Secure communications in modular non-access stratum architecture

Abstract

Techniques are provided for secure communication management in a communication network environment, such as in a roaming scenario, between a device (e.g., a user equipment) and its home network. For example, one method receives a security mode command message from a first network entity in a first communication network via a second communication network. The security mode command message has security information including a key set identifier, which is one or more key set identifiers previously received from the first communication network and associated with a first key, and the first communication network is the user equipment's home network. The method then uses the security information to establish a security context between the user equipment and the first network entity in the first communication network for secure data exchange.

Description

Technical Field

[0001] This field generally relates to communication networks, and more particularly, but not exclusively, to security management within such communication networks. Background Technology

[0002] This section introduces aspects that contribute to a better understanding of the invention. Accordingly, the statements in this section should be interpreted in this light and should not be construed as an admission of what is or is not in the prior art.

[0003] In recent years, communication network technology has made rapid progress.

[0004] Compared to previous generations of communication networks, fourth-generation (4G) wireless mobile telecommunications technology (also known as Long Term Evolution (LTE) technology) offers high-capacity mobile multimedia with high data rates, especially for human interaction.

[0005] Fifth-generation (5G) technology currently provides not only human interaction use cases but also machine-type communication in so-called Internet of Things (IoT) networks. While 5G networks enable large-scale IoT services (e.g., a very large number of limited-capacity devices) and mission-critical IoT services (e.g., requiring high reliability), improvements over 4G communication services are supported in the form of enhanced mobile broadband (eMBB) services that provide improved wireless internet access to mobile devices.

[0006] The sixth generation (6G) technology is currently being developed for communication networks that differ from 5G, particularly by providing significant improvements in speed and latency (for example, the Ultra Reliable Low Latency Communication (URLLC) service, which originated in 5G, is being refined and improved in 6G to address more stringent connectivity requirements), and the ability to sense the physical environment through the use of extended spectrum bands. This sensing capability enables the creation of digital twins of the physical environment, leading to new applications such as, but not limited to, highly accurate positioning and immersive experiences.

[0007] However, security management is an important consideration in any communication network environment—especially in today's environments that provide applications such as location services and immersive experiences. Moreover, security management is an ongoing consideration driven by the continuous effort to improve the architecture and protocols associated with communication networks to enhance network efficiency and / or subscriber convenience. Accordingly, security management can present significant technical challenges. Summary of the Invention

[0008] The illustrative embodiments provide techniques for secure communication management in a communication network environment. More specifically, for example, the illustrative embodiments provide techniques for secure communication between a device (e.g., a user equipment) and its home network in a roaming scenario.

[0009] In one illustrative embodiment, from the perspective of a user equipment, a method receives a security mode command message from a first network entity in a first communication network via a second communication network. The security mode command message has security information including a key set identifier, which is one or more key set identifiers previously received from the first communication network and associated with a first key. The first communication network is the user equipment's home network. The method then uses the security information to establish a security context between the device and the first network entity in the first communication network.

[0010] Further illustrative embodiments are provided in the form of a non-transitory computer-readable medium embodying executable program code that, when executed by a processor, causes the processor to perform the above-described and / or other steps, operations, etc. Still further illustrative embodiments include an apparatus having a processor and memory, configured to perform the above-described and / or other steps, operations, etc. Some illustrative embodiments include a system configured to perform the above-described and / or other steps, operations, etc. Furthermore, some illustrative embodiments include an apparatus or system comprising components for performing the above-described and / or other steps, operations, etc.

[0011] Advantageously, some illustrative embodiments provide the capability to extend the modular non-access stratum architecture to roaming use cases. More specifically, end-to-end security between the network functions of the user equipment and its home network is achieved without altering existing roaming interfaces.

[0012] In some illustrative embodiments, in particular, the technical solutions described herein are well-suited for implementation in 6G architectures that implement modular non-access stratum architectures.

[0013] These and other features and advantages of the embodiments described herein will become more apparent from the accompanying drawings and the following detailed description. Attached Figure Description

[0014] Figure 1A and Figure 1B A communication network environment with a modular non-access stratum architecture that can be used to implement one or more illustrative embodiments is shown.

[0015] Figure 2 User equipment and entities that can be used to implement one or more illustrative embodiments are shown.

[0016] Figure 3 A secure key agreement process in a modular non-access tier architecture according to an illustrative embodiment is shown.

[0017] Figure 4 The security mode control process in a modular non-access layer architecture according to an illustrative embodiment is shown.

[0018] Figure 5 The discovery process for the security key management function in a modular non-access tier architecture according to an illustrative embodiment is shown. Detailed Implementation

[0019] This document illustrates embodiments in conjunction with example communication systems and related techniques for security management in communication systems. However, it should be understood that the scope of the claims is not limited to the specific type of communication system and / or process disclosed. Alternative processes and operations can be used to implement the embodiments in a wide variety of other types of communication systems. For example, although illustrated in the context of a wireless cellular system utilizing 3GPP system elements such as 5G and 6G system elements, the disclosed embodiments can be adapted in a straightforward manner to a wide variety of other types of systems.

[0020] According to illustrative embodiments, one or more 3GPP Technical Specifications (TS) and Technical Reports (TRs) may provide further explanation of network elements / functions and / or operations that can interact with parts of inventive solutions (e.g., but not limited to 3GPP TS 33.501 entitled "Technical Specification Group Services and Systems Aspects; Security Architecture and Procedures for 5G Systems," the disclosure of which is incorporated herein by reference in its entirety). Note that 3GPP TS / TR documents are non-limiting examples of communication network standards (e.g., specifications, procedures, reports, requirements, recommendations, etc.). However, while well-suited to 3GPP standards, embodiments are not necessarily intended to be limited to any particular standard.

