Authentication and Key Management for Applications (AKMA) Application Key (KAF) Refresh

Abstract

Systems and techniques for wireless communication are disclosed. For example, a process may include generating an anchor key based on an authentication server function key, associating a count value with the anchor key, generating a temporary device identifier based on the authentication server function key, generating an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier, and sending the extended key identifier to a remote application.

Description

[Technical Field]

[0001]

[0001] The present disclosure relates generally to wireless communications. For example, aspects of the present disclosure relate to authentication and key management for applications (AKMA) application keys (KMA). AF This invention relates to systems and techniques for providing enhanced privacy by refreshing a user's password. [Background technology]

[0002] Wireless communication systems are being deployed to provide a variety of telecommunications and data services, including telephony, video, data, messaging, and broadcast. Broadband wireless communication systems have evolved through various generations, including first-generation analog wireless telephone service (1G), second-generation (2G) digital wireless telephone service (including interim 2.5G networks), third-generation (3G) high-speed data, Internet-enabled wireless service, and fourth-generation (4G) service (e.g., Long-Term Evolution (LTE), WiMax). Examples of wireless communication systems include code division multiple access (CDMA) systems, time division multiple access (TDMA) systems, frequency division multiple access (FDMA) systems, orthogonal frequency division multiple access (OFDMA) systems, Global System for Mobile communications (GSM) systems, etc. Other wireless communication technologies include 802.11, Wi-Fi, Bluetooth, among others.

[0003]

[0003] Fifth-generation (5G) mobile standards call for higher data rates, more connections, and better coverage, among other improvements. According to the Next Generation Mobile Network Alliance, the 5G standard (also known as "New Radio" or "NR") is designed to provide data rates of tens of megabits per second to each of tens of thousands of users, with 1 gigabit per second provided to dozens of workers on an office floor. To support large-scale sensor deployments, hundreds of thousands of simultaneous connections should be supported.

[0004]

[0004] Wireless communication systems have made great technological advances over the years, but challenges still exist. For example, AKMA authentication for wireless devices requires the use of an application key K that can be used by applications to interact with the network. AF However, K AF remains fixed until a new primary authentication is performed. A new K is issued more frequently than is provided by the primary authentication. AF It may be useful to obtain Summary of the Invention

[0005]

[0005] The following presents a simplified summary of one or more aspects disclosed herein. As such, the following summary should not be considered an extensive overview of all contemplated aspects, nor should it be considered as identifying key or critical elements of all contemplated aspects or as delimiting the scope of any particular aspect. As such, the following summary presents certain concepts of one or more aspects of the mechanisms disclosed herein in a simplified form, prior to the Detailed Description presented below.

[0006]

[0006] Systems, methods, apparatus, and computer-readable media for implementing wireless communications are disclosed. In one illustrative example, an apparatus for wireless communications is provided, including at least one memory and at least one processor (e.g., implemented in a circuit) coupled to the at least one memory. The at least one processor is configured to generate an anchor key based on a key from an authentication server function, associate a count value with the anchor key, generate an extended key identifier based on the count value, and send the extended key identifier to a remote application.

[0007]

[0007] In another example, an apparatus for wireless communications comprises at least one memory containing instructions and at least one processor coupled to the at least one memory, wherein the at least one processor is configured to: receive an anchor key and a key identifier associated with a user device from an authentication server function; receive a first request for an application key from a remote application, the first request including the first key identifier; determine that the first key identifier is a first extended key identifier including a count value; generate a first extended application key based on the count value associated with the first extended key identifier; and send the first extended application key and an indication that the user device is using the extended key identifier to the remote application.

[0008]

[0008] As another example, an apparatus for wireless communications comprises at least one memory containing instructions and at least one processor coupled to the at least one memory, wherein the at least one processor is configured to: receive a first key identifier from a user device, send the first key identifier to an authentication server function, receive from the authentication server function a first extended application key and an indication that the user device is using the extended key identifier, send a response to the user device including a request for an updated key identifier, receive a second key identifier from the user device, send the second key identifier to the authentication server function, receive a second extended application key from the authentication server function, and communicate with the user device based on the second extended application key.

[0009]

[0009] In another example, a method for wireless communication includes generating an anchor key based on a key from an authentication server function, associating a count value with the anchor key, generating an extended key identifier based on the count value, and sending the extended key identifier to a remote application.

