Protection Scheme Configuration in a Communication Network Environment

Abstract

Techniques for configuring a protection scheme in a communication network are disclosed. For example, a home communication network of a given user equipment uses a user equipment parameter update procedure or a roaming steering procedure in a visited communication network scenario to send protection scheme configuration data to the given user equipment.

Description

Technical Field

[0001] This field generally relates to communication networks, and more particularly, but not limited to, security management in communication networks.

Background Art

[0002] This section introduces aspects that may help in better understanding of the present invention. Therefore, the description in this section should be read from this perspective and should not be construed as an admission as to what is prior art and what is not prior art.

[0003] The 4th generation (4G) wireless mobile communication technology, also known as Long Term Evolution (LTE) technology, is designed to provide high-capacity mobile multimedia with high data rates, especially for human interfaces. Next-generation or 5th generation (5G) technology is intended to be used not only for human interfaces but also for machine-type communication in the so-called Internet of Things (IoT) network.

[0004] The 5G network aims to enable high-capacity IoT services (e.g., a very large number of devices with limited capacity) and mission-critical IoT services (e.g., requiring high reliability), but improvements beyond legacy mobile communication services are supported in the form of enhanced mobile broadband (eMBB) services that provide improved wireless Internet access for mobile devices.

[0005] In a communication system as an example, user equipment such as a mobile terminal (subscriber), i.e., a 5G UE in a 5G network or more generally a UE, communicates via an air interface with a base station or an access point of an access network called a 5G AN in the 5G network. The access point (e.g., gNB) is, by way of example, part of the access network of the communication system. For example, in a 5G network, the access network called 5G AN is described in 5G technical specification (TS) 23.501 named "Technical Specification Group Services and System Aspects; System Architecture for the 5G System" and TS 23.502 named "Technical Specification Group Services and System Aspects; Procedures for the 5G System (5GS)", the disclosure of which is hereby incorporated by reference in its entirety. Generally, an access point (e.g., gNB) provides access to the core network (CN or 5GC) of the UE and then provides the UE with access to other UEs and / or a data network such as a packet data network (e.g., the Internet).

[0006] TS23.501 then defines a 5G service-based architecture (SBA) that models services as network functions (NFs) that communicate with each other using a representational state transfer application programming interface (RESTful API).

[0007] Furthermore, the disclosure of 5G Technical Specification (TS) 33.501, named "Technical Specification Group Services and System Aspects; Security Architecture and Procedures for the 5G System", is hereby incorporated by reference in its entirety into this specification, and further details of security management related to 5G networks are described therein.

Prior Art Documents

Non-Patent Documents

[0008]

Non-Patent Document 1

Non-Patent Document 2

Non-Patent Document 3

Non-Patent Document 4

Summary of the Invention

Problems to be Solved by the Invention

[0009] Security management is an important consideration in any communication system. However, due to the continuous attempts to improve the architecture and protocols associated with 5G networks to enhance network efficiency and / or subscriber convenience, the security management issues related to the configuration of protection schemes when a UE moves between communication networks can become significant issues.

Means for Solving the Problems

[0010] Exemplary embodiments provide protection scheme configuration techniques in communication networks.

[0011] For example, in one exemplary embodiment from the perspective of a user equipment, in the user equipment, the method includes receiving protection scheme configuration data from a network entity of a communication system according to an update procedure between the user equipment and the communication network, and generating a unique identifier for the user equipment based on at least a portion of the received protection scheme configuration data in the user equipment.

[0012] For example, in one exemplary embodiment from the perspective of a network entity, the method includes at least one of receiving and generating protection scheme configuration data of a user equipment connected to the communication network in the network entity of the communication network, and sending the protection scheme configuration data to the user equipment according to an update procedure between the user equipment and the communication network so as to enable the user equipment to generate a unique identifier for the user equipment based on at least a portion of the received protection scheme configuration data.

[0013] Advantageously, an exemplary embodiment provides a home communication network of a given user equipment for transmitting protection scheme configuration data to the given user equipment using a user equipment parameter update procedure or a roaming steering procedure in a visited communication network scenario.

[0014] Preferably, a further exemplary embodiment is provided in the form of a non - transitory computer - readable storage medium embodying executable program code that, when executed by a processor, causes the processor to perform the above steps. Another exemplary embodiment comprises an apparatus having a processor and a memory configured to perform the above steps.

[0015] These and other features and advantages of the embodiments described herein will become more apparent from the accompanying drawings and the following detailed description.

Brief Description of the Drawings

[0016]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Best Mode for Carrying Out the Invention

[0017] This specification presents embodiments related to exemplary communication systems and related technologies for security management in a communication system. However, it will be understood that the claims are not limited to a particular type of the disclosed communication systems and / or processes. Embodiments may be implemented in a variety of other types of communication systems using alternative processes and operations. For example, although illustrated in the context of a wireless cellular system utilizing 3GPP system elements such as 3GPP next-generation systems (5G), the disclosed embodiments may be adapted in a straightforward manner to a variety of other types of communication systems.

