UE security state

Abstract

The present disclosure relates to user equipment, UE, security status. A UE is disclosed, the UE comprising: means for supporting a set of security statuses, a security status indicating a different security situation; means for adopting a security status of the set of security statuses based on a detected security situation of the UE; means for prohibiting at least some communications to and / or from the UE in dependence on the adopted security status. A corresponding network entity, system and corresponding methods are disclosed.

Description

Technical Field

[0001] The following disclosure relates to the field of communication technology, particularly communication networks, and especially wireless communication networks. This disclosure may, for example, relate to apparatus, methods, computer programs, computer-readable media, and systems for using a secure state, particularly for use by a user equipment (UE) or by a UE in a secure state. Background Technology

[0002] In mobile communication networks, security can be achieved through a layered architecture that combines various protocols and mechanisms to protect data and communications. This architecture includes a two-way authentication concept between the UE and the network. This process may involve the use of unique identifiers, such as International Mobile Subscriber Identity (IMSI) or Temporary Mobile Subscriber Identity (TMSI), which can be securely exchanged to verify the identities of both parties. Access control measures can also be employed to restrict unauthorized access to network resources.

[0003] In addition, encryption protocols can be used to protect the confidentiality of data sent over the air interface.

[0004] Integrity protection mechanisms can be implemented to ensure that data is not tampered with during transmission. These mechanisms may involve using Message Authentication Codes (MACs) or hash functions to verify the integrity of messages exchanged between the UE and the network.

[0005] In addition, key management protocols can be used to securely generate, distribute, and manage encryption keys.

[0006] Next-generation networks, such as 5G networks, use the concept of security context. A security context can be a state established locally at the UE and Serving Network domain, represented by "5G Security Context Data" stored at the UE and Serving Network. For example, "5G Security Context Data" includes one or more cryptographic keys to be used and / or one or more identifiers of cryptographic algorithms to be used. The state of a security context can be either "current" or "non-current." A "current" 5G security context is the most recently activated security context. Any other 5G security context can be understood as being in a "non-current" state. The state of a particular context type may change over time.

[0007] Despite the aforementioned security mechanisms, mobile communication networks still face security vulnerabilities and challenges in various situations. Summary of the Invention

[0008] It has been observed that introducing security states for the UE can improve security. Without such security states, the system may be unable to track the context or history of actions, users, or interactions. Therefore, without security states, there may be drawbacks such as difficulty in detecting and preventing attack patterns, lack of security awareness among UEs, or difficulty in recovering from compromised UEs. Security states can, for example, indicate the security status of the UE. For instance, they can allow tracking the context and / or history of UE actions, user and / or interactions (e.g., interactions with the network or other devices).

[0009] The security state used in this article should not be confused with the security context state in a 5G network, which only indicates whether the set of keys and / or algorithms is "current" and therefore whether it will be used.

[0010] According to the first aspect, the following was disclosed:

[0011] A user equipment (UE) includes: Components used to support a set of safety states, which indicate different safety conditions; A component for adopting security states from a security state set based on the security situation detected by the UE; A component for dynamically changing the adopted security state to another security state in the security state set when a change in the security status of the UE is detected.

[0012] A network entity, comprising: Components used to support a set of security states, which indicate different security conditions for the user equipment (UE). A component for determining the security status of a UE from a security status set based on the security situation detected by the UE; A component for dynamically changing the determined security state of a UE to another security state of the UE in the security state set when a change in the security status of the UE is detected.

[0013] According to the second aspect, the following was disclosed:

[0014] A user equipment (UE) includes: Used for components whose safety status has not been assessed; Components used for conducting safety assessments; Components used to change a non-assessed safety state to a temporary safety state based on the results of a safety assessment; A component used to send instructions to network entities regarding a change in temporary security status; Components for obtaining information from network entities indicating the security status of the UE; and Components used to adopt the indicated safety status.

[0015] A network entity, comprising: A component for receiving instructions from the UE regarding a change to a temporary security state; A component for determining the security status of a UE based on at least one of the following: (i) the availability of one or more event reports related to the behavior of the UE, and (ii) the content of one or more event reports; A component used to send information to the UE indicating the determined security status for the UE.

[0016] According to the third party, the following content was disclosed:

[0017] A user equipment (UE) includes: Components used to employ a safe operating state; The component used to determine the UE evaluation report, which includes information about the security status adopted; A component used to send information to network entities, including requests for session establishment or registration, such information including UE evaluation reports; A component for receiving information indicating a security algorithm selected based on a UE evaluation report, wherein the security algorithm is used for one or more of the following: (i) encryption of services between the UE and at least a portion of the network, (ii) decryption of services between the UE and at least a portion of the network, (iii) integrity protection of services between the UE and at least a portion of the network, and (iv) verification of integrity protection of services between the UE and at least a portion of the network. Components used to employ the indicated security algorithm.

[0018] A network entity (e.g., a Session Management Network Function (SM NF) and / or a Mobility Management Network Function (MMNF)) includes: Components used to obtain a security assessment report for a user equipment (UE), which includes information about the security status of the UE; Components for selecting security algorithms for one or more of the following based on a security assessment report: (i) encryption of services between the UE and at least a portion of the network, (ii) decryption of services between the UE and at least a portion of the network, (iii) integrity protection of services between the UE and at least a portion of the network, and (iv) verification of integrity protection of services between the UE and at least a portion of the network. A component used to send information to the UE indicating the selected security algorithm.

[0019] A network entity (e.g., a security assessment NF) includes: Components used to determine the security status of a user equipment (UE); Components used to determine a security assessment report for the UE, which includes information about the security status of the UE; A component for providing a security assessment report to select a security algorithm based on the security assessment report, wherein the security algorithm is used for one or more of the following: (i) encryption of services between the UE and at least a portion of the network, (ii) decryption of services between the UE and at least a portion of the network, (iii) integrity protection of services between the UE and at least a portion of the network, and (iv) verification of integrity protection of services between the UE and at least a portion of the network.

[0020] According to the fourth aspect, the following content was disclosed:

[0021] A user equipment (UE) includes: Components used to support a set of safety states, which indicate different safety conditions; A component for adopting security states from a security state set based on the security situation detected by the UE; A component for prohibiting at least some communications to and / or from the UE based on the security status adopted.

[0022] A network entity, comprising: Components used to support a set of security states, which indicate different security conditions for the user equipment (UE). A component for determining the security status of a UE from a security status set based on the security situation detected by the UE; A component for prohibiting at least some communications to and / or from the UE based on a security status determined for the UE.

[0023] Whenever a UE or network entity is mentioned, it should be understood that this is merely an example of a device, and any device can have the functions described.

[0024] Any disclosure in this document relating to any example aspect should be understood as equivalent to any subject matter relating to the corresponding example aspect (e.g., to apparatus, method, computer program, and computer-readable medium). For example, any paragraph describing at least one processor; and at least one memory including instructions; wherein the at least one memory and instructions are configured, together with the at least one processor, to cause the apparatus to perform at least one step, should be understood as disclosing that step itself as a method step. Conversely, any paragraph describing a method or method step should be understood as disclosing at least one processor; and at least one memory including instructions; wherein the at least one memory and instructions are configured, together with the at least one processor, to cause the apparatus to perform at least the method or method step. Disclosure of a method or method step should also be considered as disclosure of components for performing and / or causing the performance of the corresponding method or method step. Similarly, disclosure of components for performing and / or causing the performance of a method or method step should also be considered as disclosure of the method or method step itself.

[0025] Specifically, an apparatus (e.g., a network entity or a UE) is disclosed, configured to perform, execute, and / or control a method according to any of the above-described example aspects, or including corresponding components for performing and / or controlling a method according to any of the above-described example aspects. According to another example aspect, an apparatus (e.g., a UE or a network entity) is disclosed, comprising at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform at least the method according to any aspect.

[0026] The apparatus, in any respect (e.g., UE or network entity), may include components for performing specified methods or steps.

[0027] The apparatus disclosed in any aspect may include only the disclosed components (i.e., consist of the disclosed components), such as parts, processors, memory, circuit systems, or may also include one or more additional components.

[0028] This component can be implemented in hardware and / or software. It may include, for example, at least one processor for executing processor instructions to perform the required functions, at least one memory for storing the instructions, or both. Alternatively, it may include, for example, a circuit system designed or configured to perform the required functions, implemented, for example, in a chipset or chip (such as an integrated circuit). Typically, this component may include, for example, one or more processing units or processors.

[0029] As used in this application, the term "circuit system" may refer to one or more or all of the following: (a) Pure hardware circuit implementation (such as implementation in analog and / or digital circuit systems) and (b) A combination of hardware circuitry and software, such as (if applicable): (i) A combination of (multiple) analog and / or digital hardware circuits and software / firmware, and (ii) Any part of the software, including multiple hardware processors (including multiple digital signal processors), software, and multiple memories, which work together to enable a device such as a UE or network entity to perform various functions, and (c) (Multiple) hardware circuits and / or (multiple) processors, such as (multiple) microprocessors or a portion thereof, which require software (e.g., firmware) to function, but may be absent when not in use.

[0030] This definition of circuit system applies to all uses of the term in this application, including in any claim. As another example, as used herein, the term circuit system also covers implementations of hardware circuitry or a processor (or processors) or a portion thereof and its accompanying software and / or firmware. For example, if applicable to a particular claim element, the term circuit system also covers baseband integrated circuits or processor integrated circuits for mobile devices, or similar integrated circuits in servers, cellular network devices, or other computing or networking devices. Any apparatus mentioned herein may include a circuit system.

[0031] The UE can be a device that allows a user or application to access network services. For example, the UE can be a mobile phone, smartphone, tablet, laptop, television, or IoT device. The link between the UE and the network can be a wireless link.

[0032] A network entity can be a network entity of a network (e.g., a communication network), such as a TRP, gNB, RAN node, base station, or part thereof. For example, a network entity can be a distributed unit (DU) of a gNB. Network entities can be logically and / or physically distributed. A network entity can be, include, and / or carry one or more network functions (NFs).

[0033] A network entity can be understood as any component or functional element within a mobile communication network that can participate in providing services to user equipment (UE) and / or maintaining network security. Network entities may include hardware devices, software modules, or combinations thereof, which can interact with each other and / or with the UE to facilitate secure communication.

[0034] Network entities can include various functions, such as the security engine within the Mobility Management Network Function (MM NF), the Network Data Analytics Network Function (NWDA NF), and other security-related modules. These entities can communicate with the UE to authenticate its identity, manage cryptographic keys, implement access control, and / or monitor security events.

[0035] Network entities may include core network components that can handle user authentication and authorization processes, such as a Home Subscriber Server (HSS) or an Authentication, Authorization, and Accounting (AAA) server. They may also involve radio access network components, such as base stations that can manage the radio interface between the UE and the network.

[0036] Furthermore, network entities can support various security protocols and mechanisms to protect data integrity, confidentiality, and / or availability. These entities can implement encryption algorithms, integrity protection schemes, and / or key management processes to ensure secure communication channels. They can perform intrusion detection and / or prevention functions to guard against potential threats.

[0037] Furthermore, a computer program product is disclosed that, when executed by a processor of a device (e.g., a UE), causes the device to perform a method according to any example aspect.

[0038] In addition, a computer program is disclosed that, when executed by a processor, causes one or more devices (e.g., a UE or a network entity) to perform and / or control actions according to any example aspect of the method.

[0039] In addition, a computer-readable storage medium (e.g., tangible and / or non-transitory) is disclosed, which includes at least one of the disclosed computer program products or computer programs.

[0040] In addition, a system is disclosed. This system may include at least one of the following: one or more UEs and one or more network entities, for example, as described above.

[0041] The following sections will describe in more detail example features and example implementations of all aspects.

[0042] UEs and / or network entities can support security state sets.

[0043] A security state set may include at least two distinct security states. It may include two, three, four, five, six, or more security states, or consist of them. A defined security state set may exist. This set may be predefined, for example, in a protocol specification. Additionally or alternatively, the security state set supported by the UE, or by a network entity for a specific UE, may depend on the capabilities of the UE and / or the network. In some embodiments, this set may be configured by the network.

