System, method and apparatus for network controlled repeaters in a mobile network

Abstract

A Network Control Repeater comprising: a transceiver; and a signal processor, operably coupled to the transceiver and configured to operate as: a NCR-Mobile Termination (NCR-MT) circuit configured to

Description

Technical Field

[0001] , The technical field relates generally to a system, methods and apparatus for network-controlled repeaters (NCRs) in a mobile network. In particular, example implementations include a system, methods and devices to make it more difficult to attack a configuration of NCRs. Background

[0002] , In recent years, there has been a rapid development in communications technologies that are compliant with third generation partnership project (3GPP™) standards. A 4th generation (4G) wireless communication standard (sometimes referred to as long term evolution (LTE™) was designed to support mobile internet and higher speeds for activities, such as video streaming and gaming. The 3GPP™ standards then developed a fifth generation (5G) of mobile wireless communications, which provides a step change in the delivery of better and faster communications, for example powering businesses, improving communications within homes and spearheading advances such as driverless cars. These 5G networks have also brought about a wide range of new services, each with its own unique set of requirements categorized under three main categories: Ultra-Reliable Low-Latency Communication (URLLC), massive Machine-Type Communication (mMTC), and Enhanced Mobile Broadband (eMBB). However, as the industry looks toward the future, it is clear that 5G networks are just the beginning.

[0003] , A sixth generation (6G) wireless communication standard is currently under development, as the planned successor to 5G, and will likely be significantly faster. Like its predecessors, 6G networks will likely be broadband cellular networks, in which the service area is divided into small geographical areas called cells. 6G networks are expected to be even more diverse than their predecessors and are likely to support applications beyond current mobile use scenarios, such as virtual and augmented reality (VR / AR), ubiquitous instant communications, pervasive intelligence and the Internet of Things (loT). It is expected that mobile network operators will adopt flexible decentralized business models for 6G, with local spectrum licensing, spectrum sharing, infrastructure sharing, and intelligent automated management underpinned by mobile edge computing, artificial intelligence (AI), short-packet communication and blockchain technologies.

[0004] , The concept of a Network Control Repeater (NCR) is a Release 18 Study item / Work item to introduce a repeater for coverage purposes that is controlled by the network [RP-213700], Referring now to FIG. 1, an example block diagram of a known network architecture 100 of NCR communication is illustrated, with communication links between a gNodeB (gNB) 104, a NCR 108 and a user equipment (UE) 102. One of the keys to allow for easy deployments of NCR 108 is that it shall be transparent to a UE 102, irrespective of whether (or not) it is communicating through an NCR 108.

[0005] , The NCR 108 may be considered to consist of two logical entities or respective circuits; the NCR-Mobile Termination (MT) 140 and the NCR-Forward (Fwd) 142. The NCR-MT 140 part of the NCR 108 is the entity that terminates the Control Link 130 with a control link circuit 126 in the gNB 104. The main purpose of the NCR-MT 140 is to receive Control Link 130 information for the NCR-Fwd 142, such as general configurations and short-term control link information. The NCR-MT 140 is expected to function almost like a normal UE, meaning that the NCR configurations are signaled similar to a normal UE. This means that the NCR-MT 140 will contain a full protocol stack, but some functionality that is normally used by a UE 102 may not be applicable and will not be implemented by the NCR-MT 140 and / or configured by the network.

[0006] , The NCR-Fwd 142 is the forwarding entity, that has a backhaul link 132 with a backhaul processing circuit 128 in the gNB 104 and an Access Link 124 to an access link processing circuit 122 in the UE 102. There are three types of forwarding configurations:

[0007] , Periodic forwarding: This is configured and activated via the radio resource control (RRC) layer.

[0008] , Aperiodic forwarding: This is partly configured via RRC, but activated via downlink control information (DCI), i.e., DCI format 28. The DCI format 2 8 indicates the time resource as well as the beam index to be used for forwarding whilst the beam width is configured via the RRC layer.

[0009] , Semi-Persistent forwarding: This is partly configured via the RRC layer and activated via medium access control (MAC) control element (CE) (using the NCR Access Link Beam Indication MAC CE). The MAC CE includes the resource set identifier (ID) that is used to select one of forwarding semi-persistent resource lists signalled via RRC and the beam index ID of the spatial resources to be used for forwarding.

[0010] , In addition to controlling the forwarding part of the NCR-Fwd, the backhauling of the NCR-Fwd can also be configured. The backhauling part is configured via RRC on the control link as a normal UE. New for NCR is new MAC CEs introduced that control the downlink and uplink backhauling. These are called the NCR Downlink Backhaul Link Beam Indication MAC CE and NCR Uplink Backhaul Link Beam Indication MAC CE. These MAC CEs either contain the TCI state or the SRS Resource ID

[0011] , The forwarding operation has the following characteristics: Forwarding can be performed in either RRC connected mode and RRC inactive mode. When an NCR-MT 140 is in RRC inactive mode, only the periodic forwarding is applicable, as the network cannot control the aperiodic forwarding. However, if a Beam Failure occurs and a Beam Failure Recovery (BFR) procedure is triggered, the NCR-Fwd 142 will cease to forward and then continue forwarding once the beam failure has been recovered.

[0012] , Referring now to FIG. 2, a message sequence chart 200 of a known mechanism for NCR integration is illustrated. Here, an NCR 108 will be authorized by an Access and Mobility Management Function (AMF) 202 when establishing a connection to a gNB 104 and a core network. The mechanism commences with the NCR 108 and gNB 104 sending and receiving messages at 210, with the NCR 108 then sending an RRCSetupRequest message to the gNB 104 at 220. The gNB 104 responds with RRCSetup information at 230. When an NCR-MT in the NCR 108 connects to a network, the NCR-MT will send an ncr-Nodelndication information element in an RRCSetupComplete message at 240, which indicates to the gNB 104 that a UE is in fact an NCR-MT. At 250, the gNB 104 sends an Initial Context Setup message to the AMF 202. At 260, the AMF 202 will authorize the NCR and if authorized, the AMF indicates to the gNB that the NCR is authorized at 270.

[0013] , In communication systems, an operations, administration, and management or operations, administration, and maintenance (OA&M or 0AM) is located within the network and configured to handle the processes, activities, tools, and standards involved with operating, administering, managing and maintaining any system. Within the 3GPP™ 5G standard, the 0AM is expected to play a part of managing the NCR 108. 0AM is expected to handle capabilities, output power, allowed / not-allowed cells and directly interact with the NCR 108 for these issues. Similarly, the 0AM may also indirectly control the configuration of an NCR 108 through a donor gNB 104 (since the donor gNB 104 configures the NCR 108).

[0014] , A known problem with current technologies is Radio Link Failure, whereby procedures are introduced to allow a UE to regain its radio link to another base station, in case the radio link fails. After having been triggered, the UE performs radio resource control (RRC) reestablishment, which means that the UE performs cell selection to potentially find a new cell (the same cell is a possible outcome) and connects to the cell.

[0015] , Referring now to FIG. 3, some known examples of Radio Link Failure 300, 350 between a UE 102 and a gNB 104 are illustrated: a) RLF triggered 330 after T310 has been triggered 320 from receiving out-of-sync indications 310; and b) recovering after T310 being triggered. The Radio Link Failure can be declared in a number of cases, where some examples are provided below.

[0016] , In the first known example of RLF 300, following a UE out of sync, the UE 102 measures the cell strength through Radio Link Monitoring. If the cell strength is below a certain threshold for a configurable amount of times (N310), the UE triggers a timer (T310) at 320 for the UE 102 to recover. If the UE 102 does not recover, the UE 102 declares a RLF 330. The recover condition is that the UE 102 receives an in-sync indication 360 a configurable amount of times (N311) during the T310 timer duration, as illustrated in RLF 370.