[0021] It should be understood that, in some illustrative embodiments, the terms "5G network," "6G network," etc. (e.g., 5G or 6G system, 5G or 6G communication system, 5G or 6G environment, 5G or 6G communication environment, etc.) can be understood to include all or part of the access network and all or part of the core network. However, the terms "5G network" or "6G network," etc., may sometimes be used interchangeably with the terms "5GC network" or "6GC network" (and "5GS" or "6GS") herein without loss of generality.

[0022] Before describing the illustrative embodiments, Figure 1A and Figure 1BThe context describes the overall functionality of the modular non-access tier (NAS) architecture.

[0023] One technical advantage of modular NAS is that any type of NAS message can be hardened (e.g., integrity protection and / or encryption). Prior to the modular NAS concept, only Mobility Management (MM) NAS messages could be hardened. For example, in 5GS, while 5G MM messages terminated between the UE and the Access and Mobility Management Function (AMF) could be hardened, 5GS MM messages terminated between the UE and, for example, the Session Management Function (SMF) could not. Given that non-MM NAS messages could be carried by MM NAS messages, the previous decision to harden only MM NAS messages was technically reasonable. However, with the increasing demand for improved security (e.g., zero trust), the modular NAS architecture was proposed.

[0024] Accordingly, such as Figure 1A As outlined in the modular NAS architecture 100, NAS messages terminated between UE 102 and 6G MM network function (NF) 104 and NAS messages terminated between UE 102 and another NF 106 (e.g., SMF) can be hardened.

[0025] Figure 1B Depicting Figure 1A Further illustrative details of the modular NAS architecture. More specifically, such as Figure 1B As shown, the modular NAS architecture 110 involves a UE 112, a radio access network (RAN) 114, a secure key management function (SKMF) 116, a first NF 118 (NF1), and a second NF 120 (NF2). Steps 1 (1a and 1b), 2 (2a and 2b), and 3 describe an illustrative secure communication process for the modular NAS architecture 110.

[0026] Step 1a: During the Master Authentication and Key Agreement (AKA) process (e.g., the 5G AKA method or the Extensible Authentication Protocol (EAP) method can be used for the Master AKA), UE 112 and SKMF 116 obtain the anchor key (K a For example, K a K could be from the Safety Anchor Function (SEAF) SEAF Or derive the parent key K from the anchor key of a 6G equivalent function (e.g., 6G MM NF). p .

[0027] Step 1b: In the message from SKMF 116 to UE 112 during the main AKA procedure, SKMF 116 provides UE 112 with a set of Key Set Identifiers (KSIs), where each KSI is associated with a specific NF. UE 112 will then associate the received KSI set with the K... p Related.

[0028] Step 2a: Simultaneously, within the core network (CN), SKMF 116 distributes K to the NF. p And KSI. For example, for the first NF 118 (NF1) and the second NF 120 (NF2), SKMF 116 provides {K p , KSI1} and {K p ,KSI2}.

[0029] Step 2b: First, the NF (i.e., NF1; NF1 can be an AMF or its 6G equivalent) terminating the direct interface with RAN 114 initiates a Security Mode Command (SMC) procedure. UE 112 and NF1 agree on the KSI and security algorithm to be used for the secure NAS connection between UE 112 and NF1. An Access Layer (AS) level SMC procedure is also performed to harden the AS connection between UE 112 and RAN 114.

[0030] Step 3: As another NAS connection becomes necessary (e.g., UE 112 needs to establish a new Packet Data Unit (PDU) session, and therefore establish a new NAS connection between the UE and the SMF), UE 112 and NF (e.g., the second NF 120 (NF2)) perform the SMC procedure and agree on the KSI and security algorithm to be used for the secure NAS connection between UE 112 and NF.

[0031] It should be understood that Figure 1A and Figure 1B The specific arrangement of system components described herein is merely an example; in other embodiments, additional or alternative components of other types and arrangements may be used to implement the communication system. For example, in other embodiments, the modular NAS architecture 100 / 110 may include other components / functions not explicitly shown herein.

[0032] Accordingly, Figure 1A and Figure 1B The configuration shown is merely an example configuration for a wireless cellular system; various alternative configurations of system components can be used. For example, although in Figure 1A and Figure 1BThe embodiments shown depict only a single element / function, but this is merely for simplicity and clarity of description. Of course, given alternative embodiments may include a greater number of such system elements, as well as additional or alternative elements of the type typically associated with conventional system implementations.

[0033] It should also be noted that, although Figure 1A and Figure 1B While system components are represented as single functional blocks, the various subnetworks that make up 5G and / or 6G networks are segmented into so-called network slices. A network slice (network partition) is a logical network that provides specific network capabilities and characteristics, which can optionally support corresponding service types using Network Function Virtualization (NFV) over a common physical infrastructure. In the case of NFV, network slices are instantiated based on the needs of a given service. Therefore, when an instance of a network slice or function is created, that network slice or function is instantiated. In some embodiments, this involves installing or additionally running the network slice or function on one or more host devices within the underlying physical infrastructure.

[0034] Figure 2 This is a block diagram illustrating the computational architecture for various participants in a methodology according to an illustrative embodiment. More specifically, system 200 is shown as including user equipment (UE) 202 and multiple entities 204-1, ..., 204-N. For example, in the illustrative embodiment, and referring back to reference... Figure 1B UE 202 may represent UE 112, while entities 204-1, ..., 204-N may represent functions 116, 118, and 120 (i.e., network entities, such as but not limited to SKMF, NF1, and NF2), any NFs otherwise mentioned herein, and system elements associated with RAN 114 (i.e., radio access entities, such as but not limited to RAN nodes, gNBs, etc.). It should be understood that UE 202 and entities 204-1, ..., 204-N are configured to interact to provide security management and other technologies described herein.

