the first example aspect, and vice versa; method steps related to the fifth example aspect may also disclose corresponding components for performing the method steps by the network entity according to the second example aspect, and vice versa; method steps related to the sixth example aspect may also disclose corresponding components for performing the method steps by the network entity according to the third example aspect, and vice versa.

[0085] It should be understood that the presentation in this section is for illustrative purposes only and not as a limitation.

[0086] Other features will become apparent from the following detailed description taken in conjunction with the accompanying drawings. However, it should be understood that the drawings are for illustrative purposes only and not as a definition of scope, which should be referred to in conjunction with the appended claims. It should be further understood that the drawings are not drawn to scale and are intended only to conceptually illustrate the structures and processes described herein. Attached Figure Description

[0087] The attached diagram shows:

[0088] Figure 1 This is a schematic diagram illustrating the example system;

[0089] Figure 2 This is a flowchart illustrating an example embodiment of the method according to the fourth example aspect;

[0090] Figure 3 This is a flowchart illustrating an example embodiment of the method according to the fifth exemplary aspect;

[0091] Figure 4 This is a flowchart illustrating an example embodiment of the method according to the sixth exemplary aspect;

[0092] Figure 5 This is a sample message sequence diagram of a master key change during a handover;

[0093] Figure 6 This is an example diagram illustrating exemplary master key generation;

[0094] Figure 7 This is a diagram showing the subsequent mobility sequence;

[0095] Figure 8a This is a message sequence diagram illustrating example embodiments of the methods according to the fourth, fifth, and sixth example aspects;

[0096] Figure 8bThis is a message sequence diagram illustrating example embodiments of the methods according to the fourth, fifth, and sixth example aspects;

[0097] Figure 9 These are schematic block diagrams of exemplary embodiments of the apparatus according to the first aspect and / or exemplary embodiments of the network nodes according to the second and / or third exemplary aspects;

[0098] Figure 10 This is a schematic diagram of an example of a tangible and non-transitory computer-readable storage medium. Detailed Implementation

[0099] The following description is intended to enhance understanding and should be understood as supplementing and reading in conjunction with the description provided in the foregoing summary section of this specification. Some aspects may have different terminology than, for example, that is provided in the foregoing description. However, those skilled in the art will understand that these terms refer to the same subject matter, for example, by being more specific.

[0100] Figure 1This is a schematic diagram illustrating an example system. User device (e.g., user equipment) 101 has established communication with RAN node 104 (e.g., gNB or MN) via cell 102 provided by RAN node 104 using security context 107 based on a master key, such that cell 102 is the serving cell of the PCell for the user device's MCG. The RAN node prepares / configures another RAN node 106, which provides candidate target cells for user device 101 for cell mobility. RAN node 104 identifies (all) candidate target cells for user device 101 based on measurement reports received from user device 101, and assigns the identified candidate target cells to cell groups based on which RAN node provided the target cells, such as assigning candidate target cells provided by RAN node 104 to (first) cell group and assigning candidate target cells provided by RAN node 106 to (second) cell group. RAN node 104 can then obtain (e.g., assign) indicators indicating cell groups, such as an identifier indicating the first cell group and another identifier indicating the second cell group. RAN node 104 can send the acquired indicator to user equipment 101. RAN node 104 can determine that the master key used to establish a security context with another RAN node (e.g., RAN node 106) must change, and based on this, can generate a corresponding master key and send the master key or an indication of the master key to the corresponding RAN node and / or user equipment 101. The master key indication allows user equipment 101 or RAN node 106 to generate the master key. Furthermore, RAN node 104 can generate a generator key for creating a security environment for the corresponding cell group and send the generator key to the user equipment. Subsequently, user equipment 101 moves to a different area and performs cell reselection to the target cell 103 of the cell group provided by RAN node 106 (e.g., by performing a CHO, since the CHO condition is met). User equipment 101 can use the master key generated by RAN node 104 to establish a security context with RAN node 106. Alternatively, User Equipment 101 may determine, based on the received indication provided by RAN Node 106 to the cell group, that the master key used to establish a security context with RAN Node 106 via the cell group will be changed, and generate a new master key in response. User Equipment 101 then sends an indication of the new master key to RAN Node 106 so that, based on the new master key, an establishment can be made between User Equipment 101 and RAN Node 106, and RAN Node 106 can generate the new master key and security context.Furthermore, User Equipment 101 notifies RAN Node 106 that the master key is to be changed, for example, by using a generator key (which may have already been received from RAN Node 104; the User Equipment can use the master key, for example, to establish a security context in a cell group including target cell 103 generated by RAN Node 104). After communication with RAN Node 106 is successfully established (e.g., after handover), RAN Node 106 can generate an updated master key for all cell groups previously identified by RAN Node 104 (and indicated by the indicator obtained by RAN Node 104), and can send an indication of the updated master key to the corresponding RAN Node; for example, RAN Node 104 provides candidate target cell 102 for a cell group provided by RAN Node 104. Therefore, if User Equipment 101 performs cell reselection to target cell 102 provided by RAN Node 104 during subsequent mobility, it can establish a security context with RAN Node 104 using the updated master key, or determine that another master key change is needed and generate another master key. Furthermore, if user equipment 101 performs cell reselection to another cell in the cell group provided by RAN node 106 during subsequent mobility, it can utilize the same master key used to establish a security context with RAN node 106 via cell 103 in the cell group.