[0010]

[0010] As another example, a method for wireless communications includes receiving an anchor key and a key identifier associated with a user device from an authentication server function; receiving a first request for an application key from a remote application, the first request including the first key identifier; determining that the first key identifier is a first extended key identifier including a count value; generating a first extended application key based on the count value associated with the first extended key identifier; and sending the first extended application key and an indication that the user device is using the extended key identifier to the remote application.

[0011]

[0011] In another example, a method for wireless communication includes receiving a first key identifier from a user device, sending the first key identifier to an authentication server function, receiving from the authentication server function a first extended application key and an indication that the user device is using the extended key identifier, sending a response to the user device including a request for an updated key identifier, receiving a second key identifier from the user device, sending the second key identifier to the authentication server function, receiving a second extended application key from the authentication server function, and communicating with the user device based on the second extended application key.

[0012]

[0012] As another example, a non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to generate an anchor key based on a key from an authentication server function, associate a count value with the anchor key, generate an extended key identifier based on the count value, and send the extended key identifier to a remote application.

[0013]

[0013] In another example, a non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to receive an anchor key and a key identifier associated with a user device from an authentication server function, receive a first request for an application key from a remote application, the first request including the first key identifier, determine that the first key identifier is a first extended key identifier including a count value, generate a first extended application key based on the count value associated with the first extended key identifier, and send the first extended application key and an indication that the user device is using the extended key identifier to the remote application.

[0014]

[0014] As another example, a non-transitory computer-readable medium having stored thereon instructions that, when executed by at least one processor, cause the at least one processor, including at least one memory containing the instructions, and at least one processor coupled to the at least one memory and configured to receive a first key identifier from a user device, to send the first key identifier to an authentication server function, receive from the authentication server function the first extended application key and an indication that the user device is using the extended key identifier, send to the user device a response including a request for an updated key identifier, receive a second key identifier from the user device, send the second key identifier to the authentication server function, receive a second extended application key from the authentication server function, and communicate with the user device based on the second extended application key.

[0015]

[0015] In another example, an apparatus for wireless communications comprises: means for generating an anchor key based on a key from an authentication server function; means for associating a count value with the anchor key; means for generating an extended key identifier based on the count value; and means for sending the extended key identifier to a remote application.

[0016]

[0016] As another example, an apparatus for wireless communications comprising: means for receiving an anchor key and a key identifier associated with a user device from an authentication server function; means for receiving a first request for an application key from a remote application, the first request including the first key identifier; means for determining that the first key identifier is a first extended key identifier including a count value; means for generating a first extended application key based on the count value associated with the first extended key identifier; and means for sending the first extended application key and an indication that the user device is using the extended key identifier to the remote application.

[0017]

[0017] In another example, an apparatus for wireless communications comprises: means for receiving a first key identifier from a user device; means for sending the first key identifier to an authentication server function; means for receiving from the authentication server function a first extended application key and an indication that the user device is using the extended key identifier; means for sending to the user device a response including a request for an updated key identifier; means for receiving a second key identifier from the user device; means for sending the second key identifier to the authentication server function; means for receiving a second extended application key from the authentication server function; and means for communicating with the user device based on the second extended application key.

[0018] In another example, an apparatus for wireless communication is provided. The apparatus includes at least one memory including instructions and at least one processor coupled to the at least one memory. The at least one process may generate an anchor key based on an authentication server function key, associate a count value with the anchor key, generate a temporary device identifier based on the authentication server function key, generate an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier, and send the extended key identifier to a remote application.

[0019] In another example, a method for wireless communication is provided, the method including generating an anchor key based on an authentication server function key, associating a count value with the anchor key, generating a temporary device identifier based on the authentication server function key, generating an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier, and sending the extended key identifier to a remote application.

[0020] In another example, a non-transitory computer-readable medium is provided that stores instructions that, when executed by at least one processor, cause the at least one processor to generate an anchor key based on an authentication server function key, associate a count value with the anchor key, generate a temporary device identifier based on the authentication server function key, generate an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier, and send the extended key identifier to a remote application.

[0021] In another example, an apparatus for wireless communication is provided, the apparatus including: means for generating an anchor key based on an authentication server function key, means for associating a count value with the anchor key, means for generating a temporary device identifier based on the authentication server function key, means for generating an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier, and means for sending the extended key identifier to a remote application.