[0035] User equipment 202 includes a processor 212 coupled to memory 216 and interface circuitry 210. The processor 212 of user equipment 202 includes a security management processing module 214, which can be implemented at least partially in the form of software executed by the processor. The security management processing module 214 performs security management as described in conjunction with the following figures and other content herein. The memory 216 of user equipment 202 includes a security management storage module 218 that stores data generated or used during security management operations.

[0036] Each entity (referred to individually or collectively as 204 herein) includes a processor 222 (222-1, ..., 222-N) coupled to memories 226 (226-1, ..., 226-N) and interface circuitry 220 (220-1, ..., 220-N). Each processor 222 of each entity 204 includes a security management processing module 224 (224-1, ..., 224-N) that can be implemented at least partially in the form of software executed by the processor 222. The security management processing module 224 performs security management operations as described in conjunction with the following figures and other content herein. Each memory 226 of each entity 204 includes a security management storage module 228 (228-1, ..., 228-N) that stores data generated or used during security management operations.

[0037] Processor 212 and processor 222 may include, for example, a microprocessor (such as a central processing unit (CPU), application-specific integrated circuit (ASIC), digital signal processor (DSP) or other types of processing device), and portions or combinations of such elements.

[0038] Memory 216 and memory 226 may be used to store one or more software programs executed by respective processors 212 and 222 to implement at least a portion of the functions described herein. For example, software code executed by processors 212 and 222 may be used to implement, in a straightforward manner, the security management operations and other functions described in conjunction with the following figures and other content herein.

[0039] Therefore, one of the given memories 216 and 226 can be considered as an example of a computer program product, more generally referred to herein as a computer or processor-readable (non-transitory or storage) medium, in which executable program code is embodied. Other examples of computer or processor-readable media may include any combination of magnetic disks or other types of magnetic or optical media. Illustrative embodiments may include articles of manufacture containing such computer program products or other computer or processor-readable media.

[0040] Furthermore, and more specifically, memory 216 and memory 226 may include, for example, electronic random access memory (RAM), such as static RAM (SRAM), dynamic RAM (DRAM), or other types of volatile or non-volatile electronic memory. The latter may include, for example, non-volatile memory, such as flash memory, magnetic RAM (MRAM), phase-change RAM (PC-RAM), or ferroelectric RAM (FRAM). The term “memory” as used herein is intended to be interpreted broadly and may additionally or alternatively encompass, for example, read-only memory (ROM), disk-based memory, or other types of storage devices, as well as portions or combinations thereof.

[0041] Interface circuitry system 210 and interface circuitry system 220 illustratively include transceivers, or other communication hardware or firmware that allows associated system elements to communicate with each other in the manner described herein.

[0042] from Figure 2 As is evident here, user equipment 202 and multiple entities 204 are configured to communicate with each other as security management participants via their respective interface circuit systems 210 and 220. This communication involves each participant sending data to and / or receiving data from one or more other participants. The term "data" as used herein is intended to be interpreted broadly to encompass any type of information that may be sent between participants, including but not limited to identity data, key pairs, key indicators, tokens, secrets, security management messages, registration request / response messages and data, request / response messages, authorization and / or authentication request / response messages and data, metadata, control data, audio, video, multimedia, consent data, other messages, etc.

[0043] It should be understood that Figure 2 The specific arrangement of components shown is merely an example; in other embodiments, various alternative configurations may be used. For example, any given network element / function and / or access point may be configured to incorporate additional or alternative components and support other communication protocols.

[0044] Other system components ( Figure 1A and Figure 1B Network functions and other components not explicitly shown herein, including those to be discussed in this document Figures 3 to 5 Those (further described in the context) can each be configured to include components such as processors, memory, and network interfaces. Moreover, entities such as third-party applications and network operators can participate in the methods described herein via computing devices configured to include components such as processors, memory, and network interfaces. These elements and devices do not need to be implemented on separate, independent processing platforms, but can instead represent, for example, different functional parts of a single, common processing platform.

[0045] More generally, Figure 2 These can be considered as representing processing devices configured to provide their respective security management functions and operatively coupled to each other in a communication system. By way of example only, all or part of each of the UE 202 and the plurality of entities 204 (e.g., processor and memory) can be considered as examples of components for performing one or more operations, one or more steps, one or more functions, one or more processes, etc., as described herein.

[0046] Given the general description of the relevant features of the illustrative modular NAS architecture above, the technical challenges and solutions proposed based on the illustrative embodiments will now be described below.

[0047] For example, one technical challenge is establishing a secure NAS connection between the UE and an NF in the UE's home public land mobile network (HPLMN) (e.g., the UE subscriber's home network). Assuming the SKMF is located in the visited public land mobile network (VPLMN) (e.g., the visited or serving network) that the UE is currently visiting, then it is not possible to establish a secure NAS connection based on the above. Figure 1B The security architecture described in the context is used to establish a secure NAS connection between the UE and the NF in the HPLMMN. (For example, it is not reasonable from a security perspective for the VPLMN NF to provide a key to securely protect messages between the UE and the HPLMMN NF).

[0048] Another related technical challenge is how an NF in the HPLMN can discover the NF storing the HPLMN-specific NAS key (hereinafter referred to as H-SKMF) so that the NAS connection can be used to deliver HPLMN data to the UE. As an example, suppose the Network Data Analysis Function (NWDAF) in the HPLMN needs to securely send data to the UE via the VPLMN to which the UE is currently attached in the roaming scenario. The NWDAF will first need to discover the NF that stores the NAS security material (e.g., H-SKMF) for the UE, so that the NWDAF can securely deliver data to the UE via the NAS connection.

