Trust establishment in wireless networks

Abstract

Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a secure service device can receive attestation information from at least one of a device or a service, the attestation information including verifiable information about a state of the device or a state of the service. The secure service device can generate an attestation result indicating whether the attestation information satisfies an evaluation condition. The secure service device can receive a request for the attestation result. The secure service device can provide the attestation result in accordance with the request. Numerous other aspects are described.

Description

Cross-reference to related applications

[0001] This patent application claims priority to U.S. Patent Application No. 18 / 608,546, filed March 18, 2024, entitled “TRUST ESTABLISHMENT INWIRELESS NETWORKS,” which is assigned to the assignee of this application. The disclosure of the earlier application is considered part of this patent application and is incorporated herein by reference. Technical Field

[0002] All aspects of this disclosure relate to wireless communication in general, and more particularly to techniques, apparatus and methods for establishing trust in wireless networks. Background Technology

[0003] Wireless communication systems are widely deployed to provide a variety of services, including voice, text, messaging, video, data, and / or other services. Services may include unicast, multicast, and / or broadcast services, etc. Typical wireless communication systems employ multiple access radio access technologies (RATs) capable of supporting communication with multiple users by sharing available system resources (e.g., time-domain resources, frequency-domain resources, spatial-domain resources, and / or device transmit power, etc.). Examples of such multiple access RATs include Code Division Multiple Access (CDMA) systems, Time Division Multiple Access (TDMA) systems, Frequency Division Multiple Access (FDMA) systems, Orthogonal Frequency Division Multiple Access (OFDMA) systems, Single-Carrier Frequency Division Multiple Access (SC-FDMA) systems, and Time Division Synchronous Code Division Multiple Access (TD-SCDMA) systems.

[0004] The aforementioned Multiple Access RATs have been adopted in various telecommunications standards to provide a common protocol enabling different wireless communication devices to communicate at the city, national, regional, or global level. An example telecommunications standard is New Radio (NR). NR (also known as 5G) is part of the continuous evolution of mobile broadband announced by the 3rd Generation Partnership Project (3GPP). NR (and other mobile broadband evolutions beyond NR) can be designed to better support the Internet of Things (IoT) and reduced-capacity device deployments, industrial connectivity, millimeter-wave (mmWave) expansion, licensed and unlicensed spectrum access, non-terrestrial network (NTN) deployments, sidelinks and other device-to-device direct communication technologies (e.g., cellular vehicle-to-everything (CV2X) communications), massive MIMO, decomposed network architectures and network topology expansion, multi-subscriber implementations, high-precision positioning and / or radio frequency (RF) sensing, and more. As the demand for mobile broadband access continues to grow, further improvements to NR can be implemented, and other radio access technologies (such as 6G) can be introduced to further advance mobile broadband evolution. Summary of the Invention

[0005] In some aspects, a method of wireless communication performed by a security service device includes: receiving authentication information from at least one of the device or the service, the authentication information including verifiable information about the state of the device or the state of the service; generating an authentication result indicating whether the authentication information meets evaluation criteria; receiving a request for the authentication result; and providing the authentication result according to the request.

[0006] In some aspects, a method of wireless communication performed by a certifier device includes: receiving a request for certifying information from a service, the certifying information including verifiable information about the state of the certifier device; and sending the certifying information in accordance with the request.

[0007] In some aspects, an apparatus for wireless communication at a security service device includes: one or more memories; and one or more processors coupled to the one or more memories, the one or more processors being configured to cause the security service device to: receive authentication information from at least one of a device or a service, the authentication information including verifiable information about the state of the device or the state of the service; generate an authentication result indicating whether the authentication information meets evaluation criteria; receive a request for the authentication result; and provide the authentication result according to the request.

[0008] In some aspects, an apparatus for wireless communication at a certifier device includes: one or more memories; and one or more processors coupled to the one or more memories, the one or more processors being configured to cause the certifier device to: receive a request for certifying information from a service, the certifying information including verifiable information about the state of the certifier device; and transmit the certifying information in accordance with the request.

[0009] In some aspects, a non-transitory computer-readable medium storing a set of instructions for wireless communication includes one or more instructions that, when executed by one or more processors of a security service device, cause the security service device to: receive authentication information from at least one of a device or a service, the authentication information including verifiable information about the state of the device or the state of the service; generate an authentication result indicating whether the authentication information meets evaluation criteria; receive a request for the authentication result; and provide the authentication result according to the request.

[0010] In some aspects, a non-transitory computer-readable medium storing a set of instructions for wireless communication includes one or more instructions that, when executed by one or more processors of a certifier device, cause the certifier device to: receive a request for certifying information from a service, the certifying information including verifiable information about the state of the certifier device; and send the certifying information in accordance with the request.

[0011] In some aspects, an apparatus for wireless communication includes: components for receiving verification information from at least one of a device or a service, the verification information including verifiable information about the state of the device or the state of the service; components for generating a verification result indicating whether the verification information meets evaluation criteria; components for receiving a request for the verification result; and components for providing the verification result according to the request.

[0012] In some aspects, an apparatus for wireless communication includes: components for receiving a request for authentication information from a service, the authentication information including verifiable information about the status of the authenticator device; and components for sending the authentication information in accordance with the request.

[0013] Various aspects of this disclosure may be implemented or be implemented as described in whole by or embodied in the methods, apparatus, systems, computer program products, non-transitory computer-readable media, user equipment, base stations, network nodes, network entities, wireless communication devices and / or processing systems as fully described in the specification and drawings and illustrated in the specification and drawings.

[0014] The preceding paragraphs of this section have broadly summarized some aspects of this disclosure. These and additional aspects and their associated advantages will be described below. The disclosed aspects can serve as the basis for modifying or designing other aspects for performing the same or similar purposes of this disclosure. Such equivalent aspects do not depart from the scope of the appended claims. The characteristics of the aspects disclosed herein, their organization and operation, and their associated advantages will be better understood from the following description taken in conjunction with the accompanying drawings. Attached Figure Description

[0015] The accompanying drawings illustrate some aspects of this disclosure but do not limit its scope, as other aspects can be achieved by this description. Each drawing in the drawings is provided for illustrative and descriptive purposes and not as a definition of limitation of the claims. Identical or similar reference numerals in different drawings may identify identical or similar elements.

[0016] Figure 1 This is a diagram illustrating an example of a wireless communication network according to the present disclosure.

[0017] Figure 2This is a diagram illustrating communication between an example network node and an example user equipment (UE) in a wireless network according to the present disclosure.

[0018] Figure 3 This is a diagram illustrating an example decomposed base station architecture according to this disclosure.

[0019] Figure 4 This is a diagram illustrating an example of a service-based architecture based on this disclosure.

[0020] Figure 5 This is a diagram illustrating an example of a trust establishment process for a security service device in a wireless network according to the present disclosure.

[0021] Figure 6 This is a diagram illustrating an example of signaling associated with remote authentication used to establish trust in a wireless network, according to this disclosure.

[0022] Figure 7 This is a diagram illustrating an example of signaling associated with remote trust in a wireless network according to this disclosure.

[0023] Figure 8 This is a diagram illustrating an example of on-demand mutual verification according to this disclosure.

[0024] Figure 9 This is a diagram illustrating an example of the Remote Proof Process (RATS) architecture according to this disclosure.

[0025] Figure 10 This is a diagram illustrating an example process performed, for example, at a security service device or a device of a security service device, according to this disclosure.

[0026] Figure 11 This is a diagram illustrating an example process performed, for example, at a validator device or a device of a validator device, according to this disclosure.

[0027] Figure 12 This is a diagram of an example device for wireless communication according to the present disclosure.

[0028] Figure 13 This is a diagram of an example device for wireless communication according to the present disclosure. Detailed Implementation

[0029] Various aspects of this disclosure are described below with reference to the accompanying drawings. However, aspects of this disclosure may be embodied in many different forms and should not be construed as limited to any specific aspect illustrated or described with reference to the drawings or otherwise presented in this disclosure. Rather, these aspects are provided so that this disclosure will be comprehensive and complete, and will fully convey the scope of protection of this disclosure to those skilled in the art. Those skilled in the art will understand that the scope of this disclosure is intended to cover any aspect of this disclosure disclosed herein, whether implemented independently of or in combination with any other aspect of this disclosure. For example, various combinations or numbers of aspects set forth herein may be used to implement an apparatus or a practice. Furthermore, the scope of this disclosure is intended to cover apparatuses having structures and / or functionalities other than those available for practicing the various aspects of this disclosure set forth herein, or methods practiced using these other structures and / or functionalities. Any aspect of this disclosure disclosed herein may be embodied by one or more elements of the claims.

[0030] Various methods, operations, apparatuses, and techniques will now be presented with reference to them. These methods, operations, apparatuses, and techniques will be described in detail below and illustrated in the accompanying drawings by various blocks, modules, components, circuits, steps, processes, or algorithms (collectively, “elements”). These elements may be implemented using hardware, software, or a combination of hardware and software. Whether such elements are implemented as hardware or software depends on the specific application and the design constraints imposed on the system as a whole.

[0031] Some wireless networks perform subscription authentication based on the Subscriber Identity Module (SIM) credentials of the device accessing the wireless network (or the service of the wireless network). Therefore, as long as the device has obtained valid subscription credentials (provided by the device's Mobile Network Operator (MNO)) for its subscription profile, the device can use the subscription profile to access the network and services. However, International Mobile Equipment Identity (IMEI) reporting may not fully authenticate the device and therefore may not be usable for establishing trust in the device, as counterfeit IMEIs may be configured and reported by the device. This can lead to situations where compromised User Equipment (UE) can launch attacks on the network, spoofed devices with valid SIMs are used for voice phishing attacks, or gray market or cloned devices are used to circumvent standard compliance authentication. It is worth noting that in some examples, authentication alone (which refers to verifying the device's identity, or more specifically, whether the device is the genuine device it claims to be) may not fully mitigate these problems.

[0032] The aspects of this disclosure generally relate to the establishment of trust in wireless networks. Some aspects more specifically relate to establishing trust by facilitating authentication by devices to security service devices (such as remote authentication). "Authentication" is a process in which a dependent party (e.g., a service provider) assesses the trustworthiness of a remote peer entity based on evidence provided by or associated with the remote peer entity (such as a device or person). In the aspects described herein, the dependent party may include security service devices and / or services or devices (such as UEs or network nodes) that perform authentication and assess the integrity of remote peer entities. In the aspects described herein, a remote peer entity may be a device.

[0033] Verification can provide benefits in wireless networks that authentication alone cannot achieve. Remote verification can provide an indication of whether a device is in a desired or anticipated state, thereby mitigating or eliminating attacks launched by compromised UEs, device identity spoofing, or circumvention of standards compliance authentication.

[0034] However, remote authentication can present certain challenges in wireless networks. For example, the diversity of device types, the variety of software versions that can operate on the devices, and potential roaming scenarios may make it difficult to scale remote authentication to a feasible network-wide implementation.

[0035] The aspects described herein provide proof performed by a device (such as a UE), where a security service device acts as the root of trust for proof. Additionally or alternatively, network nodes may utilize the security service device to perform proof. In some aspects, this proof can be performed in addition to authentication (e.g., in conjunction with authentication). Furthermore, the aspects described herein provide semi-dynamic or dynamic proof as well as mutual proof.

[0036] The aspects of this disclosure can be used to provide one or more of the following potential advantages. By using a security service appliance as a root of trust for proofs of devices and services, the security service appliance can provide scalable proofs across multiple networks, thereby reducing the difficulties described above. By performing proofs in addition to authentication (e.g., in conjunction with authentication), reduced proof and verification overhead is provided compared to performing proofs separately from authentication. Semi-dynamic proofs provide scalability by allowing the security service appliance to provide proof results previously obtained by the security service appliance over a period of time, thereby reducing signaling overhead. Dynamic proofs (sometimes referred to as on-demand proofs) can support a variety of use cases, such as mutual proofs, thereby increasing the flexibility of network operation and proofs.

[0037] Multiple access radio access technology (RAT) has been adopted in various telecommunications standards to provide a common protocol that enables different wireless communication devices to communicate at the city, national, regional, or global level. For example, 5G New Radio (NR) is part of the continuous mobile broadband evolution program released by the 3rd Generation Partnership Project (3GPP). 5G NR supports a variety of technologies and use cases, including enhanced mobile broadband (eMBB), ultra-reliable low-latency communication (URLLC), massive machine-type communication (mMTC), millimeter wave (mmWave) technology, beamforming, network slicing, edge computing, Internet of Things (IoT) connectivity and management, and network function virtualization (NFV).

[0038] With increasing demand for broadband access and the evolution of technologies supported by wireless communication networks, further technological improvements can be adopted or implemented in 5G NR or future RATs (such as 6G) to further advance the evolution of wireless communication for a variety of existing and new use cases and applications. Such technological improvements can be associated with new frequency band extensions, licensed and unlicensed spectrum access, overlapping spectrum use, small cell deployments, non-terrestrial network (NTN) deployments, decomposed network architectures and network topology extensions, device aggregation, advanced duplex communication, sidelinks and other device-to-device direct communication, IoT (including passive or ambient IoT) networks, reduced-capacity (RedCap) UE functionality, industrial connectivity, multi-subscriber implementations, high-precision positioning, radio frequency (RF) sensing and / or artificial intelligence or machine learning (AI / ML), and more. Such technological improvements can support use cases such as wireless backhaul, wireless data centers, extended reality (XR) and metaverse applications, meta-services for supporting vehicle connectivity, holographic and mixed reality communications, autonomous and collaborative robots, vehicle platooning and collaborative manipulation, sensor networks, posture monitoring, brain-computer interfaces, digital twin applications, asset management, and general coverage applications using off-ground and / or aerial platforms, etc. The methods, operations, apparatuses, and techniques described herein can implement one or more of the foregoing technologies and / or support one or more of the foregoing use cases.

[0039] Figure 1 This is a diagram illustrating an example of a wireless communication network 100 according to the present disclosure. The wireless communication network 100 may be a 5G (or NR) network or a 6G network, or may include elements of a 5G (or NR) network or a 6G network, etc. The wireless communication network 100 may include a plurality of network nodes 110, shown as network node (NN) 110a, network node 110b, network node 110c, and network node 110d. Network nodes 110 may support communication with a plurality of UEs 120 (shown as UE 120a, UE 120b, UE 120c, UE 120d, and UE 120e).

[0040] Network nodes 110 and UEs 120 of wireless communication network 100 can communicate using the electromagnetic spectrum, which can be subdivided into various categories, frequency bands, carriers, and / or channels according to frequency or wavelength. For example, devices of wireless communication network 100 can communicate using one or more operating frequency bands. In some aspects, multiple wireless networks 100 can be deployed in a given geographical area. Each wireless communication network 100 can support a specific RAT (which may also be referred to as an air interface) and can operate on one or more carrier frequencies in one or more frequency ranges. Examples of RATs include 4G RATs, 5G / NRRATs, and / or 6G RATs, etc. In some examples, when multiple RATs are deployed in a given geographical area, each RAT in that geographical area can operate on a different frequency to avoid interference with each other.

