Radio access network security

Abstract

To provide a method implemented by a network node configured for use in a wireless communication network, and the network node, as well as a program.SOLUTION: In a wireless communication network 10, a network node 20 configures multiple central unit user planes (CU-UPs) 14-1UP of a disaggregated radio network node 14 to handle different respective data radio bearers 16-1, ..., and 16-N of a wireless device 12 in multi-connectivity operation, and security handling of user plane traffic by the different CU-UPs 14-1UP is based on different respective security keys 18. The network node 20 configures different distributed units (DUs) of the disaggregated radio network node 14 to serve different respective ones of the data radio bearers 16-1, ..., and 16-N.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] This application relates generally to wireless access networks, and more particularly to security in such wireless access networks. [Background technology]

[0002] A split radio network architecture splits a radio network node (e.g., a base station) into a so-called central unit (CU) and one or more so-called distributed units (DUs). The central unit terminates higher layer and / or less time-critical protocols, such as Packet Data Convergence Protocol (PDCP) and Radio Resource Control (RRC) protocols, that are destined for the wireless devices. The central unit also controls the operation of the distributed unit(s). The distributed units, in contrast, terminate lower layer and / or more time-critical protocols, such as Radio Link Control (RLC), Medium Access Control (MAC), and physical layer protocols.

[0003] A radio network node may also be disaggregated via a separation between the user plane (UP) and the control plane (CP). In some cases, for example, a radio network node may include one or more CU-CPs and multiple CU-UPs, where the multiple CU-UPs handle or serve the same wireless device.

[0004] Disaggregating radio network nodes in this or other ways creates challenges from a security perspective: compromising security in one part of a disaggregated radio network node (e.g., one CU-UP) may in turn compromise security in another part of the disaggregated radio network node (e.g., another CU-UP). Summary of the Invention

[0005] Some embodiments herein ensure that the same security key is not shared among multiple CU-UPs of a disaggregated radio network node. Some embodiments thereby facilitate the deployment of CU-UPs in different security domains. This may advantageously isolate security compromises for each CU-UP (silo).

[0006] More particularly, embodiments herein include a method implemented by a network node configured for use in a wireless communication network, the method including configuring multiple central unit user planes (CU-UPs) of a disaggregated radio network node to handle different respective data radio bearers of a wireless device in multi-connectivity operation, where security handling of user plane traffic by the different CU-UPs is based on different respective security keys.

[0007] In some embodiments, the method further includes making a decision to perform the configuration of the multiple CU-UPs, where the decision is made based on at least one of any one or more of: load on the wireless communication network or on the disaggregated wireless network node, type of user plane traffic, time of day, and amount of user plane traffic.

[0008] In some embodiments, the method further includes configuring different distributed units (DUs) of the disaggregated radio network node to serve different respective ones of the data radio bearers.

[0009] In some embodiments, security processing is performed at the Packet Data Convergence Protocol (PDCP) layer.

[0010] In some embodiments, the security processing of user plane traffic includes downlink and / or uplink security processing, where the downlink security processing includes encrypting, integrity protecting, and / or replay protecting the user plane traffic in the downlink direction, and the uplink security processing includes decrypting and / or verifying the integrity and replay protecting the user plane traffic in the uplink direction.

[0011] In some embodiments, the multi-connectivity operation includes a dual connectivity operation.

[0012] In some embodiments, the network node comprises a central unit control plane (CU-CP).

[0013] Other embodiments herein include a method implemented by a wireless device, the method including transmitting and / or receiving user plane traffic for the wireless device over multiple data radio bearers served by multiple respective central unit user planes (CU-UPs) of a disaggregated radio network node, and performing security processing of the transmitted and / or received user plane traffic based on different user plane security keys for different data radio bearers and / or for different CU-UPs.

[0014] In some embodiments, the method further includes receiving signaling from a network node indicating user plane security keys for the different data radio bearers and / or the different CU-UPs and / or indicating which of the security keys should be used for which of the different data radio bearers and / or for which of the different CU-UPs. In some embodiments, the network node implements a Central Unit Control Plane (CU-CP).

[0015] In some embodiments, different data radio bearers belong to different respective groups of data radio bearers, and the security keys are different for the different groups of data radio bearers.

[0016] In some embodiments, security processing is performed at the Packet Data Convergence Protocol (PDCP) layer.

[0017] In some embodiments, the security processing of user plane traffic includes downlink and / or uplink security processing, where the uplink security processing includes encrypting, integrity protecting, and / or replay protecting user plane traffic transmitted in the uplink direction, and the downlink security processing includes decrypting and / or verifying the integrity and replay protecting of user plane traffic received in the downlink direction.

[0018] In some embodiments, performing security processing includes performing security processing of user plane traffic transmitted or received over a first radio bearer of the plurality of data radio bearers based on a first user plane security key for the first data radio bearer and / or for the first CU-UP, and performing security processing also includes performing security processing of user plane traffic transmitted or received over a second radio bearer of the plurality of data radio bearers based on a second user plane security key for the second data radio bearer and / or for the second CU-UP.

[0019] In some embodiments, the plurality of data radio bearers comprises a master data radio bearer associated with a master cell group (MCG) in dual connectivity operation and a secondary data radio bearer associated with a secondary cell group (SCG) in dual connectivity operation.

[0020] Other embodiments herein include a method implemented by a network node configured for use in a wireless communication network, the method including configuring user plane traffic for a wireless device to be transmitted and / or received over a plurality of data radio bearers served by a plurality of respective central unit user planes (CU-UPs) of the disaggregated wireless network node, the method also including configuring security processing of the transmitted and / or received user plane traffic to be performed based on different user plane security keys for different data radio bearers and / or for different CU-UPs.

[0021] In some embodiments, the method further includes making a decision to perform the configuring of user plane traffic and the configuring of security processing based on at least one of any one or more of a load on the wireless communication network or on the disaggregated radio network node, a type of user plane traffic, a time of day, and an amount of user plane traffic.

[0022] In some embodiments, the method includes configuring a wireless device to transmit and / or receive user plane traffic for the wireless device via multiple data radio bearers, configuring a wireless device with user plane security keys for different data radio bearers and / or for different CU-UPs, or configuring a wireless device with one or more parameters for deriving user plane security keys.

[0023] In some embodiments, the method includes configuring different distributed units (DUs) of a disaggregated radio network node to transmit and / or receive user plane traffic for a wireless device over multiple data radio bearers. Additionally or alternatively, the method includes configuring different CU-UPs with different ones of the user plane security keys or configuring different CU-UPs with one or more parameters for deriving different ones of the user plane security keys.

[0024] In some embodiments, different data radio bearers belong to different respective groups of data radio bearers, and the security keys are different for the different groups of data radio bearers.

[0025] In some embodiments, security processing is configured to be performed at the Packet Data Convergence Protocol (PDCP) layer.

[0026] In some embodiments, the plurality of data radio bearers comprises a master data radio bearer associated with a master cell group (MCG) in dual connectivity operation and a secondary data radio bearer associated with a secondary cell group (SCG) in dual connectivity operation.

[0027] In some embodiments, the network node implements a central unit control plane (CU-CP).

[0028] Embodiments herein also include corresponding apparatus, computer programs, and carriers of those computer programs. For example, embodiments herein include a network node configured for use in a wireless communication network, the network node configured to configure multiple central unit user planes (CU-UPs) of a disaggregated radio network node to handle different respective data radio bearers of a wireless device in multi-connectivity operation, and security processing of user plane traffic by the different CU-UPs is based on different respective security keys.

[0029] Embodiments herein also include a wireless device configured to transmit and / or receive user plane traffic for the wireless device via multiple data radio bearers served by multiple respective central unit user planes (CU-UPs) of a disaggregated radio network node, and to perform security processing of the transmitted and / or received user plane traffic based on different user plane security keys for different data radio bearers and / or for different CU-UPs.

[0030] Embodiments herein further include a network node configured for use in a wireless communications network. The network node is configured to configure user plane traffic for a wireless device to be transmitted and / or received over a plurality of data radio bearers served by a plurality of respective central unit user planes (CU-UPs) of the disaggregated radio network node. The network node is also configured to configure security processing of the transmitted and / or received user plane traffic to be performed based on different user plane security keys for different data radio bearers and / or for different CU-UPs.

[0031] Of course, the present disclosure is not limited to the above features and advantages. Indeed, those skilled in the art will recognize additional features and advantages upon reading the following detailed description, and upon viewing the accompanying drawings. [Brief description of the drawings]

[0032] [Figure 1] 1 is a block diagram of a wireless communication network according to some embodiments. [Diagram 2] FIG. 1 is a block diagram of a 5G network architecture, according to some embodiments. [Diagram 3] FIG. 2 is a block diagram of a disaggregated radio network node according to some embodiments. [Figure 4] FIG. 2 is a block diagram of a disaggregated radio network node with all CU-UPs centralized in a single location according to some embodiments. [Diagram 5] FIG. 2 is a block diagram of a disaggregated radio network node in which all CU-UPs are centralized but in different locations, according to some embodiments. [Figure 6] FIG. 1 is a block diagram of disaggregated radio network nodes, where some CU-UPs are centralized and others are distributed, according to some embodiments. [Figure 7] FIG. 2 is a block diagram of a disaggregated wireless network node using a CU-UP proxy according to some embodiments. [Figure 8] A block diagram of a disaggregated wireless network node in some embodiments, where multiple CU-UPs are supported with one CU-UP terminating security, consuming some UP traffic, and forwarding other UP traffic to another CU-UP. [Figure 9]FIG. 1 is a block diagram of a disaggregated wireless network node in which dual connectivity (DC) is used to ensure that multiple CU-UPs have separate security keys, according to some embodiments. [Figure 10] FIG. 1 is a block diagram of a disaggregated radio network node in which a CU-CP sets up a DC with an MCG and an SCG with the same DU, with connections to separate CU-UPs for MN and SN bearers, respectively, according to some embodiments. [Figure 11] FIG. 1 is a block diagram of a disaggregated radio network node in which a CU-CP sets up a DC with an MCG and SCG with the same DU, with connections to separate CU-UPs for MN and SN bearers, respectively, in accordance with some embodiments, and one or more cells may be part of both the MCG and SCG. [Figure 12] FIG. 2 is a block diagram of a disaggregated radio network node in which a UE has a separate key per DRB or per CU-UP according to some embodiments. [Figure 13] 1 is a logic flow diagram of a method implemented by a central unit user plane (CU-UP) proxy configured to act as a proxy for multiple CU-UPs of a disaggregated radio network node, according to some embodiments. [Figure 14] FIG. 2 is a logic flow diagram of a method implemented by a network node, according to some embodiments. [Figure 15] A logic flow diagram of a method implemented by a first central unit user plane (CU-UP) of a disaggregated radio network node comprising a first CU-UP and a second CU-UP, according to yet another embodiment. [Figure 16] FIG. 11 is a logic flow diagram of a method implemented by a network node configured for use in a wireless communications network, according to yet another embodiment. [Figure 17]4 is a logic flow diagram of a method implemented by a wireless device according to some embodiments. [Figure 18] FIG. 11 is a logic flow diagram of a method implemented by a network node configured for use in a wireless communications network, according to another embodiment. [Figure 19] 1 is a block diagram of a wireless device according to some embodiments. [Figure 20] FIG. 2 is a block diagram of a network node according to some embodiments. [Figure 21] FIG. 2 is a block diagram of a CU-UP proxy according to some embodiments. [Figure 22] FIG. 2 is a block diagram of a CU-UP according to some embodiments. [Diagram 23] 1 is a block diagram of a wireless communication network according to some embodiments. [Figure 24] FIG. 2 is a block diagram of a user equipment according to some embodiments. [Diagram 25] FIG. 1 is a block diagram of a virtualization environment, according to some embodiments. [Figure 26] 1 is a block diagram of a communications network having a host computer according to some embodiments. [Figure 27] FIG. 2 is a block diagram of a host computer, according to some embodiments. [Figure 28] 1 is a flow chart illustrating a method implemented in a communication system according to one embodiment. [Figure 29] 1 is a flow chart illustrating a method implemented in a communication system according to one embodiment. [Diagram 30] 1 is a flow chart illustrating a method implemented in a communication system according to one embodiment. [Diagram 31] 1 is a flow chart illustrating a method implemented in a communication system according to one embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0033] 1 illustrates a wireless communication network 10 according to some embodiments, for example in the form of a 5G network. The wireless communication network 10 is configured to provide wireless communication services to wireless devices 12, for example user equipment (UE). The wireless communication network 10 includes a disaggregated radio network node 14 in this regard.

[0034] The disaggregated radio network node 14 is disaggregated in that it is split into a so-called central unit (CU) 14-1 and one or more so-called distributed units (DUs) 14-2. The CU 14-1 terminates higher layer and / or less time-critical protocols, such as Packet Data Convergence Protocol (PDCP) and Radio Resource Control (RRC) protocols, which are destined for the wireless devices 12. The CU 14-1 also controls the operation of the distributed unit(s) 14-2, which in contrast terminates lower layer and / or more time-critical protocols, such as Radio Link Control (RLC), Medium Access Control (MAC), and physical layer protocols.

[0035] The disaggregated radio network node 14 is disaggregated through a separation between the user plane (UP) and the control plane (CP). As shown, for example, the disaggregated radio network node 14 includes one or more CU-CPs 14-CPs and multiple CU-UPs 14-1UPs that handle or serve the same wireless device 12.

[0036] 1 takes advantage of multi-connectivity operation of the wireless device 12. Multi-connectivity operation in this regard refers to the simultaneous use of multiple (independent) communication paths for communication with the wireless device 12, e.g., where separate schedulers are used for the multiple communication paths. One example of multi-connectivity is dual connectivity (DC), where two communication paths are used simultaneously for communication with the wireless device 12.

[0037] In some embodiments, different distributed units (DUs) 14-2 of the disaggregated radio network node 14 may provide different communication paths for multi-connectivity operation. In some embodiments, for example, a master cell group (MCG) includes one or more cells provided by one DU 14-2 acting as a master node (MN) in DC operation, and a secondary cell group (SCG) includes one or more cells served by another DU 14-2 acting as a secondary node (SN) in DC operation.

[0038] In other embodiments, in contrast, a single DU 14-2 of a disaggregated radio network node 14 may provide different communication paths for multi-connectivity operations. In one embodiment, for example, the same DU 14-2 may act as both an MN and an SN by providing a cell included in both the MCG and SCG in DC operations. In this case, the CU-CP 14-1CP(s) may then ensure that different identifiers (e.g., different RNTIs or C-RNTIs) are allocated and used for the MN (MCG) and SN (SCG) so that the wireless device 12 and the DU 14-2 can distinguish between the operations and events of the MN and the SN.

[0039] Regardless of whether different communication paths for multi-connectivity operation are provided by multiple DUs or a single DU, multiple Data Radio Bearers (DRBs) 16-1...16-N support this multi-connectivity operation, e.g., as distinguished from Signaling Radio Bearers (SRBs). The DRBs 16-1...16-N are radio bearers on which user plane traffic is transported. In some embodiments, the data radio bearers 16-1...16-N include a master data radio bearer and one or more secondary data radio bearers.

[0040] The embodiments herein take advantage of such multi-connectivity operation, more particularly by configuring multiple CU-UPs 14-1UP of a disaggregated radio network node 14 to handle different respective data radio bearers 16-1...16-N of a wireless device 12 in multi-connectivity operation. In particular, multiple CU-UPs 14-1UP are configured to handle different respective data radio bearers 16-1...16-N, and security processing of user plane traffic by the different CU-UPs 14-1UP is based on different respective security keys 18, e.g. in the form of different respective user plane security keys. Some embodiments thereby ensure that the same security key 18 is not shared between multiple CU-UPs 14-1UP of a disaggregated radio network node 14. Some embodiments thereby facilitate the deployment of CU-UPs 14-1UP in different security domains. This may advantageously isolate security compromises per CU-UP.

[0041] In some embodiments, security processing based on the different respective security keys 18 is performed at the Packet Data Convergence Protocol (PDCP) layer. In these and other embodiments, security processing may include downlink security processing and / or uplink security processing. Downlink security processing may include encrypting, integrity protecting, and / or replay protecting user plane traffic in the downlink direction. Conversely, uplink security processing may include decrypting user plane traffic in the uplink direction and / or verifying the integrity and replay protection of user plane traffic.

[0042] 1 shows that configuring multiple CU-UPs 14-1UP in this manner may be performed by a network node 20, which in some embodiments is or implements a CU-CP 14-1CP of the disaggregated radio network node 14. In other embodiments, the network node 20 is a radio network device, or a core network device, or an operation and maintenance device.

[0043] Regardless, in some embodiments, the network node 20 configures multiple CU-UPs 14-1UP in this manner, by configuring different CU-UPs 14-1UP with different respective ones of the security keys 18, or by configuring different CU-UPs 14-1UP with one or more parameters for deriving different respective ones of the security keys 18. Alternatively or additionally, the network node 20 may configure the wireless device 12 with security keys 18 for different data radio bearers 16-1...16-N and / or for different CU-UPs 14-1UP, or may configure the wireless device 12 with one or more parameters for deriving the security keys 18.

[0044] In some embodiments, a single DU 14-2 is configured to transmit and / or receive user plane traffic for a wireless device 12 over multiple data radio bearers 16-1...16-N, as illustrated in Figures 10 and 11. In other embodiments, in contrast, multiple different DUs 14-2 of a disaggregated radio network node 14 are configured to transmit and / or receive user plane traffic for a wireless device 12 over multiple data radio bearers 16-1...16-N, as illustrated in Figure 9, for example.

[0045] Next, additional embodiments are described, at least some of which may be described, for purposes of explanation, as applicable in certain contexts and / or wireless network types, although the embodiments are likewise applicable in other contexts and / or wireless network types not explicitly described.

[0046] Some embodiments of the present specification are applicable in 5G systems.

[0047] The 5G RAN architecture is described in 3GPP TS38.401 V16.2.0, NG-RAN, Architecture Description, as shown in Figure 2. The NG-RAN consists of a set of eNBs and gNBs connected to the 5G Core (5GC) through the NG. The eNBs / gNBs can support Frequency Division Duplex (FDD) mode, Time Division Duplex (TDD) mode, or dual mode operation. The eNBs / gNBs can be interconnected through Xn. The gNBs can consist of a gNB central unit (gNB-CU) and a gNB distributed unit (gNB-DU). The gNB-CU and gNB-DU are connected through an F1 logical interface. One gNB-DU is connected to only one gNB-CU.

[0048] NG, Xn, and F1 are logical interfaces. In the case of NG-RAN, the NG and Xn-C interfaces for a gNB consisting of a gNB-CU and a gNB-DU terminate at the gNB-CU. In the case of E-UTRA New Radio Dual Connectivity (EN-DC), the S1-U and X2-C interfaces for a gNB consisting of a gNB-CU and a gNB-DU terminate at the gNB-CU. The gNB-CU and the connected gNB-DU are only visible to other gNBs and 5GC as a gNB.

[0049] The F1 Application Protocol (F1AP) is specified in 3GPP TS38.473 V16.2.0.

[0050] The NG-RAN is layered into a Radio Network Layer (RNL) and a Transport Network Layer (TNL). The NG-RAN architecture, i.e., the NG-RAN logical nodes and the interfaces between the NG-RAN logical nodes, are specified as part of the RNL. For each NG-RAN interface (NG, Xn, F1), the relevant TNL protocols and functions are specified. The TNL provides services for user plane transport and signaling transport. In an NG-Flex configuration, each gNB is connected to all Access and Mobility Functions (AMFs) within an AMF area. The AMF area is specified in 3GPP TS23.501 V16.6.0.