[0049] The illustrative embodiments overcome the aforementioned and other technical challenges by providing techniques for secure communication between a device and its home network in a modular NAS architecture. More specifically, the illustrative embodiments achieve end-to-end security between the UE and the HPLMN NF (e.g., HPLMN NF X) via a security context established between the UE and the HPLMN NF. The established security context includes the home parent key K associated with the KSI. home_parent and a set of security algorithms (e.g., encryption / cryptography algorithms and integrity protection algorithms).

[0050] By way of an illustrative embodiment, the establishment of a security context may include the following: (i) During the primary AKA, the UE and the network (e.g., authentication server function or AUSF) from K AUSF Derivation of K home_parent . (ii) The network (e.g., H-SKMF) is K home_parent Assign one or more KSIs and provide them to the UE. Each KSI is for a specific type of HPLMN NF (e.g., Unified Data Management (UDM) function, Home Network Policy Control (H-PCF) function, etc.). (iii) The UE and HPLMN NF agree on which key and security algorithm to use. To this end, the HPLMN NF initiates the SMC procedure and provides the KSI (to identify the key to be used) and the selected security algorithm. During the SMC procedure, a globally unique identifier (ID) for the UE is also provided to the UE. (iv) After the SMC procedure, the UE and HPLMN NF can safely exchange messages.

[0051] Now will be Figures 3 to 5 Further illustrative details of the modular NAS approach for roaming use cases are described in the context of [the previous sentence].

[0052] Figure 3 A security key agreement process 300 in a modular NAS architecture according to an illustrative embodiment is shown. As shown, the security key agreement process 300 involves a UE 302, a VPLMN 310 having an NF 312 (NF1), and an HPLMN 320 having an AUSF 322, an H-SKMF 324, and a UDM 326.

[0053] The purpose of the security key agreement process 300 (steps 2 through 5) is to enable UE 302 and H-SKMF 324 to share the K key to be used to protect messages between UE 302 and one or more HPLMN NFs. home_parent .

[0054] Step 2: Trigger the main AKA. For example, the registration process described in Figure 6.1.2-1 of 3GPP TS 33.501 can be performed in this step.

[0055] Step 1: UDM 326 sends the authentication vector to AUSF 322 via the Nudm_UEAuthentication_Get response.

[0056] Step 0: Based on the authentication vector, make K AUSFAvailable in AUSF 322. AUSF 322 derives K. home_parent and K home_parent Provided to H-SKMF 324.

[0057] Step 1: K home_parent It became available in H-SKMF 324. For example: (i) In one illustrative embodiment, AUSF 322 can be derived from K AUSF Create K home_parent (In this case, H-SKMF 324 is not co-located with AUSF 322), and K is provided to H-SKMF 324 as described in step 0. home_parent The following will describe the information from K. AUSF Derivation of K home_parent Explanatory details. (ii) In another illustrative embodiment, H-SKMF 324 is juxtaposed with AUSF 322. AUSF 322 / H-SKMF 324 is located from K... AUSF Calculate K home_parent The following will describe the information from K. AUSF Derivation of K home_parent Illustrative details. In this alternative, the signaling from AUSF 322 to H-SKMF 324 described in step 0 is internal signaling.

[0058] Regarding the derived K home_parent H-SKMF 324 assigns KSI and matches KSI with K home_parent Associated. Each KSI is associated with an HPLMN NF (e.g., UDM, H-PCF, etc.). H-SKMF 324 can assign a single KSI common to all HPLMN NFs.

[0059] In some illustrative embodiments, H-SKMF 324 can also be derived from K for each HPLMN NF (e.g., UDM, H-PCF, etc.). home_parent Derivation of the unique key K HPLMN_NF And for the derived K HPLMN_NF Assign a unique KSI. H-SKMF324 can be used to derive K HPLMN_NF Use a distinguisher (e.g., the type of NAS / HPLMN NF, the content of the KSI for HPLMN NF, etc.).

[0060] Step 2: H-SKMF 324 sends a KSI for HPLMN NF to AUSF 322.

[0061] Step 3: AUSF 322 transparently transmits the KSI associated with the NAS of the HPLMN NF to UE 302 via NF 312 (as described above, NF 312 can be an MM NF). This step may correspond to step 5 in section 6.1.3.2.0 of 3GPP TS 33.501 referenced above or step 10 in section 6.1.3.1 of 3GPP TS 33.501 referenced above.

[0062] Step 4: NF 312 provides UE 302 with a KSI for the HPLMN NF. This step may correspond to step 6 in section 6.1.3.2.0 of 3GPP TS 33.501 referenced above, or step 11 in section 6.1.3.1 of 3GPP TS 33.501 referenced above. Each KSI may be associated with the type of NAS / HPLMN NF, allowing UE 302 to identify which NAS connection each KSI is for.

[0063] Step 5: UE 302 from K AUSF Derivation of K home_parent UE 302 will receive the KSI and K for HPLMN NF. home_parent Related.

[0064] In some illustrative embodiments, UE 302 can also obtain K from each HPLMN NF (e.g., UDM, H-PCF, etc.). home_parent Derivation of key K HPLMN_NF And the received KSI is compared with the derived K HPLMN_NF Related. UE 302 can derive K HPLMN_NF Use a distinguisher (e.g., the type of NAS / HPLMN NF, the content of the KSI for HPLMN NF, etc.).

[0065] Figure 4 A Security Mode Control (SMC) process 400 in a modular NAS architecture according to an illustrative embodiment is shown. As shown, the SMC process 400 involves a UE 402, a VPLMN 410 having NF 412 (NF1), and an HPLMN 420 having H-SKMF 422 and HPLMN NF 424.