[0101] Figure 2 This is a flowchart illustrating an example embodiment of the method according to the fourth example aspect. The example method can be executed or performed by a device (e.g., a user device or user equipment) and includes: - Receive from the first network entity 104 an indicator 201 indicating a cell group provided by the network entity, and an optional group change indicator and / or another indicator indicating a first cell group provided by the first network entity or a third network entity, in which case the indicator indicating a cell group provided by the network entity is an indicator indicating a second cell group provided by the second network entity. - After receiving an indicator indicating the second cell group, another indicator indicating the first cell group, and a group change indicator, it may be optionally determined whether to establish a connection to the second network entity via the second cell group; - Based on the indicator provided by the second network entity 106 to the cell group, determine whether the master key used by 202 to establish a security context with the second network entity 106 via the cell group should be changed; - Generates a 203 master key in response to the determination that the master key is to be changed; - Send a 204 master key instruction to the second network entity 106 (if it is determined that the master key is to be changed). - Optionally, a component for establishing communication with a second network entity using a security context (based on a master key, wherein the master key may be a master key generated by the device in step 203 (in case it is determined that the master key is to be changed) or a (previous) master key generated by the first network entity for establishing communication with the second network entity); - Optionally (after establishing communication with the second network entity) based on a group change indicator, determine whether to establish a connection to the first network entity or the third network entity via a cell of the first cell group (e.g., based on an evaluation of CHO or CPAC conditions) (e.g., depending on whether the first or third network entity provides the first cell group); wherein, optionally, the group change indicator determines whether to establish a connection via a cell of the first cell group, and instructs the second network entity to generate / update a master key for establishing communication via the first cell group when establishing communication with the device.

[0102] Figure 3 This is a flowchart illustrating an example embodiment of the method according to the fifth example aspect. The example method can be executed or performed by a network entity (e.g., a RAN node) and includes: - Identify at least one candidate target cell 103 for device 101; - Optionally determine whether a master key change is needed, wherein the determination of whether a master key change is needed is based on whether the candidate target cell is provided by a network entity different from the first network entity; - Optionally, based on the determination that a master key change is required, a master key is generated (e.g., for establishing communication with a second network entity or, for example, a third network entity that provides candidate target cells for the device). - Optionally, the master key or an instruction to the master key may be sent to the (corresponding) second or third network entity; - Based on which network entities 104 and 106 provide at least one candidate target cell with an identifier, assign at least one candidate target cell 103 with an identifier to the cell group 302; - Based on obtaining the cell group, obtain 303 indication of the cell group provided by the second network entity 106; - Send a 304 instruction cell group indicator to the device; - Optionally, a group change indicator is sent to the second network entity and / or the device; - Optionally, a corresponding second or third network entity can be configured to establish communication with the device via a candidate target cell (included in a second cell group or a cell group provided by a third network entity), for example, by providing a conditional handover configuration to the second network entity; - Optionally, a first network entity can be configured to establish communication with the device via candidate target cells (included in a first cell group), for example, by storing a conditional handover configuration (for candidate target cells provided by the first network entity).

[0103] Figure 4 This is a flowchart illustrating an example embodiment of the method according to the sixth example aspect. The example method can be executed or performed by a network entity (e.g., a RAN node) and includes: - Optionally, the indicator can be changed from the first network entity receiving group; - Receive from device 101 an instruction 401 for establishing a master key for a security context with second network entity 106 via a cell group provided by the second network entity; - Based on the instruction of the master key used to establish a security context with the second network entity 106, and optionally based on the group change indicator, generate 402 a master key for establishing a security context with the first network entity 104 via a cell group provided by the first network entity 104; - Send 403 to the first network entity 104 an instruction to establish a master key for a security context with the first network entity 104 via a cell group provided by the first network entity 104.

[0104] In Conditional PSCell Change (CPC), a CPC-configured UE may have to release its CPC configuration upon completing random access to the target PSCell. Therefore, without prior CPC reconfiguration and reinitialization from the network, the UE may not have the opportunity to perform subsequent CPCs. This can increase cell change latency and signaling overhead, especially when SCG changes are frequent during operation in Frequency Range 2 (FR2, which can include the band from 24.25 GHz to 71.0 GHz). Therefore, MR-DC with selective activation of cell groups can enable subsequent CPCs after an SCG change without requiring reconfiguration and initialization of CPC preparation from the network. This can lead to a reduction in signaling overhead and downtime for SCG changes.

[0105] In subsequent CPAC (S-CPAC), the mobility can also be applied to single-connection scenarios for DC and single-connection (SC) scenarios for MCG changes. The S-CPAC functionality can be extended to use PCell change / conditional handover scenarios.

[0106] Many features of S-CPAC can be reused for MCG selective activation. The example aspects disclosed herein can enable security key changes for the master key during subsequent mobility without reconfiguration, and can be component MCG selective activation or (S-CHO: subsequent CHO).

[0107] Figure 5 An example message sequence diagram of a master key generated during a handover, which is not covered by the claims, is shown.

[0108] See the table below for details on IE. The table below also covers switching requests:

[0109] The following table contains security information:

[0110] AS security information (IE) can be used to generate key materials for AS security to be used by the UE.