[0051] The overall architecture for the separation of gNB-CU-CP and gNB-CU-UP is shown in 3. A gNB may consist of a gNB-CU-CP, multiple gNB-CU-UPs and multiple gNB-DUs. The gNB-CU-CP is connected to the gNB-DU through an F1-C interface. The gNB-CU-UPs are connected to the gNB-DU through an F1-U interface. The gNB-CU-UPs are connected to the gNB-CU-CP through an E1 interface. One gNB-DU is connected to only one gNB-CU-CP. One gNB-CU-UP is connected to only one gNB-CU-CP.

[0052] For resiliency, gNB-DU and / or gNB-CU-UP may be connected to multiple gNB-CU-CPs by appropriate implementation. One gNB-DU may be connected to multiple gNB-CU-UPs under the control of the same gNB-CU-CP. One gNB-CU-UP may be connected to multiple DUs under the control of the same gNB-CU-CP. Connectivity between gNB-CU-UP and gNB-DU is established by the gNB-CU-CP using bearer context management functions. The gNB-CU-CP selects the appropriate gNB-CU-UP(s) for the requested service for the UE. Data forwarding between gNB-CU-UPs during intra-gNB-CU-CP handover within a gNB may be supported by Xn-U.

[0053] The E1 interface provides support for several procedures as described in 3GPP TS38.463 v16.2.0.

[0054] The parameters exchanged during the E1 setup procedure (1) inform the CU-CP regarding the specific supported attributes of the CU-UP that can be evaluated by the CU-CP when selecting a specific CU-UP in the user plane establishment for a particular UE.

[0055] As can be seen from the bearer establishment procedure, (2) the CU-CP establishes a bearer that includes a large set of parameters. Some parameters, such as QoS parameters, depend on the bearer requirements. Thus, the selection of the CU-UP takes into account the support of specific CU-UP attributes. For example, one CU-UP may be optimized for Vehicle 2 Everything (V2X) services realized by one (one or more) Single Network Slice Selection Assistance Information (S-NSSAI), and one other CU-UP may be desired to be used for Mobile Broadband (MBB) realized on another (one or more) S-NSSAI. In the bearer establishment, the CU-CP will then preferably select the CU-UP accordingly.

[0056] To support the above, one UE may connect to several gNB-CU-UPs that belong to different security domains (see, for example, RP-191975 and S3-201381). A disaggregated gNB herein may include multiple CU-UPs according to various embodiments shown in Figures 4 to 6 in accordance with 3GPP TR38.823 V16.0.0.

[0057] One option, shown in Figure 4, is for all CU-UPs to be centralized in a single location. Another option, shown in Figure 5, is for all CU-UPs to be centralized but in different locations. Yet another option, shown in Figure 6, is for some CU-UPs to be centralized and others to be distributed.

[0058] Given this, some embodiments herein address the need for a CU-UP to handle UE traffic secured with a security key shared with the UE. There is one root key to secure one UE's traffic. When there is only one CU-UP, that CU-UP uses the necessary security keys, which is acceptable. When there are multiple CU-UPs, all of those CU-UPs would ever need to share security keys, which is unacceptable from a security point of view, since compromising one of the CU-UPs means that UE traffic handled by all of those CU-UPs could be compromised.

[0059] In fact, even when all CU-UPs are centralized in a single location, the level of trust does not have to be the same for all of those CU-UPs. Each of those CU-UPs can be virtualized with different security hardening or handled by different slice providers. If the same security key for UE UP traffic is shared between all CU-UP instances, there is a threat that a compromise in one of those CU-UP instances means that all of those CU-UP instances are affected. The above threats are also applicable to CU-UPs that are centralized in different locations. The above threats are even more evident for a mixed deployment of CU-UPs in centralized and distributed locations.

[0060] Some aspects of the present disclosure and their embodiments may provide solutions to these or other problems. Various embodiments herein ensure that the same security key is not shared between different instances of the CU-UP. Some embodiments thereby facilitate the deployment of CU-UP in different security domains. In particular, some embodiments support disaggregated gNB-CU-UP to maintain the security principle of separate UP keys per CU-UP instance.

[0061] Some embodiments may provide one or more of the following technical advantage(s): The same security key is not shared between different instances of the CU-UP.

[0062] Various embodiments are described below for achieving multiple CU-UPs while preserving the security principle of not sharing UE-related security keys among two or more CU-UPs.

[0063] Figure 7 shows an example of a Group A and / or Group AA embodiment described in the embodiments section of this specification. In Figure 7, a new function called CU-UP Proxy is introduced. The CU-UP Proxy terminates security towards the UE and delivers UP traffic to multiple CU-UPs in a secure link.

[0064] As shown, there are two CU-UPs, namely, CU-UP1 and CU-UP2. The CU-UP proxy is located between the DU and CU-UP1 / 2. The interface between the CU-UP proxy and CU-UP1 / 2 may be a new F1-U-like interface, e.g., F1-U-bis, which may be secured with technologies such as IP Security (IPsec) or Transport Layer Security (TLS).

[0065] The CU-UP Proxy can be considered as a CU-UP that supports proxy capabilities. This capability is exposed to the CU-CP when setting up the E1 interface. One encoding possibility for this capability indication is shown below. GNB-CU-UP E1 Setup Request: This message is sent by the gNB-CU-UP to transfer information for TNL association. Direction: gNB-CU-UP(R) gNB-CU-CP TIFF2025060878000002.tif238170

[0066] Similarly, if the E1 setup procedure is triggered by the CU-CP, a proxy instruction may be added to the relevant message, as shown as an example below. GNB-CU-CP E1 Setup Response: This message is sent by the gNB-CU-UP to transfer information for TNL association. Direction: gNB-CU-UP(R) gNB-CU-CP TIFF2025060878000003.tif249170

[0067] In the bearer context setup procedure, the CU-CP needs to link together the entities in CU-UP1 and CU-UP2 with the entities in the CU-UP proxy. The following flow is an example of how this can be achieved. 1. The CU-CP establishes a bearer context with CU-UP1 and CU-UP2. For each DRB, CU-UP1 and CU-UP2 provide their UL TNL address information to be used on the F1-U-bis. 2. The CU-CP establishes a bearer context with the CU-UP proxy. In this step, the CU-UP proxy is informed about the UL TNL address information to be used on the F1-U-bis towards CU-UP1 and CU-UP2, respectively, established in step 1. For each DRB, the CU-UP proxy provides the DL TNL address information to be used on the F1-U-bis as the termination for communication with CU-UP1 and CU-UP2. 3. The CU-CP modifies the bearer context in CU-UP1 and CU-UP2 by providing the information required to communicate with the CU-UP proxy, i.e., for each DRB, as the termination for communication information in the CU-UP proxy, the DL TNL address information to be used on the F1-U-bis should be used by CU-UP1 and CU-UP2.

[0068] Security and Policy Management: The CU-UP proxy obtains at least one security key, Key-UP-1, for securing UP traffic. This may be such that the CU-CP provides Key-UP-1 to the CU-UP proxy using an E1 interface or a new E1-like interface introduced in 3GPP. This security key may be directly used to secure UP traffic, or this security key may be a root key from which child keys are derived to secure UP traffic. This security processing may be one or more of encryption / decryption, integrity protection / verification, and replay protection.

[0069] Similarly, the CU-UP proxy obtains security algorithms (not shown in FIG. 7) for processing UP traffic. These security algorithms may include one or more of the algorithms for encryption / decryption and integrity protection / verification.

[0070] Similarly, the CU-UP proxy obtains a security policy (not shown in FIG. 7) for handling UP traffic. This security policy may indicate whether encryption / decryption, integrity protection / verification, and replay protection are enabled for UP traffic. This security policy may also indicate the maximum traffic rate supported by the UE.

[0071] Similarly, the CU-UP proxy gets information about what type of UP traffic should be routed to which CU-UP. For example, depending on bearer ID, IP address, transport protocol port, transport protocol type, access point, etc., some UP traffic may be forwarded to CU-UP1, while others are forwarded to CU-UP2.

[0072] Uplink Security Processing: When uplink UP traffic from the UE reaches the CU-UP proxy, the CU-UP proxy security processes the UP traffic using a key based on Key-UP-1. This security processing may include one or more of decryption, integrity verification, and replay protection. The CU-UP proxy may also perform other non-security processing such as header decompression.

[0073] After security processing, the CU-UP proxy provides all or part of the UP traffic to CU-UP1 and CU-UP2 depending on the information it obtains about routing the UP traffic. The UP traffic that the CU-UP proxy provides to the CU-UP is plaintext traffic (no longer protected with the key used by the UE). Therefore, this traffic needs to be sent in a link such as F1-U, which can be secured using, for example, IPsec or TLS or WireGuard.

[0074] The CU-UP proxy may implement the Packet Data Convergence Protocol (PDCP) protocol.

[0075] Downlink Security Processing: When downlink UP traffic from one or more CU-UPs reaches the CU-UP proxy, the CU-UP proxy uses a key based on Key-UP-1 to security process the UP traffic. This security processing may include one or more of encryption, integrity protection, and replay protection. The CU-UP proxy may also perform other non-security processing such as header compression.

[0076] After security processing, the CU-UP proxy provides all or part of the UP traffic to the UE. The UP traffic that the CU-UP proxy provides to the UE is ciphertext traffic (protected with a key used by the UE).

[0077] The CU-UP proxy may implement the Packet Data Convergence Protocol (PDCP) protocol.

[0078] CU-UP Proxy Placement: The CU-UP proxy may be co-located or provided as part of the DU, CU-CP. The CU-UP proxy may also be a separate function or node. When co-located or provided by the DU, this solution may be realized by the DU implementing the PDCP protocol.

[0079] The CU-UP proxy may be located in the same or a different security domain than the CU-CP, CU, and CU-UP.

[0080] Other considerations: To support optimized data scheduling for the air interface and efficient memory usage in the DU, flow control for each Data Radio Bearer (DRB) for a given UE is supported in the current specification. Flow control manages the data flow from the CU-UP through the F1-U to the DU.

[0081] In some embodiments herein, there is flow control on the interface between the CU-UP proxy and CU-UP1, and between the CU-UP proxy and CU-UP2, assuming that one DRB is terminated in CU-UP1 and another DRB is terminated in CU-UP2, respectively.

[0082] However, in other embodiments, there is no flow control on the interfaces between the CU-UP proxy and CU-UP1, and between the CU-UP proxy and CU-UP2, assuming that one DRB is terminated at CU-UP1 and another DRB is terminated at CU-UP2, respectively.

[0083] Figure 8 illustrates an example of a Group B and / or Group BB embodiment described in the embodiments section of this specification. In Figure 8, multiple CU-UPs are supported with one CU-UP terminating security, consuming some UP traffic, and forwarding other UP traffic to another CU-UP.

[0084] As shown, there are multiple CU-UPs, namely CU-UP1 and CU-UP2. The interface between these CU-UPs may be a new F1-U-like interface, e.g., F1-U-bis-bis, which may be secured with technologies such as IPsec or TLS.

[0085] General administration considerations: A CU-UP operating in plain text mode may be considered as a CU-UP supporting plain text mode capability. This capability is exposed to the CU-CP when setting up the E1 interface. One possible encoding of this capability indication is shown below: GNB-CU-UP E1 Setup Request: This message is sent by the gNB-CU-UP to transfer information for TNL association. Direction: gNB-CU-UP(R) gNB-CU-CP TIFF2025060878000004.tif238170

[0086] Similarly, if the E1 setup procedure is triggered by the CU-CP, a plain text mode support indication may be added to the relevant message, as shown as an example below. GNB-CU-CP E1 Setup Response: This message is sent by the gNB-CU-UP to transfer information for TNL association. Direction: gNB-CU-UP(R) gNB-CU-CP TIFF2025060878000005.tif238170

[0087] In the bearer context setup procedure, the CU-CP needs to link the entities in CU-UP1 and CU-UP2 together. The following flow is an example of how this can be achieved. 1. The CU-CP establishes a bearer context with CU-UP2. The bearer context in CU-UP2 is set to operate in plain text mode. For each DRB, CU-UP2 provides the UL TNL address information to be used by CU-UP1 on the F1-U-bis. 2. The CU-CP establishes a bearer context with CU-UP1, including, for each DRB, UL TNL address information to be used on the F1-U-bis for communication with CU-UP2. For each DRB, CU-UP1 provides DL TNL address information to be used on the F1-U-bis by CU-UP2. 3. The CU-CP modifies the bearer context in the CU-UP2 to provide, for each DRB, the DL TNL address information to be used by the CU-UP2 on the F1-U-bis.

[0088] Security and Policy Management: The CU-UP1 obtains at least one security key, Key-UP-1, for securing UP traffic. This obtaining may be such that the CU-CP provides Key-UP-1 to the CU-UP1 using an E1 interface introduced in 3GPP or a new E1-like interface. This security key may be directly used to secure UP traffic, or this security key may be a root key from which child keys are derived to secure UP traffic. This security processing may be one or more of encryption / decryption, integrity protection / verification, and replay protection.

[0089] Similarly, CU-UP1 obtains security algorithms (not shown) for processing UP traffic. These security algorithms may include one or more of the following algorithms for encryption / decryption and integrity protection / verification.

[0090] Similarly, CU-UP1 obtains a security policy (not shown in the figure) for handling UP traffic. This security policy may indicate whether encryption / decryption, integrity protection / verification, and replay protection are enabled for UP traffic. This security policy may also indicate the maximum traffic rate supported by the UE.

[0091] Similarly, CU-UP1 gets information about what type of UP traffic should be routed to which CU-UP2. For example, depending on bearer ID, IP address, transport protocol port, transport protocol type, access point, etc., some UP traffic may be forwarded to CU-UP2, while others may be handled by CU-UP1 itself.

[0092] CU-UP2 accepts plaintext UP traffic from CU-UP1. Plaintext UP traffic means that the UP traffic is not protected with the key used by the UE. There may be transport layer protection using IPsec or TLS, but these protections do not use the key used by the UE.

[0093] Uplink Security Processing: When uplink UP traffic from the UE reaches CU-UP1, CU-UP1 security processes the UP traffic using a key based on Key-UP-1. This security processing may include one or more of decryption, integrity verification, and replay protection. CU-UP1 may also perform other non-security processing such as header decompression.

[0094] After security processing, CU-UP1 provides all or part of the UP traffic to CU-UP2 depending on the information it obtains about routing the UP traffic. The UP traffic that CU-UP1 provides to CU-UP2 is plaintext traffic (no longer protected with the key used by the UE). Therefore, this traffic needs to be sent in a link such as F1-U, which can be secured using, for example, IPsec or TLS or WireGuard.

[0095] CU-UP1 can implement the Packet Data Convergence Protocol (PDCP) protocol.

[0096] Downlink Security Processing: When downlink UP traffic from CU-UP2 reaches CU-UP1, CU-UP1 secures the UP traffic using a key based on Key-UP-1. CU-UP1 may also have downlink data alone, which is securely processed by CU-UP1. This security processing may include one or more of encryption, integrity protection, and replay protection. CU-UP1 may also perform other non-security processing, such as header compression.

[0097] After security processing, CU-UP1 provides all or part of the UP traffic to the UE. The UP traffic provided by CU-UP1 to the UE is ciphertext traffic (protected by a key used by the UE).

[0098] CU-UP1 can implement the Packet Data Convergence Protocol (PDCP) protocol.

[0099] CU-UP Placement: The CU-UP1 may be co-located or provided as part of the DU, CU-CP, or may be a separate function or node.

[0100] CU-UP1 may be located in the same or a different security domain as the CU-CP, CU, and CU-UP.

[0101] Other considerations: To support optimized data scheduling for the air interface and efficient memory usage in the DU, flow control for each Data Radio Bearer (DRB) for a given UE is supported in the current specification. Flow control manages the data flow from the CU-UP through the F1-U to the DU.

[0102] In one embodiment, there is flow control on the interface between CU-UP1 and CU-UP2. In another embodiment, there is no flow control on the interface between CU-UP1 and CU-UP2 and between the CU-UP proxy and CU-UP2.

[0103] FIG. 9 illustrates an example of FIG. 1 as well as Group X embodiments, such as embodiment X4, described within the embodiments section of this specification.

[0104] In dual connectivity (DC), the UE has one radio resource control (RRC) state based on the master node (MN) RRC. However, each radio node has its own RRC entity that can generate RRC protocol data units (PDUs) to be sent to the UE. RRC PDUs generated by a secondary node (SN) can be transported to the UE via the MN or SN, except for the initial SN RRC setup, which is sent via the MN. This means that in the current DC architecture, there are two RRC entities involved instead of one.

[0105] In the following, without loss of generality, it is assumed that the MN RRC entity and the SN RRC entity are handled by the same CU-CP, however, it should be appreciated that the SN RRC entity may involve different CU-CPs.

[0106] To avoid multiple CU-UPs sharing the same security key, the CU-CP sets up DCs with Master Cell Group (MCG) and Secondary Cell Group (SCG) with different DUs, with connections to separate CU-UPs for MN and SN bearers, respectively, so that some UP traffic is sent to one CU-UP and others to another CU-UP.

[0107] That is, the DC is used to ensure that multiple CU-UPs have separate security keys. Each CU-UP terminates its own PDCP security towards the UE, ensuring that multiple CU-UPs have separate security keys. In some embodiments, the security handling of the DC shall be in accordance with 3GPP TS33.501 V16.4.0 clause 6.10.

[0108] The dual CU-UP with separate keys based on DC can be generalized to multi-CU-UP with separate keys by extending dual connectivity (DC) to multi-connectivity (MC) with three or more nodes (e.g., MN, SN1, SN2) and three or more cell groups (e.g., MCG, SCG1, SCG2).

[0109] FIG. 10 illustrates another example of FIG. 1 as well as Group X embodiments described within the embodiments section herein, such as embodiment X6.

[0110] As a variation of Figure 9 above, the CU-CP sets up DCs with MCG and SCG with the same DU, with connections to separate CU-UPs for MN and SN bearers, respectively, so that some UP traffic is sent to one CU-UP and other to another CU-UP.

[0111] In some embodiments where a DC is configured with the same DU handling the MCG and SCG (i.e., the same DU acting as both MN and SN), the CU-CP ensures that the MN and SN contexts for the UE can be differentiated. For example, by allocating / using different UE context identifiers for the MN and SN roles of the DU to allow the DU to differentiate the MN and SN contexts for the UE. The UE context identifier(s) may comprise, for example, one or more of a Radio Network Temporary Identifier (RNTI), a Cell RNTI (C-RNTI), a CU endpoint identifier (e.g., gNB-CU UE F1AP ID), and a DU endpoint identifier (e.g., gNB-DU UE F1AP ID).

[0112] In some embodiments, a field or information element (IE) is added, for example, in the UE context, F1 signaling, Uu signaling and / or Uu UP PDU header (e.g., PDCP PDU header) to distinguish MN and SN context / role / association or CU-UP association. The field or IE may comprise, for example, an index (e.g., 0 for MN, 1 for SN or SN1, 2 for SN2, etc.), a value associated with an instance or role of a DU, a value associated with a particular CU-UP, or another discriminator, e.g., "MN" or "SN".

