Apparatus, method, and computer program

Abstract

The present disclosure relates to an apparatus configured to perform: receiving, from a base station, a first message comprising: an authentication and key agreement challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; performing successful verification of the authentication and key agreement challenge packet, the access stratum security mode command packet, and the non-access stratum security mode command packet; and transmitting, to the base station, a second message comprising: an authentication and key agreement response packet, an access stratum security mode command complete packet, and a non-access stratum security mode command complete packet.

Description

Technical Field

[0001] This disclosure relates to technologies for managing security in communication systems. Background Technology

[0002] A communication system can be viewed as a facility that enables communication sessions between two or more entities, such as communication equipment, base stations, and / or other nodes, by providing carriers between the various entities involved in the communication path.

[0003] A communication system can be a wireless communication system. Examples of wireless systems include public terrestrial mobile networks that operate based on radio standards (such as those provided by 3GPP), satellite-based communication systems, and various wireless local area networks (e.g., wireless LANs). Wireless systems are typically divided into cells and are therefore often referred to as cellular systems.

[0004] Communication systems and their associated equipment typically operate according to a given standard or specification that defines what the various entities associated with the system are allowed to do and how they should be implemented. The communication protocols and / or parameters that should be used for the connection are also usually defined. Examples of standards include 4G, 5G, or 6G standards. Summary of the Invention

[0005] According to one aspect, an apparatus is provided, the apparatus comprising: at least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured together with the at least one processor such that the apparatus at least performs: receiving a first message from a base station, the first message including: access stratum security mode command packets and non-access stratum security mode command packets; performing successful verification of the access stratum security mode command packets and non-access stratum security mode command packets; and sending a second message to the base station, the second message including access stratum security mode command completion packets and non-access stratum security mode command completion packets.

[0006] Access Stratified Security Mode Command (ASMS) packets may include a Message Authentication Code (MAC), and successful verification of an ASMS packet may include successful verification of the MAC included in the ASMS packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0007] A Non-Access Stratum Security Mode (NASSM) command packet may include a Message Authentication Code (MAC), and successfully verifying a NASSM command packet may include successfully verifying the MAC included in the NASSM command packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0008] The first message may also include an indication of a security level selection; and at least one memory and computer code may be configured, together with at least one processor, such that the device performs at least: generating an access layer key K for encryption based on the indication of the security level selection. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following; and an instruction based on the selection of the security level, generating a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0009] At least one memory and computer code can be configured, together with at least one processor, such that the device performs at least: using the access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following: performing at least one of an access stratum security mode command to complete packet encryption or access stratum security mode command to complete packet integrity protection; using a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following: to execute at least one of encryption of a non-access stratum security mode command completion packet or integrity protection of a non-access stratum security mode command completion packet; and the second message may include at least one of authentication and key negotiation response packet, encrypted access stratum security mode command completion packet or integrity protection access stratum security mode command completion packet, and at least one of encrypted non-access stratum security mode command completion packet or integrity protection non-access stratum security mode command completion packet.

[0010] The access stratum key K for encryption is generated based on the indication of the selected security level. LPSenc Or the access layer key K used for integrity protection LPSint At least one of them may include: generating an access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint The selection of at least one of the security choices includes the number of bits corresponding to the security level.

[0011] Generate an access layer key K for encryption, including the number of bits corresponding to the security level. LPSenc Or the access layer key K used for integrity protection LPSint The security options for at least one of them may include: generating a base station key K gNB_LPS The base station key K gNB_LPS This includes the number of bits corresponding to the security level; and the base station key K. gNB_LPS Generate an access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the safest options.

[0012] A non-access stratum key K for encryption is generated based on the indication of the selected security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: generating a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint The security selection of at least one of them includes the number of bits corresponding to the security level.

[0013] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint Security options for at least one of these may include: generating a mobility management network function key K. MM NF The mobility management network function key K MM NF This includes the number of bits corresponding to the security level; and the mobility management network function key K. MM NF Generate a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the safest options.

[0014] The device may include user equipment.

[0015] This device may include Internet of Things (IoT) devices.

[0016] According to one aspect, an apparatus is provided, the apparatus comprising components for: receiving a first message from a base station, the first message including: access stratum security mode command packets and non-access stratum security mode command packets; performing successful verification of the access stratum security mode command packets and non-access stratum security mode command packets; and sending a second message to the base station, the second message including: access stratum security mode command completion packets and non-access stratum security mode command completion packets.

[0017] According to one aspect, a method is provided, the method comprising: receiving a first message from a base station, the first message including: an access stratum security mode command packet and a non-access stratum security mode command packet; performing successful verification of the access stratum security mode command packet and the non-access stratum security mode command packet; and sending a second message to the base station, the second message including an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0018] This method can be performed by a device.

[0019] Access Stratified Security Mode Command (ASMS) packets may include a Message Authentication Code (MAC), and successful verification of an ASMS packet may include successful verification of the MAC included in the ASMS packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0020] A Non-Access Stratum Security Mode (NASSM) command packet may include a Message Authentication Code (MAC), and successful verification of a NASSM command packet may include: successfully verifying the MAC included in the NASSM command packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0021] The first message may also include an indication of a security level selection; and the method may include: generating an access stratum key K for encryption based on the indication of the security level selection. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following; and an instruction based on the selection of the security level, generating a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0022] The method may include: using an access stratum key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following: performing an access stratum security mode command to complete packet encryption or performing access stratum security mode command to complete packet integrity protection; using a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASintAt least one of the following: to execute at least one of encryption of a non-access stratum security mode command completion packet or integrity protection of a non-access stratum security mode command completion packet; and wherein the second message may include at least one of authentication and key negotiation response packet, encrypted access stratum security mode command completion packet or integrity protection access stratum security mode command completion packet, and at least one of encrypted non-access stratum security mode command completion packet or integrity protection non-access stratum security mode command completion packet.

[0023] The access stratum key K for encryption is generated based on the indication of the selected security level. LPSenc Or the access layer key K used for integrity protection LPSint At least one of them may include: generating an access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint The security selection of at least one of them includes the number of bits corresponding to the security level.

[0024] Generate an access layer key K for encryption, including the number of bits corresponding to the security level. LPSenc Or the access layer key K used for integrity protection LPSint The security options for at least one of them may include: generating a base station key K gNB_LPS The base station key K gNB_LPS This includes the number of bits corresponding to the security level; and the base station key K. gNB_LPS Generate an access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the safest options.

[0025] A non-access stratum key K for encryption is generated based on the indication of the selected security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: generating a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint The security selection of at least one of them includes the number of bits corresponding to the security level.

[0026] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint Security options for at least one of these may include: generating a mobility management network function key K. MM NF The mobility management network function key K MM NFThis includes the number of bits corresponding to the security level; and the mobility management network function key K. MM NF Generate a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the safest options.

[0027] The device may include user equipment.

[0028] This device may include Internet of Things (IoT) devices.

[0029] According to one aspect, an apparatus is provided, the apparatus comprising a circuit system configured to perform: receiving a first message from a base station, the first message including: an access stratum security mode command packet and a non-access stratum security mode command packet; performing successful verification of the access stratum security mode command packet and the non-access stratum security mode command packet; and sending a second message to the base station, the second message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0030] According to one aspect, a computer program is provided, the computer program including computer-executable instructions that execute at runtime on one or more processors: receiving a first message from a base station, the first message including: an access stratum security mode command packet and a non-access stratum security mode command packet; performing successful verification of the access stratum security mode command packet and the non-access stratum security mode command packet; and sending a second message to the base station, the second message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0031] According to one aspect, an apparatus is provided, the apparatus comprising: at least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured together with the at least one processor such that the apparatus at least performs: sending a first message to a user equipment, the first message including: an access stratum security mode command packet and a non-access stratum security mode command packet; and receiving a second message from the user equipment, the second message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0032] The first message may also include instructions on selecting a security level.

[0033] At least one memory and computer code may be configured, together with at least one processor, such that the device performs at least: successful verification of an access stratum security mode command completion packet; and sending a third message to a network function, the third message including at least one of an authentication and key negotiation response packet, and an encrypted non-access stratum security mode command completion packet or an integrity-protected non-access stratum security mode command completion packet.

[0034] The Access Layer Security Mode Command Completion Packet may include a Message Authentication Code (MAC), and successfully verifying the Access Layer Security Mode Command Completion Packet may include successfully verifying the MAC included in the Access Layer Security Mode Command Completion Packet. It should be understood that if the MAC matches the expected MAC, the verification of the MAC can be successful.

[0035] The device includes a base station.

[0036] This network functionality includes mobility management network functions.

[0037] Mobility management network functions can be part of a service network (e.g., an access network).

[0038] According to one aspect, an apparatus is provided, the apparatus comprising components for: sending a first message to a user equipment, the first message including: an access stratum security mode command packet and a non-access stratum security mode command packet; and receiving a second message from the user equipment, the second message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0039] According to one aspect, a method is provided, the method comprising: sending a first message to a user equipment, the first message including: an access stratum security mode command packet and a non-access stratum security mode command packet; and receiving a second message from the user equipment, the second message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0040] This method can be performed by a device.

[0041] The first message may also include instructions on selecting a security level.

[0042] The method may include: performing successful verification of the access stratum security mode command completion packet; and sending a third message to the network function, the third message including: an authentication and key negotiation response packet, and at least one of an encrypted non-access stratum security mode command completion packet or an integrity-protected non-access stratum security mode command completion packet.

[0043] The Access Layer Security Mode Command Completion Packet may include a Message Authentication Code (MAC), and successfully verifying the Access Layer Security Mode Command Completion Packet may include successfully verifying the MAC included in the Access Layer Security Mode Command Completion Packet. It should be understood that if the MAC matches the expected MAC, the verification of the MAC can be successful.

[0044] The device includes a base station.

[0045] This network functionality includes mobility management network functions.

[0046] Mobility management network functions can be part of a service network (e.g., an access network).

[0047] According to one aspect, an apparatus is provided, the apparatus comprising a circuit system configured to perform: sending a first message to a user equipment, the first message including: an access stratum security mode command packet and a non-access stratum security mode command packet; and receiving a second message from the user equipment, the second message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0048] According to one aspect, a computer program is provided, the computer program including computer-executable instructions that execute at runtime on one or more processors: sending a first message to a user equipment, the first message including: an access stratum security mode command packet and a non-access stratum security mode command packet; and receiving a second message from the user equipment, the second message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0049] According to one aspect, an apparatus is provided, the apparatus comprising: at least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured together with the at least one processor such that the apparatus performs at least: receiving a first message from a network function, the first message including an indication of a security level selection; and sending a second message to a base station, the second message including an indication of a security level selection.

[0050] At least one memory and computer code can be configured, together with at least one processor, such that the device performs at least: generating a non-access stratum key K for encryption based on an instruction for selecting a security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; and using the non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASintAt least one of the following, to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and the second message may further include at least one of an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet.

[0051] A non-access stratum key K for encryption is generated based on the indication of the selected security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them includes: generating a non-access stratum key K for encryption, comprising a number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0052] The number of bits corresponding to a security level may include: a first or low number of bits corresponding to a first or low security level; a second or medium number of bits corresponding to a second or medium security level; or a third or high number of bits corresponding to a third or high security level.

[0053] The first message may also include the security anchoring function key K. SEAF The security anchoring function key K SEAF This includes the number of bits corresponding to the security level.

[0054] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: based on the secure anchoring function key K SEAF Generate the mobility management network function key K MM NF The mobility management network function key K MM NF This includes the number of bits indicating the selection of the security level; and the number of bits based on the mobility management network function key K. MM NF Generate a non-access stratum key K for encryption, comprising the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0055] At least one memory and computer code can be configured, together with at least one processor, such that the device performs at least: based on the mobility management network function key K. MM NF Generate base station key K gNB_LPS The base station key K gNB_LPS The second message includes the number of bits indicating the selection of the security level; and it also includes the base station key K. gNB_LPS .

[0056] The first message may also include authentication and key negotiation packets; and the second message may also include authentication and key negotiation packets.

[0057] The second message may also include the hidden user device identifier.

[0058] This network functionality may include authentication server functionality.

[0059] The authentication server function can be part of the home network.

[0060] The device may include mobility management network functionality.

[0061] Mobility management network functions can be part of a service network (e.g., an access network).

[0062] According to one aspect, an apparatus is provided, the apparatus comprising components for: receiving a first message from a network function, the first message including an indication of a security level selection; and sending a second message to a base station, the second message including an indication of a security level selection.

[0063] According to one aspect, a method is provided, the method comprising: receiving a first message from a network function, the first message including an indication of a security level selection; and sending a second message to a base station, the second message including an indication of a security level selection.

[0064] This method can be performed by a device.

[0065] The method may include: generating a non-access stratum key K for encryption based on an indication of a security level selection. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; and using the non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following, to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and the second message may also include at least one of an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet.

[0066] A non-access stratum key K for encryption is generated based on the indication of the selected security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them includes: generating a non-access stratum key K for encryption, comprising a number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0067] The number of bits corresponding to a security level may include: a first or low number of bits corresponding to a first or low security level; a second or medium number of bits corresponding to a second or medium security level; or a third or high number of bits corresponding to a third or high security level.

[0068] The first message may also include the security anchoring function key K. SEAF The security anchoring function key K SEAF This includes the number of bits corresponding to the security level.