[0018] According to an exemplary embodiment implemented in a 5G communication system environment, one or more 3GPP Technical Specifications (TS) and Technical Reports (TR) may provide further descriptions of network elements / functions and / or operations that can interact with inventive solutions, such as the portions of 3GPP TS23.501 and 3GPP TS33.501 referenced above. Other 3GPP TS / TR documents, for example, 3GPP TS31.115, entitled "Technical Specification Group Core Network and Terminals; Secured Packet Structure for (Universal) Subscriber Identity Module (U) SIM Toolkit Applications," the disclosure of which is hereby incorporated by reference in its entirety, may provide other details that would be understood by one of ordinary skill in the art. However, while well-suited to 5G-related 3GPP standards, the embodiments are not necessarily intended to be limited to a particular standard.

[0019] Before describing the exemplary embodiments, a general description of certain key components of a 5G network is presented below in connection with FIGS. 1 and 2.

[0020] Figure 1 shows a communication system 100 in which an exemplary embodiment is implemented. It should be understood that the elements shown in communication system 100 are intended to represent the main functions brought into the system, such as UE access function, mobility management function, authentication function, serving gateway function, etc. Therefore, the blocks shown in Figure 1 refer to specific elements in the 5G network that bring these main functions. However, other network elements may be used to implement some or all of the main functions represented. Also, it should be understood that not all functions of the 5G network are shown in Figure 1. Rather, at least some functions are represented to facilitate the description of the exemplary embodiment. Subsequent figures may show some additional elements / functions (i.e., network entities).

[0021] Accordingly, as shown, communication system 100 includes a user equipment (UE) 102 that communicates with an access point (gNB) 104 via an air interface 103. It should be understood that UE 102 may use one or more other types of access points (e.g., access functions, networks, etc.) to communicate with a 5G core other than the gNB. By way of example only, access point 104 can be any 5G access network, an untrusted non-3GPP access network using an N3IWF (Non-3GPP Interworking Function), a trusted non-3GPP network using a TNGF (Trusted Non-3GPP Gateway Function), or a wired access using a W-AGF (Wired Access Gateway Function), or may correspond to a legacy access point (e.g., eNB).

[0022] UE102 can be a mobile station, and such a mobile station can include, by way of example, a mobile phone, a computer, an IoT device, or any other type of communication device. The term "user equipment" as used herein is thus intended to be broadly construed to include communication devices, including examples such as various different types of mobile stations, subscriber stations, or more generally, combinations of other devices such as smartphones or data cards inserted within a laptop. Such communication devices are also intended to generally include devices commonly referred to as access terminals.

[0023] In one embodiment, UE102 is composed of a Universal Integrated Circuit Card (UICC) portion and a Mobile Equipment (ME) portion (such as shown in FIG. 1). The UICC is the user-dependent portion of the UE and includes at least one Subscriber Identity Module (USIM, such as shown in FIG. 1) and appropriate application software. The USIM securely stores a permanent subscriber identifier and associated keys used to uniquely identify and authenticate a subscriber to an access network. The ME is the user-independent portion of the UE and includes a Terminal Equipment (TE) function and various Mobile Terminal (MT) functions. The USIM may be referred to herein more generally as the "subscriber identity-dependent portion" of the UE, and the ME may be referred to herein more generally as the "subscriber identity-independent portion" of the UE.

[0024] Note that in one example, the permanent subscriber identifier is the International Mobile Subscriber Identity (IMSI) that is unique to the UE. In one embodiment, the IMSI is of a fixed 15-digit length and consists of a 3-digit Mobile Country Code (MCC), a 3-digit Mobile Network Code (MNC), and a 9-digit Mobile Station Identification Number (MSIN). In a 5G communication system, the IMSI is referred to as the Subscriber Permanent Identifier (SUPI). In the case of the IMSI as the SUPI, the MSIN provides subscriber identification. Thus, typically only the MSIN part of the IMSI needs to be encrypted. The MNC and MCC parts of the IMSI provide routing information that is used by the serving network to route to the correct home network. When the MSIN of the SUPI is encrypted, it is called the Subscriber Concealed Identifier (SUCI). Another example of the SUPI uses the Network Access Identifier (NAI). The NAI is typically used for IoT communication. Further details of the format as an example of the SUCI are described below in relation to Figure 3.

[0025] The access point 104 is, by way of example, part of the access network of the communication system 100. Such an access network may comprise, for example, a 5G system having a plurality of base stations.

[0026] Furthermore, the access point 104 in this exemplary embodiment is operatively coupled to an Access and Mobility Management Function (AMF) 106. In a 5G network, the AMF supports, among other things, Mobility Management (MM) and Security Anchor (SEAF) functions.