[0041] Various operating frequency bands have been defined as frequency ranges designated FR1 (410 MHz to 7.125 GHz), FR2 (24.25 GHz to 52.6 GHz), FR3 (7.125 GHz to 24.25 GHz), FR4a or FR4-1 (52.6 GHz to 71 GHz), FR4 (52.6 GHz to 114.25 GHz), and FR5 (114.25 GHz to 300 GHz). Although a portion of FR1 is greater than 6 GHz, in some documents and articles, FR1 is often (interchangeably) referred to as the “sub-6 GHz” band. Similarly, in some documents and articles, FR2 is often (interchangeably) referred to as the “millimeter wave” band, but this is different from the Very High Frequency (EHF) band (30 GHz to 300 GHz) identified as the “millimeter wave” band by the International Telecommunication Union (ITU). The frequencies between FR1 and FR2 are often referred to as the mid-band frequencies, including FR3. Frequency bands falling within FR3 can inherit FR1 or FR2 characteristics, thereby effectively extending the characteristics of FR1 or FR2 into mid-band frequencies. Therefore, "below 6 GHz" (if used herein) can broadly refer to frequencies less than 6 GHz, within FR1, and / or included in mid-band frequencies. Similarly, the term "millimeter wave" (if used herein) can broadly refer to frequencies included in mid-band frequencies, within FR2, FR4, FR4-a, FR4-1, or FR5, and / or within the EHF band. Higher frequency bands can extend 5G NR operation, 6G operation, and / or other RATs above 52.6 GHz. For example, each of FR4a, FR4-1, FR4, and FR5 falls within the EHF band. In some examples, the wireless communication network 100 can implement dynamic spectrum sharing (DSS), where multiple RATs (e.g., 4G / LTE and 5G / NR) are implemented within a single frequency band using dynamic bandwidth allocation (e.g., based on user demand). It is conceivable that the frequencies included in these operating frequency bands (e.g., FR1, FR2, FR3, FR4, FR4-a, FR4-1 and / or FR5) can be modified, and the techniques described herein are applicable to those modified frequency ranges.

[0042] Network node 110 may include one or more devices, components, or systems that enable communication between UE 120 and one or more devices, components, or systems of wireless communication network 100. Network node 110 may be, may include, or may be referred to as: NR network node, 5G network node, 6G network node, node B, eNB, gNB, access point (AP), transmit / receive point (TRP), mobility element, core, network entity, network element, network equipment, and / or another type of device, component, or system included in radio access network (RAN).

[0043] Network node 110 may be implemented as a single physical node (e.g., a single physical structure) or as two or more physical nodes (e.g., two or more different physical structures). For example, network node 110 may be a device or system implementing a portion of a radio protocol stack, a device or system implementing a complete protocol stack (such as a complete gNB protocol stack), or a collection of devices or systems collectively implementing a complete protocol stack. For example, and as shown, network node 110 may be an aggregated network node, meaning that network node 110 can implement a complete radio protocol stack physically and logically integrated within a single node (e.g., a single physical structure) in the wireless communication network 100. For example, aggregated network node 110 may consist of a single standalone base station or a single TRP that uses a complete radio protocol stack to implement or facilitate communication between UE 120 and the core network of wireless communication network 100.

[0044] Alternatively, and also as shown, network node 110 may be a decomposed network node (sometimes referred to as a decomposed base station), meaning that network node 110 may use protocol stacks that are physically distributed and / or logically distributed across two or more nodes in the same or different geographic locations. For example, a decomposed network node may have a decomposed architecture. In some deployments, decomposed network node 110 may be used in integrated access and backhaul (IAB) networks, in open radio access networks (O-RAN) (such as network configurations compliant with the O-RAN Alliance), or in virtualized radio access networks (vRAN) (also referred to as cloud radio access networks (C-RAN)) to facilitate scaling by decomposing base station functionality into multiple individually deployable units.

[0045] Network nodes 110 of the wireless communication network 100 may include one or more central units (CUs), one or more distributed units (DUs), and / or one or more radio units (RUs). CUs may host one or more higher-layer control functions, such as Radio Resource Control (RRC) functions, Packet Data Convergence Protocol (PDCP) functions, and / or Service Data Adaptation Protocol (SDAP) functions, etc. DUs may host one or more of the Radio Link Control (RLC) layer, Media Access Control (MAC) layer, and / or one or more higher physical (PHY) layers, at least in part, according to functional splits (such as those defined by 3GPP). In some examples, DUs may also host one or more low-PHY layer functions, such as Fast Fourier Transform (FFT), Inverse FFT (iFFT), beamforming, Physical Random Access Channel (PRACH) extraction and filtering, and / or scheduling of resources for one or more UEs 120, etc. RUs may host RF processing functions or low-PHY layer functions, such as FFT, iFFT, beamforming, or PRACH extraction and filtering, etc., according to functional splits (such as lower-layer functional splits). In this type of architecture, each RU can be operated to handle over-the-air (OTA) communications with one or more UE 120s.

[0046] In some aspects, a single network node 110 may include a combination of one or more CUs, one or more DUs, and / or one or more RUs. Additionally or alternatively, network node 110 may include one or more near real-time (near RT) RAN Intelligent Controllers (RICs) and / or one or more non-real-time (non-RT) RICs. In some examples, CUs, DUs, and / or RUs may be implemented as virtual units, such as Virtual Central Units (VCUs), Virtual Distributed Units (VDUs), or Virtual Radio Units (VRUs), etc. Virtual units may be implemented as virtual network functions, such as those associated with cloud deployments.

[0047] Some network nodes 110 (e.g., base stations, RUs, or TRPs) can provide communication coverage for specific geographic areas. In 3GPP, the term "cell" can refer to the coverage area of ​​network node 110 or to network node 110 itself, depending on the context in which the term is used. Network node 110 can support one or more (e.g., three) cells. In some examples, network node 110 can provide communication coverage for macro cells, pico cells, femto cells, or another type of cell. A macro cell can cover a relatively large geographic area (e.g., a radius of several kilometers) and can allow unrestricted access by UE 120 with a service subscription. A pico cell can cover a relatively small geographic area and can allow unrestricted access by UE 120 with a service subscription. A femto cell can cover a relatively small geographic area (e.g., a residential area) and can allow restricted access by UE 120 associated with that femto cell (e.g., UE 120 in a Closed Subscriber Group (CSG)). The network node 110 used for a macro cell may be referred to as a macro network node. Network node 110 used for a picocell may be referred to as a pico network node. Network node 110 used for a femtocell may be referred to as a femto network node or a home network node. In some examples, the cell may not necessarily be stationary. For example, the geographical area of ​​the cell may move depending on the location of the associated mobile network node 110 (e.g., a train, satellite base station, drone, or NTN network node).

[0048] The wireless communication network 100 can be a heterogeneous network, comprising different types of network nodes 110, such as macro network nodes, piconet nodes, femtonet nodes, relay network nodes, aggregation network nodes, and / or decomposition network nodes, etc. Figure 1 In the example shown, network node 110a can be a macro network node for macro cell 130a, network node 110b can be a pico network node for pico cell 130b, and network node 110c can be a femto network node for femto cell 130c. Compared to other types of network nodes 110, the various types of network nodes 110 typically transmit at different power levels, serve different coverage areas, and / or have different effects on interference in the wireless communication network 100. For example, macro network nodes may have high transmit power levels (e.g., 5 watts to 40 watts), while pico network nodes, femto network nodes, and relay network nodes may have lower transmit power levels (e.g., 0.1 watts to 2 watts).

[0049] In some examples, network node 110 may be, may include, or operate as a RU, TRP, or base station communicating with one or more UEs 120 via a radio access link (which may be referred to as a "Uu" link). The radio access link may include a downlink and an uplink. "Downlink" (or "DL") refers to the communication direction from network node 110 to UE 120, and "uplink" (or "UL") refers to the communication direction from UE 120 to network node 110. Downlink channels may include one or more control channels and one or more data channels. Downlink control channels may be used to transmit downlink control information (DCI) (e.g., scheduling information, reference signals, and / or configuration information) from network node 110 to UE 120. Downlink data channels may be used to transmit downlink data (e.g., user data associated with UE 120) from network node 110 to UE 120. Downlink control channels may include one or more physical downlink control channels (PDCCH), and downlink data channels may include one or more physical downlink shared channels (PDSCH). The uplink channel may similarly include one or more control channels and one or more data channels. The uplink control channel can be used to transmit uplink control information (UCI) from UE 120 to network node 110 (e.g., transmitting corresponding reference signals and / or feedback with one or more downlinks). The uplink data channel can be used to transmit uplink data (e.g., user data associated with UE 120) from UE 120 to network node 110. The uplink control channel may include one or more physical uplink control channels (PUCCH), and the uplink data channel may include one or more physical uplink shared channels (PUSCH). The downlink and uplink may each include a set of resources on which network node 110 and UE 120 can communicate.

[0050] Downlink and uplink resources may include time-domain resources (frames, subframes, time slots, and / or symbols), frequency-domain resources (bands, component carriers, subcarriers, resource blocks, and / or resource elements), and / or spatial-domain resources (specific transmission directions and / or beam parameters). Frequency-domain resources in some bands may be subdivided into bandwidth portions (BWPs). A BWP may be a contiguous block of frequency-domain resources allocated to one or more UEs 120 (e.g., a contiguous block of resource blocks). UEs 120 may be configured using both uplink and downlink BWPs (where the uplink and downlink BWPs may be the same BWP or different BWPs). BWPs may be dynamically configured and / or reconfigured (e.g., by sending DCI configuration to one or more UEs 120 via network node 110), meaning that BWPs may be adjusted in real-time (or near real-time) based on changing network conditions in the wireless communication network 100 and / or based on the specific requirements of one or more UEs 120. This allows for more efficient use of available frequency domain resources in the wireless communication network 100, as fewer frequency domain resources can be allocated to the BWP for UE 120 (which reduces the number of frequency domain resources that UE 120 needs to monitor), thus allowing more frequency domain resources to be distributed across multiple UE 120s. Therefore, the BWP can also assist in the implementation of such UE 120s by facilitating the configuration of smaller bandwidths for communications performed by lower-capacity UE 120s.

[0051] As described above, in some aspects, the wireless communication network 100 may be an IAB network, may include an IAB network, or may be included in an IAB network. In an IAB network, at least one network node 110 is an anchor network node communicating with a core network. The anchor network node 110 may also be referred to as an IAB donor (or "IAB donor"). The anchor network node 110 may be connected to the core network via a wired backhaul link. For example, the Ng interface of the anchor network node 110 may terminate at the core network. Additionally or alternatively, the anchor network node 110 may be connected to one or more devices in the core network that provide core access and mobility management functions (AMF). An IAB network typically also includes multiple non-anchor network nodes 110, which may also be referred to as relay network nodes or simply IAB nodes (or "IAB-nodes"). Each non-anchor network node 110 can directly communicate with the anchor network node 110 via a wireless backhaul link to access the core network, or can indirectly communicate with the anchor network node 110 via one or more other non-anchor network nodes 110 and an associated wireless backhaul link forming a backhaul path to the core network. Some anchor network nodes 110 or other non-anchor network nodes 110 can also directly communicate with one or more UEs 120 via a wireless access link carrying access services. For example, network resources used for wireless communication (such as time resources, frequency resources, and / or spatial resources) can be shared between the access link and the backhaul link.

[0052] In some examples, any network node 110 relaying communication may be referred to as a relay network node, a relay station, or simply a repeater. A repeater may receive communications from an upstream station (e.g., another network node 110 or UE 120) and transmit communications to a downstream station (e.g., UE 120 or another network node 110). In this case, the wireless communication network 100 may include or be referred to as a "multi-hop network." Figure 1 In the example shown, network node 110d (e.g., a relay network node) can communicate with network node 110a (e.g., a macro network node) and UE 120d to facilitate communication between network node 110a and UE 120d. Additionally or alternatively, UE 120 can be a relay station capable of relaying transmissions to or from other UE 120s, or can operate as such a relay station. UE 120 relaying communication can be referred to as a UE repeater or relay UE, etc.

[0053] UE 120 may be physically distributed throughout the wireless communication network 100, and each UE 120 may be stationary or mobile. UE 120 may be, may include, an access terminal, another terminal, a mobile station, or a subscriber unit, or may be included in an access terminal, another terminal, a mobile station, or a subscriber unit. UE 120 may be, or may include, a cellular phone (e.g., a smartphone), a personal digital assistant (PDA), a wireless modem, a wireless communication device, a handheld device, a laptop computer, a cordless phone, a wireless local loop (WLL) station, a tablet computer, a camera, a gaming device, a netbook, a smartbook, an ultrabook, a medical device, a biometric device, a wearable device (e.g., a smartwatch, smart clothing, smart glasses, a smart wristband and / or smart jewelry (such as a smart ring or smart bracelet)), an entertainment device (e.g., a music device, a video device and / or a satellite radio), an XR device, a vehicle component or sensor, a smart meter or sensor, industrial manufacturing equipment, a Global Navigation Satellite System (GNSS) device (such as a Global Positioning System device or another type of positioning device), a UE function of a network node, and / or any other suitable device or function that can communicate via a wireless medium, or may be coupled to them.

[0054] UE 120 and / or network node 110 may include one or more chips, system-on-a-chip (SoC), chipsets, packages, or devices that individually or collectively constitute or include a processing system. The processing system includes processor (or “processing”) circuitry in the form of one or more processors, microprocessors, processing units (such as central processing units (CPUs), graphics processing units (GPUs), neural processing units (NPUs), and / or digital signal processors (DSPs)), processing blocks, application-specific integrated circuits (ASICs), programmable logic devices (PLDs) (such as field-programmable gate arrays (FPGAs)), or other discrete gate or transistor logic components or circuits (all of which are generally referred to herein individually as “processors” or collectively as “processors” or “processor circuitry”). One or more of these processors may be individually or collectively configured to perform the various functions or operations described herein. A group of processors that can be configured or configured to perform a set of functions may include a first processor that can be configured or configured to perform a first function in the set, and a second processor that can be configured or configured to perform a second function in the set, or may include the entire group of processors that are configured or configured to perform the set of functions.

[0055] The processing system may also include memory circuitry in the form of one or more memory devices, memory blocks, memory elements, or other discrete gate or transistor logic components or circuits, each of which may include tangible storage media such as random access memory (RAM) or read-only memory (ROM) or combinations thereof (all of which are generally referred to herein individually as "memory" or collectively as "memory" or "memory circuitry"). One or more of these memories may be coupled to one or more processors in the processor (e.g., operatively coupled, communicatively coupled, electronically coupled, or electrically coupled) and may store processor-executable code (such as software) individually or collectively, which, when executed by one or more processors in the processor, may configure one or more processors in the processor to perform the various functions or operations described herein. Additionally or alternatively, in some examples, one or more processors in the processor may be pre-configured to perform the various functions or operations described herein without being configured by software. The processing system may also include or be coupled to one or more modems (such as Wi-Fi (e.g., IEEE compliant) modems or cellular (e.g., 3GPP 4G LTE, 5G, or 6G compliant) modems). In some embodiments, one or more processors of the processing system include or implement one or more modems among the modems. The processing system may also include, or be coupled to, multiple radio components (collectively, “radio components”), multiple RF chains, or multiple transceivers, each of which may in turn be coupled to one or more antennas among multiple antennas. In some embodiments, one or more processors of the processing system include or implement one or more of the radio components, RF chains, or transceivers. UE 120 may be included or may be contained in a housing that houses components associated with UE 120, including the processing system.

[0056] Some UEs 120 may be considered Machine Type Communication (MTC) UEs, Evolved or Enhanced Machine Type Communication (eMTC) UEs, Further Enhanced eMTC (feMTC) UEs or Enhanced feMTC (efeMTC) UEs, or further evolutions thereof, all of which may be collectively referred to as "MTC UEs". MTC UEs may be, may include, or may be included in or coupled with the following: robots, unmanned aerial vehicles, remote devices, sensors, instruments, monitors, and / or location tags. Some UEs 120 may be considered IoT devices and / or may be implemented as NB-IoT (Narrowband IoT) devices. IoT UEs or NB-IoT devices may be, may include, or may be included in or coupled with the following: industrial machines, appliances, refrigerators, doorbell camera devices, home automation devices, and / or lighting fixtures, etc. Some UEs 120 may be considered customer premises equipment, which may include telecommunications equipment installed at a customer location (such as a home or office) to enable access to a service provider’s network (such as being included in or communicating with the wireless communication network 100).