[0044] In some embodiments, a UE may be referred to as supporting a set of security states when it is able to adopt each security state in the set based on the security situation and / or instructions received from the network. The set of security states may be referred to as an adoptable (and / or determinable) set of security states.

[0045] A network entity can be referred to as supporting a set of security states for a UE when it is able to determine each security state in the security state set for the UE based on the security situation for the UE. It is understood that a network entity can determine and / or maintain and / or track (e.g., one) a security state for each UE.

[0046] A security status can indicate different security conditions of a UE. For example, a security status can indicate different trust levels of a UE. In some embodiments, a security status can reflect the results of a security assessment. Security assessments can occur continuously (e.g., periodically or in an event-driven manner) to track changes in the security status of the UE and to adopt or determine a security status for the UE accordingly.

[0047] Security status can influence UE behavior, such as the length of cryptographic keys used in applications. Similarly, UE security status can influence network behavior towards the UE. In some embodiments, security status can reflect the level of security measures already adopted or should be adopted. For example, there can be a security status indicating that low security measures can be used to communicate with the UE. This could be, for example, when a security assessment run has been completed and the result is positive, such as the UE passing all security tests and / or no negative events reported about the UE. On the other hand, there can be a security status indicating that high security measures should be used to communicate with the UE. This could be, for example, when a security assessment run has been completed and the result is partially or entirely negative, such as the UE not yet passing all security tests and / or negative events reported about the UE. For example, if the UE attempts to access the network using the authentication details of another device, this could result in negative event reports.

[0048] In various embodiments, the security state set includes one or more of the following, or consists of one or more of the following: - Safe and secure status; - Monitor security status; - Restricted security status; - Damaged safety status; - Security status not assessed.

[0049] A secure status can indicate, for example, that the UE has passed one or more security assessments. This can mean that the UE is considered trustworthy. In this status, normal operation can proceed with standard security measures in place. For example, the UE can use default encryption algorithms and / or access controls suitable for trusted devices. This status can be adopted, for example, when the initial registration and / or assessment process confirms the integrity of the UE's hardware and / or software components.

[0050] Monitoring the security status can indicate that while the UE is generally trustworthy, it requires closer observation due to certain detected anomalies or potential risks. In this state, additional monitoring mechanisms can be activated to track UE activity and / or ensure ongoing security compliance. For example, the network can employ enhanced logging and / or auditing processes to detect any suspicious behavior.

[0051] A restricted security state indicates that the UE is operable but has limited functionality due to identified security issues. In this state, a subset of features and / or services can be disabled and / or restricted to mitigate potential risks. For example, if the UE has reported minor security issues such as software vulnerabilities, access to sensitive data (such as SMS messages) and / or specific network slices may be restricted (e.g., temporarily).

[0052] A compromised security status can reflect a serious security vulnerability. For example, it can indicate a situation where the integrity and trustworthiness of the UE have been severely compromised. In such cases, stringent measures can be applied to contain potential threats. For instance, if hardware tampering is detected, the UE can be isolated from critical network resources. Additionally or alternatively, communications can be encrypted using more secure algorithms (e.g., using longer and / or specially designated keys) to prevent data leakage.

[0053] The "Unassessed Security" status indicates that the UE's security status has not yet been assessed or determined. This status can be applied during initial registration and / or when the UE is handing over between networks or cells. In this status, default security measures applicable to untrusted devices can be applied until the assessment is completed.

[0054] It should be understood that the set of security states may include other security states, additional security states and / or only some of the above security states, or consist of them.

[0055] The UE can adopt a security state from a set of security states based on the security conditions detected by the UE. The UE can detect security conditions. Detecting the UE's security conditions can include evaluation. In various embodiments, the UE's security conditions can be evaluated, for example, in an event-based and / or periodic manner. As a result, the UE's security state can change, for example, in an event-based or periodic manner. For example, this can be based on the detection of a change in security conditions. Security evaluation can include monitoring security conditions, such as continuous monitoring or monitoring over a predefined time period.

[0056] In various embodiments, the UE can run a security assessment and adopt a security state based on the security assessment.

[0057] Security status can be assessed based on one or more factors, such as evaluating one or more security parameters. An example security parameter is whether the UE includes one or more hardware components that are expected to be included. An additional or alternative factor is whether the UE does not include one or more hardware components that are not expected to be excluded. Another example factor is whether the UE includes one or more software components that are expected to be included. An additional or alternative factor is whether the UE does not include one or more software components that are not expected to be excluded.

[0058] For example, the UE may generate a hash code based on one or more hardware components and / or one or more software components of the UE; and determine whether the generated hash code matches a hash code stored in the UE.

[0059] Hash codes can be determined using a hash function (e.g., a one-way function). Unique identifiers of one or more hardware and / or software components, such as serial numbers and / or fixed addresses, can be used as input. The hash code stored in the UE can have been determined based on components originally installed or intended to be installed in the UE (e.g., by the manufacturer). Therefore, when the UE generates a hash code based on its (actual) hardware and / or software components using the same hash function, the generated hash code should match the stored hash code. If the generated hash code does not match the stored hash code, this can be interpreted as an indication that one or more hardware components and / or one or more software components of the UE used as the basis for generating the hash code do not match the originally installed components. This can be interpreted as an indication that the UE's components have been tampered with. Because hash codes are based on one-way functions, potential attackers may find it difficult to determine the inputs used to obtain the stored hash code. Therefore, attackers may find it difficult to determine (incorrect) serial numbers and / or fixed addresses that will produce the same hash code, and thus may be able to deceive such a security assessment.

[0060] Additionally or alternatively, the UE may evaluate its own behavior (e.g., within a predetermined time interval) and / or its own components and / or changes to those components. During the evaluation, it may detect anomalies and thus potentially insecure security situations. Therefore, it may adopt a security state corresponding to the detected security / insecurity level. The security state adopted by the UE may be a locally adopted security state that is not necessarily mirrored by the network (e.g., temporarily not mirrored).

[0061] When a change in the UE's security status is detected, the UE can dynamically change its adopted security status to another security status within the security status set. In some embodiments, the UE's security status is monitored and / or tracked, for example, continuously (e.g., until a command to change the configuration is received) and / or at least within a predefined time interval. This allows for the detection of changes and a corresponding response. In some embodiments, the security status can be tracked in real-time or near real-time, for example, within 1 or 10 seconds or 1 or 10 minutes. How close to real-time the response to the changed security status should be to detection can depend on the deployment scenario.

[0062] In various embodiments, the UE can run a security assessment (e.g., as described above), and the UE can dynamically change the adopted security state to another security state based on the security assessment. This can occur periodically or based on events. Therefore, the UE does not adopt a security state once and remain in that state (e.g., after initial authentication with the network), but rather dynamically changes the adopted security state. In this way, the security state can dynamically reflect the UE's current security status.

[0063] Additionally or alternatively, the security status of the UE may be detected by another device (e.g., a network entity), and the UE may be notified of the detected security status and / or the security status determined by the detection device based on the detected security status for the UE.

[0064] For example, a network entity can support a set of security states that indicate different security conditions for a user equipment (UE), and the network entity can determine the security state for the UE from the set of security states based on the security conditions detected by the UE.

[0065] Network entities can determine the security state for a UE from a set of security states based on the security situation detected by the UE. To this end, the network entity can perform a security assessment run. This security assessment run can be independent of a security assessment run performed by the UE, and / or may take into account the results of a security assessment run at the UE. The security state for the UE determined by the network entity can correspond to, or differ from, the security state adopted by the UE. Whether the security situation is detected by the UE or the network entity can differ in various embodiments, and / or depend on various factors, such as what aspects are analyzed at the UE (e.g., available hardware components) and the network entity (e.g., event reports from other network entities).

[0066] In some embodiments, the behavior of the UE is evaluated to determine the security status of the UE. This evaluation may involve analyzing the presence and / or absence and / or frequency of one or more specific message types. Additionally or alternatively, the evaluation may involve analyzing authentication information used by the UE.

[0067] For example, determining the security status of a UE by a network entity may include determining the security status based on at least one of the following: (i) the availability of one or more event reports related to the behavior of the UE, and (ii) the content of one or more event reports.

[0068] For example, the absence of event reports for the UE or events indicating unsafe UE behavior can be interpreted as a good sign that the UE is in a safe security condition. However, the network can assess whether a timer used by the UE is malfunctioning and / or whether the UE is attempting to access a prohibited frequency band. For instance, the UE may have been configured to sleep for a predefined period, such as 6 hours. If the UE does not follow this pattern, this can be interpreted as inappropriate behavior. Similarly, the network may notice that the UE's battery is depleting faster than expected. Any events involving UEs that deviate from their expected and / or configured behavior can be reported. Any such event reports and their contents can be considered when determining the security situation and therefore the security status of the UE.

[0069] When a change in the security status of a UE is detected, the network entity can dynamically change the UE's determined security status to another security status within the UE's security status set. The network entity can run multiple security assessments. For example, the network entity can continuously monitor the UE's security status. This can occur proactively, such as by triggering security assessment runs (e.g., periodically), and / or passively, such as by reacting to events.

[0070] For example, a network entity may dynamically change the determined security state based on at least one of the following: (i) the availability of one or more event reports related to the UE's behavior, and (ii) the content of one or more event reports, as at the initial determination of the UE's security state. Therefore, the network entity does not simply adopt and maintain the UE's security state (e.g., after initial authentication with the network), but rather dynamically changes the determined security state of the UE. In this way, the security state can dynamically reflect the UE's current security status.

[0071] In some cases, it may be desirable for the security state adopted by the UE to be consistent with the security state determined by the network for the UE. The security state determined by the network for the UE can be considered more trustworthy than the security state adopted by the UE itself. Network entities can inform the UE of the security state they determine for the UE and / or the security conditions they detect for the UE.

[0072] For example, a network entity can send information to the UE indicating the determined security status for the UE.

[0073] The UE can obtain information indicating its security state. The UE can adopt the indicated security state or dynamically change its adopted security state to the indicated security state. This can be interpreted as the UE no longer relying on its own security assessment, but rather on the assessment of the network entity. In various scenarios, it can be expected that the UE's security assessment and the network entity's security assessment will yield the same results. In this case, the information from the network entity to the UE can simply be a confirmation of what the UE has determined.

[0074] In various embodiments, the network entity can acquire event reports related to the UE's behavior, determine changes to the identified security state for the UE based on the acquired event reports, and send an indication of the security state change to the UE. Thus, even if the UE itself does not continuously run security assessments, the security state adopted by the UE can reflect the UE's security status.

[0075] In some embodiments, the security state adopted by the UE differs across multiple Protocol Data Unit (PDU) sessions.

[0076] In some embodiments, the security state determined by the network entity for the UE differs across multiple PDU sessions with the UE.

[0077] This does not necessarily mean that there is a different adopted / determined security state for the UE in every PDU session. Rather, it could mean that the security state is dynamic. Therefore, one of its characteristics could be that it is variable between PDU sessions. Thus, it can be expected that, at least for some UEs and / or some scenarios, the adopted / determined security state will differ across multiple PDU sessions; for example, assuming that the UE's security situation differs between PDU sessions. In some embodiments, the request to establish a PDU session can be a trigger for assessing the UE's security situation and / or determining / adopting / changing the UE's security state based on the assessment results.

[0078] In some embodiments, the UE may include a trusted execution environment (TEU) for performing operations related to the UE's security state. The TEU may be a dedicated environment, such as a dedicated module in hardware and / or software, or a dedicated module implemented by hardware and / or software. It may be more secure than other parts of the UE. For example, it may be physically protected from tampering. Additionally or alternatively, the software that can run in the TEU may be restricted. The TEU may be used to perform operations related to the UE's security state. For example, the TEU (and, for example, a TEU-only) may handle the adoption and / or alteration of the adopted security state. Additionally or alternatively, the TEU may perform security assessments or portions thereof (e.g., hash code calculations). The TEU may additionally or alternatively run other operations related to the UE's security state. Having a TEU for performing operations related to the UE's security state may make it more difficult for an attacker to manipulate the security state adopted by the UE. This can increase the trustworthiness of the UE. The UE may notify the network whether it has a TEU. This can be advantageous, for example, if it can be anticipated that only some UEs have a TEU, while others do not.