[0027] In this exemplary embodiment, the AMF 106 is operatively coupled to (e.g., uses the services of) other network functions 108. As shown, some of these other network functions 108 include, but are not limited to, an authentication server function (AUSF), an integrated data management (UDM) function, and other network functions that can operate as a service producer (NFp) and / or a service consumer (NFc). Note that any network function can be a service producer for one service and a service consumer for another service. Further, when the service provided includes data, the data-providing NFp is referred to as a data producer, and the data-requesting NFc is referred to as a data consumer. The data producer can also be an NF that generates data by modifying or otherwise processing data produced by another NF.

[0028] Note that a UE such as UE102 typically subscribes to what is called a home public land mobile network (HPLMN) where some or all of functions 106 and 108 are present. Alternatively, a UE such as UE102 can receive services from a non-public network (NPN) where these functions may be present. The HPLMN is also called the home environment (HE). When the UE is roaming (not within the HPLMN), it is typically connected to a visited public land mobile network (VPLMN), also called the visited network, while the network currently serving the UE is also called the serving network. In the case of roaming, some of the network functions 106 and network functions 108 can be present within the VPLMN, in which case the functions within the VPLMN communicate with the functions within the HPLMN as needed. However, in a non-roaming scenario, the mobility management function 106 and the other network functions 108 are present within the same communication network, i.e., within the HPLMN. The embodiments described herein are not necessarily limited by which functions are present within which PLMN (i.e., HPLMN or VPLMN). Further, it should be understood that the embodiments described herein are not necessarily limited to PLMNs and can be implemented in a stand-alone non-public network (SNPN). An SNPN is a private communication network managed by an NPN operator.

[0029] Access point 104 is also operably coupled to a session management function (SMF) 110, which is operably coupled (via one or more of functions 106 and / or 108) to a user plane function (UPF) 112. The UPF 112 is operably coupled to a packet data network, such as the Internet 114. Note that the thick solid lines in this figure represent the user plane (UP) of the communication network, as contrasted with the thin solid lines that represent the control plane (CP) of the communication network. The network 114 of FIG. 1 may represent other network infrastructures, including, by way of addition or alternative, cloud computing infrastructure and / or edge computing infrastructure, but is not limited thereto. It should be recognized that for the further typical operations and functions of such network elements, since they are not the focus in the exemplary embodiments and may be found in appropriate 3GPP 5G documents, they are not described herein. Note that the functions shown in 106, 108, 110, and 112 are examples of network functions (NFs).

[0030] It should be recognized that this particular arrangement of system elements is for illustrative purposes only, and that other types and arrangements of additional or alternative elements may be used to implement the communication system in other embodiments. For example, in other embodiments, system 100 may include other elements / functions not explicitly shown herein.

[0031] Accordingly, the arrangement of FIG. 1 is merely one exemplary configuration of a wireless cellular system, and numerous alternative configurations of system elements may be used. For example, although only one element / function is shown in the embodiment of FIG. 1, this is for simplicity and clarity of explanation only. A given alternative embodiment may, of course, include more such system elements, as well as additional or alternative elements of the types commonly associated with normal system implementations.

[0032] Also, while FIG. 1 shows system elements as single functional blocks, it should be noted that the various sub-networks that make up the 5G network are partitioned into so-called network slices. A network slice (network partition) is a logical network that can optionally use network function virtualization (NFV) on a common physical infrastructure to provide specific network capabilities and network characteristics that support corresponding service types. With NFV, network slices can be instantiated as needed for a given service, such as an eMBB service, a massive IoT service, and a mission-critical IoT service. A network slice or function is thus instantiated when that network slice or function is created. In some embodiments, this includes installing or otherwise operating the network slice or function on one or more host devices of the underlying physical infrastructure. UE102 is configured to access one or more of these services via gNB104.

[0033] FIG. 2 is a block diagram showing, methodologically, a computing architecture for various participants according to an exemplary embodiment. More specifically, system 200 is shown to include a user equipment (UE) 202 and a plurality of network entities 204-1, ···, 204-N. For example, in the exemplary embodiment and referring back to FIG. 1, UE202 can represent UE102, and network entities 204-1, ···, 204-N can represent functions 106 and 108. It should be appreciated that UE202 and network entities 204-1, ···, 204-N are configured to interact to provide the security management and other techniques described herein.

[0034] The user device 202 includes a processor 212 coupled to a memory 216 and an interface circuit 210. The processor 212 of the user device 202 includes a security management processing module 214 that can be implemented in the form of software at least partially executed by the processor. The processing module 214 performs security management, which will be described in connection with subsequent figures or, if not, this specification. The memory 216 of the user device 202 includes a security management storage module 218 that stores data generated or otherwise used during security management operations.

[0035] Each of the network entities (referred to individually or collectively as 204 herein) includes a processor 222 (222-1, ···, 222-N) coupled to a memory 226 (226-1, ···, 226-N) and an interface circuit 220 (220-1, ···, 220-N). Each processor 222 of each network entity 204 includes a security management processing module 224 (224-1, ···, 224N) that can be implemented in the form of software at least partially executed by the processor 222. The processing module 224 performs security management operations, which will be described in connection with subsequent figures and, if not, this specification. Each memory 226 of each network entity 204 includes a security management storage module 228 (228-1, ···, 228-N) that stores data generated or otherwise used during security management operations.