[0111] In NR, a security key change may not be necessary for every PCell change. In NR, if a change occurs in the PDCP anchor used for the bearer during mobility, the gNB can decide to activate a security key change. The key change indication can be included in an RRC reconfiguration message with sync. The master key update field in the RRC configuration can be given below:

[0112] Figure 6 An example diagram illustrating exemplary master key generation is shown. Specifically, the initial K... gNB It can be based on K AMF (e.g., the basic key for Access and Mobility Management Functions (AMF)) to generate (e.g., the master key used after the UE connects to the gNB), and subsequent K gNB It can be based on the PCI and DL frequencies of the target cell, as well as K NG-RAN To generate (e.g., a new master key for the target gNB).

[0113] K for target gNB NG-RAN The derivation function can be given as follows:

[0114] When from the current K gNB Alternatively, it can be derived from the new NH, as well as the target physical cell ID in the UE and NG-RAN. When used for switching purposes and transitioning from the RRC_INACTIVE state to the RRC_CONNECTED state, at least one of the following parameters can be used to form the input S to the KDF. - FC=0x70 - P0 = PCI (Target Physical Cell ID) - L0 = the length of PCI (i.e., 0x00 0x02) - P1 = ARFCN-DL (absolute frequency of the SSB of the target PCell as specified in Clause 13.3 of TS 38.300

[52] ) - The length of L1 = ARFCN-DL (i.e., 0x00 0x03) When the index NCC is increased during the switch, the input key KEY should be a 256-bit NH, otherwise it should be the current 256-bit KgNB (when the source is gNB) or KeNB (when the source is ng-eNB).

[0115] Therefore, the new (master) key to be used in the target cell can be based on the K key used in the current serving cell and the target PCI. gNB The key is derived from the value and frequency. In the case of subsequent mobility across different gNBs (master nodes), each handover across the MN may result in a new key, and the new key value may depend on the selected target cell PCI and frequency.

[0116] In secondary cell change scenarios (e.g., S-CPAC security key change), the UE and gNB can use the SN counter value to generate a new key based on the master key. In these cases, the target cell PCI and frequency can be disregarded because the PCell remains unchanged. To avoid reusing the same SN counter value when the UE returns to the same cell, the following is disclosed: The MN can provide the UE with the SN counter value for each SN, and the UE can store these values ​​together with the CPC. ·UE can use K gNB K_SN is derived from the unused SN counter value provided in advance by MN. The UE can change the SN counter every time SN changes.

[0117] However, this method may not be suitable for MCG-modified scenarios.

[0118] For example: A new KgNB can be generated based on the last used KgNB and the target cell PCI / frequency (NCC value remains unchanged). The target node can know the key that will be used as part of the preparation. The source MN can determine whether a key change is needed based on whether the source and target cells are processed by the same or different PDCP anchor points.

[0119] The exemplary aspects and embodiments provided in this disclosure can be used in subsequent CHO (S-CHO) mobility scenarios.

[0120] As an example, a method (for the network side) is disclosed (which may specifically relate to the fifth example aspect): The initial serving MN can prepare multiple target cells for S-CHO. For all target cells belonging to different nodes, the serving MN can provide a new (master) key generated based on the target cell's PCI and frequency. The serving MN can also provide K to all candidate MNs. gNB The value (as an example of a generator key), this K gNB The value is used to decode the security header, which indicates the cell change during subsequent mobility. The final RRC message containing the S-CHO configuration may include a Master-key-Group-ID for each target cell (as an example indicating a cell group provided by a network entity). For candidate cells belonging to the same node or having the same PDCP anchor point, the Master-key-Group-ID will be the same. After each change of neighborhood, the new service MN can be based on the current K. gNB The target cell's PCI / frequency parameters are used to generate new keys for all target cells belonging to other nodes. These keys can be sent to other candidate nodes via inter-node messages.

[0121] As an example, a method (for the UE side) is disclosed (which may specifically relate to the fourth example aspect). The UE can decide whether to generate a new K for cell changes. gNB (As an example of a master key). The UE can decide to use the Master-Key-change-Group-Id. If the Master-key-Group-ID differs between the serving cell and the target cell, the UE can generate a new key (master key). Key changes can be indicated using a security header that, during preparation, uses the K of the initial serving cell. gNB Perform integrity protection.

[0122] As an example alternative method for indicating a key change without a security header, the following is disclosed: Each candidate cell can assign a C-RNTI (Key-change-C-RNTI) for the purpose of indicating a key change (called KC-C-RNTI), instead of using a security header to indicate a key change. The UE can send a KC-C-RNTI as its UE context identifier when sending an RRC reconfiguration complete message. If the target node receives the KC-C-RNTI, it can apply the key change. Otherwise, it can use the same security key of the current serving MN to process the received message.

[0123] In addition, the following example of key derivation using the next-hop link count (NCC) value is disclosed: If the initial service node has unused NCC values, it can use these values ​​to generate new keys for continuation key generation. The initial service node can send all unused values ​​to each candidate MN. Each candidate MN can then use the unused NCC values ​​to generate the next set of keys. It can also provide the UE with a list of NCC values ​​for use in subsequent cell changes.

[0124] Figure 7 The subsequent mobility sequence, i.e., the example cell change sequence, is shown, which further illustrates the example message sequence diagram, illustrating... Figure 8a , Figure 8b The implementation of subsequent CHO scenarios is given in the document. Figure 8a , Figure 8b The example message sequence diagram can illustrate the combined performance of examples of methods according to the fourth, fifth, and sixth example aspects, for example, through an example system comprising: a device (UE) according to the first example aspect, a first network entity (S-MN) according to the second example aspect for providing a serving cell for the device, and at least one second network entity (T-MN) according to the third example aspect for providing at least one candidate target cell for the device. Figure 8a , Figure 8b Any method step performed by the UE as shown can be performed by a device according to the first example aspect (e.g., a device having components for performing the step), or can be part of a method according to the fourth example aspect. Figure 8a , Figure 8b Any method step performed by the S-MN as shown can be performed by a network node according to the second example aspect (e.g., a network node having components for performing that step), or can be part of the method according to the fifth example aspect. Figure 8a , Figure 8b Any method steps performed by the T-MN (target master node) shown can be performed by a network entity according to the third example aspect (e.g., a network entity with components for performing the steps), or can be part of the method according to the sixth example aspect.