[0069] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: based on the secure anchoring function key K SEAF Generate the mobility management network function key K MM NF The mobility management network function key K MM NF This includes the number of bits indicating the selection of the security level; and the number of bits based on the mobility management network function key K. MM NF Generates a non-access stratum key K, which includes the number of bits corresponding to the security level and is used for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0070] This method may include: based on the mobility management network function key K MM NF Generate base station key K gNB_LPS The base station key K gNB_LPS The second message includes the number of bits indicating the selection of the security level; and it also includes the base station key K. gNB_LPS .

[0071] The first message may also include authentication and key negotiation packets; and the second message may also include authentication and key negotiation packets.

[0072] The second message may also include the hidden user device identifier.

[0073] This network functionality may include authentication server functionality.

[0074] The authentication server function can be part of the home network.

[0075] The device may include mobility management network functionality.

[0076] Mobility management network functions can be part of a service network (e.g., an access network).

[0077] According to one aspect, an apparatus is provided, the apparatus comprising a circuit system configured to perform the following: receiving a first message from a network function, the first message including an indication of a security level selection; and sending a second message to a base station, the second message including an indication of a security level selection.

[0078] According to one aspect, a computer program is provided, the computer program including computer-executable instructions that execute at runtime on one or more processors: receiving a first message from a network function, the first message including an indication of a security level selection; and sending a second message to a base station, the second message including an indication of a security level selection.

[0079] According to one aspect, an apparatus is provided, comprising: at least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured, together with the at least one processor, such that the apparatus at least performs: receiving a first message from a base station, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; performing successful verification of the authentication and key negotiation challenge packet, the access stratum security mode command packet, and the non-access stratum security mode command packet; and sending a second message to the base station, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

[0080] An authentication and key negotiation challenge group may include an authentication and key negotiation challenge, and performing successful verification of the authentication and key negotiation challenge group may include performing successful verification of the authentication and key negotiation challenge. It should be understood that verification of the authentication and key negotiation challenge can be successful if the authentication and key negotiation challenge matches the expected authentication and key negotiation challenge.

[0081] Access Stratified Security Mode Command (ASMS) packets may include a Message Authentication Code (MAC), and successful verification of an ASMS packet may include successful verification of the MAC included in the ASMS packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0082] A Non-Access Stratum Security Mode (NASSM) command packet may include a Message Authentication Code (MAC), and successfully verifying a NASSM command packet may include successfully verifying the MAC included in the NASSM command packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0083] The first message may also include an indication of a security level selection; and at least one memory and computer code may be configured, together with at least one processor, such that the device performs at least: generating an access layer key K for encryption based on the indication of the security level selection. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following; and an instruction based on the selection of the security level, generating a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0084] At least one memory and computer code can be configured, together with at least one processor, such that the device performs at least: using the access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following: performing at least one of an access stratum security mode command to complete packet encryption or access stratum security mode command to complete packet integrity protection; using a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following: to execute at least one of encryption of a non-access stratum security mode command completion packet or integrity protection of a non-access stratum security mode command completion packet; and wherein the second message includes: an authentication and key negotiation response packet, at least one of an encrypted access stratum security mode command completion packet or an integrity-protected access stratum security mode command completion packet, and at least one of an encrypted non-access stratum security mode command completion packet or an integrity-protected non-access stratum security mode command completion packet.

[0085] The access stratum key K for encryption is generated based on the indication of the selected security level. LPSenc Or the access layer key K used for integrity protection LPSint At least one of them may include: generating an access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint The selection of at least one of the security choices includes the number of bits corresponding to the security level.

[0086] Generate an access layer key K for encryption, including the number of bits corresponding to the security level. LPSenc Or the access layer key K used for integrity protection LPSint The security options for at least one of them may include: generating a base station key K gNB_LPS The base station key K gNB_LPS This includes the number of bits corresponding to the security level; and the base station key K. gNB_LPSGenerate an access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the safest options.

[0087] A non-access stratum key K for encryption is generated based on the indication of the selected security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: generating a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint The security selection of at least one of them includes the number of bits corresponding to the security level.

[0088] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint Security options for at least one of these may include: generating a mobility management network function key K. MM NF The mobility management network function key K MM NF This includes the number of bits corresponding to the security level; and the mobility management network function key K. MM NF Generate a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the safest options.

[0089] The device may include user equipment.

[0090] This device may include Internet of Things (IoT) devices.

[0091] According to one aspect, an apparatus is provided, comprising components for: receiving a first message from a base station, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; performing successful verification of the authentication and key negotiation challenge packet, the access stratum security mode command packet, and the non-access stratum security mode command packet; and sending a second message to the base station, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

[0092] According to one aspect, a method is provided, the method comprising: receiving a first message from a base station, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; performing successful verification of the authentication and key negotiation challenge packet, the access stratum security mode command packet, and the non-access stratum security mode command packet; and sending a second message to the base station, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

[0093] This method can be performed by a device.

[0094] An authentication and key negotiation challenge group may include an authentication and key negotiation challenge, and performing successful verification of the authentication and key negotiation challenge group may include performing successful verification of the authentication and key negotiation challenge. It should be understood that verification of the authentication and key negotiation challenge can be successful if the authentication and key negotiation challenge matches the expected authentication and key negotiation challenge.

[0095] Access Stratified Security Mode Command (ASMS) packets may include a Message Authentication Code (MAC), and successful verification of an ASMS packet may include successful verification of the MAC included in the ASMS packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0096] A Non-Access Stratum Security Mode (NASSM) command packet may include a Message Authentication Code (MAC), and successfully verifying a NASSM command packet may include successfully verifying the MAC included in the NASSM command packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0097] The first message may also include an indication of a security level selection; and the method may include: generating an access stratum key K for encryption based on the indication of the security level selection. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following; and an instruction based on the selection of the security level, generating a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0098] The method may include: using an access stratum key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSintAt least one of the following: performing an access stratum security mode command to complete packet encryption or performing access stratum security mode command to complete packet integrity protection; using a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following: to execute at least one of encryption of a non-access stratum security mode command completion packet or integrity protection of a non-access stratum security mode command completion packet; and wherein the second message includes: an authentication and key negotiation response packet, at least one of an encrypted access stratum security mode command completion packet or an integrity-protected access stratum security mode command completion packet, and at least one of an encrypted non-access stratum security mode command completion packet or an integrity-protected non-access stratum security mode command completion packet.

[0099] The access stratum key K for encryption is generated based on the indication of the selected security level. LPSenc Or the access layer key K used for integrity protection LPSint At least one of them may include: generating an access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint The security selection of at least one of them includes the number of bits corresponding to the security level.

[0100] Generate an access layer key K for encryption, including the number of bits corresponding to the security level. LPSenc Or the access layer key K used for integrity protection LPSint The security options for at least one of them may include: generating a base station key K gNB_LPS The base station key K gNB_LPS This includes the number of bits corresponding to the security level; and the base station key K. gNB_LPS Generate an access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the safest options.

[0101] A non-access stratum key K for encryption is generated based on the indication of the selected security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: generating a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint The security selection of at least one of them includes the number of bits corresponding to the security level.

[0102] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASencOr the non-access stratum key K used for integrity protection NASint Security options for at least one of these may include: generating a mobility management network function key K. MM NF The mobility management network function key K MM NF This includes the number of bits corresponding to the security level; and the mobility management network function key K. MM NF Generate a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the safest options.

[0103] The device may include user equipment.

[0104] This device may include Internet of Things (IoT) devices.

[0105] According to one aspect, an apparatus is provided, comprising a circuit system configured to perform: receiving a first message from a base station, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; performing successful verification of the authentication and key negotiation challenge packet, the access stratum security mode command packet, and the non-access stratum security mode command packet; and sending a second message to the base station, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

[0106] According to one aspect, a computer program is provided, the computer program including computer-executable instructions that execute at runtime on one or more processors: receiving a first message from a base station, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; performing successful verification of the authentication and key negotiation challenge packet, the access stratum security mode command packet, and the non-access stratum security mode command packet; and sending a second message to the base station, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

[0107] According to one aspect, an apparatus is provided, the apparatus comprising: at least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured, together with the at least one processor, such that the apparatus performs at least: sending a first message to a user equipment, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; and receiving a second message from the user equipment, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

[0108] The first message may also include instructions on selecting a security level.

[0109] At least one memory and computer code may be configured, together with at least one processor, such that the device performs at least: successful verification of an access stratum security mode command completion packet; and sending a third message to a network function, the third message including at least one of an authentication and key negotiation response packet, and an encrypted non-access stratum security mode command completion packet or an integrity-protected non-access stratum security mode command completion packet.

[0110] The Access Layer Security Mode Command Completion Packet may include a Message Authentication Code (MAC), and successfully verifying the Access Layer Security Mode Command Completion Packet may include successfully verifying the MAC included in the Access Layer Security Mode Command Completion Packet. It should be understood that if the MAC matches the expected MAC, the verification of the MAC can be successful.

[0111] The device includes a base station.

[0112] According to one aspect, an apparatus is provided, the apparatus comprising components for: sending a first message to a user equipment, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; and receiving a second message from the user equipment, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

[0113] According to one aspect, a method is provided, the method comprising: sending a first message to a user equipment, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; and receiving a second message from the user equipment, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

[0114] This method can be performed by a device.

[0115] The first message may also include instructions on selecting a security level.

[0116] The method may include: performing successful verification of the access stratum security mode command completion packet; and sending a third message to the network function, the third message including: an authentication and key negotiation response packet, and at least one of an encrypted non-access stratum security mode command completion packet or an integrity-protected non-access stratum security mode command completion packet.

[0117] The Access Layer Security Mode Command Completion Packet may include a Message Authentication Code (MAC), and successfully verifying the Access Layer Security Mode Command Completion Packet may include successfully verifying the MAC included in the Access Layer Security Mode Command Completion Packet. It should be understood that if the MAC matches the expected MAC, the verification of the MAC can be successful.

[0118] The device includes a base station.

[0119] According to one aspect, an apparatus is provided, the apparatus comprising a circuit system configured to perform: sending a first message to a user equipment, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; and receiving a second message from the user equipment, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

[0120] According to one aspect, a computer program is provided, the computer program including computer-executable instructions that execute at runtime on one or more processors: sending a first message to a user equipment, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; and receiving a second message from the user equipment, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

[0121] According to one aspect, an apparatus is provided, comprising: at least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured, together with the at least one processor, such that the apparatus at least performs: receiving a first message from a network function, the first message including an indication of a security level selection; and generating a non-access stratum key K for encryption based on the indication of the security level selection. NASenc Or the non-access stratum key K used for integrity protectionNASint At least one of them; using the non-access stratum key K used for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following: to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and to send a second message to the base station, the second message including at least one of: an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet, and an indication of the selection of a security level.

[0122] A non-access stratum key K for encryption is generated based on the indication of the selected security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: generating a non-access stratum key K for encryption, comprising a number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0123] The number of bits corresponding to a security level may include: a first or low number of bits corresponding to a first or low security level; a second or medium number of bits corresponding to a second or medium security level; or a third or high number of bits corresponding to a third or high security level.

[0124] The first message may also include the security anchoring function key K. SEAF The security anchoring function key K SEAF This includes the number of bits corresponding to the security level.

[0125] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: based on the secure anchoring function key K SEAF Generate the mobility management network function key K MM NF The mobility management network function key K MM NF This includes the number of bits indicating the selection of the security level; and the number of bits based on the mobility management network function key K. MM NF Generate a non-access stratum key K for encryption, comprising the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0126] At least one memory and computer code can be configured, together with at least one processor, such that the device performs at least: based on the mobility management network function key K. MM NF Generate base station key KgNB_LPS The base station key K gNB_LPS The second message includes the number of bits indicating the selection of the security level; and it also includes the base station key K. gNB_LPS .

[0127] The first message may also include authentication and key negotiation challenge packets; and the second message may also include authentication and key negotiation challenge packets.

[0128] The second message may also include the hidden user device identifier.

[0129] This network functionality may include authentication server functionality.

[0130] The authentication server function can be part of the home network.

[0131] The device may include mobility management network functionality.

[0132] Mobility management network functions can be part of a service network (e.g., an access network).

[0133] According to one aspect, an apparatus is provided, the apparatus comprising components for: receiving a first message from a network function, the first message including an indication of a security level selection; and generating a non-access stratum key K for encryption based on the indication of the security level selection. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; using the non-access stratum key K used for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following: to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and to send a second message to the base station, the second message including at least one of: an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet, and an indication of the selection of a security level.

[0134] According to one aspect, a method is provided, the method comprising: receiving a first message from a network function, the first message including an indication of a security level selection; and generating a non-access stratum key K for encryption based on the indication of the security level selection. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; using the non-access stratum key K used for encryption. NASenc Or the non-access stratum key K used for integrity protection NASintAt least one of the following: to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and to send a second message to the base station, the second message including at least one of: an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet, and an indication of the selection of a security level.

[0135] This method can be performed by a device.

[0136] A non-access stratum key K for encryption is generated based on the indication of the selected security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: generating a non-access stratum key K for encryption, comprising a number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0137] The number of bits corresponding to a security level may include: a first or low number of bits corresponding to a first or low security level; a second or medium number of bits corresponding to a second or medium security level; or a third or high number of bits corresponding to a third or high security level.

[0138] The first message may also include the security anchoring function key K. SEAF The security anchoring function key K SEAF This includes the number of bits corresponding to the security level.