[0036] The processors 212 and 222 can include, for example, a microprocessor such as a central processing unit (CPU), an application specific integrated circuit (ASIC), a digital signal processor (DSP), or other types of processing devices, and portions or combinations of such elements.

[0037] Memory 216 and memory 226 can be used to store one or more software programs that are executed by respective processors 212 and 222 to implement at least a portion of the functions described herein. For example, the security management operations and other functions described in connection with the subsequent figures and other forms herein can be implemented in a direct manner using software code executed by processors 212 and 222.

[0038] Accordingly, either memory 216 or memory 226 can be seen as an example of what is more generally referred to herein as a computer program product, or even more generally, a processor-readable storage medium having embodied executable program code. Other examples of processor-readable storage media can include disks or other types of magnetic or optical media in any combination. Exemplary embodiments can include products comprising such a computer program product or other processor-readable storage medium.

[0039] Furthermore, memory 216 and memory 226 can more specifically include electronic random access memory (RAM), such as, for example, static RAM (SRAM), dynamic RAM (DRAM), or other types of volatile or non-volatile electronic memory. The latter can include non-volatile memory, such as, for example, flash memory, magnetic RAM (MRAM), phase change RAM (PC-RAM), or ferroelectric RAM (FRAM). The term "memory" as used herein is intended to be construed broadly and can additionally or alternatively include, for example, read only memory (ROM), disk-based memory, or other types of storage devices, and portions or combinations of such devices.

[0040] Interface circuit 210 and interface circuit 220 exemplify a transceiver, or other communication hardware or firmware, that enables related system elements to communicate with each other in the manner described herein.

[0041] From FIG. 2, it is clear that user device 202 and a plurality of network entities 204 are configured to communicate with each other as participants in security management via their respective interface circuits 210 and interface circuits 220. This communication includes each participant sending data to and / or receiving data from one or more of the other participants. As used herein, the term "data" is broadly construed to include any type of information that can be sent between participants, including but not limited to identification data, key pairs, key indicators, security management messages, registration request / response messages and data, request / response messages, authentication request / response messages and data, metadata, control data, audio, video, multimedia, consent data, other messages, etc.

[0042] It should be recognized that the particular arrangement of components shown in FIG. 2 is an example, and that in other embodiments, numerous alternative components may be used. For example, any given network element / function may be configured to incorporate additional or alternative components and support other communication protocols.

[0043] Other system elements such as gNB 104, SMF 110, and UPF 112 may be configured to each include components such as a processor, memory, and network interface. These elements need not be implemented on separate stand-alone processing platforms, and instead may represent different functional portions of, for example, a single common processing platform.

[0044] More generally, FIG. 2 can be considered to represent processing devices that are configured to provide respective security management functions and are operably coupled to each other in a communication system.

[0045] As described above, a SUCI is established for each UE102. The SUCI is defined in 3GPP TS33.501 referenced above and serves as a privacy-preserving identifier that includes an encrypted SUPI, as shown in format 300 of FIG. 3. As shown, SUCI format 300 includes a SUPI type 302, a home network identifier 304, a routing indicator 306, a protection scheme identifier (ID) 308, a home network public key ID 310, and a scheme output 312. Some of the values in format 300 have fixed ranges, while some values depend on other values as shown.

[0046] More specifically, as shown, the protection scheme ID 308 has a value in the range from 0 to 15. The protection scheme ID 308 represents a null scheme, a non-null scheme defined in Annex C of 3GPP TS33.501 referenced above, or a protection scheme defined by the HPLMN. The null scheme is used when the SUPI type is a global line identifier (GLI) or a global cable identifier (GCI) and privacy is not protected.

[0047] UE102 generates a SUCI using the null scheme only in the following cases: (i) when UE102 is establishing an unauthenticated emergency session and does not have a 5G-GUTI for the selected PLMN, (ii) when the home network is configured to use the null scheme, or, (iii) when the home network has not provisioned the public key required to generate a SUCI.

[0048] If it is the network operator's decision that the ME of UE102 should calculate the SUCI, the home network operator provisions an ordered priority list of protection scheme IDs permitted by the operator into the USIM of UE102. The priority list of protection scheme identifiers in the USIM only includes the protection scheme IDs defined in Annex C of 3GPP TS33.501 referenced above, and the list can include one or more protection scheme IDs. The ME reads out SUCI calculation information from the USIM, which includes the SUPI, SUPI type, routing indicator, home network public key ID, home network public key, and a list of protection scheme IDs. The ME selects a protection scheme from the supported schemes that has the highest priority within the list obtained from the USIM. If the home network public key or the priority list is not provisioned in the USIM, the ME calculates the SUCI using the null scheme. Note that this feature may be provisioned for future releases of MEs newer than the current release, as additional protection schemes may be defined in the future. In this case, the protection scheme selected by an older ME may not be the protection scheme with the highest priority in the USIM's list. If the network operator selects that the calculation of the SUCI should be done in the USIM, the network operator should use a unique identifier for the protection scheme.