[0017] , A second example of RLF is when RLC PDUs are re-transmitted a number of times. Here, the network configures a number of times (maxRetxThreshold) that an RLC protocol data unit (PDU) may be attempted to be re-transmitted.

[0018] , A third example of RLF is when there are random access problems. This can occur, for example, when the UE 102 is in connected mode and the UE 102 is trying to re-synchronize, for instance after losing uplink synchronization.

[0019] , A fourth example of RLF occurs following a failure of backhaul links, which leads to backhaul (BH) RLF (IAB related).

[0020] , A fifth example of RLF occurs following an Uplink Listen Before Talk (LBT) failure, which occurs when the UE 102 fails LBT when, say, operating on an unlicensed band. [0021 ]. As part of performing RLF, the UE 102 can be configured to gather an RLF-Report, which contains information regarding the RLF, which then can be reported to the gNB 104 where it occurred, or indeed any other gNB.

[0022] , In some circumstances, such as when RRC re-establishment fails, or if the UE 102 has not yet activated access stratum (AS) security, the UE 102 may have to leave connected mode under the release cause ‘RRC Connection Failure’. The release cause is relayed to upper layers of the UE 102 - non-access stratum (NAS) in this case. The action in NAS, upon entering RRC idle mode with this release cause, is to trigger a Tracking Area Update (TAU) to any cell according to idle mode procedures.

[0023] , Referring now to FIG. 4, a known example illustrates RRC Re-establishment procedure 400 is performed after RLF in most cases; and can also be performed when a UE fails a handover, as well as in cases of configuration failure. The RRC Re-establishment procedure 400 comprises communications between a UE 402, an old gNB 404 and a new gNB 406. The RRC Re-establishment procedure 400 includes a RLF being declared between the UE 402 and the old gNB 404 at 410, which in some instances can also be a Handover failure. At 420, an Idle mode cell selection is performed by the UE 402. At 430, after first performing random access, the UE 402 sends a RRC Re-establishment request to the new gNB 406. At 440, the new gNB 406 retrieves UE context from old gNB 404 (if the new gNB is not the same as the old gNB). At 450, the old gNB 404 returns the UE context to the new gNB 406. At 460, the new gNB 406 replies with RRC Re-establishment and potentially reconfigures UE 402 if needed, or continues using the same RRC configuration as previous. If reconfiguring the UE 402, the new gNB 406 replies with RRCSetup. At 470, the UE 402 returns to the new gNB 406 with a message that the RRC re-establishment is complete.

[0024] , To indicate to an old gNB 404 that a UE 402 previously associated / connected to it, has failed, the new gNB 406 can signal a so-called RLF indication to the old gNB 404 via the Xn interface, as illustrated in the failure indication procedure 500 of FIG. 5. The RLF indication can for instance contain the RLF-Report compiled by the UE 402.

[0025] , Referring now to FIG. 5, a known example illustrates a failure indication procedure 500 with accompanying RLF and RRC re-establishment procedure, as well as RLF Report transmission. The failure indication procedure 500 comprises communications between a UE 402, an old gNB 404 and a new gNB 406. The failure indication procedure 500 includes a RLF being declared between the UE 402 and the old gNB 404 at 510, which in some instances can also be a Handover failure. At 520, an Idle mode cell selection is performed by the UE 402. At 530, after first performing random access, a RRC Re-establishment procedure is performed between the UE 402 and the new gNB 406. At 540, the UE 402 sends a UE information response (in a form of a RLF report) to the new gNB 406. At 550, the new gNB 406 sends the old gNB 404 the failure indication (in the form of the RLF report).

[0026] , In 3 GPP™ 5G, non-access stratum (NAS) and mobility management (MM) are two protocols that operate at the upper layer of the 5G system architecture, above the access stratum (AS) that deals with the radio interface. NAS is responsible for establishing, maintaining, and releasing sessions between the user equipment (UE) and the core network (CN). To activate 5G NAS security, the AMF and the UE first need to perform mutual authentication, which establishes the 5G NAS security context.

[0027] , Referring now to FIG. 6, a message sequence chart 600 of a known example of an AS security establishment procedure, from a perspective of the AS layer, is illustrated. When an RRC connection is being established via RRC setup procedures, the procedures will first establish a radio bearer that can be used for further configurations. This first radio bearer is a signalling radio bearer (termed ‘SRB1 ’), which is used for RRC messages (that may include a piggybacked NAS message) as well as for NAS messages prior to an establishment of SRB2, all using a dedicated Control (logical) Channel (DCCH) that is used within the uplink and downlink to carry dedicated control information between the UE or mobile and the network; where SRB2 is for NAS messages, again using DCCH logical channel.

[0028] , The mechanism commences with the UE 102 and gNB 104 sending and receiving messages at 610, with the UE 102 then sending an RRCSetupRequest message to the gNB 104 at 620. The gNB 104 responds with RRCSetup information at 630 and the UE confirms that an RRC connection has been established by sending an RRCSetupComplete message to the gNB 104 at 640. Establishing SRB1 (without AS security) at 650 allows for continued configurations of the UE and the establishment of AS security. Configurations that can for instance be configured without AS security include measurement reporting configurations, medium access control (MAC) and physical (PHY) layer configurations, etc.

[0029] , Then after this is established, secure NAS signaling can be configured by the gNB 104 sending the Security Mode Command at 660 to the UE 102, which establishes the ciphering and integrity protection algorithms. The UE 102 confirms that AS security has been established at 680 by sending a SecurityCommandComplete message to the gNB 104 at 670.

[0030] , Thus, the AS security is established via the Initial AS security activation procedures. This is done through the message SecurityModeCommand and SecurityModeCamplete. The SecurityModeCommand configures the specific security algorithms to be used and the SecurityModeComplete acknowledges the successful establishment. When a UE 102 receives the SecurityModeCommand, the UE 102 verifies the integrity protection of the message using derived keys, and if the integrity protection passes, then new keys are generated using the signaled ciphering algorithm. These keys are maintained for the SRB after the completion of the Initial AS security activation. AS security supports both ciphering (that provides signaling data confidentiality) and integrity protection (that provides user or data integrity). It is supported for both signaling via SRBs or user data via DRBs. The keys used for ciphering and integrity protection are different for SRBs and DRBs, where all SRBs (SRB1, SRB2, SRB3 and SRB4) share keys (KRRCint and KRRCeno) and DRBs have another set of keys (Kupint and Kupenc). The keys may be updated, but this can only be performed by using RRC Reconfiguration with sync, which causes the UE to perform random access before replying with the RRCReconfigurationComplete message. [0031 ]. Mutual authentication is performed over NAS by initiating the Authentication Request / Response. There are two methods for performing the mutual authentication; Extensible Authentication Protocol (EAP)-based primary authentication, which is an authentication framework that allows for the use of different authentication methods for secure network access technologies, and 5G EAP with Authentication and Key Agreement (AKA), which uses a more advanced primary authentication algorithm than EAP to generate and exchange encryption keys. The mutual authentication can be initiated when a UE 102 sends a Registration Request and the AMF 202 and the UE 102 have not authenticated themselves. The keys generated during the NAS / 5GC procedures are used when generating AS keys. To start using NAS signaling security, the security mode control procedures are used.

[0032] , In the Release 18 work item of the Network Controlled Repeater 108 a simplified repeater was introduced that can be configured and controlled by the network. NCR 108 is a potentially very powerful tool in securing good coverage in a cost-effective manner. However, a number of significant features were not concluded for NCR Release 18.

