Simultaneous security handling and reporting of subsequent mobility failures

Abstract

A method and apparatus for safe handling and reporting at subsequent mobility failures is provided. When a cell selection is triggered by detecting a failure of a cell handover from a source cell to a target cell, and the selected cell is the target cell, the wireless device can i) perform a security update for the target cell based on security information included in a cell handover command, and / or ii) can send a security key related to the failure of the cell handover to the network.

Description

Technical Field

[0001] This disclosure relates to the handling and reporting of subsequent mobility failures. Background Technology

[0002] The 3rd Generation Partnership Project (3GPP) Long Term Evolution (LTE) is a technology for enabling high-speed packet communication. Many proposals have been put forward for LTE objectives, including those aimed at reducing costs for users and providers, improving quality of service, and expanding and improving coverage and system capacity. 3GPP LTE requires lower cost per bit, increased service availability, flexible use of frequency bands, a simple architecture, open interfaces, and appropriate terminal power consumption as higher-level requirements.

[0003] 3GPP New Radio (NR) aims to address all use cases, requirements, and deployment scenarios with a single technology framework, including enhanced mobile broadband (eMBB), massive machine-type communications (mMTC), ultra-reliable low-latency communications (URLLC), and more. NR should be inherently forward-compatible. Furthermore, NR should be able to utilize any spectrum band ranging from at least 100 GHz, which can be used for wireless communication even in the more distant future.

[0004] 6G is the successor to 5G cellular technology. 6G networks will be able to use higher frequencies than 5G networks and offer significantly higher capacity and lower latency. The 6G technology market is expected to drive significant improvements in imaging, presence technology, and location awareness. Combined with artificial intelligence (AI) work, 6G computing infrastructure will be able to identify the optimal locations for computation. This includes decisions regarding data storage, processing, and sharing.

[0005] Layer 3-based mobility has evolved in several releases. Conditional handover (CHO) and other conditional mobility procedures (Conditional PSCell Addition and Change (CPAC), Subsequent CPAC (SCPAC)) were developed to achieve high robustness by allowing the procedure to be performed without prior signaling exchange with the source cell. L1 / L2 triggered mobility (LTM), as introduced in Rel-18, provides short downtime but does not have the same level of robustness as conditional L3 mobility procedures. In Rel-19, enhancements should be specified so that the system can benefit from both high robustness and short downtime. Summary of the Invention

[0006] Technical solution

[0007] In one aspect, a method is provided. The method includes receiving a cell handover command including security information from a source cell. The method further includes: based on a selected cell, which is the target cell in the event of a cell handover failure detected from the source cell to the target cell, performing a security update for the target cell based on the security information.

[0008] On the other hand, a method is provided. This method includes: based on a selected cell, since the cell selection at the time of detecting a cell handover failure from the source cell to the target cell is the target cell, sending a security key related to the cell handover failure to the network.

[0009] On the other hand, an apparatus for implementing the above method is provided. Attached Figure Description

[0010] Figure 1 An example of a communication system that applies the implementation of this disclosure is shown.

[0011] Figure 2 An example of a wireless device that applies the implementation of this disclosure is shown.

[0012] Figure 3 An example of a UE that applies the implementation of this disclosure is shown.

[0013] Figure 4 and Figure 5 An example of a protocol stack in a 3GPP-based wireless communication system using the implementation of this disclosure is shown.

[0014] Figure 6 The frame structure in a 3GPP-based wireless communication system implementing the present disclosure is shown.

[0015] Figure 7 An example of a data flow in a 3GPP NR system applying the implementation of this disclosure is shown.

[0016] Figure 8 An example of a gNB handover process using an implementation of this disclosure is shown.

[0017] Figure 9 An example of a signaling procedure for LTM using an implementation of this disclosure is shown.

[0018] Figure 10 An example of applying the implementation of this disclosure is shown.

[0019] Figure 11 An example of another method applying the implementation of this disclosure is shown.

[0020] Figure 12 An example of another method applying the embodiments of this disclosure is shown. Detailed Implementation

[0021] The following technologies, devices, and systems can be applied to a variety of wireless multiple access systems. Examples of these multiple access systems include Code Division Multiple Access (CDMA) systems, Frequency Division Multiple Access (FDMA) systems, Time Division Multiple Access (TDMA) systems, Orthogonal Frequency Division Multiple Access (OFDMA) systems, Single-Carrier Frequency Division Multiple Access (SC-FDMA) systems, and Multi-Carrier Frequency Division Multiple Access (MC-FDMA) systems. CDMA can be implemented using radio technologies such as Universal Terrestrial Radio Access (UTRA) or CDMA2000. TDMA can be implemented using radio technologies such as Global System for Mobile Communications (GSM), Universal Packet Radio Service (GPRS), or Enhanced Data Rate Evolution of GSM (EDGE). OFDMA can be implemented using radio technologies such as IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, or Evolved UTRA (E-UTRA). UTRA is part of the Universal Mobile Telecommunications System (UMTS). The 3rd Generation Partnership Project (3GPP) Long Term Evolution (LTE) is part of the Evolved UMTS (E-UMTS) using E-UTRA. 3GPP LTE employs OFDMA in the downlink (DL) and SC-FDMA in the uplink (UL). The evolution of 3GPP LTE includes LTE Advanced (LTE-A), LTE-A Pro, 5G New Radio (NR), and / or 6G.

[0022] For ease of description, the implementation of this disclosure is primarily described with respect to 3GPP-based wireless communication systems. However, the technical features of this disclosure are not limited thereto. For example, although the following detailed description is based on a mobile communication system corresponding to a 3GPP-based wireless communication system, aspects of this disclosure that are not limited to 3GPP-based wireless communication systems are applicable to other mobile communication systems.

[0023] For terms and techniques used in this disclosure that are not specifically described in this disclosure, please refer to previously published wireless communication standards documents.

[0024] In this disclosure, "A or B" may mean "A only", "B only", or "both A and B". In other words, in this disclosure, "A or B" can be interpreted as "A and / or B". For example, in this disclosure, "A, B or C" may mean "A only", "B only", "C only", or "any combination of A, B and C".

[0025] In this disclosure, a forward slash ( / ) or a comma (,) can mean "and / or". For example, "A / B" can mean "A and / or B". Therefore, "A / B" can mean "A only", "B only", or "both A and B". For example, "A, B, C" can mean "A, B, or C".

[0026] In this disclosure, "at least one of A and B" can mean "only A", "only B" or "both A and B". Furthermore, the expressions "at least one of A or B" or "at least one of A and / or B" in this disclosure can be interpreted as the same as "at least one of A and B".

[0027] Additionally, in this disclosure, "at least one of A, B, and C" may mean "A only", "B only", "C only" or "any combination of A, B, and C". Furthermore, "at least one of A, B, or C" or "at least one of A, B, and / or C" may mean "at least one of A, B, and C".

[0028] Furthermore, the brackets used in this disclosure may mean "for example". Specifically, when shown as "Control Information (PDCCH)", "PDCCH" can be cited as an example of "Control Information". In other words, "Control Information" in this disclosure is not limited to "PDCCH", and "PDCCH" can be cited as an example of "Control Information". Additionally, even when shown as "Control Information (i.e., PDCCH)", "PDCCH" can be cited as an example of "Control Information".

[0029] The technical features described individually in one of the accompanying drawings in this disclosure may be implemented individually or simultaneously.

[0030] Although not limited thereto, the various descriptions, functions, processes, suggestions, methods and / or operation flowcharts disclosed herein can be applied to various fields requiring wireless communication and / or connectivity between devices (e.g., 5G).

[0031] In the following description, this disclosure will be described in more detail with reference to the accompanying drawings. Unless otherwise stated, the same reference numerals in the following drawings and / or description may refer to the same and / or corresponding hardware blocks, software blocks and / or functional blocks.

[0032] Figure 1 An example of a communication system that applies the implementation of this disclosure is shown.

[0033] Figure 1 The 5G use cases shown are merely exemplary, and the technical features of this disclosure can be applied to scenarios not described herein. Figure 1 Other 5G use cases are shown in the diagram.

[0034] The three main demand categories for 5G include: (1) enhanced mobile broadband (eMBB), (2) massive machine-type communications (mMTC), and (3) ultra-reliable low-latency communications (URLLC).

[0035] Reference Figure 1 The communication system 1 includes wireless devices 100a to 100f, a base station (BS) 200, and a network 300. Although Figure 1 An example of a 5G network as a network of communication system 1 is illustrated, but the implementation of this disclosure is not limited to 5G systems and can be applied to future communication systems other than 5G systems.

[0036] BS 200 and network 300 can be implemented as wireless devices, and a particular wireless device can operate as a BS / network node relative to other wireless devices.

[0037] Wireless devices 100a to 100f represent devices that use radio access technology (RAT) (e.g., 5G NR or LTE) to perform communication and may be referred to as communication / wireless / 5G devices. Wireless devices 100a to 100f may include, but are not limited to, robots 100a, vehicles 100b-1 and 100b-2, extended reality (XR) devices 100c, handheld devices 100d, home appliances 100e, Internet of Things (IoT) devices 100f, and artificial intelligence (AI) devices / servers 400. For example, vehicles may include vehicles with wireless communication capabilities, autonomous vehicles, and vehicles capable of performing communication between vehicles. Vehicles may include unmanned aerial vehicles (UAVs) (e.g., drones). XR devices may include augmented reality (AR) / virtual reality (VR) / mixed reality (MR) devices and may be implemented in the form of head-mounted displays (HMDs), head-up displays (HUDs) installed in vehicles, televisions, smartphones, computers, wearable devices, home appliances, digital signage, vehicles, robots, etc. Handheld devices may include smartphones, smart tablets, wearable devices (e.g., smartwatches or smart glasses), and computers (e.g., laptops). Home appliances may include TVs, refrigerators, and washing machines. IoT devices may include sensors and smart meters.

[0038] In this disclosure, wireless devices 100a to 100f may be referred to as user equipment (UE). UE may include, for example, cellular phones, smartphones, laptop computers, digital broadcasting terminals, personal digital assistants (PDAs), portable multimedia players (PMPs), navigation systems, tablet PCs, ultrabooks, vehicles, vehicles with autonomous driving capabilities, connected cars, UAVs, AI modules, robots, AR devices, VR devices, MR devices, holographic devices, public safety devices, MTC devices, IoT devices, medical devices, Fintech devices (or financial devices), security devices, weather / environment devices, devices related to 5G services, or devices related to the Fourth Industrial Revolution.

[0039] Wireless devices 100a to 100f can connect to network 300 via BS 200. AI technology can be applied to wireless devices 100a to 100f, and wireless devices 100a to 100f can connect to AI server 400 via network 300. Network 300 can be configured using 3G networks, 4G (e.g., LTE) networks, 5G (e.g., NR) networks, and super 5G networks. Although wireless devices 100a to 100f can communicate with each other via BS 200 / network 300, wireless devices 100a to 100f can also perform direct communication with each other without going through BS 200 / network 300 (e.g., secondary link communication). For example, vehicles 100b-1 and 100b-2 can perform direct communication (e.g., vehicle-to-vehicle (V2V) / vehicle-to-everything (V2X) communication). IoT devices (e.g., sensors) can perform direct communication with other IoT devices (e.g., sensors) or other wireless devices 100a to 100f.