[0125] In step 801, (active) communication is established between the device and the first network entity. In step 802, measurement reports on candidate target cells C2 and C3, provided by the T-MN, are sent to the first network entity. In step 803, the first network entity determines or decides on selective activation of the candidate target cells. In step 804, the first network entity determines that a master key change is required to establish a security context via all candidate target cells. In step 805, the first network entity generates master keys KgNB-T(C2) and KgNB-T(C3) based on the master key KgNB used in the active communication. In step 806, the first network entity sends a handover request for cell 2 (C2) to the second network entity, the handover request including: KgNB-T(C2), a Key-change-Ind set to "Group-change", and a KgNB used to generate the (cell change) security header. In step 807, the first network entity sends a handover request for cell 3 (C3) to the second network entity. This handover request includes: KgNB-T (C3), a Key-change-Ind set to "Group-change", and a KgNB used to generate the (cell change) security header. In step 808, target cells C2 and C3 are prepared without activating the security context. Instead, the security context is activated upon UE arrival; that is, the UE establishes communication with the second network entity via one of cells C2 or C3. In steps 809 and 810, a corresponding handover request confirmation message is sent from the second network entity to the first network entity. In step 811, the first network entity generates a selective activation configuration including the serving cell (C1). In step 812, the first network entity assigns C2 and C3 to the (second) cell group and assigns the indicator MKC-G2 to that cell group. Additionally, the first network entity assigns C1 to the (first) cell group and assigns the indicator MKC-G1. In step 813, the first network entity sends an RRS reconfiguration message to the device. This RRS reconfiguration message includes: a Key-change-Ind set to "Group-change", (Candidate-config-list, C1, MKC-G1, RRC-Configuration), (C2, MKC-G2, RRC-Configuration), and (C3, MKC-G2, RRC-Configuration). In step 814, the device executes a CHO to establish communication with the second network entity via C2. In step 815, because the MKC group has changed (since C1 is part of MKC-G1 and C2 is part of MKC-G2), the device generates a secure header for the key-change-ind (as an example of an indicator indicating that the master key will be changed).In step 816, the device sends a handover completion message protected by KgNB-T (C2) to the second network entity, the message having a security header including a key change flag. In step 817, when the serving cell changes to a new group, the second network entity generates a key for further inter-group mobility. The second network entity specifically generates a T-KgNB based on KgNB (C2). In step 818, the second network node sends an inter-group key update message including KgNB-T (C1) to the first network node. In step 818, when the current KgNB changes to a new value, the next KgNB to be used in other candidate SNs in the upcoming handover may need to use the new KgNB. Therefore, the new serving node (T-MN) can generate a target key for all candidate SNs based on the target cell PCI and frequency. In step 819, the device performs a CHO to establish communication via C3. In step 820, the device determines that no security header is generated because the MKC group has not changed (both C2 and C3 belong to MKC-G2). In step 821, the device sends a handover completion message based on the same key (used for active communication with the second network entity). In step 822, the handover of C1 is determined. In step 823, when the MKC group changes (because C1 is part of MKC-G1 and C2 is part of MKC-G2), the device generates a secure header for the key change (as an example of an indicator indicating that the master key will be changed). In step 824, the device sends a handover completion message protected by KgNB-T (C1) to the second network entity, the message having a secure header including a key change flag.

[0126] As an example, particularly in relation to the first aspect (e.g., any component of the disclosed method steps can be performed by an apparatus according to the first example aspect), an apparatus is disclosed comprising: - Establish a connection with the first network entity via cells included in the first cell group provided by the first network entity; - A component for performing at least one measurement on a reference signal received via a candidate target cell included in a second cell group provided by a second network entity; - A component for sending a report to the first network entity regarding at least one measurement; - A component for receiving a first indicator indicating a first cell group from a first network entity in response to sending a report; - A component for receiving a second indicator indicating a second cell group from a first network entity; - A component for determining whether to establish a connection via a target cell, the target cell being included in a first cell group or a second cell group and associated with a corresponding first indicator or second indicator, and the indicator being the corresponding first indicator or second indicator; - A component used to determine whether the master key used to establish a security context with a network entity via a target cell should be changed, based on whether the indicator is the first indicator or the second indicator. - A component for generating a master key in response to an instruction that the master key is to be changed and for sending the master key to a second network entity; - A component for establishing a connection between a second network entity and a cell in a second cell group after receiving a first indicator and a second indicator; - A component for establishing communication with a first network entity when the target cell is included in a first cell group or with a second network entity when the target cell is included in a second cell group.

[0127] As an example, particularly relevant to the second aspect (e.g., any component of the disclosed method steps can be performed by a network entity according to the second example aspect), a network entity is disclosed that includes: - Establish a connection with the device via a cell group provided by a first network entity; - A component used to identify at least one candidate target cell for the device; - Components for assigning at least one identified candidate target cell to a cell group based on which network entity provides at least one identified candidate target cell, thereby obtaining at least the second cell group provided by the second network entity; - A component used to acquire a first indicator indicating the first cell group; - A component for obtaining a second indication of the second cell group based on obtaining the second cell group; - Components for sending the first and second indicators to the device; and optionally - A component used to send indicators to a second network entity.