[0139] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: based on the secure anchoring function key K SEAF Generate the mobility management network function key K MM NF The mobility management network function key K MM NF This includes the number of bits indicating the selection of the security level; and the number of bits based on the mobility management network function key K. MM NF Generate a non-access stratum key K for encryption, comprising the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0140] This method may include: based on the mobility management network function key K MM NF Generate base station key K gNB_LPS The base station key K gNB_LPS The second message includes the number of bits indicating the selection of the security level; and it also includes the base station key K.gNB_LPS .

[0141] The first message may also include authentication and key negotiation challenge packets; and the second message may also include authentication and key negotiation challenge packets.

[0142] The second message may also include the hidden user device identifier.

[0143] This network functionality may include authentication server functionality.

[0144] The authentication server function can be part of the home network.

[0145] The device may include mobility management network functionality.

[0146] Mobility management network functions can be part of a service network (e.g., an access network).

[0147] According to one aspect, an apparatus is provided, the apparatus comprising a circuit system configured to perform: receiving a first message from a network function, the first message including an indication of a security level selection; and generating a non-access stratum key K for encryption based on the indication of the security level selection. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; using the non-access stratum key K used for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following: to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and to send a second message to the base station, the second message including at least one of: an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet, and an indication of the selection of a security level.

[0148] According to one aspect, a computer program is provided, comprising computer-executable instructions that execute at runtime on one or more processors: receiving a first message from a network function, the first message including an indication of a security level selection; and generating a non-access stratum key K for encryption based on the indication of the security level selection. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; using the non-access stratum key K used for encryption. NASenc Or the non-access stratum key K used for integrity protection NASintAt least one of the following: to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and to send a second message to the base station, the second message including at least one of: an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet, and an indication of the selection of a security level.

[0149] According to one aspect, an apparatus is provided, the apparatus comprising: at least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured together with the at least one processor such that the apparatus performs at least: receiving a first message from a first network function, the first message including an indication that a user equipment supports a security level; sending a second message to a second network function, the second message including an indication that the user equipment supports a security level; receiving a third message from the second network function, the third message including an indication of a selected security level; and sending a fourth message to the first network function, the fourth message including an indication of a selected security level.

[0150] The choice of security level can be based on the security level subscribed to by the user's device.

[0151] At least one memory and computer code can be configured, together with at least one processor, such that the device performs at least: generating a secure anchoring function key K. SEAF The security anchoring function key K SEAF This includes the number of bits corresponding to the security level; and the fourth message also includes the security anchoring function key K. SEAF .

[0152] At least one memory and computer code may be configured, together with at least one processor, such that the device performs at least: generating an authentication and key negotiation challenge packet; and a fourth message further includes the authentication and key negotiation challenge packet.

[0153] The first message may also include a hidden user equipment identifier; and at least one memory and computer code may be configured, together with at least one processor, such that the device performs at least: sending the hidden user equipment identifier to a third network function; receiving the dehidden user equipment identifier from the third network function; and wherein the fourth message includes the dehidden user equipment identifier.

[0154] The device includes authentication server functionality.

[0155] The authentication server function can be part of the home network.

[0156] The first network function may include mobility management network functions.

[0157] Mobility management network functions can be part of a service network (e.g., an access network).

[0158] The third network function may include the ability to remove subscriber identifiers.

[0159] The subscriber identifier removal function can be part of the home network.

[0160] According to one aspect, an apparatus is provided, the apparatus comprising components for: receiving a first message from a first network function, the first message including an indication that a user equipment supports a security level; sending a second message to a second network function, the second message including an indication that the user equipment supports a security level; receiving a third message from the second network function, the third message including a selection indication of a security level; and sending a fourth message to the first network function, the fourth message including a selection indication of a security level.

[0161] According to one aspect, a method is provided, the method comprising: receiving a first message from a first network function, the first message including an indication that a user equipment supports a security level; sending a second message to a second network function, the second message including an indication that the user equipment supports a security level; receiving a third message from the second network function, the third message including an indication of a selected security level; and sending a fourth message to the first network function, the fourth message including an indication of a selected security level.

[0162] This method can be performed by a device.

[0163] The choice of security level can be based on the security level subscribed to by the user's device.

[0164] The method may include: generating a secure anchoring function key K SEAF The security anchoring function key K SEAF This includes the number of bits corresponding to the security level; and the fourth message also includes the security anchoring function key K. SEAF .

[0165] The method may include: generating an authentication and key negotiation challenge block; and the fourth message may also include the authentication and key negotiation challenge block.

[0166] The first message may also include a hidden user equipment identifier; and the method may include: sending the hidden user equipment identifier to a third network function; receiving a dehidden user equipment identifier from the third network function; and wherein the fourth message includes the dehidden user equipment identifier.

[0167] The device includes authentication server functionality.

[0168] The authentication server function can be part of the home network.

[0169] The first network function may include mobility management network functions.

[0170] Mobility management network functions can be part of a service network (e.g., an access network).

[0171] The third network function may include the ability to remove subscriber identifiers.

[0172] The subscriber identifier removal function can be part of the home network.

[0173] According to one aspect, an apparatus is provided, the apparatus comprising a circuit system configured to perform: receiving a first message from a first network function, the first message including an indication that a user equipment supports a security level; sending a second message to a second network function, the second message including an indication that the user equipment supports a security level; receiving a third message from the second network function, the third message including an indication of a selected security level; and sending a fourth message to the first network function, the fourth message including an indication of a selected security level.

[0174] According to one aspect, a computer program is provided, the computer program including computer-executable instructions that execute at runtime on one or more processors: receiving a first message from a first network function, the first message including an indication that a user equipment supports a security level; sending a second message to a second network function, the second message including an indication that the user equipment supports a security level; receiving a third message from the second network function, the third message including an indication of a selected security level; and sending a fourth message to the first network function, the fourth message including an indication of a selected security level.

[0175] According to one aspect, an apparatus is provided, comprising: at least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured, together with the at least one processor, such that the apparatus at least performs: receiving a first message from a base station, the first message including an authentication and key negotiation challenge packet; performing successful verification of the authentication and key negotiation challenge packet; sending a second message to the base station, the second message including an authentication and key negotiation response packet; receiving a third message from the base station, the third message including: an access stratum security mode command packet and a non-access stratum security mode command packet; performing successful verification of the access stratum security mode command packet and the non-access stratum security mode command packet; and sending a fourth message to the base station, the fourth message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0176] An authentication and key negotiation challenge group may include an authentication and key negotiation challenge, and performing successful verification of the authentication and key negotiation challenge group may include performing successful verification of the authentication and key negotiation challenge. It should be understood that verification of the authentication and key negotiation challenge can be successful if the authentication and key negotiation challenge matches the expected authentication and key negotiation challenge.

[0177] Access Stratified Security Mode Command (ASMS) packets may include a Message Authentication Code (MAC), and successful verification of an ASMS packet may include successful verification of the MAC included in the ASMS packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0178] A Non-Access Stratum Security Mode (NASSM) command packet may include a Message Authentication Code (MAC), and successfully verifying a NASSM command packet may include successfully verifying the MAC included in the NASSM command packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0179] The third message may also include an indication of a security level selection; and at least one memory and computer code may be configured, together with at least one processor, such that the device performs at least: generating an access layer key K for encryption based on the security level selection indication. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following; and an instruction based on the selection of the security level, generating a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0180] At least one memory and computer code can be configured, together with at least one processor, such that the device performs at least: using the access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following: performing at least one of an access stratum security mode command to complete packet encryption or access stratum security mode command to complete packet integrity protection; using a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASintAt least one of the following: to execute at least one of encryption of a non-access stratum security mode command completion packet or integrity protection of a non-access stratum security mode command completion packet; and the fourth message may include: at least one of an encrypted access stratum security mode command completion packet or an integrity-protected access stratum security mode command completion packet, and at least one of an encrypted non-access stratum security mode command completion packet or an integrity-protected non-access stratum security mode command completion packet.

[0181] The access stratum key K for encryption is generated based on the indication of the selected security level. LPSenc Or the access layer key K used for integrity protection LPSint At least one of them may include: generating an access layer key K for encryption, comprising a number of bits corresponding to the security level. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the safest options.

[0182] Generate an access layer key K for encryption, including the number of bits corresponding to the security level. LPSenc Or the access layer key K used for integrity protection LPSint The security options for at least one of them may include: generating a base station key K gNB_LPS The base station key K gNB_LPS This includes the number of bits corresponding to the security level; and the base station key K. gNB_LPS Generate an access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the safest options.

[0183] A non-access stratum key K for encryption is generated based on the indication of the selected security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: generating a non-access stratum key K for encryption, comprising a number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the safest options.

[0184] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint Security options for at least one of these may include: generating a mobility management network function key K. MM NF The mobility management network function key K MM NF This includes the number of bits corresponding to the security level; and the mobility management network function key K.MM NF Generate a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the safest options.

[0185] The device may include user equipment.

[0186] This device may include Internet of Things (IoT) devices.

[0187] According to one aspect, an apparatus is provided, the apparatus comprising components for: receiving a first message from a base station, the first message including an authentication and key negotiation challenge packet; performing successful verification of the authentication and key negotiation challenge packet; sending a second message to the base station, the second message including an authentication and key negotiation response packet; receiving a third message from the base station, the third message including: an access stratum security mode command packet and a non-access stratum security mode command packet; performing successful verification of the access stratum security mode command packet and the non-access stratum security mode command packet; and sending a fourth message to the base station, the fourth message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0188] According to one aspect, a method is provided, the method comprising: receiving a first message from a base station, the first message including an authentication and key negotiation challenge packet; performing successful verification of the authentication and key negotiation challenge packet; sending a second message to the base station, the second message including an authentication and key negotiation response packet; receiving a third message from the base station, the third message including: an access stratum security mode command packet and a non-access stratum security mode command packet; performing successful verification of the access stratum security mode command packet and the non-access stratum security mode command packet; and sending a fourth message to the base station, the fourth message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0189] This method can be performed by a device.

[0190] An authentication and key negotiation challenge group may include an authentication and key negotiation challenge, and performing successful verification of the authentication and key negotiation challenge group may include performing successful verification of the authentication and key negotiation challenge. It should be understood that verification of the authentication and key negotiation challenge can be successful if the authentication and key negotiation challenge matches the expected authentication and key negotiation challenge.

[0191] Access Stratified Security Mode Command (ASMS) packets may include a Message Authentication Code (MAC), and successful verification of an ASMS packet may include successful verification of the MAC included in the ASMS packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0192] A Non-Access Stratum Security Mode (NASSM) command packet may include a Message Authentication Code (MAC), and successfully verifying a NASSM command packet may include successfully verifying the MAC included in the NASSM command packet. It should be understood that verification of the MAC can be successful if it matches the expected MAC.

[0193] The third message may also include an indication of a security level selection; and at least one memory and computer code may be configured, together with at least one processor, such that the device performs at least: generating an access layer key K for encryption based on the security level selection indication. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following; and an instruction based on the selection of the security level, generating a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0194] The method may include: using an access stratum key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following: performing at least one of an access stratum security mode command to complete packet encryption or access stratum security mode command to complete packet integrity protection; using a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following: to execute at least one of encryption of a non-access stratum security mode command completion packet or integrity protection of a non-access stratum security mode command completion packet; and the fourth message may include: at least one of an encrypted access stratum security mode command completion packet or an integrity-protected access stratum security mode command completion packet, and at least one of an encrypted non-access stratum security mode command completion packet or an integrity-protected non-access stratum security mode command completion packet.

[0195] The access stratum key K for encryption is generated based on the indication of the selected security level. LPSenc Or the access layer key K used for integrity protection LPSint At least one of them may include: generating an access layer key K for encryption, comprising a number of bits corresponding to the security level. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the safest options.

[0196] Generate an access layer key K for encryption, including the number of bits corresponding to the security level. LPSenc Or the access layer key K used for integrity protectionLPSint The security options for at least one of them may include: generating a base station key K gNB_LPS The base station key K gNB_LPS This includes the number of bits corresponding to the security level; and the base station key K. gNB_LPS Generate an access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint At least one of the safest options.

[0197] A non-access stratum key K for encryption is generated based on the indication of the selected security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: generating a non-access stratum key K for encryption, comprising a number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the safest options.

[0198] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint Security options for at least one of these may include: generating a mobility management network function key K. MM NF The mobility management network function key K MM NF This includes the number of bits corresponding to the security level; and the mobility management network function key K. MM NF Generate a non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the safest options.

[0199] The device may include user equipment.

[0200] This device may include Internet of Things (IoT) devices.