[0040] Wireless communication / connections 150a, 150b, and 150c can be established between wireless devices 100a to 100f and / or between wireless devices 100a to 100f and BS 200 and / or between BS 200. In this document, wireless communication / connections can be established via various RATs (e.g., 5G NR) such as uplink / downlink communication 150a, secondary link communication (or device-to-device (D2D) communication) 150b, and inter-base station communication 150c (e.g., relay, integrated access and backhaul (IAB)). Wireless devices 100a to 100f and BS 200 / wireless devices 100a to 100f can transmit / receive radio signals to / from each other via wireless communication / connections 150a, 150b, and 150c. For example, wireless communication / connections 150a, 150b, and 150c can transmit / receive signals via various physical channels. Therefore, at least a portion of various configuration information configuration processes, various signal processing processes (e.g., channel coding / decoding, modulation / demodulation, and resource mapping / demapping), and resource allocation processes for transmitting / receiving radio signals can be performed based on various proposals of this disclosure.

[0041] NR supports multiple parameter sets (and / or multiple subcarrier spacings (SCS)) to support a variety of 5G services. For example, a 15 kHz SCS can support wide-area coverage in traditional cellular bands, while a 30 kHz / 60 kHz SCS can support dense urban areas, lower latency, and wider carrier bandwidth. A 60 kHz or higher SCS can support bandwidths greater than 24.25 GHz to overcome phase noise.

[0042] NR bands can be defined as two types of frequency ranges: frequency range 1 (FR1) and frequency range 2 (FR2). The numerical values ​​of the frequency ranges can vary. For example, the two types of frequency ranges (FR1 and FR2) can be shown in Table 1 below. For ease of explanation, in the frequency ranges used in NR systems, FR1 can refer to "the range below 6 GHz," and FR2 can refer to "the range above 6 GHz," and can be referred to as millimeter wave (mmW).

[0043] [Table 1]

[0044] As mentioned above, the frequency range of the NR system can be varied. For example, FR1 can include 410 MHz to 7125 MHz as shown in Table 2 below. That is, FR1 can include a frequency band of 6 GHz (or 5850, 5900, 5925 MHz, etc.) or higher. For example, the frequency band of 6 GHz (or 5850, 5900, 5925 MHz, etc.) or higher included in FR1 can include unlicensed frequency bands. Unlicensed frequency bands can be used for various purposes, such as for vehicle communications (e.g., autonomous driving).

[0045] [Table 2]

[0046] Here, the radio communication technologies implemented in the wireless devices of this disclosure may include narrowband IoT (NB-IoT) technologies for low-power communication, as well as LTE, NR, and 6G. For example, NB-IoT technology may be an example of low-power wide-area network (LPWAN) technology, implemented in specifications such as LTE Cat NB1 and / or LTE Cat NB2, and may not be limited to the names mentioned above. Additionally and / or alternatively, the radio communication technologies implemented in the wireless devices of this disclosure may be based on LTE-M technology for communication. For example, LTE-M technology may be an example of LPWAN technology and is referred to by various names such as enhanced MTC (eMTC). For example, LTE-M technology may be implemented in at least one of various specifications such as 1) LTE Cat 0, 2) LTE Cat M1, 3) LTE Cat M2, 4) LTE non-bandwidth limited (non-BL), 5) LTE-MTC, 6) LTE machine-type communication, and / or 7) LTE M, and may not be limited to the names mentioned above. Additionally and / or alternatively, the radio communication technology implemented in the wireless devices of this disclosure may include at least one of ZigBee, Bluetooth, and / or LPWAN, taking into account low-power communication, and may not be limited to the names mentioned above. For example, ZigBee technology may generate personal area networks (PANs) associated with small / low-power digital communication based on various specifications such as IEEE 802.15.4, and may be referred to by various names.

[0047] Figure 2 An example of a wireless device that applies the implementation of this disclosure is shown.

[0048] exist Figure 2 In this context, the first wireless device 100 and / or the second wireless device 200 can be implemented in various forms depending on the usage / service. For example, {the first wireless device 100 and the second wireless device 200} can correspond to... Figure 1At least one of {wireless devices 100a to 100f and BS 200}, {wireless devices 100a to 100f and wireless devices 100a to 100f} and / or {BS 200 and BS 200}. The first wireless device 100 and / or the second wireless device 200 may be configured from various elements, devices / components and / or modules.

[0049] The first wireless device 100 may include at least one transceiver, such as transceiver 106; at least one processing chip, such as processing chip 101; and / or one or more antennas 108.

[0050] The processing chip 101 may include at least one processor, such as processor 102, and at least one memory, such as memory 104. Additionally and / or alternatively, memory 104 may be located outside the processing chip 101.

[0051] Processor 102 can control memory 104 and / or transceiver 106 and can be adapted to implement the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts described in this disclosure. For example, processor 102 can process information in memory 104 to generate first information / signal, and then transmit a radio signal including the first information / signal via transceiver 106. Processor 102 can receive a radio signal including a second information / signal via transceiver 106 and then store the information obtained by processing the second information / signal in memory 104.

[0052] Memory 104 may be operatively connected to processor 102. Memory 104 may store various types of information and / or instructions. Memory 104 may store firmware and / or software code 105 that implements code, commands, and / or sets of commands, which, when executed by processor 102, perform the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts disclosed in this disclosure. For example, firmware and / or software code 105 may implement instructions that, when executed by processor 102, perform the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts disclosed in this disclosure. For example, firmware and / or software code 105 may control processor 102 to execute one or more protocols. For example, firmware and / or software code 105 may control processor 102 to execute one or more layers of a radio interface protocol.

[0053] In this document, processor 102 and memory 104 may be part of a communication modem / circuit / chip designed to implement RAT (e.g., LTE or NR). Transceiver 106 may be connected to processor 102 and transmit and / or receive radio signals via one or more antennas 108. Each of transceivers 106 may include a transmitter and / or a receiver. Transceivers 106 may be used interchangeably with radio frequency (RF) units. In this disclosure, first wireless device 100 may represent a communication modem / circuit / chip.

[0054] The second wireless device 200 may include at least one transceiver, such as transceiver 206; at least one processing chip, such as processing chip 201; and / or one or more antennas 208.

[0055] The processing chip 201 may include at least one processor, such as processor 202, and at least one memory, such as memory 204. Additionally and / or alternatively, memory 204 may be located outside the processing chip 201.

[0056] Processor 202 can control memory 204 and / or transceiver 206 and can be adapted to implement the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts described in this disclosure. For example, processor 202 can process information in memory 204 to generate third information / signal, and then transmit a radio signal including the third information / signal via transceiver 206. Processor 202 can receive a radio signal including a fourth information / signal via transceiver 106, and then store the information obtained by processing the fourth information / signal in memory 204.

[0057] Memory 204 may be operatively connected to processor 202. Memory 204 may store various types of information and / or instructions. Memory 204 may store firmware and / or software code 205 that implements code, commands, and / or sets of commands, which, when executed by processor 202, perform the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts disclosed in this disclosure. For example, firmware and / or software code 205 may implement instructions that, when executed by processor 202, perform the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts disclosed in this disclosure. For example, firmware and / or software code 205 may control processor 202 to execute one or more protocols. For example, firmware and / or software code 205 may control processor 202 to execute one or more layers of a radio interface protocol.

[0058] In this document, processor 202 and memory 204 may be part of a communication modem / circuit / chip designed to implement RAT (e.g., LTE or NR). Transceiver 206 may be connected to processor 202 and transmit and / or receive radio signals via one or more antennas 208. Each of transceivers 206 may include a transmitter and / or a receiver. Transceivers 206 may be used interchangeably with RF units. In this disclosure, second wireless device 200 may represent a communication modem / circuit / chip.

[0059] The hardware elements of wireless devices 100 and 200 will be described in more detail below. One or more protocol layers may be implemented by, but are not limited to, one or more processors 102 and 202. For example, one or more processors 102 and 202 may implement one or more layers (e.g., functional layers such as the Physical (PHY) layer, Media Access Control (MAC) layer, Radio Link Control (RLC) layer, Packet Data Convergence Protocol (PDCP) layer, Radio Resource Control (RRC) layer, and Service Data Adaptation Protocol (SDAP) layer). One or more processors 102 and 202 may generate one or more Protocol Data Units (PDUs), one or more Service Data Units (SDUs), messages, control information, data, or information in accordance with the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts disclosed in this disclosure. One or more processors 102 and 202 may generate signals (e.g., baseband signals) including PDUs, SDUs, messages, control information, data, or information, in accordance with the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts disclosed in this disclosure, and provide the generated signals to one or more transceivers 106 and 206. One or more processors 102 and 202 may receive signals (e.g., baseband signals) from one or more transceivers 106 and 206 and acquire PDUs, SDUs, messages, control information, data, or information, in accordance with the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts disclosed in this disclosure.

[0060] One or more processors 102 and 202 may be referred to as controllers, microcontrollers, microprocessors, or microcomputers. One or more processors 102 and 202 may be implemented through hardware, firmware, software, or a combination thereof. As an example, one or more processors 102 and 202 may include one or more application-specific integrated circuits (ASICs), one or more digital signal processors (DSPs), one or more digital signal processing devices (DSPDs), one or more programmable logic devices (PLDs), or one or more field-programmable gate arrays (FPGAs). For example, one or more processors 102 and 202 may be configured as a collection of communication control processors, application processors (APs), electronic control units (ECUs), central processing units (CPUs), graphics processing units (GPUs), and memory control processors.

[0061] One or more memories 104 and 204 may be connected to one or more processors 102 and 202 and store various types of data, signals, messages, information, programs, code, instructions, and / or commands. One or more memories 104 and 204 may be configured with random access memory (RAM), dynamic RAM (DRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EPROM), flash memory, volatile and non-volatile memory, hard disk drive, registers, cache memory, computer-readable storage media, and / or combinations thereof. One or more memories 104 and 204 may be located internally and / or externally to one or more processors 102 and 202. One or more memories 104 and 204 may be connected to one or more processors 102 and 202 via various technologies such as wired or wireless connections.

[0062] One or more transceivers 106 and 206 can transmit user data, control information, and / or radio signals / channels mentioned in the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts disclosed herein to one or more other devices. One or more transceivers 106 and 206 can receive user data, control information, and / or radio signals / channels mentioned in the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts disclosed herein from one or more other devices. For example, one or more transceivers 106 and 206 can be connected to one or more processors 102 and 202 and transmit and receive radio signals. For example, one or more processors 102 and 202 can perform control such that one or more transceivers 106 and 206 can transmit user data, control information, or radio signals to one or more other devices. One or more processors 102 and 202 can perform control such that one or more transceivers 106 and 206 can receive user data, control information, or radio signals from one or more other devices.

[0063] One or more transceivers 106 and 206 may be connected to one or more antennas 108 and 208. Additionally and / or alternatively, one or more transceivers 106 and 206 may include one or more antennas 108 and 208. One or more transceivers 106 and 206 may be adapted to transmit and receive user data, control information, and / or radio signals / channels mentioned in the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts disclosed herein. In this disclosure, one or more antennas 108 and 208 may be multiple physical antennas or multiple logical antennas (e.g., antenna ports).

[0064] One or more transceivers 106 and 206 can convert received user data, control information, radio signals / channels, etc., from RF band signals to baseband signals so that the received user data, control information, radio signals / channels, etc., can be processed by one or more processors 102 and 202. One or more transceivers 106 and 206 can also convert user data, control information, radio signals / channels, etc., processed by one or more processors 102 and 202 from baseband signals to RF band signals. For this purpose, one or more transceivers 106 and 206 may include (analog) oscillators and / or filters. For example, one or more transceivers 106 and 206, under the control of one or more processors 102 and 202, can upconvert OFDM baseband signals to OFDM signals using their (analog) oscillators and / or filters and transmit the upconverted OFDM signals at the carrier frequency. One or more transceivers 106 and 206 can receive OFDM signals at a carrier frequency and, under the control of one or more processors 102 and 202, down-convert the OFDM signals to OFDM baseband signals via their (analog) oscillators and / or filters.