[0079] In various embodiments, the network entity may include a security engine for performing operations related to the security state of the UE. The security engine may be a dedicated component in hardware and / or software. It may resemble a trusted execution environment in the UE, similar in that it may be more secure than other parts of the network (entity). For example, it may be physically protected from tampering. Additionally or alternatively, the software that can run in the security engine may be limited. The security engine (and, for example, a security engine only) may handle the adoption and / or alteration of a determined security state and / or the performance of security assessments or portions thereof, such as including assessment event reporting. The security engine may be part of a network function, such as an Authentication Server Function (AUSF) or Unified Data Management (UDM). Alternatively, it may be part of a dedicated security assessment network function (Sec NF).

[0080] The security state adopted by the UE and / or determined by the network for the UE can affect the handling of services (e.g., control and / or data services) between the UE and other entities (e.g., network entities or other UEs). For example, the way services are handled can differ depending on the security state. When the security state indicates a low-security situation, more secure processing can be applied. When the security state indicates a secure situation, less secure processing can be applied. This can have the advantage of finding a balance between security requirements and efficiency. From an efficiency perspective, it is preferable to keep the operations used to ensure security to a minimum in all situations. Therefore, if the network considers the UE to be trustworthy (e.g., its security state indicates a secure situation), a configuration that requires fewer or lighter operations to ensure security can be used. On the other hand, if the network considers the UE to be untrustworthy or not trustworthy at all (e.g., its security state indicates an insecure situation), a configuration that enforces many and / or heavy operations to ensure security can be used. Because the security state is dynamic (and, for example, not determined only once at certification and then kept static for a long time by design (e.g., a month)), the balance can be dynamically readjusted to meet security requirements and to be as efficient as possible for a given security situation.

[0081] In various embodiments, the network entity may select, based on a determined security state, one or more of the following security algorithms: (i) encryption of services between the UE and at least a portion of the network; (ii) decryption of services between the UE and at least a portion of the network; (iii) integrity protection of services between the UE and at least a portion of the network; (iv) verification of integrity protection of services between the UE and at least a portion of the network; send information to the UE indicating the selected security algorithm; and use the selected security algorithm.

[0082] This selection can come from a set of security algorithms, which are predefined in the protocol specification and / or supported by the UE and / or the network. Security algorithms can differ in one or more aspects. For example, they can differ in the key length used for business encryption and / or decryption. They can differ in the cryptographic algorithms used for business encryption and / or decryption (e.g., symmetric or asymmetric). Additionally or alternatively, they can differ in whether and how integrity protection is implemented, such as whether a function is used and, if so, which function. For example, a hash function can transform input data into a fixed-size byte string called a hash value or digest. These functions can be used to perform integrity protection by generating a checksum used to verify the authenticity of the transmitted data. For example, SHA-256 (Secure Hash Algorithm 256-bit) and / or SHA-3 can be used in mobile communication networks to ensure data integrity. Message Authentication Codes (MACs) can combine symmetric key encryption with hash functions to provide both confidentiality and integrity protection. In mobile communication networks, MACs such as HMAC-SHA256 (Hash-based Message Authentication Code using SHA-256) can be used to authenticate control plane messages exchanged between the UE and / or network entities. Additionally or alternatively, security algorithms may differ in whether and how integrity protection is verified, such as how the MAC is checked.

[0083] In various embodiments, the UE may use a security algorithm selected based on the security state adopted, the security algorithm being used for one or more of the following: (i) encryption of services between the UE and at least a portion of the network, (ii) decryption of services between the UE and at least a portion of the network, (iii) integrity protection of services between the UE and at least a portion of the network, and (iv) verification of the integrity protection of services between the UE and at least a portion of the network.

[0084] The UE can be notified of the security algorithm selected by the network entity. Therefore, the UE can use the security algorithm based on the network entity's selection. Alternatively or additionally, the UE is notified of its determined security status, and the UE can determine the security algorithm to use based on the received information.

[0085] In addition to determining the security algorithm to be used based on the UE's security status, alternatively, communication with the UE (e.g., communication to and / or from the UE) can be restricted.

[0086] In some embodiments, a network entity may block at least some communications to and / or from the UE based on a security status determined for the UE.

[0087] For example, a network entity can: Supports security state sets, with security state indicators tailored to different security conditions of the user equipment (UE). The security status for the UE is determined from the security status set based on the security situation detected by the UE. Based on the security status determined for the UE, at least some communications to and / or from the UE are prohibited.

[0088] For example, at least some communications may refer to communications of a defined type, and / or communications with a defined destination and / or a defined source. As a simple example, the network may decide that the UE can communicate with a video platform used for streaming media, but is not permitted to communicate with a government server. A network entity may determine which communications it prohibits based on security status, the UE's security situation, and / or event reports and / or other data regarding the UE's behavior. The network entity may consider external factors, such as the security status of another device. A network entity may prohibit almost all or all communications with the UE, such as all user plane communications, or all user plane and all control plane communications.

[0089] In various embodiments, the security state set includes multiple security states indicating security conditions corresponding to different security levels, and if the determined security state for the UE indicates a security condition corresponding to a lower security level, the network entity may disable more services, and if the determined security state indicates a security condition corresponding to a higher security level, the network entity is configured to disable fewer services.

[0090] At least some of the prohibited communications may be communications associated with a network slice. For example, a network entity may prohibit a UE's communications associated with a network slice based on a security status determined for the UE. A network slice can be understood as a logical network that provides specific network capabilities and characteristics. Communications associated with a network slice may refer to the exchange of signaling and / or user data that can be processed within the framework of a specific network slice instance. Communications associated with such a slice may be subject to slice-specific configurations, resource allocation, and / or quality of service parameters. A network slice may be selected based on subscription information, service type, application characteristics, and / or other criteria related to a given UE or service provider. Such communications may involve the establishment, maintenance, and / or release of sessions or connections that may be restricted to a specified network slice. This may include the selection of access network functions, core network functions, and / or transport paths that can be allocated or dedicated to the selected network slice. Communications may include control plane processes such as registration, authentication, session management, and / or mobility processing; and / or user plane data transmissions that can be routed through network functions and / or interfaces that may belong to a specific network slice. The association between communication and network slices can be indicated by identifiers such as Single Network Slice Selection Assistance Information (S-NSSAI), which can be provided by the UE and / or assigned by the network.

[0091] Additionally or alternatively, at least some of the prohibited communications may be communications associated with a data network name. For example, a network entity may prohibit a UE's data network name-associated communications based on a security status determined for the UE. Data network name-associated communications may refer to the exchange of control plane and / or user plane data that can be linked to a specific data network (such as that identified by a corresponding data network name (DNN)). The DNN can be used as an identifier that enables the selection of a UE and / or its association with a specific packet data network, such as the public internet, private enterprise networks, and / or dedicated service networks. Such communications may involve establishing PDU sessions, which can be configured to route services to and / or from the data network identified by the DNN. The DNN may be sent by the UE during registration and / or session establishment, and / or may be configured by the network based on subscription data and / or policy rules. The network may use the DNN to determine the corresponding network slice, network function instance, and / or routing path required to support the requested service. Communications associated with the DNN can include signaling messages exchanged between the UE and / or network entities (such as access network functions and / or core network functions) for session management, authentication, authorization, policy enforcement, and / or quality of service configuration. It can cover user data transmission between the UE and / or data network via PDU sessions bound to the DNN.

[0092] Prohibition can be implemented in various forms. For example, prohibiting at least some communications can mean that a network entity refuses to forward information that is part of the prohibited communication to or from the UE. A network entity can discard packets of prohibited communication. A network entity can notify the UE and / or another entity communicating with the UE of an error. Prohibition can be implemented indirectly, for example, by instructing and / or configuring another entity (e.g., a network device) to refuse to forward information that is part of the prohibited communication to or from the UE and / or discard packets of prohibited communication.

[0093] In some embodiments, a network entity may receive messages from another network function including service requests for a UE associated with a network slice; and send an error message to the other network function if communication of the UE associated with the network slice is blocked. Additionally or alternatively, a network entity may receive messages from another network function including service requests for a UE associated with a data network name, and send an error message to the other network function if communication of the UE associated with the data network name is blocked.

[0094] In various embodiments, a network entity may receive from the UE a message including a request for session establishment associated with a network slice, and send an error message to the UE if communication associated with the network slice is blocked. Additionally or alternatively, a network entity may receive from the UE a message including a request for session establishment associated with a data network name, and send an error message to the UE if communication associated with the data network name is blocked.

[0095] In some embodiments, error messages may not indicate a reason, but simply indicate that communication failed. Alternatively, error messages may indicate to another network function or UE the reason why a service request could not be fulfilled, for example, because some communication was blocked, or more specifically, why and / or what type of communication was blocked.

[0096] In addition to network entities blocking at least some communications, or alternatively, the UE may block at least some communications based on the security state adopted. The aforementioned actions regarding network entities may be additionally or alternatively performed by the UE based on the security state adopted by the UE.

[0097] For example, according to one embodiment, the UE may support a set of security states that indicate different security conditions; adopt a security state from the set of security states based on the security conditions detected by the UE; and prohibit at least some communications to and / or from the UE based on the adopted security state.

[0098] In some embodiments, the UE may block communications associated with network slices based on the adopted security state. Additionally or alternatively, the UE may block communications associated with data network names based on the adopted security state.

[0099] In some cases, the UE can send an error message to the network to notify the network. In some embodiments, the UE can use an error message to respond to a request to the UE, informing the sender of the request that the UE is not allowed to respond.

[0100] In various embodiments, the security state set may include multiple security states that indicate security conditions corresponding to different security levels. For example, in such an embodiment, if the adopted security state indicates a security condition corresponding to a lower security level, the UE may disable more services, and if the adopted security state indicates a security condition corresponding to a higher security level, the UE is configured to disable fewer services.

[0101] In one embodiment, a user equipment may: Using an unassessed safety status; Operational safety assessment; Based on the results of the security assessment, the unassessed security status is changed to a temporary security status; Send instructions to network entities regarding a change in temporary security status; Obtain information from network entities indicating the security status of the UE; and Adopt the indicated safety status.

[0102] For example, an unassessed security state may be adopted in response to activating the UE. Additionally or alternatively, the UE may adopt an unassessed security state periodically (e.g., monthly) and / or in response to events. For example, the UE may adopt an unassessed security state after a software component change (e.g., software update) and / or a hardware component change (e.g., screen replacement). An unassessed security state can indicate an unknown security status for the UE. In some embodiments, the network entity determines the UE's security state to be unassessed before the network entity and / or the UE have performed a security assessment.

[0103] The user equipment can perform a security assessment (e.g., when it is in an unassessed security state). A security assessment can involve the operations described above. For example, it can involve assessing one or more security parameters, such as generating a hash code based on one or more hardware components and / or one or more software components of the UE, and determining whether the generated hash code matches a hash code stored in the UE.

[0104] Based on the results of a security assessment, the UE can change from an unassessed security state to a provisional security state. In some embodiments, a provisional security state is not a distinct additional security state, but rather one of the security states in a set of security states that is marked as provisional, for example, through relevant information such as a label. A security state can be marked as provisional because it has not yet been confirmed by a network entity. Other criteria are conceivable, such as local security assessments at the UE not being performed by a trusted execution environment.

[0105] For example, if the security assessment results in the UE deeming the security situation secure, a change from an unassessed security state to a temporary secure state can occur. For instance, in the example above comparing the generated hash code and the stored hash code, this could indicate that the two hash codes match. In some embodiments, the change from an unassessed security state to a temporary secure state only occurs given a specific outcome of the security assessment. For another outcome of the security assessment, the UE can change to another temporary security state, such as a temporary monitored security state or a temporary restricted security state.

[0106] The UE can send an indication of a change in temporary security status to a network entity, for example, to request confirmation of the temporary security status. This indication can indicate that a change in temporary security status has occurred (e.g., without indicating a specific temporary security status) and / or indicate the temporary security status to which the UE has changed.

[0107] The network entity can be a security assessment network function, such as one that differs from MM NF, AMF, UDM, and / or AUSF. It may include a security engine. In some embodiments, the security assessment network function (with or without a security engine) is part of MMNF, AMF, UDM, and / or AUSF.