[0201] According to one aspect, an apparatus is provided, comprising a circuit system configured to perform: receiving a first message from a base station, the first message including an authentication and key negotiation challenge packet; performing successful verification of the authentication and key negotiation challenge packet; sending a second message to the base station, the second message including an authentication and key negotiation response packet; receiving a third message from the base station, the third message including: an access stratum security mode command packet and a non-access stratum security mode command packet; performing successful verification of the access stratum security mode command packet and the non-access stratum security mode command packet; and sending a fourth message to the base station, the fourth message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0202] According to one aspect, a computer program is provided, comprising computer-executable instructions that execute at runtime on one or more processors: receiving a first message from a base station, the first message including an authentication and key negotiation challenge packet; performing successful verification of the authentication and key negotiation challenge packet; sending a second message to the base station, the second message including an authentication and key negotiation response packet; receiving a third message from the base station, the third message including: an access stratum security mode command packet and a non-access stratum security mode command packet; performing successful verification of the access stratum security mode command packet and the non-access stratum security mode command packet; and sending a fourth message to the base station, the fourth message including: an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0203] According to one aspect, an apparatus is provided, comprising: at least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured, together with the at least one processor, such that the apparatus performs at least: sending a first message to a user equipment, the first message including an authentication and key negotiation challenge packet; receiving a second message from the user equipment, the second message including an authentication and key negotiation response packet; sending a third message to the user equipment, the third message including an access stratum security mode command packet and a non-access stratum security mode command packet; and receiving a fourth message from the user equipment, the fourth message including an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0204] The fourth message may include at least one of an encrypted access stratum security mode command completion packet or an integrity-protected access stratum security mode command completion packet, and at least one of an encrypted non-access stratum security mode command completion packet or an integrity-protected non-access stratum security mode command completion packet.

[0205] At least one memory and computer code may be configured, together with at least one processor, such that the device performs at least: performing successful verification of an Access Layer Security Mode Command Completion packet; and sending a fifth message to a network function, the fifth message including at least one of an encrypted Non-Access Layer Security Mode Command Completion packet or an Integrity-protected Non-Access Layer Security Mode Command Completion packet.

[0206] The Access Layer Security Mode Command Completion Packet may include a Message Authentication Code (MAC), and successfully verifying the Access Layer Security Mode Command Completion Packet may include successfully verifying the MAC included in the Access Layer Security Mode Command Completion Packet. It should be understood that if the MAC matches the expected MAC, the verification of the MAC can be successful.

[0207] The device may include a base station.

[0208] Network functions may include mobility management network functions.

[0209] Mobility management network functions can be part of a service network (e.g., an access network).

[0210] According to one aspect, an apparatus is provided, the apparatus comprising components for: sending a first message to a user equipment, the first message including an authentication and key negotiation challenge packet; receiving a second message from the user equipment, the second message including an authentication and key negotiation response packet; sending a third message to the user equipment, the third message including an access stratum security mode command packet and a non-access stratum security mode command packet; and receiving a fourth message from the user equipment, the fourth message including an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0211] According to one aspect, a method is provided, the method comprising: sending a first message to a user equipment, the first message including an authentication and key negotiation challenge packet; receiving a second message from the user equipment, the second message including an authentication and key negotiation response packet; sending a third message to the user equipment, the third message including an access stratum security mode command packet and a non-access stratum security mode command packet; and receiving a fourth message from the user equipment, the fourth message including an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0212] This method can be performed by a device.

[0213] The fourth message may include at least one of an encrypted access stratum security mode command completion packet or an integrity-protected access stratum security mode command completion packet, and at least one of an encrypted non-access stratum security mode command completion packet or an integrity-protected non-access stratum security mode command completion packet.

[0214] The method may include: performing successful verification of the access stratum security mode command completion packet; and sending a fifth message to the network function, the fifth message including at least one of an encrypted non-access stratum security mode command completion packet or an integrity-protected non-access stratum security mode command completion packet.

[0215] The Access Layer Security Mode Command Completion Packet may include a Message Authentication Code (MAC), and successfully verifying the Access Layer Security Mode Command Completion Packet may include successfully verifying the MAC included in the Access Layer Security Mode Command Completion Packet. It should be understood that if the MAC matches the expected MAC, the verification of the MAC can be successful.

[0216] The device may include a base station.

[0217] Network functions may include mobility management network functions.

[0218] Mobility management network functions can be part of a service network (e.g., an access network).

[0219] According to one aspect, an apparatus is provided, the apparatus comprising a circuit system configured to perform: sending a first message to a user equipment, the first message including an authentication and key negotiation challenge packet; receiving a second message from the user equipment, the second message including an authentication and key negotiation response packet; sending a third message to the user equipment, the third message including an access stratum security mode command packet and a non-access stratum security mode command packet; and receiving a fourth message from the user equipment, the fourth message including an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0220] According to one aspect, a computer program is provided, comprising computer-executable instructions that execute at runtime on one or more processors: sending a first message to a user equipment, the first message including an authentication and key negotiation challenge packet; receiving a second message from the user equipment, the second message including an authentication and key negotiation response packet; sending a third message to the user equipment, the third message including an access stratum security mode command packet and a non-access stratum security mode command packet; and receiving a fourth message from the user equipment, the fourth message including an access stratum security mode command completion packet and a non-access stratum security mode command completion packet.

[0221] According to one aspect, an apparatus is provided, comprising: at least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured, together with the at least one processor, such that the apparatus at least performs: receiving a first message from a network function, the first message including at least one of an indication of a security level selection or an indication of a number of bits corresponding to the security level; and generating a non-access stratum key K for encryption based on at least one of the indication of the security level selection or the indication of a number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; using the non-access stratum key K used for encryption. NASenc Or the non-access stratum key K used for integrity protection NASintAt least one of the following: to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and to send a second message to the base station, the second message including: at least one of an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet, and an indication of the selection of a security level.

[0222] A non-access stratum key K for encryption is generated based on an indication of the selected security level or an indication of the number of bits corresponding to that security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: generating a non-access stratum key K for encryption, comprising a number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0223] The number of bits corresponding to a security level may include: a first or low number of bits corresponding to a first or low security level; a second or medium number of bits corresponding to a second or medium security level; or a third or high number of bits corresponding to a third or high security level.

[0224] The first message may also include the security anchoring function key K. SEAF The security anchoring function key K SEAF This includes the number of bits corresponding to the security level.

[0225] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: based on the secure anchoring function key K SEAF Generate the mobility management network function key K MM NF The mobility management network function key K MM NF This includes the number of bits indicating the selection of the security level; and the number of bits based on the mobility management network function key K. MM NF Generate a non-access stratum key K for encryption, comprising the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0226] At least one memory and computer code can be configured, together with at least one processor, such that the device performs at least: based on the mobility management network function key K. MM NF Generate base station key K gNB_LPS The base station key K gNB_LPSThe second message includes the number of bits indicating the selection of the security level; and it also includes the base station key K. gNB_LPS .

[0227] The first message may also include authentication and key negotiation challenge packets; and the second message may also include authentication and key negotiation challenge packets.

[0228] The second message may also include the hidden user device identifier.

[0229] This network functionality may include authentication server functionality.

[0230] The authentication server function can be part of the home network.

[0231] The device may include mobility management network functionality.

[0232] Mobility management network functions can be part of a service network (e.g., an access network).

[0233] According to one aspect, an apparatus is provided, the apparatus comprising components for: receiving a first message from a network function, the first message including at least one of an indication of a security level selection or an indication of a number of bits corresponding to the security level; and generating a non-access stratum key K for encryption based on at least one of the indication of the security level selection or the indication of a number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; using the non-access stratum key K used for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following: to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and to send a second message to the base station, the second message including: at least one of an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet, and an indication of the selection of a security level.

[0234] According to one aspect, a method is provided, the method comprising: receiving a first message from a network function, the first message including at least one of an indication of a security level selection or an indication of a number of bits corresponding to the security level; and generating a non-access stratum key K for encryption based on at least one of the indication of the security level selection or the indication of a number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; using the non-access stratum key K used for encryption. NASenc Or the non-access stratum key K used for integrity protection NASintAt least one of the following: to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and to send a second message to the base station, the second message including: at least one of an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet, and an indication of the selection of a security level.

[0235] This method can be performed by a device.

[0236] A non-access stratum key K for encryption is generated based on an indication of the selected security level or an indication of the number of bits corresponding to that security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: generating a non-access stratum key K for encryption, comprising a number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0237] The number of bits corresponding to a security level may include: a first or low number of bits corresponding to a first or low security level; a second or medium number of bits corresponding to a second or medium security level; or a third or high number of bits corresponding to a third or high security level.

[0238] The first message may also include the security anchoring function key K. SEAF The security anchoring function key K SEAF This includes the number of bits corresponding to the security level.

[0239] Generate a non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them may include: based on the secure anchoring function key K SEAF Generate the mobility management network function key K MM NF The mobility management network function key K MM NF This includes the number of bits indicating the selection of the security level; and the number of bits based on the mobility management network function key K. MM NF Generate a non-access stratum key K for encryption, comprising the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

[0240] This method may include: based on the mobility management network function key K MM NF Generate base station key K gNB_LPS The base station key K gNB_LPSThe second message includes the number of bits indicating the selection of the security level; and it also includes the base station key K. gNB_LPS .

[0241] The first message may also include authentication and key negotiation challenge packets; and the second message may also include authentication and key negotiation challenge packets.

[0242] The second message may also include the hidden user device identifier.

[0243] This network functionality may include authentication server functionality.

[0244] The authentication server function can be part of the home network.

[0245] The device may include mobility management network functionality.

[0246] Mobility management network functions can be part of a service network (e.g., an access network).

[0247] According to one aspect, an apparatus is provided, the apparatus comprising circuitry configured to perform: receiving a first message from a network function, the first message including at least one of an indication of a security level selection or an indication of a number of bits corresponding to the security level; and generating a non-access stratum key K for encryption based on the indication of the security level selection or the indication of the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; using the non-access stratum key K used for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following: to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and to send a second message to the base station, the second message including: at least one of an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet, and an indication of the selection of a security level.

[0248] According to one aspect, a computer program is provided, comprising computer-executable instructions that execute at runtime on one or more processors: receiving a first message from a network function, the first message including at least one of an indication of a security level selection or an indication of a number of bits corresponding to the security level; and generating a non-access stratum key K for encryption based on the indication of the security level selection or the indication of the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; using the non-access stratum key K used for encryption. NASencOr the non-access stratum key K used for integrity protection NASint At least one of the following: to perform at least one of encryption of a non-access stratum security mode command packet or integrity protection of a non-access stratum security mode command packet; and to send a second message to the base station, the second message including: at least one of an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet, and an indication of the selection of a security level.

[0249] According to one aspect, an apparatus is provided, comprising: at least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured together with the at least one processor such that the apparatus performs at least: receiving a first message from a first network function, the first message including an indication that a user equipment supports a security level; sending a second message to a second network function, the second message including an indication that the user equipment supports a security level; receiving a third message from the second network function, the third message including an indication of a selected security level; and sending a fourth message to the first network function, the fourth message including at least one of an indication of a selected security level or an indication of a number of bits corresponding to a security level.

[0250] The choice of security level is based on the security level subscribed to by the user's device.

[0251] At least one memory and computer code can be configured, together with at least one processor, such that the device performs at least: generating a secure anchoring function key K. SEAF The security anchoring function key K SEAF This includes the number of bits corresponding to the security level; and the fourth message may also include the security anchoring function key K. SEAF .

[0252] At least one memory and computer code can be configured, together with at least one processor, such that the device performs at least: generating an authentication and key negotiation challenge packet; and a fourth message may also include the authentication and key negotiation challenge packet.

[0253] The first message may also include a hidden user equipment identifier; and at least one memory and computer code may be configured, together with at least one processor, such that the device performs at least: sending the hidden user equipment identifier to a third network function; receiving the dehidden user equipment identifier from the third network function; and the fourth message may include the dehidden user equipment identifier.

[0254] The device may include authentication server functionality.

[0255] The authentication server function can be part of the home network.

[0256] The first network function includes mobility management network functions.

[0257] Mobility management network functions can be part of a service network (e.g., an access network).

[0258] The third network function may include the ability to remove subscriber identifiers.

[0259] The subscriber identifier removal function can be part of the home network.

[0260] According to one aspect, an apparatus is provided, the apparatus comprising components for: receiving a first message from a first network function, the first message including an indication that a user equipment supports a security level; sending a second message to a second network function, the second message including an indication that the user equipment supports a security level; receiving a third message from the second network function, the third message including an indication of a selected security level; and sending a fourth message to the first network function, the fourth message including at least one of an indication of a selected security level or an indication of a number of bits corresponding to a security level.

[0261] According to one aspect, a method is provided, the method comprising: receiving a first message from a first network function, the first message including an indication that a user equipment supports a security level; sending a second message to a second network function, the second message including an indication that the user equipment supports a security level; receiving a third message from the second network function, the third message including an indication of a selected security level; and sending a fourth message to the first network function, the fourth message including at least one of an indication of a selected security level or an indication of a number of bits corresponding to a security level.

[0262] This method can be performed by a device.

[0263] The choice of security level is based on the security level subscribed to by the user's device.

[0264] The method may include: generating a secure anchoring function key K SEAF The security anchoring function key K SEAF This includes the number of bits corresponding to the security level; and the fourth message may also include the security anchoring function key K. SEAF .

[0265] The method may include: generating an authentication and key negotiation challenge packet; and the fourth message may also include the authentication and key negotiation challenge packet.

[0266] The first message may also include a hidden user equipment identifier; and the method may include: sending the hidden user equipment identifier to a third network function; receiving the dehidden user equipment identifier from the third network function; and the fourth message includes the dehidden user equipment identifier.

[0267] The device may include authentication server functionality.

[0268] The authentication server function can be part of the home network.

[0269] The first network function includes mobility management network functions.

[0270] Mobility management network functions can be part of a service network (e.g., an access network).

[0271] The third network function may include the ability to remove subscriber identifiers.

[0272] The subscriber identifier removal function can be part of the home network.