[0065] Although Figure 2 Not shown, but wireless devices 100 and 200 may further include additional components. Additional component 140 may be configured differently depending on the type of wireless devices 100 and 200. For example, additional component 140 may include at least one of a power unit / battery, input / output (I / O) devices (e.g., audio I / O ports, video I / O ports), drive devices, and computing devices. Additional component 140 may be coupled to one or more processors 102 and 202 via various technologies such as wired or wireless connections.

[0066] In implementations of this disclosure, the UE can operate as a transmitting device in the UL and as a receiving device in the DL. In implementations of this disclosure, the BS can operate as a receiving device in the UL and as a transmitting device in the DL. For ease of description, hereinafter, it is primarily assumed that the first wireless device 100 is the UE and the second wireless device 200 is the BS. For example, a processor 102 connected to, mounted on, or activated therein of the first wireless device 100 can be adapted to perform UE behavior according to the implementation of this disclosure or to control the transceiver 106 to perform UE behavior according to the implementation of this disclosure. A processor 202 connected to, mounted on, or activated therein of the second wireless device 200 can be adapted to perform BS behavior according to the implementation of this disclosure or to control the transceiver 206 to perform BS behavior according to the implementation of this disclosure.

[0067] In this disclosure, BS is also referred to as Node B (NB), eNode B (eNB), or gNB.

[0068] Figure 3 An example of a UE that applies the implementation of this disclosure is shown.

[0069] Reference Figure 3 UE 100 can correspond to Figure 2 The first wireless device 100.

[0070] The UE 100 includes a processor 102, a memory 104, a transceiver 106, one or more antennas 108, a power management module 141, a battery 142, a display 143, a keyboard 144, a subscriber identification module (SIM) card 145, a speaker 146, and a microphone 147.

[0071] Processor 102 may be adapted to implement the descriptions, functions, procedures, suggestions, methods, and / or operation flowcharts disclosed in this disclosure. Processor 102 may be adapted to control one or more other components of UE 100 to implement the descriptions, functions, procedures, suggestions, methods, and / or operation flowcharts disclosed in this disclosure. A layer of the radio interface protocol may be implemented in processor 102. Processor 102 may include an ASIC, other chipsets, logic circuits, and / or data processing devices. Processor 102 may be an application processor. Processor 102 may include at least one of a DSP, CPU, GPU, and modem (modulator and demodulator). Examples of processor 102 can be found in Qualcomm... ® SNAPDRAGON™ series processors manufactured by Samsung ® EXYNOS™ series processors manufactured by [Company Name], A-series processors manufactured by Apple®, and MediaTek processors. ®HELIO™ series processors manufactured by Intel ® Manufactured ATOM™ series processors or corresponding next-generation processors.

[0072] Memory 104 is operatively coupled to processor 102 and stores various information to operate processor 102. Memory 104 may include ROM, RAM, flash memory, memory card, storage medium, and / or other storage devices. When the implementation is software-based, the techniques described herein can be implemented using modules (e.g., processes, functions, etc.) that perform the descriptions, functions, processes, suggestions, methods, and / or operation flowcharts disclosed herein. Modules can be stored in memory 104 and executed by processor 102. Memory 104 can be implemented within or outside processor 102, in which case memory 104 can be communicatively coupled to processor 102 via various means known in the art.

[0073] Transceiver 106 is operatively coupled to processor 102 and transmits and / or receives radio signals. Transceiver 106 includes a transmitter and a receiver. Transceiver 106 may include baseband circuitry for processing radio frequency signals. Transceiver 106 controls one or more antennas 108 to transmit and / or receive radio signals.

[0074] The power management module 141 manages the power of the processor 102 and / or transceiver 106. The battery 142 supplies power to the power management module 141.

[0075] Display 143 outputs the results processed by processor 102. Keyboard 144 receives input to be used by processor 102. Keyboard 144 may be displayed on display 143.

[0076] The SIM 145 is an integrated circuit designed to securely store the International Mobile Subscriber Identity (IMSI) number and its associated keys, used for identifying and authenticating subscribers on mobile devices such as mobile phones and computers. Contact information can also be stored on many SIM cards.

[0077] Speaker 146 outputs the sound-related results processed by processor 102. Microphone 147 receives the sound-related input to be used by processor 102.

[0078] Figure 4 and Figure 5 An example of a protocol stack in a 3GPP-based wireless communication system using the implementation of this disclosure is shown.

[0079] Specifically, Figure 4 An example of the user plane protocol stack for the radio interface between the UE and the BS is illustrated, and Figure 5An example of a radio interface control plane protocol stack between a UE and a BS is illustrated. The control plane refers to the path through which control messages used to manage calls made by the UE and the network are transmitted. The user plane refers to the path through which data generated in the application layer (e.g., voice data or Internet packet data) is transmitted. See reference... Figure 4 The user plane protocol stack can be divided into Layer 1 (i.e., the PHY layer) and Layer 2. (See reference...) Figure 5 The control plane protocol stack can be divided into Layer 1 (i.e., the PHY layer), Layer 2, Layer 3 (e.g., the RRC layer), and the Non-Access Layer (NAS). Layers 1, 2, and 3 are collectively referred to as the Access Layer (AS).

[0080] In 3GPP LTE systems, Layer 2 is separated into the following sublayers: MAC, RLC, and PDCP. In 3GPP NR systems, Layer 2 is separated into the following sublayers: MAC, RLC, PDCP, and SDAP. The PHY layer provides transport channels to the MAC sublayer, the MAC sublayer provides logical channels to the RLC sublayer, the RLC sublayer provides RLC channels to the PDCP sublayer, and the PDCP sublayer provides radio bearers to the SDAP sublayer. The SDAP sublayer provides Quality of Service (QoS) streams to the 5G core network.

[0081] In the 3GPP NR system, the main services and functions of the MAC sublayer include: mapping between logical channels and transport channels; multiplexing / demultiplexing MAC SDUs belonging to one or different logical channels to / from the transport channel to / from the physical layer to transport blocks (TBs); scheduling information reporting; error correction via Hybrid Automatic Repeat Request (HARQ) (one HARQ entity per cell in the case of carrier aggregation (CA); priority handling between UEs via dynamic scheduling; priority handling between logical channels of a UE via logical channel priority ordering; and padding. A single MAC entity can support multiple parameter sets, transmission timings, and cells. Mapping constraints in logical channel priority ordering control which parameter set(s), cell(s), and transmission timing(s) a logical channel(s) can use.

[0082] MAC provides different types of data transmission services. To accommodate these different services, various types of logical channels are defined, each supporting the transmission of a specific type of information. Each logical channel type is defined by the type of information being transmitted. Logical channels are divided into two groups: control channels and traffic channels. Control channels are used only for transmitting control plane information, and traffic channels are used only for transmitting user plane information. The Broadcast Control Channel (BCCH) is a downlink logical channel used for broadcasting system control information; the Paging Control Channel (PCCH) is a downlink logical channel for transmitting paging information, system information change notifications, and indications of ongoing Public Warning Service (PWS) broadcasts; the Common Control Channel (CCCH) is a logical channel used to send control information between the UE and the network and is used by UEs without an RRC connection to the network; and the Dedicated Control Channel (DCCH) is a point-to-point bidirectional logical channel used by UEs with an RRC connection to send dedicated control information between the UE and the network. The Dedicated Traffic Channel (DTCH) is a point-to-point logical channel dedicated to a single UE for transmitting user information. DTCHs can exist in both the uplink and downlink. In the downlink, the following connections exist between logical channels and transport channels: BCCH can be mapped to the broadcast channel (BCH); BCCH can be mapped to the downlink shared channel (DL-SCH); PCCH can be mapped to the paging channel (PCH); CCCH can be mapped to DL-SCH; DCCH can be mapped to DL-SCH; and DTCH can be mapped to DL-SCH. In the uplink, the following connections exist between logical channels and transport channels: CCCH can be mapped to the uplink shared channel (UL-SCH); DCCH can be mapped to UL-SCH; and DTCH can be mapped to UL-SCH.

[0083] The RLC sublayer supports three transmission modes: Transparent Mode (TM), Unacknowledged Mode (UM), and Acknowledged Mode (AM). RLC configuration is per logical channel and is not dependent on parameter sets and / or transmission duration. In 3GPP NR systems, the main services and functions of the RLC sublayer depend on the transmission mode and include: transmission of upper-layer PDUs; sequence numbering independent of sequence numbering in PDCP (UM and AM); error correction via ARQ (AM only); RLC SDU segmentation (AM and UM) and re-segmentation (AM only); SDU reassembly (AM and UM); duplicate detection (AM only); RLC SDU dropping (AM and UM); RLC reconstruction; and protocol error detection (AM only).

[0084] In 3GPP NR systems, the main services and functions of the PDCP sublayer for the user plane include: sequence numbering; header compression and decompression using Robust Header Compression (RoHC); transmission of user data; reordering and duplicate detection; in-order delivery; PDCP PDU routing (in the case of separate bearers); PDCP SDU retransmission; encryption, decryption, and integrity protection; PDCP SDU discarding; PDCP reconstruction and data recovery for RLC AM; PDCP status reporting for RLC AM; and PDCP PDU duplication and duplicate discarding indications to lower layers. The main services and functions of the PDCP sublayer for the control plane include: sequence numbering; encryption, decryption, and integrity protection; transmission of control plane data; reordering and duplicate detection; in-order delivery; and PDCP PDU duplication and duplicate discarding indications to lower layers.

[0085] In the 3GPP NR system, the main services and functions of SDAP include: mapping between QoS flows and data radio bearers; and marking QoS flow IDs (QFIs) in both DL and UL packets. A single protocol entity for SDAP is configured for each individual PDU session.

[0086] In the 3GPP NR system, the main services and functions of the RRC sublayer include: broadcasting system information related to AS and NAS; paging initiated by the 5G core network (5GC) or next-generation radio access network (NG-RAN); establishment, maintenance, and release of RRC connections between UE and NG-RAN; security functions including key management; establishment, configuration, maintenance, and release of signaling radio bearers (SRB) and data radio bearers (DRB); mobility functions (including: handover and context delivery, UE cell selection and reselection and control of cell selection and reselection, and inter-RAT mobility); QoS management functions; UE measurement reporting and control of reports; detection and recovery of radio link failures; and NAS message delivery from UE to NAS / from NAS to UE.

[0087] Figure 6 The frame structure in a 3GPP-based wireless communication system implementing the present disclosure is shown.

[0088] Figure 6The frame structure shown is merely exemplary, and the number of subframes, the number of time slots, and / or the number of symbols in a frame can vary. In 3GPP-based wireless communication systems, the OFDM parameter set (e.g., SCS, Transmission Time Interval (TTI) duration) can be configured differently across multiple cells aggregated for a UE. For example, if the UE is configured with different SCSs for cells aggregated for a cell, the (absolute time) duration of time resources (e.g., subframes, time slots, or TTIs) comprising the same number of symbols can be different across the aggregated cells. In this document, symbols can include OFDM symbols (or Cyclic Prefix (CP)-OFDM symbols) and SC-FDMA symbols (or Discrete Fourier Transform-Extended-OFDM (DFT-s-OFDM) symbols).

[0089] Reference Figure 6 Downlink and uplink transmissions are organized into frames. Each frame has a duration of Tf = 10 ms. Each frame is divided into two half-frames, each with a duration of 5 ms. Each half-frame comprises 5 subframes, each with a duration Tsf of 1 ms. Each subframe is divided into time slots, and the number of time slots in a subframe depends on the subcarrier spacing. Each time slot includes either 14 or 12 OFDM symbols based on the CP. In normal CP, each time slot includes 14 OFDM symbols, and in extended CP, each time slot includes 12 OFDM symbols. The parameter set is based on an exponentially scalable subcarrier spacing Δf = 2u. 15kHz.