[0108] This instruction can be sent via a mobility network function. For example, a mobility network function (e.g., MM NF and / or SM NF) can receive the instruction and forward it to a security assessment network function.

[0109] In various embodiments, a network entity can: Receive indication from the UE of a change to a temporary security state; The security status of the UE is determined based on at least one of the following: (i) the availability of one or more event reports related to the behavior of the UE, and (ii) the content of one or more event reports; Send information to the UE indicating the determined security status for the UE.

[0110] The determination of the security status of a UE by a network entity has been described previously.

[0111] Information indicating the determined security state for a UE can indicate the determined security state (e.g., in the form of an index). This may happen, for example, when the determined security state differs from the provisional security state.

[0112] Additionally or alternatively, in various embodiments, information indicating the security status of the UE includes: confirmation of the temporary security status of the UE (e.g., in the form of a flag or an index).

[0113] Information indicating the determined security state for a UE can be sent via a mobility network function, such as the same mobility network function used to forward instructions from the UE to a change to a temporary security state.

[0114] The UE can obtain information indicating its security status from network entities and adopt the indicated security status. For example, if it receives confirmation of a temporary security status, it can adopt that security status as a non-temporary security status.

[0115] After the UE has adopted the indicated security state, the process can proceed as described above. For example, a network entity can monitor the UE's security state. In various embodiments, it can acquire event reports (or any number of event reports) related to the UE's behavior, determine a change in the determined security state for the UE based on the acquired event reports, and send an indication of the change in security state to the UE. The UE can acquire the indication of the change in its security state and execute the change in the adopted security state according to the acquired indication.

[0116] In various embodiments, the adopted / determined security state can be used for the purposes described above, such as for selecting security algorithms and / or for disabling at least some communications. The role of the temporary security state in this regard can vary depending on the embodiment. For example, in some embodiments, the UE and / or network may behave as if the temporary security state it adopts has been confirmed by the network. In other embodiments, the UE and / or network will ignore the temporary security state and behave as if the UE is still in an unassessed security state or an insecure security state. In yet another embodiment, the process followed by the UE and / or network when adopting a temporary security state may depend on the last confirmed security state for the UE or the history of confirmed security states for the UE. More complex processes can be envisioned, where only parts of the process are modified for the temporary state compared to the non-temporary state, and / or other aspects are considered to determine how to proceed under the temporary security state.

[0117] As mentioned earlier, security algorithms can be selected based on the security status of the UE.

[0118] According to one embodiment, a network entity (e.g., a security assessment NF) can: Determine the security status for the UE; Determine a security assessment report for the UE, which includes information about the security status of the UE; Provide (e.g., to SM NF / MM NF) a security assessment report to select a security algorithm based on the security assessment report, the security algorithm being used for one or more of the following: (i) encryption of services between the UE and at least a portion of the network, (ii) decryption of services between the UE and at least a portion of the network, (iii) integrity protection of services between the UE and at least a portion of the network, and (iv) verification of integrity protection of services between the UE and at least a portion of the network.

[0119] Network entities can be, include, or carry security assessment NFs (Sec NFs). For example, determining the security status of a UE and / or determining a security assessment report for a UE can be included in a security assessment network function. Network entities and / or security assessment NFs can serve as or include a security engine for performing operations related to the security status of the UE.

[0120] In various embodiments, the network entity may determine the security level for the UE. In various embodiments, the security assessment report may also include information regarding the security level for the UE.

[0121] Security level can be understood as a quantitative or qualitative measure of security, indicating the degree of protection deployed (or to be deployed). Security status can indicate the current condition or state at a given point in time.

[0122] The security level for a UE can be determined based on one or more of the following: (i) Information about the UE's radio capabilities from the UE Radio Capability Management Function (UCMF) network function; (ii) Information about one or more hardware components of the UE; (iii) Information about one or more software components of the UE.

[0123] For example, a network entity (e.g., a Sec NF) can retrieve information about one or more UE radio capabilities from a UCMF (UE Radio Capability Management Function) NF. This can include UE radio capabilities. For instance, when the Sec NF retrieves UE radio capabilities from the UCMF NF, this can involve obtaining information about the communication capabilities and characteristics of the user equipment (UE). This can be achieved by providing insights into various aspects related to the UE's hardware, software, and / or operating parameters, enabling security assessments. The UE radio capability data retrieved from the UCMF NF can include, but is not limited to: 1. Hardware information: For example, specific details about the UE's wireless hardware components, such as the type of transceiver module, antenna configuration, and / or other relevant specifications that affect its communication performance. 2. Software Information: For example, details about the firmware version, supported protocols, and / or any software patches and / or updates installed on the UE. This information can help assess whether the UE is running a trusted and / or secure software configuration. 3. Operating parameters: For example, parameters related to the UE's operating mode, such as maximum data rate, supported frequency bands, and / or power management settings.

[0124] By accessing the UE's radio capability set, Sec NF can perform assessments to determine the degree of security a particular UE operates within the network. This assessment may include evaluating whether the UE's hardware and software meet established security standards and / or whether any vulnerabilities or anomalies may compromise its security posture.

[0125] Additionally or alternatively, network entities may determine information about one or more hardware components and / or one or more software components of the UE based on a Type Assignment Code (TAC). For example, the network can identify various features and capabilities of the UE, such as a specific model, manufacturer, and / or version, by extracting relevant information from the TAC. This code may be a unique identifier specifying a range of IMEI numbers assigned to a particular UE model. The TAC may be sent during the initial registration process and / or other communication exchanges between the UE and the network entity. It enables the network to access the hardware and / or software profiles associated with the UE. By analyzing the TAC, the network can retrieve information such as the UE's supported frequency bands, radio capabilities, and / or firmware versions.

[0126] A network entity (e.g., a Sec NF) may provide a security assessment report in response to a received request for such a report. This request may be received from another network entity, such as an MM NF / SM NF. For example, during PDU session establishment and / or UE registration, other network functions may submit a request for a security assessment report to the Sec NF. The Sec NF may then generate a security assessment report based on available data, and / or request data from other entities, and generate the report based on the received response.

[0127] Additionally or alternatively, a network entity (e.g., a Sec NF) may monitor the security level and / or security status for the UE. It may detect changes in the security level for the UE. A security assessment report may indicate such changes. The network entity may provide a security assessment report in response to detecting a change in the security level for the UE.

[0128] Therefore, network entities (e.g., Sec NF) can support the passive provision of security assessment reports and / or the proactive provision of security assessment reports.

[0129] According to one embodiment, a network entity (e.g., SM NF / MM NF) can: Obtain a security assessment report for the user equipment (UE), which includes information about the security status of the UE. Based on the security assessment report, select one or more of the following security algorithms: (i) encryption of services between the UE and at least a part of the network, (ii) decryption of services between the UE and at least a part of the network, (iii) integrity protection of services between the UE and at least a part of the network, and (iv) verification of integrity protection of services between the UE and at least a part of the network. Send information to the UE indicating the selected security algorithm.

[0130] In various embodiments, the network entity is one or more of the following: (i) Session Management Function (SMF) network function. The SMF network function can be a module within a mobile communication network that manages and / or controls data sessions between a User Equipment (UE) and network entities. This function can monitor the establishment, modification, and / or release of these sessions. The SMF network function can interact with other network functions, such as Mobility Management Function (MM NF), Access and Mobility Management Function (AMF), User Plane Function (UPF), and / or Policy Control Function (PCF). (ii) Mobility Management (MM) Network Function. A Mobility Management (MM) network function can be a component within a mobile communication network responsible for managing the mobility and / or connectivity of User Equipment (UE) across different access technologies and / or networks. This function can handle tasks related to UE registration, authentication, tracking area updates, and / or handover processes between various network nodes such as base stations. The Mobility Management (MM) network function can interact with other network functions, including the Authentication Server Function (AUSF), User Data Management Function (UDM), or Session Management Function Network Function (SMF NF). It can also support security measures to ensure that the UE identity is authenticated and / or protected during movement across different network domains. (iii) User Plane UP Network Functions. User plane network functions can be elements within a mobile communication network responsible for handling (user) data services between the UE and an external packet data network (PDN). This function can manage the transmission, routing, and / or delivery of user data packets. It can interact with other network functions, such as Session Management Function Network Function (SMF NF), Access Mobility Management Function (AMF), or Network Open Function (NEF). User plane network functions can employ encryption mechanisms, for example, to protect data confidentiality during transmissions over the air interface and / or core network.

[0131] Network entities (e.g., SM NF / MM NF) may support receiving security assessment reports in response to a request and / or without prior request.

[0132] For example, a network entity (e.g., SM NF / MM NF) can: Receive information from the UE, including requests for session establishment or registration. In response to receiving information from the UE, including requests for session establishment or registration, the security assessment report is retrieved.

[0133] Retrieving a security assessment report may include sending a request to another network function (e.g., Sec NF) and receiving the security assessment report in response.

[0134] In various embodiments, the request for session establishment is a PDU session establishment request. The PDU session establishment request can be a signaling message initiated by the UE to establish a Protocol Data Unit (PDU) session within the mobile communication network. This request may contain various parameters and / or information elements that specify desired characteristics of the data connection, including, for example, the requested QoS level, network slice selection assistance information, session and service continuity (SSC) mode preferences, and / or security requirements. The PDU session establishment request can be sent to the Access Mobility Management Function (AMF) or a similar entity responsible for mobility management. It can trigger a series of procedures involving other network functions such as the Session Management Function Network Function (SMF NF), User Plane Function (UPF), Policy Control Function (PCF), and / or Authentication Server Function (AUSF). These procedures may be designed to authenticate the UE, allocate resources, configure session parameters, and / or establish a secure communication channel for data transmission.

[0135] Additionally or alternatively, in various embodiments, in response to a network function detecting a change in the security level for the UE, a network entity can obtain a security assessment report for the UE from the network function, wherein the security assessment report indicates the change in the security level for the UE. For example, the security assessment report may be received independently of the PDU session establishment request and / or during the establishment of the PDU session.

[0136] Information indicating the selected security algorithm sent to the UE can be sent as part of a security mode command. This information indicating the security algorithm can be included in the security mode command. The security mode command can be a control message sent by a network entity to a user equipment (UE) within the mobile communication network to initiate and / or modify secure communication parameters of an established radio link. This command can instruct the UE to apply specific cryptographic algorithms, encryption keys, integrity protection mechanisms, and / or other security configurations. The security mode command can be issued at various stages of the communication process, such as initial registration, handover procedures, and / or when a change in security requirements is detected. It ensures that subsequent data exchange between the network and the UE is protected according to a predefined security policy.

[0137] According to one embodiment, a UE can: Adopt a safe state; The UE evaluation report is determined, and the UE evaluation report includes information about the security status adopted; Send information to network entities (such as SM NF and / or MM NF) including requests for session establishment or registration, including UE evaluation reports; Receive information indicating the security algorithm selected based on the UE evaluation report, the security algorithm being used for one or more of the following: (i) encryption of services between the UE and at least a portion of the network, (ii) decryption of services between the UE and at least a portion of the network, (iii) integrity protection of services between the UE and at least a portion of the network, and (iv) verification of the integrity protection of services between the UE and at least a portion of the network. Use the indicated security algorithm.

[0138] In various embodiments, the request for session establishment can be a PDU session establishment request, as described above.

[0139] UE assessment reports may also include one or more of the following: (i) Information regarding the UE's permanent device identifier. A permanent device identifier can be defined as, for example, a unique code assigned to a user equipment (UE) by its manufacturer. It can remain unchanged throughout its lifecycle. This identifier can be used as a unique identifier for the UE, enabling network entities to consistently identify and / or authenticate the device across different networks and / or communication sessions. Examples of permanent device identifiers include IMEI and TAC. One or more of these codes can be stored in non-volatile memory within the UE. (ii) Information about one or more hardware components of the UE; (iii) Information about one or more software components of the UE.

[0140] This information may include a list of hardware and / or software versions.

[0141] While in some embodiments and under certain circumstances, the UE may provide its "UE evaluation report," the UE may not be entirely trustworthy. Therefore, when a network entity receives a UE evaluation report, it may not fully trust it. Consequently, the network entity may retrieve a security evaluation report prepared by another network entity. This security evaluation report can be fully trusted because it was generated by the network. The UE evaluation report can be used as a factor in determining whether to trust the UE and / or whether the network prepared the security evaluation report.