[0022] In some aspects, one or more of the devices described herein are, are part of, or include a mobile device (e.g., a mobile phone or so-called “smartphone,” a tablet computer, or other type of mobile device), a wearable device, an extended reality device (e.g., a virtual reality (VR) device, an augmented reality (AR) device, or a mixed reality (MR) device), a personal computer, a laptop computer, a video server, a television (e.g., a network-connected television), a vehicle (or a computing device or system in a vehicle), or other device. In some aspects, the device includes at least one camera for capturing one or more images or video frames. For example, the device may include a camera (e.g., an RGB camera) or multiple cameras for capturing one or more videos including one or more images and / or video frames. In some aspects, the device includes a display for displaying one or more images, videos, notifications, or other displayable data. In some aspects, the apparatus includes a transmitter configured to transmit one or more video frames and / or syntax data to at least one device over a transmission medium. In some aspects, the processor includes a neural processing unit (NPU), a central processing unit (CPU), a graphics processing unit (GPU), or other processing device or component.

[0023] The foregoing has outlined rather broadly the features and technical advantages of embodiments according to the present disclosure in order that the following Detailed Description may be better understood. Additional features and advantages will be described hereinafter. The concepts and specific examples disclosed may be readily utilized as a basis for modifying or designing other structures for carrying out the same purposes of the present disclosure. Such equivalent constructions do not depart from the scope of the appended claims. The nature of the concepts disclosed herein, both their organization and method of operation, together with associated advantages, will be better understood by considering the following description in conjunction with the accompanying figures. Each of the figures is provided for purposes of illustration and description, and not as a definition of the limits of the claims.

[0024] Although aspects are described in this disclosure by way of example with respect to some examples, those skilled in the art will understand that such aspects can be implemented in many different configurations and scenarios. The techniques described herein can be implemented using a variety of platform types, devices, systems, shapes, sizes, and / or packaging configurations. For example, some aspects can be implemented via integrated chip embodiments or other non-modular component-based devices (e.g., end-user devices, vehicles, communications devices, computing devices, industrial equipment, retail / purchasing devices, medical devices, and / or artificial intelligence devices). Aspects can be implemented in chip-level components, modular components, non-modular components, non-chip-level components, device-level components, and / or system-level components. Devices incorporating the described aspects and features may include additional components and features for implementing and practicing the claimed and described aspects. For example, transmitting and receiving wireless signals may include one or more components (e.g., hardware components including antennas, radio frequency (RF) chains, power amplifiers, modulators, buffers, processors, interleavers, summers, and / or analog summers) for analog and digital purposes. It is contemplated that aspects described herein may be practiced in a wide variety of devices, components, systems, distributed configurations, and / or end-user devices of various sizes, shapes, and configurations.

[0025]

[0025] Other objects and advantages associated with the embodiments disclosed herein will become apparent to those skilled in the art based on the accompanying drawings and detailed description. [Brief explanation of the drawings]

[0026]

[0026] Examples of various implementations are described in detail below with reference to the following drawings: [Figure 1]

[0027] 1 is a block diagram illustrating an embodiment of a wireless communication network, in accordance with some embodiments. [Figure 2]

[0028] 1 illustrates a design of a base station and a User Equipment (UE) device that enables transmission and processing of signals exchanged between the UE and the base station in accordance with some embodiments. [Figure 3]

[0029] FIG. 1 illustrates an example of a disaggregated base station, in accordance with some embodiments. [Figure 4]

[0030] FIG. 2 is a block diagram illustrating components of user equipment, according to some embodiments. [Figure 5]

[0031] 1 illustrates various exemplary aspects of data structures for a wireless communication network, according to some embodiments. [Figure 6]

[0032] 1 illustrates an example of a primary authentication and key derivation procedure according to an aspect of the present disclosure. [Figure 7]

[0033] 1 illustrates an example procedure for obtaining a KAF based on an AKMA key identifier (A-KID), according to an aspect of the present disclosure. [Figure 8]

[0034] FIG. 10 is a flow diagram of a process for AKMA application key refresh according to an aspect of the disclosure. [Figure 9]

[0035] FIG. 10 is a flow diagram of a process for AKMA application key refresh according to an aspect of the disclosure. [Figure 10]

[0036] FIG. 10 is a flow diagram of a process for AKMA application key refresh according to an aspect of the disclosure. [Figure 11]

[0037] FIG. 1 illustrates an example of a computing system according to aspects of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0027]

[0038] Specific aspects and embodiments of the present disclosure are provided below. As will be apparent to one skilled in the art, some of these aspects and embodiments may be applied independently, and some of them may be applied in combination. In the following description, for purposes of explanation, specific details are set forth in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent that various embodiments can be practiced without these specific details. The figures and description are not intended to be limiting.