[0273] According to one aspect, an apparatus is provided, comprising a circuit system configured to perform: receiving a first message from a first network function, the first message including an indication that a user equipment supports a security level; sending a second message to a second network function, the second message including an indication that the user equipment supports a security level; receiving a third message from the second network function, the third message including an indication of a selected security level; and sending a fourth message to the first network function, the fourth message including at least one of an indication of a selected security level or an indication of a number of bits corresponding to a security level.

[0274] According to one aspect, a computer program is provided, the computer program including computer-executable instructions that execute when one or more processors are running: receiving a first message from a first network function, the first message including an indication that a user equipment supports a security level; sending a second message to a second network function, the second message including an indication that the user equipment supports a security level; receiving a third message from the second network function, the third message including an indication of a selected security level; and sending a fourth message to the first network function, the fourth message including at least one of an indication of a selected security level or an indication of a number of bits corresponding to a security level.

[0275] According to one aspect, a computer-readable medium is provided, including program instructions stored thereon for performing at least one of the methods described above.

[0276] According to one aspect, a non-transitory computer-readable medium is provided, including program instructions stored thereon for performing at least one of the methods described above.

[0277] According to one aspect, a non-volatile tangible storage medium is provided, including program instructions stored thereon for performing at least one of the methods described above.

[0278] Many different aspects have been described above. It should be understood that additional aspects can be provided by combining any two or more of the above aspects.

[0279] Various other aspects are also described in the following detailed description and the appended claims.

[0280] List of abbreviations

[0281] AI: Artificial Intelligence

[0282] AKA: Authentication and Key Negotiation

[0283] AMF: Access and Mobility Management Function

[0284] AS: Access Layer

[0285] AUSF: Authentication Server Function

[0286] BS: Base Station

[0287] CN: Core Network

[0288] gNB: gNodeB

[0289] HN: Home Network

[0290] ID: Identifier

[0291] IoT: Internet of Things

[0292] LPS1: Simplified Protocol Stack 1

[0293] LPS2: Simplified Protocol Stack 2

[0294] LPS3: Simplified Protocol Stack 3

[0295] MAC: Message Authentication Code

[0296] MM NF: Mobility Management Network Function

[0297] MS: Mobile Site

[0298] MTC: Machine Type Communication

[0299] NAS: Non-Access Layer

[0300] NF: Network Functions

[0301] RAM: Random Access Memory

[0302] (R)AN: (Radio) Access Network

[0303] ROM: Read-Only Memory

[0304] SEAF: Server Anchoring Function

[0305] SIDF: User ID De-hiding Function

[0306] SMC: Safe Mode Command

[0307] SN: Service Network

[0308] SUCI: Subscriber Hidden Identifier

[0309] SUPI: Subscriber Permanent Identifier

[0310] UDM: Unified Data Management

[0311] UE: User Equipment

[0312] USIM: Universal Subscriber Identification Module

[0313] 4G: Fourth Generation

[0314] 5G: Fifth Generation

[0315] 6G: Sixth generation Attached Figure Description

[0316] The embodiments will now be described by way of example only with reference to the accompanying drawings, in which:

[0317] Figure 1 A schematic representation of an example 6G system is shown;

[0318] Figure 2 A schematic representation of an example control device is shown;

[0319] Figure 3 A schematic representation of an example user device is shown;

[0320] Figure 4a and Figure 4b A signaling diagram illustrating an example procedure for managing security in a communication system is shown.

[0321] Figure 5 The au authentication server function key K is shown. AUSF Security anchoring function key K SEAF Mobility Management Network Function Key K MM NF The non-access stratum key K used for encryption NASenc The non-access stratum key K used for integrity protection NASint gNodeB key K gNB_LPS Access layer key K used for encryption LPSenc and the access layer key K used for integrity protection LPSint A diagram illustrating the example relationships between them;

[0322] Figure 6a and Figure 6b A signaling diagram illustrating an example procedure for managing security in a communication system is shown.

[0323] Figure 7 A block diagram is shown of an example method for managing security in a communication system, executed by a user equipment.

[0324] Figure 8 A block diagram of an example method for managing security in a communication system, executed by a base station, is shown.

[0325] Figure 9 A block diagram is shown of an example method for managing security in a communication system, performed by mobility management network functions;

[0326] Figure 10 A block diagram is shown of an example method for managing security in a communication system, executed by an authentication server function;

[0327] Figure 11 A block diagram is shown of an example method for managing security in a communication system, executed by a user equipment.

[0328] Figure 12 A block diagram of an example method for managing security in a communication system, executed by a base station, is shown.

[0329] Figure 13 A block diagram is shown of an example method for managing security in a communication system, performed by mobility management network functions;

[0330] Figure 14 A block diagram is shown of an example method for managing security in a communication system, executed by an authentication server function;

[0331] Figure 15 A block diagram is shown of an example method for managing security in a communication system, executed by a user equipment.

[0332] Figure 16 A block diagram of an example method for managing security in a communication system, executed by a base station, is shown.

[0333] Figure 17 A block diagram is shown of an example method for managing security in a communication system, performed by mobility management network functions;

[0334] Figure 18 A block diagram illustrates an example method for managing security in a communication system, executed by an authentication server function; and

[0335] Figure 19A block diagram is shown of a non-volatile storage medium for storing instructions, which, when executed by the processor, allow the processor to perform... Figures 7 to 18 One or more steps of any of the methods. Detailed Implementation

[0336] Figure 1 A schematic representation of an example communication system is shown. This communication system may include a 6G communication system. A 6G communication system may include some or all of the components of a 5G communication system.

[0337] It should be understood that one or more aspects are discussed in the context of 6G communication systems, and these aspects can also be used in conjunction with other communication systems.

[0338] The communication system may include user equipment, a radio access network (RAN), and one or more core networks (CNs). The one or more CNs may include a serving network (SN) and a home network (HN).

[0339] The RAN may include one or more base stations (BS). One or more BS may include one or more gNodeBs (gNBs). A gNodeB may include one or more gNB distributed unit functions connected to one or more gNB centralized unit functions.

[0340] A SN may include one or more network functions (NFs). One or more NFs may include mobility management network functions (MM NFs) and security anchoring functions (SEAFs). An MM NF may be an access and mobility management function (AMF).

[0341] HN can include one or more Network Functions (NFs). One or more NFs can include Unified Data Management (UDM), Authentication Server Function (AUSF), and Subscriber Identity De-hiding Function (SIDF).

[0342] Figure 2 It shows the control such as Figure 1An example of a control device 200 for the functions of RAN, SN, or HN shown above. The control device may include at least one random access memory (RAM) 211a, at least one read-only memory (ROM) 211b, at least one processor 212, 213, and an input / output interface 214. The at least one processor 212, 213 may be coupled to RAM 211a and ROM 211b. The at least one processor 212, 213 may be configured to execute appropriate software code 215. For example, the software code 215 may allow the execution of one or more steps to perform one or more aspects of this aspect. The software code 215 may be stored in ROM 211b. The control device 200 may be interconnected with another control device 200 that controls another function of RAN, SN, or HN. In some embodiments, each function of RAN, SN, or HN includes a control device 200. In alternative embodiments, two or more functions of RAN, SN, or HN may share a single control device.

[0343] Figure 3 An example of user device 300 is shown, such as Figure 1 The user equipment shown above. UE 300 can be provided by any device capable of transmitting and receiving radio signals. Non-limiting examples include mobile stations (MS) or mobile devices, such as mobile phones or so-called "smartphones"; computers provided with wireless interface cards or other wireless interface facilities (e.g., USB dongles); personal digital assistants (PDAs) or tablets provided with wireless communication capabilities; machine-type communication (MTC) devices; Internet of Things (IoT) devices, or any combination of these devices, etc. UE 300 can provide, for example, data communication for carrying communications. Communication can be one or more of the following: voice, email, SMS, multimedia, data, machine data, etc.

[0344] UE 300 can receive signals via air or radio interface 307 through appropriate receiving means for receiving, and can transmit signals via appropriate means for transmitting radio signals. Figure 3 In the diagram, the transceiver device is schematically represented by block 306. The transceiver device 306 may be provided, for example, via radio components and an associated antenna arrangement. The antenna arrangement may be located inside or outside the mobile device.

[0345] UE 300 may be provided with at least one processor 301, at least one memory ROM 302a, at least one RAM 302b, and other possible components 303 for use in performing its designed tasks with software and hardware assistance, including controlling access to access systems and other communication devices, and communicating with these systems and other communication devices. At least one processor 301 is coupled to RAM 302b and ROM 302a. At least one processor 301 may be configured to execute appropriate software code 308. For example, software code 308 may allow execution of one or more aspects of this aspect. Software code 308 may be stored in ROM 302a.

[0346] The processor, memory, and other related control devices may be provided on a suitable circuit board and / or chipset. This feature is indicated by reference numeral 304. The device may optionally have a user interface, such as a keyboard 305, a touchscreen or touchpad, a combination thereof, etc. Depending on the type of device, optionally one or more of a display, speaker, and microphone may be provided.

[0347] One or more aspects of this disclosure relate to the management of security in communication systems, and particularly, but not exclusively, to the security of 6G communication systems.

[0348] In the 6G domain, which aims to provide seamless and secure connectivity with extremely low latency and high reliability, the adoption of streamlined security protocols may be crucial. Achieving a balance between robust security and efficiency in communication systems can be a significant challenge. Traditional security protocols often take a "one-size-fits-all" approach, applying uniform security measures regardless of context or specific use case. This can lead to inefficiencies such as unnecessary resource consumption and increased latency, especially in resource-constrained environments such as IoT devices and mobile networks. A technical problem may lie in the inability of traditional technologies to dynamically adjust security levels based on real-time factors such as user location, device trustworthiness, and network conditions. Therefore, communication systems may either become vulnerable due to insufficient protection in high-risk scenarios or suffer performance degradation due to overprotection in low-risk scenarios.

[0349] Furthermore, the complexity and overhead associated with standard cryptographic operations, such as key exchange and handshake, can pose additional challenges. These processes can introduce latency and consume valuable computational resources, which is particularly problematic in applications requiring low-latency communication, such as real-time IoT applications and edge computing.

[0350] This disclosure proposes an adaptive security protocol that can efficiently scale and adapt to different security requirements, optimizing both the security and performance of communication systems. This may involve creating context-aware and usage-based policies that adjust in real time, leveraging innovative techniques such as zero-round-time handshakes and pre-shared keys to simplify the authentication process. Ultimately, addressing this issue can lead to more secure and efficient communication systems that provide an appropriate level of protection without compromising performance.

[0351] This disclosure proposes a streamlined security protocol designed to optimize security measures by making them more adaptable and efficient based on context and specific needs. The following is a standard that may require different security levels.

[0352] Context-aware security levels: This may involve creating adaptive security mechanisms that adjust based on various factors, such as the location of the user device, its trust level, and network conditions. For example, a user device connected to a trusted home network might use less stringent security measures than it would on a public network considered less secure. This approach ensures that security measures are appropriate for the risk level and context.

[0353] Usage-based strategies: Security policies can be tailored to the usage patterns of the communication system. Critical transactions or sensitive operations can trigger stricter security protocols, while routine or less critical activities can be conducted using leaner and less resource-intensive methods. This helps to balance security requirements with system performance.

[0354] The communication system can dynamically switch between different security levels based on current needs and circumstances. Security levels can be defined as follows:

[0355] Reduced Protocol Stack 1 (LPS1): Offers robust protection and high security for critical or high-risk situations. It provides the highest level of security for environments where data confidentiality and integrity are paramount. While it may require a significant amount of computable power, which may not be sustainable in all setups, it can be crucial for protecting against sophisticated threats.

[0356] Reduced Protocol Stack 2 (LPS2): Medium security, providing basic protection for standard operations. It offers a balance between security and resource usage, making it suitable for standard business applications. Compared to LPS1, it reduces resource consumption, providing a more sustainable solution for organizations that require a reasonable level of protection without the full overhead of LPS1.

[0357] Reduced Protocol Stack 3 (LPS3): Lowest security level, for low-risk or trusted environments where high security is unnecessary. It can focus on minimizing energy and resource usage, making it ideal for IoT and other low-power devices. This level is likely the most sustainable, as it significantly reduces operating costs and can extend device battery life, but it may only provide basic protection and may not be suitable for high security requirements.

[0358] By optimizing security levels and protocols, these security levels can contribute to sustainability. This can include energy optimization, reduced latency, and efficient use of resources, making the system not only secure but also more environmentally and economically friendly.

[0359] These security levels are designed to provide a balanced approach to security, ensuring robust protection when needed while avoiding unnecessary overhead in less critical situations.

[0360] Security levels can be included as a subscription option, which can be selected by the UE during initial registration.

[0361] HN can dynamically select the required security level for user registration based on the artificial intelligence (AI) model at HN and the UE's location information already available during registration, or use the appropriate security level to update the registration.

[0362] Figure 4a and Figure 4b A signaling diagram illustrating an example procedure for managing security in a communication system is shown. In this example procedure, the UDM can select LPS3.

[0363] At step 1, the UE (e.g., an IoT device) may send a message (e.g., a registration request) to the MM NF via the gNB. This message may include a hidden UE ID (e.g., an IoT device ID). This hidden ID may include a Subscriber Hidden Identifier (SUCI). The message may include the LPS capabilities supported by the UE.

[0364] At step 2, the MM NF can send a message (e.g., an authentication request) to the AUSF. This message may include a hidden UE ID. This message may also include the LPS capabilities supported by the UE.