[0142] Using the indicated security algorithm can indicate that the UE encrypts, decrypts, protects the integrity of services, and / or verifies the integrity of services in accordance with the indicated security algorithm.

[0143] In various embodiments, the security algorithm is valid for sessions established in response to a request for session establishment. This can be interpreted as a rule that the security algorithm is valid for a session (e.g., a PDU) unless reconfigured before the session ends. This can also be understood as meaning that the security algorithm is valid for multiple sessions, but the selection of the security algorithm is re-evaluated, for example, at least once per session, such as at the start of the session.

[0144] It should be understood that the presentation in this section is for illustrative purposes only and not as a limitation. Each of the steps described above may occur after or in response to another step (e.g., the previous step). However, different order of steps is also possible.

[0145] Other features will become clear from the following detailed description taken in conjunction with the accompanying drawings. However, it should be understood that the drawings are for illustrative purposes only and are not intended to limit the scope, which should be referenced to the appended claims. It should be further understood that the drawings are not drawn to scale and are intended only to conceptually illustrate the structures and processes described herein. Attached Figure Description

[0146] The attached image is as follows:

[0147] Figure 1 It is an example system that includes UEs and network entities;

[0148] Figure 2 This is an example set of security states;

[0149] Figure 3 This is an example system with security-related modules in the UE and network entities;

[0150] Figure 4 This is a flowchart illustrating an example embodiment of a method according to the first aspect, such as a method performed by a UE;

[0151] Figure 5 This is a flowchart illustrating an example embodiment of a method according to the first aspect, such as a method performed by a network entity;

[0152] Figure 6 This is a flowchart illustrating an example embodiment of a method according to the second aspect, such as a method performed by a UE;

[0153] Figure 7 This is a flowchart illustrating an example embodiment of a method according to the second aspect, such as a method performed by a network entity;

[0154] Figure 8 These are example message sequences according to embodiments of the second aspect;

[0155] Figure 9 This is a flowchart illustrating a sequence of actions according to an embodiment of the second aspect;

[0156] Figure 10 This is a flowchart illustrating an example embodiment of a method according to the third aspect, such as a method performed by a UE;

[0157] Figure 11 This is a flowchart illustrating an example embodiment of a method according to a third aspect, such as a method performed by a network entity;

[0158] Figure 12 This is a flowchart illustrating an example embodiment of a method according to the third aspect, such as a method performed by a network entity's SecNF;

[0159] Figure 13 These are example message sequences according to embodiments of the third aspect;

[0160] Figure 14 These are example message sequences according to embodiments of the third aspect;

[0161] Figure 15This is a flowchart illustrating an example embodiment of a method according to the fourth aspect, such as a method performed by a UE;

[0162] Figure 16 This is a flowchart illustrating an example embodiment of a method according to the fourth aspect, such as a method performed by a network entity;

[0163] Figure 17 This is an example message sequence according to another embodiment of the fourth aspect; and

[0164] Figure 18 This is a schematic block diagram of an apparatus according to an embodiment. Detailed Implementation

[0165] The following description is intended to enhance understanding and should be understood as supplementing and reading in conjunction with the description provided in the foregoing summary section of this specification. Some aspects may have different terminology than, for example, that is provided in the foregoing description. However, those skilled in the art will understand that these terms refer to the same subject matter, for example, by being more specific.

[0166] Figure 1 An example system 100 including UE 1 and network entity 2 is shown.

[0167] UE 1 can be any device used to access and / or communicate within a mobile communication network. Examples include smartphones, tablets, IoT devices, or other wireless-enabled endpoints. UE 1 can support various communication technologies such as LTE, 5G, 6G, and / or Wi-Fi, enabling connectivity across different network environments. The device can interact with one or more network entities to access services including voice calls, data sessions, messaging, and / or multimedia applications. UE 1 may include a wireless transceiver module for transmitting and / or receiving signals via one or more access technologies, a baseband processing unit capable of performing modulation, demodulation, encoding, decoding, and / or protocol stack processing, and / or a SIM or UICC capable of storing subscriber credentials and / or network configuration data. UE also includes an application processor for executing software and / or user applications, a power management component for regulating power consumption, and / or an antenna system for signal propagation and / or reception. Depending on the device type and / or use case, other elements may include a memory module, user interface components, and / or sensors.

[0168] Network entity 2 can be any component, functional element, or functional subsystem (e.g., a combination of functional modules such as several network functions) within the mobile communication network that can participate in providing services to UE 1 and / or maintaining network security. Network entity 2 may include one or more hardware devices, software modules, or combinations thereof, which can interact with each other and / or with the UE to facilitate secure communication. For example, examples of network entities may include one or more functions such as Mobility Management Network Function (MM NF), Authentication Server Function (AUSF), Session Management Function Network Function (SMF NF), and Security Assessment Network Function (Sec NF). These entities can communicate with the UE to authenticate its identity, manage cryptographic keys, perform access control, monitor security events, and / or perform operations related to the UE's security status. In some embodiments, network entity 2 may be a base station or include a base station.

[0169] For example, UE 1 and network entity 2 communicate via radio link 3.

[0170] Radio Link 3 can be a wireless communication channel established between UE 1 and network entities such as base stations within the mobile communication network. This Radio Link 3 allows data packet transmission via the air interface, thereby enabling voice, messaging, and / or multimedia services. Radio Link 3 may include one or more parameters, including frequency band, modulation scheme, coding rate, and / or power level, to enable communication sessions between the UE and network entities. The establishment, maintenance, and / or termination of Radio Link 3 can be defined through protocol mechanisms.

[0171] UE 1, network entity 2, and radio link 3 may be part of mobile communication network 100. Mobile communication network 100 may be an infrastructure enabling wireless connectivity and / or data transmission between user equipment (UE) and various services over a geographical area. The network may include multiple components such as a radio access network, core network, and transport layer. These components facilitate communication sessions. Network 100 may support or operate according to one or more of a variety of technologies, such as LTE, 5G, and / or future generations (6G), and / or enable Wi-Fi connectivity for purposes such as voice calls, messaging, data exchange, multimedia applications, and / or IoT services. The mobile communication network may utilize various protocols, frequencies, and / or modulation schemes to manage bandwidth allocation, ensure secure transmission, handle user mobility, and maintain Quality of Service (QoS) levels.

[0172] Whether a UE can access network services can be determined through one or more authentication and authorization processes. These processes may involve the exchange of credentials between the UE and / or network entities such as the Authentication Server Function (AUSF) and the Access and Mobility Management Function (AMF). The UE may present its permanent International Mobile Equipment Identity (e.g., IMEI) and / or subscription information during initial registration to facilitate verification by the network.

[0173] Secure communication sessions can be established using cryptographic key management processes. For example, protocols such as Authentication and Key Agreement (AKA) can generate session keys for encrypting data services and / or protecting signaling messages. These mechanisms help ensure that only authorized UEs can access specific services and / or resources within the network based on predefined policies and / or user profiles.

[0174] However, in principle, these mechanisms only authenticate the UE once at a given moment. Afterward, another authentication may not be performed for a considerable period, such as a month. Therefore, the network may be unable to track the UE's actions, the context or history of user or interaction, or the (current) security status of the UE. This can lead to several drawbacks, such as difficulty in detecting and / or preventing attack patterns, a lack of security awareness within the UE, and / or difficulty in recovering from compromised UEs.

[0175] To improve one or more of these aspects, different types of UE security states can be used at both the UE and the network (NW). The UE or NW can change the UE security state based on security assessments. The UE security state can be used to generate one or more key performance indicators (KPIs) to select security algorithms for the UE. Additionally or alternatively, the UE security state can be used to determine whether to allow the initiation and / or termination of services at the UE.

[0176] Generating KPIs for selecting a security algorithm for the UE using the UE's security state can include associating different UE security states with different KPI values. The selection of a security algorithm for the UE can be based on KPI values ​​derived from the UE's current security state. KPI values ​​can reflect target values ​​that should be met after the security algorithm selection. Additionally or alternatively, KPI values ​​can reflect values ​​already observed for the UE in a specific security state.

[0177] According to the first example, a KPI could be authentication time (e.g., in milliseconds) used to measure the time spent authenticating a UE. Different security states can be associated with different authentication times. According to the second example, packet loss (e.g., as a percentage) could be a KPI. It can be used to assess data integrity and / or reliability under various security mechanisms. According to the third example, re-authentication frequency (e.g., per session / hour) could be a KPI. It can be used to determine how often a UE needs to be re-authenticated. Frequent re-authentication can impact user experience. According to another example, throughput (e.g., in Mbps) could be a KPI. It can be used to measure data transmission rates when using different security algorithms. According to yet another example, handover latency could be a KPI. It can measure the time spent securely transmitting a UE between base stations during handover.

[0178] Figure 2 An example security state set 200 is shown. For example, security state set 200 consists of the following security states and their attributes: • UE Security Security State (USS State) 201: The UE is (e.g., fully) protected and / or the vulnerability has not been detected. In some embodiments, this means that a positive security check is implemented in the UE and a standard security check is performed in the network function (e.g., Network Data Analysis Function (NWDAF)). • UE Security Monitoring Status (UMS Status) 202: The UE is in an active observation / monitoring state due to the detection of a potential threat. This allows for analysis of network traffic and / or system behavior, for example, targeting abnormal patterns. • UE Restricted Security State (URS State) 203: The UE currently has only restricted services because a primary threat has been detected. In some embodiments, this means that some functions are disabled. • UE compromised / unsecured security status (UCS status) 204: UE compromised and / or unauthorized access has occurred. • UE Security Status Unassessed (UNS Status) 205: The security of the UE has not been verified / assessed.

[0179] The UE and / or network can support a set of 200 security states. This means that the UE and network can adopt each security state of the UE if a given condition is met. Based on these states stored in the UE and network, the UE and / or network can take certain actions for different operations. For example, if the UE's state is insecure, the UE / network can disable certain features of the UE, such as SMS, Slice, etc.

[0180] It should be understood that the security state set 200 is merely an example embodiment. In other embodiments, there are fewer or more security states 200. Such an alternative security state set 200 may include one or more of the example security states described above and / or other security states.

[0181] In some embodiments, one or more security states in set 200 may change. For example, the UE may have temporary and non-temporary security states. Other changes are also conceivable.

[0182] The security state set 200 supported by the UE and / or the network for the UE may be predefined, for example in the protocol specification, and / or configurable at the UE and / or the network, and / or depend on, for example, the capabilities of the UE.

[0183] Figure 3 An example system with security-related modules is shown, including UE 1 and network entity MM NF 4 and security assessment NF 5 (also known as Sec NF).

[0184] UE 1 can be configured to communicate with AMF / MM NF 4 via link 6. Link 6 can be at least partially radio.

[0185] As shown in the figure, as an example, UE 1 includes SEC module 10. Security module 10 may be a trusted execution environment, may include a trusted execution environment, or may be included in a trusted execution environment. It may be a dedicated module for operations related to the security state of UE 1. For example, it may be used to run security assessments to determine the security status and / or security condition of UE 1. In some embodiments, it may also run other functions, particularly security-related functions. Security module 10 may allow the separation of security-related functions from other functions of UE 1. This may make manipulating security-related functions more difficult.

[0186] For example, the AMF (Access and Mobility Management Function) / MM NF (Network Function) 4 can have a separate SEC module 40. The security module 40 can be a dedicated module for operations related to security status, such as the security status of UE 1. For example, it can receive information about the security status of UE 1 and / or determine security algorithms used for encrypting, decrypting, protecting integrity, and / or verifying integrity protection for services with UE 1. The security module 40 can be used to determine whether certain communications with UE 1 should be blocked. In some embodiments, it can also run other functions, particularly security-related functions. The security module 40 can allow security-related functions to be separated from other functions of the AMF / MM NF 4. This may make manipulating security-related functions more difficult.