[0049] Currently, the schemes for SUCI (i.e., null, profile A, and profile B) are configured in the UICC of UE102 by a priority list. For all VPLMNs, the UE / UICC uses the same configuration (i.e., the same priority list) as the HPLMN. For some countries or VPLMNs, the null scheme or a customized (proprietary) scheme configured by the operator is not permitted. Second, the use of the null scheme should not be used in certain networks as it carries the risk of exposing the identity.

[0050] For example, if the null scheme is active in UE102 within the HPLMN (e.g., due to legal eavesdropping or LI requirements), and then UE102 enters another country or geographical area and accesses the VPLMN, the same null scheme will be used in the VPLMN. This increases the risk of enabling the identification of the UE wirelessly. Since the LI requirements are specific to a country, using the null scheme in the VPLMN poses a significant security risk to UE102.

[0051] Currently, the protection scheme can usually be changed by over-the-air (OTA) procedures operating within the HPLMN. However, USIM configuration messages sent to the VPLMN may be discarded due to security / firewalls and may also incur additional charges, so they are avoided or not supported in the VPLMN.

[0052] Currently, there is no available mechanism for dynamically updating the protection scheme via the 5GC in the VPLMN. Furthermore, the protection scheme stored in the USIM of UE102 is not specific to a PLMN. Therefore, the network operator cannot control which protection scheme should be used in which PLMN.

[0053] Exemplary embodiments overcome the above and other drawbacks by providing a technical solution that provides an improved protection scheme configuration in a communication network. For example, according to one or more exemplary embodiments, the HPLMN may send an approved protection scheme and a PLMN mapping table to the UICC of the UE102 using a UE parameter update (UPU) procedure or a steering of roaming (SoR) procedure in a VPLMN scenario. Further, in one or more exemplary embodiments, the HPLMN updates the home network public key list and the protection scheme configured in the UICC. Further, in one or more exemplary embodiments, the UE102 indicates its capabilities via a container that is transparent to the VPLMN and via a 5G mobility management (5GMM) capability information element (IE) that is not transparent to the VPLMN (the VPLMN forwards the capability indication to the HPLMN).

[0054] It should be recognized that the following description is based on the case of a PLMN, but the protection scheme configuration according to the exemplary embodiments can be extended to the case of an SNPN without loss of generality.

[0055] Next, further details of the IE sent to the UE102 are described with reference to FIG. 4, which shows an example 400 of an approved protection scheme and a PLMN mapping table. The HPLMN may send a protection scheme associated with the PLMN ID.

[0056] In the proposed A format 402, the UICC of the UE102 has each PLMN listed in the corresponding approved scheme.

[0057] In the proposed B format 404, the UICC of the UE102 has each protection scheme together with the approved lists corresponding to the VPLMN and the HPLMN.

[0058] The default option for the VPLMN is to check whether the UICC can use the corresponding permitted scheme for that particular VPLMN if the VPLMN is not listed in this configuration.

[0059] In a configuration with only permitted protection schemes, the HPLMN can simply update the list of protection schemes for the UE102. For example, refer to the protection scheme table 406.

[0060] Furthermore, the HPLMN can update (add or delete) the home network public key configured within the UICC of the UE102. For example, refer to the home network public key identifier table 408.

[0061] The exemplary embodiment provides procedures for transmitting a protection scheme information element (e.g., described above in relation to FIG. 4) to the UE102. FIG. 5 shows the UPU procedure for transmitting protection scheme information, and FIG. 6 shows the SoR procedure for transmitting protection scheme information.

[0062] In an embodiment of updating the UPU procedure, the UDM updates the information (exemplarily referred to as "protection scheme configuration data" herein) described above in relation to FIG. 4 via the UPU procedure. For example, the UDM can execute this procedure based on internal triggers such as the UE roaming in a particular PLMN (i.e., a registration request at the UDM) or a provisioning change request.

[0063] More specifically, FIG. 5 shows a procedure 500 for a static protection scheme configuration using the UPU procedure according to an exemplary embodiment. As shown, the procedure 500 includes a UE502, an AMF504, an AUSF506, and a UDM508.

[0064] In step 1, UDM 508 determines to update the PLMN protection scheme mapping table, update the home network public key, or update the protection scheme.

[0065] In step 2a, UDM 508 generates a secure packet containing the new updated information (protection scheme configuration data) and includes the secure packet in the UPU data. Alternatively, UDM 508 can prepare the UPU data by directly including the updated information (protection scheme configuration data).

[0066] In step 2b, UDM 508 sends the UPU data as part of the Nausf UPU Protection message described in 3GPP TS31.115 referred to above.