[0128] As an example, particularly in relation to the third aspect (e.g., any component of the disclosed method steps can be performed by a network entity according to the third example aspect), a network entity is disclosed that includes: - A component for receiving from the device an instruction for establishing a security context with a second network entity via a second cell group provided by the second network entity; - A component for generating a master key based on an instruction of the master key for establishing a security context between the device and the first network entity via a first cell group provided by the first network entity; - A component used to send a master key to a first network entity for establishing a security context between the device and the first network entity.

[0129] Figure 9 These are schematic block diagrams of exemplary embodiments of the apparatus according to the first aspect and / or exemplary embodiments of the network nodes according to the second and / or third exemplary aspects.

[0130] The device or network entity 900 includes a processor 901, a program memory 902, a working or main memory 903, a data memory, (multiple) communication interfaces 904, and an optional user interface 905.

[0131] The apparatus 900 may, for example, be configured to perform and / or control, or include corresponding components (at least one of 901 to 905) for performing and / or controlling the methods according to the fourth, fifth, and / or sixth example aspects. The apparatus or network entity 900 may also constitute an apparatus or network entity including at least one processor (901) and at least one memory (902) storing instructions that, when executed by the at least one processor, cause the apparatus or network entity (e.g., apparatus or network entity 900) to at least perform and / or control the methods according to all example aspects.

[0132] The processor 901 may also control, for example, memories 902 to 903, multiple communication interfaces 904, and an optional user interface 905.

[0133] The processor 901 may execute, for example, program code stored in program memory 902, which may represent, for example, a readable storage medium including program code that, when executed by the processor 901, causes the processor 901 to perform a method according to the fourth, fifth, or sixth example aspect.

[0134] Processor 901 (and any other processors mentioned in this specification) can be any suitable type of processor. Processor 901 can be, but is not limited to, one or more microprocessors, one or more processors accompanied by one or more digital signal processors, one or more processors without digital signal processors(s), one or more application-specific computer chips, one or more field-programmable gate arrays (FPGAs), one or more controllers, one or more application-specific integrated circuits (ASICs), or one or more computers / servers. The associated architecture / hardware has been programmed in this way to perform the functions described above. Processor 1001 can, for example, be an application processor for running an operating system.

[0135] Program memory 902 may also be included in processor 901. This memory may be fixedly connected to processor 901, or at least partially removable from processor 901, for example, in the form of a memory card or memory stick. Program memory 902 may be, for example, non-volatile memory. For example, it may be any of flash memory (or a portion thereof), ROM, PROM, EPROM, and EEPROM memory (or a portion thereof), or a hard disk (or a portion thereof), to name just a few examples. Program memory 902 may also include an operating system for processor 901. Program memory 902 may also include firmware for device or network entity 900.

[0136] Multiple communication interfaces 904 enable the device or network entity 900 to communicate with other entities (e.g., another device or network entity). The multiple communication interfaces 904 may include, for example, wireless interfaces (e.g., cellular radio communication interfaces and / or WLAN interfaces) and / or wired interfaces (e.g., IP-based interfaces for communicating with entities via the Internet). The multiple communication interfaces enable the device or network entity 900 to communicate with other entities, such as one or more entities included in a mobile communication network.

[0137] User interface 905 is optional and may include a display for showing information to the user and / or an input device (e.g., keyboard, keypad, touchpad, mouse, etc.) for receiving information from the user.

[0138] Some or all of the components of the device or network entity 900 may be connected via a bus, for example. For example, some or all of the components of the device or network entity 900 may be combined into one or more modules.

[0139] The apparatus 900 may further include at least one of the following: a receiver, for example, for receiving from a first network entity an indicator indicating a cell group provided by the network entity; a determiner, for example, for determining, based on the indicator indicating that the cell group is provided by a second network entity, whether a master key for establishing a security context with the second network entity via the cell group needs to be changed; a generator, for example, for generating a master key in response to determining that the master key needs to be changed; or a transmitter, for example, for sending an indication of the master key to the second network entity.

[0140] Network entity 900 may further include at least one of the following: an identifier, for example, for identifying at least one candidate target cell for the device; an allocator, for example, for allocating at least one identified candidate target cell to a cell group based on which network entity provides at least one identified candidate target cell; an acquirer, for example, for acquiring an indicator indicating a cell group provided by a second network entity based on the cell group; and a receiver or transmitter, for example, for sending an indicator indicating a cell group to the device.

[0141] Network entity 900 may further include at least one of the following: a receiver, for example, for receiving from the device an instruction for establishing a security context with the second network entity via a cell group provided by the second network entity; a generator, for example, for generating an instruction for establishing a security context with the first network entity via a cell group provided by the first network entity based on the instruction for establishing a security context with the second network entity; or a transmitter, for example, for sending to the first network entity the instruction for establishing a security context with the first network entity via a cell group provided by the first network entity.

