System and method for security protection of NAS messages

Abstract

To provide a non-access stratum (NAS) security protection for mobile networks.SOLUTION: In a method, a network element of a mobile network performs a NAS procedure in multiple phases to establish a NAS communication session with user equipment (UE) when no NAS security context exists. For a phase 831, the network element receives, from the UE, an initial NAS message populated with a subset of NAS protocol information elements (IEs) designated for security handling, selects a NAS security algorithm for the NAS security context, and sends the UE a response that indicates the NAS security algorithm. For a phase 832, the network element receives, from the UE, a subsequent NAS message having a NAS message container that contains the initial NAS message populated with each of the NAS protocol IEs, and decrypts the container using the NAS security algorithm.SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] Related Applications This non-provisional patent application claims priority to U.S. Provisional Patent Application No. 62 / 735,732, filed September 24, 2018, and is incorporated by reference as if fully set forth herein.

[0002] TECHNICAL FIELD The present disclosure relates to the field of communication systems, and in particular to network security. [Background technology]

[0003] Service providers or carriers implement mobile networks to provide numerous voice and data services to end users of mobile phones or other mobile devices / terminals, commonly referred to as user equipment (UE). Examples of voice services include voice calling, call forwarding, and call waiting. Examples of data services include Internet access, audio streaming, video streaming, online gaming, and Internet Protocol Television (IP-TV). A mobile network is a type of network in which the final link to the end user is wireless. A mobile network generally includes a core network and one or more radio access networks (RANs) that exchange signaling and data with the UE over the air interface. A typical mobile network is logically divided into a user plane and a control plane. The user plane is the logical plane responsible for the transmission of user data sent over the network, and the control plane is the logical plane responsible for the transmission of signaling used to establish communication for the UE. The Third Generation Partnership Project (3GPP) specifications divide cellular protocols into two layers: the non-access stratum (NAS) and the access stratum (AS). The AS consists of communications between the UE and the RAN (e.g., eNodeB) that occur over a radio frequency (RF) channel. The NAS consists of non-wireless signaling traffic between the UE and the core network (e.g., the Mobility Management Entity (MME) in the case of LTE, or the Access and Mobility Management Function (AMF) in the case of a network-generating network). 3GPP has implemented security procedures to protect control plane messages (e.g., NAS messages) from various attacks. However, it may be beneficial to identify enhanced security procedures that further protect control plane messages. Summary of the Invention

[0004] The embodiments described herein provide enhanced protection for NAS messages. NAS procedures (e.g., UE registration) include a set of information elements (IEs) that convey information. The embodiments described below describe how to protect the IEs or a subset of IEs sent in NAS messages. Therefore, the information conveyed in the IEs is not vulnerable to malicious attacks.

[0005] One embodiment includes a network element of a mobile network. The network element includes processor(s) and memory including computer program code executable by the processor. The processor is configured to cause the network element to perform a multi-phase NAS procedure for establishing a NAS communication session between the network element and the UE. In a first phase of the NAS procedure, the processor is further configured to cause the network element to receive an initial NAS message from the UE, the initial NAS message populating a subset of NAS protocol IEs designated for security-related actions from the NAS protocol IEs of the NAS procedure. The processor is further configured to cause the network element to process the subset of NAS protocol IEs to determine that a NAS security context does not exist for the UE, select a NAS security algorithm for the NAS security context, and transmit a response to the UE indicating a NAS security algorithm and a security keyset identifier for the NAS security context. In a second phase of the NAS procedure, the processor is further configured to cause the network element to receive a subsequent NAS message from the UE having a NAS message container containing an initial NAS message encrypted based on a NAS security algorithm, and to decrypt the NAS message container of the subsequent NAS message, wherein the initial NAS message contained in the NAS message container of the subsequent NAS message has been populated with each NAS protocol IE of the NAS procedure.

[0006] In another embodiment, in the first phase, a subset of the NAS protocol IEs is encrypted in the initial NAS message using a public key of a Home Public Land Mobile Network (HPLMN) of the UE, and the processor is further configured to cause the network element to initiate decryption of the subset of the NAS protocol IEs.

[0007] In another embodiment, the network element comprises an Access and Mobility Management Function (AMF) element of a mobile network.

[0008] In another embodiment, the processor is further configured to cause the network element to transmit the encrypted subset of NAS protocol IEs to a unified data management (UDM) element that decrypts the subset of NAS protocol IEs based on a private key of the HPLMN.

[0009] In another embodiment, the initial NAS message comprises a registration request message, where the subset of NAS protocol IEs designated for security-related handling consists of a mobile identity of the UE, a UE security capability indicating one or more NAS security algorithms supported by the UE, a registration type, and a security keyset identifier for the NAS security context.

[0010] In another embodiment, the response comprises a security mode command message indicating a NAS security algorithm and a security keyset identifier, and a subsequent NAS message received from the UE comprises a security mode complete message having a NAS message container containing the initial NAS message encrypted based on the NAS security algorithm.

[0011] In another embodiment, the mobile network comprises a fifth generation (5G) network.

[0012] Another embodiment comprises a method for performing a NAS procedure to establish a NAS communication session between a UE and a network element of a mobile network. In a first phase of the NAS procedure, the method comprises receiving an initial NAS message from the UE at the network element, the initial NAS message being populated with a subset of NAS protocol IEs from the NAS procedure designated for security-related actions. Further, in the first phase, the method comprises processing the subset of NAS protocol IEs at the network element to determine that a NAS security context does not exist for the UE, selecting a NAS security algorithm at the network element for the NAS security context, and transmitting a response from the network element to the UE indicating the NAS security algorithm and a security keyset identifier for the NAS security context. In a second phase of the NAS procedure, the method comprises receiving at the network element from the UE a subsequent NAS message having a NAS message container containing an initial NAS message encrypted based on a NAS security algorithm, and decrypting at the network element the NAS message container of the subsequent NAS message, wherein the initial NAS message contained in the NAS message container of the subsequent NAS message has been populated with each NAS protocol IE of the NAS procedure.

[0013] In another embodiment, in the first phase, a subset of the NAS protocol IEs is encrypted in the initial NAS message using a public key of the UE's HPLMN, and the method further comprises initiating decryption of the subset of the NAS protocol IEs.

[0014] In another embodiment, the network element comprises an AMF element of the mobile network, and the step of initiating decryption of the subset of NAS protocol IEs comprises sending the encrypted subset of NAS protocol IEs to a UDM element for decrypting the subset of NAS protocol IEs based on a private key of the HPLMN.

[0015] In another embodiment, the initial NAS message comprises a registration request message, and the subset of NAS protocol IEs designated for security-related handling consists of a mobile identity of the UE, a UE security capability indicating one or more NAS security algorithms supported by the UE, a registration type, and a security keyset identifier for the NAS security context.

[0016] In another embodiment, the response comprises a security mode command message indicating a NAS security algorithm and a security keyset identifier, and a subsequent NAS message received from the UE comprises a security mode complete message having a NAS message container containing the initial NAS message encrypted based on the NAS security algorithm.

[0017] In another embodiment, in a first phase of the NAS procedure, the method comprises the steps of: identifying, at the UE, a subset of NAS protocol IEs of the NAS procedure designated for security-related handling, inserting the subset of NAS protocol IEs into an initial NAS message, transmitting the initial NAS message from the UE to a network element, and receiving a response from the network element indicating NAS security algorithms and security keyset identifiers for the NAS security context. In a second phase of the NAS procedure, the method comprises the steps of: inserting, at the UE, NAS protocol IEs of the NAS procedure into the initial NAS message, inserting the initial NAS message into a NAS message container of a subsequent NAS message, encrypting the NAS message container of the subsequent NAS message using the NAS security algorithms, and transmitting the subsequent NAS message from the UE to the network element.

[0018] In another embodiment, in the first phase, the method further comprises encrypting, at the UE, a subset of NAS protocol IEs of the initial NAS message using a public key of the UE's HPLMN.

[0019] Another embodiment comprises a UE including processor(s) and computer program code executable by the processor. The processor is configured to cause the UE to initiate a multi-phase NAS procedure for establishing a NAS communication session between the UE and a network element of a mobile network. In a first phase of the NAS procedure, the processor is further configured to cause the UE to identify, from the NAS protocol IEs of the NAS procedure, a subset of NAS protocol IEs designated for security-related actions. The processor is further configured to cause the UE to insert the subset of NAS protocol IEs into an initial NAS message, send the initial NAS message to the network element, and receive from the network element a response indicating NAS security algorithms and security keyset identifiers for the NAS security context. In a second phase of the NAS procedure, the processor is further configured to cause the UE to insert NAS protocol IEs of the NAS procedure into the initial NAS message, insert the initial NAS message into a NAS message container of a subsequent NAS message, encrypt the NAS message container of the subsequent NAS message using the NAS security algorithm, and send the subsequent NAS message to the network element.

[0020] In another embodiment, in the first phase, the processor is further configured to cause the UE to encrypt a subset of NAS protocol IEs of the initial NAS message using a public key of the UE's HPLMN.

[0021] In another embodiment, the processor is further configured to cause the UE to encrypt a subset of NAS protocol IEs in the initial NAS message using the public key when the UE has the public key programmed in a UMTS Subscriber Identity Module (USIM), and to send the initial NAS message to the network element without encrypting the subset of NAS protocol IEs in the initial NAS message when the UE does not have the public key programmed in the USIM.

[0022] In another embodiment, the initial NAS message comprises a registration request message, and the subset of NAS protocol IEs designated for security-related handling consists of a mobile identity of the UE, a UE security capability indicating one or more NAS security algorithms supported by the UE, a registration type, and a security keyset identifier for the NAS security context.

[0023] In another embodiment, the processor is configured to cause the UE to encrypt a subset of NAS protocol IEs of the initial NAS message using a public key of the UE's HPLMN when the registration type does not indicate an emergency, and to send the initial NAS message to the network element without encrypting the subset of NAS protocol IEs of the initial NAS message when the registration type indicates an emergency.

[0024] In another embodiment, the response comprises a security mode command message indicating a NAS security algorithm and a security keyset identifier, and the subsequent NAS message comprises a security mode complete message having a NAS message container containing the initial NAS message encrypted based on the NAS security algorithm.

[0025] Another embodiment includes a network element of a mobile network, the network element including means for causing the network element to perform a multi-phase NAS procedure to establish a NAS communication session between the network element and the UE. In a first phase of the NAS procedure, the network element includes means for receiving an initial NAS message from the UE, the initial NAS message populated with a subset of NAS protocol IEs designated for security-related actions from the NAS protocol IEs of the NAS procedure. The network element further includes means for processing the subset of NAS protocol IEs to determine that a NAS security context does not exist for the UE, means for selecting a NAS security algorithm for the NAS security context, and means for transmitting a response to the UE indicating the NAS security algorithm and a security keyset identifier for the NAS security context. In a second phase of the NAS procedure, the network element further includes means for receiving from the UE a subsequent NAS message having a NAS message container containing an initial NAS message encrypted based on a NAS security algorithm, and means for decrypting the NAS message container of the subsequent NAS message, wherein the initial NAS message contained in the NAS message container of the subsequent NAS message has been populated with each NAS protocol IE of the NAS procedure.