[0365] At step 3, the AUSF can send a message to the UDM. This message may include a hidden UE ID. The message may also include the LPS capabilities supported by the UE. The UDM can dehide the hidden UE ID to obtain a dehideable UE ID (e.g., a dehideable IoT device ID). The dehideable UE ID may include a Subscription Permanent Identifier (SUPI). The UDM can determine whether the UE is subscribed to LPS3 based on the subscription information.

[0366] At step 4, the UDM can select LPS3. The UDM can select LPS3 based on the UE's subscription to LPS3. The UDM can select LPS3 based on an AI model. The UDM can select LPS3 based on the UE's context (e.g., UE location, UE trust level, and network conditions). The UDM can select LPS3 based on the UE's use of the communication system (e.g., the criticality of the transaction or the sensitivity of the operation). The UDM can select LPS3 to provide optimized signaling and lower security. The UDM can generate (e.g., derive) the AUSF key K based on the ciphertext key CK' and the integrity key IK'. AUSF UDM can send the AUSF key K to AUSF. AUSF Alternatively, AUSF can generate (e.g., derive) the AUSF key K based on the ciphertext key CK' and the integrity key IK'. AUSF AUSF key K AUSF This can include the number of bits "n" corresponding to LPS3 (e.g., n equals 64 bits). AUSF can be based on the AUSF key K. AUSF To generate (e.g., export) the SEAF key K SEAF SEAF key K SEAF It can include the number of bits "n" corresponding to LPS3 (e.g., n equals 64 bits). AUSF can store the AUSF key K. AUSF and SEAF key K SEAF .

[0367] It should be understood that if the authentication process is successful, AUSF can continue to store the AUSF key K. AUSF and SEAF key K SEAF However, if the authentication process fails, AUSF can delete the AUSF key K. AUSF and SEAF key K SEAF .

[0368] The UDM can send a message to the AUSF. This message may include the de-hidden UE ID. The message may also include an indication of LPS3 selection.

[0369] At step 5, the AUSF may send a message (e.g., an authentication response) to the MM NF. This message may include the dehidden UE ID. The message may include an Authorization and Key Agreement (AKA) challenge packet. The AKA challenge packet may include an AKA challenge. The message may include the SEAF key K. SEAF This message may include instructions for selecting LPS3.

[0370] At step 6, the MM NF can generate a Non-Access Stratum (NAS) Security Mode Command (SMC) packet. This NAS SMC packet may include a message for commanding the activation of NAS security. The NAS SMC may include a Message Authentication Code (MAC). This NAS SMC packet should be sent in the same message along with an AKA challenge packet.

[0371] In step 7, MM NF can be based on the SEAF key K SEAF To generate (e.g., export) the MM NF key K MN NF The MM NF key K MN NF It can include the number of bits "n" corresponding to LPS3 (e.g., n equals 64 bits).

[0372] MM NF can be based on this MM NF key K MN NF To generate (e.g., export) a NAS key K for encryption. NASenc and / or NAS key K used for integrity protection NASint NAS key K used for encryption NASenc and / or NAS key K used for integrity protection NASint It can include the number of bits "n" corresponding to LPS3 (e.g., n equals 64 bits).

[0373] MM NF can be based on MM NF key K MN NF To generate (e.g., export) the gNB key K gNB_LPS gNB key K gNB_LPS It can include the number of bits "n" corresponding to LPS3 (e.g., n equals 64 bits).

[0374] MM NF can be based on the NAS key K used for encryption. NASenc and / or NAS key K used for integrity protection NASint Encrypt and / or protect the integrity of NAS SMC packets.

[0375] At step 8a, the MM NF may send a message (e.g., an authentication request) to the gNB. This message may include encrypted NAS SMC packets and / or integrity-protected NAS SMC packets. The message may include an AKA challenge packet. The message may include an indication of LPS3 selection. The message may include the gNB key K. gNB_LPS This message may include the initial context.

[0376] At step 8b, gNB can base its key K on gNB_LPS To generate (e.g., derive) an access layer (AS) key K for encryption. LPSenc and / or the access stratum (AS) key K used for integrity protection LPSint The AS key K used for encryption LPSenc and / or AS key K used for integrity protection LPSint It can include the number of bits "n" corresponding to LPS3 (e.g., n equals 64 bits).

[0377] The gNB can generate Access Layer (AS) Security Mode Command (SMC) packets. AS SMC packets can include messages used to command the activation of AS security. AS SMC packets can include MAC addresses. AS SMC packets are sent along with NAS SMC packets and AKA challenge packets in the same message.

[0378] gNB can be based on the AS key K used for encryption. LPSenc and / or AS key K used for integrity protection LPSint Encrypt and / or protect the integrity of ASSMC packets.

[0379] At step 8c, the gNB may send a message (e.g., a RAN message) to the UE. This message may include encrypted ASSMC packets and / or integrity-protected AS SMC packets. This message may include encrypted NAS SMC packets and / or integrity-protected NAS SMC packets. This message may include AKA challenge packets. This message may include an indication of LPS3 selection.

[0380] At step 9a, the UE can perform successful verification of the AKA challenge packet. More specifically, the UE can perform successful verification of the AKA challenge (e.g., the AKA challenge matches the expected AKA challenge). The UE can perform successful verification of the AKA challenge using the Universal Subscriber Identifier Module (USIM). The UE can generate an AKA response packet. The AKA response packet may include an AKA response.

[0381] UE can be based on MM NF key K MM NF(Similar to MM NF in step 7) to generate (e.g., derive) the NAS key K for encryption. NASenc and / or NAS key K used for integrity protection NASint NAS key K used for encryption NASenc and / or NAS key K used for integrity protection NASint It can include the number of bits "n" corresponding to LPS3.

[0382] UE can be based on NAS key K used for encryption NASenc and / or NAS key K used for integrity protection NASint Decrypt and / or verify the integrity of NAS SMC packets.

[0383] The UE can perform successful verification of NAS SMC packets. More specifically, the UE can perform successful verification of the MAC included in the NAS SMC packet (e.g., the MAC matches the expected MAC). The UE can generate a NAS SMC completion packet. The NAS SMC completion packet may include a NAS SMC completion message to confirm the activation of NAS security. The NAS SMC completion packet may include a MAC.

[0384] UE can be based on NAS key K used for encryption NASenc and / or NAS key K used for integrity protection NASint Encrypt and / or protect the integrity of NAS SMC completion messages.

[0385] At step 9b, the UE can use the gNB key K gNB_LPS To generate (e.g., derive) the AS key K for encryption. LPSenc and / or AS key K used for integrity protection LPSint (Similar to gNB in ​​step 8b). The AS key K used for encryption. LPSenc and / or AS key K used for integrity protection LPSint It can include the number of bits "n" corresponding to LPS3.

[0386] UE can be based on the AS key K used for encryption. LPSenc and / or AS key K used for integrity protection LPSint Decrypt and / or verify the integrity of ASSMC packets.

[0387] The UE can perform successful verification of AS SMC packets. More specifically, the UE can perform successful verification of the MAC included in the AS SMC packets (e.g., the MAC matches the expected MAC).

[0388] The UE can generate an AS SMC completion packet. The AS SMC completion packet may include an AS SMC completion message to confirm the activation of NAS security. The AS SMC completion packet may include a MAC address.

[0389] UE can be based on the AS key K used for encryption. LPSenc and / or AS key K used for integrity protection LPSint ASSMC completes the encryption and / or integrity protection of packets.

[0390] At step 10, the UE may send a message (e.g., a RAN message) to the gNB. This message may include an AKA response packet. This message may include an encrypted AS SMC completion packet and / or an integrity-protected AS SMC completion packet. This message may include an encrypted NAS SMC completion packet and / or an integrity-protected NAS SMC completion packet.

[0391] At step 11a, gNB can be based on the AS key K used for encryption. LPSenc and / or AS key K used for integrity protection LPSint Complete the decryption and / or integrity verification of the AS SMC group.

[0392] The gNB can perform successful verification of AS SMC completion packets. More specifically, the UE can perform successful verification of the MAC included in the AS SMC completion packet (e.g., the MAC matches the expected MAC).

[0393] At step 11b, the gNB may send a message (e.g., an authentication response) to the MM NF. This message may include an AKA response packet. The message may include an encrypted NAS SMC completion packet and / or an integrity-protected NAS SMC completion packet.

[0394] MM NF can be based on the NAS key K used for encryption. NASenc and / or NAS key K used for integrity protection NASint Complete the decryption and / or integrity verification of the NAS SMC packets.

[0395] The MM NF can perform successful verification of NAS SMC completion packets. More specifically, the UE can perform successful verification of the MAC included in the NAS SMC completion packet (e.g., the MAC matches the expected MAC).

[0396] MM NF can send messages to AUSF. These messages may include AKA response packets.

[0397] At step 11c, AUSF can perform successful verification of the AKA response packet. More specifically, AUSF can perform successful verification of the AKA response (e.g., the AKA response matches the expected AKA response).

[0398] It should be understood that in the above example, the UE can support LPS3, and the UDM can also select LPS3. Therefore, the AUSF key K AUSF SEAF key K SEAF MM NF key K MN NF NAS key K used for encryption NASenc NAS key K used for integrity protection NASint gNB key K gNB_LPS AS key K used for encryption LPSenc and the AS key K used for integrity protection LPSint It can include a low number of bits "n" (e.g., 64 bits).

[0399] The same process can be implemented, but the UE can support LPS2, and the UDM can also select LPS2. Therefore, the AUSF key K AUSF SEAF key K SEAF MM NF key K MN NF NAS key K used for encryption NASenc NAS key K used for integrity protection NASint gNB key K gNB_LPS AS key K used for encryption LPSenc and the AS key K used for integrity protection LPSint It can include a medium number of bits "n" (e.g., 128 bits).

[0400] Figure 5 The AUSF key K is shown. AUSF SEAF key K SEAF MM NF key K MN NF NAS key K used for encryption NASenc NAS key K used for integrity protection NASint gNB key K gNB_LPS AS key K used for encryption LPSenc and the AS key K used for integrity protection LPSint A diagram illustrating the example relationships between them.

[0401] Figure 6a and Figure 6b A signaling diagram illustrating an example procedure for managing security in a communication system is shown.

[0402] At step 1, the UE (e.g., an IoT device) may send a message (e.g., a registration request) to the MM NF via the gNB. This message may include a hidden UE ID (e.g., an IoT device ID). This hidden ID may include a Subscriber Hidden Identifier (SUCI). The message may include the LPS capabilities supported by the UE. The message may include metadata for AI support.

[0403] This metadata can include dataset metadata. Dataset metadata can include information about the data that will be used to train or evaluate the AI ​​model. Dataset metadata can include the data source (e.g., IoT sensors, user-generated content), data type (e.g., text, image, video), timestamp or creation date, or format (e.g., JSON, image resolution).

[0404] Metadata can include AI model metadata. AI model metadata can include information about the AI ​​model. AI model metadata can include model architecture (e.g., neural network type, layers, parameters), training configuration (e.g., hyperparameters), and performance metrics (e.g., accuracy, loss, precision-recall).

[0405] Metadata can include process metadata. Process metadata can include information about the workflow or environment. Process metadata can include the version of the software or framework used, or computable resources.

[0406] At step 2, the MM NF can send a message (e.g., an authentication request) to the AUSF. This message may include a hidden UE ID. This message may include the LPS capabilities supported by the UE. This message may include metadata for AI support.

[0407] At step 3, the AUSF can send a message to the UDM. This message may include the hidden UE ID. The message may also include the LPS capabilities supported by the UE. The UDM can dehide the hidden UE ID to obtain the dehideable UE ID (e.g., the dehideable IoT device ID). The dehideable UE ID may include a Subscription Permanent Identifier (SUPI). The UDM can determine the UE's LPS1 subscription based on the subscription information.

[0408] At step 4, the UDM can select LPS1. The UDM can select LPS1 based on the UE's subscription to LPS1. The UDM can select LPS1 based on an AI model. The UDM can select LPS1 based on the UE's context (e.g., UE location, UE trust level, and network conditions). The UDM can select LPS1 based on the UE's use of the communication system (e.g., the criticality of the transaction or the sensitivity of the operation). The UDM can select LPS1 to provide optimized signaling and high security. The UDM can generate (e.g., derive) the AUSF key K based on the ciphertext key CK' and the integrity key IK'. AUSF UDM can send the AUSF key K to AUSF. AUSF Alternatively, AUSF can generate (e.g., derive) the AUSF key K based on the ciphertext key CK' and the integrity key IK'. AUSF AUSF key K AUSF This can include the number of bits "n" corresponding to LPS1 (e.g., n equals 256 bits or 512 bits). AUSF can be based on the AUSF key K. AUSF To generate (e.g., export) the SEAF key K SEAF SEAF key K SEAF It can include the number of bits "n" corresponding to LPS1. AUSF can store the AUSF key K. AUSF and SEAF key K SEAF .

[0409] It should be understood that if the authentication process is subsequently successful, AUSF can continue to store the AUSF key K. AUSF and SEAF key K SEAF However, if the authentication process fails, AUSF can delete the AUSF key K. AUSF and SEAF key K SEAF .

[0410] The UDM can send a message to the AUSF. This message may include the de-hidden UE ID. This message may also include an indication of LPS1 selection.