[0057] Some UEs 120 can be categorized according to different categories associated with varying levels of complexity and / or capabilities. Category 1 UEs 120 facilitate large-scale IoT within the wireless communication network 100 and offer lower complexity and / or cost compared to Category 2 UEs 120. Category 2 UEs 120 may include mission-critical IoT devices capable of URLLC, enhanced mobile broadband (eMBB), and / or precise positioning within the wireless communication network 100, legacy UEs, baseline UEs, high-level UEs, advanced UEs, full-capability UEs, and / or premium UEs. Category 3 UEs 120 may possess intermediate-level complexity and / or capabilities (e.g., capabilities between Category 1 and Category 2 UEs 120). Category 3 UEs 120 may be referred to as reduced-capability UEs (“RedCap UEs”), intermediate-level UEs, NR lightweight UEs, and / or NR simplified UEs, etc. RedCap UEs bridge the gap in capabilities and complexity between NB-IoT devices and / or eMTC UEs and mission-critical IoT devices and / or premium UEs. RedCap UEs can include, for example, wearable devices, IoT devices, industrial sensors, and / or cameras associated with limited bandwidth, power capacity, and / or transmission range. RedCap UEs can support healthcare environments, building automation, power distribution, process automation, transportation and logistics, and / or smart city deployments, among others.

[0058] In some examples, two or more UEs 120 (e.g., shown as UE 120a and UE 120e) can communicate directly with each other using sidelink communication (e.g., without communicating through a network node 110 acting as an intermediary). As an example, UE 120a can send data, control information, or other signaling directly to UE 120e as sidelink communication. This contrasts with, for example, UE 120a first sending data to network node 110 in UL communication, and then that network node sending data to UE 120e in DL communication. In various examples, UE 120 can send and receive sidelink communication using peer-to-peer (P2P) communication protocols, device-to-device (D2D) communication protocols, vehicle-to-everything (V2X) communication protocols (which may include vehicle-to-vehicle (V2V) protocols, vehicle-to-infrastructure (V2I) protocols, and / or vehicle-to-pedestrian (V2P) protocols), and / or mesh network communication protocols. In some deployments and configurations, network node 110 may schedule and / or allocate resources for sidelink communication between UEs 120 in the wireless communication network 100. In some other deployments and configurations, UE 120 (instead of network node 110) may perform or cooperate with or negotiate with one or more other UEs to perform scheduling operations, resource selection operations, and / or other operations for sidelink communication.

[0059] In various examples, in addition to half-duplex operation, some network nodes and UEs in the wireless communication network 100, including network node 110 and UE 120, can also be configured for full-duplex operation. Network node 110 or UE 120 operating in half-duplex mode can perform only one of transmission or reception during a specific time resource period (such as a specific time slot, symbol, or other time period). Half-duplex operation may involve time division duplex (TDD), where the DL transmission of network node 110 and the UL transmission of UE 120 do not occur in the same time resource (i.e., the transmissions do not overlap in time). In contrast, network node 110 or UE 120 operating in full-duplex mode can transmit and receive communications concurrently (e.g., within the same time resource). By operating in full-duplex mode, network node 110 and / or UE 120 can generally increase the capacity of the network and radio access links. In some examples, full-duplex operation may involve frequency division duplex (FDD), in which network node 110 performs DL transmission in a first frequency band or on a first component carrier, and UE 120 performs transmission in a second frequency band or on a second component carrier, the second frequency band or the second component carrier being different from the first frequency band or the first component carrier, respectively. In some examples, full-duplex operation may be enabled for UE 120 but not for network node 110. For example, UE 120 may simultaneously transmit UL to the first network node 110 and receive DL transmissions from the second network node 110 in the same time resources. In some other examples, full-duplex operation may be enabled for network node 110 but not for UE 120. For example, network node 110 may simultaneously transmit DL to the first UE 120 and receive UL transmissions from the second UE 120 in the same time resources. In some other examples, full-duplex operation may be enabled for both network node 110 and UE 120.

[0060] In some examples, UE 120 and network node 110 can perform MIMO communication. "MIMO" generally refers to the simultaneous transmission or reception of multiple signals (such as multiple layers or multiple data streams) using the same time and frequency resources. MIMO techniques typically utilize multipath propagation. MIMO can be implemented using various spatial processing or spatial multiplexing operations. In some examples, MIMO can support simultaneous transmission to multiple receivers, which is called multi-user MIMO (MU-MIMO). Some RATs can employ advanced MIMO techniques such as mTRP operations (including redundant transmission or reception on multiple TRPs), reciprocity in the time or frequency domain, single-frequency network (SFN) transmission, or noncoherent joint transmission (NC-JT).

[0061] In some aspects, the certifier device may include a communication manager 140 or 150. As described in more detail elsewhere herein, the communication manager 140 or 150 may: receive a request for certifying information from a service, the certifying information including verifiable information about the status of the certifier device; and send the certifying information upon request. Additionally or alternatively, the communication manager 140 or 150 may perform one or more other operations described herein.

[0062] As indicated above, Figure 1 This is provided as an example. Other examples are available with reference to [the relevant information]. Figure 1 The examples described are different.

[0063] Figure 2 This is a diagram illustrating communication between an example network node 110 and an example UE 120 in a wireless network according to the present disclosure.

[0064] like Figure 2 As shown, network node 110 may include a data source 212, a transmit processor 214, a transmit (TX) MIMO processor 216, a set of modems 232 (shown as 232a to 232t, where t≥1), a set of antennas 234 (shown as 234a to 234v, where v≥1), a MIMO detector 236, a receive processor 238, a data sink 239, a controller / processor 240, a memory 242, a communication unit 244, a scheduler 246, and / or a communication manager 150, etc. In some configurations, one or a combination of antennas 234, modems 232, MIMO detectors 236, receive processors 238, transmit processors 214, and / or TX MIMO processors 216 may be included in the transceiver of network node 110. The transceiver may be under the control of and used by one or more processors (such as controller / processor 240), and in some respects, may perform aspects of the methods, procedures and / or operations described herein in conjunction with processor-readable code stored in memory 242. In some respects, network node 110 may include one or more interfaces, communication components and / or other components that facilitate communication with UE 120 or another network node.

[0065] The terms “processor,” “controller,” or “controller / processor” can refer to one or more controllers and / or one or more processors. For example, references to “a / the processor,” “a / the controller / processor,” etc. (in the singular) should be understood as referring to a combination of… Figure 2 The processor described refers to any one or more processors, such as a single processor or a combination of multiple different processors. The reference to "one or more processors" should be understood as a combination of references. Figure 2Any one or more processors described herein. For example, one or more processors of network node 110 may include transmit processor 214, TX MIMO processor 216, MIMO detector 236, receive processor 238, and / or controller / processor 240. Similarly, one or more processors of UE 120 may include MIMO detector 256, receive processor 258, transmit processor 264, TX MIMO processor 266, and / or controller / processor 280.

[0066] In some aspects, a single processor can perform all operations described as being performed by one or more processors. In some aspects, a first set of one or more processors can perform a first operation described as being performed by that one or more processors, and a second set of one or more processors can perform a second operation described as being performed by that one or more processors. The first set of processors and the second set of processors can be the same set of processors or can be different sets of processors. The reference to "one or more memories" should be understood to refer to any one or more memories of the corresponding device, such as those in combination. Figure 2 The memory described. For example, an operation described as being performed by one or more memories can be performed by the same subset of the one or more memories or by different subsets of the one or more memories.

[0067] For downlink communication from network node 110 to UE 120, transmitting processor 214 may receive data (“downlink data”) intended for use by UE 120 (or a set of UEs including UE 120) from data source 212 (such as a data pipeline or data queue). In some examples, transmitting processor 214 may select one or more MCSs for UE 120 based on one or more Channel Quality Indicators (CQIs) received from UE 120. Network node 110 may process the data (e.g., including encoding the data) based on the MCS selected for UE 120 for transmission to UE 120 on the downlink, thereby generating data symbols. Transmitting processor 214 may process system information (e.g., semi-static resource partitioning information (SRPI)) and / or control information (e.g., CQI requests, grants, and / or upper-layer signaling) and provide overhead symbols and / or control symbols. The transmitting processor 214 can generate reference symbols for reference signals (e.g., cell-specific reference signals (CRS), demodulation reference signals (DMRS), or channel state information (CSI) reference signals (CSI-RS)) and / or synchronization signals (e.g., primary synchronization signal (PSS) or secondary synchronization signal (SSS)).

[0068] The TX MIMO processor 216 can perform space processing (e.g., pre-decoding) on ​​data symbols, control symbols, overhead symbols, and / or reference symbols where applicable, and can output a set of symbol streams (e.g., T A set of output symbol streams is provided to modem 232. For example, each output symbol stream may be provided to a corresponding modulator component (shown as MOD) of modem 232. Each modem 232 may use the corresponding modulator component to process (e.g., modulate) the corresponding output symbol stream (e.g., for orthogonal frequency division multiplexing (OFDM)) to obtain an output sample stream. Each modem 232 may further use the corresponding modulator component to process (e.g., convert to analog, amplify, filter, and / or upconvert) the output sample stream to obtain a time-domain downlink signal. Modems 232a to 232t may transmit the set of downlink signals (e.g., via a set of corresponding antennas 234) together. T (One downlink signal).

[0069] Downlink signals may include DCI communication, MAC control element (MAC-CE) communication, RRC communication, downlink reference signals, or another type of downlink communication. Downlink signals may be transmitted on the PDCCH, PDSCH, and / or on another downlink channel. Downlink signals may carry one or more transport blocks (TBs) of data. A TB may be a data unit transmitted via the air interface in the wireless communication network 100. A data stream (e.g., from data source 212) may be encoded into multiple TBs for transmission via the air interface. The number of TBs used to carry data associated with a particular data stream may be associated with a TB size shared by multiple TBs. The TB size may be based on the radio channel conditions of the air interface, the MCS used to encode the data, downlink resources allocated for transmitting data, and / or other parameters, or otherwise associated with them. Generally, a larger TB size allows for a larger amount of data to be transmitted in a single transmission, reducing signaling overhead. However, a larger TB size may be more prone to transmission and / or reception errors than a smaller TB size, but such errors can be mitigated through more robust error correction techniques.

[0070] For uplink communication from UE 120 to network node 110, the uplink signal from UE 120 may be received by antenna 234, processed by modem 232 (e.g., demodulator component of modem 232, shown as DEMOD), detected where applicable by MIMO detector 236 (e.g., receive (Rx) MIMO processor), and / or further processed by receive processor 238 to obtain decoded data and / or control information. Receive processor 238 may provide the decoded data to data sink 239 (which may be a data pipeline, data queue, and / or another type of data sink) and provide the decoded control information to processors such as controller / processor 240.

[0071] Network node 110 may use scheduler 246 to schedule one or more UEs 120 for downlink or uplink communication. In some aspects, scheduler 246 may use DCI to dynamically schedule DL transmissions to and / or UL transmissions from UE 120. In some examples, scheduler 246 may allocate repetitive time-domain and / or frequency-domain resources that UE 120 may use for transmitting and / or receiving communication with RRC configuration (e.g., semi-static configuration), for example, to perform semi-persistent scheduling (SPS) or to configure configuration grant (CG) for UE 120.

[0072] One or more of the following may be included in the RF chain of network node 110: transmit processor 214, TX MIMO processor 216, modem 232, antenna 234, MIMO detector 236, receive processor 238, and / or controller / processor 240. The RF chain may include filters, mixers, oscillators, amplifiers, analog-to-digital converters (ADCs), and / or other devices for converting analog signals (such as those used for transmission or reception via an air interface) to digital signals (such as those used for processing by one or more processors of network node 110). In some aspects, the RF chain may be a transceiver of network node 110, or may be included in such a transceiver.

[0073] In some examples, network node 110 may use communication unit 244 to communicate with the core network and / or other network nodes. Communication unit 244 may support wired and / or wireless communication protocols and / or connections, such as Ethernet, fiber optic, Common Public Radio Interface (CPRI), and / or wired or wireless backhaul, etc. Network node 110 may use communication unit 244 to send and / or receive data associated with UE 120, or to execute network control signaling, etc. Communication unit 244 may include transceivers and / or interfaces, such as network interfaces.

[0074] UE 120 may include a collection of antennas 252 (shown as antennas 252a to 252r, where r ≥ 1), a collection of modems 254 (shown as modems 254a to 254u, where u ≥ 1), a MIMO detector 256, a receive processor 258, a data sink 260, a data source 262, a transmit processor 264, a TX MIMO processor 266, a controller / processor 280, a memory 282, and / or a communication manager 140, etc. One or more components of UE 120 may be included in housing 284. In some aspects, one or a combination of antenna 252, modem 254, MIMO detector 256, receive processor 258, transmit processor 264, or TX MIMO processor 266 may be included in a transceiver included in UE 120. The transceiver may be under the control of and used by one or more processors (such as controller / processor 280), and in some respects, may perform aspects of the methods, procedures, or operations described herein in conjunction with processor-readable code stored in memory 282. In some respects, UE 120 may include another interface, another communication component, and / or another component that facilitates communication with network node 110 and / or another UE 120.

[0075] For downlink communication from network node 110 to UE 120, the set of antennas 252 can receive downlink communication or signals from network node 110, and can receive the set of downlink signals (e.g., R Each received signal is provided to a set of modems 254. For example, each received signal may be provided to a corresponding demodulator component (shown as DEMOD) of modem 254. Each modem 254 may use the corresponding demodulator component to condition (e.g., filter, amplify, down-convert, and / or digitize) the received signal to obtain an input sample. Each modem 254 may use the corresponding demodulator component to further demodulate or process the input sample (e.g., for OFDM) to obtain a received symbol. MIMO detector 256 may obtain the received symbols from the set of modems 254, may perform MIMO detection on the received symbols where applicable, and may provide the detected symbols. Receiver processor 258 may process (e.g., decode) the detected symbols, may provide the decoded data for UE 120 to data sink 260 (such as a data pipeline, data queue, and / or application executed on UE 120), and may provide the decoded control information and system information to controller / processor 280.

[0076] For uplink communication from UE 120 to network node 110, the transmitting processor 264 may receive and process data (“uplink data”) from data source 262 (such as data pipelines, data queues, and / or applications running on UE 120) and control information from controller / processor 280. The control information may include one or more parameters, feedback, one or more signal measurements, and / or other types of control information. In some aspects, the receiving processor 258 and / or controller / processor 280 may determine one or more parameters related to the transmission of uplink communication for received signals (such as those received from network node 110 or another UE). One or more parameters may include a Reference Signal Received Power (RSRP) parameter, a Received Signal Strength Indicator (RSSI) parameter, a Reference Signal Received Quality (RSRQ) parameter, a CQI parameter, or a Transmit Power Control (TPC) parameter, etc. The control information may include indications of the RSRP parameter, RSSI parameter, RSRQ parameter, CQI parameter, TPC parameter, and / or another parameter. Control information can facilitate parameter selection and / or scheduling for UE 120 by network node 110.

[0077] Transmit processor 264 can generate reference symbols for one or more reference signals, such as uplink DMRS, uplink sounding reference signal (SRS), and / or another type of reference signal. Symbols from transmit processor 264 can be pre-decoded by TX MIMO processor 266 where applicable, and further processed by a set of modems 254 (e.g., for DFT-s-OFDM or CP-OFDM). TX MIMO processor 266 can perform spatial processing (e.g., pre-decoding) on ​​data symbols, control symbols, overhead symbols, and / or reference symbols where applicable, and can output symbol streams (e.g., U A set of output symbol streams is provided to a set of modems 254. For example, each output symbol stream may be provided to a corresponding modulator component (shown as MOD) of modem 254. Each modem 254 may use the corresponding modulator component to process (e.g., modulate) the corresponding output symbol stream (e.g., for OFDM) to obtain an output sample stream. Each modem 254 may further use the corresponding modulator component to process (e.g., convert to analog, amplify, filter, and / or upconvert) the output sample stream to obtain an uplink signal.