[0090] Table 3 shows the results based on subcarrier spacing Δf = 2. u The number N of OFDM symbols per time slot at 15 kHz slot symb The number of time slots N in each frame frame,u slot And the number of time slots N for each subframe of a normal CP. subframe,u slot .

[0091] [Table 3]

[0092] Table 4 shows the results based on subcarrier spacing Δf = 2. u The number N of OFDM symbols per time slot at 15 kHz slot symb The number of time slots N in each frame frame,u slot And the number of time slots N for each subframe of the extended CP subframe,uslot .

[0093] [Table 4]

[0094] A time slot comprises multiple symbols (e.g., 14 or 12 symbols) in the time domain. For each parameter set (e.g., subcarrier spacing) and carrier, a common resource block (CRB) N is defined by higher-layer signaling (e.g., RRC signaling). start,u grid Initially, N was defined. size,u grid,x N RB sc Subcarriers and N subframe,u symb A resource grid of N OFDM symbols, where N size,u grid,x This represents the number of resource blocks (RBs) in the resource grid, where the subscript x represents the downlink DL and the uplink UL. N RB sc N is the number of subcarriers in each RB. In 3GPP-based wireless communication systems, N RB sc Typically, it is 12. For a given antenna port p, subcarrier spacing configuration u, and transmission direction (DL or UL), there exists a resource grid. The carrier bandwidth N for the subcarrier spacing configuration u is... size,u grid Given by higher-layer parameters (e.g., RRC parameters). Each element in the resource grid, configured for antenna port p and subcarrier spacing u, is called a resource element (RE), and a complex symbol can be mapped to each RE. Each RE in the resource grid is uniquely identified by an index k in the frequency domain and an index l representing the symbol position relative to a reference point in the time domain. In 3GPP-based wireless communication systems, RBs are defined by 12 consecutive subcarriers in the frequency domain.

[0095] In 3GPP NR systems, Resource Blocks (RBs) are classified into CRBs and Physical Resource Blocks (PRBs). CRBs are numbered upwards from 0 in the frequency domain based on the subcarrier spacing configuration u. The center of subcarrier 0 of CRB 0 for the subcarrier spacing configuration u coincides with "point A," which serves as the common reference point for the resource block grid. In 3GPP NR systems, PRBs are defined within the Bandwidth Part (BWP) and numbered from 0 to N. size BWP,i -1 is the number, where i is the number of the bandwidth section. The physical resource block n within bandwidth section i... PRB With public resource block n CRB The relationship between n is as follows: PRB =nCRB +N size BWP,i , where N size BWP,i The bandwidth portion is the common resource block starting relative to CRB 0. A BWP comprises multiple consecutive RBs. A carrier can include up to N (e.g., 5) BWPs. A UE can be configured with one or more BWPs on a given component carrier. Only one BWP can be active at a time among those configured for the UE. The active BWP is defined within the UE's operating bandwidth of the cell.

[0096] In this disclosure, the term "cell" can refer to a geographical area in which one or more nodes provide a communication system or to a radio resource. A "cell" as a geographical area can be understood as the coverage area within which a node can provide services using a carrier, and a "cell" as a radio resource (e.g., a time-frequency resource) is associated with bandwidth, which is a frequency range configured by a carrier. A "cell" associated with a radio resource is defined by a combination of downlink and uplink resources (e.g., a combination of DL component carriers (CC) and UL CC). A cell can be configured by downlink resources only, or it can be configured by both downlink and uplink resources. Since DL coverage (which is the range within which a node can transmit a valid signal) and UL coverage (which is the range within which a node can receive a valid signal from a UE) depend on the carrier carrying the signal, a node's coverage area can be associated with the coverage area of ​​the "cell" of the radio resources used by the node. Therefore, the term "cell" can be used to sometimes indicate the service coverage area of ​​a node, at other times to indicate a radio resource, or at other times to indicate the range within which a signal using a radio resource can reach with effective strength.

[0097] In CA, two or more CCs are aggregated. A UE can receive or transmit on one or more CCs simultaneously, depending on its capabilities. CA is supported for both continuous and non-continuous CCs. When CA is configured, the UE has only one RRC connection with the network. During RRC connection establishment / re-establishment / handover, one serving cell provides NAS mobility information, and during RRC connection re-establishment / handover, one serving cell provides security input. This cell is called the primary cell (PCell). The PCell is the cell operating on the primary frequency, where the UE performs the initial connection establishment procedure or initiates the connection re-establishment procedure. Depending on the UE's capabilities, secondary cells (SCells) can be configured to form a set of serving cells together with the PCell. An SCell is a cell that provides additional radio resources on top of a special cell (SpCell). Therefore, the set of serving cells configured for a UE always consists of one PCell and one or more SCells. For dual connectivity (DC) operation, the term "SpCell" refers to the PCell of the primary cell group (MCG) or the primary SCell (PSCell) of the secondary cell group (SCG). SpCell supports Physical Uplink Control Channel (PUCCH) transmission and contention-based random access, and is always active. MCG is the set of serving cells associated with the primary node, comprising SpCell (PCell) and optionally one or more SCells. For a UE configured with a DC, SCG is a subset of serving cells associated with the secondary node, comprising PSCell and zero or more SCells. For a UE in RRC_CONNECTED without a CA / DC, only one serving cell consisting of PCells exists. For a UE in RRC_CONNECTED with a CA / DC, the term "serving cell" is used to refer to the set of cells consisting of SpCell and all SCells. In the DC, two MAC entities are configured in the UE: one for the MCG and one for the SCG.

[0098] Figure 7 An example of a data flow in a 3GPP NR system applying the implementation of this disclosure is shown.

[0099] Reference Figure 7 “RB” indicates a radio bearer, and “H” indicates a header. Radio bearers are classified into two groups: DRBs for user plane data and SRBs for control plane data. MAC PDUs are sent / received to / from external devices via the PHY layer using radio resources. MAC PDUs arrive at the PHY layer in the form of transport blocks.

[0100] In the PHY layer, the uplink transport channel UL-SCH and random access channel (RACH) are mapped to their respective physical channels, the Physical Uplink Shared Channel (PUSCH) and Physical Random Access Channel (PRACH). Similarly, the downlink transport channels DL-SCH, BCH, and PCH are mapped to the Physical Downlink Shared Channel (PDSCH), Physical Broadcast Channel (PBCH), and PDSCH, respectively. In the PHY layer, uplink control information (UCI) is mapped to the physical PUCCH, and downlink control information (DCI) is mapped to the physical downlink control channel (PDCCH). MAC PDUs associated with UL-SCH are transmitted by the UE via PUSCH based on UL permission, and MAC PDUs associated with DL-SCH are transmitted by the BS via PDSCH based on DL assignment.

[0101] Network-controlled mobility applies to UEs under RRC_CONNECTED and is classified into two types of mobility: cell-level mobility and beam-level mobility. Beam-level mobility includes intra-cell beam-level mobility and inter-cell beam-level mobility.

[0102] Cell-level mobility requires the triggering of explicit RRC signaling, i.e., handover.

[0103] Figure 8 An example of a gNB handover process using an implementation of this disclosure is shown.

[0104] For handover between gNBs, the signaling process consists of at least [number] steps. Figure 8 It consists of the following basic components as described in the document.

[0105] 1. Step 1: The source gNB initiates the handover and sends a handover request (HANDOVER REQUEST) through the Xn interface.

[0106] 2. Step 2: The target gNB performs admission control and provides a new RRC configuration as part of the handover request acknowledgment.

[0107] 3. Step 3: The source gNB provides RRC configuration to the UE by forwarding the RRCReconfiguration message received in the HANDOVER REQUEST ACKNOWLEDGE message. The RRCReconfiguration message includes at least the cell ID and all the information required to access the target cell, enabling the UE to access the target cell without reading system information. In some cases, information required for contention-based and contention-free random access may be included in the RRCReconfiguration message. Access information for the target cell may include beam-specific information (if any).

[0108] 4. Step 4: The UE moves the RRC connection to the target gNB and replies with RRCReconfigurationComplete.

[0109] If permission is granted, user data can also be sent in step 4.

[0110] Beam-level mobility does not require explicit RRC signaling. Beam-level mobility can occur intra-cell or inter-cell, the latter being known as inter-cell beam management (ICBM). For ICBM, the UE can receive or transmit UE-dedicated channels / signals via a transmit / receive point (TRP) associated with a PCI different from the serving cell's Physical Cell ID (PCI), while non-UE-dedicated channels / signals can only be received via a TRP associated with the serving cell's PCI. The gNB provides the UE with a measurement configuration via RRC signaling, which includes Synchronization Signal Block (SSB) / Channel State Information (CSI) resources and resource sets, reports, and configurations for triggering channel and interference measurements and reports. In the case of ICBM, the measurement configuration includes SSB resources associated with a PCI different from the serving cell's PCI. Beam-level mobility is then processed at the lower layers via physical and MAC layer control signaling, and the RRC does not need to know which beam is being used at a given time.

[0111] SSB-based beam-level mobility is based on the SSB associated with the initial DL BWP and can only be configured for the initial DL BWP and DL BWPs containing the SSB associated with the initial DL BWP. For other DL BWPs, beam-level mobility can only be performed based on the CSI reference signal (RS).

[0112] Conditional handover (CHO) is defined as a handover performed by the UE when one or more handover execution conditions are met. The UE begins evaluating the execution conditions upon receiving the CHO configuration and stops evaluating the execution conditions once the handover is performed.

[0113] The following principles apply to CHO: - The CHO configuration includes the configuration of CHO candidate cells generated by the candidate gNB and the configuration of execution conditions generated by the source gNB.

[0114] - Execution conditions can consist of one or two trigger conditions (CHO event A3 / ...). Only a single RS type is supported, and up to two different trigger quantities (e.g., Reference Signal Received Power (RSRP) and Reference Signal Received Quality (RSRQ), RSRP and Signal-to-Interference-plus-Noise Ratio (SINR), etc.) can be configured simultaneously for the evaluation of CHO execution conditions for a single candidate cell.

[0115] - Before any CHO execution conditions are met, the UE executes the HO procedure upon receiving an HO command (without CHO configuration), regardless of any previously received CHO configuration.

[0116] - When executing CHO, that is, from the time when the UE begins to synchronize with the target cell, the UE does not monitor the source cell.

[0117] L1 / L2 triggered mobility (LTM) is the process by which the gNB receives an L1 measurement report from the UE, and based on this, the gNB changes the UE's serving cell via a cell handover command signaled via the MAC CE. The cell handover command indicates the LTM candidate cell configuration previously prepared by the gNB and provided to the UE via RRC signaling. The UE then hands over to the target cell according to the cell handover command. The LTM process can be used to reduce mobility latency.

[0118] When configured by the network, the Transport Configuration Index (TCI) state of one or more cells that are different from the currently serving cell can be activated. For example, the TCI state of LTM candidate cells can be activated in advance before any of these cells becomes the serving cell. This allows the UE to DL synchronize with those cells, thereby facilitating a faster cell handover to one of those cells when a cell handover is triggered.

[0119] When configured by the network, an early TA (Advance UL) acquisition procedure can be initiated for one or more cells different from the current serving cell. For example, the network can request the UE to perform early TA acquisition for a candidate cell before a cell handover. Early TA acquisition is triggered by a PDCCH command or by UE-based TA measurement. In the former case, the gNB to which the candidate cell belongs calculates the TA value and sends it to the gNB to which the serving cell belongs. When an LTM cell handover is triggered, the serving cell sends the TA value in the LTM cell handover command MAC CE. In the latter case, the UE applies the TA value measured by itself and performs RACH-less LTM upon receiving the cell handover command.