[0028]

[0039] The following description provides only exemplary embodiments and is not intended to limit the scope, applicability, or configuration of the present disclosure. Rather, the following description of exemplary embodiments will provide those skilled in the art with an enabling description for implementing the exemplary embodiments. It should be understood that various changes may be made in the function and arrangement of elements without departing from the spirit and scope of the present application, as set forth in the appended claims.

[0029]

[0040] In some cases, a wireless device, such as a user equipment (UE), may access an application function (AF) of a wireless network. The AF may include services of the wireless network, such as video streaming services, vehicle-to-everything (V2X) services, extended reality (XR) services, network applications, etc. In some wireless networks, a UE may be authenticated with the wireless network through a primary authentication procedure. As part of the primary authentication process, a specific authentication key may be generated, for example, by the UE and an authentication server function (AUSF) of the wireless network.

[0030]

[0041] An example of an authentication key is an anchor key (e.g., an Authentication and Key Management for Applications (AKMA) anchor key (K AKMA ) or other types of anchor keys). AKMA The AKMA Application Key (K or other anchor key) may be a root cryptographic key from which other keys may be derived. For example, other keys may be derived from the anchor key. An example of a key that may be derived from the anchor key may include an application key, which may be associated with a key identifier used to identify an application key and / or a temporary device identifier. The application key may be a cryptographic key that may be used for communication with the AF. The AKMA Application Key (K AF ) is an example of an application key, and (K AF An AKMA key identifier (A-KID) that can be used to identify a device (as an example of an application key) is an example of a key identifier, and an AKMA temporary UE identifier (A-TID) is an example of a temporary device identifier. AF , A-KID (as an example of a key identifier), and AKMA Temporary UE Identifier (A-TID) (as an example of a temporary device identifier) ​​are used to AKMA In some cases, the A-KID may include the A-TID and a home network identifier.

[0031]

[0042] The AUSF may then send the derived key to the AF. AF ) can be used between the UE and the AF. Therefore, an application key (e.g., K AF ) may be a cryptographic key that may be used for communication between the UE and the AF. In some cases, a specific application key (e.g., K AF ), once derived, may not be refreshed except through another primary authentication procedure. In some cases, an application key (e.g., K AF) can be refreshed.

[0032]

[0043] Application key refresh (e.g., AKMA application key (K)) using an extended key identifier (e.g., extended A-KID) AF Described herein are systems, apparatus, electronic devices, methods (also called processes), and computer-readable media (collectively referred to herein as "systems and techniques") for application key refresh (e.g., K AF refresh) and possibly generate an anchor key (K AKMA ) and key identifier (e.g., A-KID) may be extended to include a count value. This count value is used to identify the extended application key (e.g., extended K AF ) may be used to refresh the application key (e.g., K AF ) can be refreshed. The extended key identifier (e.g., A-KID) is used to identify the application key (e.g., K AF ), and may include a truncated portion of the temporary device identifier (e.g., A-TID), e.g., a portion shorter than the entire A-TID, along with the count value and the home network identifier. For example, the A-TID of an unextended A-KID may be 256 bits long, while the truncated portion of the A-TID may be 128 bits long.

[0033]

[0044] In some cases, the count value included in the key identifier (e.g., A-KID) may be encrypted. The count value may be encrypted based on a first function. For example, the encrypted count value may be determined by XORing the count value with the output of the first function. The first function may be based on an anchor key (e.g., K AKMA ) derived from the key (e.g., K encThe MAC may be a key derivation function (KDF) with parameters that may include an anchor key (e.g., K), an identifier for the application function being accessed, and / or a message authentication code (MAC). The MAC may be a relatively short authentication and / or integrity check value / message that helps verify the sender and / or integrity of a message, and the MAC may be updated whenever the key containing the MAC is updated. The MAC may be generated based on a second function, which may be a KDF with a set of parameters. The parameters for the second function may include an anchor key (e.g., K AKMA ) derived from the key (e.g., K mac ), a temporary device identifier (e.g., A-TID), and / or an identifier of the application feature being accessed.