[0033] , The inventors have recognised and appreciated that whilst a repeater is a powerful device, it can also cause significant interference in a wireless communication system if it is misconfigured. In particular, it would be problematic if there was a malicious configuration of the NCR with the intent of producing wireless interference. This risk is particularly prevalent with an NCR because the forwarding operation of the NCR can be configured by a gNB via standardized RRC configurations, which could result in repeating all signals across the bandwidth of a cell. This is different from, for instance, capturing an IAB node, because the IAB node acts as its own base stations and will transmit according to a scheduler based on serving UEs. Furthermore, the NCR-MT will in most cases not have any uplink user data to send by itself. The privacy requirements of an NCR 108 may be less, since there is no personal user data to request. However, there is still a need to ensure secure communication and configuration of an NCR 108 device, as without such security, there is a risk of attack of the NCR configuration with implications to the efficiency and operational state of the wireless system as a whole.

[0034] , Thus, the inventors have recognised and appreciated that a need exists for devices, circuits and methods to make the NCR configuration and operation more secure. Summary

[0035] , In a first aspect, a Network Control Repeater, NCR, is described that comprises: a transceiver; and a signal processor, operably coupled to the transceiver and configured to operate as: a NCR-Mobile Termination (NCR-MT) circuit configured to communicate with at least one base station using control link information; and a NCR-Forward (NCR-Fwd) circuit configured to communicate with the base station via a backhaul link. The NCR-Fwd circuit of the NCR is configurable by the base station. The signal processor is arranged, prior to one or more of security measures having been performed, to perform one or more of: prevent a configuration of the NCR-Fwd circuit by the at least one base station; prevent the NCR-Fwd circuit performing a forwarding operation; prevent the NCR from accepting any configuration.

[0036] , In this manner, a number of limitations on the NCR configuration is / are introduced and operation is made more secure, for instance preventing or making it more difficult to perform the aforementioned attacks.

[0037] , In a second aspect, a method for a Network Control Repeater, NCR, is described, wherein the method comprises: communicating, using a NCR-Mobile Termination (MT) circuit, with at least one base station using control link information; and communicating, using a NCR-Forward (Fwd) circuit coupled to the NCR-MT circuit, with the at least one base station via a plurality of backhaul links; wherein, prior to one or more of security measures having been performed, performing one or more of the following: preventing a configuration of the NCR-Fwd circuit by the at least one base station; preventing the NCR-Fwd circuit performing a forwarding operation; preventing the NCR from accepting any configuration. Brief Description of the Drawings

[0038] , Further details, aspects and embodiments will be described, by way of example only, with reference to the drawings. In the drawings, similar reference numbers are used to identify like or functionally similar elements. Elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale.

[0039] , FIG. 1 illustrates a block diagram of a known network architecture of NCR communication.

[0040] , FIG. 2 illustrates a message sequence chart of a known mechanism for NCR integration.

[0041] , FIG. 3 illustrates a known example of a simplified message sequence chart of Radio Link Failure.

[0042] , FIG. 4 illustrates a known example of a simplified message sequence chart of a RRC Re-establishment procedure.

[0043] , FIG. 5 illustrates a known example of a simplified message sequence chart of a failure indication procedure.

[0044] , FIG. 6 illustrates a known example of an AS security establishment procedure example from the perspective of the AS layer.

[0045] , FIG. 7 illustrates one example of a simplified message sequence chart (with schematic), perceived as a potential NCR problem by the inventors, of an attacker acting as a donor gNB in an attempt to get an NCR-Fwd to create interference.

[0046] , FIG. 8 illustrates a block diagram of a base station, such as a gNB, communicating with a NCR, adapted in accordance with some examples.

[0047] , FIG. 9 illustrates a simplified message sequence chart of one example of establishing AS security or performing mutual authentication before configuring the NCR-Fwd, adapted in accordance with some examples.

[0048] , FIG. 10 illustrates a simplified message sequence chart of one example of configuring NCR-Fwd after NCR is authorized by the core network, adapted in accordance with some examples.

[0049] , FIG. 11 illustrates a simplified message sequence chart of one example of general outline of NCR procedures, adapted in accordance with some examples.

[0050] , Skilled artisans will appreciate that elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. For example, the dimensions and / or relative positioning of some of the elements in the figures may be exaggerated relative to other elements to help to improve understanding of various examples. Also, common but well-understood elements that are useful or necessary in a commercially feasible embodiment are often not depicted in order to facilitate a less obstructed view of these various examples. It will be further appreciated that certain actions and / or steps may be described or depicted in a particular order of occurrence while those skilled in the art will understand that such specificity with respect to sequence is not actually required. It will also be understood that the terms and expressions used herein have the ordinary technical meaning as is accorded to such terms and expressions by persons skilled in the technical field as set forth above except where different specific meanings have otherwise been set forth herein. Detailed Description

[0051] , Examples herein described are focused on an NCR and methods for securely configuring and operating an NCR.

[0052] , Referring first to FIG. 7, one example of a simplified message sequence chart 700 (with schematic) is illustrated, perceived as a potential NCR problem by the inventors, of an attacker 710 acting as a donor gNB in an attempt to get an NCR-Fwd circuit 142 of an NCR 108 to create interference. In this attack, there is a failure between donor gNB 104 and the NCR 108 that causes an establishment with the attacker 710 acting as the donor gNB. Here, the NCR-MT 140 of the NCR 108 detects the attacker 710 acting as the donor gNB as the strongest gNB at 720. During a normal establishment at 730, the AS security may not be activated for a while as NAS security is established. The attacker 710 acting as the donor gNB is also the entity that sends the command to establish AS security, making it possible to delay any AS security establishment. In this attack, the attacker 710 acting as the donor gNB of an NCR 108, and the attacker configures the NCR 108 to repeat the messages on all signals (e.g., all slots and beams), at 740, thereby causing interference 750 using the operations of the NCR-Fwd circuit 142.

[0053] , A yet further envisaged problem of an attack uses the unprotected lower layer signaling in an attempt to get the NCR 108 to forward on resources, thereby causing interference to the network. This is because downlink control information (DCI) and MAC CE can control what resources that an NCR-Fwd 142 forwards on, which is neither integrity protected nor ciphered. It should be noted that similar weaknesses exist for a UE, where an attacker could potentially get the UE to transmit in the uplink using DCIs, thereby also causing interference. However, the difference in this scenario is that a UE has a significantly lower maximum output power compared to an NCR 108, which is a network node.

[0054] , In Release 18 Network Controlled Repeaters, it is always considered that the NCR-Fwd will forward, i.e., repeat, the signals of the full bandwidth of a specific cell that the NCR-MT is connected / camping on. Thus, when defining how the forwarding part of an NCR node is configured “from another frequency”, the frequency band that the NCR-Fwd is forwarding on may be defined as “forwarding on a carrier”, “forwarding a cell”, and other similar phraseology. Similarly, it may be considered that there are multiple “NCR-Fwd” entities, existing for each band / carrier, or it may be considered to be a single NCR-Fwd entity that forwards across multiple potentially discontinuous frequency bands. The above scenarios give rise to following possibilities that may perform similar functionality required in existing single carrier NCRs, but function over multiple carriers, in accordance with example embodiments herein described.