[0120] If UE-based TA measurement is configured, the UE performs a no-RACH LTM upon receiving a cell handover command. Otherwise, the UE determines whether to access the target cell using the RA procedure based on whether a TA value is provided in the cell handover command. For no-RACH LTM, the UE accesses the target cell via a configuration grant set in the LTM candidate cell configuration and selects the timing of the configuration grant associated with the beam indicated in the cell handover command. If the LTM candidate cell configuration does not include a configuration grant, the UE can monitor the PDCCH from the target cell for dynamic scheduling during LTM cell handover. If the UE does not have valid PUCCH resources for a triggered scheduling request (SR) before the no-RACH LTM procedure is completed, the UE may not trigger a random access procedure.

[0121] The following principles apply to LTM: - The UE does not update its security key after LTM cell handover within the gNB.

[0122] - Supports subsequent LTM.

[0123] LTM supports gNB-DU mobility between distributed cells (DUs) and centralized cells (CUs) within a gNB. LTM supports both intra-frequency and inter-frequency mobility, including mobility to inter-frequency cells that are not the current serving cell. It supports the following scenarios: - PCell changes in non-CA and non-DC scenarios - PCell changes in CA scenarios - Changes in MCG PCell and SCG PSCell (i.e., changes in PSCell within SN) in a DC scenario without MN participation.

[0124] Although the UE has stored the LTM candidate cell configuration, the UE can still execute any L3 handover command sent by the network.

[0125] Figure 9 An example of a signaling procedure for LTM using an implementation of this disclosure is shown.

[0126] Cell handover commands are transmitted in the MAC control element (CE), which contains the necessary information to perform LTM cell handover.

[0127] Subsequent LTMs are completed by repeating the early synchronization, LTM cell handover execution, and LTM cell handover completion steps without releasing the configuration of other LTM candidate cells after each LTM cell handover is completed.

[0128] The signaling process of LTM is as follows.

[0129] 1. Step 1: The UE sends a MeasurementReport message to the gNB. The gNB decides to configure LTM and initiates candidate cell preparation.

[0130] 2. Step 2: The gNB sends an RRCReconfiguration message to the UE, which includes the LTM candidate cell configuration of one or more candidate cells.

[0131] 3. Step 3: The UE stores the LTM candidate cell configuration and sends an RRCReconfigurationComplete message to the gNB.

[0132] 4a. Step 4a: Before receiving a cell handover command, the UE can perform DL synchronization with the candidate cell.

[0133] 4b. Step 4b: When UE-based TA measurement is configured, the UE can obtain the TA value of the candidate cell through measurement. Otherwise, the UE can perform early TA acquisition of the candidate cell upon network request before receiving a cell handover command. This can be done via contention-free random access (CFRA) triggered by a PDCCH command from the source cell, after which the UE can send a preamble to the indicated candidate cell. To minimize data interruption of the source cell due to CFRA towards the candidate cell, the UE may not receive a random access response from the network for the purpose of TA value acquisition and may indicate the TA value of the candidate cell in the cell handover command. The UE may not maintain a TA timer for the candidate cell and may rely on the network implementation to ensure TA validity.

[0134] 5. Step 5: The UE performs L1 measurements on the configured candidate cells and sends an L1 measurement report to the gNB. L1 measurements should be performed whenever RRC reconfiguration (step 2) is applicable.

[0135] 6. Step 6: The gNB decides to perform a cell handover to the target cell and sends a MAC CE to trigger the handover, including a candidate configuration index for the target cell. The UE switches to the target cell and applies the configuration indicated by the candidate configuration index.

[0136] 7. Step 7: If the UE does not have a valid TA for the target cell, the UE can perform a random access procedure toward the target cell. If the LTM cell handover command MAC CE contains information for CFRA, the UE can perform CFRA.

[0137] 8. Step 8: The UE completes the LTM cell handover process by sending an RRCReconfigurationComplete message to the target cell. If the UE has already performed the random access procedure in step 7, the UE considers the LTM cell handover to be successfully completed when the random access procedure is successfully completed. For LTM without RACH, the UE considers the LTM cell handover to be successfully completed when it determines that the network has successfully received its first UL data. The UE determines the successful reception of its first UL data by receiving the PDCCH of the UE's Cell Radio Network Temporary Identifier (C-RNTI) in the target cell. This PDCCH schedules new transmissions after the first UL data. The PDCCH carries the DL assignment or UL clearance for resolving the same HARQ procedure as the first UL data.

[0138] The LTM candidate cell configuration provided in step 2 can be used to execute steps 4 to 8 multiple times for subsequent LTMs.

[0139] It describes safe handling procedures in mobility.

[0140] Whenever it is necessary to establish the initial AS security context between the UE and the gNB / ng-eNB, the Access and Mobility Management Function (AMF) and the UE can derive K gNB and the next-hop parameter (NH). K gNB And NH is from K AMF Derived. NH chain counter (NCC) with each K gNB Associated with the NH parameter. Each K gNB It is associated with the NCC corresponding to the NH value derived from it. At the initial setup, K... gNB Directly from K AMF The derived NH value is then considered to be associated with a virtual NH parameter where the NCC value is zero. Initially, the derived NH value is associated with an NCC value of 1.

[0141] AMF may not send the NH value to the gNB / ng-eNB during the initial connection establishment. The gNB / ng-eNB may initialize the NCC value to zero after receiving the NGAP Initial Context Establishment Request message.

[0142] UE and gNB / ng-eNB use K gNB To protect communication between them. During handover and when transitioning from the RRC_INACTIVE state to the RRC_CONNECTED state, K will be used between the UE and the target gNB / ng-eNB. gNB The basis (called K) NG-RAN ) is from the currently active K gNBOr derived from the NH parameter. If K NG-RAN From the currently active K gNB If it is exported, then this is called horizontal key export, and if K NG-RAN If it is derived from the NH parameter, then the export is called a vertical key export.

[0143] Since the NH parameters can only be calculated by the UE and AMF, they are arranged so that the NH parameters are provided from the AMF to the gNB / ng-eNB in ​​a way that enables forward security.

[0144] In a handover with vertical key derivation, NH is used as K in the target gNB / ng-eNB. gNB Previously, NH was further bound to the target PCI and its frequency absolute radio frequency channel number (ARFCN) - DL. In the handover with horizontal key derivation, in the currently active K... gNB Used as K in the target gNB / ng-eNB gNB Previously, the currently active K gNB It is further bound to the target PCI and its frequency ARFCN-DL.

[0145] In intra-gNB CU handovers and ng-eNB handovers, the gNB can decide which intra-gNB CU handovers can retain K. gNB And in what situations is it necessary to export a new K? gNB The strategy involves the gNB instructing the UE in the HO command message whether to change or retain the current K during CU handover. gNB Keep the current K. gNB It can be done only during the CU handover within the gNB.

[0146] If we want to change the current K gNB Then gNB / ng-eNB and UE can use the target PCI, its frequency ARFCN-DL / E-UTRAN ARFCN(EARFCN)-DL and NH or current K gNB (Depending on the following criteria) to derive K NG-RAN If an unused {NH, NCC} pair is available in gNB, then gNB can use NH to derive K. NG-RAN (This is called vertical key derivation), otherwise, if no unused {NH, NCC} pair is available in the gNB, the gNB can derive the key from the current K. gNB Export K NG-RAN (This is called horizontal key export). The gNB can send the key export to the UE in the HO command message. NG-RAN The exported NCC. gNB / ng-eNB and UE can use K after handover. NG-RAN As K gNB .

[0147] If we want to retain the current K gNB Then gNB and UE can continue to use the current K after the handover. gNB .

[0148] This also applies when the gNB is implemented as a single unit (i.e., when the gNB is not divided into CU and DU).

[0149] During the Xn handover, the source gNB / ng-eNB can perform vertical key export if it has unused {NH, NCC} pairs. The source gNB / ng-eNB can first select the target PCI, its frequency ARFCN-DL / EARFCN-DL, and (in the case of horizontal key export) the currently active K... gNB Or (in the case of vertical key derivation) calculate K from NH NG-RAN .

[0150] Next, the source gNB / ng-eNB can {K NG-RAN The NCC forwards the data to the target gNB / ng-eNB. The target gNB / ng-eNB can directly use the received K. NG-RAN K, to be used with UE gNB The target gNB / ng-eNB can compare the NCC value received from the source gNB / ng-eNB with K. gNB Related. The target gNB / ng-eNB can include the received NCC in the prepared HO command message, which is sent back to the source gNB / ng-eNB in ​​a transparent container and then forwarded to the UE by the source gNB / ng-eNB.

[0151] When the target gNB / ng-eNB has completed handover signaling with the UE, it can send an NGAP path handover request message to the AMF. Upon receiving the NGAP path handover request, the AMF can increment its locally maintained NCC value by one and use a function to calculate the new fresh NH from its stored data. The AMF can use K from the currently active 5G NAS security context. AMFThe new, fresh NH is then calculated. The AMF can then send the newly calculated {NH, NCC} pair to the target gNB / ng-eNB in ​​the NGAP path switching request confirmation message. The target gNB / ng-eNB can store the received {NH, NCC} pair for further handover and remove any other existing, unused stored {NH, NCC} pairs (if any).

[0152] If AMF has already used the new K AMF If a new 5G NAS security context (different from the 5G NAS security context upon which the currently active 5G AS security context is based) is activated, but the UE context modification process has not yet been successfully executed, the sent NGAP path handover request confirmation message may additionally include a New Security Context Indicator (NSCI). In this case, the AMF can retrieve the new K... AMF The uplink NAS COUNT exported a new initial K in the recent NAS security mode completion message. gNB AMF can derive a new initial K. gNB This is associated with a new NCC value equal to zero. Then, the AMF can use the derived new initial K. gNB The newly calculated {NH, NCC} pair, initialized to zero, is sent as the new calculated {NH, NCC} pair to be sent in the NGAP path handover request confirmation message. In this case, the gNB / ng-eNB can then... keySetChangeIndicator The field's value is set to true. In this case, the gNB / ng-eNB should immediately perform a handover within the gNB / ng-eNB.

[0153] The key export mechanism described above can also be applied to CHO.

[0154] The UE behavior is the same regardless of whether the handover occurs within a gNB CU, ng-eNB, Xn, or N2, except that during a gNB CU handover, the UE can retain the same key based on instructions from the gNB. In the case of a CHO, the UE behavior is also the same; that is, the UE should retain the same key in K. NG-RAN The parameters of the selected target cell are used in the export.

[0155] If the UE also receives the NAS container (NASC) in the HO command message, the UE can update its NAS security context as follows: 1> The UE can verify the freshness of the downlink NAS COUNT in NASC.

[0156] 1> If NASC has indicated that a new K has been calculated AMF(That is, K_AMF_change_flag is one), 2> The UE can use the K from the current 5G NAS security context identified by ngKSI included in NASC. AMF And the downlink NAS COUNT in NASC is used to calculate the horizontally derived K. AMF .

[0157] 2> UE can assign the ngKSI included in NACS to the newly exported K AMF The ngKSI. UE can be further based on the horizontally derived K. AMF Configure NAS security using the NAS security algorithm selected in NASC.

[0158] 2> The UE can further verify the NAS MAC in the NASC, and if the verification is successful, the UE can further set the NAS COUNT to zero.

[0159] 1> If K is not indicated AMF Change, 2> If the verification is successful, the UE can configure NAS security based on the parameters included in NASC, but does not need to set NAS COUNT to zero.

[0160] 2> UE can verify the NAS MAC in NACS.

[0161] 2> The UE can further set the downlink NAS COUNT value of the currently active NAS security context to the downlink NAS COUNT value received in the NASC.