[0142] Figure 10 This is a schematic diagram of an example of a tangible, non-transitory, computer-readable storage medium according to the present disclosure, which, for example, can be used to implement... Figure 9 The memory 902 or memory 902. Therefore, Figure 10 Examples of the inventions shown include a flash memory 1000 that can be soldered or bonded to a printed circuit board, a solid-state drive 1001 that includes multiple memory chips (e.g., flash memory chips), a magnetic hard disk drive 1002, a secure digital (SD) card 1003, a universal serial bus (USB) memory stick 1004, an optical storage medium 1005 (such as a CD-ROM or DVD), and a magnetic storage medium 1006.

[0143] The aspects and embodiments provided in this disclosure can enable or enhance subsequent mobility scenarios for master key changes. During subsequent mobility, the serving MN can provide a KgNB value to all candidate MNs, which is used to decode the security header indicating a cell change. The Master-Key-Group-ID can be included in the final RRC message for each target cell, and it can be the same for all candidate cells belonging to the same node or having the same PDCP anchor. If the Master-Key-Group-ID differs between the serving cell and the target cell, the UE can generate a new key, and the key change can be indicated using a new security header that is integrity-protected using the KgNB of the initial serving cell during preparation. After each cell change, the new serving MN can generate new keys for all target cells belonging to other nodes based on the current KgNB and the target cell's Physical Cell ID (PCI) / frequency parameters. These keys can be indicated to other candidate nodes via inter-node messages. As an alternative to indicating a key change without a secure header, KC-C-RNTI (Key-Change-C-RNTI) and an extension for key derivation using the next-hop link count (NCC) value are disclosed, which can enable efficient and secure master key changes.

[0144] The aspects and embodiments provided in this disclosure may relate to a source MN instructing a UE to change a key group, wherein a master key is generated on the UE, and a target MN generates a new key for all candidate nodes. Additionally, the UE may decide whether to generate a new KgNB for a cell change. If the Master-key-Group-ID differs between the serving cell and the target cell, the UE may generate a new key and send it (or an indication thereof) to the target in a security header; otherwise, a security header is not required. Furthermore, in other embodiments, the UE may send a key change indication without a security header, wherein the KC-C-RNTI is sent to the target node. Moreover, it is novel and inventive that the target MN may generate a target key for all candidate SNs based on the target cell PCI and frequency, and may send the key (or an indication thereof) to all candidates in a new signal.

[0145] The following examples are also considered to be publicly available:

[0146] A method executed at the source MN (S-MN): • It is determined / determined that (multiple) master key changes are required; • Generate a key based on the target cell's PCI / frequency group and provide the key to all target cells; • Provides a KgNB value, which is used to decode the security header indicating cell changes to all target cells; • Send an RRC message to the UE, which indicates a group change and includes the master key group ID for each target cell.

[0147] A method executed at the UE: • Receive an RRC message from the source MN, which indicates a group change with a master key group ID for each target cell; • When the master key group ID differs between the serving cell and the target cell, a new K is generated. gNB ; • The new security header indicates the key change for the target MN.

[0148] A method to be performed at the target MN (T-MN): • Receive the KgNB value from the source MN. This KgNB value is used to decode the security header indicating a cell change. • The key changed from the source MN; • Receive a key change indication from the UE in the security header; • Generate target keys for all candidate cells belonging to other nodes based on KgNB and target cell PCI / frequency parameters; • Send a new inter-node message that includes the target key for other candidate nodes.

[0149] An alternative example method for indicating a key change without a security header is also disclosed, including sending a KC-C-RNTI in an RRC reconfiguration complete message, and if the target MN receives the KC-C-RNTI, its applied key is changed. Furthermore, unused NCC values ​​can also be used to generate new keys for continuation key generation.

[0150] In this specification, any connections presented in the described embodiments should be understood as operatively coupled to the components involved. Therefore, connections can be direct or indirect, may involve any number or combination of elements, and the components may have only a functional relationship.

[0151] Furthermore, any methods, processes, and actions described or illustrated herein may be implemented using executable instructions in a general-purpose or special-purpose processor and stored on a computer-readable storage medium (e.g., a disk, memory, etc.) for execution by that processor. The reference to 'computer-readable storage medium' should be understood to include special-purpose circuitry such as FPGAs, ASICs, signal processing devices, and other devices.

[0152] The expression “A and / or B” is considered to include any one of the following three cases: (I) A, (II) B, or (III) A and B. Furthermore, the article “a” should not be understood as “one,” meaning that the use of the expression “an element” does not exclude the presence of other elements. The term “comprising” should be understood in an open sense, meaning that the object “comprising element A” can also include other elements besides element A. Furthermore, the term “comprising” can be limited to “consisting of,” that is, consisting only of the specified elements.

[0153] The expressions “at least one of the following: ” and “<at least one of the two or more elements>” and similar wording (where the list of two or more elements is connected by “and” or “or”) mean at least any one of these elements, or at least any two or more of these elements, or at least all of these elements.

[0154] It should be understood that all presented embodiments are merely examples, and any feature presented for a particular example embodiment may be used alone with any aspect, or in combination with any feature presented for the same or another particular example embodiment, and / or in combination with any other feature not mentioned. In particular, the example embodiments presented in this specification should also be understood as disclosing each other in all possible combinations, provided it is technically reasonable, and the example embodiments are not alternatives to each other. It will also be understood that any feature presented for example embodiments in a particular class (method / apparatus / computer program / system) may also be used in a corresponding manner in example embodiments of any other class. It should also be understood that the presence of a feature in a presented example embodiment does not necessarily mean that the feature forms an essential feature and cannot be omitted or substituted.