[0066] The purpose of SMC procedure 400 (steps 1 through 6) is to enable UE 402 and HPLMN NF 424 to agree on the K identified by KSI and the security algorithm. home_parent (or K) HPLMN_NF (to establish a secure connection between UE 402 and HPLMN NF 424).

[0067] Step 1: UE 402 indicates its security capabilities to NF 412. The message used in this step may be a "Registration Request" message. Security capabilities may include security algorithms supported by UE 402.

[0068] Step 2: NF 412 forwards security capabilities to H-SKMF 422. NF 412 can send security capabilities to H-SKMF 422 directly or via (multiple) other NFs (e.g., AUSF (not explicitly shown)). If the security capability is delivered via AUSF, NF 412 can invoke the Nausf_UEAuthentication_Authenticate service to AUSF, and then AUSF can invoke the Nh-skmf service. H-SKMF 422 stores the UE security capability information.

[0069] Step 3: Assume that messages need to be exchanged between UE 402 and HPLMN NF 424, but there is no security context between UE 402 and HPLMN NF 424. This need can be identified by either UE 402 or HPLMN NF 424.

[0070] Sub-step 3a (3a1 and 3a2): Again, assume UE 402 needs to send a message (e.g., message X) to HPLMN NF 424. UE 402 creates an MM message and includes in the MM message an indication of the type of message X (e.g., NAS container type), and optionally includes the message destined for HPLMN NF 424 (e.g., message X). In message X, UE 402 only includes non-sensitive information because a secure connection between UE 402 and HPLMN NF 424 has not yet been established. If UE 402 only needs to send sensitive information, then at this step, UE 402 may not include message X in the MM message; UE 402 will send message X after the SMC procedure (e.g., after step 6 described below) or via the “HPLMN NF Security Mode Command” message in step 6.

[0071] Based on the indication in the MM message (e.g., NAS container type), NF 412 can identify that HPLMN NF 424 needs to be contacted. NF 412 can contact HPLMN NF424 directly or via other NF(s) that include the corresponding part of the HPLMN NF in the VPLMN (e.g., in the case that the HPLMN NF is an H-PCF, signaling is propagated via V-PCF, i.e., NF→V-PCF→H-PCF). If NF 412 receives message X, then NF 412 also forwards message X.

[0072] Upon being contacted, HPLMN NF 424 determines that it needs to obtain information from H-SKMF 422 to establish a secure connection between UE 402 and HPLMN NF 424. HPLMN NF 424 proceeds to sub-step 3b.

[0073] Sub-step 3b: After sub-step 3a, or after HPLMN NF 424 identifies the need to send a message to UE 402 (in the absence of a trigger from UE 402, e.g., without executing sub-step 3a), HPLMNNF 424 sends a request for security information to H-SKMF 422, as shown below. Figure 5 Described in the context of.

[0074] Step 4: After sub-step 3b, or as part of the registration or main AKA process (i.e., even before identifying any need to send messages from HPLMN NF 424 to UE 402 or from UE 402 to HPLMN NF 424 respectively); for example, in Figure 3 Following step 1 in the security key agreement process 300, H-SKMF 422 provides HPLMN NF 424 with the security capabilities of UE 402 (which have become available via step 2), and has been based on Figure 3 Step 1 of the secure key agreement process 300 becomes available. home_parent (or K) HPLMN_NF ), and with K home_parent KSI associated with HPLMN NF 424 (or related to K HPLMN_NF (Associated KSI). It should be noted that step 4 assumes that AUSF and H-SKMF 422 are not juxtaposed and K home_parent Not K AUSF .

[0075] Step 5: The HPLMN NF424 selects a security algorithm from the security algorithms included in its security capabilities. The HPLMN NF424 will use the received K... home_parent (or K) HPLMN_NF This is used to derive the NAS key (integrity and cryptographic key) for the HPLMN NF. HPLMN NF 424 creates a standard "HPLMN NF Security Mode Command" message and uses the selected security algorithm and K... home_parent (or K) HPLMN_NFThe NAS integrity key derived from [the previous step] is used to protect the integrity of ordinary "HPLMN NF Security Mode Command" messages. In the "HPLMN NF Security Mode Command" message, HPLMN NF 424 includes a copy of UE 402's security capabilities, KSI, the selected security algorithm, and a globally unique ID assigned to UE 402 by HPLMN NF 424. HPLMN NF 424 sends the integrity-protected "HPLMN NF Security Mode Command" message.

[0076] Step 6: After receiving the "HPLMN NF Security Mode Command" message, UE 402 checks whether the HPLMNNF Security Mode Command can be accepted. This is done by performing a message integrity check and verifying that the received replayed security capabilities have not been changed compared to the latest value sent by UE 402 (as described in Step 1). The integrity check is performed using K... home_parent (or K) HPLMN_NF It is executed based on the integrity derived in ), where K home_parent (or K) HPLMN_NF The KSI is identified by the received KSI and the security algorithm used for integrity protection.

[0077] UE 402 sends a response message to HPLMN NF 424. If the safe mode command is accepted, UE 402 responds with an "HPLMN NF safe mode complete" message, which is sent using the K... home_parent (or K) HPLMN_NF Integrity protection is performed using the integrity key derived from KSI and the selected security algorithm. home_parent (or K) HPLMN_NF The encryption is performed using the cryptographic key derived from [the previous step]. If the security mode command is not accepted, UE 402 responds with an "HPLMN NF Security Mode Denied" message. In this message, UE 402 may include a reason value. UE 402 may include the current PLMN in the list of disabled PLMNs.