[0162] If NASC verification fails, the UE can abort the handover process. Furthermore, if a new NAS security context is derived, the UE can discard the new NAS security context and continue using the existing NAS and AS security contexts.

[0163] The UE can use K when communicating with the target gNB. NG-RAN As K gNB And K can be used when communicating with the target ng-eNB. NG-RAN As K eNB .

[0164] SK for dual connectivity between base stations eNB It is also used as the root of the security context at secondary base stations (e.g., secondary gNB (SgNB)). When used in a dual-connectivity context with an SgNB, this key can be referred to as SK. gNBThat is, the primary base station (e.g., primary eNB (MeNB) and / or primary gNB (MgNB)) generates an SK during the SgNB addition process or the SgNB modification process that requires a key update. gNB And forwarded it to SgNB.

[0165] Similarly, the MeNB / MgNB handles the SCG counter generated due to interaction with the SgNB for interaction with the SeNB; that is, it is a single shared SCG counter for both the SeNB and SgNB, and provides the UE with the same value of the SCG counter used, ensuring the use of a fresh radio bearer identifier or refresh of the SK. gNB .

[0166] When SgNB receives SK during the SgNB add / modify process gNB At that time, the SgNB can receive the SK gNB Export and store K SgNB-UP-enc and K SgNB-UP-int And if you want to add SRB, export and store K. SgNB-RRC-int and K SgNB-RRC-enc These newly exported keys are then used to protect all radio bearers using PDCP with SgNB. Any previous keys of this type can be deleted. If all keys have been exported, SK can be deleted. gNB .

[0167] If the UE receives a new SCG counter during the SgNB addition / modification process, the UE can derive the new SK from that SCG counter. gNB and using from the new SK gNB Exported K SgNB-UP-enc K SgNB-UP-int K SgNB-RRC-int and K SgNB-RRC-enc This serves as the key for protecting all radio bearers using the PDCP with the SgNB. If all keys are exported, the SK can be removed from the UE. gNB .

[0168] When the SgNB release procedure releases the last radio bearer on the SgNB, the SgNB and UE can delete K. SgNB-UP-enc K SgNB-UP-int K SgNB-RRC-int and K SgNB-RRC-enc If SK gNB If SK was not previously deleted, then SgNB and UE can also delete it. gNB .

[0169] The UE and MeNB / MgNB can export the security key SK of the target SgNB. gNB K SgNB-UP-encK SgNB-UP-int K SgNB-RRC-int and K SgNB-RRC-enc Both on the SgNB side and the UE side are from SK gNB Exported.

[0170] The system supports SK gNB Updates. MeNB / MgNB can be updated using SK. gNB SK updates during the update process for any reason gNB When the uplink or downlink PDCP count for any SgNB-terminated DRB or SgNB-terminated SRB is about to wrap around, the SgNB can request the MeNB / MgNB to update the SK via X2-C. gNB .

[0171] If MeNB / MgNB resets its currently active K in the AS security context eNB If the key is obtained, then the MeNB / MgNB can update any SK associated with that AS security context. gNB This preserves the two-hop safety attribute for X2 handover.

[0172] If MeNB / MgNB receives SK from SgNB gNB Update requests or self-determination to execute SK gNB Updated, MeNB / MgNB can then be used to calculate the fresh SK. gNB And increment the SCG counter. Then, MeNB / MgNB can perform the SgNB modification process to add fresh SK. gNB Delivered to SgNB. MeNB / MgNB can provide the UE with the necessary information for SK during the integrity-protected RRC process. gNB The exported SCG counter value. UE can export SK. gNB .

[0173] Whenever UE or SgNB starts using fresh SK gNB At that time, they can be obtained from fresh SK gNB Recalculate K SgNB-UP-int K SgNB-UP-enc K SgNB-RRC-int and K SgNB-RRC-enc .

[0174] The scenarios considered in LTM are limited to intra-CU situations, i.e., serving cell changes within multiple cells under a single CU. To enhance NR mobility, support for inter-CU LTM has been investigated. Specifically, support for subsequent LTM mobility procedures has been investigated, aiming to avoid RRC configuration between cell handovers according to the current LTM mechanism. In other words, inter-CU mobility should support initial serving cell and subsequent serving cell changes based on a single mobility configuration (i.e., no RRC reconfiguration between cell handovers). Because subsequent mobility (e.g., LTM and / or subsequent conditional PSCell addition and modification (SCPAC)) should be able to support continuous mobility based on pre-configuration without additional reconfiguration from the network, the UE can receive multiple security key values ​​required when performing inter-MN subsequent mobility.

[0175] However, when performing inter-MN follow-up mobility, a security mismatch may occur between the network and the UE. This is because if a mobility failure is declared during inter-MN follow-up mobility such as CHO and LTM, the UE can initiate a UE-based fault recovery process.

[0176] If the UE has already received multiple security key values ​​for subsequent inter-MN mobility (and in reality, mobility failures may occur due to security issues), the UE can revert from the target cell configuration to the source cell configuration, and then the UE can initiate UE-based fault recovery. During this process, the security information updated along with the target cell configuration should be considered invalid. However, in this case, there is currently no defined UE operation, so the network cannot know this, resulting in a security mismatch.

[0177] Therefore, the network may mistakenly believe that a usable security key value still exists among multiple security key values ​​used for subsequent inter-MN mobility, when in reality, the UE may not have a valid security key value. This security mismatch, which could cause data interruption, could lead to a connection reconstruction process.

[0178] According to embodiments of this disclosure, when a subsequent mobility failure is announced and / or detected while performing subsequent mobility, the UE may consider a security key value intended to be applied to the target cell as invalid. The UE may initiate a cell selection procedure for UE-based fault recovery. If the selected new cell is suitable for performing UE-based fault recovery, the UE may re-initiate subsequent mobility using the new security key value. When the re-initiated subsequent mobility is successfully completed, the UE may notify the network that the security key value intended to be applied to the target cell has been considered invalid by the UE based on the subsequent mobility failure.

[0179] According to embodiments of this disclosure, for subsequent mobility, the network can provide security information as a pre-configuration, including one or more lists of multiple security key values. The one or more lists of multiple security key values ​​may be designed to allow the UE to update security whenever subsequent mobility is performed without receiving configuration from the network (e.g., no RRC reconfiguration between cell handovers). The one or more lists of multiple security key values ​​can only be used for security updates when the UE performs inter-node subsequent mobility (e.g., inter-CU mobility). When the UE performs intra-node subsequent mobility (e.g., intra-CU mobility), the one or more lists of multiple security key values ​​may not be used for security updates. Furthermore, the security information may include one or more lists of multiple security key values ​​for multiple nodes for security updates, and when performing subsequent mobility, the UE can select one of the lists of multiple security key values ​​for the respective node from the one or more lists of multiple security key values ​​for multiple nodes.

[0180] According to embodiments of this disclosure, in order to select a security key value from a list of selected security key values, the UE can select a security key value sequentially or randomly (e.g., selecting a first or last value from the corresponding list). After a security update, when subsequent mobility is completed, the UE can report the updated security information to the network. This report may include the selected security key value and / or the derived gNB key. The UE can also consider the security key value used for the source cell as invalid, and if the used security key value is still included, it can remove (and / or exclude) the used security key value from the list of multiple security key values.

[0181] Otherwise, if the network commands subsequent mobility to the UE via RRC signaling or lower-layer signaling (e.g., MAC CE), the network can indicate a security key value from one or more lists of multiple security key values. In this case, the network can indicate the security key value as the index value in the subsequent mobility command, or the network can indicate only the security key value in the subsequent mobility command.

[0182] According to embodiments of this disclosure, for pre-configuration, the network may also provide one or more candidate cell information / configurations to be applied when performing subsequent mobility. Additionally and / or alternatively, the network may include one or more execution conditions corresponding to and / or associated with each candidate cell. If the UE receives one or more execution conditions for subsequent mobility, the UE may begin evaluating the execution conditions, and the UE may apply the corresponding candidate cell information / configuration for subsequent mobility only if at least one corresponding execution condition is met.

[0183] According to embodiments of this disclosure, for UE-based fault recovery, the network may provide indication / information to allow UE-based fault recovery for subsequent mobility failures before performing subsequent mobility. If the network allows, the UE may initiate additional subsequent mobility again based on the pre-configuration used for subsequent mobility after subsequent mobility has failed. More specifically, upon announcing / detecting a subsequent mobility failure, the UE may perform a cell selection procedure, and if the newly selected cell is one of the candidate cells for subsequent mobility, the UE may attempt additional subsequent mobility toward the newly selected cell for UE-based fault recovery, instead of performing an RRC connection re-establishment procedure.

[0184] According to embodiments of this disclosure, when performing UE-based fault recovery, the UE can use the security key value of the source cell for security updates to a newly selected cell from the cell selection process. For example, in the case of MN mobility, the UE can always use the security key value of the source cell (e.g., a horizontally derived version based on the source key KgNB) to perform security updates for security updates to a newly selected cell from the UE-based fault recovery.

[0185] Otherwise, the network may provide security information (e.g., NCC values) for one or more candidate cells in subsequent mobility commands for UE-based fault recovery. If security information for UE-based fault recovery is provided in a subsequent mobility command, the UE may first check whether a newly selected cell for UE-based fault recovery is suitable for using the security information. If the newly selected cell is suitable for using the security information, the UE may perform a security update (e.g., vertical export) for the newly selected cell based on the provided security information. If the newly selected cell is not suitable for using the security information, the UE may perform a security update (e.g., horizontal export) for the newly selected cell based on the security key value of the source cell.

[0186] If the network does not provide security information for UE-based fault recovery, and if the newly selected cell for UE-based fault recovery should use the same list of security keys used in subsequent mobility failures, the UE may simply use the next unused security key value from a pre-configured list of selected security key values ​​sequentially.

[0187] According to embodiments of this disclosure, when notifying the network of updated security information after successful UE-based fault recovery, the UE may send updated security information and / or invalid security information. Updated security information may include a new security key value for a candidate cell already selected from the UE-based fault recovery process. Invalid security information may include a security key value for another candidate cell where subsequent mobility failed before the UE-based fault recovery was performed. At the time of notification and / or after notification, if the used security key is still included, the UE may remove (and / or exclude) security key values ​​used for invalid security information from one or more lists of multiple security key values. The order of notification and removal of security key values ​​may vary, so the UE may remove (and / or exclude) them first and then notify the network.

[0188] The following figures are provided to illustrate specific embodiments of this disclosure. The names of specific devices or signals / messages / fields shown in the figures are provided by way of example only, and therefore, the technical features of this disclosure are not limited to the specific names used in the following figures.

[0189] The embodiments of this disclosure relating to the specific drawings below can be combined with various embodiments of this disclosure relating to other drawings, and some descriptions, functions, processes, proposals, methods and / or operations of these embodiments may be omitted.

[0190] The various embodiments disclosed herein can be combined with each other, and some descriptions, functions, processes, proposals, methods and / or operations of the various embodiments may be omitted.

[0191] Figure 10 Examples of methods for applying embodiments of this disclosure are shown.

[0192] In step S1000, the method includes receiving a cell handover command from a source cell. The cell handover command includes security information.

[0193] In some implementations, security information may include the NCC value for the target cell.

[0194] In step S1010, the method includes initiating a cell handover based on a cell handover command.

[0195] In step S1020, the method includes performing cell selection when a cell handover failure is detected.

[0196] In step S1030, based on the fact that the selected cell is a target cell among one or more candidate target cells for subsequent mobility, the method includes applying the configuration of the target cell.

[0197] For example, if cell selection is triggered by detecting a cell handover failure, and if the selected cell is the target cell among one or more candidate target cells for subsequent mobility, the radio device can perform UE-based fault recovery toward the target cell, such as applying the target cell's configuration.