[0067] In step 3, AUSF 506 generates UPU-MAC-I AUSF using the UPU data containing the protection scheme configuration data.

[0068] In step 4, AUSF 506 returns the generated UPU-MAC-I AUSF to UDM 508 as part of the Nausf UPU Protection response together with the counter information.

[0069] In step 5, UDM 508 sends the UPU data to AMF 504, and AMF 504 sends the same to UE 502. Step 5 can be performed according to TS33.501 Figure 6.15.2.1-1 as follows (note that the following steps (i), (ii), and (iii) correspond to steps 4, 5, and 6 in TS33.501 Figure 6.15.2.1-1).

[0070] i) The UDM508 initiates the Nudm_SDM_Notification service operation, which includes the UPU transparent container if the AMF504 supports it, or in the access and mobility subscription data, UE Parameters Update Data, UPU-MAC-I AUSF , and includes individual IEs with CounterUPU. When the UDM508 requests a positive response, it temporarily stores the expected UPU-XMAC-I UE .

[0071] ii) Upon receiving the Nudm_SDM_Notification message, the AMF504 sends the DL NAS Transport message to the served UE502. If received from the UDM508 in step (i) above, the AMF504 includes the transparent container in the DL NAS Transport message. Otherwise, if the UDM508 provided individual IEs in step (i) above, the AMF has to construct the UPU transparent container.

[0072] iii) Upon receiving the DL NAS Transport message, the UE502 calculates the UPU-MAC-I AUSF for the received UE Parameters Update Data and CounterUPU in the same way as the AUSF506, and verifies whether it matches the UPU-MAC-I AUSF value received in the UPU transparent container of the DL NAS Transport message. If the verification of UPU-MAC-I AUSF is successful and the UPU data includes some parameters protected by a secure packet, the ME transfers the secure packet to the USIM. If the verification of UPU-MAC-I AUSF is successful and the UPU data includes some parameters not protected by a secure packet, the ME updates the parameters stored in it with the received parameters in the UDM update data.

[0073] Since the information is for the UICC of UE502, the ME of UE502 transfers the information to the UICC, and in step 6, the UICC stores the information. Alternatively, the last recipient of the information can be the ME of UE502, in which case the ME of UE502 stores the information.

[0074] In step 7, according to TS33.501 Figure 6.15.2.1-1 as follows, the following steps occur (note that the following steps (iv), (v), and (vi) correspond to steps 7, 8, and 9 of TS33.501 Figure 6.15.2.1-1).

[0075] iv) If UDM508 requests an affirmative response from UE502 and UE502 successfully verifies and updates the UE Parameters Update Data provided by UDM508, UE502 sends a UL NAS Transport message to AMF504. UE502 generates UPU-MAC-I UE and includes the generated UPU-MAC-I UE in a transparent container within the UL NAS Transport message.

[0076] v) If a transparent container with UPU-MAC-I UE is received within the UL NAS Transport message, AMF504 sends a Nudm_SDM_Info request message to UDM508 together with the transparent container.

[0077] vi) If UDM508 indicates that UE502 should affirmatively respond to the success of the security check of the received UE Parameters Update Data, UDM508 compares the received UPU-MAC-I UE with the expected UPU-XMAC-I UE temporarily stored by UDM508 in step (i) above.

[0078] In step 8, if the HPLMN requests re-registration due to being updated to a new configuration, the UE 502 triggers a registration request and the generation of an SUCI with the updated information.

[0079] Next, looking at the embodiment updated by the SoR procedure, the UDM updates the protection scheme configuration data via the SoR procedure. The UDM can execute this procedure based on internal triggers such as, for example, the UE roaming within a specific PLMN (i.e., a registration request at the UDM), or based on a provisioning change request.

[0080] More specifically, FIG. 6 shows a procedure 600 for dynamic protection scheme configuration using the SoR procedure according to an exemplary embodiment. As shown, the procedure 600 includes a UE 602, a VPLMN AMF 604, an HPLMN AUSF 606, and an HPLMN UDM 608.

[0081] In step 1, the HPLMN UDM 608 dynamically determines to update the PLMN protection scheme mapping table, update the home network public key, or update the protection scheme.

[0082] In step 2a, the HPLMN UDM 608 generates a secure packet using the newly updated information (protection scheme configuration data).

[0083] In step 2b, the HPLMN UDM 608 transmits the secure packet as part of the Nausf SoR Protection message described in 3GPP TS31.115 referenced above.

[0084] In step 3, the HPLMN AUSF 606 generates SoR-MAC-I AUSF using the SoR data including the protection scheme configuration data.

[0085] In step 4, the HPLMN AUSF 606 returns the generated SoR-MAC-I AUSF to the HPLMN UDM 608, together with the counter information, as part of the Nausf SoR Protection response.

[0086] In step 5, the HPLMN UDM 608 sends the SoR data to the VPLMN AMF 604, and the VPLMN AMF 604 sends the same to the UE 602. Step 5 can be performed according to TS 33.501 Figure 6.14.2.2-1 as follows (note that the following steps (i), (ii), and (iii) correspond to steps 4, 5, and 6 of TS 33.501 Figure 6.14.2.2-1).