[0026] The above summary provides a basic understanding of some aspects of the specification. This summary is not an extensive overview of the specification. It is not intended to identify key or critical elements of the specification, nor is it intended to delineate the scope of particular embodiments of the specification or the claims. The summary's sole purpose is to present some concepts of the specification in a simplified form as a prelude to the more detailed description that is presented later.

[0027] Embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which the same reference numbers represent the same elements or types of elements in all figures, and in which: [Brief explanation of the drawings]

[0028] [Figure 1] 1 illustrates a mobile network in an exemplary embodiment. [Figure 2] 1 shows an evolved packet core (EPC) network. [Figure 3] 1 illustrates a non-roaming architecture for next generation networks. [Figure 4] 1 shows the roaming architecture of a next-generation network. [Figure 5] 1 shows a wireless protocol stack. [Figure 6] FIG. 2 is a block diagram of a UE in an example embodiment. [Figure 7] FIG. 2 is a block diagram of a network element in an exemplary embodiment. [Figure 8] 1 is a flowchart illustrating a method for performing a NAS procedure in a UE in an exemplary embodiment. [Figure 9] 10 is a flowchart illustrating a method for performing a NAS procedure in a network element in an example embodiment. [Figure 10] FIG. 10 is a message diagram illustrating a NAS procedure when the UE does not have a security context in an exemplary embodiment. [Figure 11] 10 is a flowchart illustrating a method for performing a NAS procedure at a UE 110 in accordance with another exemplary embodiment. [Figure 12] 10 is a flowchart illustrating a method for performing a NAS procedure in a network element in another exemplary embodiment. [Figure 13] FIG. 10 is a message diagram illustrating a NAS procedure when the UE does not have a security context in an exemplary embodiment. [Figure 14] 10 is a flowchart illustrating a method for performing a NAS procedure in a UE in accordance with another exemplary embodiment. [Figure 15] 10 is a flowchart illustrating a method for performing a NAS procedure in a network element in another exemplary embodiment. [Figure 16]1 is a message diagram illustrating a NAS registration procedure when the UE has a valid security context in an exemplary embodiment. [Figure 17] 1 is a message diagram illustrating a NAS service request procedure when the UE has a valid security context in an exemplary embodiment. [Figure 18] FIG. 10 is a message diagram illustrating a NAS deregistration procedure when the UE has a valid security context in an exemplary embodiment. [Figure 19A] 1 is a flowchart illustrating a method for performing a NAS procedure in a UE in an example embodiment. [Figure 19B] 1 is a flowchart illustrating a method for performing a NAS procedure in a UE in an example embodiment. [Figure 20] 10 is a flowchart illustrating a method for performing a NAS procedure in a network element in an example embodiment. [Figure 21] 1 is a message diagram illustrating a NAS registration procedure when a UE has a NAS security context but the NAS security context is not valid or cannot be found in an exemplary embodiment. [Figure 22] 1 is a message diagram illustrating a NAS service request procedure when the UE has a NAS security context but the NAS security context is not valid or cannot be found in an exemplary embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0029] The figures and the following description illustrate specific exemplary embodiments. Those skilled in the art will understand that, although not explicitly described or shown herein, they can devise various configurations that embody the principles of the embodiments and are included within the scope of the embodiments. Furthermore, any examples described herein are intended to aid in the understanding of the principles of the embodiments and should not be construed as being limited to such specifically described examples and conditions. Consequently, the concept(s) of the present invention are not limited to the specific embodiments or examples described below, but rather by the claims and their equivalents.

[0030] 1 illustrates a mobile network 100 in an exemplary embodiment. The mobile network 100 (also called a cellular network) is a type of network where the last link is wireless and provides voice and / or data services to multiple devices. The mobile network 100 may be a third-generation (3G), fourth-generation (4G), and / or next-generation network (e.g., fifth-generation (5G)).

[0031] Mobile network 100 is shown as providing communication services to UE 110 (along with other UEs not shown). UE 110 may be enabled for voice services, data services, machine-to-machine (M2M) or machine-type communication (MTC) services, and / or other services. UE 110 may be an end-user device such as a mobile phone (e.g., a smartphone), a tablet or PDA, a computer with a mobile broadband adapter, etc.

[0032] The mobile network 100 includes one or more Radio Access Networks (RANs) 120 that communicate with the UEs 110 via an air interface 122. The RAN 120 may support Evolved UMTS Terrestrial Radio Access Network (E-UTRAN) access, Wireless Local Area Network (WLAN) access, fixed access, satellite radio access, new radio access technologies (RATs), etc. As an example, the RAN 120 may include an E-UTRAN or Next Generation RAN (NG-RAN) that includes one or more base stations 124 distributed over a geographic region. The base stations 124 may include entities that communicate with UEs over a licensed spectrum using wireless communication technologies and interface the UEs to a core network. The base stations 124 in an E-UTRAN are referred to as Evolved NodeBs (eNodeBs). The base stations 124 in an NG-RAN are referred to as gNodeBs (NR base stations) and / or ng-eNodeBs (LTE base stations supporting a 5G core network). As another example, the RAN 120 may include a WLAN that includes one or more Wireless Access Points (WAPs) 125. A WLAN is a network that allows UEs to connect to a local area network (LAN) via a wireless (radio) connection. A WAP 125 is a node that uses wireless communication technology to communicate with UEs over an unlicensed spectrum and provides the UEs with access to a core network. An example of a WAP 125 is a WiFi access point that operates in the 2.4 GHz or 5 GHz radio band. As used herein, the term "base station" may refer to an eNodeB, a gNodeB, a ng-eNodeB, a WAP, etc.

[0033] The UE 110 can connect to a cell 126 of the RAN 120 to access the core network 130. The RAN 120 thus represents a radio interface between the UE 110 and the core network 130. The core network 130 is a central part of the mobile network 100 that provides various services to customers connected by the RAN 120. One example of the core network 130 is the Evolved Packet Core (EPC) network proposed by 3GPP for LTE. Another example of the core network 130 is the 5G core network proposed by 3GPP. The core network 130 comprises network elements 132, which may include servers, devices, apparatus, or equipment (including hardware) that provide services to the UE 110. The network elements 132 of the EPC network may include a mobility management entity (MME), a serving gateway (S-GW), a packet data network gateway (P-GW), etc. The network elements 132 of the 5G network may include an Access and Mobility Management Function (AMF), a Session Management Function (SMF), a Policy Control Function (PCF), an Application Function (AF), a User Plane Function (UPF), etc.

[0034] 2 illustrates an evolved packet core (EPC) network 200, which is a core network for LTE. The EPC network 200 includes a mobility management entity (MME) 214, a serving gateway (S-GW) 215, a packet data network gateway (P-GW) 216, a home subscriber server (HSS) 217, and a policy and charging rules function (PCRF) 218, but may also include other elements not shown, such as an IP multimedia subsystem (IMS) application server. Within the EPC network 200, user data (also referred to as the "user plane") and signaling (also referred to as the "control plane") are separated. The MME 214 handles the control plane within the EPC network 200. For example, the MME 214 handles signaling related to mobility and security for E-UTRAN access. The MME 214 is responsible for tracking and paging the UE 110 in idle mode. The S-GW 215 and P-GW 216 handle the user plane. The S-GW 215 and P-GW 216 transport data traffic between the UE 110 and an external data network 240 (DN or packet data network (PDN)). The S-GW 215 is the interconnection point between the wireless side and the EPC network 200, and serves the UE 110 by routing incoming and outgoing IP packets. The S-GW 215 is also the anchor point for intra-LTE mobility (i.e., in case of handover between eNodeBs) and between LTE and other 3GPP accesses. The P-GW 216 is the interconnection point between the EPC network 200 and the external data network 240 (i.e., the ingress or egress point of the data network 240), and routes packets to and from the data network 240. The HSS 217 is a database that stores user-related and subscriber-related information. The PCRF 218 is a node or entity in the EPC network 200 that provides a Policy and Charging Control (PCC) solution in the EPC network 200 and formulates PCC rules for services requested by end users.

[0035] The MME 214 connects to the RAN 120 (i.e., eNodeB) via an S1-MME interface, and the S-GW 215 connects to the RAN 120 via an S1-U interface. The MME 214 connects to the S-GW 215 via an S11 interface and to the HSS 217 via an S6a interface. The PCRF 218 connects to the P-GW 216 via a Gx interface, which transfers policy and charging rules from the PCRF 218 to the Policy and Charging Enforcement Function (PCEF) of the P-GW 216. The PCRF 218 connects to the S-GW 215 via a Gxx interface, and the S-GW 215 connects to the P-GW 216 via an S5 interface.

[0036] Figure 3 illustrates a non-roaming architecture 300 for a next-generation network. The architecture of Figure 3 is a reference point representation, as further described in 3GPP TS 23.501 (v15.3.0), which is incorporated by reference as if fully incorporated herein. The architecture 300 is comprised of core network network functions (NFs), with the control plane network functions separated from the user plane. The core network control plane includes an Authentication Server Function (AUSF) 310, a Unified Data Management (UDM) 312, a Network Slice Selection Function (NSSF) 313, an Access and Mobility Management Function (AMF) 314, a Session Management Function (SMF) 316, a Policy Control Function (PCF) 318, and an Application Function (AF) 320. The core network user plane includes one or more User Plane Functions (UPFs) 324 that communicate with the data network 240. A UE 110 can access the control plane and user plane of the core network via an (R)AN 120.

[0037] The AUSF 310 is configured to support authentication of the UE 110. The UDM 312 is configured to store subscription data / information for the UE 110. The UDM 312 may store three types of user data: subscription, policy, and session-related context (e.g., UE location). The AMF 314 is configured to provide UE-based authentication, authorization, mobility management, etc. The SMF 316 is configured to provide session management (SM), UE Internet Protocol (IP) address allocation and management, UPF(s) selection and control, terminating interface to the PCF 318, policy enforcement and control portion of Quality of Service (QoS), lawful interception, terminating the SM portion of NAS messages, downlink data notification (DNN), roaming functionality, handling local enforcement for QoS application of Service Level Agreements (SLAs), charging data collection, and charging interface, etc. If the UE 110 has multiple sessions, a different SMF can be assigned for each session to manage the multiple sessions separately and provide different functions for each session. The PCF 318 is configured to support a unified policy framework for managing network behavior and to provide policy rules to control plane functions for QoS enforcement, charging, access control, traffic routing, etc. The AF 320 provides information about packet flows to the PCF 318. Based on this information, the PCF 318 is configured to determine policy rules regarding mobility and session management in order to enable the AMF 314 and SMF 316 to operate appropriately.