[0078] Following a successful SMC procedure, UE 402 and HPLMN NF 424 can securely exchange messages. For example, if UE 402 needs to send a message (i.e., message Y) to HPLMN NF 424, UE 402 may include: (i) A globally unique ID (or a portion thereof) for UE 402; (ii) NAS container type (associated with HPLMN NF 424); and (iii) NAS container targeting HPLMN NF 424 (NAS container containing message Y); And it is sent to NF 412. Based on the NAS container type and a portion of the globally unique ID provided by UE 402, NF 412 simply forwards message Y directly or via (multiple) VPLMN NFs to the correct HPLMN NF, where (multiple) VPLMN NFs ultimately forward message Y to HPLMN NF 424.

[0079] Illustrative embodiments provide for K home_parent Multiple methods for deriving functions. Some methods can be illustrated with examples:

[0080] Method 1:

[0081] When from K AUSF Derivation of K home_parent The following parameters can be used to form the input S of the Key Derivation Function (KDF): -FC = new FC value; -P0 = HOME_PARENT; -L0 = the length of HOME_PARENT; (i.e., 0x00, 0x04) -P1 = SUPI / UE ID / USER ID; -L1 = Length of SUPI / UE ID / USER ID.

[0082] The key should be K. AUSF .

[0083] SUPI can be the same value as parameter P0 in Appendix A.7.0 of TS 33.501 referenced above.

[0084] The UE ID can be the PEI. The USER ID can be the user identifier following the UE.

[0085] Method 2:

[0086] When from K AUSF Derivation of K home_parent The following parameters can be used to form the input S of the KDF: -FC = new FC value; -P0 = COUNT value; -L0 = the length of COUNT; (i.e., 0x00, 0x04) -P1 = SUPI / UE ID / USER ID; -L1 = Length of SUPI / UE ID / USER ID.

[0087] The input key KEY can be K AUSF .

[0088] SUPI can be the same value as parameter P0 in Appendix A.7.0 of TS 33.501 referenced above.

[0089] The UE ID can be the PEI. The USER ID can be the user identifier following the UE.

[0090] The COUNT value is a counter maintained by the UE and the network, incremented by 1 for each new NAS connection. For the first NF, the count will be 1, and for the second NF, the count will be 2.

[0091] Method 3:

[0092] When from K AUSF Derivation of K home_parent The following parameters can be used to form the input S of the KDF: -FC = new FC value; -P0 = RAND value; -L0 = the length of the RAND; (i.e., 0x00, 0x04) -P1 = SUPI / UE ID / USER ID; -L1 = Length of SUPI / UE ID / USER ID.

[0093] The input key KEY can be K AUSF .

[0094] SUPI can be the same value as parameter P0 in Appendix A.7.0 of TS 33.501 referenced above.

[0095] The UE ID can be the PEI. The USER ID can be the user identifier following the UE.

[0096] SUPI and PEI are identifiers that identify subscribers and user devices. For example, SUPI is a subscription perpetual identifier, while PEI is a perpetual device identifier.

[0097] The RAND value is a random value determined by the H-SKMF. The RAND value is then sent from the H-SKMF to the NF, and the NF sends this RAND value as part of a New Information Element (IE) in the SMC message (for integrity protection only). Once the UE receives the RAND value, it uses it to calculate the key.

[0098] It should be understood that H-SKMF handles NAS from HPLMN to UE. However, since multiple H-SKMFs may exist in HPLMN, one H-SKMF will handle the NAS connection for the UE. Therefore, for an NF that wants to send data to the UE using HPLMN NAS, H-SKMF discovery is required.

[0099] Figure 5 An H-SKMF discovery process 500 in a modular NAS architecture according to an illustrative embodiment is shown. As shown, the H-SKMF discovery process 500 involves a UE 502 and an HPLMN 510 having an H-SKMF 512, a UDM 514, and an HPLMN NF 516.

[0100] The purpose of H-SKMF discovery process 500 (steps 1 to 3) is to enable the NF that wants to send data to the UE using HPLMN NAS.

[0101] Step 1: When H-SKMF 512 creates a NAS for UE 502, H-SKMF 512 registers its ID with UDM 514. For this step, H-SKMF 512 can use the Nudm_UECM_Registration application programming interface (API) or a new API with the following parameters: (i) UE ID (SUPI); (ii) H-SKMF instance ID; and (iii) NAS connection creation timestamp.

[0102] Step 2: When the HPLMN NF 516 wants to send packets / data to the UE 502 via the NAS, the HPLMN NF 516 queries the UDM 514 to select H-SKMF 512. For this step, the HPLMN NF 516 uses the Nudm_UECM_Get API or the new API to obtain the service H-SKMF 512 for the NAS connection. The Get query can include the following parameters: (i) SUPI or UE ID; and (ii) the requested H-SKMF address.

[0103] Step 3: UDM 514 returns the H-SKMF address to HPLMN NF 516.

[0104] Accordingly, HPLMN NF 516 sends a request to H-SKMF 512, and H-SKMF 512 delivers it to UE502. These steps are similar to... Figure 4 Steps 3 to 6 of the SMC process 400 are similar.

[0105] Advantageously, the illustrative embodiments extend modular NAS to UE roaming architectures. More specifically, end-to-end security between the UE and the HPLMN NF is achieved without altering the existing roaming interface.

[0106] In some embodiments, an apparatus includes at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: receive one or more key set identifiers from a first communication network, the one or more key set identifiers being previously assigned by a second communication network, the second communication network being the home network of the apparatus, the one or more key set identifiers corresponding to one or more network entities in the second communication network; and generate one or more keys, wherein the one or more keys are identical to one or more keys associated with the one or more key set identifiers in the second communication network.