[0055] , In some examples herein described, the wording “NCR-Fwd ON” / ”NCR forwarding” is used to indicate that NCR forwarding is operational, whereas “NCR-Fwd OFF” or “NCR ceasing forwarding” or similar wording is used to indicate that NCR-Fwd is not operating, i.e., not forwarding. “NCR-Fwd ON” may also mean that NCR-Fwd is not “OFF”, meaning that it can forward if the NCR has been configured to forward. As a concrete example, the NCR may be configured with aperiodic or semi-persistent forwarding and then NCR-Fwd may be turned “ON”. In this case the NCR-Fwd will not perform any forwarding before a DCI or MAC CE command has been received from the donor gNB ordering the NCR-Fwd to forward. This has been defined in NCR 3GPP Rei-18. It is also envisaged that the concepts herein described may be referred to differently when applied to other communication systems, both currently and in the future, for example in 6G. For instance, it is envisaged that “NCR-Fwd ON”, “NCR-Fwd partial ON” or “NCR-Fwd OFF”, may indicate intermediate steps where the NCR is not forwarding fully but may also be employed to implement the concepts described herein. It is envisaged that this may be, for instance, implemented only using a set of beams to forward, or only using a part of a configuration to forward, or only using a set of the time-resources to forward, or only using a part of the bandwidth to forward, or using less than full power to forward, etc.

[0056] , In some of the examples herein described, the term “network” may encompass the core network or a base station (such as a 5G gNB), as both may be employed in the authentication and security provisions herein described. Therefore, in and across some examples, the terms “network” and “base station” or “gNB” may be used interchangeably.

[0057] , Referring now to FIG. 8, block diagrams of a wireless base station, in a form of a gNB 804, communicating 821 with a NCR 808 are illustrated, where the respective wireless communications units have been adapted in accordance with some examples.

[0058] , The gNB 804 contains a beam forming antenna array 802, coupled to a transceiver via an antenna switch or duplexer 803 that provides isolation between receive and transmit chains within the gNB 804. As regards the receive chain, this includes one or more receiver circuits that include receiver front-end circuitry 806 (effectively providing reception, filtering and intermediate or base-band frequency conversion). The receiver front-end circuitry 806 is coupled to a signal processor 809 (generally realized by a digital signal processor (DSP)). A skilled artisan will appreciate that the level of integration of receiver circuits or components may be, in some instances, implementation-dependent.

[0059] , A controller 814 maintains overall operational control of the gNB 804. The controller 814 is also coupled to the receiver front-end circuitry 806 and the signal processor 809. In some examples, the controller 814 is also coupled to a frequency generation circuit 817 and a memory device 816 that selectively stores operating regimes, such as decoding / encoding functions, synchronization patterns, code sequences, and the like. A timer 818 is operably coupled to the controller 814 to control the timing of operations (e.g., transmission or reception of timedependent signals) within the gNB 804.

[0060] , As regards the transmit chain, this includes a transmitter / modulation circuitry 822 and a power amplifier 824 coupled to the beam forming antenna array 802. The transmitter / modulation circuitry 822 and the power amplifier 824 are operationally responsive to the controller 814. The signal processor 809 in the transmit chain may be implemented as distinct from the signal processor in the receive chain. Alternatively, a single processor may be used to implement a processing of both transmit and receive signals, as shown m FIG. 8. Clearly, the various components within the gNB 804 can be realized in discrete or integrated component form, with an ultimate structure therefore being an application-specific or design selection.

[0061] , The signal processor 809 comprises a control link processing circuit 826 operably communicates via Control link information 830 to an NCR 808 and comprises a backhaul processing circuit 828 operably coupled to the NCR 808 via a backhaul link 832. The signal processor 809 and / or controller 814 together with the transceiver (e.g., transmitter / modulation circuitry 822 and receiver front-end circuitry 806) of the gNB 804 are configured to transmit Control Link 830 information to a NCR-Fwd circuit 842 in the NCR 808, such as general configurations and short-term control link information. In some examples (not shown), the gNB 804 may be configured to provide configuration messages and details to an NCR 808, in order to configure an NCR-Fwd circuit 842, as described later.

[0062] , FIG. 8 also shows a high-level block diagram of a NCR 808. In this example, the NCR 808 may be considered to consist of two or more logical entities performed by software in the signal processor 859 (or by logic in, say, a FPGA, or by other devices or circuits), referred to hereafter as a NCR-Mobile Termination (MT) circuit 840 and an NCR-Forward (Fwd) circuit, 842. In this example, the NCR-MT circuit 840 is the entity that terminates the Control Link 830 with a control link circuit 826 in the gNB 804. The main purpose of the NCR-MT circuit 840 is to receive Control Link 830 information for the NCR-Fwd circuit 842, such as general configurations and short-term control link information. In this example, the NCR-MT circuit 840 is expected to function almost like a normal UE, meaning that the NCR configurations are signaled similar to a normal UE. This means that the NCR-MT circuit 840 will contain a full protocol stack. However, in this example, some functionality that is normally used by a UE may not be applicable and will not be implemented by the NCR-MT circuit 840 and / or configured by the network. In accordance with examples, the NCR-Fwd circuit 842 is the forwarding entity, that has a backhaul link 832 with the backhaul processing circuit 828 in the gNB 804.

[0063] , NCR 808 contains a beam forming antenna array 852, for transmitting and receiving transmissions, coupled to a transceiver via an antenna switch or duplexer 853 that provides isolation between receive and transmit chains within the NCR 808. One or more receiver chains, as known in the art, include receiver front-end circuitry 856 (effectively providing reception, filtering and intermediate or base-band frequency conversion). The receiver front-end circuitry 856 is coupled to a signal processor 859 (generally realized by a digital signal processor (DSP)). A skilled artisan will appreciate that the level of integration of receiver circuits or components may be, in some instances, implementation-dependent.

[0064] , In some examples (not shown), the NCR-Fwd circuit 842 is operably coupled to the NCR-MT circuit 840 of the NCR 808, and configured or prevented from being configured in accordance with the approaches described later.

[0065] , The controller 864 maintains overall operational control of the NCR 808. The controller 864 is also coupled to the receiver front-end circuitry 856 and the signal processor 859. In some examples, the controller 864 is also coupled to a frequency generation circuit 867 and a memory device 866 that selectively stores operating regimes, such as decoding / encoding functions, synchronization patterns, code sequences, and the like. A timer 868 is operably coupled to the controller 864 to control the timing of operations (e.g., transmission or reception of time-dependent signals) within the NCR 808.

[0066] , As regards the transmit chain, this includes the signal processor 859 forwarding (repeating) received messages, through transmitter / modulation circuitry 872 and a power amplifier 874 to the beam forming antenna array 852. The transmitter / modulation circuitry 872 and the power amplifier 874 are operationally responsive to the controller 864.

[0067] , The signal processor 859 in the transmit chain may be implemented as distinct from the signal processor in the receive chain. Alternatively, a single processor may be used to implement a processing of both transmit and receive signals, as shown in FIG. 8. Clearly, the various components within the NCR 808 can be realized in discrete or integrated component form, with an ultimate structure therefore being an application-specific or design selection.

[0068] , In some examples, the signal processor 859 and / or controller 864 and transceiver (e.g., transmitter / modulation circuitry 872 and receiver front-end circuitry 856) of the NCR 808 are configured to communicate with the wireless base station, e.g., gNB 804 to avoid the NCR 808 being falsely configured. In some examples, it is envisaged that there may need to be limitations or new, expected behaviour applied to the donor gNB 804 and the NCR 808, in order to prevent or at least mitigate any attempt at malicious configuration of the NCR 808.