[0113] In some embodiments, the F1-C interfaces relating to the MN and SN roles of a gNB are combined or coupled, for example, by the following: Using the same CU endpoint identifier and / or DU endpoint identifier with a new discriminator in the F1-AP for F1-C related to the MN and SN roles of the gNB, respectively; Use the same gNB-CU UE F1AP ID and / or gNB-DU UE F1AP ID with a new discriminator in the F1-AP for F1-C related MN and SN roles of the gNB, respectively; or using predefined relationships between CU endpoint identifiers and / or between DU endpoint identifiers for F1-C related to the MN and SN roles of the gNB, respectively; Using predefined relationships between gNB-CU UE F1AP IDs and / or between gNB-DU UE F1AP IDs for F1-C related to MN and SN roles of a gNB, respectively. o For example, odd IDs may be used for the MN role and even IDs for the SN role. The relationship between MN identifiers and SN identifiers is Y=X+(K mod N)+M

[0043] where Y is an ID associated with the SN role, X is an ID associated with the MN role, K is an index (e.g., 0 for MN, 1 for SN or SN1, 2 for SN2, etc.), N is the number of MN and SN combinations supported, and M is an offset.

[0114] In some embodiments, when MN and SN bearers are served by the same DU, the CU-CP(s) ensure that different radio bearer (RB) identifiers and / or logical channel identifiers are allocated and used for the MN and SN bearers, respectively, so that the UE and DU can distinguish between MN and SN operations and events and data can be routed to the relevant CU-UP instance.

[0115] In some embodiments, when MN and SN bearers are served by the same DU, the CU-CP configures the UE and DU with identifiers or indices corresponding to different CU-UPs, and the UE and / or DU include an identifier or index associated with the CU-UP that handles the bearer for the transmission of associated data and / or signaling.

[0116] FIG. 11 illustrates another example of FIG. 1 as well as Group X embodiments described in the embodiments section herein, such as embodiment X7.

[0117] As a variation of Figures 9 and 10, a CU-CP sets up a DC with an MCG and SCG with the same DU, where one or more cells may be part of both the MCG and SCG, with connections to separate CU-UPs for MN and SN bearers, respectively, so that some UP traffic is sent to one CU-UP and others to another CU-UP.

[0118] In some embodiments, when MN and SN bearers are served on the same cell, the CU-CP(s) ensure that different UE identifiers (e.g., different RNTIs or C-RNTIs) are allocated and used for the MN (MCG) and SN (SCG) so that the UE and DU can distinguish between MN and SN operations and events.

[0119] In some embodiments, when MN and SN bearers are served on the same cell, the CU-CP(s) ensure that different RB identifiers and / or logical channel identifiers are allocated and used for the MN and SN bearers, respectively, so that the UE and DU can distinguish between MN and SN operations and events and data can be routed to the relevant CU-UP instance.

[0120] In some embodiments, when MN and SN bearers are served on the same cell, the CU-CP configures the UE and DU with identifiers or indices corresponding to different CU-UPs, and the UE and / or DU include an identifier or index associated with the CU-UP that handles the bearer for transmission of the associated data.

[0121] Figure 12 shows an example of a Group Y and / or Group YY embodiment described in the embodiments section of this specification. In Figure 12, the UE has a separate key per DRB or per CU-UP. Security for each DRB terminates in one of the CU-UPs.

[0122] As shown in Figure 12, separate DRBs are forwarded by a DU to separate CU-UPs. A group of DRBs may also be forwarded to a CU-UP.

[0123] The separate keys can be achieved with the help of a Core Network (CN), not shown in the figure, or by the RAN itself.

[0124] Security and Policy Management: The CU-UPs, i.e., CU-UP1 and CU-UP2, obtain security keys Key-UP-1 and Key-UP-2, respectively, to secure UP traffic. This may be such that the CU-CP provides those keys to the CU-UP using the E1 interface or a new E1-like interface introduced in 3GPP. These security keys may be directly used to secure UP traffic, or these security keys may be root keys from which child keys are derived to secure UP traffic. This security processing may be one or more of encryption / decryption, integrity protection / verification, and replay protection.

[0125] Similarly, the CU-UP obtains security algorithms (not shown) for processing UP traffic. These security algorithms may include one or more of the following algorithms for encryption / decryption and integrity protection / verification.

[0126] Similarly, the CU-UP obtains a security policy (not shown in the figure) for handling UP traffic. This security policy may indicate whether encryption / decryption, integrity protection / verification, and replay protection are enabled for UP traffic. This security policy may also indicate the maximum traffic rate supported by the UE.

[0127] The DU obtains information on how UP traffic should be routed to which CU-UP, such that a certain DRB is routed to one CU-UP, e.g., DRB1 to CU-UP1 and DRB2 to CU-UP2. This can be such that the CU-CP or the core network (such as AMF Access and Mobility Management Function, SMF Session Management Function, SEAF Security Anchor Function) provides the information via an F1-C-like or NG-AP-like interface.

[0128] The UE obtains information on how to secure the DRB. This may be such that the CU-CP or the core network (such as AMF Access and Mobility Management Function, SMF Session Management Function, SEAF Security Anchor Function) provides the information via an RRC-like or NAS-like (such as Non-Access Stratum) protocol. The information may comprise a key for the separate DRB, a security algorithm for the DRB, and a security policy for the DRB.

[0129] Uplink Security Processing: The UE security processes the UP traffic using keys based on Key-UP-1 and Key-UP-2 for DRB1 and DRB2, respectively. This security processing may include one or more of decryption, integrity verification, and replay protection. The UE may also perform other non-security processing, such as header decompression.

[0130] Similarly, CU-UPs, ie, CU-UP1 and CU-UP2, secure UP traffic using keys based on Key-UP-1 and Key-UP-2.

[0131] The UE and CU-UP may implement a Packet Data Convergence Protocol (PDCP) protocol.

[0132] Downlink Security Processing: The CU-UPs, i.e., CU-UP1 and CU-UP2, use keys based on Key-UP-1 and Key-UP-2, respectively, to security process UP traffic. This security processing may include one or more of decryption, integrity verification, and replay protection. The UE may also perform other non-security processing, such as header decompression.

[0133] Similarly, the UE secures UP traffic using keys based on Key-UP-1 and Key-UP-2.

[0134] The UE and CU-UP may implement a Packet Data Convergence Protocol (PDCP).

[0135] CU-UP Placement: The CU-UP may be co-located or provided as part of a DU, CU-CP, or may be a separate function or node.

[0136] The CU-UP may be located in the same or a different security domain as the CU-CP, CU, and CU-UP.

[0137] Although some embodiments are described in the context of 5G networks, the embodiments herein are not limited to 5G and are applicable to 4G or future generations of mobile networks, and thus, some embodiments are described using 5G terminology, but this is done without loss of generality.

[0138] In view of the above modifications and variations, Figure 13 illustrates a method implemented by a central unit user plane (CU-UP) proxy configured to act as a proxy for multiple CU-UPs of a disaggregated radio network node. The method includes transmitting and / or receiving user plane traffic for a wireless device served by the multiple CU-UPs on an interface between the CU-UP proxy and a distributed unit (DU) of the disaggregated radio network node (block 1300). The method also includes performing security processing of the user plane traffic transmitted and / or received on the interface based on a user plane security key for the wireless device (block 1310).

[0139] In some embodiments, security processing is performed at the Packet Data Convergence Protocol (PDCP) layer.

[0140] In some embodiments, the security processing of user plane traffic includes downlink security processing and / or uplink security processing, where the downlink security processing includes encrypting, integrity protecting, and / or replay protecting the user plane traffic to be transmitted on the interface, and the uplink security processing includes decrypting and / or verifying the integrity and replay protecting the user plane traffic received on the interface.

[0141] In some embodiments, the method further includes receiving a user plane security key or one or more child security keys derived from the user plane security key from a central unit control plane (CU-CP) of the disaggregated radio network node (block 1305).

[0142] In some embodiments, the method further includes transmitting and / or receiving user plane traffic for different ones of the multiple CU-UPs on different respective interfaces between the CU-UP proxy and the multiple CU-UPs (block 1320). In one or more of these embodiments, security processing of the user plane traffic is performed at a first layer. In this case, the method further includes protecting, at a second layer, the user plane traffic transmitted and / or received on different respective interfaces between the CU-UP proxy and the multiple CU-UPs.

[0143] In some embodiments, performing security processing of user plane traffic for the multiple CU-UPs includes terminating security of the user plane traffic at the PDCP layer.

[0144] In some embodiments, the user plane security keys are common to or shared by multiple CU-UPs, and the user plane security keys are shared between the wireless device and the disaggregated radio network node.

[0145] 14 illustrates a method implemented by a network node according to another embodiment, including configuring a central unit user plane (CU-UP) proxy as a proxy for multiple CU-UPs serving a wireless device, the CU-UP being a CU-UP of a disaggregated wireless network node (block 1400).

[0146] In some embodiments, configuring the CU-UP proxy includes configuring an interface between the CU-UP proxy and a distributed unit (DU) of the disaggregated radio network node. In this case, the interface is configured as an interface over which user plane traffic for a wireless device served by multiple CU-UPs should be transmitted and / or received. In one or more of these embodiments, configuring the CU-UP proxy includes configuring a user plane security key, or one or more child keys derived from the user plane security key, for a wireless device in the CU-UP proxy, based on which the CU-UP proxy should perform security processing of user plane traffic transmitted and / or received over the interface. In one or more of these embodiments, the security processing should be performed at a Packet Data Convergence Protocol (PDCP) layer.

[0147] In some embodiments, the method further includes configuring different interfaces between the CU-UP proxy and different ones of the multiple CU-UPs over which user plane traffic for a wireless device should be transmitted and / or received (block 1410). In one or more of these embodiments, the method includes configuring, in the CU-UP proxy, a user plane security key for a wireless device, or one or more child keys derived from the user plane security key, based on which the CU-UP proxy should perform security processing of user plane traffic transmitted and / or received on the interface. In this case, the security processing is configured to be performed at a first layer, and configuring the user plane traffic transmitted and / or received on the different respective interfaces between the CU-UP proxy and the multiple CU-UPs to be protected at a second layer. In one or more of these embodiments, the user plane security key is common to or shared by the multiple CU-UPs, and the user plane security key is shared between the wireless device and the disaggregated radio network node.

[0148] 15 illustrates a method performed by a first central unit user plane (CU-UP) of a disaggregated radio network node comprising a first CU-UP and a second CU-UP, according to yet another embodiment. The method includes transmitting and / or receiving user plane traffic for a radio device served by both the first CU-UP and the second CU-UP on an interface between the first CU-UP and a distributed unit (DU) of the disaggregated radio network node (block 1500). The method also includes performing security processing of the user plane traffic transmitted and / or received on the interface based on a user plane security key for the radio device (block 1510).

[0149] In some embodiments, security processing is performed at the Packet Data Convergence Protocol (PDCP) layer.

[0150] In some embodiments, the security processing of user plane traffic includes downlink security processing and / or uplink security processing, where the downlink security processing includes encrypting, integrity protecting, and / or replay protecting the user plane traffic to be transmitted on the interface, and the uplink security processing includes decrypting and / or verifying the integrity and replay protecting the user plane traffic received on the interface.

[0151] In some embodiments, the method further includes receiving a user plane security key or one or more child security keys derived from the user plane security key from a central unit control plane (CU-CP) of the disaggregated radio network node.

[0152] In some embodiments, the method further includes consuming a portion of user plane traffic for a first CU-UP and received on an interface between the first CU-UP and the DU (block 1520) and forwarding another portion of user plane traffic for a second CU-UP and received on the interface between the first CU-UP and the DU to the second CU-UP on the interface between the first CU-UP and the second CU-UP (block 1530).

[0153] In some embodiments, the method further includes receiving user plane traffic intended for the second CU-UP from the second CU-UP on an interface between the first CU-UP and the second CU-UP (block 1540), and transmitting the user plane traffic received from the second CU-UP together with the user plane traffic for the first CU-UP on an interface between the first CU-UP and the DU (block 1550).

[0154] In some embodiments, security processing of user plane traffic is performed at the first layer, in which case the method further includes protecting, at the second layer, user plane traffic intended for the second CU-UP and transmitted and / or received on an interface between the first CU-UP and the second CU-UP.

[0155] In some embodiments, performing security processing of the user plane traffic includes terminating security of the user plane traffic at the PDCP layer.

[0156] In some embodiments, the user plane security key is common to or shared by the first and second CU-UPs, and the user plane security key is shared between the wireless device and the disaggregated radio network node.

[0157] Figure 16 shows a method implemented by a network node configured for use in a wireless communications network, the method comprising configuring multiple central unit user planes (CU-UPs) 14-1UP of a disaggregated radio network node 14 to handle different respective data radio bearers 16-1...16-N of a wireless device 12 in multi-connectivity operation, where security handling of user plane traffic by the different CU-UPs 14-1UP is based on different respective security keys 18.

[0158] In some embodiments, the method further includes making a decision to perform the configuration of the multiple CU-UPs 14-1UP, where the decision is made based on at least one of any one or more of the load on the wireless communication network 10 or on the disaggregated radio network node 12, the type of user plane traffic, the time of day, and the amount of user plane traffic.

[0159] In some embodiments, the method further includes configuring different distributed units (DUs) 14-2 of the disaggregated radio network node 14 to serve different respective ones of the data radio bearers 16-1...16-N.

[0160] In some embodiments, security processing is performed at the Packet Data Convergence Protocol (PDCP) layer.

[0161] In some embodiments, the security processing of user plane traffic includes downlink and / or uplink security processing, where the downlink security processing includes encrypting, integrity protecting, and / or replay protecting the user plane traffic in the downlink direction, and the uplink security processing includes decrypting and / or verifying the integrity and replay protecting the user plane traffic in the uplink direction.

[0162] 17 illustrates a method performed by the wireless device 12. The method includes transmitting and / or receiving user plane traffic for the wireless device 12 over multiple data radio bearers 16-1...16-N served by multiple respective central unit user planes (CU-UPs) 14-1UP of the disaggregated radio network node 14 (block 1700) and performing security processing of the transmitted and / or received user plane traffic based on different user plane security keys 18 for different data radio bearers 16-1...16-N and / or for different CU-UPs 14-1UP (block 1710).

[0163] In some embodiments, the method further includes receiving signaling from the network node 20 indicating user plane security keys 18 for different data radio bearers and / or different CU-UP 14-1UP and / or indicating which of the security keys 18 should be used for which of the different data radio bearers 16-1...16-N and / or for which of the different CU-UP 14-1UP (block 1705).

[0164] In some embodiments, the different data radio bearers 16-1...16-N belong to different respective groups of data radio bearers, and the security key 18 is different for the different groups of data radio bearers 16-1...16-N.

[0165] In some embodiments, security processing is performed at the Packet Data Convergence Protocol (PDCP) layer.

[0166] In some embodiments, the security processing of user plane traffic includes downlink and / or uplink security processing, where the uplink security processing includes encrypting, integrity protecting, and / or replay protecting user plane traffic transmitted in the uplink direction, and the downlink security processing includes decrypting and / or verifying the integrity and replay protecting of user plane traffic received in the downlink direction.

[0167] In some embodiments, performing security processing includes performing security processing of user plane traffic transmitted or received over a first radio bearer of the plurality of data radio bearers 16-1...16-N based on a first user plane security key for the first data radio bearer and / or for the first CU-UP. Performing security processing also includes performing security processing of user plane traffic transmitted or received over a second radio bearer of the plurality of data radio bearers 16-1...16-N based on a second user plane security key for the second data radio bearer and / or for the second CU-UP.

[0168] 18 illustrates a method performed by a network node 20 configured for use in a wireless communication network 10. The method includes configuring (block 1800) user plane traffic for a wireless device 12 to be transmitted and / or received over a plurality of data radio bearers 16-1...16-N served by a plurality of respective central unit user planes (CU-UPs) 14-1UP of a disaggregated wireless network node 14. The method also includes configuring (block 1810) security processing of the transmitted and / or received user plane traffic to be performed based on different user plane security keys 18 for different data radio bearers 16-1...16-N and / or for different CU-UPs 14-1UP.

[0169] In some embodiments, the method further includes making a decision to configure user plane traffic and configure security processing based on at least one of any one or more of the load on the wireless communication network 10 or on the disaggregated radio network node 14, the type of user plane traffic, the time of day, and the amount of user plane traffic (block 1805).

[0170] In some embodiments, the method includes configuring a wireless device 12 to transmit and / or receive user plane traffic for the wireless device 12 via multiple data radio bearers 16-1...16-N, configuring the wireless device 12 with user plane security keys 18 for different data radio bearers 16-1...16-N and / or for different CU-UPs 14-1UP, or configuring the wireless device 12 with one or more parameters for deriving the user plane security key 18 (block 1820).

[0171] In some embodiments, the method includes configuring different distributed units (DUs) 14-2 of the disaggregated radio network node 14 to transmit and / or receive user plane traffic for a wireless device 12 over multiple data radio bearers 16-1...16-N (block 1830). Additionally or alternatively, the method includes configuring different CU-UPs 14-1UP with different respective ones of the user plane security keys 18 or configuring different CU-UPs 14-1UP with one or more parameters for deriving different respective ones of the user plane security keys 18 (block 1840).

[0172] In some embodiments, the different data radio bearers 16-1...16-N belong to different respective groups of data radio bearers, and the security keys 18 are different for the different groups of data radio bearers.

[0173] In some embodiments, security processing is configured to be performed at the Packet Data Convergence Protocol (PDCP) layer.

[0174] The embodiments herein also include corresponding apparatus, for example, a wireless device 12 configured to perform any of the steps of any of the embodiments described herein for the wireless device 12.

[0175] The embodiments also include a wireless device 12 comprising a processing circuit and a power supply circuit. The processing circuit is configured to perform any of the steps of any of the embodiments described herein for the wireless device 12. The power supply circuit is configured to supply power to the wireless device 12.

[0176] The embodiments further include a wireless device 12 comprising a processing circuit configured to perform any of the steps of any of the embodiments described herein for the wireless device 12. In some embodiments, the wireless device 12 further comprises a communication circuit.

[0177] The embodiment further includes a wireless device 12 comprising a processing circuit and a memory, the memory including instructions executable by the processing circuit to configure the wireless device 12 to perform any of the steps of any of the embodiments described herein for the wireless device 12.

[0178] The embodiments further include a user equipment (UE). The UE comprises an antenna configured to send and receive wireless signals. The UE also comprises a radio front-end circuit connected to the antenna and the processing circuit and configured to condition signals communicated between the antenna and the processing circuit. The processing circuit is configured to perform any of the steps of any of the embodiments described herein for the wireless device 12. In some embodiments, the UE also comprises an input interface connected to the processing circuit and configured to allow input of information to the UE to be processed by the processing circuit. The UE may comprise an output interface connected to the processing circuit and configured to output information from the UE processed by the processing circuit. The UE may also comprise a battery connected to the processing circuit and configured to provide power to the UE.

[0179] Embodiments herein also include a network node, for example a network node configured to perform any of the steps of any of the embodiments described herein for network node 20 in FIG.

[0180] Embodiments also include a network node comprising a processing circuit and a power supply circuit, the processing circuit configured to perform any of the steps of any of the embodiments described herein for the network node, e.g., network node 20 in Figure 1. The power supply circuit is configured to supply power to the network node.

[0181] Embodiments further include a network node comprising processing circuitry configured to perform any of the steps of any of the embodiments described herein for the network node, e.g., network node 20 in Figure 1. In some embodiments, the network node further comprises communications circuitry.