[0411] At step 5, the AUSF may send a message (e.g., an authentication response) to the MM NF. This message may include the dehidden UE ID. The message may include an Authorization and Key Agreement (AKA) challenge packet. The AKA challenge packet may include an AKA challenge. The message may include the SEAF key K. SEAF This message may include an indication of the selection of LPS1. This message may also include an indication of the number of bits "n" corresponding to LPS1.

[0412] At step 6, the MM NF can send a message (e.g., an authentication request) to the UE via the gNB. This message may include an AKA challenge packet.

[0413] The UE can perform successful verification of an AKA challenge packet. More specifically, the UE can perform successful verification of an AKA challenge (e.g., the AKA challenge matches the expected AKA challenge). The UE can perform successful verification of an AKA challenge using USIM. The UE can generate an AKA response packet. This AKA response packet can include an AKA response.

[0414] The UE can send messages (e.g., authentication responses) to the MM NF via the gNB. This message may include an AKA response packet.

[0415] MM NF can send messages (e.g., authentication requests) to AUSF. These messages may include AKA response packets.

[0416] AUSF can perform successful verification of AKA response groups. More specifically, AUSF can perform successful verification of AKA responses (e.g., the AKA response matches the expected AKA response). AUSF can generate AKA result groups. These AKA response groups can include AKA results (e.g., success).

[0417] AUSF can send messages (e.g., authentication responses) to MM NF. These messages may include AKA result packets.

[0418] At step 7, the MM NF can generate a NAS SMC packet. The NAS SMC packet may include a message used to command the activation of NAS security. The NAS SMC packet may include a MAC address.

[0419] MM NF can be based on SEAF key K SEAF To generate (e.g., export) the MM NF key K MN NF MM NF key K MM NF It can include the number of bits "n" corresponding to LPS1.

[0420] MM NF can be based on MM NF key K MN NF To generate (e.g., export) a NAS key K for encryption. NASenc and / or NAS key K used for integrity protection NASint NAS key K used for encryption NASenc and / or NAS key K used for integrity protection NASint It can include the number of bits "n" corresponding to LPS1.

[0421] MM NF can be based on MM NF key KMN NF To generate (e.g., export) the gNB key K gNB_LPS gNB key K gNB_LPS It can include the number of bits "n" corresponding to LPS1.

[0422] MM NF can be based on the NAS key K used for encryption. NASenc and / or NAS key K used for integrity protection NASint Encrypt and / or protect the integrity of NAS SMC packets.

[0423] At step 8a, the MM NF can send a message to the gNB. This message may include encrypted NAS SMC packets and / or integrity-protected NAS SMC packets. The message may include an indication of LPS1 selection. The message may include the gNB key K. gNB_LPS This message may include the initial context. This message may include an indication of the number of bits "n" corresponding to LPS1.

[0424] At step 8b, the gNB can be based on the gNB key K gNB_LPS To generate (e.g., derive) the AS key K for encryption. LPSenc and / or AS key K used for integrity protection LPSint The AS key K used for encryption LPSenc and / or AS key K used for integrity protection LPSint It may include the number of bits “n” corresponding to LPS1 (e.g., n equals 256 or 512 bits).

[0425] The gNB can generate AS SMC packets. AS SMC packets can include messages used to command the activation of AS security. AS SMC packets can include MAC addresses. AS SMC packets will be sent together with NAS SMC packets in the same message.

[0426] gNB can be based on the AS key K used for encryption. LPSenc and / or AS key K used for integrity protection LPSint Encrypt and / or protect the integrity of ASSMC packets.

[0427] At step 8c, the gNB may send a message (e.g., a RAN message) to the UE. This message may include encrypted ASSMC packets and / or integrity-protected AS SMC packets. This message may include encrypted NAS SMC packets and / or integrity-protected NAS SMC packets. This message may include an indication of LPS1 selection. This message may include an indication of the number of bits "n" corresponding to LPS1.

[0428] At step 9a, the UE can base its MM NF key K on the UE. MN NF (Similar to MM NF in step 7) to generate (e.g., derive) the NAS key K for encryption. NASenc and / or NAS key K used for integrity protection NASint NAS key K used for encryption NASenc and / or NAS key K used for integrity protection NASint It can include the number of bits "n" corresponding to LPS1.

[0429] UE can be based on NAS key K used for encryption NASenc and / or NAS key K used for integrity protection NASint Decrypt and / or verify the integrity of NAS SMC packets.

[0430] The UE can perform successful verification of the NAS SMC packet. More specifically, the UE can perform successful verification of the MAC included in the NAS SMC packet (e.g., the MAC matches the expected MAC). The UE can generate a NAS SMC completion packet. The NAS SMC completion packet may include a NAS SMC completion message to confirm the activation of NAS security. The NAS SMC completion packet may include a MAC.

[0431] UE can be based on NAS key K used for encryption NASenc and / or NAS key K used for integrity protection NASint Encrypt and / or protect the integrity of NAS SMC completion messages.

[0432] At step 9b, the UE can use the gNB key K gNB_LPS To generate (e.g., derive) the AS key K for encryption. LPSenc and / or AS key K used for integrity protection LPSint (Similar to gNB NF at step 8b). The AS key K used for encryption. LPSenc and / or AS key K used for integrity protection LPSint It can include the number of bits "n" corresponding to LPS1.

[0433] UE can be based on the AS key K used for encryption. LPSenc and / or AS key K used for integrity protection LPSint Decrypt and / or verify the integrity of ASSMC packets.

[0434] The UE can perform successful verification of AS SMC packets. More specifically, the UE can perform successful verification of the MAC included in the AS SMC packets (e.g., the MAC matches the expected MAC).

[0435] The UE can generate an AS SMC completion packet. This AS SMC completion packet may include an AS SMC completion message to confirm NAS security activation. The AS SMC completion packet may also include a MAC address.

[0436] UE can be based on the AS key K used for encryption. LPSenc and / or AS key K used for integrity protection LPSint ASSMC completes the encryption and / or integrity protection of packets.

[0437] At step 10, the UE may send a message (e.g., a RAN message) to the gNB. This message may include encrypted ASSMC completion packets and / or integrity-protected AS SMC completion packets.

[0438] At step 11a, gNB can be based on the AS key K used for encryption. LPSenc and / or AS key K used for integrity protection LPSint Complete the decryption and / or integrity verification of the AS SMC group.

[0439] The gNB can perform successful verification of AS SMC completion packets. More specifically, the UE can perform successful verification of the MAC included in the AS SMC completion packet (e.g., the MAC matches the expected MAC).

[0440] At step 11b, the gNB may send a message to the MM NF. This message may include an encrypted NAS SMC completion packet and / or an integrity-protected NAS SMC completion packet.

[0441] MM NF can be based on the NAS key K used for encryption. NASenc and / or NAS key K used for integrity protection NASint Complete the decryption and / or integrity verification of the NAS SMC packets.

[0442] The MM NF can perform successful verification of NAS SMC completion packets. More specifically, the UE can perform successful verification of the MAC included in the NAS SMC completion packet (e.g., the MAC matches the expected MAC).

[0443] Figure 7 A block diagram of an example method for managing security in a communication system, executed by the UE, is shown.

[0444] At step 700, the UE can receive a first message from the BS, which includes an AS SMC packet and a NAS SMC packet.

[0445] At step 702, the UE can perform successful verification of AS SMC packets and NAS SMC packets.

[0446] At step 704, the UE may send a second message to the BS, which includes an AS SMC completion packet and a NASSMC completion packet.

[0447] Figure 8 A block diagram of an example method for managing security in a communication system, executed by a BS, is shown.

[0448] At step 800, the BS may send a first message to the UE, which includes an AS SMC packet and a NAS SMC packet.

[0449] At step 802, the BS can receive a second message from the UE, which includes an AS SMC completion packet and a NASSMC completion packet.

[0450] Figure 9 A block diagram of an example method for managing security in a communication system, executed by MM NF, is shown.

[0451] At step 900, the MM NF can receive a first message from the NF, which includes an indication of the selection of a security level.

[0452] At step 902, the MM NF may send a second message to the BS, which includes an indication of the selection of a security level.

[0453] Figure 10 A block diagram is shown of an example method for managing security in a communication system, executed by AUSF.

[0454] At step 1000, the AUSF can receive a first message from the first NF, which includes an indication of the security level supported by the UE.

[0455] At step 1002, the AUSF may send a second message to the second NF, which includes an indication that the UE supports the security level.

[0456] Figure 11 A block diagram of an example method for managing security in a communication system, executed by the UE, is shown.

[0457] At step 1100, the UE can receive a first message from the BS, which includes an AKA challenge packet, an AS SMC packet, and a NAS SMC command packet.

[0458] At step 1102, the UE can perform successful verification of the AKA challenge packet, AS SMC packet, and NAS SMC packet.

[0459] At step 1104, the UE may send a second message to the BS, which includes an AKA response packet, an AS SMC completion packet, and a NAS SMC completion packet.

[0460] Figure 12 A block diagram is shown of an example method for managing security in a communication system, executed by a base station.

[0461] At step 1200, the BS may send a first message to the UE, which includes: an AKA challenge packet, an AS SMC packet, and a NAS SMC packet.

[0462] At step 1202, the BS can receive a second message from the UE, which includes: an AKA response packet, an AS SMC completion packet, and a NAS SMC completion packet.

[0463] Figure 13 A block diagram of an example method for managing security in a communication system, executed by MM NF, is shown.

[0464] At step 1300, the MM NF can receive a first message from the NF, which includes an indication of the selection of a security level.

[0465] At step 1302, MM NF can generate a NAS key K for encryption based on the selected security level. NASenc Or NAS key K used for integrity protection NASint At least one of them.

[0466] At step 1304, MM NF can use the NAS key K for encryption. NASenc Or NAS key K used for integrity protection NASint At least one of the following, performing at least one of the encryption or integrity protection operations of the non-access stratum security mode command packet.

[0467] At step 1306, the MM NF may send a second message to the BS, the second message including at least one of an encrypted NAS SMC packet or an integrity-protected NAS SMC packet, and a security level selection indication.

[0468] Figure 14 A block diagram is shown of an example method for managing security in a communication system, executed by AUSF.

[0469] At step 1400, the AUSF can receive a first message from the first NF, which includes an indication of the security level supported by the UE.

[0470] At step 1402, the AUSF may send a second message to the second NF, which includes an indication that the UE supports the security level.

[0471] At step 1404, the AUSF can receive a third message from the second NF, which includes an indication of the selection of a security level.

[0472] At step 1406, the AUSF may send a fourth message to the first NF, which includes an indication of the selection of a security level.

[0473] Figure 15 A block diagram of an example method for managing security in a communication system, executed by the UE, is shown.

[0474] At step 1500, the UE can receive a first message from the BS, which includes an AKA challenge packet.

[0475] At step 1502, the UE can perform successful verification of the AKA challenge group.

[0476] At step 1504, the UE may send a second message to the BS, the second message including an AKA response packet.

[0477] At step 1506, the UE can receive a third message from the BS, which includes AS SMC packets and NAS SMC packets.

[0478] At step 1508, the UE can perform successful verification of AS SMC packets and NAS SMC packets.

[0479] At step 1510, the UE may send a fourth message to the BS, which includes an AS SMC completion packet and a NAS SMC completion packet.

[0480] Figure 16 A block diagram of an example method for managing security in a communication system, executed by a BS, is shown.

[0481] At step 1600, the BS may send a first message to the UE, which includes an AKA challenge packet.

[0482] At step 1602, the BS can receive a second message from the UE, which includes an AKA response packet.

[0483] At step 1604, the BS may send a third message to the UE, which includes: AS SMC packet and NASSMC packet.

[0484] In step 1606, the BS can receive a fourth message from the UE, which includes: AS SMC completion packet and NASSMC completion packet.

[0485] Figure 17 A block diagram of an example method for managing security in a communication system, executed by MM NF, is shown.

[0486] At step 1700, the MM NF can receive a first message from the NF, the first message including at least one of: an indication of a security level selection or an indication of the number of bits corresponding to the security level.

[0487] At step 1702, MM NF can generate a NAS key K for encryption based on at least one of an indication of the selected security level or an indication of the number of bits corresponding to that security level. NASenc Or NAS key K used for integrity protection NASint At least one of them.

[0488] At step 1704, MM NF can use the NAS key K for encryption. NASenc Or NAS key K used for integrity protection NASint At least one of the following, to perform at least one of NAS SMC packet encryption or NAS SMC packet integrity protection.

[0489] At step 1706, the MM NF may send a second message to the BS, which includes at least one of an encrypted NAS SMC packet or an integrity-protected NAS SMC packet, and an indication of the selection of a security level.

[0490] Figure 18 A block diagram is shown of an example method for managing security in a communication system, executed by AUSF.

[0491] At step 1800, the AUSF can receive a first message from the first NF, which includes an indication of the security level supported by the UE.

[0492] At step 1802, the AUSF may send a second message to the second NF, which includes an indication that the UE supports the security level.

[0493] At step 1804, the AUSF can receive a third message from the second NF, which includes an indication of the selection of a security level.

[0494] At step 1806, the AUSF may send a fourth message to the first NF, the fourth message including at least one of: an indication of a security level selection or an indication of the number of bits corresponding to the security level.

[0495] Figure 19 A schematic diagram of a non-volatile storage medium 800 is shown, which stores instructions that, when executed by a processor, allow the processor to execute... Figures 7 to 18 One or more steps of any of the methods mentioned above.