[0069] , Therefore, in accordance with examples herein described, one of the most important operations, before the NCR 808 starts operating, is to ensure that security measures have been taken. In some examples, these security measures may encompass at least one, a number, or all of the following configurations: Before the NCR-Fwd circuit 842 starts operating, the NCR 808 and either the donor gNB and / or a core network (CN) (e.g CN 905 from FIG. 9) shall have mutually authenticated one another. AS security shall have been established between donor gNB 804 and NCR 808. NAS security has been established between NCR 808 and core network 905 (e.g., more specifically an AMF m this case).

[0070] , In examples of the invention, and only after one or more of these security measures have been taken, the donor gNB 804 may be allowed to configure the NCR 808, or the NCR-Fwd circuit 842 may begin forwarding. In some examples, the NCR 808 may also be considered to be allowed to “accept” configurations after the above one or more security measures have been taken.

[0071] , An example of these security measures may, for instance, be that donor gNB 804 shall not configure the NCR 808 with any forwarding resources before AS security has been established, in other words the donor gNB 804 only configures the NCR-Fwd circuit 842 after the AS security has been established. An example of this is illustrated in FIG. 9.

[0072] , Referring now to FIG. 9, a message sequence chart 900 illustrates one example of establishing AS security or performing mutual authentication before configuring the NCR-Fwd in accordance with some examples. The message sequence chart 900 illustrates communications between an NCR 808 and a donor gNB 804 and a core network 905. In this example, the NCR 808 includes NCR-MT 840 operably coupled to NCR-Fwd circuit 842.

[0073] , At 910, RRC setup procedures are adopted with communications between NCR-MT 840 of the NCR 808 and the donor gNB 804. At 920, a SRB1 without AS security is established between the NCR-MT 840 of the NCR 808 and the donor gNB 804. In accordance with some examples, security measures 925 are then employed between NCR-MT 840 of the NCR 808 and the donor gNB 804. In this example, the security measures 925 comprise establishing a new NAS security link being established between the donor gNB 804 and respectively at 930 the NCR-MT 840 of the NCR 808 and at 932 the CN 905. At 940, the donor gNB 804 sends a SecurityModeCommand to the NCR-MT 840 of the NCR 808. At 950, the NCR-MT 840 of the NCR 808 sends a SecurityModeComplete to the donor gNB 804. At 960, an AS security is, according to examples herein described, now established between the NCR-MT 840 of the NCR 808 and the donor gNB 804 following mutual authentication. At this point, the security measures 925 have been completed. At 970, the donor gNB 804 sends a RRCReconfiguration sent using integrity protection and ciphering (to configure the NCR-Fwd circuit 842 of the NCR 808) to the NCR-MT 840. At this moment, at 975, the NCR-Fwd circuit 842 is turned ON’

[0074] , In another example, it is envisaged that the NCR 808 may be configured to not perform any forwarding before AS security has been established. This implicitly means that resources may be configured, but no forwarding is allowed before AS security has been established. As a refinement of this example, it is envisaged that the NCR may be configured to wait until AS security has been confirmed, before starting to forward, thus no additional signaling would be needed.

[0075] , In some examples, the establishment of the AS security may be performed via a SecurityModeCommand, or any other methods to establish AS security. If, for instance, a handover is performed, then AS security will be (re-)established with the new gNB. If for instance a dual connectivity connection is established, the AS security of the new cell group will be established via the RRC reconfiguration with sync procedures. If an NCR-MT resumes an RRC connection from the RRC inactive state, the AS security will be resumed after successful RRC Resume procedures.

[0076] , As another example, any proprietary algorithm may be used to establish AS security that is suitable for the aforementioned NCR scenario, for example a manual establishment may be used.

[0077] , In another example, it is envisaged that a yet further network-based condition may be that the gNB 804 is configured to refrain from configuring the NCR 808 before the NCR 808 has been authorized by an AMF to act as an NCR In this example, the gNB 804 waits for the authorization in a UE Context setup received by AMF before performing any type of configuration of the NCR-Fwd circuit 842. This is because it may be possible that NCR has setup AS security while the NCR has yet to be authorized in some cases. If for instance it is not safe for the NCR to operate (due to a possible attacker, such as an attacker base station being identified in the vicinity of the NCR), it may be able to establish AS security, but it may not be authorized by the AMF to operate. This scenario is illustrated in FIG. 10.

[0078] , Referring now to FIG. 10, a message sequence chart 1000 illustrates communications between an NCR 808 and a donor gNB 804 and a core network 905, in accordance with some examples. In this example, the NCR 808 includes NCR-MT 840, NCR-Fwd circuit 842.

[0079] , At 1010, RRC setup procedures are adopted with communications between NCR-MT 840 of the NCR 808 and the donor gNB 804. At 1020, a SRB1 without AS security is established between the NCR-MT 840 of the NCR 808 and the donor gNB 804. In accordance with some examples, security measures 1025 are then employed between NCR-MT 840 of the NCR 808 and the donor gNB 804. In this example, the security measures 1025 comprise a new NAS security link being established between the donor gNB 804 and respectively at 1030 the NCR-MT 840 of the NCR 808 and at 1032 the CN 905. At 1040, the donor gNB 804 sends a SecurityModeCommand to the NCR-MT 840 of the NCR 808. At 1050, the NCR-MT 840 of the NCR 808 sends a SecurityModeComplete message to the donor gNB 804. At 1060, an AS security is, according to examples herein described, now established between the NCR-MT 840 of the NCR 808 and the donor gNB 804 following mutual authentication. At this point, the security measures 1025 have been completed. In this example, at 1070, the CN 905 confirms to the donor gNB 804 that the NCR 808 is authorized and at 1080, the donor gNB 804 sends a RRCReconfiguration message (to configure the NCR-Fwd circuit 842 of the NCR 808) to the NCR-MT 840, where the RRCReconfiguration message is ciphered and integrity-protected. At this moment, at 1090, the NCR-Fwd circuit 842 is turned ‘ON’.

[0080] , In one example, the donor gNB 804 may be configured to refrain from configuring anything related to backhauling before the security measures have been taken. These configurations can for instance be TCI state or SRS resource configurations of the downlink or uplink. In some examples, it is envisaged that this approach may be important as an attacker may be able to get information on backhaul configuration in order to try to interrupt the NCR-Fwd backhaul operation through MAC CEs (as explained previously).

[0081] , Thus, in this scenario, it is envisaged that a network may wait before the above security measures have been taken before authorizing the NCR 808 so that it can be configured by the donor gNB 804 to forward. Similarly, an NCR 808 may be configured to be aware that it should not be configured to forward before the above measures are taken into account.

[0082] , Thus, the example message sequence charts 900 and 1000 of FIG. 9 and FIG. 10 respectively illustrate mechanisms to enable protection from two different attacks: a first attack may be a ‘man-in-the-middle’ attack, where a malicious attacker base station pretends to be a legitimate gNB and configures the gNB to forward using RRC; and a second attack may be a malicious attacker using knowledge of the NCR RRC configuration to obtain the NCR-Fwd circuit 842 to forward using downlink control information (DCI) or MAC CE.

[0083] , In some examples, it is envisaged that the donor gNB 804 may be required to use ciphering of the RRC signalling when configuring an NCR-Fwd circuit 842. In some instances, this may be important as in some example implementations it may not be mandatory to use ciphering when sending RRC signalling. If ciphering is not used, the NCR 808 may be configured to refuse or consider the RRC signaling to be invalid.