[0182] Embodiments further include a network node comprising a processing circuit and a memory, the memory including instructions executable by the processing circuit to configure the network node to perform any of the steps of any of the embodiments described herein for the network node, e.g., network node 20 in FIG.

[0183] Embodiments of the present specification also include a CU-UP configured to perform any of the steps of any of the embodiments described herein for a CU-UP, for example, CU-UP14-1UP(s) in FIG. 1.

[0184] The embodiment also includes a CU-UP comprising a processing circuit and a power supply circuit. The processing circuit is configured to perform any of the steps of any of the embodiments described herein for the CU-UP, e.g., CU-UP14-1UP(s) in FIG. 1. The power supply circuit is configured to supply power to the CU-UP.

[0185] An embodiment further includes a CU-UP comprising a processing circuit configured to perform any of the steps of any of the embodiments described herein for the CU-UP, e.g., CU-UP 14-1UP(s) in FIG. 1. In some embodiments, the CU-UP further comprises communications circuitry.

[0186] The embodiment further includes a CU-UP comprising a processing circuit and a memory, the memory including instructions executable by the processing circuit to configure the CU-UP to perform any of the steps of any of the embodiments described herein for the CU-UP, e.g., CU-UP14-1UP(s) in FIG.

[0187] Embodiments herein also include a CU-UP proxy configured to perform any of the steps of any of the embodiments described herein for the CU-UP proxy.

[0188] An embodiment also includes a CU-UP proxy comprising a processing circuit and a power supply circuit, the processing circuit configured to perform any of the steps of any of the embodiments described herein for the CU-UP proxy, and the power supply circuit configured to supply power to the CU-UP proxy.

[0189] An embodiment further includes a CU-UP proxy comprising a processing circuit configured to perform any of the steps of any of the embodiments described herein for the CU-UP proxy. In some embodiments, the CU-UP proxy further comprises communication circuitry.

[0190] An embodiment further includes a CU-UP proxy comprising a processing circuit and a memory, the memory including instructions executable by the processing circuit such that the CU-UP proxy is configured to perform any of the steps of any of the embodiments described herein for the CU-UP proxy.

[0191] More specifically, the apparatus described above may perform the methods and any other processes herein by implementing any functional means, module, unit, or circuit. In one embodiment, for example, the apparatus comprises a respective circuit or circuitry configured to perform the steps illustrated in the method diagrams. The circuit or circuitry in this regard may comprise one or more microprocessors along with circuits and / or memories dedicated to performing certain functional processes. For example, the circuitry may include one or more microprocessors or microcontrollers, as well as other digital hardware, which may include digital signal processors (DSPs), dedicated digital logic, and the like. The processing circuitry may be configured to execute program code stored in memory, which may include one or several types of memory, such as read-only memory (ROM), random access memory, cache memory, flash memory devices, optical storage devices, and the like. The program code stored in memory may include, in some embodiments, program instructions for performing one or more communication and / or data communication protocols, as well as instructions for performing one or more of the techniques described herein. In embodiments that employ memory, the memory stores program code that, when executed by one or more processors, performs the techniques described herein.

[0192] FIG. 19 illustrates, for example, a wireless device 1900 (e.g., a UE or wireless device 12) implemented in accordance with one or more embodiments. As illustrated, the wireless device 1900 includes a processing circuit 1910 and a communication circuit 1920. The communication circuit 1920 (e.g., a radio circuit) is configured, for example, to transmit information to and / or receive information from one or more other nodes via any communication technology. Such communication may occur via one or more antennas either internal or external to the wireless device 1900. The processing circuit 1910 is configured to perform the processing described herein, for example, in Group Y embodiments, such as by executing instructions stored in a memory 1930. The processing circuit 1910 may implement several functional means, units, or modules in this regard.

[0193] FIG. 20 illustrates a network node 2000 (e.g., network node 20 in FIG. 1) implemented in accordance with one or more embodiments. As illustrated, the network node 2000 includes a processing circuit 2010 and a communication circuit 2020. The communication circuit 2020 is configured to transmit information to and / or receive information from one or more other nodes, e.g., via any communication technology. The processing circuit 2010 is configured to perform the processing described herein, e.g., in a Group AA, Group BB, Group X, or Group YY embodiment, such as by executing instructions stored in a memory 2030. The processing circuit 2010 may implement several functional means, units, or modules in this regard.

[0194] FIG. 21 illustrates a CU-UP proxy 2100 implemented according to one or more embodiments. As illustrated, the CU-UP proxy 2100 includes a processing circuit 2110 and a communication circuit 2120. The communication circuit 2120 is configured to transmit information to and / or receive information from one or more other nodes, e.g., via any communication technology. The processing circuit 2110 is configured to perform the processing described herein, e.g., in the Group A embodiments, such as by executing instructions stored in a memory 2130. The processing circuit 2110 may implement several functional means, units, or modules in this regard.

[0195] FIG. 22 illustrates a CU-UP 2200 (e.g., CU-UP14-1UP in FIG. 1) implemented according to one or more embodiments. As illustrated, the CU-UP 2200 includes a processing circuit 2210 and a communication circuit 2220. The communication circuit 2220 is configured to transmit information to and / or receive information from one or more other nodes, e.g., via any communication technology. The processing circuit 2210 is configured to perform the processing described herein, e.g., in Group B embodiments, such as by executing instructions stored in a memory 2230. The processing circuit 2210 may implement several functional means, units, or modules in this regard.

[0196] Those skilled in the art will also appreciate that the embodiments herein further include corresponding computer programs.

[0197] The computer program comprises instructions which, when executed on at least one processor of the apparatus, cause the apparatus to perform any of the respective operations described above. The computer program may in this respect comprise one or more code modules which correspond to the means or units described above.

[0198] Embodiments further include a carrier containing such a computer program, which may comprise one of an electronic signal, an optical signal, a radio signal, or a computer-readable storage medium.

[0199] In this regard, embodiments herein also include a computer program product comprising instructions stored on a non-transitory computer-readable (storage or recording) medium that, when executed by a processor of the device, causes the device to perform as described above.

[0200] Embodiments further include a computer program product comprising program code portions for performing the steps of any of the embodiments herein when the computer program product is executed by a computing device. The computer program product may be stored on a computer-readable recording medium.

[0201] Although the subject matter described herein may be implemented in any suitable type of system using any suitable components, the embodiments disclosed herein are described with respect to a wireless network, such as the exemplary wireless network shown in FIG. 23. For simplicity, the wireless network of FIG. 23 illustrates only the network 2306, the network nodes 2360 and 2360b, and the WDs 2310, 2310b, and 2310c. In practice, the wireless network may further include any additional elements suitable for supporting communication between wireless devices, or between a wireless device and another communication device, such as a landline, a service provider, or any other network node or end device. Of the components shown, the network node 2360 and the wireless device (WD) 2310 are illustrated with additional details. The wireless network may provide communication and other types of services to one or more wireless devices to facilitate the wireless device's access to the wireless network and / or use of services provided by or via the wireless network.

[0202] A wireless network may comprise and / or interface with any type of communication, telecommunication, data, cellular, and / or radio network, or other similar type of system. In some embodiments, a wireless network may be configured to operate according to a particular standard or other type of predefined rules or procedures. Thus, particular embodiments of a wireless network may implement a communications standard, such as Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), Long Term Evolution (LTE), Narrowband Internet of Things (NB-IoT), and / or other suitable 2G, 3G, 4G, or 5G standards, a wireless local area network (WLAN) standard, such as the IEEE 802.11 standard, and / or any other suitable wireless communication standard, such as Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, and / or ZigBee standards.

[0203] The network 2306 may comprise one or more backhaul networks, core networks, IP networks, public switched telephone networks (PSTN), packet data networks, optical networks, wide area networks (WANs), local area networks (LANs), wireless local area networks (WLANs), wired networks, wireless networks, metropolitan area networks, and other networks to enable communication between devices.

[0204] The network node 2360 and WD 2310 comprise various components that are described in more detail below. These components cooperate to provide network node and / or wireless device functionality, such as providing wireless connectivity in a wireless network. In different embodiments, a wireless network may comprise any number of wired or wireless networks, network nodes, base stations, controllers, wireless devices, relay stations, and / or any other components or systems that may facilitate or participate in the communication of data and / or signals, whether via wired or wireless connections.

[0205] A network node, as used herein, refers to a device capable of, set up, configured, and / or operable to communicate directly or indirectly with wireless devices and / or other network nodes or devices in a wireless network to enable and / or provide wireless access to wireless devices and / or to perform other functions (e.g., administration) in the wireless network. Examples of network nodes include, but are not limited to, access points (APs) (e.g., wireless access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs) and NR Node Bs (gNBs)). Base stations may be categorized based on the amount of coverage they provide (or, in other words, their transmit power levels), and may then be referred to as femto, pico, micro, or macro base stations. A base station may be a relay node or a relay donor node that controls a relay. A network node may also include one or more (or all) parts of a distributed radio base station, such as a centralized digital unit and / or a remote radio unit (RRU), sometimes referred to as a remote radio head (RRH). Such a remote radio unit may or may not be integrated with an antenna as an antenna-integrated radio. A part of a distributed radio base station may also be referred to as a node in a distributed antenna system (DAS). Still further examples of a network node include MSR equipment such as a multi-standard radio (MSR) BS, a network controller such as a radio network controller (RNC) or a base station controller (BSC), a base transceiver station (BTS), a transmission point, a transmitting node, a multi-cell / multicast coordination entity (MCE), a core network node (e.g., MSC, MME), an O&M node, an OSS node, a SON node, a positioning node (e.g., E-SMLC), and / or an MDT. As another example, a network node may be a virtual network node, as described in more detail below.More generally, however, a network node may represent any suitable device (or group of devices) capable of, configured to, and / or operable to enable and / or provide wireless devices with access to a wireless network or to provide some service to wireless devices that have accessed the wireless network.

[0206] In FIG. 23, network node 2360 includes processing circuitry 2370, device readable medium 2380, interface 2390, auxiliary equipment 2384, power source 2386, power circuitry 2387, and antenna 2362. Although network node 2360 shown in the example wireless network of FIG. 23 may represent a device including the shown combination of hardware components, other embodiments may comprise network nodes with different combinations of components. It should be understood that a network node comprises any suitable combination of hardware and / or software required to perform the tasks, features, functions and methods disclosed herein. Moreover, while the components of network node 2360 are illustrated as a single box located within a larger box or nested within multiple boxes, in reality the network node may comprise multiple different physical components that make up a single shown component (e.g., device readable medium 2380 may comprise multiple separate hard drives as well as multiple RAM modules).

[0207] Similarly, the network node 2360 may be assembled from multiple physically separate components (e.g., a Node B component and an RNC component, or a BTS component and a BSC component, etc.), each of which may have their own respective components. In some scenarios in which the network node 2360 comprises multiple separate components (e.g., a BTS component and a BSC component), one or more of the separate components may be shared among several network nodes. For example, a single RNC may control several Node Bs. In such scenarios, each unique Node B and RNC pair may be considered as a single separate network node in some instances. In some embodiments, the network node 2360 may be configured to support several radio access technologies (RATs). In such embodiments, some components may be duplicated (e.g., separate device-readable media 2380 for different RATs) and some components may be reused (e.g., the same antenna 2362 may be shared by the RATs). Network node 2360 may also include multiple sets of the various shown components for different wireless technologies, such as, for example, GSM, WCDMA, LTE, NR, WiFi, or Bluetooth wireless technologies, integrated into network node 2360. These wireless technologies may be integrated in the same or different chips or sets of chips and other components within network node 2360.

[0208] The processing circuitry 2370 is configured to perform any decision, computation, or similar operations (e.g., some acquisition operations) described herein as being provided by a network node. These operations performed by the processing circuitry 2370 may include processing information acquired by the processing circuitry 2370, for example, by transforming the acquired information into other information, comparing the acquired or transformed information to information stored in the network node, and / or performing one or more operations based on the acquired or transformed information and as a result of said processing making a decision.

[0209] The processing circuitry 2370 may comprise one or more combinations of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application specific integrated circuit, field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software, and / or coded logic operable to provide network node 2360 functionality, either alone or in conjunction with other network node 2360 components, such as device readable medium 2380. For example, the processing circuitry 2370 may execute instructions stored on the device readable medium 2380 or in memory within the processing circuitry 2370. Such functionality may include providing any of the various wireless features, functions, or benefits described herein. In some embodiments, the processing circuitry 2370 may include a system on a chip (SOC).

[0210] In some embodiments, the processing circuitry 2370 may include one or more of a radio frequency (RF) transceiver circuitry 2372 and a baseband processing circuitry 2374. In some embodiments, the radio frequency (RF) transceiver circuitry 2372 and the baseband processing circuitry 2374 may be on separate chips (or sets of chips), boards, or units, such as a radio unit and a digital unit. In alternative embodiments, some or all of the RF transceiver circuitry 2372 and the baseband processing circuitry 2374 may be on the same chip or set of chips, board, or unit.

[0211] In some embodiments, some or all of the functionality described herein as being provided by a network node, base station, eNB, or other such network device may be performed by the processing circuitry 2370 executing instructions stored in the device-readable medium 2380, or in a memory within the processing circuitry 2370. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry 2370 without executing instructions stored in a separate or distinct device-readable medium, such as in a hardwired manner. In any of those embodiments, the processing circuitry 2370 may be configured to perform the described functionality, whether or not it executes instructions stored in a device-readable storage medium. Benefits provided by such functionality are enjoyed by the processing circuitry 2370 alone, or by other components of the network node 2360, but by the network node 2360 as a whole, and / or by end users and wireless networks generally.

[0212] The device readable medium 2380 may comprise any form of volatile or non-volatile computer readable memory, including, but not limited to, persistent storage, solid-state memory, remotely mounted memory, magnetic media, optical media, random access memory (RAM), read only memory (ROM), mass storage media (e.g., hard disk), removable storage media (e.g., flash drive, compact disk (CD) or digital video disk (DVD)), and / or any other volatile or non-volatile, non-transitory device readable and / or computer executable memory device that stores information, data, and / or instructions that may be used by the processing circuit 2370. The device readable medium 2380 may store any suitable instructions, data or information, including applications including one or more of computer programs, software, logic, rules, codes, tables, etc., and / or other instructions that may be executed by the processing circuit 2370 and utilized by the network node 2360. The device readable medium 2380 may be used to store calculations performed by the processing circuit 2370 and / or data received via the interface 2390. In some embodiments, the processing circuit 2370 and the device readable medium 2380 may be considered to be integrated.

[0213] The interface 2390 is used in wired or wireless communication of signaling and / or data between the network node 2360, the network 2306, and / or the WD 2310. As shown, the interface 2390 comprises a port(s) / terminal(s) 2394 for sending and receiving data to and from the network 2306, for example over a wired connection. The interface 2390 also includes a radio front-end circuit 2392, which is coupled to the antenna 2362 or, in some embodiments, may be part of the antenna 2362. The radio front-end circuit 2392 comprises a filter 2398 and an amplifier 2396. The radio front-end circuit 2392 may be connected to the antenna 2362 and the processing circuit 2370. The radio front-end circuit may be configured to condition signals communicated between the antenna 2362 and the processing circuit 2370. The radio front-end circuit 2392 may receive digital data to be sent to other network nodes or WDs via a wireless connection. The radio front-end circuitry 2392 may convert the digital data into a radio signal having appropriate channel and bandwidth parameters using a combination of filters 2398 and / or amplifiers 2396. The radio signal may then be transmitted via the antenna 2362. Similarly, when receiving data, the antenna 2362 may collect the radio signal, which is then converted into digital data by the radio front-end circuitry 2392. The digital data may be passed to the processing circuitry 2370. In other embodiments, the interface may comprise different components and / or different combinations of components.

[0214] In some alternative embodiments, the network node 2360 may not include a separate radio front-end circuit 2392, and instead the processing circuit 2370 may comprise a radio front-end circuit and be connected to the antenna 2362 without a separate radio front-end circuit 2392. Similarly, in some embodiments, all or a portion of the RF transceiver circuit 2372 may be considered part of the interface 2390. In still other embodiments, the interface 2390 may include one or more ports or terminals 2394, the radio front-end circuit 2392, and the RF transceiver circuit 2372 as part of a radio unit (not shown), and the interface 2390 may communicate with a baseband processing circuit 2374 that is part of a digital unit (not shown).

[0215] The antenna 2362 may include one or more antennas or antenna arrays configured to send and / or receive wireless signals. The antenna 2362 may be coupled to the wireless front-end circuitry 2390 and may be any type of antenna capable of wirelessly transmitting and receiving data and / or signals. In some embodiments, the antenna 2362 may comprise one or more omni-directional, sector or panel antennas operable to transmit / receive wireless signals, for example, between 2 GHz and 66 GHz. An omni-directional antenna may be used to transmit / receive wireless signals in any direction, a sector antenna may be used to transmit / receive wireless signals from devices in a particular area, and a panel antenna may be a line-of-sight antenna used to transmit / receive wireless signals in a relatively straight line. In some instances, the use of more than one antenna may be referred to as MIMO. In some embodiments, the antenna 2362 may be separate from the network node 2360 and may be connectable to the network node 2360 through an interface or port.

[0216] The antenna 2362, the interface 2390, and / or the processing circuit 2370 may be configured to perform any receiving operation and / or some obtaining operation described herein as being performed by a network node. Any information, data, and / or signal may be received from a wireless device, another network node, and / or any other network equipment. Similarly, the antenna 2362, the interface 2390, and / or the processing circuit 2370 may be configured to perform any transmitting operation described herein as being performed by a network node. Any information, data, and / or signal may be transmitted to a wireless device, another network node, and / or any other network equipment.

[0217] The power circuitry 2387 may comprise or be coupled to a power management circuitry and is configured to supply power to the components of the network node 2360 for performing the functions described herein. The power circuitry 2387 may receive power from a power source 2386. The power source 2386 and / or the power circuitry 2387 may be configured to provide power to the various components of the network node 2360 in a form suitable for the respective components (e.g., at the voltage and current levels required for each respective component). The power source 2386 may either be included in the power circuitry 2387 and / or the network node 2360 or may be external to the power circuitry 2387 and / or the network node 2360. For example, the network node 2360 may be connectable to an external power source (e.g., an electrical outlet) via an input circuit or interface, such as an electrical cable, whereby the external power source supplies power to the power circuitry 2387. As a further example, power supply 2386 may include a power source in the form of a battery or battery pack connected to or integrated in power circuit 2387. The battery may provide backup power in the event that an external power source fails. Other types of power sources, such as photovoltaic devices, may also be used.

[0218] Alternative embodiments of network node 2360 may include additional components other than those shown in FIG. 23 that may be responsible for providing some aspects of the network node's functionality, including any of the functionality described herein and / or functionality necessary to support the subject matter described herein. For example, network node 2360 may include user interface devices to enable input of information into network node 2360 and output of information from network node 2360. This may enable a user to perform diagnostics, maintenance, repair, and other administrative functions for network node 2360.