[0496] It should be noted that although exemplary embodiments have been described above, various variations and modifications can be made to the disclosed solutions without departing from the scope of the invention.

[0497] Therefore, embodiments may vary within the scope of the appended claims. Typically, some embodiments may be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. For example, some aspects may be implemented in hardware, while others may be implemented in firmware or software, which may be executed by a controller, microprocessor, or other computing device, although embodiments are not limited thereto. While various embodiments may be shown and described as block diagrams, flowcharts, or using other graphical representations, it should be understood that, as non-limiting examples, these blocks, apparatuses, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or combinations thereof.

[0498] These embodiments can be implemented by computer software stored in memory and executed by at least one data processor of the relevant entity, or by hardware, or by a combination of software and hardware. Furthermore, in this regard, attention should be paid to any processes (e.g., such as...) Figures 7 to 18 Any of the following can represent a program step, or an interconnected logic circuit, block, or function, or a combination of program steps and logic circuits, blocks, and functions. Software can be stored on physical media, such as memory chips or memory blocks implemented inside a processor, magnetic media (hard disks or floppy disks), and optical discs (such as DVDs and their data versions, CDs).

[0499] The memory can be any type suitable for the local technological environment and can be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory. The data processor can be any type suitable for the local technological environment and, by way of non-limiting example, can include one or more of the following: general-purpose computers, special-purpose computers, microprocessors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), gate-level circuits, and processors based on multi-core processor architectures.

[0500] Alternatively or additionally, some embodiments may be implemented using a circuit system. This circuit system may be configured to perform one or more of the previously described functional and / or method steps. This circuit system may be provided in a base station and / or communication equipment.

[0501] As used in this application, the term "circuit system" may refer to one or more or all of the following: (a) Hardware circuit implementation only (such as implementation only in analog and / or digital circuit systems); (b) A combination of hardware circuits and software, such as: (i) A combination of (multiple) analog and / or digital hardware circuits having software / firmware, and (ii) Any part of a hardware processor(s) having software (including (multiple) digital signal processors, software, and (multiple) memories, which work together to enable an apparatus (such as a communication device or base station) to perform the aforementioned functions; and (c) (multiple) hardware circuits and / or (multiple) processors, such as (multiple) microprocessors or a portion thereof, which require software (e.g., firmware) to operate, but may be absent when operation is not required.

[0502] This definition of circuit system applies to all uses of the term in this application (including in any claim). As another example, as used in this application, the term circuit system also covers only hardware circuitry or a processor (or multiple processors) or portions of hardware circuitry or a processor and its accompanying software and / or firmware implementation. For example, the term circuit system also covers integrated devices.

[0503] As used in the specification and claims, the term "component" can refer to one or more individual elements configured to perform one or more corresponding functions, or it can refer to multiple elements performing such one or more functions. Furthermore, the functions described in the claims can be performed by the same individual components or the same combination of components. For example, in a device, the execution of one or more such functions can be caused by a processor executing instructions stored in the device's memory.

[0504] The foregoing description has provided a comprehensive and detailed description of some embodiments through exemplary and non-limiting examples. However, various modifications and adjustments will become apparent to those skilled in the art when read in conjunction with the accompanying drawings and appended claims, given the foregoing description. Nevertheless, all such and similar modifications will still fall within the scope defined in the appended claims.

Claims

1. A device for communication, comprising: At least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured together with the at least one processor such that the device performs at least: The first message is received from the base station, and the first message includes: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; Perform successful verification of the authentication and key negotiation challenge packet, the access stratum security mode command packet, and the non-access stratum security mode command packet; and A second message is sent to the base station, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

2. The apparatus of claim 1, wherein the first message further includes an indication of a security level selection; and The at least one memory and the computer code are configured, together with the at least one processor, such that the device performs at least the following: Based on the indication of the selected security level, an access layer key K for encryption is generated. LPSenc Or the access layer key K used for integrity protection LPSint At least one of them; and Based on the indication of the selected security level, a non-access stratum key K for encryption is generated. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them.

3. The apparatus of claim 2, wherein the at least one memory and the computer code are configured, together with the at least one processor, such that the apparatus performs at least: Using the access layer key K used for encryption LPSenc Or the access layer key K used for integrity protection LPSint At least one of the following: performing an access layer security mode command to complete packet encryption or performing access layer security mode command to complete packet integrity protection; Using the non-access stratum key K used for encryption NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following: performing a non-access stratum security mode command to complete packet encryption or performing non-access stratum security mode command to complete packet integrity protection; and The second message includes at least one of the following: the authentication and key negotiation response packet, the encrypted access stratum security mode command completion packet or the access stratum security mode command completion packet with integrity protection, and the encrypted non-access stratum security mode command completion packet or the non-access stratum security mode command completion packet with integrity protection.

4. The apparatus of claim 3, wherein the access layer key K for encryption is generated based on the indication of the selection of the security level. LPSenc Or the access layer key K used for integrity protection LPSint The at least one of the following includes: Generate the access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint The security selection of at least one of the security levels, wherein the security selection includes a number of bits corresponding to the security level.

5. The apparatus of claim 4, wherein the generation includes the access layer key K for encryption, which comprises a number of bits corresponding to the security level. LPSenc Or the access layer key K used for integrity protection LPSint The security selection of at least one of the following includes: Generate base station key K gNB_LPS The base station key K gNB_LPS Including the number of bits corresponding to the security level; as well as Based on the base station key K gNB_LPS Generate the access layer key K for encryption. LPSenc Or the access layer key K used for integrity protection LPSint The safe choice of at least one of them.

6. The apparatus according to any one of claims 2 to 5, wherein the non-access stratum key K for encryption is generated based on the indication of the selection of the security level. NASenc Or the non-access stratum key K used for integrity protection NASint The at least one of the following includes: Generate the non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint The security selection of at least one of the security levels, wherein the security selection includes the number of bits corresponding to the security level.

7. The apparatus of claim 6, wherein the generation includes the number of bits corresponding to the security level, for encryption, the non-access stratum key K. NASenc Or the non-access stratum key K used for integrity protection NASint The security selection of at least one of the following includes: Generate Mobility Management Network Function Key K MM NF The mobility management network function key K MM NF Including the number of bits corresponding to the security level; and Based on the mobility management network function key K MM NF Generate the non-access stratum key K for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint The safe choice of at least one of them.

8. The apparatus according to any one of claims 1 to 7, wherein the apparatus includes user equipment.

9. The apparatus according to any one of claims 1 to 8, wherein the apparatus includes an Internet of Things (IoT) device.

10. A device for communication, comprising: At least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured together with the at least one processor such that the device performs at least: Send a first message to the user equipment, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; and The user equipment receives a second message, which includes: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

11. The apparatus of claim 10, wherein the first message further includes an indication of a security level selection.

12. The apparatus of claim 10 or 11, wherein the at least one memory and the computer code are configured, together with the at least one processor, such that the apparatus performs at least: Execute the access layer security mode command to complete the successful verification of the packet; and Send a third message to the network function, the third message including at least one of the following: the authentication and key negotiation response packet, and the encrypted non-access stratum security mode command completion packet or the integrity-protected non-access stratum security mode command completion packet.

13. The apparatus according to any one of claims 9 to 11, wherein the apparatus comprises a base station.

14. The apparatus according to any one of claims 9 to 12, wherein the network function includes a mobility management network function.

15. An apparatus comprising: At least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured together with the at least one processor such that the device performs at least: Receive a first message from the network function, the first message including an indication of the selection of a security level; Based on the indication of the selected security level, a non-access stratum key K for encryption is generated. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; Using the non-access stratum key K used for encryption NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following, to perform at least one of encryption of non-access stratum security mode command packets or integrity protection of non-access stratum security mode command packets; as well as A second message is sent to the base station, the second message including at least one of an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet and the indication of the selection of the security level.

16. The apparatus of claim 15, wherein the non-access stratum key K for encryption is generated based on the indication of the selection of the security level. NASenc Or the non-access stratum key K used for integrity protection NASint The at least one of the following includes: Generate the non-access stratum key K for encryption, which includes the number of bits corresponding to the security level. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the above.

17. The apparatus of claim 16, wherein the number of bits corresponding to the security level comprises: The first or lowest number of bits corresponding to the first or lowest security level; The second or medium number of bits corresponding to the second or medium security level; or The third or higher number of bits corresponding to the third or higher security level.

18. The apparatus of claim 16 or claim 17, wherein the first message further includes a secure anchoring function key K. SEAF The secure anchoring function key includes K SEAF The number of bits corresponding to the security level.

19. The apparatus of claim 18, wherein the generation includes the number of bits corresponding to the security level, for encryption, the non-access stratum key K. NASenc Or the non-access stratum key K used for integrity protection NASint The at least one of the following includes: Based on the security anchoring function key K SEAF Generate the mobility management network function key K MM NF The mobility management network function key K MM NF This includes the number of bits in the indication corresponding to the selection of the security level; as well as Based on the mobility management network function key K MM NF Generate the non-access stratum key K, which includes the number of bits corresponding to the security level, for encryption. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the above.

20. The apparatus of claim 19, wherein the at least one memory and the computer code are configured, together with the at least one processor, such that the apparatus performs at least: Based on the mobility management network function key K MM NF Generate base station key K gNB_LPS The base station key K gNB_LPS Includes the number of bits in the indication corresponding to the selection of the security level; and The second message also includes the base station key K. gNB_LPS .

21. The apparatus according to any one of claims 15 to 20, wherein the first message further comprises an authentication and key negotiation challenge packet; and The second message also includes the authentication and key negotiation challenge group.

22. The apparatus according to any one of claims 15 to 21, wherein the second message further includes a de-hidden user equipment identifier.

23. The apparatus according to any one of claims 15 to 22, wherein the network function includes an authentication server function.

24. The apparatus according to any one of claims 15 to 23, wherein the apparatus includes a mobility management network function.

25. An apparatus for communication, comprising: At least one processor and at least one memory, the at least one memory including computer code for one or more programs, the at least one memory and the computer code being configured together with the at least one processor such that the device performs at least: Receive a first message from a first network function, the first message including an indication that the user equipment supports a security level; Send a second message to the second network function, the second message including the indication that the user equipment supports the security level; Receive a third message from the second network function, the third message including an indication of the selection of the security level; and A fourth message is sent to the first network function, the fourth message including the indication of the selection of the security level.

26. The apparatus of claim 25, wherein the selection of the security level is based on the user equipment subscribing to the security level.

27. The apparatus of claim 25 or claim 26, wherein the at least one memory and the computer code are configured, together with the at least one processor, such that the apparatus performs at least: Generate secure anchoring function key K SEAF The security anchoring function key K SEAF Including the number of bits corresponding to the security level; and The fourth message also includes the security anchoring function key K. SEAF .

28. The apparatus according to any one of claims 25 to 27, wherein the at least one memory and the computer code are configured together with the at least one processor such that the apparatus performs at least: Generate authentication and key negotiation challenge blocks; and The fourth message also includes an authentication and key negotiation challenge group.

29. The apparatus according to any one of claims 25 to 28, wherein the first message further includes a hidden user equipment identifier; The at least one memory and the computer code are configured, together with the at least one processor, such that the device performs at least the following: Send the hidden user equipment identifier to the third network function; Receive the dehidden user equipment identifier from the third network function; and The fourth message includes the de-hidden user equipment identifier.

30. The apparatus according to any one of claims 25 to 29, wherein the apparatus includes an authentication server function.

31. The apparatus according to any one of claims 25 to 30, wherein the first network function includes a mobility management network function.

32. The apparatus according to any one of claims 25 to 31, wherein the third network function includes a subscriber identifier de-hiding function.

33. A method for communication, comprising: The first message is received from the base station, and the first message includes: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; Perform successful verification of the authentication and key negotiation challenge packet, the access stratum security mode command packet, and the non-access stratum security mode command packet; and A second message is sent to the base station, the second message including: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

34. A method for communication, comprising: Send a first message to the user equipment, the first message including: an authentication and key negotiation challenge packet, an access stratum security mode command packet, and a non-access stratum security mode command packet; and The user equipment receives a second message, which includes: an authentication and key negotiation response packet, an access stratum security mode command completion packet, and a non-access stratum security mode command completion packet.

35. A method for communication, comprising: Receive a first message from the network function, the first message including an indication of the selection of a security level; Based on the indication of the selected security level, a non-access stratum key K for encryption is generated. NASenc Or the non-access stratum key K used for integrity protection NASint At least one of them; Using the non-access stratum key K used for encryption NASenc Or the non-access stratum key K used for integrity protection NASint At least one of the following, to perform at least one of encryption of non-access stratum security mode command packets or integrity protection of non-access stratum security mode command packets; as well as A second message is sent to the base station, the second message including at least one of an encrypted non-access stratum security mode command packet or an integrity-protected non-access stratum security mode command packet and the indication of the selection of the security level.

36. A method for communication, comprising: Receive a first message from a first network function, the first message including an indication that the user equipment supports a security level; Send a second message to the second network function, the second message including the indication that the user equipment supports the security level; Receive a third message from the second network function, the third message including an indication of the selection of the security level; and A fourth message is sent to the first network function, the fourth message including the indication of the selection of the security level.

37. A computer program product comprising computer-executable instructions that, when executed on one or more processors, perform the steps of the method according to any one of claims 33 to 36.

Images