[0155] The statement of a feature including at least one of the subsequently listed features is not mandatory, as the feature may include all of the subsequently listed features, or one or more of the multiple subsequently listed features. Furthermore, listed features may be selected in any combination, or only one of the listed features may be selected. Specific combinations of all subsequently listed features may also be considered. Additionally, only one of the listed features may be possible.

[0156] The order of all the method steps described above is not mandatory, and alternative orders are also possible. However, the specific order of the method steps exemplarily shown in the accompanying drawings should be considered as one possible order of method steps for the corresponding embodiments described in the accompanying drawings.

[0157] The subject matter has been described above by way of exemplary embodiments. It should be noted that there are alternatives and variations that are obvious to those skilled in the art, and that these alternatives and variations can be implemented without departing from the scope of the appended claims.

[0158] List of abbreviations: 3GPP: Third Generation Partnership Project 5G: Fifth Generation AMF: Access and Mobility Management Functions C-RNTI: Temporary Identifier for Cell Radio Network DL: Downlink gNB: Next-generation NodeB KC: Key Change MCG: Main Cell Group MN: Master Node NF: Network Functions ng-eNB: Next-Generation Evolved Node-B ngKSI: Key Set Identifier in 5G NR: New Radio PCI: Physical Cell Identifier PDCP: Packet Data Convergence Protocol RAN: Radio Access Network RRC: Radio Resource Control SCG: Auxiliary Community Group SN: Secondary node UE: User Equipment UL: Uplink

Claims

1. An apparatus comprising: A component for receiving from a first network entity an indicator indicating a cell group provided by the network entity; A component for determining, based on an indicator that indicates the cell group is provided by a second network entity, whether the master key used to establish a security context with the second network entity via the cell group should be changed; Components for generating the master key in response to determining that the master key is to be changed; A component for sending an instruction of the master key to the second network entity.

2. The apparatus according to claim 1, further comprising: Components for determining, upon receiving the indicator, whether to establish a connection to the second network entity via the cell group; A component used to establish communication with the second network entity using the security context.

3. The apparatus according to claim 1 or 2, further comprising: A component for receiving from the first network entity a generator key for generating a secure environment for the cell group; The component for sending the instruction of the master key is a component for sending the instruction of the master key using the security environment based on the generator key.

4. The apparatus according to claim 3, further comprising: Components used to generate a secure header based on the generator key; The security environment described therein is based on the security header.

5. The apparatus of claim 4, wherein the security header includes an indicator indicating that the master key is to be changed; The instruction to send the master key using the secure environment based on the generator key includes: The instruction of the master key is sent to the second network entity, and the security header is sent to the second network entity.

6. The apparatus according to claim 1, further comprising: Components for sending network identifiers to the second network entity, particularly components for sending network identifiers to the second network entity based on the determination that the master key is to be changed.

7. The apparatus according to claim 2, further comprising: A component for sending a network identifier to the second network entity after determining that a connection has been established to the second network entity via the cell group, the network identifier being optionally included in a radio resource control reconfiguration completion message; or Additionally, according to the apparatus of claim 5, wherein the sending of the security header is performed after determining that a connection to the second network entity has been established via the cell group.

8. The apparatus according to any one of claims 1 to 7, further comprising: A component for performing at least one measurement on a reference signal received via the cell group; A component for sending a report about the at least one measurement to the first network entity; wherein the indicator for receiving the report is in response to sending the report.

9. A first network entity, comprising: Components used to identify at least one candidate target cell for the device; A component for assigning the at least one identified candidate target cell to a cell group based on which network entity provides the candidate target cell with the at least one identifier; Components for obtaining an indicator of the cell group based on the cell group; A component for sending the indicator indicating the cell group to the device.

10. The network entity of claim 9, wherein identifying at least one candidate target cell for the device includes: The device receives a report of at least one reference signal received via a candidate target cell included in the cell group.

11. The network entity according to claim 9 or 10, further comprising: A component for generating a generator key, which is used to generate a secure environment for the cell group provided by the second network entity; Components for sending the generator key to the device; A component used to send the generator key to the second network entity.

12. The network entity according to any one of claims 9 to 11, further comprising: The component is used to determine whether a master key change is needed, wherein the determination of whether the master key change is needed is based on whether the candidate target cell is provided by a network entity different from the first network entity; The acquisition of the indicator is required based on the determination of a master key change.

13. The network entity according to any one of claims 9 to 12, wherein the generator key is generated based on at least one of: the physical cell identifier of the cell of the cell group, the frequency of the cell of the first cell group, the unused next-hop link count of the first network node, and a master key for establishing a security context with the first network entity via the cell group provided by the first network entity.

14. The network entity according to any one of claims 9 to 13, further comprising: A component for sending an indication of an unused next-hop link count value to the second network entity and / or the device.

15. A second network entity, comprising: A component for receiving from the device an instruction for establishing a security context with the second network entity via a cell group provided by the second network entity; A component for generating a master key for establishing a security context with the first network entity via a cell group provided by the first network entity, based on the instruction of the master key for establishing a security context with the second network entity; A component for sending an instruction to the first network entity for establishing the security context with the first network entity via the cell group provided by the first network entity.

16. The network entity according to claim 15, further comprising: A component for receiving from the first network entity a generator key for generating a secure environment for the cell group; The component for receiving the instruction of the master key is a component for receiving the instruction of the master key in the secure environment generated using the generator key.