[0084] , In some examples, if a signal processor, e.g., signal processor 859 of the NCR 808, determines that any of the above actions occur, i.e., a network attempts to configure the NCR 808 to forward before security provisions are in place, it is envisaged that one of the following may be employed. For example, the NCR-MT 840 may be configured to perform a reestablishment procedure and the NCR-MT 840 will not consider the attacking gNB as part of a cell selection if the attack gNB communications are performed during a RRC re-establishment procedure. A further example is that the NCR-MT 840 is configured to move into an RRC idle mode, whereby the NCR-MT 840 will then not consider the attacker gNB as part of the cell selection / re-selection. Furthermore, in this example, the attacker gNB may be reported to the network upon re-connecting to a gNB 804 that can be verified. A yet further envisaged example is when the NCR-MT 840 does not perform re-establishment and does not change its RRC state, but it does not pass on the forwarding parameters to the Fwd entity or does not configure or activate forwarding operations. It is envisaged that in this scenario, this may be achieved if the NCR-Fwd circuit 842 has been configured but no forwarding is allowed.

[0085] , In one example, the donor gNB 804 will not configure the ncr-RNTl before AS security has been configured. This is important as the ncr-RNTI may not be configured together with the other forwarding configurations. If the ncr-RNTI is configured in cleartext, there is a risk that some of the attacks may be attempted. In another example, the donor gNB 804 may be required to re-configure ncr-RNTI regularly, for instance at every ‘X’ seconds or minutes, every time the NCR 808 resumes from RRC inactive, or every time the NCR-Fwd circuit 842 or NCR 808 is reconfigured.

[0086] , In another example, if the NCR 808 configuration is sent before security is in place, the NCR 808 will not start forwarding before the security is in place. This is not as secure as the other options, but still protects the NCR 808 from some attacks.

[0087] , In one example, the NCR 808 will release itself from the network if AS security is not established within a certain time period of being connected to a donor gNB 804. This has a potential downside that it may enable a different kind of attack, whereby a rogue gNB could withhold or delay the establishment of AS security, leading to the NCR 808 releasing and attaching to this same rogue gNB and disrupting service. Therefore, in a refinement of this scenario, it is envisaged that the NCR-MT 840 may be configured to not consider this rogue gNB as part of the cell selection / re-selection after, say, ‘N’ such failed attempts at establishing AS security.

[0088] , In one example, the configuration of the NCR 808 may be configured to not start until both: 1) security is in place, and 2) an 0AM connection has been established and 0AM has indicated that forwarding may be started. In one example, it is envisaged that the 0AM may also perform authentication check on the base station (e.g., gNB 804) that the NCR 808 is connected to. An example of how this may be specified can be seen in Specification Example #2, where when these two conditions are fulfilled, the NCR 808 is considered to be “authorized”.

[0089] , In one example, if the gNB 804 is allowed to initially configure NCR-Fwd circuit 842 without AS security (ciphering and integrity protection), then it is envisaged that the AS security must be used when NCR-Fwd is de-configured, i.e., when NCR-Fwd circuit 842 is turned ‘OFF’. In this scenario, it is envisaged that this helps to protect against any attacker that is trying to disrupt the NCR 808 from forwarding. Otherwise, an attacker gNB could potentially easily deconfigure and turn ‘OFF’ the NCR-Fwd circuit 842.

[0090] , In one example, the 0AM will indicate to the NCR 808 if the NCR-MT 840 has connected to an unauthorized / un-authenticated gNB. This can for instance cause the NCR-MT 840 to disconnect to the gNB 804. NCR signalling. [0091 ]. In an NCR 808, DCI and MAC CE may be used to indicate to the NCR-Fwd circuit 842 to forward on certain antenna beams or in certain time slots. The inventors have recognized and appreciated that DCI and MAC CE are neither integrity protected nor ciphered. DCI is used for aperiodic forwarding and MAC CE is used for Semi-Persistent forwarding. Therefore, the inventors have recognized and appreciated that a malicious attacker may thus use the DCI or MAC CE to manipulate the NCR 808 to forward in order to create interference. Thus, in some examples, it is envisaged that certain restrictions may need to be put in place in order to either: (i) reduce the chance of malicious attacker; or (ii) at least reduce the chance to create a lot of interference.

[0092] , Similarly, it is known that in order to control the backhauling, MAC CE is used. The inventors have recognized and appreciated that an attacker could control (or partly control) the backhauling in order to either produce interference in the network or to disrupt and / or render any forwarding useless. For instance, if the downlink backhauling is functioning correctly, but an attacker uses MAC CE to change the uplink backhauling, then the operation of the NCR 808 can be rendered useless.

[0093] , Therefore, in some examples and in order to detect a possible malicious attacker, the NCR 808 may be configured to detect one or more of the following:

[0094] , receiving a DCI or MAC CE indicating resources that have not been configured. For instance, one example for Semi-Persistent Forwarding using MAC CE, detecting if a resource set ID or a beam index is used that has not been configured in the RRC configuration (NCR-SemiPersistentFwdResourceSet), then the NCR 808 may suspect that a malicious attacker is attempting to get the NCR 808 to forward. For instance, one example for aperiodic forwarding using DCI format 2 8, detecting if beam index or time resource index signaled in the DCI is outside of the range as signaled by RRC (in NCR-AperiodicFwdResourceSet), the NCR may suspect that a malicious attacker is attempting to get the NCR 808 to forward. For instance, one example for backhauling MAC CE, detecting if the NCR-MT 840 receiving MAC CE indicates a specific TCI or SRS resource that has not been configured by RRC;

[0095] , DCI (with format 2 8) if aperiodic forwarding has not been configured;

[0096] , MAC CE if semi-persistent forwarding has not been configured;

[0097] , a large amount of DCI / MAC CE signaling that is irregular. For instance, one example may be to detect if more than ‘X’ commands are received within ‘ Y’ time period, it may be assumed that the UE may have detected a malicious attacker;

[0098] , conflicting forwarding requests in DCI and MAC CE. For instance, the NCR 808 may receive requests to forward in the same beam or same time instance from DCI and MAC CE. This can detect a malicious attacker that is attempting to use one type of forwarding, while the other forwarding resources are being used. It is envisaged that this may happen if the attacker does not know the full RRC configuration, but attempts to get the NCR 808 to forward.

[0099] , If, in some examples, any of the above is detected, the NCR-MT 840 may be configured to perform one or more of the following actions: Ignore the DCI or MAC CE; if for instance a lot of attempts using DCI is made, the NCR can be configured to ignore any DCI (with format 2 8). Report the received signaling; this may allow a donor gNB 804 to de-configure any Semi-Persistent or Aperiodic forwarding to reduce risk of excessive forwarding. Perform Radio Link Failure / re-establishment; this can for instance be done if the NCR-MT detects a lot of attempts to forward that the donor gNB 804 does not deal with. The NCR-MT 840 may then signal the reason for performing RLF to indicate why the radio link failure was triggered.

[0100] , Referring now to FIG. 11, illustrates a simplified message sequence chart 1100 of one example of general outline of NCR procedures, adapted in accordance with some examples. The message sequence chart 1100 illustrates communications between an NCR 808 and a donor gNB 804 together with potential interference caused by an attacker donor gNB 710. In this example, the NCR 808 includes NCR-MT 840 operably coupled to NCR-Fwd circuit 842. At 1110, setup procedures are adopted with communications from donor gNB 804 to NCR-MT 840 of the NCR 808 to configure NCR-Fwd circuit 842. However, at 1120, attacker donor gNB 710 sends DCI or MAC CE to the NCR 808 to initiate forwarding operations. In response, at 1130, the NCR-MT 840 of the NCR 808 is configured to detect signalling that is inconsistent with a donor gNB’s configuration and in response at 1140, perform an action based on the detected signalling inconsistencies, such as report the received signalling that may indicate an attacker donor gNB 710 being at large.