[0038] The UPF 324 supports various user plane operations and functions, including packet routing and forwarding, traffic processing (e.g., QoS enforcement), anchor point for intra-RAT / inter-RAT mobility (when applicable), packet inspection and policy rule enforcement, lawful interception (UP collection), traffic accounting, and reporting. The data network 240 is not part of the core network and provides Internet access, operator services, third-party services, etc. For example, the International Telecommunication Union (ITU) classifies 5G mobile network services into three categories: Enhanced Mobile Broadband (eMBB), Ultra-reliable and Low-Latency Communications (uRLLC), and Massive Machine Type Communications (mMTC) or Massive Internet of Things (MIoT). eMBB focuses on services with high bandwidth requirements, such as HD video, virtual reality (VR), and augmented reality (AR). uRLLC focuses on latency-sensitive services such as autonomous driving and remote management. mMTC and MIoT focus on services with high connection density requirements such as smart cities and smart agriculture. Data network 240 may be configured to provide these and other services.

[0039] The architecture 300 includes the following reference points: The N1 reference point is implemented between the UE 110 and the AMF 314. The N2 reference point is implemented between the (R)AN 120 and the AMF 314. The N3 reference point is implemented between the (R)AN 120 and the UPF 324. The N4 reference point is implemented between the SMF 316 and the UPF 324. The N5 reference point is implemented between the PCF 318 and the AF 320. The N6 reference point is implemented between the UPF 324 and the data network 240. The N7 reference point is implemented between the SMF 316 and the PCF 318. The N8 reference point is implemented between the UDM 312 and the AMF 314. The N9 reference point is implemented between two UPFs 324. The N10 reference point is implemented between the UDM 312 and the SMF 316. The N11 reference point is implemented between the AMF 314 and the SMF 316. The N12 reference point is implemented between the AMF 314 and the AUSF 310. The N13 reference point is implemented between the UDM 312 and the AUSF 310. The N14 reference point is implemented between two AMFs. For non-roaming scenarios, the N15 reference point is implemented between the PCF 318 and the AMF 314. The N22 reference point is implemented between the NSSF 313 and the AMF 314.

[0040] Figure 4 illustrates a next-generation network roaming architecture 400. The architecture in Figure 4 is a local breakout scenario in a reference point representation, as further described in 3GPP TS 23.501 (v15.3.0). In the roaming scenario, a Visited Public Land Mobile Network (VPLMN) 402 and a Home PLMN (HPLMN) 404 are shown. The HPLMN 404 identifies the PLMN where the mobile subscriber's profile is maintained. The VPLMN is the PLMN to which the mobile subscriber roams when leaving their HPLMN. Users roaming to other networks receive subscription information from the HPLMN 404. In the local breakout scenario, the PCF 318 (hPCF), UDM 312, and AUSF 310 reside in the HPLMN 404 of the UE 110. Other network functions, including the Visited PCF (vPCF) 418, reside in the VPLMN 402.

[0041] 5 illustrates a radio protocol stack 500, such as the radio interface 122. As described herein, the user plane 512 includes a set of protocols used to transfer actual user data over the network, and the control plane 514 includes protocols used to control and establish user connections and bearers within the network. In the user plane 512 and control plane 514, the radio protocol stack 500 includes a physical (PHY) layer 501, a medium access control (MAC) layer 502, a radio link control (RLC) layer 503, and a packet data convergence protocol (PDCP) layer 504. The control plane 514 further includes a radio resource control (RRC) layer 505 and a non-access (NAS) layer 506.

[0042] The physical layer 501 transmits all information from the MAC transport channels over the air interface. Data and signaling messages are transmitted on physical channels between different levels of the physical layer 501. The physical channels are divided into physical data channels and physical control channels. The physical data channels may include the physical downlink shared channel (PDSCH), physical broadcast channel (PBCH), physical multicast channel (PMCH), physical uplink shared channel (PUSCH), and physical random access channel (PRACH). The physical control channels may include the physical control format indicator channel (PCFICH), physical hybrid ARQ indicator channel (PHICH), physical downlink control channel (PDCCH), and physical uplink control channel (PUCCH).

[0043] The MAC layer 502 is responsible for mapping between logical channels and transport channels, multiplexing MAC service data units (SDUs) from one or different logical channels into transport blocks (TBs) delivered to the physical layer on the transport channels, demultiplexing MAC SDUs from one or different logical channels from transport blocks delivered from the physical layer on the transport channels, scheduling information reports, error correction via Hybrid Automatic Repeat Request (HARQ), prioritizing between UEs via dynamic scheduling, prioritizing between logical channels of a UE, and prioritizing logical channels. The RLC layer 503 is responsible for forwarding upper layer protocol data units (PDUs), error correction via ARQ, and concatenation, segmentation, and reassembly of RLC SDUs. The RLC layer 503 is also responsible for resegmenting RLC data PDUs, reordering RLC data PDUs, duplicate detection, RLC SDU discarding, RLC re-establishment, and protocol error detection. The PDCP layer 504 is responsible for IP data header compression and decompression, data forwarding (user plane or control plane), PDCP sequence number (SN) maintenance, in-order delivery of upper layer PDUs during lower layer re-establishment, deduplication of lower layer SDUs during lower layer re-establishment of radio bearers mapped to RLC Acknowledged Mode (AM), encryption and decryption of user plane and control plane data, integrity protection and integrity verification of control plane data, timer-based discarding, and duplicate discarding. The RRC layer 505 is responsible for broadcasting NAS-related system information, broadcasting access stratum (AS)-related system information, paging, establishment, maintenance, and release of RRC connections between the UE and the RAN, security functions including key management, and establishment, configuration, maintenance, and release of point-to-point radio bearers (RBs). The NAS layer 506 represents the highest layer of the control plane 514 between the UE and the core network (e.g., MME / AMF) and supports UE mobility and session management procedures for establishing and maintaining IP connectivity between the UE and the core network.

[0044] One of the goals of a network is to improve the security of the overall system. One area of ​​particular concern is securing NAS messages. In the embodiments described herein, the UE 110 and network elements 132 are enhanced to provide additional security protection for NAS messages.

[0045] 6 is a block diagram of a UE 110 in an exemplary embodiment. The UE 110 includes a radio interface component 602, one or more processors 604, a memory 606, a user interface component 608, and a battery 610. The radio interface component 602 is a hardware component representing local radio resources of the UE 110, such as an RF unit 620 (e.g., a transceiver) and one or more antennas 622, used for wireless communication with a base station (e.g., base station 124) over the air or via "over-the-air" (OTA) signals. The processor 604 represents internal circuitry, logic, hardware, software, etc., that provides functionality for the UE 110. The processor 604 may be configured to execute instructions 640 of software loaded into the memory 606. The processor 604 may include a set of one or more processors or may include multiple processor cores, depending on the particular implementation. The memory 606 is a computer-readable storage medium for data, instructions 640, applications, etc., accessible by the processor 604. The memory 606 is a hardware storage device capable of temporarily and / or persistently storing information. The memory 606 may include random access memory or any other volatile or non-volatile storage device. The user interface component 608 is a hardware component for interacting with an end user. For example, the user interface component 608 may include a display 650, a screen, a touchscreen, etc. (e.g., a liquid crystal display (LCD), a light-emitting diode (LED) display, etc.). The user interface component 608 may include a keyboard or keypad 652, a tracking device (e.g., a trackball or trackpad), a speaker, a microphone, etc. The UE 110 also includes a universal integrated circuit card (UICC) 660, which is a hardware device that provides security and integrity functions for the UE 110. The UICC 660 may host a universal subscriber identity module (USIM) 662 that stores or represents one or more public keys of the HPLMN of the UE 110 along with other authentication information.UE 110 may include various other components not specifically shown in FIG.

[0046] The processor 604 may implement one or more applications 630. These applications 630 may access downlink (DL) data via the RAN 120 and the core network 130 and may generate uplink (UL) data for forwarding to a destination via the RAN 120 and the core network 130. The processor 604 also implements a NAS controller 634 configured to control NAS procedures, as described in more detail below.

[0047] 7 is a block diagram of a network element 132 in an exemplary embodiment. The network element 132 may be a server, device, apparatus, equipment (including hardware), system, means, etc. that handles security and registration for UEs. For example, the network element 132 may include the MME 214 in an LTE network, the AMF element 314 in an next-generation network, etc. In this embodiment, the network element 132 includes subsystems operating on one or more platforms: a network interface component 702, a security manager 704, and a registration manager 706. The network interface component 702 may include circuitry, logic, hardware, means, etc. configured to exchange control plane messages or signaling with other network elements and / or UEs (e.g., via the RAN 120). The network interface component 702 may operate using various protocols (including NAS protocols) or reference points. The security manager 704 may include circuitry, logic, hardware, means, etc. configured to handle authentication and / or security procedures for UEs, such as creating a NAS security context and selecting NAS security algorithm(s) for the NAS security context. The registration manager 706 may comprise circuitry, logic, hardware, means, etc. configured to handle registration of UEs.

[0048] One or more of the subsystems of network element 132 may be implemented on a hardware platform comprised of analog and / or digital circuits. One or more of the subsystems of network element 132 may be implemented on a processor 730 that executes instructions stored in memory 732. Processor 730 comprises integrated hardware circuitry configured to execute instructions, and memory 732 may be a non-transitory computer-readable storage medium or the like for data, instructions, applications, etc., accessible by processor 730.

[0049] Network element 132 may include various other components not specifically shown in FIG.

[0050] NAS procedures may be performed or invoked when a NAS security context already exists between the UE and an access security management entity (e.g., AMF, MME, etc.). The purpose of NAS security is to securely deliver NAS messages between the UE and the access security management entity in the control plane using NAS security keys. NAS security keys are generated each time authentication is performed for the UE. Once NAS security is configured, the UE and the access security management entity can share NAS encryption and NAS integrity keys, which are used to encrypt and integrity protect NAS messages, respectively, before transmission. NAS procedures may also be performed or invoked when no NAS security context exists. This scenario is described first.

[0051] Example 1: No security context 8 is a flowchart illustrating a method 800 of performing a NAS procedure at a UE 110 in an exemplary embodiment. The steps of method 800 are described with reference to the UE 110 of FIG. 6, but one skilled in the art will understand that method 800 may be performed in other networks or architectures. Also, the steps of the flowcharts described herein are not all-inclusive and may include other steps not shown, and the steps may be performed in a different order.

[0052] In this embodiment, it may be assumed that there is no NAS communication session between UE 110 and network element 132. Furthermore, it may be assumed that UE 110 is in a non-connected mode (e.g., idle mode) and is transitioning to a connected mode. NAS controller 634 of UE 110 initiates a NAS procedure to establish a NAS communication session between UE 110 and network element 132 (step 802). For example, the NAS procedure may comprise a registration procedure. Each NAS procedure includes a set of mandatory NAS protocol IEs and may also include a set of optional NAS protocol IEs for transmitting information. Thus, NAS controller 634 may identify the NAS protocol IEs (mandatory and optional) for the NAS procedure.

[0053] In this embodiment, the NAS procedure is performed in multiple phases 831-832. In a first phase 831 of the NAS procedure, the NAS controller 634 identifies a subset of NAS protocol IEs designated for security-related actions (step 804). The subset of NAS protocol IEs designated for security-related actions refers to IEs used to create or establish a NAS security context for the UE. In the first phase 831, providing minimal information may be desirable, and therefore the subset of NAS protocol IEs may include a minimum number of IEs for the NAS procedures used to establish a NAS security context. For a registration procedure, in one example, the subset of NAS protocol IEs may consist of the UE's mobile identity (e.g., 5G-GUTI or SUCI (Subscription Concealed Identifier)), UE security capabilities indicating one or more security algorithms supported by the UE, a registration type (e.g., initial, mobility, regular, emergency, etc.), and a security keyset identifier (e.g., ngKSI, eKSI, etc.) for the UE's NAS security context.