[0078] Modems 254a to 254u can transmit uplink signal sets (e.g., via a set of corresponding antennas 252) R One uplink signal or UUplink signals may include UCI communication, MAC-CE communication, RRC communication, or another type of uplink communication. Uplink signals may be transmitted on PUSCH, PUCCH, and / or another type of uplink channel. Uplink signals may carry one or more TBs of data. Sidelink data and control transmission (i.e., transmission directly between two or more UEs 120) may typically use techniques similar to those described for uplink data and control transmission, and may use sidelink-specific channels such as the Physical Sidelink Shared Channel (PSSCH), Physical Sidelink Control Channel (PSCCH), and / or Physical Sidelink Feedback Channel (PSFCH).

[0079] One or more antennas in the set of antennas 252 or the set of antennas 234 may include one or more antenna panels, one or more antenna groups, one or more sets of antenna elements, or one or more antenna arrays, etc., or may be included in one or more antenna panels, one or more antenna groups, one or more sets of antenna elements, or one or more antenna arrays, etc. Antenna panels, antenna groups, sets of antenna elements, or antenna arrays may include one or more antenna elements (within a single housing or multiple housings), sets of coplanar antenna elements, sets of non-coplanar antenna elements, or with one or more transmitting or receiving components (such as...) Figure 2 An antenna module is a combination of one or more antenna elements coupled to one or more components. As used herein, "antenna" can mean one or more antennas, one or more antenna panels, one or more antenna groups, one or more collections of antenna elements, or one or more antenna arrays. "Antenna panel" can mean a group of antennas (such as antenna elements) arranged in an array or panel that can facilitate beamforming by manipulating the parameters of that group of antennas. "Antenna module" can mean a circuit that includes one or more antennas, and may also include one or more other components (such as filters, amplifiers, or processors) associated with integrating the antenna module into a wireless communication device.

[0080] In some examples, each antenna element of antenna 234 or antenna 252 may include one or more sub-elements for radiating or receiving radio frequency signals. For example, a single antenna element may include a first sub-element cross-polarized with a second sub-element, which can be used to independently transmit cross-polarized signals. Antenna elements may include patch antennas, dipole antennas, and / or other types of antennas arranged in a linear pattern, a two-dimensional pattern, or another pattern. The spacing between antenna elements can allow signals with a desired wavelength transmitted individually by the antenna elements to interact or interfere (e.g., to form a desired beam) in various directions. For example, given a desired wavelength or frequency range, the spacing may provide a quarter wavelength, half a wavelength, or another fraction of the wavelength between adjacent antenna elements to allow desired constructive and destructive interference modes of signals transmitted by individual antenna elements within that desired range.

[0081] The amplitude and / or phase of signals transmitted via antenna elements and / or sub-elements can be modulated and (e.g., by manipulating phase shifts, phase offsets, and / or amplitudes) shifted relative to each other to generate one or more beams; this is known as beamforming. The term "beam" can refer to the directional transmission of a wireless signal toward a receiving device or otherwise in a desired direction. "Beam" can also generally refer to the direction associated with such directional signal transmission, the set of directional resources associated with the signal transmission (e.g., angle of arrival, horizontal direction, and / or vertical direction), and / or a set of parameters indicating one or more aspects of the directional signal, the direction associated with the signal, and / or the set of directional resources associated with the signal. In some implementations, antenna elements can be individually selected or deselected for the directional transmission of a signal (or multiple signals) by controlling the amplitude of one or more corresponding amplifiers and / or the phase of the signal to form one or more beams. The shape of the beam (such as amplitude, width, and / or the presence of sidelobes) and / or the direction of the beam (such as the angle of the beam relative to the surface of the antenna array) can be dynamically controlled by modifying the phase shifts, phase offsets, and / or amplitudes of multiple signals relative to each other.

[0082] Different UEs 120 or network nodes 110 may include different numbers of antenna elements. For example, UE 120 may include a single antenna element, two antenna elements, four antenna elements, eight antenna elements, or different numbers of antenna elements. As another example, network node 110 may include eight antenna elements, 24 antenna elements, 64 antenna elements, 128 antenna elements, or different numbers of antenna elements. Generally speaking, a larger number of antenna elements provides increased control over the parameters used for beamforming compared to a smaller number of antenna elements, while a smaller number of antenna elements may be less complex to implement and can use less power. Multiple antenna elements can support multi-layer transmission, in which the same time and frequency resources are used to utilize spatial multiplexing to transmit a first layer of communication (which may include a first data stream) and a second layer of communication (which may include a second data stream).

[0083] Although Figure 2 The boxes in the diagram are illustrated as different components, but the functions described above with respect to these boxes may be implemented in a single hardware, software, or combined component, or in various combinations of components. For example, the functions described with respect to transmit processor 264, receive processor 258, and / or TX MIMO processor 266 may be performed by or under the control of controller / processor 280.

[0084] Figure 3 This is an illustration of an example decomposed base station architecture 300 according to the present disclosure. One or more components of the example decomposed base station architecture 300 may be, may include, or may be included in one or more network nodes (such as one or more network nodes 110). The decomposed base station architecture 300 may include a CU 310, which may communicate directly with the core network 320 via a backhaul link, or may communicate indirectly with the core network 320 via one or more decomposed control units (such as non-RT RIC 350 and / or near-RT RIC 370 associated with a Service Management and Orchestration (SMO) framework 360) (e.g., via an E2 link). The CU 310 may communicate with one or more DU 330 via a corresponding midhaul link (such as via an F1 interface). Each DU 330 may communicate with one or more RU 340 via a corresponding fronthaul link. Each RU 340 may communicate with one or more UE 120 via a corresponding RF access link. In some deployments, a UE 120 may be served simultaneously by multiple RU 340s.

[0085] Each component of the disassembled base station architecture 300 (including CU 310, DU 330, RU 340, near-RT RIC 370, non-RT RIC 350, and SMO frame 360) may include one or more interfaces or may be coupled to one or more interfaces for receiving or transmitting signals, such as data or information, via wired or wireless transmission media.

[0086] In some respects, the CU 310 can be logically divided into one or more CU user plane (CU-UP) units and one or more CU control plane (CU-CP) units. When implemented in an O-RAN configuration, the CU-UP units can communicate bidirectionally with the CU-CP units via an interface such as an E1 interface. The CU 310 can be deployed to communicate with one or more DU 330s for network control and signaling, as needed. Each DU 330 may correspond to a logical unit that includes one or more base station functions for controlling the operation of one or more RU 340s. For example, the DU 330 may host various layers, such as the RLC layer, MAC layer, or one or more PHY layers (such as one or more high PHY layers or one or more low PHY layers). Each layer (which may also be referred to as a module) can be implemented using an interface for signaling to other layers (and modules) hosted by the DU 330, or for signaling to control functions hosted by the CU 310. Each RU 340 may implement lower-layer functionality. In some respects, the real-time and non-real-time aspects of communication with the control plane and user plane of the RU 340 can be controlled by the corresponding DU 330.

[0087] The SMO framework 360 supports RAN deployment and provisioning for both non-virtualized and virtualized network elements. For non-virtualized network elements, the SMO framework 360 supports the deployment of dedicated physical resources for RAN coverage requirements, which can be managed via operation and maintenance interfaces such as the O1 interface. For virtualized network elements, the SMO framework 360 can interact with cloud computing platforms such as the Open Cloud (O-Cloud) platform 390 to perform network element lifecycle management (such as instantiating virtualized network elements) via cloud computing platform interfaces such as the O2 interface. Virtualized network elements may include, but are not limited to, CU 310, DU 330, RU 340, non-RT RIC 350, and / or near-RT RIC 370. In some aspects, the SMO framework 360 can communicate with hardware aspects of the 4G RAN, 5G NR RAN, and / or 6G RAN (such as the Open eNB (O-eNB) 380) via the O1 interface. Additionally or alternatively, the SMO framework 360 can communicate directly with each of one or more RUs 340 via the corresponding O1 interface. In some deployments, this configuration enables each DU 330 and CU 310 to be implemented in a cloud-based RAN architecture, such as a vRAN architecture.

[0088] The non-RT RIC 350 may include or implement logic functions that enable non-real-time control and optimization of RAN elements and resources, including AI / ML workflows for model training and updates, and / or policy-based guidance of applications and / or features in the near-RT RIC 370. The non-RT RIC 350 may be coupled to or communicate with the near-RT RIC 370, such as via an A1 interface. The near-RT RIC 370 may include or implement logic functions that enable near real-time control and optimization of RAN elements and resources via an interface, such as an E2 interface, through data collection and actions, connecting one or more CU 310s, one or more DU 330s, and / or O-eNBs to the near-RT RIC 370.

[0089] In some aspects, to generate AI / ML models to be deployed in the near-RT RIC 370, the non-RT RIC 350 may receive parameters or external enrichment information from an external server. This information can be utilized by the near-RT RIC 370 and can be received from non-network data sources or network functions at the SMO framework 360 or the non-RT RIC 350. In some examples, the non-RT RIC 350 or near-RT RIC 370 may modulate RAN behavior or performance. For example, the non-RT RIC 350 may monitor long-term trends and patterns in performance and may employ AI / ML models to perform corrective actions via the SMO framework 360 (such as reconfiguration via the O1 interface) or via the creation of RAN management policies (such as A1 interface policies).

[0090] As indicated above, Figure 3 This is provided as an example. Other examples are available with reference to [the relevant information]. Figure 3 The examples described are different.

[0091] Figure 1 , Figure 2 or Figure 3 Network node 110, its controller / processor 240, UE 120, UE 120's controller / processor 280, CU 310, DU 330, RU 340, or any other component may implement one or more technologies associated with remote authentication or perform one or more operations associated with remote authentication, as described in more detail elsewhere herein. For example, network node 110's controller / processor 240, UE 120's controller / processor 280, CU 310, DU 330, RU 340, or any other component may implement one or more technologies associated with remote authentication or perform one or more operations associated with remote authentication, as described in more detail elsewhere herein. Figure 2 Any other component, CU 310, DU 330, or RU 340 may execute or instruct, for example Figure 10 Process 1000 Figure 11The operation of process 1100 or other processes as described herein (alone or in combination with one or more other processors). Memory 242 may store data and program code for network node 110, CU 310, DU 330, or RU 340. Memory 282 may store data and program code for UE 120. In some examples, memory 242 or memory 282 may include a non-transitory computer-readable medium storing a set of instructions (e.g., code or program code) for wireless communication. Memory 242 may include one or more memories, such as a single memory or multiple different memories (of the same or different types). Memory 282 may include one or more memories, such as a single memory or multiple different memories (of the same or different types). For example, the set of instructions may be made to be executed by one or more processors of network node 110, UE 120, CU 310, DU 330, or RU 340 (e.g., directly, or after compilation, transformation, or interpretation). Figure 10 Process 1000 Figure 11 The process 1100 or other processes as described herein. In some examples, the execution instructions may include run instructions, transform instructions, compile instructions, and / or interpret instructions, etc.

[0092] In some aspects, a certifier device (such as UE 120, network node 110, DU, RU, or a service) includes: components for receiving a request for certifying information from a service, the certifying information including verifiable information about the status of the certifier device; and / or components for sending the certifying information upon request. In some aspects, components for the certifier device to perform the operations described herein may include, for example, one or more of a communication manager 150, a transmit processor 214, a TX MIMO processor 216, a modem 232, an antenna 234, a MIMO detector 236, a receive processor 238, a controller / processor 240, a memory 242, or a scheduler 246. In some aspects, components for the certifier device to perform the operations described herein may include, for example, one or more of a communication manager 140, an antenna 252, a modem 254, a MIMO detector 256, a receive processor 258, a transmit processor 264, a TX MIMO processor 266, a controller / processor 280, or a memory 282.

[0093] As indicated above, Figure 3 This is provided as an example. Other examples are available with reference to [the relevant information]. Figure 3 The examples described are different.

[0094] Figure 4This is a diagram illustrating an example 400 of a service-based architecture according to this disclosure. As shown, example 400 may include device 405 (e.g., UE 120, network node 110, or another device capable of communicating via the RAN), RAN 410, horizontal service device set 415, user plane security anchor (UPSA) 420, and vertical service device set 425. References to services may also refer to service devices that implement services thereon or in combination with them.

[0095] The proliferation of cloud networks has facilitated the deployment of service-based architectures for wireless networks, such as 6G networks. For example, cloud-native platforms can merge core network (CN) services (e.g., functions) and radio access network (RAN) services (e.g., functions), simplifying protocols and reducing service duplication across CN and RAN. A service-based architecture may include horizontal service devices 415 (which may refer to or include basic or public services for network access), RAN 410, and a set of vertical service devices 425 (which may refer to or include applications). Horizontal service devices 415 or vertical service devices 425 may be configured with interfaces (such as application programming interfaces (APIs)) and may be implemented by a service server, which may be a device or cloud-specific implementation (e.g., a virtual machine). Nodes of vertical service devices 425 or RAN 410 can interact with horizontal service devices 415 (such as horizontal service devices 415a, 415b, 415c, 415d, or 415e) using these interfaces. The difference between a service-based architecture and a CN-based architecture is that services or functions related to a given functionality (such as mobility) can be deployed and / or executed by a single, independent horizontal service appliance 415, rather than integrated into CN functions (e.g., Access and Mobility Management Functions (AMF), User Plane Functions (UPF), Session Management Functions (SMF), or another core network function) and RAN nodes. For example, a DU can interact with mobility services that can handle the selection of a target DU and configuration or other signaling related to mobility operations, rather than CN functions and RAN nodes communicating with each other to perform mobility operations for a UE or DU.

[0096] As shown in the figure, RAN 410 may include DUs (e.g., network node 110, DU 330), wireless LAN nodes, physical radio interfaces (e.g., network node 110) (e.g., exemplified as IAB, RU 340, or a relay), etc. For example, RAN 410 may include one or more gNBs. RAN 410 may communicate via one or more RATs, such as PC5 for sidelink communication (where PC5 may be considered part of another RAT), 4G, 5G, 6G, another RAT, or a combination thereof.

[0097] The horizontal service device set 415 may include, for example, a security context storage service device 415a, a security service device 415b, a mobility service device 415c, a transport service device 415d, and / or a policy service device 415e. The security context storage service device 415a may store contexts used during the operation of the RAN 410, the horizontal service device 415, or the vertical service device 425, such as security contexts or other forms of context. A context may include a set of information associated with a specific device or service. For example, a UE context may include a set of information and parameters associated with a specific UE. Security contexts (such as user plane security contexts) may include a set of security-related parameters associated with a specific device 405, a specific service device 415 / 425, or a combination thereof. For example, a security context may indicate security keys and / or other parameters for secure communication between two parties in a service-based architecture.

[0098] The security service device 415b can perform operations related to maintaining a secure connection between the service-based architecture device 405 and one or more service devices 415 / 425. For example, the security service device 415b can perform authentication for the device 405 or the service devices 415 / 425. As another example, the security service device 415b can perform key establishment for the device 405 or the service devices 415 / 425. As yet another example, the security service device 415b can perform key distribution or provision associated with the secure establishment or updating of the device 405 and / or the service devices 415 / 425. In some aspects, the security service device 415b can prepare a security context for the device 405, such as a user-plane security context.

[0099] Mobility service device 415c can perform mobility-related operations of device 405, such as paging, location updates, handover preparation, and identification of the target DU. Transport service device 415 can locate UPSA 420 for device 405 and / or can prepare user plane security context for device 405 (which may or may not include the security context described above).