[0034]

[0045] In some cases, the AF may request an application key (e.g., K AF ) may be refreshed. For example, an instruction to refresh the key identifier may be received from a remote application, such as the AF. AF ) may be incremented, and the count value of the extended application key (e.g., extended K AF ) may be refreshed based on the incremented count value. A key identifier (e.g., A-KID) may also be refreshed based on the incremented count value. The refreshed key identifier (e.g., refreshed A-KID) may be sent to the remote application. An application key (e.g., K AF ) to derive an application key (e.g., K AF ) is obtained through a primary authentication process or similar, and an anchor key (e.g., K AKMA ) can be refreshed without having to update the

[0035]

[0046] Additional aspects of the disclosure are described in more detail below.

[0036]

[0047] Wireless networks are being deployed to provide various communication services such as voice, video, packet data, messaging, broadcast, and the like. Wireless networks may support both access links for communication between wireless devices. An access link may refer to any communication link between a client device (e.g., a user equipment (UE), station (STA), or other client device) and a base station (e.g., a 3GPP gNodeB (gNB) for 5G / NR, a 3GPP eNodeB (eNB) for LTE, a Wi-Fi access point (AP), or other base station) or a component of a disaggregated base station (e.g., a central unit, a distributed unit, and / or a radio unit, etc.). In one embodiment, the access link between the UE and the 3GPP gNB may be over the Uu interface. In some cases, the access link may support uplink signaling, downlink signaling, attachment procedures, etc.

[0037]

[0048] In some aspects, the wireless communication network may be implemented using one or more modulation schemes. For example, the wireless communication network may be implemented using a quadrature amplitude modulation (QAM) scheme such as 16QAM, 32QAM, 64QAM, etc.

[0038]

[0049] The terms “user equipment” (UE) and “network entity,” as used herein, are not intended to be specific or otherwise limited to any particular radio access technology (RAT) unless otherwise specified. Generally, a UE can be any wireless communication device (e.g., a mobile phone, a router, a tablet computer, a laptop computer, and / or a tracking device, etc.), wearable (e.g., a smart watch, smart glasses, a wearable ring, and / or an extended reality (XR) device, such as a virtual reality (VR) headset, an augmented reality (AR) headset or glasses, or a mixed reality (MR) headset), vehicle (e.g., an automobile, a motorcycle, a bicycle, etc.), and / or Internet of Things (IoT) device, etc., used by a user to communicate over a wireless communication network. A UE may be mobile or may be stationary (e.g., at a given time) and may communicate with a radio access network (RAN). As used herein, the term "UE" may be referred to interchangeably as an "access terminal" or "AT," "client device," "wireless device," "subscriber device," "subscriber terminal," "subscriber station," "user terminal" or "UT," "mobile device," "mobile terminal," "mobile station," or variations thereof. Generally, a UE may communicate with a core network via a RAN, through which the UE may connect to external networks such as the Internet and to other UEs. Of course, other mechanisms for connecting to a core network and / or the Internet are also possible for a UE, such as via a wired access network, a wireless local area network (WLAN) network (e.g., based on the IEEE 802.11 communications standard, etc.).

[0039]

[0050] The network entity may be implemented in a centralized or monolithic base station architecture, or alternatively, in a disaggregated base station architecture, and may include one or more of a central unit (CU), a distributed unit (DU), a radio unit (RU), a near-real time (Near-RT) RAN Intelligent Controller (RIC), or a non-real time (Non-RT) RIC. A base station (e.g., having a centralized / monolithic or disaggregated base station architecture) may operate according to one of several RATs when communicating with UEs, depending on the network in which it is deployed, and may also be referred to alternatively as an access point (AP), network node, Node B (NB), evolved Node B (eNB), next generation eNB (ng-eNB), New Radio (NR) Node B (also referred to as gNB or gNode B), etc. A base station may be primarily used to support wireless access by UEs, including supporting data, voice, and / or signaling connections for the supported UEs. In some systems, the base station may provide edge node signaling functionality, while in other systems, the base station may provide additional control and / or network management functionality. A communication link through which a UE may send signals to a base station is called an uplink (UL) channel (e.g., a reverse traffic channel, a reverse control channel, an access channel, etc.). A communication link through which a base station may send signals to a UE is called a downlink (DL) channel or a forward link channel (e.g., a paging channel, a control channel, a broadcast channel, a forward traffic channel, etc.).As used herein, the term traffic channel (TCH) may refer to either an uplink channel, a reverse channel, or a downlink and / or forward traffic channel.