[0054] The NAS controller 634 may format or generate an initial NAS message for a NAS procedure, such as a registration request of type “initial.” The initial NAS message refers to the first NAS message sent after the UE transitions from a non-connected mode (e.g., idle mode) to a connected mode. The NAS controller 634 includes or inserts a subset of NAS protocol IEs into the initial NAS message (step 806). In a first phase 831, the initial NAS message is populated with the subset of NAS protocol IEs, and the IEs populated in the initial NAS message are limited to (i.e., consist of) the subset of NAS protocol IEs selected for security-related handling. Because the initial NAS message does not include all of the NAS protocol IEs required for the NAS procedure, the initial NAS message is considered a “partial” message in the first phase 831. Other required NAS protocol IEs excluded from the subset are included in another NAS message (as part of a second phase 832). Next, the NAS controller 634 sends an initial NAS message to the network element 132 (step 810).

[0055] Before sending the initial NAS message, the NAS controller 634 may optionally encrypt a subset of the NAS protocol IEs of the initial NAS message using the public key of the HPLMN of the UE 110 (optional step 808). Each HPLMN may assign a public key according to an Elliptic Curve Integrated Encryption Scheme (ECIES). Depending on the protection scheme, there may be multiple public keys. The public key of the HPLMN is typically provisioned in the USIM 662 of the UE 110. Thus, the NAS controller 634 may encrypt the subset of NAS protocol IEs identified for the first phase 831 of the initial NAS message. The decision of whether to encrypt the subset of NAS protocol IEs using the public key may be based on policy or criteria. For example, the NAS controller 634 may encrypt the subset of NAS protocol IEs when the registration type does not indicate an emergency (e.g., registration type = initial) and may send the initial NAS message without encryption when the registration type indicates an emergency. In another example, the NAS controller 634 may encrypt a subset of the NAS protocol IEs when the UE 110 has a public key programmed in its USIM 662, and may send the initial NAS message without encryption when the UE 110 does not have a public key programmed in the USIM 662.

[0056] 9 is a flow chart illustrating a method 900 for performing a NAS procedure at a network element 132 in an exemplary embodiment. The steps of method 900 are described with reference to network element 132 of FIG. 7, but one skilled in the art will understand that method 900 may be performed in other networks or architectures.

[0057] In a first phase 831, the network interface component 702 of the network element 132 receives an initial NAS message from the UE 110 (step 902). After receiving the initial NAS message, the security manager 704 may optionally process the initial NAS message to determine whether the information is encrypted using the HPLMN's public key. When the initial NAS message is encrypted, the security manager 704 may begin decrypting a subset of the NAS protocol IEs of the initial NAS message (optional step 904). In one example, the security manager 704 may be configured to internally decrypt the subset of the NAS protocol IEs. In another example, the security manager 704 may send the subset of the NAS protocol IEs to another network element (e.g., the UDM element 312) to decrypt the subset of the NAS protocol IEs.

[0058] The security manager 704 processes a subset of the NAS protocol IEs and determines that a NAS security context for the UE 110 does not exist (step 906). Because a NAS security context does not exist, the security manager 704 may initiate an authentication procedure to authenticate the UE 110 (step 908). The authentication procedure (e.g., Authentication and Key Agreement (AKA)) may be used to perform mutual authentication between the UE 110 and the mobile network 100. While the authentication procedure may vary, in general, the security manager 704 may send an authentication request to the UE 110 via the network interface component 702 along with an authentication token (optional step 910). In response to the authentication request, the UE 110 processes the authentication steps on its side and attempts to verify the authentication token (see step 812 of FIG. 8). If successful, the UE 110 considers the mobile network 100 authenticated. UE 110 calculates a response token and sends an authentication response along with the response token, which is received by security manager 704 via network interface component 702 (optional step 912). Security manager 704 (or another network element) may then determine whether the response token is valid (e.g., compare the response token to an expected response token). If the response token is valid, security manager 704 considers UE 110 to be authenticated.

[0059] Once the UE 110 is verified, the security manager 704 initiates a NAS security procedure to establish a NAS security context (step 914). In the NAS security procedure, the security manager 704 selects one or more NAS security algorithms for the NAS security context (step 916) and selects one or more NAS security keys (e.g., K AMF , K. ASMEThe NAS security algorithms may include a NAS encryption algorithm and an integrity protection algorithm. The security manager 704 then sends a response to the UE via the network interface component 702 indicating or including the NAS security algorithm(s) and security keyset identifier(s) selected for the NAS security context (step 918). The response may include a security mode command including the NAS security algorithm(s), the security keyset identifier (e.g., ngKSI, eKSI, etc.), and other information.

[0060] 8, NAS controller 634 of UE 110 receives a response from network element 132 indicating the NAS security algorithm(s) and security keyset identifier (step 814). Using the information provided in the response from network element 132, a NAS security context is established between UE 110 and network element 132. Thus, subsequent NAS messages between UE 110 and network element 132 may be protected using the NAS security context.

[0061] In a second phase 832 of the NAS procedure, the NAS controller 634 includes or inserts the NAS protocol IEs for the NAS procedure into an initial NAS message (step 816). The initial NAS message is a copy, duplicate, or the same type of initial NAS message previously sent to the network element 132 in the first phase 831. In this step, the initial NAS message includes the entire set of NAS protocol IEs for the NAS procedure (mandatory and optional, if needed). Because the initial NAS message includes each NAS protocol IE required for the NAS procedure, the initial NAS message is considered a "complete" NAS message in the second phase 832.

[0062] The NAS controller 634 of the UE 110 may format or generate a subsequent NAS message for the NAS procedure. For example, the subsequent NAS message may comprise a security mode complete message. The NAS controller 634 includes or inserts the initial NAS message into a NAS message container of the subsequent NAS message (step 818). The NAS message container is a type of IE used to encapsulate a plain NAS message. The NAS controller 634 encrypts the NAS message container of the subsequent NAS message using NAS security algorithm(s) (step 820). Thus, the complete initial NAS message is encrypted in the NAS message container of the subsequent NAS message. The NAS controller 634 then transmits the subsequent NAS message to the network element 132 (step 822).

[0063] 9 , in a second phase 832, the network interface component 702 receives a subsequent NAS message from the UE 110 (step 920). The security manager 704 decrypts the NAS message container of the subsequent NAS message using the NAS security algorithm(s) to access the complete initial NAS message (step 922). The security manager 704 or another subsystem of the network element 132 may then process the NAS protocol IEs from the complete initial NAS message to perform further NAS procedures. For example, the registration manager 706 may send a registration accept message to the UE 110 and may receive a registration complete message from the UE 110 (optional step 924). One technical advantage of this process is that only the NAS protocol IEs necessary to establish a NAS security context are sent unencrypted or encrypted according to the HPLMN public key in the partial initial NAS message, and the complete initial NAS message is encrypted in the subsequent NAS message, thereby providing additional security protection.

[0064] 10 is a message diagram illustrating a NAS procedure when a UE does not have a security context in an exemplary embodiment. The NAS procedure shown in FIG. 10 is a registration procedure, but similar concepts may be applied to other NAS procedures. This example is shown in a 5G network, where network element 132 includes AMF element 314.

[0065] This NAS procedure is also performed in multiple phases. In the first phase, the UE 110 generates or formats an initial registration request for the NAS registration procedure. The NAS registration procedure includes a set of NAS protocol IEs (mandatory and optional) used for transferring information. In this embodiment, the UE 110 does not include the complete set of NAS protocol IEs in the initial registration request in the first phase. Instead, the UE 110 identifies the NAS protocol IEs that are essential for establishing a NAS security context. Thus, the UE 110 identifies a subset of NAS protocol IEs designated for security-related handling. In this example, the subset of NAS protocol IEs may consist of a 5G Globally Unique Temporary Identity (5G-GUTI), UE security capabilities, registration type, and ngKSI. The UE 110 inserts the subset of NAS protocol IEs into the initial registration request. Because the initial registration request does not include all of the mandatory NAS protocol IEs for the NAS registration procedure, the initial registration request is a "partial" request in the first phase. The UE 110 may also insert other information, such as the SUCI generated by the UE 110, into the initial registration request. In this example, the UE 110 encrypts a subset of the NAS protocol IEs using the HPLMN public key and sends the initial registration request to the AMF element 314 (S1). The protection scheme and public key identifier used for encryption are the same as those indicated in the SUCI. However, as mentioned above, encryption of the subset of the NAS protocol IEs using the HPLMN public key is optional. If the protection scheme in the SUCI is NULL, the subset of the NAS protocol IEs is not encrypted.

[0066] In response to receiving the initial registration request, the AMF element 314 routes the information to the UE's home UDM for decryption based on the UE's PLMN ID and routing ID. Accordingly, the AMF element 314 formats or generates an authentication request (i.e., a Nausf_UEAuthentication_Authenticate request) and inserts an encrypted subset of the NAS protocol IEs into the authentication request along with other information (e.g., the SUCI and serving network name). The AMF element 314 then sends the authentication request to the AUSF element 310 (S2). In response to receiving the authentication request, the AUSF element 310 formats or generates an authentication request (i.e., a Nudm_UEAuthentication_Get request) and inserts an encrypted subset of the NAS protocol IEs into the authentication request along with other information. The AUSF element 310 then sends the authentication request to the UDM element 312 (S3).

[0067] In response to the authentication request, the UDM element 312 decrypts the subset of NAS protocol IEs using the HPLMN private key (i.e., using information in accordance with the protection scheme selected for the SUCI) so that the subset of NAS protocol IEs is readable. The UDM element 312 also hosts functionality related to the Authentication Credentials Repository and Processing Function (ARPF), which selects an authentication method and calculates authentication data and key information (e.g., tokens) for the AUSF element 310 (if necessary). The UDM element 312 formats or generates an authentication response (i.e., Nudm_UEAuthentication_Get response) for the AUSF element 310 and inserts the decrypted subset of NAS protocol IEs, an authentication vector (AV), and other information into the authentication response. The UDM element 312 then sends the authentication response to the AUSF element 310 (S4). In response to receiving the authentication response, the AUSF element 310 formats or generates an authentication response (i.e., Nuasf_UEAuthentication_Authenticate response) for the AMF element 314 and inserts the decoded subset of the NAS protocol IEs, AVs, and other information into the authentication response. The AUSF element 310 then sends the authentication response to the AMF element 314 (S5).