[0100] In some examples, device 405 may use the security context associated with device 405 and a given service device 415 / 425 to communicate with that service device 415 / 425. This is illustrated by a square with a given shade or fill at device 405 and a corresponding square with a given shade or fill at service device 415 / 425. Figure 4 In the example, device 405 is associated with a set of security contexts 430a, 430b, 430c, and 430d (collectively referred to as security context 430). Although Figure 4The security context set 430 is shown as including four security contexts, but it should be understood that in other examples, the security context set 430 may include more or fewer security contexts.

[0101] For example, device 405 can use security context 430d, illustrated by the vertical stripe filling, to communicate with mobility service device 415c. As another example, device 405 can use security context 430c to communicate with the DU of RAN 410. As another example, device 405 can use security context 430b to communicate with UPSA 420. As another example, device 405 can use security context 430a to communicate with location service device 425. Furthermore, security service device 415b can manage these security contexts 430a, 430b, 430c, and 430d. Therefore, all these security contexts 430a, 430b, 430c, and 430d are illustrated at security service device 415b (represented as squares with corresponding shading or filling). Physical and MAC layer security can be provided between device 405 and RAN 410.

[0102] Horizontal service device 415 can perform network functions that can be used across vertical service device 425. For example, vertical service device 425 (which may include, for example, location services, voice services, edge services, XR services, Internet services, etc.) may correspond to applications that device 405 can communicate with. Horizontal service device 415 can provide network functions to support communication between device 405 and vertical service device 425. Therefore, horizontal service device 415 may be referred to as a horizontal service, and vertical service device 425 may be referred to as a vertical service. UPSA 420 can handle user plane security service device functions, such as key storage for accessing the network or service device 425.

[0103] As indicated above, Figure 4 This is provided as an example. Other examples are available with reference to [the relevant information]. Figure 4 The examples described are different.

[0104] Figure 5This is a diagram illustrating Example 500 of a trust establishment process for a security service device in a wireless network according to this disclosure. Example 500 includes at least one of a security service device 505 (e.g., security service device 415b), a device 510 (e.g., device 405, UE 120, network node 110, or another device capable of communicating via the RAN), and a horizontal service device 515 (e.g., horizontal service device 415), a vertical service device 520 (e.g., vertical service device 425), or a security service device 525 associated with a visited Public Land Mobile Network (PLMN). A PLMN is a network of a specific operator in a specific country, identified by a PLMN identifier or PLMN ID. In this context, a PLMN refers to a network operating using a given RAT (e.g., 6G). A home PLMN (hPLMN) may correspond to a network that device 510 subscribes to and is associated with a first operator or service provider. A visited PLMN (vPLMN) may correspond to a network that device 510 is roaming to and currently registered to, and this network may be provided by a different operator or service provider than the hPLMN. A reference to a given PLMN should be understood as referring to the network identified by the given PLMN.

[0105] The aspects described herein relate to establishing trust in a wireless network by facilitating authentication (such as remote authentication) from device 510 to security service device 505. "Authentication" is a process in which a dependent party (e.g., a service provider) assesses the trustworthiness of a remote peer entity based on evidence provided by or associated with the remote peer entity (such as a device or person). In the aspects described herein, the dependent party may include security service device 505 and / or services (such as horizontal service device 515, vertical service device 520, or security service device 525) or devices (such as a UE or network node) that perform authentication and assess the authentication and / or status of remote peer entities. In the aspects described herein, the remote peer entity may be device 510.

[0106] Proof can be different from authentication. For example, proof may involve device 510 providing security service device 505 with information about the current state of device 510 (called evidence). Proof enables security service device 505 (or an external authenticator) to determine whether device 510 is in a desired or anticipated state, thereby determining whether device 510 can be trusted. On the other hand, authentication typically involves verifying the identity of device 510 (i.e., identifying whether device 510 is the genuine device that device 510 claims to be).

[0107] Proof can provide benefits in wireless networks that authentication alone cannot achieve. For example, some wireless networks can perform subscription authentication based on the Subscriber Identity Module (SIM) credentials of device 510. Therefore, as long as device 510 has obtained valid subscription credentials for its subscription profile (provided by the mobile network operator (MNO) of device 510), device 510 can use the subscription profile to access the network and services (such as horizontal service 515 or vertical service 520). Furthermore, International Mobile Equipment Identity (IMEI) reporting may not fully authenticate device 510 and therefore may not be usable for establishing trust in the device, as a counterfeit IMEI may be configured and reported by device 510. This could lead to situations where compromised UEs launch attacks on the network, spoofed devices with valid SIMs are used for voice phishing attacks, or gray market or cloned devices are used to circumvent standards compliance authentication. Remote proof can provide an indication of whether device 510 is in a desired or anticipated state, thereby mitigating or eliminating the occurrence of attacks by compromised UEs, device identity spoofing, or circumvention of standards compliance authentication.

[0108] However, remote proofs can present certain challenges in wireless networks. For example, the diversity of device types, the variety of software versions that can operate on the devices, and the potential roaming scenarios (involving hPLMN and vPLMN) may make it difficult to scale remote proofs to a feasible scale for network coverage.

[0109] The aspects described herein provide proof performed by device 510, with security service device 505 acting as a root of trust for the proof. Additionally or alternatively, network nodes may utilize security service device 505 to perform proofs. A root of trust can be an entity that provides proof results for device 510 or a network node to other entities, enabling those entities to establish trust in device 510 or the network node. For example, other entities may include one or more of device 510, horizontal service device 515, vertical service device 520, security service device 525, or another network node. Therefore, security service device 505 can provide scalable proofs (or more precisely, proof results for devices or services) across multiple PLMNs (such as hPLMN and vPLMN), thereby reducing the difficulties described above. In some aspects, the proof can be performed in addition to authentication (e.g., in conjunction with authentication), providing reduced proof and verification overhead compared to performing proofs separately from authentication. Furthermore, the aspects described herein provide semi-dynamic or dynamic proofs as well as mutual proofs. Semi-dynamic proofs provide scalability by allowing security service appliance 505 to provide proof results previously obtained by security service appliance 505 over a period of time, thereby reducing signaling overhead. Dynamic proofs can support a variety of use cases, such as mutual proofs, thereby increasing the flexibility of network operation and proofs.

[0110] As indicated by reference numeral 530, device 510 (or network node) may provide authentication information to security service device 505. Authentication information may include verifiable claims, such as known security status information. In some aspects, authentication information may include entity authentication tokens. As indicated by reference numeral 535, security service device 505 may generate authentication results for device 510 (or network node). As indicated by reference numeral 540, security service device 505 may provide authentication results (or information derived from or related to authentication results) to horizontal service device 515, vertical service device 520, or security service device 525. As indicated by reference numeral 545, device 510 (or network node) may communicate with horizontal service device 515, vertical service device 520, or security service device 525. These operations are described in more detail elsewhere in this document. In some examples, signaling of example 500 (and examples 600, 700, 800, and 900 below) may be performed according to a protocol such as a remote authentication protocol.

[0111] As previously described, at reference numeral 535, the security service device 505 may generate (e.g., identify, determine) a proof result. For example, the security service device 505 may use a verification key (which may be associated with a reference value) to verify a claim of device 510. A claim may include, for example, information indicating location, UE identifier, hardware model information, hardware version, software version, measurement information, information about one or more submodules, etc. The verification key and / or reference value may indicate a specified value of the claim. If the claim conforms to or otherwise satisfies the specified value, the security service device 505 may generate a successful proof result. A proof result may be an evaluation (e.g., success, failure) of the proof (a set of claims) against an evaluation strategy, or it may also include a set of claims required for the proof to be evaluated by the security service device 505 or another entity against its service-specific evaluation strategy. In some other respects, another entity (such as a verifier separate from the security service device 505, which may be a trusted entity such as a manufacturer) may generate the proof result.

[0112] Therefore, the network (such as horizontal service device 525, vertical service device 520, or security service device 525) can verify the UE and its operational status. In this way, the risk of compromised UEs is reduced, the risk of grey market devices is reduced, and the problems associated with using only subscription authentication (thus reducing the feasibility of SIM card boxes and counterfeit IMEIs) are mitigated. Furthermore, verification can be performed in conjunction with the authentication process (e.g., piggybacking) or can be performed independently as needed. Additionally, the UE can verify the network (such as gNB, DU, or RU), thereby reducing the risk of encountering counterfeit base stations.

[0113] As indicated above, Figure 5 This is provided as an example. Other examples are available with reference to [the relevant information]. Figure 5 The examples described are different.

[0114] Figure 6 This is a diagram illustrating example 600 of signaling associated with remote authentication for establishing trust in a wireless network, according to various aspects of this disclosure. Example 600 includes an authenticator device 605 (such as UE 120 or network node 110), a first security service device 610 (such as security service device 505 or security service device 415b), a second security service device 615 (such as security service device 525 or security service device 415b), a vertical service device 620 (such as vertical service device 425 or vertical service device 520), and an authenticator 625. In example 600, the authenticator 625 is separate from the security service devices 610 / 615. For example, the authenticator 625 may be a vendor (e.g., UE vendor, network node vendor, etc.) associated with the authenticator device 605. In some other aspects, the first security service device 610 or the second security service device 615 may be the authenticator 625 (e.g., according to an evidence evaluation strategy, such as evidence evaluation strategy 950 described below).

[0115] An evaluation strategy for evidence can indicate the information to be included in evidence for a given service. For example, an evaluation strategy for evidence can indicate one or more statements to be included in the evidence, such as location, UE identifier, hardware model information, hardware version, software version, measurement information, information about one or more sub-modules, etc. As an example, a first service may request a first set of statements from the UE including location, UE identifier, and measurement information for evidence, and a vertical service may request a second set of statements from the UE including UE identifier, hardware model, and hardware version for evidence. A first evaluation strategy for evidence corresponding to the first service may indicate the first set of statements, and a second evaluation strategy for evidence corresponding to the vertical service may indicate the second set of statements.

[0116] As indicated by reference numeral 630, the certifier device 605 may provide evidence to the first security service device 610. As indicated by reference numeral 635, the first security service device 610 may provide evidence to the verifier 625. As indicated by reference numeral 640, the verifier 625 may provide a proof result to the first security service device 610. As indicated by reference numeral 645, the first security service device 610 may provide a proof result to the vertical service device 620. Additionally or alternatively, as indicated by reference numeral 650, the first security service device 610 may provide a proof result to the second security service device 615. The proof result may be an evaluation of the proof against an evaluation strategy (e.g., success, failure), or may also include a set of statements required by the service to evaluate the proof against its service-specific evaluation strategy.

[0117] In some respects, as indicated by reference numeral 655, the certifier device 605 may provide evidence to the second security service device 615. For example, the certifier device 605 may provide evidence to the second security service device 615 in conjunction with roaming on the network (vPLMN) of the second security service device 615. In this example, as indicated by reference numeral 660, the second security service device 615 may provide evidence (or information derived from evidence) to the first security service device 610. For example, the second security service device 615 may provide evidence to the first security service device 610 based at least in part on the association between the first security service device 610 and the hPLMN of the certifier device 605. The first security service device 610 may provide evidence to the verifier 625, as described with respect to reference numeral 635, and may receive proof results, as described with respect to reference numeral 640. The first security service device 610 may provide proof results to the second security service device 615, as described with respect to reference numeral 650. The second security service device 615 can provide proof results to the vertical service device 620 (such as a vertical service associated with a vPLMN), as indicated by reference numeral 665.

[0118] As indicated above, Figure 6 This is provided as an example. Other examples are available with reference to [the relevant information]. Figure 6 The examples described are different.

[0119] Figure 7This is a diagram illustrating example 700 of signaling associated with remote trust in a wireless network according to this disclosure. Example 700 includes device 702 (e.g., UE 120, device 405, device 510, certifier device 605), DU 704 (e.g., network node 110, DU 330, RAN 410, device 510, certifier device 605), serving device 706 (e.g., network node 110, vertical serving device 425, vertical serving device 525, vertical serving device 620), security serving device 708 (e.g., network node 110, security serving device 415b, security serving device 505, first security serving device 610, second security serving device 615), repository 710, and reference value provider (RVP) / endorser 712 (e.g., reference value provider 930 and / or endorser 935). Storage 710 may include entities storing values ​​related to remote authentication, such as reference values ​​from RVP / endorser 712 or endorsements from RVP / endorser 712, etc. In some aspects, storage 710 may be or include a Unified Data Repository (UDR). As shown, security service device 708 may access information about subscriptions (e.g., associated with a SIM) and policies (e.g., security policies, evaluation policies, etc.) via storage 710.

[0120] As shown by reference numeral 714 in the accompanying drawings, device 702 may send a service access request, and service device 706 may receive the service access request. The service access request may include a request for device 702 to access service device 706 (such as an application associated with service device 706). As shown, the service access request may include an access token. The access token may include information related to the request to access service device 706, such as credentials associated with device 702 and / or service device 706. In some aspects, the service access request may include a DU identifier corresponding to DU 704.

[0121] In some respects, device 702 may request proof results for DU 704 and / or serving device 706. For example, device 702 may request proof results in conjunction with a service access request (e.g., during or as part of a service access request, such as by including the DU identifier of DU 704 in the service access request). As another example, device 702 may request proof results prior to access layer (AS) security settings (e.g., UE 120 may request service proof results prior to AS security settings when requesting DU proof results). As another example, device 702 may request proof results periodically (e.g., according to periodicity). As another example, device 702 may request proof results "on demand" (e.g., in response to a trigger from another device or according to criteria at device 702).

[0122] As indicated by reference numeral 716 in the accompanying drawings, service device 706 may send a service key request to security service device 708. The service key request may request a security key for service device 706 (such as for a security context between device 702 and service device 706). As shown, in some aspects, the service key request may include a request for or associated with authentication information for device 702 and / or DU 704. Service device 706 may request authentication results for device 702 and / or authentication results for DU 706 from security service device 708. For example, service device 706 may represent a dependent party in a Remote Authentication (RATS) architecture, as described below. In some aspects, service device 706 may request authentication results for device 702 during service security establishment, as described below. In some other aspects, service device 706 may request authentication results periodically (e.g., according to periodicity). As another example, service device 706 may request authentication results “on demand” (such as in response to a trigger from another device or according to criteria at service device 706). In some respects, a request for proof may include one or more evaluation requirements, such as an evaluation strategy or instructions on a set of statements to be included in the evidence provided by device 702 or DU 704.

[0123] As indicated by reference numeral 718 in the accompanying drawings, two or more of devices 702, DU 704, service device 706, and / or security service device 708 may perform authentication and key negotiation. Authentication may include obtaining authentication parameters from devices 702, DU 704, and / or service device 706, and verifying the authentication parameters against an authentication policy. Key negotiation may include signaling for establishing a security key that will be used by devices 702, DU 704, and / or service device 706 to establish service security, as described below. For example, authentication may include proof of device identity based on device credentials, such as a Universal Integrated Circuit Card (UICC) (e.g., an embedded UICC (eUICC) or integrated UICC (iUICC) credential).

[0124] As indicated by reference numeral 720 in the accompanying drawings, device 702 and security service device 708 can perform security context establishment. Security context establishment may include establishing a security context between device 702 and security service device 708. Information obtained from security service device 708 may include, for example, security keys, information defining the security context, etc. In some aspects, as shown, security service device 708 may obtain authentication information from device 702 (shown as “remote authentication” between device 702 and security service device 708). For example, security service device 708 may request (e.g., trigger) authentication information to be provided by device 702. In some aspects, the request for authentication information may instruct a set of statements to be included in the authentication information (i.e., evidence), such as according to the evaluation requirements of service device 706. In some aspects, security service device 708 may additionally or alternatively combine security context establishment with obtaining authentication reference information 721 from repository 710 and / or RVP / endorser 712. For example, the authentication reference information 721 may include one or more reference values, one or more endorsements, or a combination thereof.