[0087] i) The HPLMN UDM 608 initiates the Nudm_SDM_Notification service operation, which includes the SoR transparent container if the VPLMN AMF 604 supports it, or an individual IE containing an optional list of the preferred PLMN / access technology combination or secure packet, ACK Indication, SoR-MAC-I AUSF , and the Counter SoR within the access and mobility subscription data. The HPLMN UDM 608 temporarily stores the expected SoR-XMAC-I UE if a positive response is required.

[0088] ii) When receiving the Nudm_SDM_Notification message, if the SoR transparent container is included in the message, the VPLMN AMF 604 sends the DL NAS Transport message to the served UE 602 including the received SoR transparent container, otherwise, the VPLMN AMF 604 sends the ACK Indication, steering list, SoR-MAC-I AUSF and Counter SoRBased on this, construct a SoR transparent container (including the SoR header), and include the constructed SoR transparent container in the DL NAS Transport message and send it to the served UE602.

[0089] iii) When receiving the DL NAS Transport message, UE602 calculates SoR-MAC-I in the same way as HPLMN AUSF606 on the received SoR transparent container. AUSF Calculate, and verify whether it matches the SoR-MAC-I SoR value received in the DL NAS Transport message, including Counter and the SoR header. AUSF value.

[0090] Since the dynamic configuration is for the UICC and the ME of UE602, the ME transfers the protection scheme configuration data to the UICC. In step 6, the UICC and the ME store the protection scheme configuration data. The UICC can also share the configuration with the ME.

[0091] In step 7, the following steps occur according to TS33.501 Figure 6.14.2.2-1 as follows (note that the following steps (iv), (v), and (vi) correspond to steps 7, 8, and 9 of TS33.501 Figure 6.14.2.2-1).

[0092] iv) If the HPLMN UDM608 requests a positive response from UE602 and UE602 verifies that the steering information is supplied by the HPLMN, UE602 sends the UL NAS Transport message to the VPLMN AMF604. UE602 generates SoR-MAC-I UE and includes the generated SoR-MAC-I UE in the SoR transparent container within the UL NAS Transport message.

[0093] v) The VPLMN AMF604 sends the Nudm_SDM_Info request message to the HPLMN UDM608. If a SoR transparent container with SoR-MAC-I UE has been received within the UL NAS Transport message and the VPLMN AMF604 supports the SoR transparent container, the VPLMN AMF604 includes the received SoR transparent container in the Nudm_SDM_Info request message; otherwise, the VPLMN AMF604 includes SoR-MAC-I UE in the Nudm_SDM_Info request message.

[0094] vi) If the HPLMN has instructed that the UE602 should positively respond to the successful security check of the received roaming steering information, the HPLMN UDM608 compares the received SoR-MAC-I UE with the expected SoR-XMAC-I UE temporarily stored by the HPLMN UDM608 in step (i) above.

[0095] In step 8, if the HPLMN requests re-registration due to an update of the new dynamic configuration, the UE602 triggers the registration request and the generation of the SUCI based on the updated information. The received dynamic configuration takes precedence over the static configuration. When the ME leaves this PLMN and stays in a different PLMN, this dynamic configuration is deleted.

[0096] The HPLMN is to be recognized as transmitting the protection scheme configuration data only to the UEs that support receiving the information. To achieve this capability, according to an exemplary embodiment, a UE having the capability to receive the information notifies the HPLMN of its capability. The UE notifies its capability using at least one of the following methods: (i) notify the VPLMN via a transparent container, and (ii) notify the VPLMN via a non-transparent 5GMM capability IE (the VPLMN forwards the capability indication to the HPLMN). Alternatively, the capability of the UE to update the information can be configured within the HPLMN.

[0097] It should be understood that the term "communication network" as used herein can, in some embodiments, comprise two or more separate communication networks. Further, the specific processing operations and other system functions described in connection with the figures described herein are presented as illustrative examples only and should not be construed as limiting the scope of the present disclosure in any way. Alternative embodiments can use other types of processing operations and messaging protocols. For example, the ordering of steps may be varied in other embodiments, or some steps may be performed at least partially concurrently with each other rather than sequentially. Also, one or more of the steps can be repeatedly performed periodically, and multiple instances of the method can be executed in parallel with each other.

[0098] Again, it should be emphasized that the various embodiments described herein are presented as illustrative examples only and should not be construed as limiting the claims. For example, alternative embodiments can utilize different communication system configurations, user equipment configurations, base station configurations, provisioning and usage processes, messaging protocols and message formats other than those described above in connection with the exemplary embodiments. These and numerous other alternative embodiments within the scope of the appended claims will be readily apparent to those skilled in the art.