[0068] The AMF element 314 is configured to perform an authentication procedure with the UE 110 using information provided by the UDM / AUSF. For example, the AMF element 314 sends an authentication request to the UE 110 along with an authentication token from the AV (S6), and the UE 110 attempts to verify the authentication token. If successful, the UE 110 calculates a response token and sends an authentication response along with the response token, which are received by the AMF element 314 (S7). The AMF element 314 formats or generates another authentication request (i.e., a Nausf_UEAuthentication_Authenticate request) and inserts the response token from the UE 110 into the authentication request along with other information. The AMF element 314 then sends the authentication request to the AUSF element 310 (S8). The AUSF element 310 verifies whether the response token from the UE 110 matches the expected response token and sends an authentication response (i.e., Nausf_UEAuthentication_Authenticate response) to the AMF element 314 indicating the success / failure of the authentication.

[0069] Once UE 110 is authenticated to the network, AMF element 314 initiates NAS security procedures to establish a NAS security context. The AMF element 314 selects a NAS security algorithm (or algorithms) for encryption and integrity protection. The AMF element 314 formats or generates a security mode command message and inserts indicators of the NAS security algorithm(s), the ngKSI, and other information into the security mode command message. The AMF element 314 then transmits the security mode command message to UE 110 (S10).

[0070] In the second phase of the NAS procedure, the UE 110 uses the ngKSI and the NAS security algorithm to derive corresponding keys for protecting subsequent NAS messages. A NAS security context is thus established between the UE 110 and the AMF element 314. The UE 110 includes or inserts the NAS protocol IEs of the NAS registration procedure in an initial registration request, which is a copy, duplicate, or message of the same type as the initial registration request previously sent in the first phase. The initial registration request includes all mandatory NAS protocol IEs and any optional NAS protocol IEs used for transporting information. The additional NAS protocol IEs may include a non-current native NAS keyset identifier, 5G mobility management (MM) capabilities, a requested network slice selection assistance information (NSSAI), a last visited registered tracking area identifier (TAI), S1 UE network capabilities, an uplink data status, a PDU session status, a mobile initiated connection only (MICO) indication, a UE status, an additional GUTI, an allowed PDU session status, a UE usage configuration, a requested discontinuous reception (DRX) parameter, an EPS NAS message container, and a payload container. Thus, the initial registration request is a "complete" request of the second phase because it includes all of the required NAS protocol IEs. The UE 110 formats or generates a security mode complete message and inserts the complete initial registration request into the NAS message container of the security mode complete message. The UE 110 encrypts the NAS message container of the security mode complete message using the NAS security algorithm of the NAS security context. Thus, the complete initial registration request is encrypted in the NAS message container of the security mode complete message. Next, the UE 110 sends a security mode complete message to the AMF element 314 (S11).

[0071] The AMF element 314 receives the security mode complete message from the UE 110 and decodes the NAS message container in the security mode complete message to access the NAS protocol IEs from the complete initial registration request. The AMF element 314 then continues the registration procedure (S12), such as by sending a registration accept message to the UE 110. The UE 110 responds with a registration complete message to the AMF element 314 (S13), at which point the UE 110 is registered with the network for accessing services.

[0072] Example 2: No security context In another example of a NAS procedure when no security context exists, FIG. 11 is a flowchart illustrating a method 1100 of performing a NAS procedure at a UE 110 in an exemplary embodiment. The NAS controller 634 of the UE 110 initiates a NAS procedure to establish a NAS communication session between the UE 110 and a network element 132 (step 1102). The NAS controller 634 identifies NAS protocol IEs (mandatory and optional) for the NAS procedure (step 1104). The NAS controller 634 may format or generate a first initial NAS message for the NAS procedure and includes or inserts the NAS protocol IEs in the first initial NAS message (step 1106). In this step, the first initial NAS message includes the entire set of NAS protocol IEs for the NAS procedure (mandatory and optional, if needed). Because the first initial NAS message includes each of the NAS protocol IEs required for the NAS procedure, the first initial NAS message is considered a “complete” NAS message.

[0073] The NAS controller 634 also formats or generates a second initial NAS message that is a duplicate of the first initial NAS message (step 1108). A duplicate message refers to a message of the same type in the NAS procedure. For example, if the first initial NAS message is a registration request, the second initial NAS message is also a registration request. However, the IEs populated in the duplicate message may be different from those in the original message. The NAS controller 634 includes or inserts the first initial NAS message into a NAS message container of the second initial NAS message (step 1110). The NAS controller 634 encrypts the NAS message container of the second initial NAS message using the public key of the HPLMN of the UE 110 (step 1112). Thus, the complete initial NAS message is encrypted in the NAS message container of the second initial NAS message. The NAS controller 634 then transmits the second initial NAS message to the network element 132 (step 1114).

[0074] 12 is a flowchart illustrating a method 1200 of performing a NAS procedure at network element 132 in an exemplary embodiment. Network interface component 702 of network element 132 receives a second initial NAS message from UE 110 (step 1202). When the NAS message container is encrypted, as in this example, security manager 704 begins decrypting the NAS message container to access the first initial NAS message (step 1204). In one example, security manager 704 may be configured to decrypt the NAS message container. In another example, security manager 704 may send the NAS message container to another network element (e.g., UDM element 312) for decryption of the NAS message container.

[0075] Once the NAS message container is decrypted, the security manager 704 can access the first initial NAS message. The first initial NAS message is populated with a NAS protocol IE for the NAS procedure. The security manager 704 may process the NAS protocol IE and determine that a NAS security context for the UE 110 does not exist (step 1206). Because a NAS security context does not exist, the security manager 704 may initiate an authentication procedure to authenticate the UE 110 (step 1208). In the authentication procedure, the security manager 704 may send an authentication request to the UE 110 via the network interface component 702 along with an authentication token (optional step 1210). In response to the authentication request, the UE 110 processes the authentication step on its side and attempts to verify the authentication token (see step 1116 of FIG. 11 ). If successful, the UE 110 considers the mobile network 100 authenticated. UE 110 calculates a response token and sends an authentication response with the response token, which is received by security manager 704 via network interface component 702 (optional step 1212). Security manager 704 (or another network element) may then determine whether the response token is valid (e.g., compare the response token to an expected response token). If the response token is valid, security manager 704 considers UE 110 to be authenticated.

[0076] Once the UE 110 is verified, the security manager 704 initiates a NAS security procedure to establish a NAS security context (step 1214). In the NAS security procedure, the security manager 704 selects one or more NAS security algorithms for the NAS security context (step 1216) and selects one or more NAS security keys (e.g., K AMF , K. ASMESecurity manager 704 then formats or generates a security mode command and sends the security mode command to UE 110 via network interface component 702 indicating or including the selected NAS security algorithm(s) and security keyset identifier for the NAS security challenge (step 1218).

[0077] In FIG. 11 , the NAS controller 634 of the UE 110 receives a security mode command from the network element 132 indicating the NAS security algorithm(s) (step 1118). Using the information provided in the security mode command, a NAS security context is established between the UE 110 and the network element 132. Thus, subsequent NAS messages between the UE 110 and the network element 132 may be protected using the NAS security context. The NAS controller 634 of the UE 110 may then format or generate a security mode complete message and send the security mode complete message to the network element 132 (step 1120). In FIG. 12 , the network interface component 702 receives the security mode complete from the UE 110 (step 1220). The security manager 704 may decrypt any subsequent NAS messages using the NAS security algorithm(s). One technical advantage of this process is that only the NAS protocol IEs required to establish the NAS security context are inserted unencrypted into the partial Initial NAS message, and the complete Initial NAS message is encrypted with the partial NAS message, thereby providing additional security protection.

[0078] 13 is a message diagram illustrating a NAS procedure when the UE does not have a security context in an exemplary embodiment. The NAS procedure illustrated in FIG. 13 is a registration procedure, but similar concepts may be applied to other NAS procedures. UE 110 generates or formats a registration request for the NAS registration procedure. In this embodiment, UE 110 populates the registration request with a complete set of NAS protocol IEs. Thus, the registration request is a complete registration request.

[0079] UE 110 also generates or formats another registration request that is a duplicate of the full registration request. The other registration request is of type "initial," and is therefore an initial registration request. Instead of populating each of the NAS protocol IEs required in the full registration request, UE 110 inserts the full registration request into a NAS message container of the initial registration request. UE 110 may also insert other information, such as a SUCI generated by UE 110, into the initial registration request. In this example, UE 110 encrypts the NAS message container of the initial registration request using the HPLMN public key and sends the initial registration request to AMF element 314 (S1).

[0080] In response to receiving the initial registration request, the AMF element 314 routes information to the UE's home UDM for decryption based on the UE's PLMN ID and routing ID. Accordingly, the AMF element 314 formats or generates an authentication request (i.e., a Nausf_UEAuthentication_Authenticate request) and inserts the encrypted NAS message container of the initial registration request, along with other information, into the authentication request. The AMF element 314 then sends the authentication request to the AUSF element 310 (S2). In response to receiving the authentication request, the AUSF element 310 formats or generates an authentication request (i.e., a Nudm_UEAuthentication_Get request) and inserts the encrypted NAS message container, along with other information, into the authentication request. The AUSF element 310 then sends the authentication request to the UDM element 312 (S3).

[0081] In response to the authentication request, the UDM element 312 decrypts the encrypted NAS message container using the HPLMN private key so that the complete registration request is readable. The UDM element 312 also selects an authentication method and calculates authentication data and key information (e.g., a token) for the AUSF element 310 (if necessary). The UDM element 312 formats or generates an authentication response (i.e., Nuasf_UEAuthentication_Get response) for the AUSF element 310 and inserts the decrypted NAS message container, authentication vector (AV), and other information into the authentication response. The UDM element 312 then sends the authentication response to the AUSF element 310 (S4). In response to receiving the authentication response, the AUSF element 310 formats or generates an authentication response (i.e., Nuasf_UEAuthentication_Authenticate response) for the AMF element 314 and inserts the decrypted NAS message container, AV, and other information into the authentication response. Next, the AUSF element 310 sends an authentication response to the AMF element 314 (S5).

[0082] The AMF element 314 is configured to perform an authentication procedure with the UE 110 using the information provided by the UDM / AUSF. For example, the AMF element 314 sends an authentication request to the UE 110 along with the authentication token from the AV (S6), and the UE 110 attempts to verify the authentication token. If successful, the UE 110 calculates a response token and sends an authentication response along with the response token, which are received by the AMF element 314 (S7). The AMF element 314 formats or generates another authentication request (i.e., a Nausf_UEAuthentication_Authenticate request) and inserts the response token from the UE 110 into the authentication request along with other information. The AMF element 314 then sends the authentication request to the AUSF element 310 (S8). The AUSF element 310 verifies whether the response token from the UE 110 matches the expected response token and sends an authentication response (i.e., Nausf_UEAuthentication_Authenticate response) to the AMF element 314 indicating the success / failure of the authentication.

[0083] Once UE 110 is authenticated to the network, AMF element 314 initiates NAS security procedures to establish a NAS security context. The AMF element 314 selects a NAS security algorithm (or algorithms) for encryption and integrity protection. The AMF element 314 formats or generates a security mode command message and inserts indicators of the NAS security algorithm(s), the ngKSI, and other information into the security mode command message. The AMF element 314 then sends the security mode command message to UE 110 (S10). The UE 110 uses the ngKSI and the NAS security algorithms to derive corresponding keys for protecting subsequent NAS messages. Thus, a security context is established between UE 110 and AMF element 314. The UE 110 formats or generates a security mode complete message and sends the security mode complete message to the AMF element 314 (S11).