[0219] A wireless device (WD) as used herein refers to a device capable of, configured to, and / or operable to communicate wirelessly with network nodes and / or other wireless devices. Unless otherwise noted, the term WD may be used interchangeably herein with user equipment (UE). Communicating wirelessly may involve transmitting and / or receiving wireless signals using electromagnetic, radio, infrared, and / or other types of signals suitable for conveying information over the air. In some embodiments, a WD may be configured to transmit and / or receive information without direct human interaction. For example, a WD may be designed to transmit information to a network on a predefined schedule, when triggered by an internal or external event, or in response to a request from the network. Examples of WDs include, but are not limited to, smartphones, mobile phones, cell phones, voice-over-IP (VoIP) phones, wireless local loop phones, desktop computers, personal digital assistants (PDAs), wireless cameras, gaming consoles or devices, music storage devices, playback appliances, wearable terminal devices, wireless endpoints, mobile stations, tablets, laptop computers, laptop embedded equipment (LEE), laptop mounted equipment (LME), smart devices, wireless customer premises equipment (CPE), in-vehicle wireless terminal devices, etc. A WD may support device-to-device (D2D) communications, for example, by implementing 3GPP standards for sidelink communications, vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), vehicle-to-everything (V2X), in which case it may be referred to as a D2D communications device. As yet another specific example, in an Internet of Things (IoT) scenario, a WD may represent a machine or other device that performs monitoring and / or measurements and transmits results of such monitoring and / or measurements to another WD and / or network node. The WD may in this case be a machine-to-machine (M2M) device, which may be referred to as an MTC device in the 3GPP context.As one particular example, the WD may be a UE implementing the 3GPP Narrowband Internet of Things (NB-IoT) standard. Particular examples of such machines or devices are sensors, metering devices such as power meters, industrial machinery, or household or personal appliances (e.g., refrigerators, televisions, etc.), personal wearables (e.g., watches, fitness trackers, etc.). In other scenarios, the WD may represent a vehicle or other equipment capable of monitoring and / or reporting on its operational status or other functions related to its operation. The WD described above may represent an endpoint of a wireless connection, in which case the device may be referred to as a wireless terminal. Additionally, the WD described above may be mobile, in which case the device may be referred to as a mobile device or mobile terminal.

[0220] As shown, wireless device 2310 includes antenna 2311, interface 2314, processing circuitry 2320, device readable medium 2330, user interface equipment 2332, auxiliary equipment 2334, power source 2336, and power circuitry 2337. WD 2310 may include multiple sets of one or more of the shown components for different wireless technologies supported by WD 2310, such as, for example, GSM, WCDMA, LTE, NR, WiFi, WiMAX, NB-IoT, or Bluetooth wireless technologies, just to name a few. These wireless technologies may be integrated on the same or different chip or set of chips as other components in WD 2310.

[0221] The antenna 2311 may include one or more antennas or antenna arrays configured to send and / or receive wireless signals and is connected to the interface 2314. In some alternative embodiments, the antenna 2311 may be separate from the WD 2310 and connectable to the WD 2310 through an interface or port. The antenna 2311, the interface 2314, and / or the processing circuit 2320 may be configured to perform any receiving or transmitting operation described herein as being performed by a WD. Any information, data, and / or signal may be received from a network node and / or another WD. In some embodiments, the wireless front-end circuit and / or the antenna 2311 may be considered an interface.

[0222] As shown, the interface 2314 comprises a radio front-end circuit 2312 and an antenna 2311. The radio front-end circuit 2312 comprises one or more filters 2318 and an amplifier 2316. The radio front-end circuit 2314 is connected to the antenna 2311 and the processing circuit 2320 and is configured to condition signals communicated between the antenna 2311 and the processing circuit 2320. The radio front-end circuit 2312 may be coupled to the antenna 2311 or may be part of the antenna 2311. In some embodiments, the WD 2310 may not include a separate radio front-end circuit 2312, rather the processing circuit 2320 may comprise a radio front-end circuit and be connected to the antenna 2311. Similarly, in some embodiments, some or all of the RF transceiver circuit 2322 may be considered part of the interface 2314. The radio front-end circuit 2312 may receive digital data to be sent to other network nodes or WDs via a wireless connection. The radio front-end circuitry 2312 may convert the digital data into a radio signal having appropriate channel and bandwidth parameters using a combination of filters 2318 and / or amplifiers 2316. The radio signal may then be transmitted via the antenna 2311. Similarly, when receiving data, the antenna 2311 may collect the radio signal, which is then converted into digital data by the radio front-end circuitry 2312. The digital data may be passed to the processing circuitry 2320. In other embodiments, the interface may comprise different components and / or different combinations of components.

[0223] The processing circuitry 2320 may comprise one or more combinations of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application specific integrated circuit, field programmable gate array, or any other suitable computing device, resources, or combinations of hardware, software, and / or coded logic operable to provide WD2310 functionality, either alone or in conjunction with other WD2310 components, such as the device readable medium 2330. Such functionality may include providing any of the various wireless features or benefits described herein. For example, the processing circuitry 2320 may execute instructions stored on the device readable medium 2330 or in a memory within the processing circuitry 2320 to provide the functionality disclosed herein.

[0224] As shown, the processing circuit 2320 includes one or more of the RF transceiver circuit 2322, the baseband processing circuit 2324, and the application processing circuit 2326. In other embodiments, the processing circuit may comprise different components and / or different combinations of components. In some embodiments, the processing circuit 2320 of the WD 2310 may comprise a SOC. In some embodiments, the RF transceiver circuit 2322, the baseband processing circuit 2324, and the application processing circuit 2326 may be on separate chips or sets of chips. In alternative embodiments, some or all of the baseband processing circuit 2324 and the application processing circuit 2326 may be combined into one chip or set of chips, and the RF transceiver circuit 2322 may be on a separate chip or set of chips. In yet alternative embodiments, some or all of the RF transceiver circuit 2322 and the baseband processing circuit 2324 may be on the same chip or set of chips, and the application processing circuit 2326 may be on a separate chip or set of chips. In yet other alternative embodiments, some or all of the RF transceiver circuitry 2322, the baseband processing circuitry 2324, and the application processing circuitry 2326 may be combined in the same chip or set of chips. In some embodiments, the RF transceiver circuitry 2322 may be part of the interface 2314. The RF transceiver circuitry 2322 may condition RF signals for the processing circuitry 2320.

[0225] In some embodiments, some or all of the functionality described herein as being performed by the WD may be provided by the processing circuitry 2320 executing instructions stored on a device-readable medium 2330, which in some embodiments may be a computer-readable storage medium. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry 2320 without executing instructions stored on a separate or distinct device-readable storage medium, such as in a hardwired manner. In any of those particular embodiments, the processing circuitry 2320 may be configured to perform the described functionality, regardless of whether it executes instructions stored on a device-readable storage medium. Benefits provided by such functionality are enjoyed by the WD 2310 as a whole, and / or by end users and wireless networks in general, but not limited to the processing circuitry 2320 alone or other components of the WD 2310.

[0226] The processing circuitry 2320 may be configured to perform any of the decision, calculation, or similar operations (e.g., some of the acquisition operations) described herein as being performed by the WD. These operations as performed by the processing circuitry 2320 may include processing information acquired by the processing circuitry 2320, for example, by converting the acquired information to other information, comparing the acquired or converted information to information stored by the WD 2310, and / or performing one or more operations based on the acquired or converted information and as a result of the processing making a decision.

[0227] The device-readable medium 2330 may be operable to store applications including one or more of computer programs, software, logic, rules, codes, tables, etc., and / or other instructions that may be executed by the processing circuit 2320. The device-readable medium 2330 may include computer memory (e.g., random access memory (RAM) or read-only memory (ROM)), mass storage media (e.g., hard disk), removable storage media (e.g., compact disc (CD) or digital video disc (DVD)), and / or any other volatile or non-volatile, non-transitory device-readable and / or computer-executable memory device that stores information, data, and / or instructions that may be used by the processing circuit 2320. In some embodiments, the processing circuit 2320 and the device-readable medium 2330 may be considered to be integrated.

[0228] The user interface device 2332 may provide components that allow a human user to interact with the WD 2310. Such interaction may be of many forms, such as visual, auditory, tactile, etc. The user interface device 2332 may be operable to produce output to the user and to allow the user to provide input to the WD 2310. The type of interaction may vary depending on the type of user interface device 2332 installed on the WD 2310. For example, if the WD 2310 is a smartphone, the interaction may be via a touch screen, and if the WD 2310 is a smart meter, the interaction may be through a screen that provides usage (e.g., number of gallons used) or a speaker that provides an audible alarm (e.g., if smoke is detected). The user interface device 2332 may include input interfaces, devices and circuits, as well as output interfaces, devices and circuits. The user interface device 2332 is configured to allow input of information to the WD 2310 and is connected to the processing circuit 2320 to allow the processing circuit 2320 to process the input information. The user interface device 2332 may include, for example, a microphone, proximity or other sensors, keys / buttons, a touch display, one or more cameras, a USB port, or other input circuitry. The user interface device 2332 is also configured to enable output of information from the WD 2310 and to enable the processing circuitry 2320 to output information from the WD 2310. The user interface device 2332 may include, for example, a speaker, a display, vibration circuitry, a USB port, a headphone interface, or other output circuitry. Using one or more input and output interfaces, devices, and circuits of the user interface device 2332, the WD 2310 may communicate with an end user and / or a wireless network and enable the end user and / or the wireless network to benefit from the functionality described herein.

[0229] The auxiliary device 2334 is operable to provide more specific functionality that may not generally be performed by a WD. It may include specialized sensors for taking measurements for various purposes, interfaces for additional types of communication such as wired communication, etc. The inclusion and type of components of the auxiliary device 2334 may vary depending on the embodiment and / or scenario.

[0230] The power source 2336 may be in the form of a battery or battery pack in some embodiments. Other types of power sources may also be used, such as an external power source (e.g., an electrical outlet), a photovoltaic device, or a battery. The WD 2310 may further comprise a power circuit 2337 for delivering power from the power source 2336 to various parts of the WD 2310 that require power from the power source 2336 to perform any of the functions described or indicated herein. The power circuit 2337 may comprise a power management circuit in some embodiments. The power circuit 2337 may additionally or alternatively be operable to receive power from an external power source, in which case the WD 2310 may be connectable to an external power source (such as an electrical outlet) via an input circuit or interface, such as a power cable. The power circuit 2337 may also be operable in some embodiments to deliver power from the external power source to the power source 2336. This may be for charging the power source 2336, for example. The power circuitry 2337 may perform any formatting, conversion, or other modification on the power from the power source 2336 to make the power suitable for the respective components of the WD 2310 that are being powered.

[0231] FIG. 24 illustrates an embodiment of a UE according to various aspects described herein. User equipment or UE as used herein does not necessarily have a user in the sense of a human user who owns and / or operates an associated device. Instead, a UE may represent a device (e.g., a smart sprinkler controller) that is intended for sale to or operation by a human user, but may not be associated with or may not be initially associated with a particular human user. Alternatively, a UE may represent a device (e.g., a smart power meter) that is not intended for sale to or operation by an end user, but may be associated with or operated for the benefit of a user. The UE 24200 may be any UE identified by the 3rd Generation Partnership Project (3GPP), including an NB-IoT UE, a machine-type communication (MTC) UE, and / or an enhanced MTC (eMTC) UE. The UE 2400 shown in FIG. 24 is an example of a WD configured for communication according to one or more communications standards promulgated by the 3rd Generation Partnership Project (3GPP), such as the 3GPP GSM, UMTS, LTE, and / or 5G standards. As mentioned above, the terms WD and UE may be used interchangeably. Thus, although FIG. 24 is a UE, the components described herein are equally applicable to a WD and vice versa.

[0232] In FIG. 24, UE 2400 includes a processing circuit 2401 operatively coupled to an input / output interface 2405, a radio frequency (RF) interface 2409, a network connection interface 2411, memory 2415 including random access memory (RAM) 2417, read only memory (ROM) 2419, storage medium 2421, etc., a communication subsystem 2431, a power source 2433, and / or any other components, or any combination thereof. Storage medium 2421 includes operating system 2423, application programs 2425, and data 2427. In other embodiments, storage medium 2421 may include other similar types of information. Some UEs may utilize all of the components shown in FIG. 24 or only a subset of those components. The level of integration between components may vary from UE to UE. Additionally, some UEs may include multiple instances of components, such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0233] In Fig. 24, the processing circuit 2401 may be configured to process computer instructions and data. The processing circuit 2401 may be configured to implement any sequential state machine operable to execute machine instructions stored in memory as a machine-readable computer program, such as one or more hardware-implemented state machines (e.g., in discrete logic, FPGA, ASIC, etc.), programmable logic with appropriate firmware, one or more pre-programmed, general-purpose processors, such as a microprocessor or digital signal processor (DSP) with appropriate software, or any combination of the above. For example, the processing circuit 2401 may include two central processing units (CPUs). The data may be information in a form suitable for use by a computer.

[0234] In the illustrated embodiment, the input / output interface 2405 may be configured to provide an input device, an output device, or a communication interface to an input / output device. The UE 2400 may be configured to use an output device via the input / output interface 2405. The output device may use the same type of interface port as the input device. For example, a USB port may be used to provide input to and output from the UE 2400. The output device may be a speaker, a sound card, a video card, a display, a monitor, a printer, an actuator, an emitter, a smart card, another output device, or any combination thereof. The UE 2400 may be configured to use an input device via the input / output interface 2405 to allow a user to capture information into the UE 2400. The input device may include a touch-sensitive or presence-sensitive display, a camera (e.g., a digital camera, a digital video camera, a webcam, etc.), a microphone, a sensor, a mouse, a trackball, a directional pad, a trackpad, a scroll wheel, a smart card, etc. The presence-sensitive display may include a capacitive or resistive touch sensor to sense input from a user. The sensor may be, for example, an accelerometer, a gyroscope, a tilt sensor, a force sensor, a magnetometer, a light sensor, a proximity sensor, another like sensor, or any combination thereof. For example, the input device may be an accelerometer, a magnetometer, a digital camera, a microphone, and a light sensor.

[0235] In FIG. 24, the RF interface 2409 may be configured to provide a communication interface to RF components, such as a transmitter, a receiver, and an antenna. The network connection interface 2411 may be configured to provide a communication interface to a network 2443a. The network 2443a may encompass a wired and / or wireless network, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a communication network, another similar network, or any combination thereof. For example, the network 2443a may comprise a Wi-Fi network. The network connection interface 2411 may be configured to include a receiver and a transmitter interface used to communicate with one or more other devices over a communication network according to one or more communication protocols, such as Ethernet, TCP / IP, SONET, ATM, etc. The network connection interface 2411 may implement receiver and transmitter functions suitable for a communication network link (e.g., optical, electrical, etc.). The transmitter and receiver functions may share circuit components, software or firmware, or may alternatively be implemented separately.

[0236] The RAM 2417 may be configured to interface to the processing circuit 2401 via the bus 2402 to provide storage or caching of data or computer instructions during execution of software programs, such as an operating system, application programs, and device drivers. The ROM 2419 may be configured to provide computer instructions or data to the processing circuit 2401. For example, the ROM 2419 may be configured to store unchanging low-level system code or data for basic system functions, such as basic input / output (I / O), booting, or receiving keystrokes from a keyboard, stored in non-volatile memory. The storage medium 2421 may be configured to include memory, such as RAM, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disk, optical disk, floppy disk, hard disk, removable cartridge, or flash drive. In one example, the storage medium 2421 may be configured to include an operating system 2423, an application program 2425, such as a web browser application, a widget or gadget engine, or another application, and data files 2427. The storage medium 2421 may store any of a variety of different operating systems or combinations of operating systems for use by the UE 2400.

[0237] The storage medium 2421 may be configured to include several physical drive units, such as a redundant array of independent disks (RAID), a floppy disk drive, a flash memory, a USB flash drive, an external hard disk drive, a thumb drive, a pen drive, a key drive, a high density digital versatile disk (HD-DVD) optical disk drive, an internal hard disk drive, a Blu-Ray optical disk drive, a holographic digital data storage (HDDS) optical disk drive, an external mini dual in-line memory module (DIMM), a synchronous dynamic random access memory (SDRAM), an external micro-DIMM SDRAM, a smart card memory such as a subscriber identity module or a removable user identity (SIM / RUIM) module, other memory, or any combination thereof. The storage medium 2421 may enable the UE 2400 to access computer executable instructions, application programs, etc. stored in a temporary or non-transitory memory medium, offload data, or upload data. An article of manufacture, such as an article of manufacture utilizing a communication system, may be tangibly embodied in the storage medium 2421, which may comprise a device-readable medium.

[0238] In FIG. 24, the processing circuit 2401 may be configured to communicate with the network 2443b using the communication subsystem 2431. The networks 2443a and 2443b may be the same network or networks or different networks or networks. The communication subsystem 2431 may be configured to include one or more transceivers used to communicate with the network 2443b. For example, the communication subsystem 2431 may be configured to include one or more transceivers used to communicate with one or more remote transceivers of another device capable of wireless communication, such as another WD, UE, or base station of a radio access network (RAN), according to one or more communication protocols, such as IEEE 802.11, CDMA, WCDMA, GSM, LTE, UTRAN, WiMax, etc. Each transceiver may include a transmitter 2433 and / or a receiver 2435 for implementing a transmitter function or a receiver function, respectively, appropriate for a RAN link (e.g., frequency allocation, etc.). Furthermore, the transmitter 2433 and receiver 2435 of each transceiver may share circuit components, software or firmware, or may alternatively be implemented separately.

[0239] In the illustrated embodiment, the communication functions of the communication subsystem 2431 may include data communication, voice communication, multimedia communication, short-range communication such as Bluetooth, near-field communication, location-based communication such as using a global positioning system (GPS) to determine location, another similar communication function, or any combination thereof. For example, the communication subsystem 2431 may include cellular communication, Wi-Fi communication, Bluetooth communication, and GPS communication. The network 2443b may encompass wired and / or wireless networks, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a communication network, another similar network, or any combination thereof. For example, the network 2443b may be a cellular network, a Wi-Fi network, and / or a near-field network. The power source 2413 may be configured to provide alternating current (AC) or direct current (DC) power to the components of the UE 2400.

[0240] The features, benefits and / or functions described herein may be implemented in one of the components of the UE 2400 or distributed across multiple components of the UE 2400. Furthermore, the features, benefits and / or functions described herein may be implemented in any combination of hardware, software or firmware. In one example, the communication subsystem 2431 may be configured to include any of the components described herein. Furthermore, the processing circuit 2401 may be configured to communicate with any of such components over the bus 2402. In another example, any of such components may be represented by program instructions stored in memory that, when executed by the processing circuit 2401, perform the corresponding functions described herein. In another example, the functions of any of such components may be distributed between the processing circuit 2401 and the communication subsystem 2431. In another example, non-computationally intensive functions of any of such components may be implemented in software or firmware and computationally intensive functions may be implemented in hardware.

[0241] FIG. 25 is a schematic block diagram illustrating a virtualization environment 2500 in which functions implemented by some embodiments may be virtualized. In this context, virtualizing means creating a virtual version of an apparatus or device, which may include virtualizing a hardware platform, storage devices, and networking resources. Virtualization as used herein may be applied to a node (e.g., a virtualized base station or a virtualized radio access node) or to a device (e.g., a UE, a wireless device, or any other type of communication device) or a component of that device, and relates to implementations in which at least a portion of the functionality is implemented as one or more virtual components (e.g., via one or more applications, components, functions, virtual machines, or containers running on one or more physical processing nodes in one or more networks).

[0242] In some embodiments, some or all of the functionality described herein may be implemented as virtual components executed by one or more virtual machines implemented in one or more virtual environments 2500 hosted by one or more of the hardware nodes 2530. Furthermore, in embodiments where the virtual nodes are not wireless access nodes or do not require wireless connectivity (e.g., core network nodes), the network nodes may be fully virtualized.