[0107] In another embodiment, the device may also be configured to generate one or more keys based on an authentication-based key derived by the device during an authentication process that includes a second communication network.

[0108] In another embodiment, the device may also be configured to associate one or more key set identifiers with one or more keys. The one or more keys may each correspond to one or more network entities in the second communication network. At least a portion of the one or more keys may be generated separately using a distinguishing value specific to the corresponding network entity in the second communication network. Each of the one or more key set identifiers may be associated with each of the one or more keys. The one or more key set identifiers may be secure connections that the device can use to establish one or more secure connections with one or more network entities in the second communication network. The one or more secure connections may be one or more secure non-access stratum connections. The one or more keys may be public keys that the device can use to establish one or more secure connections with one or more network entities in the second communication network. The device may be part of a first user equipment communicating with the second communication network via the first communication network.

[0109] In some embodiments, a method includes: receiving, by a first user equipment, one or more key set identifiers from a first communication network, the one or more key set identifiers being previously assigned by a second communication network, the second communication network being the home network of the first user equipment, the one or more key set identifiers corresponding to one or more network entities in the second communication network; and generating, by the first user equipment, one or more keys, wherein the one or more keys are identical to one or more keys associated with the one or more key set identifiers in the second communication network.

[0110] In some embodiments, an apparatus includes at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: obtain a first key at the apparatus, the apparatus being a network entity in a first communication network, the first communication network being the home network of a first user equipment; generate one or more key set identifiers corresponding to one or more network entities in the first communication network using the first key; and send one or more key set identifiers to the first user equipment via a second communication network.

[0111] In another embodiment, the device may also be configured to obtain a first key from an authentication entity in the first communication network. The device may also be configured to generate one or more second keys based on the first key, each of the one or more second keys corresponding to one or more network entities in the second communication network. At least a portion of the one or more second keys may be generated separately using a distinguishing value specific to a corresponding network entity in the first communication network. Each of the one or more key set identifiers may be associated with each of the one or more second keys. The one or more key set identifiers may be available from the first user equipment to establish one or more secure connections with one or more network entities in the first communication network, respectively. The one or more secure connections may be one or more secure non-access stratum connections. The first key may be a public key available to one or more network entities in the first communication network. The device may be part of a secure key management function of the first communication network. The first key may be derived based on one or more permanent identifiers of the first user equipment. The first key may be derived based on a count value maintained between the device and the first user equipment. The first key may be derived based on a random value determined by the device.

[0112] In some embodiments, a method includes: obtaining a first key by a first network entity, the first network entity being the home network of a first user equipment in a first communication network; generating one or more key set identifiers corresponding to one or more network entities in the first communication network using the first key; and sending the one or more key set identifiers to the first user equipment via a second communication network by the first network entity.

[0113] In some embodiments, an apparatus includes at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: receive a security mode command message from a first network entity in a first communication network via a second communication network, the security mode command message having security information including a key set identifier, the key set identifier being one of one or more key set identifiers previously received from the first communication network and associated with a first key, and the first communication network being the home network of the apparatus; and establish a security context between the apparatus and the first network entity in the first communication network using the security information.

[0114] In another embodiment, the security information of the received security mode command message may further identify a security algorithm, which is selected by a first network entity of the first communication network based on the device's security capabilities. The security information of the received security mode command message may also identify a globally unique identifier assigned to the device by the first network entity of the first communication network. The received security mode command message may be integrity protected. The device may also be configured to perform an integrity check on the received security mode command message using an integrity key derived from a first key and a security algorithm from one of the selected security algorithms. The device may also be configured to send a security mode completion message to the first network entity in the first communication network after a successful integrity check. The security mode completion message may: (i) be integrity protected using a security algorithm from one of the selected security algorithms and an integrity key derived from the first key; and (ii) be encrypted using another security algorithm from one of the selected security algorithms and an encryption key derived from the first key. The device may also be configured to securely send a message to the first network entity in the first communication network via a second communication network after establishing a security context. The message may include a globally unique identifier for the device, a data container type, and a data container, assigned by a first network entity of the first communication network. The first key may be a home key that can be used in a modular non-access stratum architecture when the device is roaming.

[0115] In some embodiments, a method includes: a first user equipment receiving a security mode command message from a first network entity in a first communication network via a second communication network, the security mode command message having security information including a key set identifier, the key set identifier being one of one or more key set identifiers previously received from the first communication network and the one or more key set identifiers being associated with a first key, and the first communication network being the home network of the first user equipment; and the first user equipment using the security information to establish a security context between the first user equipment and the first network entity in the first communication network.

[0116] In some embodiments, an apparatus includes at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: obtain security information for a first user equipment from a first network entity in a first communication network, the apparatus being part of the first communication network, wherein the security information includes security capabilities of the first user equipment, a first key, and a key set identifier associated with the first key and assigned to the apparatus; and use the security information to establish a security context between the apparatus and the first user equipment via a second communication network.

[0117] In another embodiment, the apparatus may also be configured to select a security algorithm for the first user equipment (User Equipment) based on its security capabilities. The apparatus may also be configured to generate a security mode command message, which includes a globally unique identifier for the first User Equipment, an indicator for the selected security algorithm, a key set identifier, and the security capabilities of the first User Equipment. The apparatus may also be configured to protect the security mode command message with integrity using a security algorithm selected from the security algorithms and an integrity key derived from a first key. The apparatus may also be configured to send the security mode command message to the first User Equipment via a second communication network. The apparatus may also be configured to receive a message from the first User Equipment, which includes a globally unique identifier for the first User Equipment, a data container type, and a data container. The first key may be a home key that can be used in a modular non-access stratum architecture when the first User Equipment is roaming. The apparatus may also be configured to discover a first network entity in the first communication network before obtaining security information for the first User Equipment from the first network entity.