[0125] As indicated by reference numeral 722, in some examples, security service device 708 may obtain certification information from DU 704 and / or service device 706. For example, security service device 708 may request (e.g., trigger) certification information to be provided by DU 704 or service device 706. For example, security service device 708 may request certification information in conjunction with remote certification from DU 704. In some aspects, a request for certification information may instruct a set of statements to be included in the certification information (i.e., evidence), such as according to the evaluation requirements of device 702. In some aspects, security service device 708 may additionally or alternatively obtain certification reference information 723 from repository 710 and / or RVP / endorser 712 in conjunction with remote certification as indicated by reference numeral 722. For example, the certification reference information 723 may include one or more reference values, one or more endorsements, or a combination thereof.

[0126] As indicated by reference numeral 724 in the attached figure, in some aspects, the security service device 708 can obtain an evaluation strategy for evidence. For example, as regarding Figure 6 The evaluation strategy for the evidence described may be related to service equipment 706 and / or equipment 702.

[0127] As indicated by reference numeral 726 in the accompanying drawings, the security service device 708 can perform verification (e.g., authentication in conjunction with devices 702 and / or DU 704) and / or evaluation. Evaluation may include assessing proof information to determine a proof result, or may include retrieving proof results (e.g., if the security service device 708 has previously stored proof results for the corresponding certifier device). Therefore, the security service device 708 can perform an evaluation of the proof. The proof result corresponding to the evaluation may be stored at the security service device 708 along with evidence (e.g., a set of statements). Thus, as described above, the security service device 708 can avoid frequent proof triggering. In some aspects, the security device 708 can provide proof results and / or evidence to a service device (e.g., service device 706), a DU (e.g., DU 704), or a device (e.g., a UE such as device 702) (such as a service device requesting proof results) without performing separate proof.

[0128] The following provides a further description of the evaluation (generation or retrieval of the proof results) for equipment 702, DU 704 and service equipment 706.

[0129] In some respects, security service device 708 may obtain (e.g., retrieve) the certification result of device 702. In this example, security service device 708 may use the certification information provided by device 702 to determine the certification result. As another example, security service device 708 may retrieve the certification result from another entity (such as repository 710). If a previous certification result for device 702 is available (e.g., has not yet expired), security service device 708 may provide the previous certification result to service device 706 and / or device 702.

[0130] In some aspects, the security service appliance 708 may generate a proof result. For example, the security service appliance 708 may trigger a proof, and based on that proof, generate a proof result if a previous proof result for appliance 702 is unavailable. As another example, the security service appliance 708 may generate a proof result (which may include triggering a proof) if a previous proof result does not meet the evaluation requirements of an entity requesting proof information (such as service appliance 706). As another example, the security service appliance 708 may generate a proof result (which may include triggering a proof) if service appliance 706 has already requested an updated (e.g., recent) proof result for appliance 702. In some aspects, the security service appliance 708 may use proof reference information (such as reference values ​​and / or endorsements obtained from the repository 710 and / or RVP / endorser 712) to generate a proof result for appliance 702, as described elsewhere herein.

[0131] In some respects, security service device 708 may obtain (e.g., retrieve) the certification results of DU 704 and / or service device 706. For example, security service device 708 may use the certification information provided by DU 704 and / or service device 706 to determine the certification results. As another example, security service device 708 may retrieve certification results from another entity, such as repository 710. If a previous certification result for DU 704 and / or 706 is available (e.g., has not yet expired), security service device 708 may provide the previous certification result to device 702 and / or service device 706.

[0132] In some respects, security service device 708 may generate a proof result. For example, security service device 708 may trigger a proof, and based on that proof, a proof result may be generated if a previous proof result for DU 704 and / or service device 706 is unavailable. As another example, security service device 708 may periodically (e.g., according to network policies) generate proof results (which may include triggering proofs). As another example, security service device 708 may generate a proof result (which may include triggering proofs) if a previous proof result does not meet the evaluation requirements of an entity requesting proof information (such as device 702 or service device 706). As another example, if device 702 or service device 706 has requested an updated (e.g., recent) proof result for service device 706 or DU 704, security service device 708 may generate a proof result (which may include triggering proofs). In some respects, security service appliance 708 may use certification information (which may include reference values ​​and / or endorsements obtained from repository 710 and / or RVP / endorser 712) to generate certification results for DU 704 or service appliance 706, as described elsewhere herein.

[0133] In some respects, DU 704 or service device 706 may be implemented (e.g., instantiated) on a cloud platform. In this example, the certification may be associated with a cloud platform. Service device 706 or DU 704 instantiated on the cloud platform that provides certification information can provide a binding to the cloud platform. Therefore, certification can be provided for cloud-implemented services such as virtualized network functions, cloud-native network functions, or physical network functions (which may include, for example, DU or RU)

[0134] As shown by reference numeral 728 in the accompanying drawings, the security service device 708 may provide a service key response to the service device 706. The service key response may indicate a security key used for communication between device 702 and service device 706. As further shown, in some aspects, the security service device 708 may provide the service device 706 with an authentication result for device 702. For example, the security service device 708 may provide an authentication result with a service key response. As another example, the security service device 708 may provide the authentication result separately from the service key response.

[0135] As indicated by reference numeral 730 in the accompanying drawings, device 702 and service device 706 can perform a secure service establishment. For example, device 702 and service device 706 can establish a secure connection, such as using a security key provided by the secure service device 708. In some aspects, device 702 and / or service device 706 can perform a secure service establishment based at least in part on the proof result of device 702. For example, service device 706 can perform a secure service establishment in response to a proof result indicating that the state of device 702 conforms to a corresponding evaluation policy.

[0136] As shown by reference numeral 732 in the attached figure, the security service device 708 can provide the DU 704 with a security key (K) for the DU 704. DU The security key and / or AS security policy used for DU 704 can be used for AS security between DU 704 and device 702. As further shown, in some aspects, security service device 708 can provide DU 704 with an authentication result for DU 704. In some aspects, the security key used for DU 704 can be at least partially based on the authentication result. For example, the authentication result can be the input used to generate the security key.

[0137] As shown by reference numeral 734 in the accompanying drawings, DU 704 may (e.g., in an AS security mode command) provide device 702 with a proof result for DU 704. Furthermore, DU 704 and device 702 may perform an AS security establishment. For example, device 702 may, in response to the proof result of DU 704, instruct DU 704 that its state conforms to a corresponding evaluation policy to establish AS security with DU 704. In some aspects, security service device 708 may provide a proof result for DU 704 to service device 706, and service device 706 may provide a proof result to device 702. In some aspects, device 702 may use the proof result to generate a key corresponding to the security key used for DU 704. For example, the proof result may be input used to generate a security key at device 702. In this way, any manipulation of the proof result may cause the security establishment to fail (e.g., the AS security mode command fails).

[0138] As indicated above, Figure 7 This is provided as an example. Other examples are available with reference to [the relevant information]. Figure 7 The examples described are different.

[0139] Figure 8 This is a diagram illustrating example 800 of on-demand mutual authentication according to this disclosure. Example 800 includes device 802 (e.g., device 405 or 510, authenticator device 605, device 702, DU 704, or service device 706), peer 804 (such as UE 120, network node 110, DU, or service), and security service device 806 (e.g., network node 110, security service device 415b, security service device 505, first security service device 610, second security service device 615, security service device 708). In on-demand mutual authentication, both device 802 and peer 804 provide authentication information; the authentication result for device 802 is provided to peer 804, and the authentication result for peer 804 is provided to device 802. It should be noted that, in combination with... Figure 8 The described mutual proof can be performed periodically depending on the configuration (i.e., mutual proof does not need to be triggered or performed on demand).

[0140] As shown by reference numeral 808, in some examples, peer 804 may send a device mutual authentication request, and device 802 may receive a device mutual authentication request. The device mutual authentication request may request device 802 to initiate or provide information relating to a remote authentication process, as described elsewhere herein. As shown by reference numeral 810, device 802 may generate a first cryptographic random number (random number 1). The cryptographic random number may include any value generated for communication. In some aspects, the cryptographic random number is generated only for a single use (to prevent replay attacks or other disruptions). As shown by reference numeral 812, device 802 may provide a device authentication initiation message to peer 804, and the device authentication initiation message may indicate the first cryptographic random number and an identifier for device 802.

[0141] As shown by reference numeral 814 in the attached figure, peer 804 can generate a second password random number (random number 2). As shown by reference numeral 816 in the attached figure, peer 804 can provide a device authentication request to security service device 806. As shown, the device authentication request may include a first password random number, an identifier of device 802, a second password random number, and an identifier of peer 804.

[0142] As shown by reference numeral 818, the security service device 806 may generate a third cryptographic random number. As shown by reference numeral 820, the security service device 806 may send a device authentication request to the peer 804. The device authentication request may include a fourth cryptographic random number, which is a function of the first, second, and third cryptographic random numbers. As further shown, the device authentication request may indicate a set of statements (e.g., evidence) to be included in the authentication information of the peer 804 and / or device 802.

[0143] As shown by reference numeral 822, peer 804 may send a device authentication request to device 802. The device authentication request may include a fourth cryptographic random number and may indicate a set of statements to be included in the authentication information of device 802. As shown by reference numeral 824, device 802 may send authentication information (shown as device authentication), and peer 804 may receive authentication information (shown as device authentication). The authentication information may include the set of statements indicated by the device authentication request. In some aspects, the set of statements may be signed by device 802. For example, device 802 may use an identifier of peer 804 to sign the set of statements. In some aspects, the signed set of statements may be encrypted using the public key or shared key of security service device 806, thereby achieving privacy of the signed set of statements.

[0144] As shown by reference numeral 826 in the accompanying drawings, peer 804 may send a device authentication request to security service device 806. As illustrated, the device authentication request may include a set of signed claims provided by device 802. Furthermore, the device authentication request may include a set of claims provided by peer 804. In some aspects, the set of claims provided by peer 804 may be signed by peer 804. For example, peer 804 may use an identifier of UE 802 to sign the set of claims. In some aspects, the signed set of claims may be encrypted using the public key or shared key of security service device 806, thereby achieving privacy for the signed set of claims.

[0145] As indicated by reference numeral 828, the security service device 806 may perform authentication (e.g., the security service device 806 may perform authentication) to verify the identity of UE 802 and / or peer 804. Furthermore, the security service device 806 may verify multiple sets of claims provided by device 802 and peer 804, such as according to one or more evaluation strategies as described elsewhere herein, thereby generating proof results for device 802 and peer 804. As indicated by reference numeral 830, the security service device may provide a device verification response to peer 804. The device verification response may indicate proof results for device 802, proof results for peer 804, and optionally a certificate associated with the security service device 806. In some examples, the proof results for device 802 (and optionally, the corresponding evaluation strategy) may be encrypted (e.g., protected) using a security key shared by device 802 and the security service device 806, or may be signed by the security service device 806. In some examples, the proof result for peer 804 (and optionally, the corresponding evaluation strategy) can be encrypted (e.g., protected) using a security key shared by peer 804 and security service device 806, or can be signed by security service device 806.

[0146] As shown by reference numeral 832 in the accompanying drawings, peer 804 may provide a device authentication response to device 802. The device authentication response may indicate the authentication result against peer 804. As shown by reference numeral 834 in the accompanying drawings, device 802 may perform a key refresh with peer 804. For example, device 802 and peer 804 may use the authentication results against peer 804 and device 802 to generate or derive a secure key for communication between device 802 and peer 804.

[0147] As indicated above, Figure 8 This is provided as an example. Other examples are available with reference to [the relevant information]. Figure 8 The examples described are different.

[0148] Figure 9This is a diagram illustrating Example 900 of the RATS architecture according to this disclosure. Example 900 includes a validator 905 (e.g., a security service appliance as described above), a prover appliance 910 (e.g., appliance 405 or 510, prover appliance 605, appliance 702, DU 704, or service appliance 706), a dependent party 915 (e.g., a security service appliance, horizontal service, or vertical service as described above), a validator owner 920, a dependent party owner 925, a reference value provider 930 (e.g., RVP / endorser 712), and an endorser 935 (e.g., RVP / endorser 712). The information exchanged in Example 900 may include evidence 940, proof result 945, evaluation strategy 950 for evidence, evaluation strategy 955 for proof result, reference value 960, and endorsement 965. The RAT architecture provides a process by which devices (such as Dependent 915 or Verifier 905) verify that the Proofer Device 910 is in the expected operational state by generating, transmitting, and evaluating proof statements.

[0149] Verifier 905 may include evaluating the validity of evidence 940 and generating an entity for proof result 945 based on the evaluation of the validity of evidence 940. Evidence 940 may include a set of claims generated by prover device 910, such as configuration data, measurements, telemetry, or inferences. A claim may include a piece of information asserting a subject. Proof result 945 may include the output generated by verifier 905. Proverr device 910 may include the entity of its evidence 940 evaluated by verifier 905. In some aspects, evidence 940 may include an entity proof token (EAT). EAT may include a message (e.g., an encoded message) for transmitting a set of claims between two parties. EAT may include authenticity and integrity protection.

[0150] The dependent party 915 may include an entity that performs an application-specific action based on the validity of information about the prover device 910 (i.e., the proof result 945).

[0151] The validator owner 920 may include an entity authorized to configure an evaluation strategy 950 for evidence, such as an administrator. The evaluation strategy 950 for evidence may include a set of rules for evaluating the validity of information (i.e., evidence 940) from the validator device 910.

[0152] The dependent party owner 925 may include an entity authorized to configure an evaluation strategy 955 for the proof result, such as an administrator. The evaluation strategy 955 for the proof result may instruct a set of rules guiding the dependent party 915 on how to use the proof result 945.

[0153] The reference value provider 930 may include an entity, such as a manufacturer, that can provide reference values ​​960 for evaluating the evidence. Reference values ​​960 may include a set of values ​​that can be compared to the values ​​claimed in the evidence 940.

[0154] Endorser 935 may include an entity such as a manufacturer that can provide an endorsement 965 for evaluating the authenticity of the evidence. Endorsement 965 may include a security statement by endorser 935 guaranteeing the integrity of the capabilities of the certifier device 910.

[0155] As indicated above, Figure 9 This is provided as an example. Other examples are available with reference to [the relevant information]. Figure 9 The examples described are different.

[0156] Figure 10 This is a diagram illustrating an example process 1000 performed, for example, at a security service device or a device of a security service device according to this disclosure. Example process 1000 is an example in which a device or security service device (e.g., authenticator 905, security service device 806, network node 110, security service device 415b, security service device 505, first security service device 610, second security service device 615, security service device 708) performs operations associated with trust establishment in a wireless network.

[0157] like Figure 10 As shown, in some aspects, process 1000 may include receiving authentication information from at least one of the devices or services, the authentication information including verifiable information about the state of the device or the state of the service (box 1010). For example, a security service device (e.g., using...) Figure 12 The receiving component 1202 and / or communication manager 1206 depicted herein can receive authentication information from at least one of the devices or services, the authentication information including verifiable information about the status of the device or the status of the service, as described above.

[0158] like Figure 10 As further shown, in some aspects, process 1000 may include generating a proof result indicating whether the proof information meets the evaluation criteria (box 1020). For example, a security service device (e.g., using...) Figure 12 The communication manager 1206 depicted above can generate proof results indicating whether the proof information meets the evaluation criteria.

[0159] like Figure 10 As further shown, in some aspects, process 1000 may include receiving a request for proof results (box 1030). For example, a security service device (e.g., using...) Figure 12 The receiving component 1202 and / or communication manager 1206 depicted herein may receive requests for proof results, as described above.

[0160] like Figure 10As further shown, in some aspects, process 1000 may include providing proof results upon request (box 1040). For example, a security service device (e.g., using...) Figure 12 The communication manager 1206 depicted in the text can provide proof results upon request, as described above.