[0243] The functionality may be implemented by one or more applications 2520 (which may alternatively be referred to as software instances, virtual appliances, network functions, virtual nodes, virtual network functions, etc.) operable to implement some of the features, functions, and / or benefits of some of the embodiments disclosed herein. The applications 2520 are run in a virtualization environment 2500, which provides hardware 2530 comprising a processing circuit 2560 and a memory 2590. The memory 2590 includes instructions 2595 executable by the processing circuit 2560 such that the applications 2520 are operable to provide one or more of the features, benefits, and / or functions disclosed herein.

[0244] The virtualization environment 2500 includes a general-purpose or dedicated network hardware device 2530 including a set of one or more processors or processing circuitry 2560, which may be a commercial off-the-shelf (COTS) processor, a dedicated application specific integrated circuit (ASIC), or any other type of processing circuitry including digital or analog hardware components or dedicated processors. Each hardware device may include a memory 2590-1, which may be a non-persistent memory for temporarily storing instructions 2595 or software executed by the processing circuitry 2560. Each hardware device may include one or more network interface controllers (NICs) 2570, also known as network interface cards, which include physical network interfaces 2580. Each hardware device may also include a non-transitory, persistent, machine-readable storage medium 2590-2 having stored thereon software 2595 and / or instructions executable by the processing circuitry 2560. Software 2595 may include any type of software, including software for instantiating one or more virtualization layers 2550 (also called hypervisors), software for running virtual machines 2540, and software that enables it to perform the functions, features and / or benefits described in connection with some embodiments described herein.

[0245] The virtual machines 2540 may comprise virtual processing, virtual memory, virtual networking or interfaces, and virtual storage and may be run by a corresponding virtualization layer 2550 or hypervisor. Different embodiments of the virtual appliance 2520 instances may be implemented on one or more of the virtual machines 2540, and the implementations may be done in different ways.

[0246] During operation, the processing circuitry 2560 executes software 2595 to instantiate a hypervisor or virtualization layer 2550, which may sometimes be referred to as a virtual machine monitor (VMM). The virtualization layer 2550 may present to the virtual machine 2540 a virtual operating platform that looks like networking hardware.

[0247] 25, the hardware 2530 may be a standalone network node with general or specific components. The hardware 2530 may include an antenna 25225 and may implement some functions via virtualization. Alternatively, the hardware 2530 may be part of a larger cluster of hardware (e.g., as in the case of a data center or customer premises equipment (CPE)) where many hardware nodes work together and are managed via a management and orchestration (MANO) 25100 that, among other things, oversees the lifecycle management of the applications 2520.

[0248] Hardware virtualization is referred to in some contexts as network function virtualization (NFV). NFV can be used to consolidate many network equipment types onto industry-standard high-volume server hardware, physical switches, and physical storage that may be located in data centers and customer premises equipment.

[0249] In the context of NFV, virtual machine 2540 may be a software implementation of a physical machine that runs programs as if those programs were running on a physical, non-virtualized machine. Each virtual machine 2540 and the portion of hardware 2530 on which it runs, whether hardware dedicated to that virtual machine and / or hardware shared by that virtual machine with other ones of virtual machines 2540, form a separate Virtual Network Element (VNE).

[0250] Further in the context of NFV, a virtual network function (VNF) is responsible for handling a specific network function running on one or more virtual machines 2540 on top of the hardware networking infrastructure 2530 and corresponds to application 2520 in FIG. 25.

[0251] In some embodiments, one or more radio units 25200, each including one or more transmitters 25220 and one or more receivers 25210, may be coupled to one or more antennas 25225. The radio units 25200 may communicate directly with the hardware node 2530 via one or more suitable network interfaces and may be used in combination with a virtualization component to provide a virtualization node with wireless capabilities, such as a wireless access node or base station.

[0252] In some embodiments, some signaling may be accomplished using the control system 25230, which may alternatively be used for communication between the hardware node 2530 and the wireless unit 25200.

[0253] Figure 26 illustrates a communication network connected to a host computer via an intermediate network, according to some embodiments. With particular reference to Figure 26, according to one embodiment, a communication system includes a communication network 2610, such as a 3GPP-type cellular network, comprising an access network 2611, such as a wireless access network, and a core network 2614. The access network 2611 comprises a number of base stations 2612a, 2612b, 2612c, such as NBs, eNBs, gNBs or other types of wireless access points, each defining a corresponding coverage area 2613a, 2613b, 2613c. Each base station 2612a, 2612b, 2612c is connectable to the core network 2614 over a wired or wireless connection 2615. A first UE 2691 located in the coverage area 2613c is configured to wirelessly connect to or be paged by the corresponding base station 2612c. A second UE 2692 in the coverage area 2613a can wirelessly connect to the corresponding base station 2612a. Although multiple UEs 2691, 2692 are shown in this example, the disclosed embodiments are equally applicable to situations where only one UE is in the coverage area or connects to the corresponding base station 2612.

[0254] The communication network 2610 is itself connected to a host computer 2630, which may be embodied in hardware and / or software of a standalone server, a cloud-implemented server, a distributed server, or as a processing resource in a server farm. The host computer 2630 may be owned or under the control of a service provider, or may be operated by or on behalf of the service provider. The connections 2621 and 2622 between the communication network 2610 and the host computer 2630 may extend directly from the core network 2614 to the host computer 2630, or may proceed through an optional intermediate network 2620. The intermediate network 2620 may be one of a public network, a private network, or a hosted network, or a combination of two or more of them, and the intermediate network 2620 may be a backbone network or the Internet, if any, and in particular the intermediate network 2620 may comprise two or more sub-networks (not shown).

[0255] The communication system of FIG. 26 as a whole enables connectivity between connected UEs 2691, 2692 and a host computer 2630. The connectivity may be described as an over-the-top (OTT) connection 2650. The host computer 2630 and connected UEs 2691, 2692 are configured to communicate data and / or signaling via the OTT connection 2650 using the access network 2611, the core network 2614, any intermediate networks 2620, and possible further infrastructure (not shown) as intermediaries. The OTT connection 2650 may be transparent in the sense that the participating communication devices through which the OTT connection 2650 passes are unaware of the routing of the uplink and downlink communications. For example, the base station 2612 may not be or need not be informed of the past routing of incoming downlink communications involving data originating from the host computer 2630 to be forwarded (e.g., handed over) to the connected UE 2691. Similarly, the base station 2612 does not need to be aware of the future routing of outgoing uplink communications originating from the UE 2691 and destined for the host computer 2630 .

[0256] Next, an exemplary implementation of the UE, base station and host computer described in the previous paragraph according to an embodiment will be described with reference to FIG. 27. FIG. 27 illustrates a host computer communicating with user equipment via a base station over a partially wireless connection according to some embodiments. In the communication system 2700, the host computer 2710 comprises hardware 2715 including a communication interface 2716 configured to set up and maintain wired or wireless connections with interfaces of different communication devices of the communication system 2700. The host computer 2710 further comprises a processing circuit 2718, which may have storage and / or processing capabilities. In particular, the processing circuit 2718 may comprise one or more programmable processors, application specific integrated circuits, field programmable gate arrays, or combinations thereof (not shown) adapted to execute instructions. The host computer 2710 further comprises software 2711, which is stored in or accessible by the host computer 2710 and is executable by the processing circuit 2718. The software 2711 includes a host application 2712. The host application 2712 may be operable to provide services to a remote user, such as a UE 2730 connecting via an OTT connection 2750 that terminates at the UE 2730 and the host computer 2710. In providing services to the remote user, the host application 2712 may provide user data that is transmitted using the OTT connection 2750.

[0257] The communication system 2700 further includes a base station 2720 provided in the communication system, the base station 2720 comprising hardware 2725 enabling the base station 2720 to communicate with the host computer 2710 and the UE 2730. The hardware 2725 may include a communication interface 2726 for setting up and maintaining wired or wireless connections with interfaces of different communication devices of the communication system 2700, as well as a wireless interface 2727 for setting up and maintaining at least a wireless connection 2770 with a UE 2730 located in a coverage area (not shown in FIG. 27) served by the base station 2720. The communication interface 2726 may be configured to facilitate a connection 2760 to the host computer 2710. The connection 2760 may be direct or alternatively the connection 2760 may pass through a core network (not shown in FIG. 27) of the communication system and / or one or more intermediate networks outside the communication system. In the illustrated embodiment, the hardware 2725 of the base station 2720 further includes processing circuitry 2728, which may comprise one or more programmable processors, application specific integrated circuits, field programmable gate arrays, or combinations thereof (not shown) adapted to execute instructions. The base station 2720 further has software 2721 stored internally or accessible via an external connection.

[0258] The communication system 2700 further includes the UE 2730 already mentioned. The hardware 2735 of the UE 2730 may include a wireless interface 2737 configured to set up and maintain a wireless connection 2770 with a base station serving a coverage area in which the UE 2730 is currently located. The hardware 2735 of the UE 2730 further includes a processing circuit 2738, which may comprise one or more programmable processors, application specific integrated circuits, field programmable gate arrays, or combinations thereof (not shown) adapted to execute instructions. The UE 2730 further includes software 2731 stored in or accessible by the UE 2730 and executable by the processing circuit 2738. The software 2731 includes a client application 2732. The client application 2732 may be operable to provide services to a human or non-human user via the UE 2730 with the support of the host computer 2710. At the host computer 2710, a running host application 2712 may communicate with a running client application 2732 via an OTT connection 2750 that terminates at the UE 2730 and the host computer 2710. In providing services to a user, the client application 2732 may receive request data from the host application 2712 and provide user data in response to the request data. The OTT connection 2750 may transfer both the request data and the user data. The client application 2732 may interact with the user to generate the user data that the client application 2732 provides.

[0259] It should be noted that the host computer 2710, base station 2720 and UE 2730 shown in Figure 27 may be similar or equivalent to the host computer 2630, one of the base stations 2612a, 2612b, 2612c, and one of the UEs 2691, 2692, respectively, of Figure 26. That is, the inner workings of these entities may be as shown in Figure 27, and separately, the surrounding network topology may be that of Figure 26.

[0260] 27, the OTT connection 2750 is depicted abstractly to show communication between the host computer 2710 and the UE 2730 via the base station 2720, without explicit reference to intermediary devices and the exact routing of messages through these devices. The network infrastructure may determine the routing, and the network infrastructure may be configured to hide the routing from the UE 2730 or from the service provider operating the host computer 2710, or both. The network infrastructure may also make decisions to dynamically change the routing while the OTT connection 2750 is active (e.g., based on load balancing considerations or reconfiguration of the network).

[0261] The wireless connection 2770 between the UE 2730 and the base station 2720 follows the teachings of the embodiments described throughout this disclosure. One or more of the various embodiments improve the performance of the OTT service provided to the UE 2730 using the OTT connection 2750 of which the wireless connection 2770 forms the final segment.

[0262] Measurement procedures may be provided for the purpose of monitoring data rates, latency, and other factors that one or more embodiments improve upon. There may further be an optional network function for reconfiguring the OTT connection 2750 between the host computer 2710 and the UE 2730 in response to fluctuations in the measurement results. The measurement procedures and / or the network function for reconfiguring the OTT connection 2750 may be implemented in the software 2711 and hardware 2715 of the host computer 2710 or in the software 2731 and hardware 2735 of the UE 2730, or both. In an embodiment, sensors (not shown) may be deployed in or in association with the communication devices through which the OTT connection 2750 passes, and the sensors may participate in the measurement procedures by providing values ​​of the monitored quantities exemplified above, or other physical quantities from which the software 2711, 2731 may calculate or estimate the monitored quantities. The reconfiguration of the OTT connection 2750 may include message formats, retransmission settings, preferred routing, etc., and the reconfiguration need not affect the base station 2720, and the reconfiguration may be unknown or imperceptible to the base station 2720. Such procedures and functions may be known and practiced in the art. In some embodiments, the measurements may involve proprietary UE signaling that facilitates the host computer 2710 measurements of throughput, propagation time, latency, etc. The measurements may be implemented in the software 2711 and 2731 causing messages, particularly empty or "dummy" messages, to be sent using the OTT connection 2750 while the software 2711 and 2731 monitors propagation times, errors, etc.

[0263] FIG. 28 is a flow chart illustrating a method implemented in a communication system according to one embodiment. The communication system includes a host computer, a base station, and a UE, which may be as described with reference to FIG. 26 and FIG. 27. For simplicity of the disclosure, only drawing references to FIG. 28 are included in this section. In step 2810, the host computer provides user data. In sub-step 2811 (which may be optional) of step 2810, the host computer provides the user data by executing a host application. In step 2820, the host computer initiates a transmission carrying the user data to the UE. In step 2830 (which may be optional), the base station transmits the user data carried in the host computer initiated transmission to the UE, according to the teachings of the embodiments described throughout this disclosure. In step 2840 (which may also be optional), the UE executes a client application associated with the host application executed by the host computer.

[0264] FIG. 29 is a flow chart illustrating a method implemented in a communication system according to one embodiment. The communication system includes a host computer, a base station, and a UE, which may be as described with reference to FIG. 26 and FIG. 27. For simplicity of the disclosure, only drawing references to FIG. 29 are included in this section. In step 2910 of the method, the host computer provides user data. In an optional sub-step (not shown), the host computer provides the user data by executing a host application. In step 2920, the host computer initiates a transmission carrying the user data to the UE. The transmission may proceed via the base station according to the teachings of the embodiments described throughout this disclosure. In step 2930 (which may be optional), the UE receives the user data carried in the transmission.

[0265] FIG. 30 is a flow chart illustrating a method implemented in a communication system according to one embodiment. The communication system includes a host computer, a base station, and a UE, which may be as described with reference to FIG. 26 and FIG. 27. For simplicity of the disclosure, only drawing reference to FIG. 30 is included in this section. In step 3010 (which may be optional), the UE receives input data provided by the host computer. Additionally or alternatively, in step 3020, the UE provides user data. In sub-step 3021 (which may be optional) of step 3020, the UE provides the user data by executing a client application. In sub-step 3011 (which may be optional) of step 3010, the UE executes a client application that provides the user data in response to the received input data provided by the host computer. In providing the user data, the executed client application may further take into account user input received from the user. Regardless of the particular manner in which the user data is provided, the UE initiates transmission of the user data to the host computer in sub-step 3030 (which may be optional). In method step 3040, the host computer receives user data transmitted from the UE according to the teachings of the embodiments described throughout this disclosure.

[0266] FIG. 31 is a flow chart illustrating a method implemented in a communication system according to one embodiment. The communication system includes a host computer, a base station, and a UE, which may be as described with reference to FIG. 26 and FIG. 27. For simplicity of the disclosure, only drawing references to FIG. 31 are included in this section. In step 3110 (which may be optional), the base station receives user data from the UE, according to the teachings of the embodiments described throughout this disclosure. In step 3120 (which may be optional), the base station initiates transmission of the received user data to the host computer. In step 3130 (which may be optional), the host computer receives the user data carried in the transmission initiated by the base station.

[0267] Any suitable steps, methods, features, functions, or benefits disclosed herein may be implemented through one or more functional units or modules of one or more virtual devices. Each virtual device may comprise several of these functional units. These functional units may be implemented via processing circuitry, which may include one or more microprocessors or microcontrollers, as well as other digital hardware, which may include digital signal processors (DSPs), dedicated digital logic, and the like. The processing circuitry may be configured to execute program code stored in memory, which may include one or several types of memory, such as read-only memory (ROM), random access memory (RAM), cache memory, flash memory devices, optical storage devices, and the like. The program code stored in memory includes program instructions for implementing one or more communication and / or data communication protocols, as well as instructions for performing one or more of the techniques described herein. In some implementations, the processing circuitry may be used to cause each functional unit to perform a corresponding function according to one or more embodiments of the present disclosure.

[0268] In view of the above, then, embodiments herein generally include a communication system including a host computer. The host computer may comprise processing circuitry configured to provide user data. The host computer may also comprise a communication interface configured to forward the user data to a cellular network for transmission to a user equipment (UE). The cellular network may comprise a base station having a radio interface and processing circuitry, the processing circuitry of the base station configured to perform any of the steps of any of the embodiments described above for the base station.

[0269] In some embodiments, the communication system further includes a base station.

[0270] In some embodiments, the communication system further includes a UE, the UE configured to communicate with the base station.

[0271] In some embodiments, the processing circuitry of the host computer is configured to execute a host application and thereby provide user data, in which case the UE comprises processing circuitry configured to execute a client application associated with the host application.

[0272] Embodiments herein also include a method implemented in a communication system including a host computer, a base station, and a user equipment (UE). The method includes providing user data at the host computer. The method may also include initiating a transmission at the host computer conveying the user data to the UE over a cellular network that includes the base station. The base station performs any of the steps of any of the embodiments described above for the base station.

[0273] In some embodiments, the method further includes transmitting, at the base station, the user data.

[0274] In some embodiments, the user data is provided by executing, at the host computer, a host application, in which case the method further includes executing, at the UE, a client application associated with the host application.

[0275] Embodiments herein also include a user equipment (UE) configured to communicate with a base station, the UE comprising a radio interface and processing circuitry configured to implement any of the embodiments described above for the UE.

[0276] Embodiments herein further include a communication system including a host computer comprising a processing circuit configured to provide user data and a communication interface configured to forward the user data to a cellular network for transmission to a user equipment (UE), the UE comprising a wireless interface and a processing circuit, the components of the UE configured to perform any of the steps of any of the embodiments described above for the UE.

[0277] In some embodiments, the cellular network further includes a base station configured to communicate with the UE.

[0278] In some embodiments, the processing circuitry of the host computer is configured to execute a host application thereby providing user data, and the processing circuitry of the UE is configured to execute a client application associated with the host application.

[0279] Embodiments also include a method implemented in a communications system including a host computer, a base station, and a user equipment (UE), the method including providing user data at the host computer and initiating a transmission conveying the user data to the UE over a cellular network including the base station, the UE performing any of the steps of any of the embodiments described above for the UE.

[0280] In some embodiments, the method further includes receiving, at the UE, user data from the base station.

[0281] Embodiments herein further include a communication system including a host computer comprising a communication interface configured to receive user data originating from a transmission from a user equipment (UE) to a base station, the UE comprising a wireless interface and processing circuitry, the processing circuitry of the UE configured to perform any of the steps of any of the embodiments described above for the UE.

[0282] In some embodiments, the communication system further includes a UE.

[0283] In some embodiments, the communication system further includes a base station, where the base station comprises a radio interface configured to communicate with the UE and a communication interface configured to forward user data carried by transmissions from the UE to the base station to a host computer.

[0284] In some embodiments, the processing circuitry of the host computer is configured to execute a host application, and the processing circuitry of the UE is configured to execute a client application associated with the host application to provide user data therewith.

[0285] In some embodiments, processing circuitry of the host computer is configured to execute a host application thereby providing requested data, and processing circuitry of the UE is configured to execute a client application associated with the host application thereby providing user data in response to the requested data.

[0286] Embodiments herein also include a method implemented in a communications system including a host computer, a base station, and a user equipment (UE), the method including receiving, at the host computer, user data transmitted from the UE to the base station, the UE performing any of the steps of any of the embodiments described above for the UE.

[0287] In some embodiments, the method further includes providing, at the UE, user data to the base station.

[0288] In some embodiments, the method also includes executing, at the UE, a client application to provide user data to be transmitted thereby. The method may further include executing, at the host computer, a host application associated with the client application.

[0289] In some embodiments, the method further includes executing, at the UE, a client application and receiving, at the UE, input data for the client application, the input data being provided by executing, at the host computer, a host application associated with the client application, the user data to be transmitted being provided by the client application in response to the input data.