[0187] AMF / MM NF 4 can be configured to communicate with Security Assessment NF 5, for example, to retrieve security assessment reports from Security Assessment NF 5. Security Assessment NF 5 may have a separate SEC engine 50 running. In some embodiments, security assessment can be a function that can be hosted in other security NFs, such as AUSF (Authentication Server Function) or UDM (Unified Data Management) or a dedicated (e.g., new) security assessment NF (network function). Security Engine 50 can be a dedicated module for assessing the security status of the UE and / or for determining the security state of the UE. For example, it can receive and / or retrieve information about parameters and / or event reports related to UE 1. It can assess the parameters and / or event reports and determine the security state of UE 1. In some embodiments, it can also run other functions, particularly security-related functions. Security Engine 50 can allow security-related functions to be separated from other functions of Security Assessment NF 5 (or, if Security Engine 50 is included in another network function, from other functions of that other network function). This may make manipulating security-related functions more difficult.

[0188] The following describes an example related to the state change process.

[0189] Figure 4 This is a flowchart illustrating a method 400 according to an example embodiment of the first aspect, such as method 400 performed by a UE.

[0190] The method may include one or more of the following:

[0191] 401: Supports security state sets, where security states indicate different security conditions;

[0192] 402: The security state from the security state set is adopted based on the security situation detected by the UE;

[0193] 403: When a change in the security status of the UE is detected, the security status adopted is dynamically changed to another security status in the security status set.

[0194] Any one or each of operations 401, 402, and 403 can be run partially or fully in the Trusted Execution Environment / Security Module 10 of UE 1.

[0195] Operation 403 can run continuously, for example, until the UE is turned off or, for example, reconfigured by the network.

[0196] Figure 5 This is a flowchart illustrating a method 500 according to an example embodiment of the first aspect, such as a method performed by a network entity.

[0197] The method may include one or more of the following:

[0198] 501: Supports security state sets, where security state indicators are tailored to different security conditions of the User Equipment (UE).

[0199] 502: Determine the security status for the UE from the security status set based on the security status detected by the UE;

[0200] 503: When a change in the security status of the UE is detected, the determined security status of the UE will be dynamically changed to another security status of the UE in the security status set.

[0201] One or more of operations 501, 502, and 503 can be performed in a single network function (e.g., the security assessment NF) or multiple network functions. For example, the network entity performing method 500 may include AMF / MM NF 4 and security assessment network function 5. They can perform method 500 together. For example, security assessment network function 5 may be responsible for operations 502 and / or 503. Any one or more operations can be performed in security engine 50 or security module 40.

[0202] Operation 503 can run continuously, for example, until the UE is turned off or, for example, reconfigured by the network.

[0203] Method 500 can be run by a network entity for multiple UEs. For example, there can be three UEs. The network entity can support a set of security states for each of the multiple UEs, determine a security state for each UE, and dynamically change the determined security state when a change in the security status of the corresponding UE is detected.

[0204] Hereinafter, an example embodiment according to the second aspect will be described. For example, this embodiment may be applicable after the UE is powered on.

[0205] Figure 6 This is a flowchart illustrating a method 600 according to an example embodiment of the second aspect, such as method 600 performed by a UE.

[0206] Method 600 may include one or more of the following:

[0207] 601: Adopting an unassessed safety status;

[0208] 602: Operational safety assessment;

[0209] 603: Based on the results of the security assessment, the unassessed security status is changed to a temporary security status;

[0210] 604: Sends an instruction to a network entity regarding a change in its temporary security status;

[0211] 605: Obtain information from a network entity indicating the security status of the UE; and

[0212] 606: Adopt the indicated safety status.

[0213] Any one or each of operations 601 to 606 can be run partially or fully in the Trusted Execution Environment / Security Module 10 of UE 1.

[0214] Figure 7 This is a flowchart illustrating a method 700 according to an example embodiment of the second aspect, such as a method performed by a network entity.

[0215] Method 700 may include one or more of the following:

[0216] 701: Receive instruction from the UE regarding a change to a temporary security state;

[0217] 702: Determine the security status of the UE based on at least one of the following: (i) the availability of one or more event reports related to the behavior of the UE, and (ii) the content of one or more event reports;

[0218] 703: Send information to the UE indicating the determined security status of the UE.

[0219] Any one or more of operations 701 to 703 can be run in security engine 50 or security module 40.

[0220] Figure 8 An example message sequence 800 according to an embodiment of the second aspect is shown. Although Figure 6 and Figure 7 The text shows what operations can be performed by the UE and the network, but message sequence 800 illustrates an example of how UE 1 and one or more network entities (e.g., MM NF 4, Sec NF 5, UDM 6) can work together.

[0221] Network entities may be, or include, a security assessment NF (Sec NF) 5. In some embodiments, network entities may additionally include, for example, an AMF / MM NF 4 and / or a UDM 6.

[0222] In 801, registration and authentication can be performed. The registration and authentication process of UE 1 with the network can involve several steps to establish a secure communication session. This process can begin when UE 1 sends a registration request message containing its permanent device identifiers (such as IMEI and / or IMSI). AMF / MM NF 4 can receive this request. It can initiate an authentication process, for example, by interacting with AUSF. AUSF can, for example, use a predefined algorithm to verify UE 1's credentials. This ensures that UE 1 is authorized to access network services. After successful authentication, AUSF can generate session keys. These can be used to protect subsequent communications between the UE and / or various network functions. These keys can encrypt user data and / or implement integrity protection for signaling messages to ensure secure transmission over the air interface. User Data Management (UDM) functions can be involved to manage subscriber profiles and / or update related information. UDM can store UE-specific configuration settings, such as QoS parameters, security policies, and / or access permissions. These settings can help ensure that the network allocates resources appropriately.

[0223] In 802, an example procedure is shown where UE 1 reports a temporary state and how the network re-examines the change and confirms it with UE 1. This is an example of a state change procedure initiated by the UE. The procedure may include the following operations:

[0224] When UE 1 registers with the network, UE 1 can assess security itself and determine a temporary security state. In this example, UE 1 claims to be in a secure state based on its own assessment. In some embodiments, this may be referred to as a temporary secure state.

[0225] For example, in 803, UE 1 is in an unassessed security state. This is an example of operation 601 in method 600.

[0226] In step 805, the UE evaluates one or more security parameters and moves to a temporary (e.g., secure) security state. This is an example of operations 602 and 603 in method 600.

[0227] To enable UE 1 to determine this, in some embodiments, UE 1 may perform the evaluation as follows: UE 1 may run an algorithm in a trusted execution environment to determine whether the associated hardware, software, and / or associated versions match stored hash codes in UE 1, for example, by comparing hash codes generated based on a list with the stored hash codes. The UE vendor (or other trusted entity) may provide a list of hardware and / or software, along with, for example, associated versions and their hash codes, and store this in the trusted execution environment. In some embodiments, updates to the list and / or hash codes may be performed via over-the-air (OTA), for example, by the operator.

[0228] UE 1 can notify the network of the change in temporary (e.g., secure) security states 806 and 807. For example, UE 1 can send a temporary state indication to the network. This is an example of operation 604 in method 600 and operation 701 in method 700.

[0229] The network (especially the security assessment function 5) can (e.g., independently of UE 1) determine that UE 1 is in an unassessed security state 804.

[0230] Subsequently (for example, when UE 1 reports a UE state change to a temporary secure state in 807), the network can evaluate one or more of the reported events and, if everything is normal, move it to a secure state 808. For example, the following can be checked: - If any events reported by UE 1 are inconsistent with UE behavior. - NWDAF reports UE 1's misconduct. - Configuration from carriers / OAM, etc.

[0231] If any event report is examined and indicates that UE 1 is behaving abnormally, the security assessment NF 5 can set the UE security status to, for example, monitored or restricted, and send 809 or 810 responses to UE 1 accordingly.

[0232] For example, if no event report indicates that UE 1 is behaving abnormally, the security assessment NF can set the UE security state to "secure" and send 809 and 810 responses to UE 1 accordingly.

[0233] The above evaluation is an example of operation 702 of method 700.

[0234] As described above, security assessments can be triggered by UE 1 at UE 1 and / or at the network. However, additional or alternative triggering conditions may exist: AMF / MM NF 4 can initiate security operations in UE 1 and / or SEC NF 5. In this case, SEC NF 5 can run security procedures in parallel with UE 1. For example, UE 1 can run stack overflow checks, heap overflows, use-after-free, integer overflows or underflows, privilege escalation, command injection, and / or data leakage, which coordinate with network element MM NF 4 (e.g., excessive reading from UE memory when sending a corrupted SIB can lead to some information being leaked back to the network) and SEC NF 5, for example, to obtain reports of other UE misconduct.

[0235] After evaluation, Secure NF 5 can store the security state of UE 1 in the network.

[0236] In steps 809 and 810, the secure NF 5 can report the UE state determined by the network to UE 1. Based on the evaluation results, this can be a message including the following information: State change: confirmed secure state. Steps 809 and 810 are examples of operation 703 in method 700 and operation 605 in method 600.

[0237] In step 811, the UE can set its security state according to the received instruction. For example, if it is confirmed in steps 809 and 810 that information regarding a temporary security state has been conveyed, UE 1 can set its security state to a secure state. UE 1 can store the indicated security state. This is an example of operation 606 in method 600.

[0238] The above describes a state change procedure 802 that can be initiated by the UE. Now, regarding 812, an example procedure for a network-initiated trigger to change the security state is shown. The network-initiated procedure 812 can be executed, for example, after the UE-initiated procedure 802. However, it should be understood that procedure 812 can also be executed without the UE-initiated procedure 802. The network-initiated procedure 812 may include the following operations:

[0239] Events can be reported to the network, and the network can move the UE's security state (813).

[0240] If the network determines that a change in UE state is necessary due to, for example, any UE event, NWDAF report, or OAM change, or any combination thereof, the security NF can send the changed UE state (814, 815) to UE 1, and UE 1 can update its security state accordingly. For example, 814, 815 may include information instructing the UE to change to a monitored security state.

[0241] Figure 9 This is a flowchart illustrating an action sequence 900 according to an embodiment of the second aspect. It shows actions performed by UE 1 (e.g., 901, 902, 903, 905, 906, 907, 908) and actions performed by the network (e.g., 904). For example, the flowchart includes the following operations:

[0242] 901: The UE is in an unassessed security state.

[0243] 902: The UE performs a check (e.g., runs a security assessment using its trusted execution environment) and moves to a temporary (e.g., secure) security state (e.g., depending on the results of the check).

[0244] 903: The UE requests network confirmation of the temporary state. (In some embodiments, for example, under certain circumstances, the UE may be unable to request confirmation from the network. Then, for example, the UE may return to the unevaluated security state 901. Alternatively, if the UE cannot request confirmation from the network (or decides not to for some reason), it may remain in the temporary state, for example, until it can request confirmation from the network.)

[0245] 904: The network performs a check (e.g., in the security engine) and moves the temporary state to a permanent state (e.g., by confirming the temporary state or by indicating a different state that the UE must adopt).

[0246] 905: The UE processes a response, which may be, for example, a positive response (e.g., an acknowledgment) or another response (e.g., a security state different from the indicated temporary state).

[0247] 908: If the response is positive, the UE can adopt, for example, a secure state.

[0248] If the response is negative, the UE can, for example, adopt UE monitoring state 906, or the UE can adopt UE restricted security state 907.

[0249] The following describes embodiments related to the selection of security algorithms based on UE state and / or security level.

[0250] Figure 10 This is a flowchart illustrating a method 1000 according to an example embodiment of a third aspect, such as method 1000 performed by a UE.

[0251] For example, method 1000 includes one or more of the following:

[0252] 1001: Safe mode is in operation;

[0253] 1002: Determine the UE evaluation report, which includes information about the security posture adopted;

[0254] 1003: Send information to network entities, including requests for session establishment or registration, such information including UE assessment reports;

[0255] 1004: Receive information indicating a security algorithm selected based on a UE evaluation report, the security algorithm being used for one or more of the following: (i) encryption of services between the UE and at least a portion of the network, (ii) decryption of services between the UE and at least a portion of the network, (iii) integrity protection of services between the UE and at least a portion of the network, (iv) verification of integrity protection of services between the UE and at least a portion of the network.

[0256] 1005: Use the indicated security algorithm.