[0161] Process 1000 may include additional aspects, such as any single aspect or any combination of aspects described below and / or in conjunction with one or more other processes described elsewhere in this document.

[0162] In the first aspect, process 1000 includes requesting verification information before receiving verification information.

[0163] In the second aspect, either alone or in combination with the first aspect, process 1000 includes requesting proof information based on the proof initiation message.

[0164] In the third aspect, either alone or in combination with one or more of the first and second aspects, it is proven that the information indicates the state of the device and that the initiating message originated from the service.

[0165] In the fourth aspect, either alone or in combination with one or more of the first to third aspects, it is proven that the information indicates the status of the service and that the initiating message originated from the device.

[0166] In the fifth aspect, either alone or in combination with one or more of the first to fourth aspects, it is demonstrated that the initiating message includes a first value generated by the device and a second value generated by the service.

[0167] In the sixth aspect, either alone or in combination with one or more of the first to fifth aspects, the first value is a first cryptographic random number, and the second value is a second cryptographic random number.

[0168] In the seventh aspect, either alone or in combination with one or more of the first to sixth aspects, the request for proof information also includes requesting proof information based on the fact that a previous proof result has expired.

[0169] In the eighth aspect, either alone or in combination with one or more of the first to seventh aspects, the request for proof information also includes request for proof information associated with the device's service access request.

[0170] In the ninth aspect, the request for proof information may be made alone or in combination with one or more of the first to eighth aspects, and may also include requesting proof information periodically.

[0171] In the tenth aspect, either alone or in combination with one or more of the first to ninth aspects, the request for proof information indicates the proof information to be provided.

[0172] In the eleventh aspect, receiving certification information, either alone or in combination with one or more of the first to tenth aspects, also includes receiving certification information from the device and the service, wherein the certification results include a first certification result for the device and a second certification result for the service.

[0173] In the twelfth aspect, alone or in combination with one or more of the first to eleventh aspects, receiving certification information also includes receiving certification information from the service, wherein the certification information indicates the status of the device.

[0174] In the thirteenth aspect, the service is accessed by the device, either alone or in combination with one or more of the first to twelfth aspects.

[0175] In the fourteenth aspect, alone or in combination with one or more of the first to thirteenth aspects, the evidence information includes at least one of the following: location information, user equipment identifier, service identifier, hardware model information, version information, software version information, information, or information about the UE or a sub-module of the service.

[0176] In the fifteenth aspect, either alone or in combination with one or more of the first to fourteenth aspects, the service is associated with the cloud platform on which the service is instantiated, and the proof information is associated with the cloud platform.

[0177] In the sixteenth aspect, alone or in combination with one or more of the first to fifteenth aspects, the service includes at least one of virtualized network functions, cloud-native network functions, or physical network functions.

[0178] In the seventeenth aspect, providing proof results, either alone or in combination with one or more of the first to sixteenth aspects, also includes providing proof results in connection with the key generation operation of the device or service.

[0179] In the eighteenth aspect, alone or in combination with one or more of the first to seventeenth aspects, a security service device is a root of trust for the authentication of a device or service.

[0180] In the nineteenth aspect, alone or in combination with one or more of the first to eighteenth aspects, process 1000 includes: receiving device credentials associated with a device or service; and using the device credentials to authenticate the device or service.

[0181] In the twentieth aspect, alone or in combination with one or more of the first to nineteenth aspects, the device certificate includes at least one of an integrated general-purpose integrated circuit card (UICC) certificate or an embedded UICC certificate.

[0182] In aspect 21, providing proof results, either alone or in combination with one or more of aspects 1 to 20, also includes providing an evaluation strategy, wherein the evaluation strategy indicates one or more parameters of the evaluation conditions or proof information.

[0183] In aspect twenty-two, the evaluation strategy is service-specific, either alone or in combination with one or more of aspects one through twenty-one.

[0184] In aspect twenty-three, generating a proof result, either alone or in combination with one or more of aspects one through twenty-two, also includes verifying verifiable information based on remote proof operations or entity proof token operations.

[0185] In aspect 24, the service is associated with user equipment (UE) alone or in combination with one or more of aspects 1 to 23.

[0186] In the twenty-fifth aspect, alone or in combination with one or more of the first to twenty-fourth aspects, the service is associated with a first public land mobile network (PLMN), the security service equipment is associated with a second PLMN, and providing proof results also includes providing proof results to the service.

[0187] although Figure 10 An example box of process 1000 is shown, but in some aspects, process 1000 may include... Figure 10 The boxes depicted in the diagram may be fewer, different, or arranged differently than additional boxes. Alternatively, two or more boxes in the process 1000 may be executed in parallel.

[0188] Figure 11 This is a diagram illustrating an example process 1100 performed, for example, at a certifier device or a device of a certifier device, according to this disclosure. Example process 1100 is an example in which a device or certifier device (e.g., device 405 or 510, certifier device 605, device 702, DU 704, service device 706, device 802, peer 804, certifier device 910) performs operations associated with trust establishment in a wireless network.

[0189] like Figure 11 As shown, in some aspects, process 1100 may include receiving a request for proof information from a service, the proof information including verifiable information about the status of the proof device (box 1110). For example, the proof device (e.g., using...) Figure 13 The receiving component 1302 and / or communication manager 1306 depicted herein may receive a request for authentication information from the service, which includes verifiable information about the status of the authenticator device, as described above.

[0190] like Figure 11 As further shown, in some aspects, process 1100 may include sending proof information upon request (box 1120). For example, a proof device (e.g., using...) Figure 13 The sending component 1304 and / or communication manager 1306 depicted herein can send authentication information upon request, as described above.

[0191] Process 1100 may include additional aspects, such as any single aspect or any combination of aspects described below and / or in conjunction with one or more other processes described elsewhere in this document.

[0192] In the first respect, the proof device is user equipment.

[0193] In the second aspect, either alone or in combination with the first aspect, the proof device is a network node (such as a service or DU).

[0194] In a third aspect, either alone or in combination with one or more of the first and second aspects, process 1100 includes sending a cryptographic random number before sending the proof information, wherein the request for the proof information is based at least in part on the cryptographic random number.

[0195] In the fourth aspect, receiving a request for proof information, either alone or in combination with one or more of the first to third aspects, also includes receiving a request for proof information based on the expiration of a previous proof result.

[0196] In the fifth aspect, receiving a request for authentication information, either alone or in combination with one or more of the first to fourth aspects, also includes receiving a request for authentication information in connection with a service access request from a user equipment.

[0197] In the sixth aspect, receiving a request for proof information, either alone or in combination with one or more of the first to fifth aspects, also includes receiving a request for proof information periodically.

[0198] In the seventh aspect, either alone or in combination with one or more of the first to sixth aspects, the request for proof information indicates the proof information to be provided.

[0199] In the eighth aspect, either alone or in combination with one or more of the first to seventh aspects, the certifier device is a network node, and the certifying information further indicates the status of the user equipment (UE) associated with the network node.

[0200] In the ninth aspect, either alone or in combination with one or more of the first to eighth aspects, the network node is associated with a service or cell accessed by the UE.

[0201] In the tenth aspect, alone or in combination with one or more of the first to ninth aspects, the proof information includes at least one of the following: location information, user equipment identifier, service identifier, hardware model information, version information, software version information, information, or information about a sub-module of the proof device.

[0202] In the eleventh aspect, either alone or in combination with one or more of the first to tenth aspects, the certifier device is associated with a cloud platform on which services are instantiated, and the certifying information is associated with the cloud platform.

[0203] In the twelfth aspect, alone or in combination with one or more of the first to eleventh aspects, the service includes at least one of virtualized network functions, cloud-native network functions, or physical network functions.

[0204] In the thirteenth aspect, alone or in combination with one or more of the first to twelfth aspects, the service includes a security service device that is a root of trust for the authentication of the authenticator device.

[0205] In the fourteenth aspect, alone or in combination with one or more of the first to thirteenth aspects, process 1100 includes sending device credentials for authentication associated with the certifier device.

[0206] In the fifteenth aspect, alone or in combination with one or more of the first to fourteenth aspects, the device certificate includes at least one of an integrated general-purpose integrated circuit card (UICC) certificate or an embedded UICC certificate.

[0207] although Figure 11 An example box of process 1100 is shown, but in some respects, process 1100 may include... Figure 11 The boxes depicted in the diagram may be fewer, different, or arranged differently than additional boxes. Alternatively, two or more boxes in the process 1100 may be executed in parallel.

[0208] Figure 12 This is a diagram of an example apparatus 1200 for wireless communication according to the present disclosure. Apparatus 1200 may be a security service device, or a security service device may include apparatus 1200. In some aspects, apparatus 1200 includes a receiving component 1202, a transmitting component 1204, and / or a communication manager 1206 that can communicate with each other (e.g., via one or more buses and / or one or more other components). As shown, apparatus 1200 can use the receiving component 1202 and the transmitting component 1204 to communicate with another apparatus 1208 (such as a UE or a network node (such as a CU, DU, RU, or base station)).

[0209] In some respects, device 1200 can be configured to perform the functions described herein. Figures 4 to 9 One or more operations as described herein. Additionally or alternatively, the apparatus 1200 may be configured to perform one or more processes described herein (such as...). Figure 10 The process 1000) or a combination thereof. In some aspects, one or more components of the security service device may be implemented at least partially as software stored in one or more memories. For example, a component (or a portion thereof) may be implemented as instructions or code stored in a non-transitory computer-readable medium and may be executed by one or more controllers or one or more processors to perform the function or operation of the component.

[0210] Receiver 1202 may receive communications from device 1208, such as reference signals, control information, data communications, or combinations thereof. Receiver 1202 may provide the received communications to one or more other components of device 1200. In some aspects, receiver 1202 may perform signal processing on the received communications (such as filtering, amplification, demodulation, analog-to-digital conversion, demultiplexing, deinterleaving, demapping, equalization, interference cancellation, or decoding, etc.) and may provide the processed signals to one or more other components of device 1200. In some aspects, receiver 1202 may include one or more antennas of a security service device, one or more modems, one or more demodulators, one or more MIMO detectors, one or more receiver processors, one or more controllers / processors, one or more memories, or combinations thereof.

[0211] Transmitting component 1204 may transmit communications, such as reference signals, control information, data communications, or combinations thereof, to device 1208. In some aspects, one or more other components of device 1200 may generate communications and provide the generated communications to transmitting component 1204 for transmission to device 1208. In some aspects, transmitting component 1204 may perform signal processing (such as filtering, amplification, modulation, digital-to-analog conversion, multiplexing, interleaving, mapping, or encoding, etc.) on the generated communications and may transmit the processed signals to device 1208. In some aspects, transmitting component 1204 may co-located with receiving component 1202 in one or more transceivers.

[0212] The communication manager 1206 may support the operation of the receiving component 1202 and / or the transmitting component 1204. For example, the communication manager 1206 may receive information associated with configuring the reception of communications by the receiving component 1202 and / or the transmission of communications by the transmitting component 1204. Additionally or alternatively, the communication manager 1206 may generate control information and / or provide control information to the receiving component 1202 and / or the transmitting component 1204 to control the reception and / or transmission of communications.

[0213] The receiving component 1202 can receive certification information from at least one of the devices or services, the certification information including verifiable information about the status of the device or the service. The communication manager 1206 can generate a certification result indicating whether the certification information meets evaluation criteria. The receiving component 1202 can receive a request for the certification result. The communication manager 1206 can provide the certification result upon request.

[0214] The communication manager 1206 can request proof information before receiving proof information.

[0215] The communication manager 1206 can request proof information based on the proof initiation message.

[0216] The receiving component 1202 can receive device credentials associated with a device or service.

[0217] The Communication Manager 1206 can use device credentials to authenticate devices or services.

[0218] Figure 12 The number and arrangement of components shown are provided as an example. In practice, different arrangements may exist. Figure 12 The components shown are compared to additional components, fewer components, different components, or components arranged in a different manner. Furthermore, Figure 12 The two or more components shown can be implemented within a single component, or Figure 12 The single component shown can be implemented as multiple distributed components. Additionally or alternatively, Figure 12 The executable description of the collection of (one or more) components shown is composed of Figure 12 Another set of components shown performs one or more functions.

[0219] Figure 13 This is a diagram of an example apparatus 1300 for wireless communication according to the present disclosure. Apparatus 1300 may be a validator device (such as UE 120, network node 110, DU, RU, or service device 415 / 425), or a validator device may include apparatus 1300. In some aspects, apparatus 1300 includes a receiving component 1302, a transmitting component 1304, and / or a communication manager 1306 that can communicate with each other (e.g., via one or more buses and / or one or more other components). In some aspects, the communication manager 1306 is combined with... Figure 1 The described communication manager 140 or 150. As shown, device 1300 can use receiving component 1302 and transmitting component 1304 to communicate with another device 1308 (such as UE, network node (such as CU, DU, RU or base station)), service or security service equipment.

[0220] In some respects, device 1300 can be configured to perform the functions described herein. Figures 4 to 9 One or more operations as described herein. Additionally or alternatively, the apparatus 1300 may be configured to perform one or more processes described herein (such as...). Figure 11 Process 1100) or combinations thereof. In some aspects, device 1300 and / or Figure 13 One or more components shown may include combinations Figure 2 One or more components of the described proof device. Additionally or alternatively, Figure 13 One or more components shown can be combined Figure 2 Implementation within one or more of the described components. Additionally or alternatively, one or more components in the set of components may be implemented at least partially as software stored in one or more memories. For example, a component (or a portion thereof) may be implemented as instructions or code stored in a non-transitory computer-readable medium and executable by one or more controllers or one or more processors to perform the function or operation of the component.

[0221] Receiver 1302 may receive communications from device 1308, such as reference signals, control information, data communications, or combinations thereof. Receiver 1302 may provide the received communications to one or more other components of device 1300. In some aspects, receiver 1302 may perform signal processing on the received communications (such as filtering, amplification, demodulation, analog-to-digital conversion, demultiplexing, deinterleaving, demapping, equalization, interference cancellation, or decoding, etc.) and may provide the processed signals to one or more other components of device 1300. In some aspects, receiver 1302 may include combinations of... Figure 2 The described verifier device includes one or more antennas, one or more modems, one or more demodulators, one or more MIMO detectors, one or more receiver processors, one or more controllers / processors, one or more memories, or combinations thereof.

[0222] Transmitting component 1304 may transmit communications, such as reference signals, control information, data communications, or combinations thereof, to device 1308. In some aspects, one or more other components of device 1300 may generate communications and provide the generated communications to transmitting component 1304 for transmission to device 1308. In some aspects, transmitting component 1304 may perform signal processing (such as filtering, amplification, modulation, digital-to-analog conversion, multiplexing, interleaving, mapping, or encoding, etc.) on the generated communications and may transmit the processed signals to device 1308. In some aspects, transmitting component 1304 may include combinations of... Figure 2The described verifier device includes one or more antennas, one or more modems, one or more modulators, one or more transmit MIMO processors, one or more transmit processors, one or more controllers / processors, one or more memories, or combinations thereof. In some aspects, the transmit component 1304 may co-located with the receive component 1302 in one or more transceivers.

[0223] The communication manager 1306 may support the operation of the receiving component 1302 and / or the transmitting component 1304. For example, the communication manager 1306 may receive information associated with configuring the reception of communications by the receiving component 1302 and / or the transmission of communications by the transmitting component 1304. Additionally or alternatively, the communication manager 1306 may generate control information and / or provide control information to the receiving component 1302 and / or the transmitting component 1304 to control the reception and / or transmission of communications.

[0224] The receiving component 1302 can receive a request for proof information from the service, which includes verifiable information about the status of the proof device. The sending component 1304 can send the proof information upon request.

[0225] The sending component 1304 may send a password random number before sending the proof information, wherein the request for the proof information is at least partially based on the password random number.

[0226] Sending component 1304 can send device credentials for authentication associated with the certifier device.