[0198] In step S1040, the method includes performing a security update for the target cell based on security information.

[0199] In some implementations, the method may further include determining whether the selected cell is suitable for using security information for UE-based fault recovery. Based on whether the selected cell is suitable for using security information for UE-based fault recovery, the security update may correspond to a vertical export.

[0200] Otherwise, if the selected cell is not suitable for using security information for UE-based fault recovery, the security update can correspond to a horizontal export. In this case, the security update can be performed based on the security key of the source cell instead of the security information (e.g., NCC value) included in the cell handover command.

[0201] In some implementations, one or more candidate target cells can be configured based on candidate target cell configurations for each of the one or more candidate target cells.

[0202] Figure 11 An example of another method applying the embodiments of this disclosure is shown.

[0203] In step S1100, the method includes initiating a cell handover based on a cell handover command.

[0204] In some implementations, the method may further include receiving a pre-configuration from the network, comprising one or more lists of security key values. The list of one or more security key values ​​may be designed to allow the wireless device to perform a security update whenever subsequent mobility is performed, without receiving configuration from the network. The list of one or more security key values ​​may be used only for security updates when subsequent mobility is performed between nodes.

[0205] In some implementations, the method may further include selecting a list from one or more lists of security key values ​​for a target node serving a target cell.

[0206] In some implementations, the method may further include selecting a security key value from one or more lists of security key values.

[0207] In some implementations, pre-configuration may include one or more candidate cell configurations to be applied to subsequent mobility, and each of the one or more candidate cell configurations may include one or more execution conditions.

[0208] In step S1110, the method performs cell selection when a cell handover failure is detected.

[0209] In step S1120, based on the fact that the selected cell is a target cell among one or more candidate target cells for subsequent mobility, the method includes applying the configuration of the target cell.

[0210] In some implementations, selecting a security key value may include selecting a first security key value. A cell handover failure may include a subsequent mobility failure with the first security key value.

[0211] In some implementations, the selection of a security key value may include selecting a second security key value.

[0212] For example, subsequent mobility with the first security key value may fail. Upon detecting a failure of subsequent mobility with the first security key value, cell selection can be triggered. If the selected cell is the target cell that is one of the candidate cells for subsequent mobility, the radio device can use the second security key value to initiate UE-based fault recovery. UE-based fault recovery may include applying the target cell's configuration and / or performing security updates based on the second security key value.

[0213] In step S1130, the method includes sending a first security key value related to a cell handover failure to the network.

[0214] In some implementations, the method may further include treating a first security key value associated with a cell handover failure as an invalid security key value.

[0215] In some implementations, the first security key value may be sent after UE-based fault recovery is completed.

[0216] In some implementations, the method may further include sending updated security information to the network. The updated security information may be encrypted based on a second security key value. The updated security information may include at least one of the second security key value and / or a derived gNB key.

[0217] In some implementations, the method may further include treating the used security key value as invalid and removing the used security key value from one or more lists of security key values.

[0218] exist Figure 10 and / or Figure 11 In the embodiments of this disclosure described herein, cell handover may be associated with subsequent mobility. Subsequent mobility may be associated with LTM and / or CHO. Subsequent mobility may be associated with inter-node mobility.

[0219] exist Figure 10 and / or Figure 11 In embodiments of this disclosure described herein, the method may be performed by a wireless device communicating with at least one of a mobile device, a network, and / or an autonomous vehicle, other than a wireless device.

[0220] In addition, the above Figure 10 and / or Figure 11 The method described herein can be executed by a wireless device. The wireless device can be... Figure 2 The first wireless device 100 and / or shown Figure 3 The UE 100 implementation shown.

[0221] The wireless device includes at least one transceiver, at least one processor, and at least one memory, the at least one memory being operatively connected to the at least one processor and storing instructions that are executed based on execution by the at least one processor. Figure 10 and / or Figure 11 The method described in [the document / document].

[0222] In addition, the above Figure 10 and / or Figure 11 The method described herein can be executed under the control of a processing device adapted to control a wireless device. The processing device can be... Figure 2 The processor 102 and / or included in the first wireless device 100 shown Figure 3 The processor 102 included in the UE 100 shown is implemented.

[0223] A processing device adapted to control a wireless device includes at least one processor and at least one memory operatively connected to the at least one processor. The at least one processor is adapted to execute... Figure 10 and / or Figure 11 The method described in [the document / document].

[0224] In addition, the above Figure 10 and / or Figure 11 The methods described in [the document] can be stored by [the entity / organization]. Figure 2 The software code 105 in the memory 104 included in the first wireless device 100 shown is executed.

[0225] The technical features of this disclosure can be embodied directly in hardware, in software executed by a processor, or in a combination of both. For example, a method executed by a wireless device in wireless communication can be implemented in hardware, software, firmware, or any combination thereof. For example, software can reside in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, removable disk, CD-ROM, or any other storage medium.

[0226] Some examples of storage media can be coupled to a processor, enabling the processor to read information from the storage media. Alternatively, the storage media can be integrated into the processor. The processor and storage media can reside in an ASIC. As other examples, the processor and storage media can reside as discrete components.

[0227] Computer-readable media may include tangible and non-transitory computer-readable storage media.

[0228] For example, non-transitory computer-readable media may include RAM, ROM such as synchronous DRAM (SDRAM), non-volatile RAM (NVRAM), EEPROM, flash memory, magnetic or optical data storage media, or any other media capable of being used to store instructions or data structures. Non-transitory computer-readable media may also include combinations of the above media.

[0229] In addition, the methods described herein can be implemented at least in part through a computer-readable communication medium that carries or transmits code in the form of instructions or data structures, and is accessible, read and / or executed by a computer.

[0230] According to some embodiments of this disclosure, a non-transitory computer-readable medium (CRM) stores instructions, which are executed by at least one processor. Figure 10 and / or Figure 11 The method described in [the document / document].

[0231] Figure 12 An example of another method applying the embodiments of this disclosure is shown.

[0232] In step S1200, based on the selected cell being a target cell among one or more candidate target cells for subsequent mobility due to a cell selection failure during cell handover, the method includes receiving a security key from a radio device related to the cell handover failure.

[0233] In addition, the above Figure 12 The method described herein can be executed by a base station. The base station can be... Figure 2 The second wireless device 200 shown is implemented.

[0234] The base station includes at least one transceiver, at least one processor, and at least one memory, the at least one memory being operatively connected to the at least one processor and storing instructions that are executed by the at least one processor. Figure 12 The method described in [the document / article].

[0235] The following describes an example of UE operation according to an embodiment of this disclosure. In the examples described below, some steps may be omitted and / or the order of the steps may be changed.

[0236] (1) Example 1: Safety procedures in case of subsequent CHO failure between MN

[0237] - Step 1: The UE can receive the CHO configuration for subsequent CHOs from cell 0. The CHO configuration can configure three cell configurations for CHO candidate cells (e.g., cell 1, cell 2, and cell 3). The CHO configuration can include candidate cell configurations for candidate cells (e.g., cell 1, cell 2, and cell 3) and execution conditions for each candidate cell. In addition, the CHO configuration can include three lists of multiple security key values ​​for security updates when performing subsequent CHOs (a first list for cell 1, a second list for cell 2, and a third list for cell 3).

[0238] - Step 2: The UE can begin evaluating the execution conditions for subsequent CHOs for Cell 1, Cell 2 and / or Cell 3.

[0239] Step 3: When the relevant execution conditions are met, the UE can initiate a subsequent CHO from cell 0 to cell 1. The UE can start a mobility timer, for example, T304. The UE can apply the corresponding cell configuration to cell 1 (e.g., RRC reconfiguration message) and attempt access synchronization. The UE can also update security information based on a first list. The UE can select the first security key value from the first list.

[0240] Step 4: The UE may have failed to access cell 1. The UE can announce / detect a mobility failure when the mobility timer expires. The UE can restore its current configuration to the configuration used for the source cell (i.e., cell 0 with the security configuration). Therefore, the UE can treat updated security information (e.g., the first security key value in the first list) as invalid. After this, the UE can perform a cell selection procedure to find a new cell instead of cell 1.

[0241] Step 5: The UE can select cell 3 as the result of the cell selection process. The UE can confirm that cell 3 is in the candidate cell list for subsequent CHOs. The UE can initiate additional subsequent CHOs from cell 0 to cell 3 for UE-based fault recovery. The UE can restart the mobility timer, for example, T304. The UE can apply the appropriate cell configuration (e.g., RRC reconfiguration message) to cell 3 and attempt access synchronization. The UE can also update security information based on a third list. The UE can select the first security key value from the third list.

[0242] Step 6: The UE can successfully access cell 3. The UE can successfully complete this process to send a mobility completion message (e.g., an RRC reconfiguration completion message). The mobility completion message may include updated security information and invalid security information. The updated security information may include a security key value for cell 3 (e.g., the first security key value in the third list). The invalid security information may include a security key value for cell 1 (e.g., the first security key value in the first list). The UE can remove invalid security information from the list when or after sending the mobility completion message, allowing the UE to later select a new first security key value from the first list.

[0243] Step 7: After receiving the mobility completion message, the network can identify that the first security key value in the first list is no longer applicable to subsequent mobility. The network can provide a reconfiguration message to update the list of multiple security key values.

[0244] (2) Example 2: Safety handling in subsequent LTM failures between MNs

[0245] - Step 1: The UE can receive the LTM configuration for subsequent LTM from cell 0. The LTM configuration can configure three cell configurations for LTM candidate cells (e.g., cell 1, cell 2, and cell 3). The LTM configuration can include candidate cell configurations for candidate cells (e.g., cell 1, cell 2, and cell 3) and L1 measurement configurations for beams associated with the LTM candidate cells (e.g., cell 1, cell 2, and cell 3). In addition, the LTM configuration can include three lists (a first list for cell 1, a second list for cell 2, and a third list for cell 3) of multiple security key values ​​used for security updates when performing subsequent LTM.

[0246] - Step 2: The UE can perform L1 measurements based on the L1 measurement configuration received for each candidate cell and report the L1 measurement results to the network.

[0247] Step 3: The UE can receive a cell handover command from cell 0 via lower-layer signaling for LTM from cell 0 to cell 1. The UE can apply the appropriate cell configuration to cell 1 (e.g., RRC reconfiguration message) and attempt access synchronization. The UE also updates security information based on the first list. The UE can select the first security key from the first list.

[0248] Step 4: The UE may have failed to access cell 1. The UE can announce / detect a mobility failure when the mobility timer expires. The UE can restore its current configuration to the configuration used for the source cell (i.e., cell 0 with the security configuration). Therefore, the UE can treat updated security information (e.g., the first security key value in the first list) as invalid. After this, the UE can perform a cell selection procedure to find a new cell instead of cell 1.

[0249] Step 5: The UE can select cell 3 as the result of the cell selection process. The UE can confirm that cell 3 is in the candidate cell list for subsequent LTM. The UE can initiate additional subsequent LTM from cell 0 to cell 3 for UE-based fault recovery. The UE can restart the mobility timer, for example, T304. The UE can apply the appropriate cell configuration to cell 3 (e.g., RRC reconfiguration message) and attempt access synchronization. The UE can also update security information based on a third list. The UE can select the first security key value in the third list.

[0250] Step 6: The UE can successfully access cell 3. The UE can successfully complete this process to send a mobility completion message (e.g., an RRC reconfiguration completion message). The mobility completion message may include updated security information and invalid security information. The updated security information may include a security key value for cell 3 (e.g., the first security key value in the third list). The invalid security information may include a security key value for cell 1 (e.g., the first security key value in the first list). The UE can remove invalid security information from the list when or after sending the mobility completion message, allowing the UE to later select a new first security key value from the first list.