[0040]

[0051] The term "network entity" or "base station" (e.g., having an aggregated / monolithic base station architecture or a disaggregated base station architecture) may refer to a single physical transmit receive point (TRP) or multiple physical TRPs, which may be collocated or not. For example, when the term "network entity" or "base station" refers to a single physical TRP, the physical TRP may be an antenna of the base station corresponding to a cell (or several cell sectors) of the base station. When the term "network entity" or "base station" refers to multiple collocated physical TRPs, the physical TRPs may be an array of antennas of the base station (e.g., as in a multiple-input multiple-output (MIMO) system or when the base station employs beamforming). When the term "base station" refers to multiple non-co-located physical TRPs, those physical TRPs may be a distributed antenna system (DAS) (a network of spatially separated antennas connected to a common source via a transport medium) or a remote radio head (RRH) (a remote base station connected to a serving base station). Alternatively, the non-co-located physical TRPs may be a serving base station that receives measurement reports from a UE and a neighboring base station whose reference radio frequency (RF) signal (or simply "reference signal") the UE is measuring. Because a TRP is a point from which a base station transmits and receives wireless signals, as used herein, references to transmission from or reception at a base station should be understood as referring to a particular TRP of the base station.

[0041]

[0052] In some implementations that support UE positioning, a network entity or base station may not support wireless access by the UE (e.g., may not support data, voice, and / or signaling connections for the UE), but instead may transmit reference signals to the UE to be measured by the UE and / or may receive and measure signals transmitted by the UE. Such a base station may be referred to as a positioning beacon (e.g., if it transmits signals to the UE) and / or a location measurement unit (e.g., if it receives and measures signals from the UE).

[0042]

[0053] An RF signal includes electromagnetic waves of a given frequency that transmit information through space between a transmitter and a receiver. As used herein, a transmitter may transmit a single "RF signal" or multiple "RF signals" to a receiver. However, due to the propagation characteristics of RF signals through a multipath channel, the receiver may receive multiple "RF signals" corresponding to each transmitted RF signal. The same RF signal transmitted over different paths between a transmitter and a receiver may be referred to as a "multipath" RF signal. As used herein, an RF signal may also be referred to as a "wireless signal" or simply a "signal" when it is clear from the context that the term "signal" refers to a wireless signal or an RF signal.

[0043]

[0054] Various aspects of the systems and techniques described herein are discussed below with reference to the figures. In accordance with various aspects, FIG. 1 illustrates an example of a wireless communication system 100. The wireless communication system 100 (sometimes referred to as a wireless wide area network (WWAN)) may include various base stations 102 and various UEs 104. In some aspects, the base stations 102 may also be referred to as “network entities” or “network nodes.” One or more of the base stations 102 may be implemented in an aggregated base station architecture or a monolithic base station architecture. Additionally or alternatively, one or more of the base stations 102 may be implemented in a non-aggregated base station architecture and may include one or more of a central unit (CU), a distributed unit (DU), a radio unit (RU), a near-real-time (Near-RT) RAN intelligent controller (RIC), or a non-real-time (Non-RT) RIC. The base stations 102 may include macrocell base stations (high-power cellular base stations) and / or small cell base stations (low-power cellular base stations). In one aspect, the macrocell base stations may include eNBs and / or ng-eNBs when the wireless communication system 100 supports a Long Term Evolution (LTE) network, or gNBs when the wireless communication system 100 supports an NR network, or a combination of both, and the small cell base stations may include femtocells, picocells, microcells, etc.

[0044]

[0055] The base stations 102 collectively form a RAN and can interface with a core network 170 (e.g., evolved packet core (EPC) or 5G core (5G core, 5GC)) through backhaul links 122, and through the core network 170 to one or more location servers 172 (which may be part of the core network 170 or may be external to the core network 170). In addition to other functions, the base stations 102 may perform functions related to one or more of the following: forwarding user data, radio channel encryption and decryption, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity), inter-cell interference coordination, connection setup and release, load balancing, non-access stratum (NAS) message delivery, NAS node selection, synchronization, RAN sharing, multimedia broadcast multicast service (MBMS), subscriber and equipment tracing, RAN information management (RIM), paging, positioning, and alert message delivery. The base stations 102 can communicate with each other directly or indirectly (e.g., through EPC or 5GC) via backhaul links 134, which may be wired and / or wireless.