[0118] In some embodiments, a method includes: obtaining security information for a first user equipment from a second network entity in a first communication network, the first network entity being part of the first communication network, wherein the security information includes security capabilities of the first user equipment, a first key, and a key set identifier associated with the first key and assigned to the first network entity; and establishing a security context between the first network entity and the first user equipment via the second communication network using the security information.

[0119] It should be understood that the specific processing operations and other system functions described in conjunction with the figures herein are presented by way of illustrative example only and should not be construed as limiting the scope of this disclosure in any way. Alternative embodiments may use other types of processing operations and messaging protocols. For example, in other embodiments, the order of steps may be changed, or certain steps may be performed at least partially concurrently rather than serially. Moreover, one or more steps may be repeated periodically, or multiple instances of the method may be performed in parallel with each other.

[0120] It should be emphasized again that the various embodiments described herein are presented by way of illustrative example only and should not be construed as limiting the scope of the claims. For example, alternative embodiments may utilize different communication system configurations, user equipment configurations, base station configurations, authorization processes, messaging protocols, and message formats than those described above in the context of the illustrative embodiments. These and many other alternative embodiments within the scope of the appended claims will be apparent to those skilled in the art.

Claims

1. An apparatus for communication, comprising: at least one processor; and at least one memory that stores instructions, which when executed by the at least one processor, cause the apparatus at least to: receive, from a first communication network, one or more key set identifiers, the one or more key set identifiers being previously assigned by a second communication network, the second communication network being a home network of the apparatus, the one or more key set identifiers corresponding to one or more network entities in the second communication network; and generate one or more keys, wherein the one or more keys are identical to one or more keys to which the one or more key set identifiers are associated in the second communication network.

2. The apparatus of claim 1, wherein the apparatus is further caused to: generate the one or more keys from authentication-based keys derived by the apparatus during an authentication procedure that includes the second communication network.

3. The apparatus of claim 1, wherein the apparatus is further caused to: associate the one or more key set identifiers with the one or more keys.

4. The apparatus of claim 1, wherein the one or more keys respectively correspond to the one or more network entities in the second communication network.

5. The apparatus of claim 4, wherein at least a portion of the one or more keys are respectively generated using a differentiating value, the differentiating value being specific to a corresponding network entity of the second communication network.

6. The apparatus of claim 4, wherein each of the one or more key set identifiers is associated with each of the one or more keys.

7. The apparatus of claim 1, wherein the one or more key set identifiers are usable by the apparatus to respectively establish one or more secure connections with the one or more network entities of the second communication network.

8. The apparatus of claim 7, wherein the one or more secure connections are one or more secure non-access stratum connections.

9. The apparatus of claim 1, wherein the one or more keys are common keys usable by the apparatus to establish one or more secure connections with the one or more network entities of the second communication network.

10. The apparatus of claim 1, wherein the apparatus is part of a first user equipment that communicates with the second communication network through the first communication network.

11. A method for communication, comprising: receiving, by a first user equipment, one or more key set identifiers from a first communication network, the one or more key set identifiers being previously assigned by a second communication network, the second communication network being a home network of the first user equipment, the one or more key set identifiers corresponding to one or more network entities in the second communication network; and generating one or more keys, wherein the one or more keys are identical to one or more keys to which the one or more key set identifiers are associated in the second communication network. generating, by the first user equipment, one or more keys, wherein the one or more keys are identical to one or more keys to which the one or more key set identifiers are associated in the second communication network.

12. An apparatus for communication, comprising: at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to at least: obtain, at the apparatus, a first key, the apparatus being a network entity in a first communication network, the first communication network being a home network of a first user equipment; generate, using the first key, one or more key set identifiers corresponding to one or more network entities in the first communication network; and send, to the first user equipment, the one or more key set identifiers over a second communication network.

13. The apparatus of claim 12, wherein the apparatus is further caused to: obtain the first key from an authentication entity in the first communication network.

14. The apparatus of claim 12, wherein the apparatus is further caused to: generate, from the first key, one or more second keys, the one or more second keys respectively corresponding to the one or more network entities in the second communication network.

15. The apparatus of claim 14, wherein at least a portion of the one or more second keys are respectively generated using a differentiating value, the differentiating value being specific to a corresponding network entity of the first communication network.

16. The apparatus of claim 14, wherein each of the one or more key set identifiers is associated with each of the one or more second keys.

17. The apparatus of claim 12, wherein the one or more key set identifiers are usable by the first user equipment to respectively establish one or more secure connections with the one or more network entities of the first communication network.

18. The apparatus of claim 17, wherein the one or more secure connections are one or more secure non-access stratum connections.

19. The apparatus of claim 12, wherein the first key is a common key usable by the one or more network entities of the first communication network.

20. The apparatus of claim 12, wherein the apparatus is part of a security key management function of the first communication network.

21. The apparatus of claim 12, wherein the first key is derived based on one or more permanent identifiers of the first user equipment.

22. The apparatus of claim 12, wherein the first key is derived based on a count value maintained between the apparatus and the first user equipment.

23. The apparatus of claim 12, wherein the first key is derived based on a random value determined by the apparatus.

24. A method for communication, comprising: obtaining, by a first network entity, a first key, the first network entity being in a first communication network, the first communication network being a home network of a first user equipment; generating, by the first network entity, one or more key set identifiers corresponding to one or more network entities in the first communication network using the first key; and sending, by the first network entity, the one or more key set identifiers to the first user equipment through a second communication network.

Images