[0257] Any one or each of operations 1001 to 1005 can be run partially or fully in the Trusted Execution Environment / Security Module 10 of UE 1.

[0258] Figure 11 This is a flowchart illustrating a method 1100 according to an example embodiment of the third aspect. The method can be performed by a network entity, such as an SM NF / MM NF.

[0259] For example, method 1100 includes one or more of the following:

[0260] 1101: Obtain a security assessment report for the User Equipment (UE), which includes information about the security status of the UE;

[0261] 1102: Select a security algorithm based on the security assessment report for one or more of the following: (i) encryption of services between the UE and at least a portion of the network, (ii) decryption of services between the UE and at least a portion of the network, (iii) integrity protection of services between the UE and at least a portion of the network, and (iv) verification of integrity protection of services between the UE and at least a portion of the network.

[0262] 1103: Send information to the UE indicating the selected security algorithm.

[0263] Any one or more of operations 1101 to 1103 can be run in security engine 50 or security module 40.

[0264] Figure 12 This is a flowchart illustrating a method 1200 according to an example embodiment of the third aspect. The method can be performed by a network entity, such as a security assessment NF.

[0265] Method 1200 may include one or more of the following:

[0266] 1201: Determine the security status for the User Equipment (UE);

[0267] 1202: Determine the security assessment report for the UE, which includes information about the security status of the UE;

[0268] 1203: Provide a security assessment report to select a security algorithm based on the security assessment report, the security algorithm being used for one or more of the following: (i) encryption of services between the UE and at least a portion of the network, (ii) decryption of services between the UE and at least a portion of the network, (iii) integrity protection of services between the UE and at least a portion of the network, and (iv) verification of integrity protection of services between the UE and at least a portion of the network.

[0269] Any one or more of operations 1201 to 1203 can be run in security engine 50 or security module 40.

[0270] Figures 10 to 12 The method relates to an example embodiment according to the third aspect, which can be performed by different entities in the network, such as a UE, an SM NF / MM NF, and a security assessment NF. Reference is made below. Figure 13 and Figure 14 The document illustrates two embodiments of the third aspect, demonstrating how different entities can work together.

[0271] Figure 13 An example message sequence 1300 according to an embodiment of the third aspect is shown. It illustrates the actions and messages between UE 1, SM NF / MM NF 4, UP NF 7 and Sec NF 5.

[0272] Message sequence 1300 relates to a dynamic information-based method 1301. For example, this dynamic information-based method is initiated by the UE. It may include the following:

[0273] 1302: UE 1 can send a PDU session EST request / registration request (including, for example, UE evaluation report, UE status) to SM NF / MM NF 4. This is an example of action 1003 of method 1000. UE 1 may have already performed actions 1001 and 1002.

[0274] 1303: SM NF / MM NF 4 can retrieve the current SEC assessment report from Sec NF 5. This is an example of action 1101 of method 1100 and action 1203 of method 1200. At this point, Sec NF 5 may have already executed actions 1201 and 1202.

[0275] 1304: AMF / SMF can select different encryption / integrity protection algorithms for each of multiple PDU sessions or NAS based on the Sec NF evaluation report. This is an example of action 1102 of method 1100.

[0276] 1305: SMC can be run to change the security algorithm. This can involve, for example, SM NF / MM NF 4, UP NF 7, and UE 1. Here are examples of action 1004 of method 1000 and action 1103 of method 1100.

[0277] 1306: PDU sessions use higher security encryption and integrity protection algorithms. This is an example of action 1005 of method 1000.

[0278] Figure 14 An example message sequence 1400 according to another embodiment of the third aspect is shown. It illustrates the actions performed by UE 1, SM NF / MM NF 4, UP NF 7 and Sec NF 5 and the messages between them.

[0279] Message sequence 1400 relates to a dynamic information-based method 1401. For example, this dynamic information-based method is initiated by the network. It can be used independently of the dynamic information-based method 1301, and / or it can be used, for example, after the dynamic information-based method 1301 has been executed.

[0280] For example, message sequence 1400 includes the following:

[0281] 1402: Sec NF 5 sends a notification to SM NF / MM NF 4, which includes a security assessment report indicating that the security level of UE 1 has changed. For example, this may occur in response to Sec NF 5 detecting a change in the security status of UE 1. For example, Sec NF 5 may have received an event report indicating improper behavior by UE 1. Step 1402 is an example of action 1101 of method 1100 and action 1203 of method 1200.

[0282] 1403: AMF / SMF can select different encryption, decryption, and / or integrity protection algorithms for each PDU session or MM NAS based on the evaluation report. This is an example of action 1102 of method 1100.

[0283] 1404: Run SMC to change the security algorithm. This is an example of action 1004 of method 1000 and action 1103 of method 1100.

[0284] Therefore, it can be seen that methods 1000, 1100, and 1200 can be implemented in different ways, for example, as methods initiated by the UE or by the network.

[0285] In some embodiments, the steps in message sequences 1300 and 1400 can be described as follows.

[0286] Step 1: UE 1 creates a PDU session and sends a PDU session creation request to the network, including the UE status and UE evaluation report available at the UE (1302).

[0287] The UE assessment report (if provided) may include or consist of the following:

[0288] Step 2: MM NF 4 can retrieve the security assessment report (1303, 1402) from Sec NF 5.

[0289] Sec NF 5 can provide the following information in the security assessment report:

[0290] Step 3: Based on the security assessment report, MM NF can determine the encryption / decryption and / or integrity protection (and its verification) algorithms (1304, 1403) for NAS and / or UP services.

[0291] Step 4: The MM NF can run the SMC to begin encryption / decryption (and / or integrity protection and / or integrity protection verification) based on the selected security algorithm (1305, 1404). The MM / SM NF 4 can send policies to UE 1 and the User Plane Function (UPF / UPNF 7) to begin protecting UPF services accordingly.

[0292] The following describes embodiments related to service initiation and termination processes based on UE security status.

[0293] Figure 15 This is a flowchart illustrating a method 1500 according to an example embodiment of the fourth aspect. This method can be performed, for example, by a UE.

[0294] For example, method 1500 includes:

[0295] 1501: Supports security state sets, where security states indicate different security conditions;

[0296] 1502: Based on the security situation detected by the UE, adopt the security state from the security state set;

[0297] 1503: Based on the security state adopted, prohibit at least some communications to and / or from the UE.

[0298] Any one or each of operations 1501 to 1503 can be run partially or fully in the Trusted Execution Environment / Security Module 10 of UE 1.

[0299] Figure 16 This is a flowchart illustrating a method 1600 according to an example embodiment of the fourth aspect. The method can be performed, for example, by a network entity, such as an SM NF / MM NF 4.

[0300] For example, method 1600 includes:

[0301] 1601: Supports security state sets, with security state indicators tailored to different security conditions of the User Equipment (UE).

[0302] 1602: Determine the security status for the UE from the security status set based on the security status detected by the UE;

[0303] 1603: Based on the security status determined for the UE, prohibit at least some communications to and / or from the UE.

[0304] Any one or more of operations 1601 to 1603 can be run in security engine 50 or security module 40.

[0305] Figure 17 An example message sequence 1700 according to an embodiment of the fourth aspect is shown. Although Figure 15 and Figure 16 The message sequence 1700 illustrates which operations can be performed by the UE and the network entity, but it also provides an example of how the UE 1 and the network entity (e.g., SMNF / MM NF 4) can work together.

[0306] Figure 17 The diagram shows two parts: UE-initiated part 1701 and NW-initiated part 1705. These two parts can be executed one after the other, for example, as follows: Figure 17 As shown. They can also be independent of each other. Each of the UE-initiated portion 1701 and the NW-initiated portion 1705 can be considered as an independent embodiment of the fourth aspect.

[0307] Part 1701 initiated by the UE may include some or all of the following actions:

[0308] 1702: UE 1 can determine that the UE security state is insecure (or at least not fully secure, e.g., restricted security state or monitored security state). This is an example of action 1502 of method 1500.

[0309] For example, according to the first option, UE 1 will disable certain slice communications and / or DNN communications 1703. For example, based on a security state (e.g., in a trusted execution environment), UE 1 can be configured not to send any communications for a specific slice and / or DNN. This is an example of action 1503 of method 1500.

[0310] Alternatively or additionally, according to the second option, UE 1 may continue as shown in references 1704a-1704c. 1704a-1704c are examples of action 1603 of method 1600.

[0311] 1704a: UE1 can send a PDU session EST request (e.g., for Slice1 / DNN1).

[0312] 1704b: If the UE state is insecure or at least not fully secure (e.g., monitored), and if a rule or policy is configured to disable slices or DNNs (e.g., DNN1) in this situation, then MM / SM NF 4 may disable slices / DNNs (e.g., any communication between UE 1 and slices or DNNs).

[0313] 1704c: SM NF / MM NF 4 can return an error to UE 1.

[0314] According to one embodiment, when the UE state is insecure (or at least not completely secure), there are several (e.g., two) possibilities. First, UE 1 can block certain slice / DNN communications. Second, a PDU session establishment request with slice / DNN information can be sent to MM NF 4. If the UE state is insecure, or for example, in a monitored secure state, then, for example, a rule / policy is configured to block slice / DNN1, and MM NF or SM NF 4 will block slice / DNN1 communications.

[0315] Part 1705 initiated by NW may include some or all of the following actions:

[0316] 1706: SM NF / MM NF 4 can receive service requests for slices and / or DNNs for UE 1.

[0317] 1707: If the UE state is, for example, insecure or monitored (e.g., after determining the state of UE 1, as shown in 1602 of method 1600), then the rule / policy can be configured to disable slice / DNN1, and then MM / SM NF 4 can disable slice / DNN1.

[0318] 1708: SM NF / MM NF 4 can return an error to another NF 8.

[0319] 1706-1708 is another example of action 1603 of method 1600.

[0320] Therefore, according to one embodiment, when one or more other NF 8s are sending service requests for slicing and / or DNN for UE 1, and if SM NF / MM NF 4 determines that the UE's security status is, for example, insecure or monitored, then rules and / or policies can be configured to prohibit slicing and / or DNN (e.g., DNN1), and MM NF / SM NF 4 will prohibit slicing and / or return an error. An error response can be sent back to the requesting NF 8.

[0321] It should be understood that when referring to MM NF and / or SM NF (MM NF / SM NF), this can mean MM NF, or it can mean SM NF, or it can mean both MM NF and SM NF, or it can mean an NF function that has similar functionality to MM NF and / or SM NF. It should be understood that any reference to MM NF / SM NF can be replaced with a reference to another NF or another set of NFs, such as AMF and / or MM NF.

[0322] Different embodiments have been illustrated above. They relate to the UE security state. The UE's security state can depend on its security status and / or indicate the current security status. In some embodiments, the security state can allow the system to track the context or history of actions, users, or interactions. In some embodiments, this allows security algorithms to select dynamic behavior, e.g., for each PDU session. In some embodiments, the security state can be used to disable communication, such as communication associated with a specific slice or DNN. In various embodiments, the security module in the UE, the MM NF, and / or the security engine in the Sec NF and / or NWDA NF are considered to enhance the security of operations related to the security state.

[0323] Figure 18 A schematic block diagram of an example of a device 1800 according to an embodiment is shown, such as a UE or a network entity or a portion thereof.

[0324] The device or network entity 1800 includes a processor 1801, a program memory 1802, a working or main memory 1803, a data memory, multiple communication interfaces 1804, and an optional user interface 1805.

[0325] The apparatus 1800 may, for example, be configured to perform and / or control a method according to any example aspect, or include corresponding components (at least one of 1801 to 1805) for performing and / or controlling a method according to any example aspect. The apparatus 1800 may also constitute a UE or network entity including at least one processor 1801 and at least one memory 1802 storing instructions, which, when executed by the at least one processor, cause (for example) the UE or network entity to at least perform and / or control a method according to any or all example aspects.

[0326] Processor 1801 may, for example, control at least one of memory 1802 and memory 1803, communication interface(s) 1804 and / or optional user interface 1805.

[0327] Processor 1801 may, for example, execute program code stored in program memory 1802, program memory may, for example, represent a readable storage medium including program code, which, when executed by processor 1801, causes processor 1801 to perform a method according to any example aspect.