17. The network entity of claim 16, wherein the security environment is based on the security header, and the security header includes an indicator indicating that the master key is to be changed; The instruction to receive the master key using the security environment based on the access key includes: receiving the instruction to receive the master key from the device, and receiving the security header from the device; the network entity further includes: A component used to authenticate the master key based on the security header.

18. The network entity according to claim 15, further comprising: Components for receiving network identifiers, particularly temporary identifiers of cell radio networks, from the device; Components used to authenticate the master key based on the network identifier.

19. The network entity according to any one of claims 15 to 18, further comprising: A component for receiving an indication of an unused next-hop link count value from the first network entity; The indication for generating the master key for establishing the security context with the first network entity via the cell group provided by the first network entity is based on the indication of the unused next-hop link count value.

20. A system comprising an apparatus according to any one of claims 1 to 8, a first network entity providing a serving cell for the apparatus according to any one of claims 9 to 14, and at least one second network entity providing at least one candidate target cell for the apparatus according to any one of claims 15 to 19.

21. A method performed by an apparatus, comprising: Receive an indicator of the cell group provided by the network entity from the first network entity; Based on the indicator that the cell group is provided by the second network entity, it is determined whether the master key used to establish a security context with the second network entity via the cell group should be changed. In response to determining that the master key is to be changed, the master key is generated; Instructions to send the master key to the second network entity.

22. The method according to any one of claims 21, further comprising: Upon receiving the indicator, determine whether to establish a connection to the second network entity via the cell group; Use the security context to establish communication with the second network entity.

23. The method according to claim 21 or 22, further comprising: Receive a generator key from the first network entity for generating a secure environment for the cell group; Sending the master key includes using the security environment based on the generator key.

24. The method of claim 21, further comprising: Generate a secure header based on the generator key; The security environment described therein is based on the security header.

25. The method of claim 24, wherein the security header includes an indicator indicating that the master key is to be changed; Sending the master key using the secure environment based on the generator key includes: The instruction of the master key is sent to the second network entity, and the security header is sent to the second network entity.

26. The method of claim 21, further comprising: Send a network identifier to the second network entity, specifically based on the determination that the master key is to be changed.

27. The method of claim 22, further comprising: After determining that a connection has been established to the second network entity via the cell group, a network identifier is sent to the second network entity, the network identifier optionally being included in a radio resource control reconfiguration completion message; or Additionally, according to the method of claim 25, the security header is sent after determining that a connection to the second network entity has been established via the cell group.

28. The method according to any one of claims 21 to 27, further comprising: Perform at least one measurement on the reference signal received via the cell group; Send a report about the at least one measurement to the first network entity; The indicator is received in response to the sending of the report.

29. A method performed by a first network entity, comprising: Identify at least one candidate target cell for the device; Based on which network entity provides the candidate target cell with the at least one identifier, the candidate target cell with the at least one identifier is assigned to the cell group; Based on obtaining the cell group, obtain an indicator that indicates the cell group; Send the indicator to the device that indicates the cell group.

30. The method of claim 29, wherein identifying at least one candidate target cell for the device comprises: The device receives a report of at least one reference signal received via a candidate target cell included in the cell group.

31. The method according to claim 29 or 30, further comprising: Generate a generator key, which is used to generate a secure environment for the cell group provided by the second network entity; Send the generator key to the device; The generator key is sent to the second network entity.

32. The method according to any one of claims 29 to 31, further comprising: Determine whether a master key change is needed, wherein the determination of whether a master key change is needed is based on whether the candidate target cell is provided by a network entity different from the first network entity; The acquisition of the indicator is required based on the determination of a master key change.

33. The method of any one of claims 29 to 32, wherein the generator key is generated based on at least one of the following: the physical cell identifier of the cell of the cell group, the frequency of the cell of the first cell group, the unused next-hop link count of the first network node, and a master key for establishing a security context with the first network entity via the cell group provided by the first network entity.

34. The method according to any one of claims 29 to 33, further comprising: Send an indication of the unused next-hop link count value to the second network entity.

35. A method performed by a second network entity, comprising: Receive from the device a master key for establishing a security context with the second network entity via a cell group provided by the second network entity; Based on the instruction of the master key used to establish a security context with the second network entity, a master key is generated for establishing a security context with the first network entity via a cell group provided by the first network entity; Send an instruction to the first network entity for establishing the security context with the first network entity via the cell group provided by the first network entity.

36. The method of claim 35, further comprising: Receive a generator key from the first network entity for generating a secure environment for the cell group; The instruction to receive the master key includes receiving the instruction to receive the master key using the secure environment generated using the generator key.

37. The method of claim 36, wherein the security environment is based on the security header, and the security header includes an indicator indicating that the master key is to be changed; The instruction to receive the master key using the security environment based on the access key includes receiving the master key from the device and receiving the security header from the device; the method further includes: The master key is authenticated based on the security header.

38. The method of claim 35, further comprising: Receive network identifiers, particularly temporary identifiers for cell radio networks, from the device; The master key is authenticated based on the network identifier.

39. The method according to any one of claims 35 to 38, further comprising: Receive an indication of the unused next-hop link count value from the first network entity; The master key used to establish the security context with the first network entity via the cell group provided by the first network entity is based on the indication of the unused next-hop link count value.

40. An apparatus comprising at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform at least the steps of the method according to any one of claims 21 to 28.

41. A network entity comprising at least one processor; at least one memory storing instructions that, when executed by the at least one processor, cause the network entity to perform at least the steps of the method according to any one of claims 29 to 34 and / or the steps of the method according to any one of claims 35 to 39.

Images