Claims

1. At least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to cause the at least one processor to, for the apparatus, at least receive protection scheme configuration data from a network entity of a communication network according to an update procedure between the apparatus and the communication network; generate a unique identifier for the apparatus based on at least a part of the received protection scheme configuration data; An apparatus configured to perform the above.

2. The apparatus according to claim 1, wherein the update procedure includes a user equipment parameter update procedure.

3. The apparatus according to claim 1, wherein the update procedure includes a roaming steering procedure.

4. The apparatus according to claim 1, wherein the at least one memory and the computer program code are further configured to cause the at least one processor to cause the apparatus to at least (i) store the protection scheme configuration data, and (ii) update the previously stored protection scheme configuration data with the protection scheme configuration data.

5. The apparatus according to claim 1, wherein the protection scheme configuration data comprises one or more identifiers corresponding to one or more of the permissible protection schemes.

6. The apparatus according to claim 1, wherein the protection scheme configuration data comprises one or more identifiers corresponding to one or more of the permissible communication networks.

7. The apparatus according to claim 1, wherein the protection scheme configuration data comprises one or more identifiers corresponding to one or more of the permissible communication network public keys.

8. The apparatus according to claim 1, wherein the at least one memory and the computer program code are further configured to cause the at least one processor to cause the apparatus to notify the communication network about the configured protection scheme capabilities.

9. The apparatus according to claim 1, wherein the communication network is one of a home communication network and a visited communication network.

10. The apparatus according to claim 1, wherein the communication network is one of a public communication network and a private communication network. **Claim 11** The apparatus according to claim 1, which is part of a user device connected to a communication network. **Claim 12** In a user device, receiving protection scheme configuration data from a network entity of a communication network according to an update procedure between the user device and the communication network; and In the user device, generating a unique identifier for the user device based on at least a part of the received protection scheme configuration data A method comprising: **Claim 13** The method according to claim 12, wherein the update procedure comprises any one of (i) a user device parameter update procedure and (ii) a roaming steering procedure. **Claim 14** A product comprising a non-transitory computer-readable storage medium in which executable program code for causing a processor to execute the steps according to claim 12 is embodied. **Claim 15** At least one processor; and At least one memory including computer program code, wherein the at least one memory and the computer program code are configured to cause the at least one processor to cause the device to at least receive or generate protection scheme configuration data of a user device connected to a communication network; and transmit protection scheme configuration data to the user device according to an update procedure between the user device and the communication network so as to enable the user device to generate a unique identifier for the user device based on at least a part of the received protection scheme configuration data An apparatus configured to perform. **Claim 16** The apparatus according to claim 15, wherein the update procedure includes a parameter update procedure of the user device. **Claim 17** The apparatus according to claim 15, wherein the update procedure includes a roaming steering procedure. **Claim 18** The apparatus according to claim 15, wherein the protection scheme configuration data includes one or more identifiers corresponding to one or more of the permissible protection schemes. **Claim 19** The apparatus according to claim 15, wherein the protection scheme configuration data includes one or more identifiers corresponding to one or more of the permissible communication networks. **Claim 20** The apparatus according to claim 15, wherein the protection scheme configuration data comprises one or more identifiers corresponding to one or more of the permissible communication network public keys.

21. The apparatus according to claim 15, further configured such that at least one memory and computer program code cause the apparatus, by at least one processor, to receive a notification from a user equipment regarding the capabilities of the configured protection scheme.

22. The apparatus according to claim 15, wherein the communication network is one of a home communication network and a visited communication network.

23. The apparatus according to claim 15, wherein the communication network is one of a public communication network and a private communication network.

24. The apparatus according to claim 15, wherein the apparatus is part of an integrated data management function of the communication network.

25. The apparatus according to claim 15, wherein the apparatus is part of an authentication server function of the communication network.

26. The apparatus according to claim 15, wherein the apparatus is part of an access and mobility management function of the communication network.

27. In a network entity of a communication network, at least one of receiving and generating protection scheme configuration data of a user equipment connected to the communication network, and sending the protection scheme configuration data to the user equipment according to an update procedure between the user equipment and the communication network so as to enable the user equipment to generate a unique identifier for the user equipment based on at least a part of the received protection scheme configuration data A method comprising.

28. The method according to claim 27, wherein the update procedure comprises either (i) a user equipment parameter update procedure, and (ii) a roaming steering procedure.

29. A product comprising a non-transitory computer-readable storage medium embodying executable program code that, when executed by a processor, causes the processor to execute the steps according to claim 27.

30. Receiving protection scheme configuration data from a network entity of a communication network according to an update procedure between the apparatus and the communication network, and Generating a unique identifier for the device based on at least a portion of the received protection scheme configuration data; An apparatus comprising means for performing.

31. Performing at least one of receiving or generating protection scheme configuration data for a user equipment connected to a communication network; Transmitting the protection scheme configuration data to the user equipment according to an update procedure between the user equipment and the communication network so as to enable the user equipment to generate a unique identifier for the user equipment based on at least a portion of the received protection scheme configuration data; An apparatus comprising means for performing.

Images