[0227] Figure 13 The number and arrangement of components shown are provided as an example. In practice, different arrangements may exist. Figure 13 The components shown are compared to additional components, fewer components, different components, or components arranged in a different manner. Furthermore, Figure 13 The two or more components shown can be implemented within a single component, or Figure 13 The single component shown can be implemented as multiple distributed components. Additionally or alternatively, Figure 13 The executable description of the collection of (one or more) components shown is composed of Figure 13 Another set of components shown performs one or more functions.

[0228] The following provides an overview of some aspects of this disclosure:

[0229] Aspect 1: A method for wireless communication performed by a security service device, the method comprising: receiving authentication information from at least one of a device or a service, the authentication information including verifiable information about the state of the device or the state of the service; generating an authentication result indicating whether the authentication information satisfies evaluation criteria; receiving a request for the authentication result; and providing the authentication result according to the request.

[0230] Aspect 2: According to the method of aspect 1, the method further includes requesting the proof information before receiving the proof information.

[0231] Aspect 3: According to the method of aspect 2, the method further includes receiving a proof initiation message, wherein requesting the proof information further includes requesting the proof information based on the proof initiation message.

[0232] Aspect 4: According to the method of aspect 3, wherein the proof information indicates the state of the device, and the proof initiation message comes from the service.

[0233] Aspect 5: According to the method of aspect 3, wherein the proof information indicates the state of the service, and the proof initiation message originates from the device.

[0234] Aspect 6: According to the method of aspect 3, wherein the proof initiation message includes a first value generated by the device and a second value generated by the service.

[0235] Aspect 7: According to the method of aspect 6, wherein the first value is a first password random number and the second value is a second password random number.

[0236] Aspect 8: According to the method of aspect 2, requesting the proof information further includes requesting the proof information based on the fact that the previous proof result has expired.

[0237] Aspect 9: According to the method of aspect 2, requesting the proof information further includes requesting the proof information in association with a service access request of the device.

[0238] Aspect 10: According to the method of aspect 2, requesting the proof information further includes requesting the proof information periodically.

[0239] Aspect 11: The method according to aspect 2, wherein the request for the proof information indicates the proof information to be provided.

[0240] Aspect 12: The method according to any one of Aspects 1 to 11, wherein receiving the proof information further includes receiving the proof information from the device and the service, wherein the proof result includes a first proof result for the device and a second proof result for the service.

[0241] Aspect 13: The method according to any one of Aspects 1 to 12, wherein receiving the proof information further includes receiving the proof information from the service, wherein the proof information indicates the state of the service.

[0242] Aspect 14: The method according to aspect 13, wherein the service is accessed by the device.

[0243] Aspect 15: The method according to any one of Aspects 1 to 14, wherein the proof information includes at least one of the following: location information, user equipment identifier, service identifier, hardware model information, hardware version information, software version information, measurement information, or information about the UE or a sub-module of the service.

[0244] Aspect 16: The method according to any one of Aspects 1 to 15, wherein the service is associated with a cloud platform on which the service is instantiated, and wherein the proof information is associated with the cloud platform.

[0245] Aspect 17: The method according to aspect 16, wherein the service includes at least one of the following: virtualized network function, cloud-native network function, or physical network function.

[0246] Aspect 18: The method according to any one of Aspects 1 to 17, wherein providing the proof result further includes providing the proof result in association with a key generation operation of the device or the service.

[0247] Aspect 19: The method according to any one of Aspects 1 to 18, wherein the security service device is a root of trust for authentication of the device or the service.

[0248] Aspect 20: The method according to any one of aspects 1 to 19, the method further comprising: receiving a device credential associated with the device or the service; and using the device credential to authenticate the device or the service.

[0249] Aspect 21: According to the method of aspect 20, the device credential includes at least one of an integrated general-purpose integrated circuit card (UICC) credential or an embedded UICC credential.

[0250] Aspect 22: The method according to any one of aspects 1 to 21, wherein providing the proof result further includes providing an evaluation strategy, wherein the evaluation strategy indicates one or more parameters of the evaluation conditions or the proof information.

[0251] Aspect 23: The method according to aspect 22, wherein the evaluation strategy is specific to the service.

[0252] Aspect 24: The method according to any one of Aspects 1 to 23, wherein generating the proof result further includes verifying the verifiable information based on a remote proof operation or an entity proof token operation.

[0253] Aspect 25: The method according to any one of Aspects 1 to 24, wherein the service is associated with a user equipment (UE).

[0254] Aspect 26: The method according to any one of Aspects 1 to 25, wherein the service is associated with a first Public Land Mobile Network (PLMN), the security service device is associated with a second PLMN, and providing the proof result further includes providing the proof result to the service.

[0255] Aspect 27: A method of wireless communication performed by a certifier device, the method comprising: receiving a request for certifying information from a service, the certifying information including verifiable information about the state of the certifier device; and sending the certifying information according to the request.

[0256] Aspect 28: According to the method of aspect 27, the proof device is user equipment.

[0257] Aspect 29: The method according to any one of Aspects 27 to 28, wherein the certifier device is a network node.

[0258] Aspect 30: The method according to any one of Aspects 27 to 29, the method further comprising sending a cryptographic random number before sending the proof information, wherein the request for the proof information is based at least in part on the cryptographic random number.

[0259] Aspect 31: The method according to any one of Aspects 27 to 30, wherein receiving the request for the proof information further includes receiving the request for the proof information based on the fact that a previous proof result has expired.

[0260] Aspect 32: The method according to any one of Aspects 27 to 31, wherein receiving the request for the authentication information further includes receiving the request for the authentication information in association with a service access request of the user equipment.

[0261] Aspect 33: The method according to any one of aspects 27 to 32, wherein receiving the request for the proof information further includes receiving the request for the proof information periodically.

[0262] Aspect 34: The method according to any one of Aspects 27 to 33, wherein the request for the proof information indicates the proof information to be provided.

[0263] Aspect 35: The method according to any one of Aspects 27 to 34, wherein the certifier device is a network node, and wherein the certifying information further indicates the status of a user equipment (UE) associated with the network node.

[0264] Aspect 36: According to the method of aspect 35, the network node is associated with a service or cell accessed by the UE.

[0265] Aspect 37: The method according to any one of Aspects 27 to 36, wherein the proof information includes at least one of the following: location information, user equipment identifier, service identifier, hardware model information, hardware version information, software version information, measurement information, or information about a sub-module of the proof device.

[0266] Aspect 38: The method according to any one of Aspects 27 to 37, wherein the certifier device is associated with a cloud platform on which a service is instantiated, and wherein the certifying information is associated with the cloud platform.

[0267] Aspect 39: The method according to aspect 38, wherein the service includes at least one of the following: virtualized network function, cloud-native network function, or physical network function.

[0268] Aspect 40: The method according to any one of Aspects 27 to 39, wherein the service includes a security service device, the security service device being a root of trust for the authentication of the authenticator device.

[0269] Aspect 41: The method according to any one of Aspects 27 to 40, the method further comprising: sending device credentials for authentication associated with the certifier device.

[0270] Aspect 42: According to the method of aspect 41, the device credential includes at least one of an integrated general-purpose integrated circuit card (UICC) credential or an embedded UICC credential.

[0271] Aspect 43: An apparatus for wireless communication at a device, the apparatus comprising: one or more processors; one or more memories coupled to the one or more processors; and instructions stored in the one or more memories and executable by the one or more processors to cause the apparatus to perform the method according to one or more of aspects 1 to 42.

[0272] Aspect 44: An apparatus for wireless communication at a device, the apparatus comprising: one or more memories; and one or more processors coupled to the one or more memories, the one or more processors being configured to cause the device to perform the method according to one or more of aspects 1 to 42.

[0273] Aspect 45: An apparatus for wireless communication, the apparatus comprising at least one component for performing the method according to one or more of aspects 1 to 42.

[0274] Aspect 46: A non-transitory computer-readable medium storing code for wireless communication, said code including instructions executable by one or more processors to perform the methods described in one or more of aspects 1 to 42.

[0275] Aspect 47: A non-transitory computer-readable medium storing a set of instructions for wireless communication, the set of instructions comprising one or more instructions that, when executed by one or more processors of a device, cause the device to perform the method according to one or more of aspects 1 to 42.

[0276] Aspect 48: A device for wireless communication, the device comprising: a processing system including one or more processors and one or more memories coupled to the one or more processors, the processing system being configured to cause the device to perform the method according to one or more of aspects 1 to 42.

[0277] Aspect 49: An apparatus for wireless communication at a device, the apparatus comprising: one or more memories; and one or more processors coupled to the one or more memories, the one or more processors being individually or collectively configured to cause the device to perform the method according to one or more of aspects 1 to 42.

[0278] While the foregoing disclosure provides examples and descriptions, it is not intended to be exhaustive or to limit aspects to the precise forms disclosed. Modifications and variations can be made based on the foregoing disclosure, or from various aspects of practice.

[0279] As used herein, the term "component" is intended to be broadly interpreted as hardware or a combination of hardware and at least one of software or firmware. "Software" should be broadly interpreted as instructions, instruction sets, code, code segments, program code, programs, subroutines, software modules, applications, software applications, software packages, routines, subroutines, objects, executable programs, threads of execution, procedures, or functions, whether referred to as software, firmware, middleware, microcode, hardware description languages, or other terms. As used herein, a "processor" is implemented in hardware or a combination of hardware and software. It will be apparent that the systems or methods described herein may be implemented in various forms of hardware or combinations of hardware and software. The actual dedicated control hardware or software code used to implement these systems or methods is not limited in any way. Therefore, the operation and behavior of these systems or methods are described herein without reference to specific software code, as those skilled in the art will understand that the software and hardware can be designed to implement these systems or methods, at least in part, based on the description herein. Unless otherwise stated, a component configured to perform a function means that the component has the capability to perform that function, but it is not necessary for the component to actually perform that function.

[0280] As used in this article, depending on the context, "meeting the threshold" can mean a value greater than the threshold, greater than or equal to the threshold, less than the threshold, less than or equal to the threshold, equal to the threshold, not equal to the threshold, etc.

[0281] As used in this article, the phrase “at least one of” in a list of items refers to any combination of these items, including a single member. As an example, “at least one of the following: a, b, or c” is intended to cover a, b, c, a+b, a+c, b+c, and a+b+c, as well as any combination with multiple of the same element (e.g., a+a, a+a+a, a+a+b, a+a+c, a+b+b, a+c+c, b+b, b+b+b, b+b+c, c+c, and c+c+c, or any other ordering of a, b, and c).

[0282] No element, action, or instruction used herein should be construed as essential or necessary unless explicitly stated otherwise. Furthermore, as used herein, the articles “a” and “an” are intended to include one or more items and are interchangeable with “one or more.” Similarly, as used herein, the article “the” is intended to include one or more items mentioned in connection with the article “the” and is interchangeable with “one or more.” Furthermore, as used herein, the terms “group” and “cluster” are intended to include one or more entries and are interchangeable with “one or more.” If only one item is desired, the phrase “only one” or similar terminology will be used. Moreover, as used herein, the terms “having” and similar terms are intended as open-ended terms that do not limit the elements they modify (e.g., “having” A may also have B). Additionally, the phrase “based on” is intended to mean “based on or otherwise related to” unless otherwise explicitly stated. Furthermore, as used herein, the term “or” is intended to be inclusive when used consecutively and is interchangeable with “and / or” unless otherwise explicitly stated (e.g., if used in conjunction with “either of the two” or “only one of them”). It should be understood that “one or more” is equivalent to “at least one”.

[0283] Although specific combinations of features are set forth in the claims or disclosed in the description, these combinations are not intended to limit the disclosure of various aspects. Many of these features may be combined in ways not specifically stated in the claims or disclosed in the description. The disclosure of various aspects includes each dependent claim in combination with each other claim in the claim set.

Claims

1. An apparatus for wireless communication at a security service device, the apparatus comprising: One or more memory units; and One or more processors, said one or more processors coupled to said one or more memories, said one or more processors being configured to enable the security service device: Receive authentication information from at least one of the devices or services, the authentication information including verifiable information about the state of the device or the state of the service; Generate a proof result indicating whether the proof information meets the evaluation conditions; Receive a request for the proof result; as well as Provide the proof results according to the request.

2. The apparatus of claim 1, wherein the one or more processors are further configured to cause the security service device to request the authentication information before receiving the authentication information.

3. The apparatus of claim 2, wherein the one or more processors are further configured to cause the security service device to receive a proof initiation message, wherein, in order for the security service device to receive the proof information, the one or more processors are configured to cause the security service device to request the proof information based on the proof initiation message.

4. The apparatus of claim 3, wherein the proof information indicates the state of the device and the proof initiation message originates from the service, or wherein the proof information indicates the state of the service and the proof initiation message originates from the device.

5. The apparatus of claim 2, wherein, in order for the security service device to request the certification information, the one or more processors are configured to cause the security service device to request the certification information based on the fact that a previous certification result has expired.

6. The apparatus of claim 2, wherein, in order for the security service device to request the authentication information, the one or more processors are configured to associate the security service device with a service access request of the device to request the authentication information.

7. The apparatus of claim 1, wherein, in order for the security service device to receive the authentication information, the one or more processors are configured to cause the security service device to receive the authentication information from the device and the service, wherein the authentication result includes a first authentication result for the device and a second authentication result for the service.

8. The apparatus of claim 1, wherein, in order for the security service device to receive the authentication information, the one or more processors are configured to cause the security service device to receive the authentication information from the service, wherein the authentication information indicates the state of the service.

9. The apparatus of claim 1, wherein, in order for the security service device to provide the proof result, the one or more processors are configured to associate the security service device with a key generation operation of the device or the service to provide the proof result.

10. The apparatus of claim 1, wherein the one or more processors are configured to cause the security service device to: Receive device credentials associated with the device or the service; and Use the device credentials to authenticate the device or the service.

11. The apparatus of claim 1, wherein, in order for the security service device to generate the proof result, the one or more processors are configured to cause the security service device to verify the verifiable information based on a remote proof operation or an entity proof token operation.

12. The apparatus of claim 1, wherein the one or more processors are further configured to cause the security service device to provide the proof result to the service.

13. An apparatus for wireless communication at a validator device, the apparatus comprising: One or more memory units; and One or more processors, said one or more processors coupled to said one or more memories, said one or more processors being configured to enable the prover device: The service receives a request for proof information, which includes verifiable information about the state of the proof device; and Send the proof information according to the request.

14. The apparatus of claim 13, wherein the one or more processors are further configured to cause the proof device to send a cryptographic random number before sending the proof information, wherein the request for the proof information is based at least in part on the cryptographic random number.

15. The apparatus of claim 13, wherein, in order for the certifier device to receive the request for the certification information, the one or more processors are configured to cause the certifier device to receive the request for the certification information based on the fact that a previous certification result has expired.

16. The apparatus of claim 13, wherein, in order for the certifier device to receive the request for the certifying information, the one or more processors are configured to cause the certifier device to receive the request for the certifying information in association with a service access request of a user equipment.

17. The apparatus of claim 13, wherein, in order for the certifier device to receive the request for the certifying information, the one or more processors are configured to cause the certifier device to receive the request for the certifying information periodically.

18. The apparatus of claim 13, wherein the certifier device is a network node, and wherein the certifying information further indicates the status of a user equipment (UE) associated with the network node.

19. The apparatus of claim 13, wherein the one or more processors are further configured to cause the proof-of-concept device to: Send device credentials for authentication associated with the authenticator.

20. A method for wireless communication performed by a security service device, the method comprising: Receive authentication information from at least one of the devices or services, the authentication information including verifiable information about the state of the device or the state of the service; Generate a proof result indicating whether the proof information meets the evaluation conditions; Receive a request for the proof result; as well as Provide the proof results according to the request.

Images