[0101] , It is envisaged that in some examples, the above scenario may, for instance, protect against cases where the malicious attacker has knowledge or no knowledge of the RRC configuration (by applying or not applying ciphering of the NCR-Fwd configuration as described previously) for the NCR-Fwd circuit 842. With knowledge of the RRC configuration of the NCR-Fwd circuit 842, the attacker donor gNB 710 knows the specific resources where forwarding may occur if signaled via a MAC CE or DCI. Without knowledge, the attacker donor gNB 710 may obtain knowledge on what type of forwarding has been configured (periodic, semi-persistent and aperiodic forwarding) based on monitoring for DCIs and MAC CEs and the NCR 808 forwarding pattern. NCR-Fwd circuit 842 4 ON’ / 9 OFF’ operation.

[0102] , As previously explained in the background section, the AS security keys used for ciphering and integrity protection may be updated using the RRC reconfiguration with sync. One potential issue with this approach is that the reconfiguration with sync procedures requires a random access procedure being employed. Therefore, in one example, if an AS security update occurs, the NCR-Fwd circuit 842 may be configured to not perform any forwarding during the key update and the random access procedure. Alternatively, in another example, if the AS security key update is triggered and fails, the NCR-Fwd circuit 842 will be turned ‘OFF’.

[0103] , In accordance with some examples, proposed changes to the 3GPP standard are as highlighted {emphasis added} and as illustrated below: ----------------------Example based on 38.331 V17.5.0---------------------- 5.3.5.2 Initiation The Network may initiate the RRC reconfiguration procedure to a UE in RRC^CONNECTED. The Network applies the procedure as follows: - the establishment of RBs (other than SRB1, that is established during RRC connection establishment) is performed only when AS security has been activated; - the establishment of BH RLC Channels for IAB is performed only when AS security has been activated; the configuration of NCR-Fwd is performed only when AS security has been activated; - the establishment of Uu Relay RLC channels and PC5 Relay RLC channels (other than SL-RLC0 and SL-RLC1) for L2 U2N Relay UE is performed only when AS security has been activated, and the establishment of PC5 Relay RLC channels for L2 U2N Remote UE (other than SL-RLC0 and SL-RLC1) is performed only when AS security has been activated; - the addition of Secondary Cell Group and SCells is performed only when AS security has been activated; - the reconfigurationWithSync is included in secondaryCellGroup only when at least one RLC bearer or BH RLC channel is setup in SCG; - the reconfiguration WithSync is included in masterCellGroup only when AS security has been activated, and SRB2 with at least one DRB or multicast MRB or, for IAB, SRB2, are setup and not suspended; - the conditionalReconfiguration for CPC is included only when at least one RLC bearer is setup in SCG; - the conditionalReconfiguration for CHO or CPA is included only when AS security has been activated, and SRB2 with at least one DRB or multicast MRB or, for IAB, SRB2, are setup and not suspended. ----------------------Example based on running RRC CR R2-2306609---------------------- 5.3.5.5.X NCR-Fwd configuration The NCR-MT shall: 1 >if NCR-FwdConfig is set to setup: 2> if NCR-FwdConfig includes periodic forwarding resource configuration: 3> indicate to NCR-Fwd to forward in accordance with the configured periodic forwarding resource set(s) once NCR-Fwd is authorized to forward; NOTE: NCR-Fwd is considered authorized when AS security is established and AMF has authorized the NCR. l>else (NCR-FwdConfig is set to release): 2> release NCR-Fwd configuration; 2> indicate to NCR-Fwd to cease forwarding. ----------------------Example based on running MAC CR R2-2306602---------------------- 5.18.t Access Link Beam Indication for NCR NCR Access Link Beam Indication MAC CE is used by a gNB to indicate to an NCR-node the forwarding resources to be used for the semi-persistent access link transmission between the NCR-node and the UE(s) served by this device. Upon reception of an NCR Access Link Beam Indication MAC CE, the NCR-node shall: - apply the configuration signalled in the MAC CE as received by NCR-MT to the forwarding resource lists indicated via RRC, and use it to operate the NCR-Fwd. - If the NCR has been configured with Aperiodic forwarding and the resources indicated the Access Link Beam Indication is colliding with transmissions for aperiodic forwarding or if the resources indicated by lower layers collide with that indicated by the Access Link Beam Indication, the NCR reports the anomalous forwarding behaviour to the upper layer

[0104] , In particular, it is envisaged that the aforementioned inventive concept can be applied by a semiconductor manufacturer to any integrated circuit comprising a signal processor configured to perform any of the aforementioned operations. Furthermore, the inventive concept can be applied to any circuit that is able to configure, process, encode and / or decode signals for wireless distribution. It is further envisaged that, for example, a semiconductor manufacturer may employ the inventive concept in a design of a stand-alone device, such as a digital signal processor, or application-specific integrated circuit (ASIC) and / or any other sub-system element.

[0105] , It will be appreciated that, for clarity purposes, the above description has described example embodiments with reference to different functional units and processors. However, it will be apparent that any suitable distribution of functionality between different functional units or processors, for example with respect to the signal processor may be used without detracting from the concepts described herein. For example, functionality illustrated to be performed by separate processors or controllers may be performed by the same processor or controller. Hence, references to specific functional units are only to be seen as references to suitable means for providing the described functionality, rather than indicative of a strict logical or physical structure or organization.

[0106] , Aspects may be implemented in any suitable form including hardware, software, firmware or any combination of these. Examples may optionally be implemented, at least partly, as computer software running on one or more data processors and / or digital signal processors or configurable circuit components such as FPGA devices. Thus, the elements and components of an example may be physically, functionally and logically implemented in any suitable way. Indeed, the functionality may be implemented in a single unit, in a plurality of units or as part of other functional units.

[0107] , Although the concepts have been described in connection with some examples, it is not intended to be limited to the specific form set forth herein. Rather, the scope is limited only by the accompanying claims. Additionally, although a feature may appear to be described in connection with particular embodiments, one skilled in the art would recognize that various features of the described examples may be combined in other examples. In the claims, the term ‘comprising’ does not exclude the presence of other elements or steps.

[0108] , Furthermore, although individually listed, a plurality of means, elements or method steps may be implemented by, for example, a single unit or processor. Additionally, although individual features may be included in different claims, these may possibly be advantageously combined, and the inclusion in different claims does not imply that a combination of features is not feasible and / or advantageous. Also, the inclusion of a feature m one category of claims does not imply a limitation to this category, but rather indicates that the feature is equally applicable to other claim categories, as appropriate.