[0084] The AMF element 314 then continues the registration procedure (S12), such as by sending a registration accept message to the UE 110. The UE 110 responds to the AMF element 314 with a registration complete message (S13), at which point the UE 110 is registered with the network for accessing services.

[0085] Example 3: Security context exists - security context is valid In a further example, the NAS procedure may be performed or invoked when a NAS security context already exists between the UE and an access security management entity (e.g., AMF, MME, etc.). Below are examples of NAS procedures when a NAS security context exists:

[0086] 14 is a flowchart illustrating a method 1400 of performing a NAS procedure at a UE 110 in an exemplary embodiment. The NAS controller 634 of the UE 110 initiates a NAS procedure to establish (or re-establish) a NAS communication session between the UE 110 and a network element 132 (step 1402). The NAS controller 634 identifies a subset of NAS protocol IEs designated for security-related handling (step 1404). The NAS controller 634 formats or generates a first NAS message for the NAS procedure, such as a registration request of type "mobility," "periodic," etc. The NAS controller 634 includes or inserts the subset of NAS protocol IEs into the first NAS message (step 1406).

[0087] The NAS controller 634 also formats or generates a second NAS message that is a duplicate of the first NAS message. The NAS controller 634 includes or inserts the NAS protocol IEs for the NAS procedure into the second NAS message (step 1408). In this step, the second NAS message includes the entire set of NAS protocol IEs for the NAS procedure (mandatory and optional, if needed). Because the second NAS message includes each of the NAS protocol IEs required for the NAS procedure, the second NAS message is considered a "complete" NAS message.

[0088] The NAS controller 634 includes or inserts the second NAS message into the NAS message container of the first NAS message (step 1410). The NAS controller 634 encrypts the NAS message container of the first NAS message using the NAS security algorithm of the NAS security context (step 1412). Thus, the complete second NAS message is encrypted with the NAS message container of the first NAS message. The NAS controller 634 then transmits the first NAS message to the network element 132 (step 1414).

[0089] FIG. 15 is a flowchart illustrating a method 1500 of performing a NAS procedure at a network element 132 in an exemplary embodiment. The network interface component 702 of the network element 132 receives a first NAS message from the UE 110 (step 1502). The security manager 704 processes a subset of the NAS protocol IEs of the first NAS message to identify the NAS security context of the UE 110 (step 1504). The security manager 704 then decrypts the NAS message container of the first NAS message using the NAS security context to access the second NAS message contained in the NAS message container (step 1506). Using the decrypted NAS message container of the first NAS message, the security manager 704 can access the decrypted second NAS message, which is populated with the NAS protocol IEs of the NAS procedure. Accordingly, the security manager 704 may process the NAS protocol IEs of the second NAS message to continue further processing of the NAS procedure (step 1508). One technical advantage of this process is that only the NAS protocol IEs required to identify the NAS security context are sent unencrypted in the initial NAS message, while the complete second NAS message is encrypted in the initial NAS message, thereby providing additional security protection.

[0090] FIG. 16 is a message diagram illustrating a NAS registration procedure when the UE has a valid security context in an exemplary embodiment. The UE 110 generates or formats a first registration request for the NAS registration procedure. In this embodiment, the UE 110 populates the first registration request with a subset of NAS protocol IEs designated for security-related handling. This information is used to indicate the NAS security context to the AMF element 314. For example, the subset of NAS protocol IEs may include a 5G-GUTI, a registration type, and an ngKSI. The UE 110 also formats or generates a second registration request that is a duplicate of the first registration request. The UE 110 includes or inserts the NAS protocol IEs for the NAS registration procedure in the second registration request. In this step, the second registration request includes the entire set of NAS protocol IEs for the NAS registration procedure (mandatory and optional, if needed). Because the second registration request includes each of the NAS protocol IEs required for the NAS registration procedure, the second registration request is considered a “complete” registration request.

[0091] The UE 110 includes or inserts the second registration request into the NAS message container of the first registration request and encrypts the NAS message container of the first registration request using the NAS security algorithm of the NAS security context. Thus, the complete second registration request is encrypted with the NAS message container of the first registration request. The UE 110 then sends the first registration request to the AMF element 314 (S1).

[0092] In response to receiving the first registration request, the AMF element 314 identifies or retrieves a NAS security context based on the subset of NAS protocol IEs included in the first registration request. The AMF element 314 then decrypts the encrypted NAS message container of the first registration request using the NAS security context so that the second registration request becomes readable. Thus, the AMF element 314 processes the entire set of NAS protocol IEs for the NAS registration procedure and can continue processing the NAS registration procedure. For example, the AMF element 314 sends a registration accept message to the UE 110 (S2). The UE 110 responds to the AMF element 314 with a registration complete message (S3), at which point the UE 110 is registered with the network to access services.

[0093] FIG. 17 is a message diagram illustrating a NAS service request procedure when the UE has a valid security context in an exemplary embodiment. UE 110 generates or formats a first service request for the NAS service request procedure. In this embodiment, UE 110 populates the first service request with a subset of NAS protocol IEs designated for security-related handling, which is used to indicate the NAS security context to AMF element 314. In this example, the subset of NAS protocol IEs may include 5G-S-TMSI and ngKSI. UE 110 also formats or generates a second service request that is a duplicate of the first service request. UE 110 includes or inserts the NAS protocol IEs for the NAS service request procedure into the second service request. In this step, the second service request includes the entire set of NAS protocol IEs for the NAS service request procedure (mandatory and optional, if necessary). Because the second service request includes each of the NAS protocol IEs required for the NAS service request procedure, the second service request is considered a "complete" service request.

[0094] The UE 110 includes or inserts the second service request into the NAS message container of the first service request and encrypts the NAS message container of the first service request using the NAS security algorithm of the NAS security context. Thus, the complete second service request is encrypted in the NAS message container of the first service request. The UE 110 then sends the first service request to the AMF element 314 (S1).

[0095] In response to receiving the first service request, the AMF element 314 identifies or retrieves a NAS security context based on the subset of NAS protocol IEs included in the first service request. The AMF element 314 then decrypts the encrypted NAS message container of the first service request using the NAS security context so that the second service request can be read. Thus, the AMF element 314 processes the entire set of NAS protocol IEs for the NAS service request procedure and can continue processing for the NAS service request procedure. For example, the AMF element 314 sends a service accept message to the UE 110 (S2).

[0096] FIG. 18 is a message diagram illustrating a NAS deregistration procedure when the UE has a valid security context in an exemplary embodiment. UE 110 generates or formats a first deregistration request for the NAS deregistration procedure. In this embodiment, UE 110 populates the first deregistration request with a subset of NAS protocol IEs designated for security-related handling, which is used to indicate the NAS security context to AMF element 314. In this example, the subset of NAS protocol IEs may include 5G-S-TMSI and ngKSI. UE 110 also formats or generates a second deregistration request that is a duplicate of the first deregistration request. UE 110 includes or inserts the NAS protocol IEs for the NAS deregistration procedure into the second deregistration request. In this step, the second deregistration request includes the entire set of NAS protocol IEs for the NAS deregistration procedure (mandatory and optional, if necessary). Because the second deregistration request includes each of the NAS protocol IEs required for the NAS deregistration procedure, the second deregistration request is considered a "complete" deregistration request.

[0097] The UE 110 includes or inserts the second deregistration request into the NAS message container of the first deregistration request and encrypts the NAS message container of the first deregistration request using the NAS security algorithm of the NAS security context. Thus, the complete second deregistration request is encrypted in the NAS message container of the first deregistration request. The UE 110 then sends the first deregistration request to the AMF element 314 (S1).

[0098] In response to receiving the first deregistration request, the AMF element 314 identifies or retrieves a NAS security context based on the subset of NAS protocol IEs included in the first deregistration request. The AMF element 314 then decrypts the encrypted NAS message container of the first deregistration request using the NAS security context so that the second deregistration request becomes readable. Thus, the AMF element 314 processes the entire set of NAS protocol IEs for the NAS deregistration procedure and can continue processing the NAS deregistration procedure. For example, the AMF element 314 sends a deregistration accept message to the UE 110 (S2).

[0099] Example 4: Security context exists - Security context is invalid or not found 19A-19B are flowcharts illustrating a method 1900 of performing a NAS procedure at a UE 110 in an exemplary embodiment. The NAS controller 634 of the UE 110 initiates the NAS procedure to establish (or re-establish) a NAS communication session between the UE 110 and a network element 132 (step 1902). In a first phase 1931 of the NAS procedure, the NAS controller 634 identifies a subset of NAS protocol IEs designated for security-related handling (step 1904). The NAS controller 634 formats or generates a first NAS message for the NAS procedure and includes or inserts the subset of NAS protocol IEs in the first NAS message (step 1906).

[0100] The NAS controller 634 also formats or generates a second NAS message that is a duplicate of the first NAS message. The NAS controller 634 includes or inserts the NAS protocol IEs for the NAS procedure into the second NAS message (step 1908). In this step, the second NAS message includes the entire set of NAS protocol IEs for the NAS procedure (mandatory and optional, if needed). Because the second NAS message includes each of the NAS protocol IEs required for the NAS procedure, the second NAS message is considered a "complete" NAS message.

[0101] The NAS controller 634 includes or inserts the second NAS message into the NAS message container of the first NAS message (step 1910). The NAS controller 634 encrypts the NAS message container of the first NAS message using the NAS security algorithm of the NAS security context (step 1912). Thus, the complete second NAS message is encrypted with the NAS message container of the first NAS message. The NAS controller 634 then transmits the first NAS message to the network element 132 (step 1914).

[0102] FIG. 20 is a flowchart illustrating a method 2000 of performing a NAS procedure in a network element 132 in an exemplary embodiment. In a first phase 1931 of the NAS procedure, the network interface component 702 of the network element 132 receives a first NAS message from the UE 110 (step 2002). The security manager 704 processes a subset of the NAS protocol IEs in the first NAS message and fails to identify a valid NAS security context for the UE 110 (step 2004). For example, even if a NAS security context exists, the security manager 704 may not be able to identify the NAS security context based on the subset of NAS protocol IEs provided in the first NAS message, or the NAS security context identified based on the subset of NAS protocol IEs may be invalid. Because a valid NAS security context is not found, the security manager 704 initiates an authentication procedure to authenticate the UE 110 (step 2006). Even though the authentication procedure may have been performed previously, the security manager 704 performs the authentication procedure again when a valid NAS security context is not found. As part of the authentication procedure, security manager 704 may send an authentication request along with an authentication token to UE 110 via network interface component 702 (optional step 2008). In response to the authentication request, UE 110 attempts to verify the authentication token (see step 1916 of FIG. 19A). If successful, UE 110 considers mobile network 100 authenticated. UE 110 calculates a response token and sends an authentication response along with the response token, which are received by security manager 704 via network interface component 702 (optional step 2010). Security manager 704 (or another network element) may then determine whether the response token is valid (e.g., compare the response token to an expected response token). If the response token is valid, security manager 704 considers UE 110 authenticated.