[0328] Processor 1801 (and any other processors mentioned in this specification) can be any suitable type of processor. Processor 1801 can be, but is not limited to, one or more microprocessors, one or more processors accompanied by one or more digital signal processors, one or more processors without digital signal processors(s), one or more application-specific computer chips, one or more field-programmable gate arrays (FPGAs), one or more controllers, one or more application-specific integrated circuits (ASICs), or one or more computers / servers. The associated architecture / hardware has been programmed to perform the functions described above. Processor 1801 can, for example, be an application processor for running an operating system.

[0329] Program memory 1802 may also be included in processor 1801. This memory may be fixedly connected to processor 1801, or at least partially removable from processor 1801, for example, in the form of a memory card or memory stick. Program memory 1802 may be, for example, non-volatile memory. For example, it may be any of flash memory (or a portion thereof), ROM, PROM, EPROM, and EEPROM memory (or a portion thereof), or a hard disk (or a portion thereof), to name just a few. Program memory 1802 may include an operating system for processor 1801. Program memory 1802 may include firmware for device or network entity 1800.

[0330] Multiple communication interfaces 1804 enable device 1800 to communicate with other entities, such as one or more UEs or one or more network nodes. The multiple communication interfaces 1804 may include, for example, wireless interfaces (e.g., cellular wireless communication interfaces and / or WLAN interfaces) and / or wired interfaces (e.g., IP-based interfaces for communicating with entities via the Internet). These multiple communication interfaces enable device 1800 to communicate with other entities, such as one or more entities included in a mobile communication network.

[0331] User interface 1805 is optional and may include a display for showing information to the user and / or an input device (e.g., keyboard, keypad, touchpad, mouse, etc.) for receiving information from the user.

[0332] Some or all of the components of device 1800 may be connected via a bus, for example. For example, some or all of the components of device or network entity 1800 may be combined into one or more modules.

[0333] The apparatus 1800 may also include at least one of the following: a receiver, for example for receiving information from a network entity or a UE; and a transmitter, for example for sending information to a network entity or a UE.

[0334] In this specification, any connections presented in the described embodiments should be understood as being operatively coupled to the components involved. Therefore, connections can be direct or indirect, may involve any number or combination of intermediate elements, and the components may have only a functional relationship.

[0335] Furthermore, any methods, processes, and actions described or illustrated herein may be implemented using executable instructions in a general-purpose or special-purpose processor and stored on a computer-readable storage medium (e.g., a disk, memory, etc.) for execution by that processor. The reference to 'computer-readable storage medium' should be understood to include special-purpose circuitry such as FPGAs, ASICs, signal processing devices, and other devices.

[0336] The expression "A and / or B" is considered to include any one of the following three cases: (I) A, (II) B, or (III) A and B. Furthermore, the article "a" should not be understood as "one," meaning that the use of the expression "one element" does not exclude the presence of other elements. The term "includes" should be understood in an open sense, meaning that the object "including element A" can also include other elements besides element A. Furthermore, the term "includes" can also be understood as disclosing "consisting of," that is, consisting only of the specified elements.

[0337] The expressions “at least one of the following: ” and “<at least one of a list of two or more elements>” and similar wording (where the list of two or more elements is connected by “and” or “or”) mean at least any one of these elements, or at least any two or more of these elements, or at least all of these elements.

[0338] It should be understood that all presented embodiments are merely examples, and any feature presented for a particular example embodiment may be used alone with any aspect, or in combination with any feature presented for the same or another particular example embodiment, and / or in combination with any other feature not mentioned. In particular, the example embodiments presented in this specification should also be understood as disclosing each other in all possible combinations, provided it is technically reasonable, and the example embodiments are not substitutes for each other. It will also be understood that any feature presented for example embodiments in a particular class (method / apparatus / computer program / system) may also be used in a corresponding manner in example embodiments of any other class. It should also be understood that the presence of a feature in a presented example embodiment does not necessarily mean that the feature is essential and cannot be omitted or substituted.

[0339] The statement of a feature includes at least one of the subsequently listed features, but it is not mandatory that the feature include all of the subsequently listed features, or include at least one of the multiple subsequently listed features. Furthermore, listed features can be selected in any combination, or only one of the listed features can be selected. Specific combinations of all subsequently listed features can also be considered. Additionally, only one of the listed features may be possible.

[0340] The order of all the method steps described above is not mandatory, and alternative orders are possible. However, the specific order of the method steps illustrated in the accompanying drawings should be considered as one possible order of method steps for the corresponding embodiments described in the accompanying drawings.

[0341] The subject matter has been described above by way of exemplary embodiments. It should be noted that there are alternatives and variations that are obvious to those skilled in the art, and that these alternatives and variations can be implemented without departing from the scope of the appended claims.

[0342] List of abbreviations:

[0343] 5G: Fifth Generation

[0344] 6G: Sixth Generation

[0345] AAA: Authentication, Authorization and Billing

[0346] AKA: Authentication and Key Negotiation

[0347] AMF: Access and Mobility Management Functions

[0348] ASIC: Application-Specific Integrated Circuit

[0349] AUSF: Authentication Server Function

[0350] DNN: Data Network Name

[0351] DU: Distributed Unit

[0352] EPROM: Erasable PROM

[0353] EEPROM: Electrically Erasable PROM

[0354] FPGA: Field Programmable Gate Array

[0355] HMAC-SHA256: Hash-based message authentication code using SHA-256.

[0356] HSS: Home Subscriber Server

[0357] IMSI: International Mobile Subscriber Identity

[0358] IoT: Internet of Things

[0359] KPI: Key Performance Indicators

[0360] LTE: Long Term Evolution

[0361] MAC: Message Authentication Code

[0362] MM NF: Mobility Management Network Function

[0363] NAS: Non-Access Layer

[0364] NEF: Network Open Functionality

[0365] NF: Network Functions

[0366] NW: Network

[0367] NWDA NF: Network Data Analysis Network Functions

[0368] OTA (Over-the-Air) Download

[0369] PCF: Policy Control Function

[0370] PDN: Packet Data Network

[0371] PDU: Protocol Data Unit

[0372] PROM: Programmable Read-Only Memory

[0373] QoS: Quality of Service

[0374] ROM: Read-Only Memory

[0375] Sec NF: Security Assessment of Network Functions

[0376] SHA-256: Secure Hash Algorithm (256-bit)

[0377] SHA-3: Secure Hash Algorithm 3

[0378] SIM: Subscriber Identification Module

[0379] S-NSSAI: Auxiliary Information for Single Network Slice Selection

[0380] SM NF: Session Management Network Function

[0381] SMC: Safe Mode Command

[0382] SMS: SMS service

[0383] SSC: Session and Service Continuity

[0384] TAC: Type Assignment Code

[0385] TMSI: Temporary Mobile Subscriber Identity

[0386] TV: Television

[0387] UCMF: UE Radio Capability Management Function

[0388] UCS Status: UE Damaged / Unsafe (Safe)

[0389] UDM: Unified Data Management

[0390] UE: User Equipment

[0391] UICC: General Purpose Integrated Circuit Card

[0392] UMS Status: UE monitors security status

[0393] UNS Status: UE has not assessed security status.

[0394] UPF: User-Face Functionality

[0395] URS Status: UE Restricted Security Status

[0396] USS Status: UE Security Status

[0397] WLAN: Wireless Local Area Network

Claims

1. A user equipment (UE), comprising: Components for supporting a set of security states, which indicate different security conditions; A component for adopting a security state from the security state set based on the security situation detected by the UE; as well as A component for prohibiting at least some communications to and / or from the UE based on the security state adopted.

2. The UE of claim 1, wherein the component for prohibiting at least some communications to and / or from the UE based on the adopted security state is configured to: prohibit communications associated with network slices based on the adopted security state.

3. The UE according to claim 1 or 2, wherein the component for prohibiting at least some communications to and / or from the UE based on the adopted security state is configured to: prohibit communications associated with a data network name based on the adopted security state.

4. The UE according to any one of claims 1 to 3, wherein the security state set comprises: It indicates multiple security states corresponding to different security levels, and The component for prohibiting at least some communications to and / or from the UE based on the adopted security state is configured to: prohibit more services if the adopted security state indicates a security situation corresponding to a lower security level, and prohibit fewer services if the adopted security state indicates a security situation corresponding to a higher security level.

5. The UE according to claim 1, wherein the security state set includes one or more of the following, or is composed of one or more of the following: - Safe and secure status; - Monitor security status; - Restricted security status; - Damaged safety status; as well as - Security status not assessed.

6. The UE according to any one of the preceding claims, the UE further comprising: A component for dynamically changing the adopted security state to another security state in the set of security states when a change in the security status of the UE is detected.

7. The UE according to any one of the preceding claims, wherein the UE further comprises: A trusted execution environment for performing operations related to the security state of the UE.

8. The UE according to any one of the preceding claims, wherein the security state adopted is different in multiple Protocol Data Unit (PDU) sessions.

9. A network entity, comprising: Components for supporting a set of security states, the security states indicating different security conditions for a user equipment (UE); A component for determining the security status of the UE from the security status set based on the security situation detected by the UE; as well as A component for prohibiting at least some communications to and / or from the UE based on a security status determined for the UE.

10. The network entity of claim 9, wherein the component for prohibiting at least some communications to and / or from the UE based on the security state determined for the UE is configured to: prohibit the UE's communications associated with a network slice based on the security state determined for the UE.

11. The network entity according to claim 10, further comprising: A component for receiving messages from another network function, the messages including service requests for the UE associated with the network slice; The component for blocking at least some communications to and / or from the UE based on the security status determined for the UE is configured to send an error message to the other network function if the communications of the UE associated with the network slice are blocked.

12. The network entity according to claim 10 or 11, wherein the network entity further comprises: A component for receiving messages from the UE, the messages including a session establishment request associated with the network slice; The component for blocking at least some communications to and / or from the UE based on the security status determined for the UE is configured to send an error message to the UE if the communications associated with the network slice of the UE are blocked.

13. The network entity according to any one of claims 9 to 12, wherein the component for prohibiting at least some communications to and / or from the UE based on the security state determined for the UE is configured to: prohibit the UE's communications associated with a data network name based on the security state determined for the UE.

14. The network entity according to claim 13, further comprising: A component for receiving messages from another network function, the messages including service requests for the UE associated with the data network name; The component for blocking at least some communications to and / or from the UE based on a determined security status for the UE is configured to send an error message to the other network function if the communications associated with the data network name of the UE are blocked.

15. The network entity according to claim 13 or 14, further comprising: A component for receiving messages from the UE, the messages including a session establishment request associated with the data network name; The component for blocking at least some communications to and / or from the UE based on the security status determined for the UE is configured to send an error message to the UE if the communications associated with the data network name of the UE are blocked.

16. The network entity according to any one of claims 9 to 15, wherein the security state set comprises: It indicates multiple security states corresponding to different security levels, and The component for prohibiting at least some communications to and / or from the UE based on the security status determined for the UE is configured to: prohibit more services if the security status determined for the UE indicates a security situation corresponding to a lower security level, and prohibit fewer services if the determined security status indicates a security situation corresponding to a higher security level.

17. The network entity according to any one of claims 9 to 16, wherein the security state set comprises one or more of the following, or consists of one or more of the following: - Safe and secure status; - Monitor security status; - Restricted security status; - Damaged safety status; as well as - Security status not assessed.

18. The network entity according to any one of claims 9 to 17, wherein the network entity further comprises: A component for dynamically changing the determined security state to another security state in the set of security states when a change in the security status of the UE is detected.

19. The network entity according to any one of claims 9 to 18, wherein the determined security state differs in multiple Protocol Data Unit (PDU) sessions.

20. A method performed by a user equipment (UE), the method comprising: Supports a set of security states, which indicate different security conditions; Based on the security situation detected by the UE, a security state from the security state set is adopted; as well as Based on the security state adopted, at least some communications to and / or from the UE are prohibited.

21. A method performed by a network entity, the method comprising: Supports a set of security states, which indicate different security conditions for the user equipment (UE). Based on the security situation detected by the UE, a security state for the UE is determined from the security state set; as well as Based on the security status determined for the UE, at least some communications to and / or from the UE are prohibited.

Images