[0109] , In accordance with examples herein described, a system and a number of methods and devices are provided to make the NCR configuration and operation more secure, by for instance preventing or making it more difficult to perform attacks, wherein the aforementioned disadvantages with prior art arrangements have been substantially alleviated. Abbreviations / Definitions In the present disclosure, the following acronyms / definitions are used. 3GPP 3rd Generation Partnership Project 5G 5th Generation 5GC 5G Core 5QI 5G QoS Identifier 5GS 5G System 5GSM 5G System Session Management 5GMM 5G System Mobility Management AF Application Function AI Artificial Intelligence AM Acknowledged Mode AMF Access and Mobility Management Function AS Application Server ASP Application Service Provider AUSF Authentication Server Function CDN Content Delivery Network CN Core Network DCAF Data Collection Application Function DNAI Data Network Access Identifier DNN Data Network Name DNS Domain Name Server DRB Data Radio Bearer gNB Evolved Node B EPC Evolved Packet Core FEC Forward Error Correction FQDN Fully Qualified Domain Name GBR Guaranteed Bit Rate gNB Next generation Node B GPSI Generic Public Subscription Identifier HSS Home Subscriber Service IAB Integrated Access and Backhaul ID Identity / Identifier IIoT Industrial Internet of Things IMEI International Mobile Equipment Identities IP Internet Protocol I-SMF Intermediate SMF LADN Local Area Data Network LLSSM Lower Layer SSM MBMS Multimedia Broadcast / Multicast Service MBS Multicast / Broadcast Service MBSF Multicast Broadcast Service Function MBSTF Multicast / Broadcast Service Transport Function MB-SMF Multicast / Broadcast Session Management Function MB-UPF Multicast / Broadcast User Plane Function ML Machine Learning MME Mobility Management Entity MN Master Node MNF Monitoring Network Function MNO Mobile Network Operator MT Mobile Termination NAS Non-Access Stratum NEF Network Exposure Function NRF Network Repository Function NG-RAN Next Generation Radio Access Network NG-gNB Next Generation gNB NSA Non-Standalone NSSF Network Slice Selection Function NTN Non-Terrestrial Networks NW Network NWDAF Network Data Analytics Function OS Operating System OSAPP OS Application PCF Policy Control Function PCO Protocol Configuration Options PDR Packet Detection Rule PDU Protocol Data Unit PTM Point To Multipoint PTP Point to Point QFI QoS Flow Identifier (ID) QoS Quality of Service RACH Random Access Channel RAN Radio Access Network RRC Radio Resource Control RSD Route Selection Descriptor RSRP Reference Signal Received Power RSRQ Reference Signal Received Quality RSS Reference Signal Strength RSSI Received Signal Strength Indicator. SA Standalone SDAP Service Data Adaptation Protocol SDU Service Data Unit SGW Serving Gateway SIM Subscriber Identity Module SLA Service Level Agreement SM Session Management SMF Session Management Function SN Secondary Node S-NSSAI Single Network Slice Selection Assistance Information SSB Synchronization Signal Block SSM Source Specific IP Multicast address SSC Session and Service Continuity SRB Signaling Radio Bearer SUPI Subscription Permanent Identifier TA Tracking Area TAI Tracking Area Identity TE Terminal Equipment TM Transparent Mode TMGI Temporary Mobile Group Identity TS Technical Specification UDM Unified Data Manager UDR Unified Data Repository UE User Equipment UL Uplink UM Unacknowledged Mode UP User Plane UPF User Plane Function URLLC Ultra-Reliable and Low-Latency Communication URSP UE Route Selection Policy

Claims

:

1. A Network Control Repeater, NCR, (808) comprises:a transceiver; anda signal processor (859), operably coupled to the transceiver and configured to operate as:a NCR-Mobile Termination, NCR-MT, circuit (840) configured to communicate with at least one base station (804) using control link information (830) and wherein the NCR-MT circuit (840) and either the at least one base station (804) or a core network, CN, (905) that supports said at least one base station (804) are configured to mutually authenticate one another; anda NCR-Forward, NCR-Fwd, circuit (842) configured to communicate with and be configurable by the at least one base station (804) via a backhaul link;wherein the signal processor (859) is arranged, prior to access stratum, AS, security measures having been established between the at least one base station (804) and the NCR (808), to prevent a configuration of the NCR-Fwd circuit (842) being performed by the at least one base station (804).

2. The NCR (808) of Claim 1, wherein the CN (905), that supports said at least one base station (804) and having performed mutual authentication with the NCR (808), comprises an Access and Mobility Management Function, AMF, wherein the AMF having authorized the at least one base station (804) to configure the NCR (808) in an user equipment, UE, Context setup message.

3. The NCR (808) of any preceding Claim, wherein prior to AS security measures (1025) having been established, a first signalling radio bearer, SRB1, without AS security, is established between the NCR-MT (840) of the NCR (808) and the at least one base station (804).

4. The NCR (808) of any preceding Claim, wherein the CN (905) confirms to the at least one base station (804) that the NCR (808) is authorized following mutual authentication and the at least one base station (804) sends (1080) a RRCReconfiguration message to the NCR-MT (840) to configure the NCR-Fwd circuit (842).

5. The NCR (808) of Claim 4, wherein the at least one base station (804) employs ciphering of radio resource control, RRC, signalling when configuring an NCR-Fwd circuit (842).

6. The NCR (808) of Claim 5, wherein in response to the at least one base station (804) not employing ciphering of the RRC signalling when configuring the NCR-Fwd circuit (842), the NCR (808) is configured to perform at least one of: refuse the RRCReconfiguration message, consider the RRC signalling to be invalid.

7. The NCR (808) of any preceding Claim, wherein the signal processor (859) is configuredto determine when an attempt to configure the NCR (808) is performed before the AS security measures (1025) having been established, and in response thereto performs at least one of the following:perform a re-establishment procedure;configure the NCR-MT (840) to move into an RRC idle mode;report an attacker base station upon re-connecting to at least one base station (804) that is verified;configure the NCR-MT (840) to not pass on forwarding parameters to the NCR-Fwd circuit (842);configure the NCR-MT (840) to not activate forwarding operations.

8. The NCR (808) of any preceding Claim, wherein the NCR (808) is configured to not start a message forwarding operation until at least one security measure is in place, an operations, administration, and management, 0AM, connection has been established and the 0AM has indicated that forwarding can start.

9. The NCR (808) of Claim 8, wherein the NCR (808) is configured to not start a message forwarding operation until additionally the 0AM has performed an authentication check on the at least one base station (804) that the NCR (808) is connected to.

10. The NCR (808) of any preceding Claim, wherein the NCR-MT 840 of the NCR (808) is configured to detect signalling (1120) from an attacker base station (710) in an identification of at least one signalling inconsistency sent by the attacker base station (710) to the NCR (808) where the attacker base station (710) has attempted to initiate forwarding operations, using one of in downlink control information DCI, in a medium access control, MAC, control element, CE.

11. A wireless communication system comprising the NCR (808) according to any preceding Claim configured to communicate with the at least one base station of Claim 1.

12. A method for a Network Control Repeater, NCR, (808) comprising: communicating, using a NCR-Mobile Termination, NCR-MT circuit (840), with at least one base station (804) using control link information (830), wherein the NCR-MT circuit (840) and either the at least one base station (804) or a core network, CN, (905) that supports said at least one base station (804) are configured to mutually authenticate one another;communicating between a NCR-Forward, NCR-Fwd, circuit (842) and the at least one base station (804) via a backhaul link wherein the NCR-Fwd circuit (842) is configurable by the at least one base station (804); andpreventing a configuration of the NCR-Fwd circuit (842) by the at least one base station (804) prior to access stratum, AS, security having been established between the at least one base station (804) and the NCR (808).

13. A base station (804) comprises:a transceiver (806, 822); anda signal processor (809), operably coupled to the transceiver and configured to: communicate with a Network Control Repeater-Mobile Termination, NCR-MT, circuit of a NCR (808) using control link information (830); andconfigure a NCR-Forward, NCR-Fwd, circuit (842) of the NCR (808) via a backhaul link;wherein the signal processor (809) is arranged, prior to access stratum, AS, security having been established between the base station (804) and the NCR (808), to prevent the base station (804) performing a configuration of the NCR-Fwd circuit (842).

14. A method for a base station (804) comprising:communicating with a Network Control Repeater-Mobile Termination, NCR-MT, circuit (840) of a NCR (808) using control link information (830);communicating between a NCR-Forward, NCR-Fwd, circuit (842) and the base station (804) via a backhaul link wherein the communication comprises configuring the NCR-Fwd circuit (842) by the base station (804); andpreventing a configuration of the NCR-Fwd circuit (842) by the base station (804) prior to access stratum, AS, security having been established between the base station (804) and the NCR (808).CM

Images