[0103] Once UE 110 is verified, security manager 704 initiates a NAS security procedure that establishes a new NAS security context (step 2012). In the NAS security procedure, security manager 704 selects one or more NAS security algorithms for the new NAS security procedure (step 2014) and derives one or more NAS security keys. Security manager 704 then sends a response to UE 110 via network interface component 702 indicating or including the selected NAS security algorithm(s) and security keyset identifier for the new NAS security context (step 2016). The response may include a security mode command that includes the NAS security algorithm(s), security keyset identifier (e.g., ngKSI, eKSI, etc.), and other information.

[0104] 19A, NAS controller 634 receives a response from network element 132 indicating the NAS security algorithm(s) and security keyset identifier (step 1918). Using the information provided in the response from network element 132, a new NAS security context is established between UE 110 and network element 132. Thus, subsequent NAS messages between UE 110 and network element 132 may be protected using the new NAS security context.

[0105] In a second phase 1932 of the NAS procedure of FIG. 19B, the NAS controller 634 of the UE 110 may then format or generate a subsequent NAS message for the NAS procedure. For example, the subsequent NAS message may comprise a security mode complete message. The NAS controller 634 includes or inserts the second NAS message for the NAS procedure into a NAS message container of the subsequent NAS message (step 1920). As described above, the second NAS message includes the entire set of NAS protocol IEs for the NAS procedure (mandatory and optional, if needed) and is considered a “complete” NAS message. The NAS controller 634 encrypts the NAS message container of the subsequent NAS message using the NAS security algorithm(s) of the new NAS security context (step 1922). The NAS controller 634 then transmits the subsequent NAS message to the network element 132 (step 1924).

[0106] 20 , in a second phase 1932, the network interface component 702 receives a subsequent NAS message from the UE 110 (step 2018). The security manager 704 decrypts the NAS message container of the subsequent NAS message using the NAS security algorithm(s) of the new NAS security context to access the complete second NAS message (step 2020). The security manager 704 or another subsystem of the network element 132 may then process the NAS protocol IEs from the complete second NAS message for further processing of the NAS procedure. One technical advantage of this process is that only the NAS protocol IEs necessary to identify the NAS security context are sent unencrypted in the first NAS message. When a valid NAS security context is not found, a new NAS security context is established, and the complete NAS message is encrypted in subsequent NAS messages according to the new NAS security context, thereby providing additional security protection.

[0107] FIG. 21 is a message diagram illustrating a NAS registration procedure when the UE has a NAS security context but the NAS security context is not valid or cannot be found in an exemplary embodiment. In the first phase of the NAS procedure, the UE 110 generates or formats a first registration request for the NAS registration procedure. In this embodiment, the UE 110 populates the first registration request with a subset of NAS protocol IEs designated for security-related handling. This information is used to indicate the NAS security context to the AMF element 314. For example, the subset of NAS protocol IEs may include a 5G-GUTI, a registration type, and an ngKSI. The UE 110 also formats or generates a second registration request that is a duplicate of the first registration request. The UE 110 includes or inserts the NAS protocol IEs for the NAS registration procedure into the second registration request. In this step, the second registration request includes the entire set of NAS protocol IEs for the NAS registration procedure (both mandatory and optional, if necessary). Because the second registration request includes each of the NAS protocol IEs required for the NAS registration procedure, the second registration request is considered a "complete" registration request.

[0108] The UE 110 includes or inserts the second registration request into the NAS message container of the first registration request and encrypts the NAS message container of the first registration request using the NAS security algorithm of the NAS security context. Thus, the complete second registration request is encrypted with the NAS message container of the first registration request. The UE 110 then sends the first registration request to the AMF element 314 (S1).

[0109] In response to receiving the first registration request, the AMF element 314 attempts to identify or retrieve a NAS security context based on the subset of NAS protocol IEs included in the first registration request. In this example, the AMF element 314 cannot identify a valid NAS security context for the UE 110. Therefore, the AMF element 314 cannot decrypt the NAS message container of the first registration request. To enable secure communication, the AMF element 314 initiates a new authentication procedure to create a new NAS security context. The AMF element 314 formats or generates an authentication request (i.e., a Nausf_UEAuthentication_Authenticate request) and sends the authentication request to the AUSF element 310 (S2). In response to receiving the authentication request, the AUSF element 310 formats or generates an authentication request (i.e., a Nudm_UEAuthentication_Get request) and sends the authentication request to the UDM element 312 (S3).

[0110] In response to the authentication request, the UDM element 312 unmasks the SUCI and sends an authentication response (i.e., Nudm_UEAuthentication_Get response) to the AUSF element 310 (S4). In response to receiving the authentication response, the AUSF element 310 formats or generates an authentication response (i.e., Nuasf_UEAuthentication_Authenticate response) for the AMF element 314 and sends the authentication response to the AMF element 314 (S5).

[0111] The AMF element 314 is configured to perform an authentication procedure with the UE 110 using information provided by the UDM / AUSF. For example, the AMF element 314 sends an authentication request along with an authentication token to the UE 110 (S6), and the UE 110 attempts to verify the authentication token. If successful, the UE 110 calculates a response token and sends an authentication response along with the response token, which are received by the AMF element 314 (S7). The AMF element 314 formats or generates another authentication request (i.e., a Nausf_UEAuthentication_Authenticate request) and inserts the response token from the UE 110, along with other information, into the authentication request. The AMF element 314 then sends the authentication request to the AUSF element 310 (S8). The AUSF element 310 verifies whether the response token from the UE 110 matches the expected response token and sends an authentication response (i.e., a Nausf_UEAuthentication_Authenticate response) to the AMF element 314 indicating authentication success / failure.

[0112] Once UE 110 is authenticated to the network, AMF element 314 initiates NAS security procedures to establish a new NAS security context. The AMF element 314 selects a NAS security algorithm (or algorithms) for encryption and integrity protection. The AMF element 314 formats or generates a security mode command message and inserts indicators of the NAS security algorithm, ngKSI, and other information into the security mode command message. The AMF element 314 then transmits the security mode command message to UE 110 (S10).

[0113] In the second phase of the NAS procedure, the UE 110 uses the ngKSI and the NAS security algorithm to derive the corresponding key for protecting subsequent NAS messages. Thus, a new NAS security context is established between the UE 110 and the AMF element 314. The UE 110 formats or generates a security mode complete message and inserts a second registration request into the NAS message container of the security mode complete message. As described above, the second registration request includes the entire set of NAS protocol IEs for the NAS registration procedure (mandatory and optional, if required) and is considered a "complete" NAS message. The UE 110 encrypts the NAS message container of the security mode complete message using the NAS security algorithm of the new NAS security context. Thus, the second registration request is encrypted in the NAS message container of the security mode complete message. Next, the UE 110 sends the security mode complete message to the AMF element 314 (S11).

[0114] The AMF element 314 receives the security mode complete message from the UE 110 and decodes the NAS message container in the security mode complete message to access the NAS protocol IEs from the second registration request. The AMF element 314 then continues with the NAS registration procedure (S12), such as by sending a registration accept message to the UE 110. The UE 110 responds with a registration complete message to the AMF element 314 (S13), at which point the UE 110 is registered with the network to access services.

[0115] FIG. 22 is a message diagram illustrating a NAS service request procedure when the UE has a NAS security context but the NAS security context is not valid or cannot be found in an exemplary embodiment. In the first phase of the NAS procedure, the UE 110 generates or formats a first service request for the NAS service request procedure. In this embodiment, the UE 110 populates the first service request with a subset of NAS protocol IEs designated for security-related handling. This information is used to indicate the NAS security context to the AMF element 314. For example, the subset of NAS protocol IEs may include the 5G-S-TMSI and ngKSI. The UE 110 also formats or generates a second service request that is a duplicate of the first service request. The UE 110 includes or inserts the NAS protocol IEs for the NAS service request procedure into the second service request. In this step, the second service request includes the entire set of NAS protocol IEs for the NAS service request procedure (both mandatory and optional, if necessary). Because the second service request includes each of the NAS protocol IEs required for the NAS service request procedure, the second service request is considered a "complete" service request.

[0116] The UE 110 includes or inserts the second service request into the NAS message container of the first service request and encrypts the NAS message container of the first service request using the NAS security algorithm of the NAS security context. Thus, the complete second service request is encrypted in the NAS message container of the first service request. The UE 110 then sends the first service request to the AMF element 314 (S1).

[0117] In response to receiving the first service request, the AMF element 314 attempts to identify or retrieve a NAS security context based on the subset of NAS protocol IEs included in the first service request. In this example, the AMF element 314 cannot identify a valid NAS security context for the UE 110. Therefore, the AMF element 314 cannot decrypt the NAS message container of the first service request. To enable secure communication, the AMF element 314 initiates a new authentication procedure that creates a new NAS security context. The AMF element 314 formats or generates an authentication request (i.e., a Nausf_UEAuthentication_Authenticate request) and sends the authentication request to the AUSF element 310 (S2). In response to receiving the authentication request, the AUSF element 310 formats or generates an authentication request (i.e., a Nudm_UEAuthentication_Get request) and sends the authentication request to the UDM element 312 (S3).

[0118] In response to the authentication request, the UDM element 312 unmasks the SUCI and sends an authentication response (i.e., Nudm_UEAuthentication_Get response) to the AUSF element 310 (S4). In response to receiving the authentication response, the AUSF element 310 formats or generates an authentication response (i.e., Nuasf_UEAuthentication_Authenticate response) for the AMF element 314 and sends the authentication response to the AMF element 314 (S5).

[0119] The AMF element 314 is configured to perform an authentication procedure with the UE 110 using the information provided by the UDM / AUSF. For example, the AMF element 314 sends an authentication request along with an authentication token to the UE 110 (S6), and the UE 110 attempts to verify the authentication token. If successful, the UE 110 calculates a response token and sends an authentication response along with the response token, which are received by the AMF element 314 (S7). The AMF element 314 formats or generates another authentication request (i.e., a Nausf_UEAuthentication_Authenticate request) and inserts the response token from the UE 110, along with other information, into the authentication request. The AMF element 314 then sends the authentication request to the AUSF element 310 (S8). The AUSF element 310 verifies whether the response token from the UE 110 matches the expected response token and sends an authentication response (i.e., Nausf_UEAuthentication_Authenticate response) to the AMF element 314 indicating the success / failure of the authentication.

[0120] Once UE 110 is authenticated to the network, AMF element 314 initiates NAS security procedures to establish a new NAS security context. The AMF element 314 selects a NAS security algorithm (or algorithms) for encryption and integrity protection. The AMF element 314 formats or generates a security mode command message and inserts indicators of the NAS security algorithm, ngKSI, and other information into the security mode command message. The AMF element 314 then transmits the security mode command message to UE 110 (S10).