[0290] An embodiment also includes a communication system including a host computer, the host computer comprising a communication interface configured to receive user data originating from a transmission from a user equipment (UE) to a base station, the base station comprising a wireless interface and processing circuitry, the processing circuitry of the base station configured to perform any of the steps of any of the embodiments described above for the base station.

[0291] In some embodiments, the communication system further includes a base station.

[0292] In some embodiments, the communication system further includes a UE, the UE being configured to communicate with the base station.

[0293] In some embodiments, the processing circuitry of the host computer is configured to execute a host application, and the UE is configured to execute a client application associated with the host application to thereby provide user data to be received by the host computer.

[0294] Additionally, embodiments include a method implemented in a communications system including a host computer, a base station, and a user equipment (UE), the method including receiving, at the host computer, from the base station, user data originating from a transmission received by the base station from the UE, the UE performing any of the steps of any of the embodiments described above for the UE.

[0295] In some embodiments, the method further includes receiving, at the base station, user data from the UE.

[0296] In some embodiments, the method further includes initiating, at the base station, a transmission of the received user data to the host computer.

[0297] Generally, all terms used herein should be interpreted according to the ordinary meaning of those terms in the relevant technical field, unless a different meaning is expressly given and / or implied from the context in which the term is used. All references to a / an / the element, apparatus, component, means, step, etc. should be openly interpreted as referring to at least one instance of that element, apparatus, component, means, step, etc., unless expressly stated otherwise. The steps of any method disclosed herein need not be performed in the exact order disclosed, unless a step is expressly described as following or preceding another step, and / or if it is implicit that a step must follow or precede another step. Any feature of any of the embodiments disclosed herein may be applied to any other embodiment, wherever appropriate. Similarly, any advantage of any of the embodiments may be applied to any other embodiment, and vice versa. Other objectives, features, and advantages of the enclosed embodiments will become apparent from the description thereof.

[0298] The term unit may have its conventional meaning in the field of electronics, electrical devices, and / or electronic devices and may include, for example, electric and / or electronic circuits, devices, modules, processors, memories, logical solid and / or discrete devices, computer programs or instructions, etc., for performing a respective task, procedure, computation, output, and / or display function, such as those described herein.

[0299] As used herein, the term "A and / or B" covers embodiments having only A, only B, or both A and B together. Thus, the term "A and / or B" can equivalently mean "at least one of any one or more of A and B."

[0300] Some of the embodiments contemplated herein are more fully described with reference to the accompanying drawings. However, other embodiments are included within the scope of the subject matter disclosed herein. The subject matter disclosed should not be construed as being limited to only the embodiments described herein, but rather, these embodiments are provided as examples to convey the scope of the subject matter to those skilled in the art.

[0301] In particular, modifications and other embodiments of the present disclosure will come to mind to one skilled in the art having the benefit of the teachings presented in the foregoing descriptions and the associated drawings. It is to be understood, therefore, that the present disclosure is not to be limited to the particular embodiments disclosed, and that modifications and other embodiments are intended to be included within the scope of the present disclosure. Although specific terms may be employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.

[0302] Exemplary embodiments of the techniques and apparatus described herein include, but are not limited to, the following listed examples.

[0303] Embodiment

[0304] Group A embodiment A1. A method implemented by a central unit user plane (CU-UP) proxy configured to act as a proxy for a plurality of central unit user planes (CU-UPs) of a disaggregated radio network node, the method comprising: Transmitting and / or receiving user plane traffic for a wireless device served by multiple CU-UPs on an interface between a CU-UP proxy and a distributed unit (DU) of the disaggregated wireless network node; performing security processing of user plane traffic transmitted and / or received on the interface based on a user plane security key for a wireless device; A method comprising: A2. The method of embodiment A1, in which the security processing is performed at a Packet Data Convergence Protocol (PDCP) layer. A3. The method of embodiment A1 or A2, wherein the security processing of user plane traffic includes downlink security processing and / or uplink security processing, the downlink security processing including encrypting, integrity protecting, and / or replay protecting the user plane traffic to be transmitted on the interface, and the uplink security processing including decrypting the user plane traffic received on the interface and / or verifying the integrity and replay protection of the user plane traffic. A4. The method of any one of embodiments A1 to A3, further comprising receiving a user plane security key or one or more child security keys derived from the user plane security key from a central unit control plane (CU-CP) of the disaggregated radio network node. A5. A method as in any one of embodiments A1 to A4, further comprising: deriving one or more child security keys from the user plane security key; and performing security processing of user plane traffic for the multiple CU-UPs based on the user plane security keys comprising performing security processing of user plane traffic for the multiple CU-UPs based on the one or more child security keys. A6. A method as in any one of embodiments A1 to A5, further comprising transmitting and / or receiving user plane traffic for different ones of the multiple CU-UPs on different respective interfaces between the CU-UP proxy and the multiple CU-UPs. A7. The method described in embodiment A6, in which security processing of user plane traffic is performed at a first layer, and the method further includes protecting user plane traffic transmitted and / or received on different respective interfaces between the CU-UP proxy and multiple CU-UPs at a second layer. A8. The method of embodiment A6 or A7, wherein user plane traffic transmitted and / or received on different respective interfaces between the CU-UP proxy and the multiple CU-UPs is in plain text above the PDCP layer. A9. The method of any one of embodiments A1 to A8, wherein performing security processing of user plane traffic for the multiple CU-UPs includes terminating security of the user plane traffic at a PDCP layer. A10. The method of any one of embodiments A1 to A9, wherein a user plane security key is common to or shared by multiple CU-UPs. A11. The method of any one of embodiments A1 to A10, wherein a user plane security key is shared between the wireless device and the disaggregated radio network node. A12. The method of any one of embodiments A1 to A11, wherein the CU-UP proxy is a CU-UP that supports CU-UP proxy capabilities. A13. The method of any one of embodiments A1 to A11, wherein the CU-UP proxy is collocated with or part of a distributed unit (DU) that supports the CU-UP proxy capability. A14. The method of embodiment A12 or A13, further comprising sending a message indicating support for CU-UP proxy capability. A15. The method of embodiment A14, in which the message is sent to a central unit control plane (CU-CP) of the disaggregated radio network node. A16. The method of embodiment A15, wherein the message is a message for transferring information for a transport network layer (TNL) association.

[0305] Group AA embodiment AA1. A method implemented by a network node, the method comprising: Configuring a central unit user plane (CU-UP) proxy as a proxy for multiple CU-UPs serving a wireless device, the CU-UP being a CU-UP of a disaggregated wireless network node A method comprising: AA2. The method of embodiment AA1, wherein the configuring includes configuring an interface between a CU-UP proxy and a distributed unit (DU) of a disaggregated radio network node, the interface being configured as an interface over which user plane traffic for a wireless device served by multiple CU-UPs should be transmitted and / or received. AA3. The method of embodiment AA2, in which the setting includes setting in the CU-UP proxy a user plane security key for a wireless device, or one or more child keys derived from the user plane security key, based on which the CU-UP proxy should perform security processing of user plane traffic transmitted and / or received on the interface. AA4. The method of embodiment AA3, in which security processing is to be performed at the Packet Data Convergence Protocol (PDCP) layer. AA5. The method of embodiment AA3 or AA4, wherein the security processing of user plane traffic includes downlink security processing and / or uplink security processing, the downlink security processing including encrypting, integrity protecting, and / or replay protecting the user plane traffic to be transmitted on the interface, and the uplink security processing including decrypting the user plane traffic received on the interface and / or verifying the integrity and replay protecting the user plane traffic. AA6. The method of any one of embodiments AA1 to AA5, further comprising configuring different interfaces between the CU-UP proxy and different ones of the multiple CU-UPs over which user plane traffic for a wireless device should be transmitted and / or received. AA7. A method as described in embodiment AA6, including configuring a user plane security key for a wireless device, or one or more child keys derived from the user plane security key, in the CU-UP proxy, based on which the CU-UP proxy should perform security processing of user plane traffic transmitted and / or received on the interface, with security processing configured to be performed at a first layer and user plane traffic transmitted and / or received on different respective interfaces between the CU-UP proxy and multiple CU-UPs configured to be protected at a second layer. AA8. The method of any one of embodiments AA3 to AA5, wherein a user plane security key is common to or shared by multiple CU-UPs. AA9. The method of any one of embodiments AA3 to AA5 and AA8, wherein a user plane security key is shared between the wireless device and the disaggregated radio network node. AA10. The method of any one of embodiments AA1 to AA9, wherein the CU-UP proxy is a CU-UP that supports CU-UP proxy capabilities. AA11. The method of any one of embodiments AA1 to AA9, wherein the CU-UP proxy is collocated with or part of a distributed unit (DU) that supports the CU-UP proxy capability. AA12. The method of embodiment AA10 or AA11, further comprising receiving a message indicating that the CU-UP proxy supports CU-UP proxy capabilities. AA13. The method of embodiment AA12, wherein the message is a message for transferring information for a transport network layer (TNL) association.

[0306] Group B embodiment B1. A method implemented by a first central unit user plane (CU-UP) of a disaggregated radio network node comprising a first CU-UP and a second CU-UP, the method comprising: Transmitting and / or receiving user plane traffic for a wireless device served by both the first CU-UP and the second CU-UP on an interface between the first CU-UP and a distributed unit (DU) of the disaggregated wireless network node; performing security processing of user plane traffic transmitted and / or received on the interface based on a user plane security key for a wireless device; A method comprising: B2. The method of embodiment B1, in which security processing is performed at a Packet Data Convergence Protocol (PDCP) layer. B3. The method of embodiment B1 or B2, wherein the security processing of user plane traffic includes downlink security processing and / or uplink security processing, the downlink security processing including encrypting, integrity protecting, and / or replay protecting the user plane traffic to be transmitted on the interface, and the uplink security processing including decrypting the user plane traffic received on the interface and / or verifying the integrity and replay protection of the user plane traffic. B4. The method of any one of embodiments B to B3, further comprising receiving a user plane security key or one or more child security keys derived from the user plane security key from a central unit control plane (CU-CP) of the disaggregated radio network node. B5. The method of any one of embodiments B1 to B4, further comprising deriving one or more child security keys from the user plane security key, and performing security processing of user plane traffic for the first and second CU-UPs based on the user plane security keys comprises performing security processing of user plane traffic for the first and second CU-UPs based on the one or more child security keys. B6. Consuming a portion of user plane traffic that is for a first CU-UP and is received on an interface between the first CU-UP and a DU; forwarding another portion of user plane traffic, which is for the second CU-UP and is received on the interface between the first CU-UP and the DU, to the second CU-UP on the interface between the first CU-UP and the second CU-UP; The method of any one of embodiments B1 to B5, further comprising: B7. receiving user plane traffic intended for the second CU-UP from the second CU-UP on an interface between the first CU-UP and the second CU-UP; Transmitting user plane traffic received from the second CU-UP together with user plane traffic for the first CU-UP on an interface between the first CU-UP and the DU; The method of any one of embodiments B1 to B5, further comprising: B8. A method as in any one of embodiments B1 to B7, wherein security processing of user plane traffic is performed at a first layer and the method is for a second CU-UP at a second layer, and further includes protecting user plane traffic transmitted and / or received on an interface between the first CU-UP and the second CU-UP. B9. The method of any one of embodiments B1 to B8, wherein user plane traffic transmitted and / or received on the interface between the first CU-UP and the second CU-UP is in plain text above the PDCP layer. B10. The method of any one of embodiments B1 to B9, wherein performing security processing of user plane traffic includes terminating security of the user plane traffic at a PDCP layer. B11. The method of any one of embodiments B1-B10, wherein the user plane security key is common to or shared by the first and second CU-UPs. B12. The method of any one of embodiments B1 to B11, wherein a user plane security key is shared between the wireless device and the disaggregated radio network node. B13. The method of any one of embodiments B1 to B12, wherein the first CU-UP is a CU-UP that supports a mode for forwarding at least a portion of the received user plane traffic to another CU-UP. B14. A method according to any one of embodiments B1 to B12, wherein a first CU-UP is collocated with or part of a distributed unit (DU) that supports a mode for forwarding at least a portion of received user plane traffic to another CU-UP. B15. The method of embodiment B13 or B14, further comprising sending a message indicating support for the mode. B16. The method of embodiment B15, in which the message is sent to a central unit control plane (CU-CP) of the disaggregated radio network node. B17. The method of embodiment B16, wherein the message is a message for transferring information for a transport network layer (TNL) association.

[0307] Group BB embodiment BB1. A method implemented by a network node, the method comprising: Configuring a first unit user plane (CU-UP) to operate according to any one of embodiments B1 to B17. A method comprising:

[0308] Group X embodiment X1. A method implemented by a network node configured for use in a wireless communications network, the method comprising: Configuring multiple central unit user planes (CU-UPs) of a disaggregated radio network node to handle different respective data radio bearers of a radio device in a multi-connectivity operation wherein security processing of user plane traffic by different CU-UPs is based on different respective security keys. X2. The method of embodiment X1, further comprising making a decision to perform the setting. X3. Judgment, a load on a wireless communication network or on a disaggregated wireless network node; The type of user plane traffic; and Time and The volume of user plane traffic and The method of embodiment X2, wherein the method is performed based on at least one of any one or more of: X4. The method of any one of embodiments X1 to X3, further comprising configuring different distributed units (DUs) of the disaggregated radio network node to serve different respective ones of the data radio bearers. X5. The method of embodiment X4, further comprising configuring multiple central unit control planes (CU-CPs) to handle different respective ones of the different DUs. X6. The method of any one of embodiments X1 to X3, further comprising configuring the same distributed unit (DU) of the disaggregated radio network node to serve the data radio bearer. X7. The method of embodiment X6, further comprising configuring a data radio bearer to be served on the same cell. X8. The method of embodiment X6, further comprising configuring data radio bearers to be served on different respective cells. X9. The method of any one of embodiments X1 to X8, wherein the network node is or implements a central unit control plane (CU-CP) of a disaggregated radio network node. X10. The method of any one of embodiments X1 to X8, wherein the network node is a radio network device, or a core network device, or an operation and maintenance device. X11. The method of any one of embodiments X1 to X10, wherein each distinct data radio bearer includes a master data radio bearer and one or more secondary data radio bearers. X12. The method of any one of embodiments X1 to X11, wherein the multi-connectivity operation includes a dual connectivity operation. X13. The method of any one of embodiments X1 to X12, wherein security processing is performed at a Packet Data Convergence Protocol (PDCP) layer. X14. The method of any one of embodiments X1 to X13, wherein the security processing of user plane traffic includes downlink security processing and / or uplink security processing, the downlink security processing including encrypting, integrity protecting, and / or replay protecting the user plane traffic in the downlink direction, and the uplink security processing including decrypting the user plane traffic in the uplink direction and / or verifying the integrity and replay protecting the user plane traffic. X15. The method of embodiment X2, wherein the determination is made based on a policy.

[0309] Group Y embodiment Y1. A method implemented by a wireless device, the method comprising: transmitting and / or receiving user plane traffic for the wireless device via a plurality of data radio bearers served by a plurality of respective central unit user planes (CU-UPs) of the disaggregated wireless network node; performing security processing of transmitted and / or received user plane traffic based on different user plane security keys for different data radio bearers and / or for different CU-UPs; A method comprising: Y2. The method of embodiment Y1, further comprising receiving signaling from a network node indicating user plane security keys for different data radio bearers and / or different CU-UPs, and / or indicating which of the security keys should be used for which of the different data radio bearers and / or for which of the different CU-UPs. Y3. The method of embodiment Y2, wherein the network node is a radio network node. Y4. The method of embodiment Y2, wherein the network node is a core network node. Y5. The method of embodiment Y2, in which the network node is or implements a central unit control plane (CU-CP) of a disaggregated radio network node. Y3. The method of embodiment Y1 or Y2, wherein different data radio bearers belong to different respective groups of data radio bearers, and the security keys are different for the different groups of data radio bearers. Y4. The method of any one of embodiments Y1 to Y3, wherein security processing is performed at a Packet Data Convergence Protocol (PDCP) layer. Y5. A method according to any one of embodiments Y1 to Y4, wherein the security processing of user plane traffic includes downlink security processing and / or uplink security processing, the uplink security processing includes encrypting, integrity protecting, and / or replay protecting user plane traffic transmitted in the uplink direction, and the downlink security processing includes decrypting user plane traffic received in the downlink direction and / or verifying the integrity and replay protecting the user plane traffic. Y6. The implementation of the security process is performing security processing of user plane traffic transmitted or received over a first radio bearer of the plurality of data radio bearers based on a first user plane security key for the first data radio bearer and / or for a first CU-UP; performing security processing of user plane traffic transmitted or received over a second radio bearer of the plurality of data radio bearers based on a second user plane security key for the second data radio bearer and / or for the second CU-UP; The method of any one of embodiments Y1 to Y5, comprising:

[0310] Group YY embodiment 19. A method implemented by a network node configured for use in a wireless communications network, the method comprising: configuring user plane traffic for a wireless device to be transmitted and / or received via a plurality of data radio bearers served by a plurality of respective central unit user planes (CU-UPs) of the disaggregated wireless network nodes; Configuring security processing of transmitted and / or received user plane traffic to be performed based on different user plane security keys for different data radio bearers and / or for different CU-UPs; A method comprising: 20. A decision to implement the configuration of user plane traffic and the configuration of security processing, a load on a wireless communication network or on a disaggregated wireless network node; The type of user plane traffic; and Time and The volume of user plane traffic and 20. The method of embodiment 19, further comprising: 21. The method of embodiment 19 or 20, further comprising making a decision to implement the configuring of user plane traffic and the configuring of security processing based on a policy. twenty two. configuring a wireless device to transmit and / or receive user plane traffic for the wireless device via a plurality of data radio bearers; Configuring a wireless device with user plane security keys for different data radio bearers and / or for different CU-UPs, or configuring a wireless device with one or more parameters for deriving a user plane security key; 22. The method of any one of embodiments 19 to 21, comprising: YY5. The method of any one of embodiments 19 to 22, comprising configuring different distributed units (DUs) of a disaggregated radio network node to transmit and / or receive user plane traffic for a radio device via multiple data radio bearers. YY6. A method according to any one of embodiments 19 to YY5, comprising configuring different CU-UPs with different ones of user plane security keys, or configuring different CU-UPs with one or more parameters for deriving different ones of user plane security keys. YY7. The method of any one of embodiments 19 to YY6, wherein the network node is a wireless network node. YY8. The method of any one of embodiments 19 to YY6, wherein the network node is a core network node. YY9. The method of any one of embodiments 19 to YY6, wherein the network node is or implements a central unit control plane (CU-CP) of a disaggregated radio network node. 190. The method of any one of embodiments 19 to YY9, wherein different data radio bearers belong to different respective groups of data radio bearers, and the security keys are different for the different groups of data radio bearers. 191. The method of any one of embodiments 19 to 190, wherein the security processing is configured to be performed at a Packet Data Convergence Protocol (PDCP) layer. 192. User plane traffic security processing: Encrypting and / or decrypting user plane traffic; and Integrity protecting and / or verifying the integrity of user plane traffic; Replay-protecting user plane traffic and / or verifying replay protection of user plane traffic; 192. The method of any one of embodiments 19 to 191, comprising at least one of any one or more of:

[0311] Group C embodiment C1. A wireless device configured to perform any of the steps recited in any one of the Group Y embodiments. C2. A wireless device comprising processing circuitry configured to perform any of the steps recited in any one of the Group Y embodiments. C3. A communication circuit; a processing circuit configured to perform any of the steps recited in any one of the Group Y embodiments; A wireless device comprising: C4. A wireless device, a processing circuit configured to perform any of the steps recited in any one of the Group Y embodiments; and a power delivery circuit configured to provide power to a wireless device; A wireless device comprising: C5. A wireless device, comprising: A wireless device comprising a processing circuit and a memory, the memory including instructions executable by the processing circuit, whereby the wireless device is configured to perform any of the steps recited in any one of the Group Y embodiments. C6. A user equipment (UE), an antenna configured to transmit and receive radio signals; a radio front-end circuit coupled to an antenna and to a processing circuit and configured to condition a signal communicated between the antenna and the processing circuit, a radio front-end circuit, the processing circuitry being configured to perform any of the steps recited in any one of the Group Y embodiments; an input interface coupled to the processing circuitry and configured to enable input of information to the UE to be processed by the processing circuitry; an output interface coupled to the processing circuit and configured to output information from the UE that has been processed by the processing circuit; a battery connected to the processing circuit and configured to power the UE; A user equipment (UE) comprising: C7. A computer program comprising instructions that, when executed by at least one processor of a wireless device, cause the wireless device to perform the steps recited in any one of the Group Y embodiments. C8. A carrier containing the computer program of embodiment C7, the carrier being one of an electronic signal, an optical signal, a radio signal, or a computer-readable storage medium. C9. A central unit user plane (CU-UP) proxy configured to perform any of the steps recited in any one of the Group A embodiments. C10. A central unit user plane (CU-UP) proxy comprising processing circuitry configured to perform any of the steps recited in any one of the Group A embodiments. C11. A communication circuit; a processing circuit configured to perform any of the steps recited in any one of the Group A embodiments; A central unit user plane (CU-UP) proxy comprising: C12. A central unit user plane (CU-UP) proxy, comprising: a processing circuit configured to perform any of the steps recited in any one of the Group A embodiments; a power delivery circuit configured to power the CU-UP proxy; A central unit user plane (CU-UP) proxy comprising: C13. A central unit user plane (CU-UP) proxy, comprising: A central unit user plane (CU-UP) proxy comprising a processing circuit and a memory, the memory including instructions executable by the processing circuit, whereby the CU-UP proxy is configured to perform any of the steps described in any one of the Group A embodiments. C14. A computer program comprising instructions that, when executed by at least one processor of a central unit user plane (CU-UP) proxy, cause the CU-UP proxy to perform the steps recited in any one of the Group A embodiments. C15. A carrier containing the computer program of embodiment C15 or C16, the carrier being one of an electronic signal, an optical signal, a radio signal, or a computer-readable storage medium. C16. A network node configured to perform any of the steps recited in any one of the Group AA, Group BB, Group X, or Group YY embodiments. C17. A network node comprising processing circuitry configured to perform any of the steps recited in any one of the Group AA, Group BB, Group X, or Group YY embodiments. C18. A communication circuit; a processing circuit configured to perform any of the steps recited in any one of the Group AA, Group BB, Group X, or Group YY embodiments; A network node comprising: C19. A network node, a processing circuit configured to perform any of the steps recited in any one of the Group AA, Group BB, Group X, or Group YY embodiments; a power supply circuit configured to supply power to the network node; A network node comprising: C20. A network node, A network node comprising a processing circuit and a memory, the memory including instructions executable by the processing circuit, whereby the network node is configured to perform any of the steps described in any one of the Group AA, Group BB, Group X, or Group YY embodiments. C21. The network node of any one of embodiments C16 to C20, wherein the network node is a base station. C22. A computer program comprising instructions that, when executed by at least one processor of a network node, cause the network node to perform the steps set forth in any one of the Group AA, Group BB, Group X, or Group YY embodiments. C23. The computer program product of embodiment C22, wherein the radio network node is a base station. C24. A carrier containing the computer program of embodiment C22 or C23, the carrier being one of an electronic signal, an optical signal, a radio signal, or a computer-readable storage medium. C25. A first central unit user plane (CU-UP) of a disaggregated radio network node, wherein the first CU-UP is configured to perform any of the steps described in any one of the Group B embodiments. C26. A first central unit user plane (CU-UP) of a disaggregated radio network node, the first CU-UP comprising processing circuitry configured to perform any of the steps set forth in any one of the Group B embodiments. C27. A first central unit user plane (CU-UP) of a disaggregated radio network node, the first CU-UP comprising: A communication circuit; a processing circuit configured to perform any of the steps recited in any one of the Group B embodiments; A first central unit user plane (CU-UP) comprising: C28. A first central unit user plane (CU-UP) of a disaggregated radio network node, the first CU-UP comprising: a processing circuit configured to perform any of the steps recited in any one of the Group B embodiments; a power supply circuit configured to supply power to the first CU-UP; A first central unit user plane (CU-UP) comprising: C29. A first central unit user plane (CU-UP) of a disaggregated radio network node, the first CU-UP comprising: A first central unit user plane (CU-UP) comprising a processing circuit and a memory, the memory including instructions executable by the processing circuit, whereby the first CU-UP is configured to perform any of the steps described in any one of the Group B embodiments. C30. A computer program comprising instructions that, when executed by at least one processor of a first central unit user plane (CU-UP) of a disaggregated radio network node, cause the first CU-UP to perform the steps recited in any one of the Group B embodiments. C31. A carrier containing the computer program of embodiment C30, the carrier being one of an electronic signal, an optical signal, a radio signal, or a computer-readable storage medium.

[0312] Group D embodiment D1. A communication system including a host computer, the host computer: processing circuitry configured to provide user data; a communications interface configured to forward user data to a cellular network for transmission to a user equipment (UE); Equipped with A communications system, wherein the cellular network comprises a base station having a radio interface and processing circuitry, the processing circuitry of the base station configured to perform any of the steps described in any one of the Group A, Group AA, Group B, Group BB, Group X, Group XX, or Group Y embodiments. D2. The communications system of embodiment D1, further comprising a base station. D3. The communications system of any one of embodiments D1 to D2, further comprising a UE, the UE configured to communicate with the base station. D4. processing circuitry of the host computer configured to execute a host application thereby providing user data; the UE comprising processing circuitry configured to execute a client application associated with the host application; A communication system described in any one of embodiments D1 to D3. D5. A method implemented in a communication system including a host computer, a base station, and a user equipment (UE), the method comprising: providing user data at a host computer; Initiating, in a host computer, a transmission conveying user data to a UE over a cellular network comprising a base station, the base station performing any of the steps described in any one of the Group A, Group AA, Group B, Group BB, Group X, Group XX, or Group Y embodiments; A method comprising: D6. The method of embodiment D5, further comprising transmitting user data at the base station. D7. The method of embodiment D5 or D6, wherein the user data is provided by executing a host application at the host computer, and the method further includes executing, at the UE, a client application associated with the host application. D8. A user equipment (UE) configured to communicate with a base station, the UE comprising a radio interface and processing circuitry configured to implement any one of embodiments D5 to D7. D9. A communication system including a host computer, the host computer: processing circuitry configured to provide user data; a communications interface configured to forward user data to a cellular network for transmission to a user equipment (UE); Equipped with A communications system, wherein the UE comprises a radio interface and processing circuitry, the components of the UE configured to perform any of the steps recited in any one of the Group Y embodiments. D10. The communications system of embodiment D9, wherein the cellular network further includes a base station configured to communicate with the UE. D11. processing circuitry of the host computer configured to execute a host application thereby providing user data; a processing circuit in the UE configured to execute a client application associated with the host application; A communication system as described in embodiment D9 or D10. D12. A method implemented in a communication system including a host computer, a base station, and a user equipment (UE), the method comprising: providing user data at a host computer; initiating, at the host computer, a transmission conveying user data to a UE over a cellular network comprising a base station, the UE performing any of the steps recited in any one of the Group Y embodiments; A method comprising: D13. The method of embodiment D12, further comprising receiving, at the UE, user data from the base station. D14. A communication system including a host computer, the host computer: A communications interface configured to receive user data originating from a transmission from a user equipment (UE) to a base station Equipped with A communications system, wherein the UE comprises a radio interface and a processing circuit, the processing circuitry of the UE configured to perform any of the steps recited in any one of the Group Y embodiments. D15. The communication system of embodiment D14, further comprising a UE. D16. The communications system of any one of embodiments D14 to D15, further comprising a base station, the base station having a wireless interface configured to communicate with the UE and a communications interface configured to forward user data carried by transmissions from the UE to the base station to a host computer. D17. processing circuitry of the host computer is configured to execute a host application; a processing circuit in the UE configured to execute a client application associated with the host application and thereby provide user data; A communication system described in any one of embodiments D14 to D16. D18. processing circuitry of the host computer configured to execute the host application and thereby provide the requested data; processing circuitry of the UE configured to execute a client application associated with the host application, thereby providing user data in response to the request data; A communication system described in any one of embodiments D14 to D17. D19. A method implemented in a communication system including a host computer, a base station, and a user equipment (UE), the method comprising: receiving, at the host computer, user data transmitted from the UE to the base station, wherein the UE performs any of the steps recited in any one of the Group Y embodiments; A method comprising: D20. The method of embodiment D19, further comprising, at the UE, providing user data to the base station. D21. executing, at the UE, a client application thereby providing user data to be transmitted; executing, at the host computer, a host application associated with the client application; The method of embodiment D19 or D20, further comprising: D22. executing, in the UE, a client application; receiving, at the UE, input data for a client application, the input data being provided at a host computer by executing a host application associated with the client application; Further comprising: the user data to be transmitted is provided by a client application in response to the input data; The method of any one of embodiments D19 to D21. D23. A communications system including a host computer, the host computer comprising a communications interface configured to receive user data originating from a transmission from a user equipment (UE) to a base station, the base station comprising a wireless interface and processing circuitry, the processing circuitry of the base station configured to perform any of the steps set forth in any one of the Group A, Group AA, Group B, Group BB, Group X, Group XX, or Group Y embodiments. D24. The communications system of embodiment D23, further comprising a base station. D25. The communications system of any one of embodiments D23 to D24, further comprising a UE, the UE configured to communicate with the base station. D26. processing circuitry of the host computer is configured to execute a host application; the UE is configured to execute a client application associated with the host application, thereby providing user data to be received by the host computer; A communication system described in any one of embodiments D23 to D25. D27. A method implemented in a communication system including a host computer, a base station, and a user equipment (UE), the method comprising: receiving, at the host computer, from a base station, user data originating from a transmission received by the base station from the UE, wherein the UE performs any of the steps recited in any one of the Group Y embodiments. A method comprising: D28. The method of embodiment D27, further comprising receiving, at the base station, user data from the UE. D29. The method of embodiment D27 or D28, further comprising initiating, at the base station, transmission of the received user data to the host computer.

Claims

1. A method implemented by a network node (20) configured for use in a wireless communication network (10), the method comprising: Configuring multiple central unit user planes (CU-UPs) (14-1UP) ​​of a disaggregated radio network node (14) to handle different respective data radio bearers (16-1 . . . 16-N) of a wireless device (12) in multi-connectivity operation wherein security processing of user plane traffic by different CU-UPs (14-1UP) ​​is based on different respective security keys (18).

2. and determining whether to perform the setting, the determining further comprising: a load on the wireless communication network (10) or on the disaggregated wireless network node (14); The type of user plane traffic; and Time and the amount of user plane traffic; The method of claim 1 , wherein the method is performed based on at least one of any one or more of:

3. The method of claim 1 or 2, further comprising configuring different distribution units (DUs) of the disaggregated radio network node (14) to serve different respective ones of the data radio bearers (16-1 . . . 16-N).

4. The method according to claim 1 , wherein the security processing is performed at a Packet Data Convergence Protocol (PDCP) layer.

5. 5. The method according to claim 1, wherein the security processing of the user plane traffic comprises downlink and / or uplink security processing, the downlink security processing comprising encrypting, integrity protecting, and / or replay protecting the user plane traffic in a downlink direction, and the uplink security processing comprising decrypting and / or verifying the integrity and replay protecting the user plane traffic in an uplink direction.

6. The method of claim 1 , wherein the multi-connectivity operation includes a dual connectivity operation.

7. The method according to any one of claims 1 to 6, wherein the network node (20) comprises a central unit control plane (CU-CP) of the disaggregated radio network node (14).

8. A method implemented by a wireless device (12), the method comprising: transmitting and / or receiving user plane traffic for said wireless device (12) via a plurality of data radio bearers (16-1...16-N) served by a plurality of respective central unit user planes (CU-UPs) (14-1UP) ​​of a disaggregated wireless network node (14); performing security processing of the transmitted and / or received user plane traffic based on different user plane security keys (18) for different data radio bearers (16-1...16-N) and / or for different CU-UPs (14-1UP); A method comprising:

9. 9. The method of claim 8, further comprising receiving signaling from a network node (20) indicating the user plane security keys (18) for the different data radio bearers (16-1...16-N) and / or the different CU-UPs (14-1UP) ​​and / or indicating which of the security keys (18) should be used for which of the different data radio bearers (16-1...16-N) and / or for which of the different CU-UPs (14-1UP).

10. The method of claim 9, wherein the network node (20) implements a central unit control plane (CU-CP) of the disaggregated radio network node (14).

11. The method according to any one of claims 8 to 10, wherein the different data radio bearers (16-1 . . . 16-N) belong to different respective groups of data radio bearers, and the security key (18) is different for the different groups of data radio bearers.

12. The method according to any one of claims 8 to 11, wherein the security processing is performed at a Packet Data Convergence Protocol (PDCP) layer.

13. 13. The method according to claim 8, wherein the security processing of the user plane traffic comprises downlink and / or uplink security processing, the uplink security processing comprising encrypting, integrity protecting and / or replay protecting the user plane traffic transmitted in an uplink direction, and the downlink security processing comprising decrypting and / or verifying the integrity and replay protecting of the user plane traffic received in a downlink direction.

14. Implementing the security process performing security processing of the user plane traffic transmitted or received over a first radio bearer of the plurality of data radio bearers (16-1 . . . 16-N) based on a first user plane security key for the first data radio bearer and / or for a first CU-UP; performing security processing of the user plane traffic transmitted or received over a second radio bearer of the plurality of data radio bearers (16-1 . . . 16-N) based on a second user plane security key for the second data radio bearer and / or for a second CU-UP; 14. The method of any one of claims 8 to 13, comprising:

15. 15. The method according to claim 8, wherein the plurality of data radio bearers (16-1 .. 16-N) comprises a master data radio bearer associated with a master cell group (MCG) in dual connectivity operation and a secondary data radio bearer associated with a secondary cell group (SCG) in dual connectivity operation.

16. A method implemented by a network node (20) configured for use in a wireless communication network (10), the method comprising: configuring user plane traffic for a wireless device (12) to be transmitted and / or received via a plurality of data radio bearers (16-1...16-N) served by a plurality of respective central unit user planes (CU-UPs) (14-1UP) ​​of a disaggregated wireless network node (14); configuring security processing of the transmitted and / or received user plane traffic to be performed based on different user plane security keys (18) for different data radio bearers (16-1...16-N) and / or for different CU-UPs (14-1UP); A method comprising:

17. A decision to perform the configuration of the user plane traffic and the configuration of the security processing, a load on the wireless communication network (10) or on the disaggregated wireless network node (14); The type of user plane traffic; and Time and the amount of user plane traffic; 20. The method of claim 16, further comprising:

18. configuring the given wireless device (12) to transmit and / or receive the user plane traffic for the given wireless device (12) via the plurality of data radio bearers (16-1 . . . 16-N); configuring the user plane security keys (18) for the different data radio bearers (16-1...16-N) and / or for the different CU-UPs (14-1UP) ​​in the one wireless device (12), or configuring one or more parameters for deriving the user plane security keys (18) in the one wireless device (12); 18. The method of claim 16 or 17, comprising:

19. configuring different distributed units (DUs) of the disaggregated radio network node (14) to transmit and / or receive the user plane traffic for the certain radio device (12) via the plurality of data radio bearers (16-1 . . . 16-N); and / or Configuring the different CU-UPs (14-1UP) ​​with different ones of the user plane security keys (18), or configuring the different CU-UPs (14-1UP) ​​with one or more parameters for deriving the different ones of the user plane security keys (18).

19. The method of any one of claims 16 to 18, comprising:

20. The method according to any one of claims 16 to 19, wherein the different data radio bearers (16-1 . . . 16-N) belong to different respective groups of data radio bearers, and the security key (18) is different for the different groups of data radio bearers.

21. 21. The method according to any one of claims 16 to 20, wherein the security processing is configured to be performed at a Packet Data Convergence Protocol (PDCP) layer.

22. 22. The method according to any one of claims 16 to 21, wherein the plurality of data radio bearers (16-1 .. 16-N) comprises a master data radio bearer associated with a master cell group (MCG) in dual connectivity operation and a secondary data radio bearer associated with a secondary cell group (SCG) in dual connectivity operation.

23. The method according to any one of claims 16 to 22, wherein the network node (20) implements a central unit control plane (CU-CP) of the disaggregated radio network node (14).

24. A network node (20) configured for use in a wireless communication network (10), said network node (20) comprising: A communication circuit; a processing circuit configured to configure a plurality of central unit user planes (CU-UP) (14-1UP) ​​of the disaggregated radio network node (14) to handle different respective data radio bearers (16-1...16-N) of the wireless device (12) in multi-connectivity operation; wherein security processing of user plane traffic by different CU-UPs (14-1UP) ​​is based on different respective security keys (18).

25. 25. A network node according to claim 24, wherein the processing circuitry is configured to carry out a method according to any one of claims 2 to 7.

26. A communication circuit; Processing circuit and A wireless device (12) comprising: transmitting and / or receiving user plane traffic for said wireless device (12) via a plurality of data radio bearers (16-1...16-N) served by a plurality of respective central unit user planes (CU-UPs) (14-1UP) ​​of a disaggregated wireless network node (14); performing security processing of the transmitted and / or received user plane traffic based on different user plane security keys (18) for the different data radio bearers (16-1 . . . 16-N) and / or for the different CU-UPs (14-1UP); A wireless device (12) configured to:

27. 27. The wireless device (12) of claim 26, wherein the processing circuitry is configured to perform a method according to any one of claims 9 to 15.

28. A network node (20) configured for use in a wireless communication network (10), said network node (20) comprising: A communication circuit; Processing circuit and wherein the processing circuitry comprises: configuring user plane traffic for a wireless device (12) to be transmitted and / or received via a plurality of data radio bearers (16-1...16-N) served by a plurality of respective central unit user planes (CU-UPs) (14-1UP) ​​of a disaggregated wireless network node (14); configuring security processing of the transmitted and / or received user plane traffic to be performed based on different user plane security keys (18) for different data radio bearers (16-1...16-N) and / or for different CU-UPs (14-1UP); A network node (20) configured to:

29. 29. A network node according to claim 28, wherein the processing circuitry is configured to carry out a method according to any one of claims 17 to 23.

30. A computer program comprising instructions which, when executed by at least one processor of a network node (20), cause said network node (20) to perform a method according to any one of claims 1 to 7 and 16 to 23.

31. A computer program comprising instructions which, when executed by at least one processor of a wireless device (12), cause the wireless device (12) to perform a method according to any one of claims 8 to 15.

32. 32. A carrier containing a computer program according to claim 30 or 31, the carrier being one of an electronic signal, an optical signal, a radio signal or a computer readable storage medium.

Images