[0251] Step 7: After receiving the mobility completion message, the network can identify that the first security key value in the first list is no longer applicable to subsequent mobility. The network can provide a reconfiguration message to update the list of multiple security key values.

[0252] In this disclosure, UE-based fault recovery when a fault is detected involving cell selection and subsequent mobility toward the target cell during handover can be performed as follows.

[0253] When selecting a suitable NR cell while T311 is running, the UE can: 1> Ensure that you have valid and up-to-date basic system information; 1> Stop timer T311; 1> If T390 is running: 2> Stop timer T390 for all access categories; 1> If in progress, stop the relay (re)selection process; 1> If cell selection is triggered by detecting radio link failure of the MCG, reconfiguration with synchronization failure of the MCG, or mobility from NR failure, and 1> If attemptCondReconfig Configured; and 1> If the selected community is not configured with CondEventT1 Or the selected community is equipped with CondEventT1 And the conditions for leaving have not yet been met; and 1> If the selected cell is for its MCG VarConditionalReconfig In masterCellGroup Including reconfigurationWithSync One of the candidate communities: 2> If the UE supports conditional handover RLF-Report Then VarRLF-Report In choCellId Set to the global cell identifier if available; otherwise, set to the physical cell identifier and carrier frequency of the selected cell. 2> The application is associated with the stored data of the selected cell. condRRCReconfig and execute the application. RRCReconfiguration information; 1> If cell selection is triggered by detecting radio link failure of the MCG, reconfiguration with synchronization failure of the MCG, or mobility from NR failure; and 1> If attemptLTM-Switch Configured; and 1> If the selected cell is associated with MCG VarLTM-Config within LTM-Candidate One of the LTM candidate cells in IE: 2> Perform the LTM cell handover procedure for the selected LTM candidate cell according to the actions specified below.

[0254] For LTM cell handover execution, when the LTM cell handover process is triggered by a lower-layer indication, or when LTM cell handover is performed after cell selection that is being performed while timer T311 is running, the UE can: 1> Release / clear all current private radio configurations associated with the cell group that triggered the LTM cell handover procedure, except for the following: 2> If LTM cell handover is triggered on the MCG: - MCG C-RNTI; - AS security configuration associated with the master key; - For each SRB / DRB in the current UE configuration that is using the master key: - Maintain the associated PDCP and SDAP entities, their state variables, buffers, and timers; - Released srb-Identity and drb-Identity All fields other than those related to SRB / DRB configuration; 2> Otherwise, if an LTM cell handover is triggered on the SCG: - AS security configuration associated with the secondary key; - For each SRB / DRB in the current UE configuration that is using a secondary key: - Maintain the associated PDCP and SDAP entities, their state variables, buffers, and timers; - Released srb-Identity and drb-Identity All fields other than those related to SRB / DRB configuration; - exist RLC-BearerConfig RLC bearer configured in logicalChannelIdentity and logicalChannelIdentityExt And the associated RLC entities, their state variables, buffers, and timers; - UE variables VarLTM-Config , VarLTM-ServingCellNoResetID and VarLTM- ServingCellUE-MeasuredTA-ID .

[0255] 1> Release / clear all current public radio configurations associated with the cell group that triggered the LTM cell handover procedure; 1> Use the default values ​​for timers T310, T311 and constants N310, N311 associated with the cell group that triggered the LTM cell handover process; 1> Apply the default L1 parameter values ​​as specified in the corresponding physical layer specification; 1> If indicated by a lower layer or used for the selected cell 3 VarLTM-Config In LTM- Candidate Fields included in IE ltm-NoResetID The value is equal to VarLTM-ServingCellNoResetID within ltm-ServingCellNoResetID Value: 2> Continue using the current RLC entity in the LTM candidate configuration indicated by the lower layer; 1> Otherwise: 2> For each logicalChannelId and logicalChannelIdExt It is part of the current UE configuration used to trigger the LTM cell handover process for the cell group: 3> Reconstruct the corresponding RLC entity; 2> For each UE that is part of the current UE configuration drb-Identity value: 3> Trigger the PDCP entity of this DRB to perform data recovery; 2> will VarLTM-ServingCellNoResetID In ltm-ServingCellNoResetID The value is replaced by the one indicated by the lower layer or used for the selected cell. VarLTM-Config LTM-Candidate ltm- NoResetID The value; 1> If indicated by a lower layer or used for the selected cell VarLTM-Config In LTM-Candidate Included in IE ltm-UE-MeasuredTA-ID The value is equal to VarLTM-ServingCellUE-MeasuredTA-ID within ltm-ServingCellUE-MeasuredTA-ID Value: 2> Notify the lower-layer UE to perform UE-based TA measurements; 2> Will VarLTM-ServingCellUE-MeasuredTA-ID In ltm-ServingCellUE- MeasuredTA-ID Replace the value with ltm-UE-MeasuredTA-ID The value received internally; 1> Otherwise: 2> will VarLTM-ServingCellUE-MeasuredTA-ID In ltm-ServingCellUE- MeasuredTA-ID The value is replaced by the one indicated by the lower layer or used for the selected cell. VarLTM-Config In LTM- Candidate In ltm-UE-MeasuredTA-ID The value; 1> Continue using the current PDCP entity in the LTM candidate configuration indicated by the lower layer; 1> If ltm-ConfigComplete Not included in the cells indicated by lower levels or for the selected cells VarLTM-Config In LTM-Candidate Within IE: 2> Associated with the cell group that triggered the LTM cell handover process for it. VarLTM-Config In ltm- ReferenceConfiguration Consider it as the current UE configuration; 1> If LTM cell handover is triggered by an instruction from a lower layer: 2> In the case of LTM candidate configuration identifiers received from lower layers VarLTM-Config In LTM- Candidate In IE ltm-CandidateConfig LTM configuration is applied in the middle; 1> Otherwise (LTM cell handover is triggered during cell selection while timer T311 is running): 2> In relation to the LTM candidate configuration identifier used for the selected cell VarLTM-Config In LTM- Candidate In IE ltm-CandidateConfig LTM configuration is applied in the middle; 2> Execute the LTM configuration release procedure for MCG.

[0256] This disclosure can have various beneficial effects.

[0257] For example, it can prevent mismatches in multiple security key transactions between the network and the UE.

[0258] For example, the network can perform appropriate security measures to prevent RRC connection reconstruction due to the application of invalid security key values ​​during subsequent mobility.

[0259] The beneficial effects that can be obtained through specific embodiments of this disclosure are not limited to those listed above. For example, there may be various technical effects that those skilled in the art can understand and / or derive from this disclosure. Therefore, the specific effects of this disclosure are not limited to those explicitly described herein, but may include various effects that can be understood or derived from the technical features of this disclosure.

[0260] The claims in this disclosure can be combined in various ways. For example, the technical features in the method claims of this disclosure can be combined to implement or perform in a device, and the technical features in the device claims can be combined to implement or perform in a method. Additionally, the technical features in the method claims and device claims can be combined to implement or perform in a device. Other implementations are within the scope of the appended claims.

Claims

1. A method comprising: Receive cell handover command from source cell. The cell handover command includes security information; Initiate cell handover based on the cell handover command; When a cell handover failure is detected, cell selection is performed; Based on the fact that the selected cell is the target cell among one or more candidate target cells for subsequent mobility, the configuration of the target cell is applied; and Based on the security information, perform a security update for the target cell.

2. The method according to claim 1, wherein, The security information includes the next-hop chain counter (NCC) value for the target cell.

3. The method according to claim 1 or 2, wherein, The method further includes determining whether the selected cell is suitable for using the security information for user equipment (UE) based fault recovery.

4. The method according to claim 3, wherein, The selected cell is suitable for using the security information for UE-based fault recovery, and the security update corresponds to vertical export.

5. The method according to claim 3, wherein, The selected cell is not suitable for using the security information for UE-based fault recovery, and the security update corresponds to a horizontal export. The security update is performed based on the security key of the source cell.

6. The method according to any one of claims 1 to 5, wherein, The one or more candidate target cells are configured based on the candidate target cell configuration for each of the one or more candidate target cells.

7. The method according to any one of claims 1 to 6, wherein, The subsequent mobility is associated with L1 / L2 triggered mobility (LTM) and / or conditional handover (CHO).

8. The method according to any one of claims 1 to 7, wherein, The subsequent mobility is related to mobility between nodes.

9. The method according to any one of claims 1 to 8, wherein, The method is performed by a wireless device that communicates with at least one of a mobile device, a network, and / or an autonomous vehicle, in addition to the wireless device itself.

10. A wireless device, comprising: At least one transceiver; At least one processor; as well as At least one memory, operatively connected to the at least one processor, and storing instructions, which are executed by the at least one processor to perform the method according to any one of claims 1 to 8.

11. A processing apparatus adapted to control a wireless device, comprising: At least one processor; as well as At least one memory, operatively connected to the at least one processor. The at least one processor is adapted to perform the method according to any one of claims 1 to 9.

12. A non-transitory computer-readable medium (CRM) storing instructions, said instructions being executed by at least one processor to perform the method of any one of claims 1 to 9.

13. A method comprising: Initiate cell handover based on cell handover commands; Cell selection is performed when a failure of the cell handover is detected; Based on the fact that the selected cell is the target cell among one or more candidate target cells for subsequent mobility, the configuration of the target cell is applied; as well as Send a first security key value related to the cell handover failure to the network.

14. The method according to claim 13, wherein, The method further includes: treating the first security key value associated with the cell handover failure as an invalid security key value.

15. The method according to claim 13 or 14, wherein, The method further includes: receiving a pre-configured list of one or more security key values ​​from the network.

16. The method according to claim 15, wherein, The list of one or more security key values ​​is designed to allow wireless devices to perform security updates whenever subsequent mobility is performed without receiving configuration from the network.

17. The method according to claim 15 or 16, wherein, One or more lists of the security key values ​​are used for security updates only when mobility between subsequent nodes is performed.

18. The method according to any one of claims 15 to 17, wherein, The method further includes: selecting one list from one or more lists of security key values ​​to serve the target node of the target cell.

19. The method according to any one of claims 15 to 18, wherein, The method further includes: selecting a security key value from one or more lists of the security key values.

20. The method according to claim 19, wherein, The selection of the security key value includes selecting the first security key value, and The cell handover failure includes subsequent mobility failures with the first security key value.

21. The method according to claim 20, wherein, The selection of the security key value includes selecting a second security key value.

22. The method according to claim 21, wherein, The method further includes: initiating UE-based fault recovery using the second security key value, and The UE-based fault recovery includes applying the configuration of the target cell based on the second security key value and performing a security update.

23. The method according to claim 19, wherein, After the UE-based fault recovery is completed, the first security key value is sent.

24. The method according to claim 19 or 20, wherein, The method further includes: sending updated security information to the network.

25. The method according to claim 24, wherein, The updated security information is encrypted based on the second security key value.

26. The method according to claim 24 or 25, wherein, The updated security information includes at least one of the following: the second security key value and / or the derived gNB key.

27. The method according to any one of claims 15 to 26, wherein, The method further includes: treating the used security key value as invalid and removing the used security key value from one or more lists of the security key values.

28. The method according to any one of claims 15 to 27, wherein, The pre-configuration includes one or more candidate cell configurations to be applied to subsequent mobility, and Each of the one or more candidate cell configurations includes one or more execution conditions.

29. A method comprising: Based on the selected cell, since the cell selection in the event of a cell handover failure from the source cell to the target cell is the target cell among one or more candidate target cells for subsequent mobility, the security key related to the cell handover failure is received from the radio device.

30. A base station, comprising: At least one transceiver; At least one processor; as well as At least one memory, operatively connected to the at least one processor and storing instructions, the instructions being executed by the at least one processor to perform the method of claim 29.

Images