[0121] In the second phase of the NAS procedure, the UE 110 uses the ngKSI and the NAS security algorithm to derive a corresponding key for protecting subsequent NAS messages. Thus, a new NAS security context is established between the UE 110 and the AMF element 314. The UE 110 formats or generates a security mode complete message and inserts a second service request into the NAS message container of the security mode complete message. As described above, the second service request includes the entire set of NAS protocol IEs for the NAS service request procedure (mandatory and optional, if required) and is considered a "complete" NAS message. The UE 110 encrypts the NAS message container of the security mode complete message using the NAS security algorithm of the new NAS security context. Thus, the second service request is encrypted in the NAS message container of the security mode complete message. Next, the UE 110 sends the security mode complete message to the AMF element 314 (S11).

[0122] The AMF element 314 receives the security mode complete message from the UE 110 and decrypts the NAS message container in the security mode complete message to access the NAS protocol IEs from the second service request. The AMF element 314 then continues the NAS service request procedure (S12), such as by sending a registration accept message to the UE 110. The UE 110 responds to the AMF element 314 with a registration complete message (S13).

[0123] Any of the various elements or modules shown in the figures or described herein may be implemented as hardware, software, firmware, or some combination thereof. For example, an element may be implemented as dedicated hardware. A dedicated hardware element may be referred to as a “processor,” “controller,” or some similar terminology. When provided by a processor, functionality may be provided by a single dedicated processor, a single shared processor, or multiple individual processors, some of which may be shared. Furthermore, explicit use of the terms “processor” or “controller” should not be construed to refer only to hardware capable of executing software, but may implicitly include digital signal processor (DSP) hardware, network processors, application-specific integrated circuits (ASICs) or other circuitry, field-programmable gate arrays (FPGAs), read-only memory (ROM) for storing software, random access memory (RAM), non-volatile storage, logic circuitry, or any other physical hardware component or module.

[0124] Additionally, an element may be implemented as instructions executable by a processor or computer to perform the function of the element. Examples of instructions include software, program code, firmware, etc. The instructions, when executed by a processor, are operable to direct the processor to perform the function of the element. The instructions may be stored in a processor-readable storage device. Examples of storage devices include digital or solid-state memory, magnetic storage media such as magnetic disks or magnetic tapes, hard drives, or optically readable digital data storage media.

[0125] As used in this application, the term "circuitry" may refer to one or more or all of the following: (a) Hardware-only circuit implementation (e.g., implementation using only analog and / or digital circuits) (b) a combination of hardware circuitry and software (if applicable); (i) a combination of analog and / or digital hardware circuitry(s) and software / firmware; (ii) Any portion of the hardware processor(s) with software (including digital signal processor(s)), software, and memory(s) that cooperate to cause a device, such as a mobile phone or server, to perform various functions. (c) Hardware circuit(s) and / or processor(s), such as microprocessor(s) or portions of microprocessor(s), that require software (e.g., firmware) for operation but where the software is not necessary for operation, the software may not be present.

[0126] This definition of circuit applies to all uses of the term in this specification, including the claims. As a further example, as used in this application, the term circuit also encompasses simply a hardware circuit or processor (or processors) or portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware implementations. The term circuit also encompasses, by way of example and where applicable to particular claim elements, a baseband or processor integrated circuit for a mobile device, or similar integrated circuit of a server, cellular network device, or other computing or network device.

[0127] Although specific embodiments have been described herein, the scope of the disclosure is not limited to those specific embodiments, and is defined by the following claims and their equivalents.

Claims

1. A network element of a mobile network, the network element comprising: at least one processor; at least one memory containing computer program code executable by said processor; the processor is configured to cause the network element to perform a multi-phase Non-Access Stratum (NAS) procedure to establish a NAS communication session between the network element and a user equipment (UE); In a first phase of the NAS procedure, the processor instructs the network element to: receiving an initial NAS message from the UE, the initial NAS message being populated with a subset of NAS protocol information elements (IEs) designated for security-related handling from the NAS protocol IEs of the NAS procedure; processing the subset of NAS protocol IEs to determine that a NAS security context for the UE does not exist; selecting a NAS security algorithm for the NAS security context; and sending a response to the UE indicating the NAS security algorithm and security keyset identifier of the NAS security context; further configured to cause In a second phase of the NAS procedure, the processor instructs the network element to: receiving a subsequent NAS message from the UE having a NAS message container containing the initial NAS message encrypted based on the NAS security algorithm; and decoding the NAS message container of the subsequent NAS message, wherein the initial NAS message contained in the NAS message container of the subsequent NAS message is populated with each of the NAS protocol IEs of the NAS procedure; further configured to cause A network element of the mobile network.

2. In the first phase, the subset of NAS protocol IEs is encrypted in the initial NAS message using a public key of the UE's Home Public Land Mobile Network (HPLMN); The processor is further configured to cause the network element to initiate decoding of the subset of the NAS protocol IEs. The network element of claim 1 .

3. the network element comprises an Access and Mobility Management Function (AMF) element of the mobile network; The network element of claim 2 .

4. The processor is further configured to cause the network element to encrypt and transmit the subset of NAS protocol IEs to a unified data management (UDM) element that decrypts the subset of NAS protocol IEs based on a private key of the HPLMN. The network element of claim 3 .

5. the initial NAS message comprises a registration request message; The subset of NAS protocol IEs designated for security-related handling consists of a mobile identity of the UE, a UE security capability indicating one or more NAS security algorithms supported by the UE, a registration type, and a security keyset identifier for a NAS security context. The network element of claim 1 .

6. the response comprises a Security Mode Command message indicating the NAS security algorithm and the security keyset identifier; the subsequent NAS message received from the UE comprises a security mode complete message having the NAS message container containing the initial NAS message encrypted based on the NAS security algorithm. The network element of claim 1 .

7. the mobile network comprises a fifth generation (5G) network; The network element of claim 1 .

8. 1. A method for performing a Non-Access Stratum (NAS) procedure for establishing a NAS communication session between a user equipment (UE) and a network element of a mobile network, comprising: In the first phase of the NAS procedure: receiving an initial NAS message from the UE at the network element, the initial NAS message populated with a subset of NAS protocol information elements (IEs) designated for security-related handling from the NAS protocol IEs of the NAS procedure; processing the subset of NAS protocol IEs at the network element to determine that a NAS security context for the UE does not exist; selecting a NAS security algorithm for the NAS security context at the network element; sending a response from the network element to the UE indicating the NAS security algorithms and security keyset identifiers of the NAS security context; Equipped with In a second phase of the NAS procedure: receiving a subsequent NAS message from the UE at the network element, the subsequent NAS message having a NAS message container containing the initial NAS message encrypted based on the NAS security algorithm; decoding the NAS message container of the subsequent NAS message at the network element, wherein the initial NAS message contained in the NAS message container of the subsequent NAS message is populated with each of the NAS protocol IEs of the NAS procedure; The method comprising:

9. In the first phase, the subset of NAS protocol IEs is encrypted in the initial NAS message using a public key of the UE's Home Public Land Mobile Network (HPLMN); The method comprises: Initiating decoding of the subset of the NAS protocol IEs. Further provided with The method of claim 8.

10. the network element comprises an Access and Mobility Management Function (AMF) element of the mobile network; Initiating decryption of the subset of NAS protocol IEs comprises encrypting and sending the subset of NAS protocol IEs to a unified data management (UDM) element for decrypting the subset of NAS protocol IEs based on a private key of the HPLMN.

10. The method of claim 9.

11. the initial NAS message comprises a registration request message; The subset of NAS protocol IEs designated for security-related handling consists of a mobile identity of the UE, a UE security capability indicating one or more NAS security algorithms supported by the UE, a registration type, and a security keyset identifier for a NAS security context. The method of claim 8.

12. the response comprises a Security Mode Command message indicating the NAS security algorithm and the security keyset identifier; The subsequent NAS message received from the UE comprises a security mode complete message having the NAS message container containing the initial NAS message encrypted based on the NAS security algorithm. The method of claim 8.

13. In the first phase of the NAS procedure, identifying, at the UE, the subset of NAS protocol IEs of the NAS procedures designated for security-related handling; inserting, at the UE, the subset of NAS protocol IEs into the initial NAS message; sending the initial NAS message from the UE to the network element; receiving the response at the UE from the network element indicating the NAS security algorithms and the security keyset identifier of the NAS security context; In the second phase of the NAS procedure, inserting, at the UE, the NAS protocol IE of the NAS procedure into the initial NAS message; inserting, at the UE, the initial NAS message into the NAS message container of the subsequent NAS message; encrypting, at the UE, the NAS message container of the subsequent NAS message using the NAS security algorithm; sending the subsequent NAS message from the UE to the network element; The method of claim 8 further comprising:

14. In the first phase, encrypting, at the UE, the subset of NAS protocol IEs of the initial NAS message using a public key of a Home Public Land Mobile Network (HPLMN) of the UE; 14. The method of claim 13, further comprising:

15. at least one processor; at least one memory containing computer program code executable by said processor; A user equipment (UE) comprising: the processor is configured to cause the UE to initiate a multi-phase Non-Access Stratum (NAS) procedure to establish a NAS communication session between the UE and a network element of a mobile network; In a first phase of the NAS procedure, the processor causes the UE to: identifying a subset of the NAS protocol information elements (IEs) of the NAS procedure that are designated for security-related handling; inserting said subset of NAS protocol IEs into an initial NAS message; causing the initial NAS message to be sent to the network element; and receiving a response from the network element indicating a NAS security algorithm and a security keyset identifier for the NAS security context; further configured as follows: In a second phase of the NAS procedure, the processor causes the UE to: inserting the NAS protocol IE of the NAS procedure into the initial NAS message; Inserting the initial NAS message into a NAS message container of a subsequent NAS message; encrypting the NAS message container of the subsequent NAS message using the NAS security algorithm; and causing the subsequent NAS message to be transmitted to the network element. It is further configured as follows: The user equipment (UE).

16. The processor may cause the UE to: The first phase involves encrypting the subset of NAS protocol IEs of the initial NAS message using a public key of the UE's Home Public Land Mobile Network (HPLMN). The UE of claim 15 further configured to:

17. The processor may cause the UE to: When the UE has the public key programmed into a UMTS Subscriber Identity Module (USIM), encrypting the subset of the NAS protocol IEs of the initial NAS message using the public key; and When the UE does not have the public key programmed in the USIM, the initial NAS message is sent to the network element without encrypting the subset of the NAS protocol IEs of the initial NAS message. The UE of claim 16, further configured to:

18. the initial NAS message comprises a registration request message; The subset of NAS protocol IEs designated for security-related handling consists of a mobile identity of the UE, a UE security capability indicating one or more NAS security algorithms supported by the UE, a registration type, and a security keyset identifier of a NAS security context.

16. The UE of claim 15.

19. The processor may cause the UE to: When the registration type does not indicate an emergency, encrypting the subset of NAS protocol IEs of the initial NAS message using a public key of the UE's Home Public Land Mobile Network (HPLMN); and When the registration type indicates an emergency, causing the initial NAS message to be sent to the network element without encrypting the subset of the NAS protocol IEs of the initial NAS message. The UE of claim 18 further configured to:

20. the response comprises a Security Mode Command message indicating the NAS security algorithm and the security keyset identifier; the subsequent NAS message comprises a security mode complete message having the NAS message container containing the initial NAS message encrypted based on the NAS security algorithm.

16. The UE of claim 15.

Images