[0045]

[0056] The base stations 102 may wirelessly communicate with the UEs 104. Each of the base stations 102 may provide communication coverage for a respective geographic coverage area 110. In one aspect, one or more cells may be supported by the base stations 102 within each coverage area 110. A "cell" is a logical communication entity used for communication with a base station (e.g., over some frequency resource, referred to as a carrier frequency, component carrier, carrier, band, etc.) and may be associated with an identifier (e.g., a physical cell identifier (PCI), a virtual cell identifier (VCI), a cell global identifier (CGI)) to distinguish between cells operating over the same or different carrier frequencies. In some cases, different cells may be configured according to different protocol types (e.g., machine-type communication (MTC), narrowband IoT (NB-IoT), enhanced mobile broadband (eMBB), or others) that may provide access to different types of UEs. Because a cell is supported by a particular base station, the term "cell" can refer to either or both of the logical communication entity and the base station that supports it, depending on the context. Additionally, because a TRP is typically the physical transmission point of a cell, the terms "cell" and "TRP" are sometimes used interchangeably. In some cases, the term "cell" can also refer to the geographic coverage area (e.g., sector) of a base station, so long as the carrier frequency can be detected and used for communication within some portion of the geographic coverage area 110.

[0046]

[0057] The geographic coverage areas 110 of neighboring macrocell base stations 102 may partially overlap (e.g., in handover regions), and some of the geographic coverage areas 110 may be significantly overlapped by larger geographic coverage areas 110. For example, a small cell base station 102' may have a coverage area 110' that significantly overlaps with the coverage area 110 of one or more macrocell base stations 102. A network including both small cell and macrocell base stations is sometimes known as a heterogeneous network. A heterogeneous network may also include home eNBs (HeNBs), which may serve closed groups known as closed subscriber groups (CSGs).

[0047]

[0058] The communication link 120 between the base station 102 and the UE 104 may include uplink (also referred to as reverse link) transmissions from the UE 104 to the base station 102 and / or downlink (also referred to as forward link) transmissions from the base station 102 to the UE 104. The communication link 120 may use MIMO antenna techniques, including spatial multiplexing, beamforming, and / or transmit diversity. The communication link 120 may be over one or multiple carrier frequencies. Carrier allocation may be asymmetric with respect to the downlink and uplink (e.g., the downlink may be allocated more or fewer carriers than the uplink).

[0048]

[0059] The wireless communication system 100 may further include a WLAN AP 150 that communicates with WLAN stations (STAs) 152 via communication links 154 in an unlicensed frequency spectrum (e.g., 5 gigahertz (GHz)). When communicating in the unlicensed frequency spectrum, the WLAN STAs 152 and / or the WLAN AP 150 may perform a clear channel assessment (CCA) or listen before talk (LBT) procedure before communicating to determine whether a channel is available. In some examples, the wireless communication system 100 may include devices (e.g., UEs, etc.) that communicate with one or more UEs 104, base stations 102, APs 150, etc., utilizing an ultra-wideband (UWB) spectrum. The UWB spectrum may be in the 3.1 to 10.5 GHz range.

[0049]

[0060] The small cell base station 102' may operate in a licensed and / or unlicensed frequency spectrum. When operating in an unlicensed frequency spectrum, the small cell base station 102' may utilize LTE or NR technology and employ the same 5 GHz unlicensed frequency spectrum used by the WLAN AP 150. By employing LTE and / or 5G in the unlicensed frequency spectrum, the small cell base station 102' may enhance coverage to and / or increase capacity of the access network. NR in the unlicensed spectrum may be referred to as NR-U. LTE in the unlicensed spectrum may be referred to as LTE-U, licensed assisted access (LAA), or MultiFire.

[0050]

[0061] The wireless communication system 100 may further include a millimeter wave (mmW) base station 180 that may operate at millimeter wave and / or sub-mmW frequencies and communicate with the UE 182. The mmW base station 180 may be implemented in an aggregated or monolithic base station architecture, or alternatively in a non-aggregated base station architecture (e.g., including one or more of a CU, DU, RU, Near-RT RIC, or Non-RT RIC). Extremely high frequency (EHF) is a portion of RF in the electromagnetic spectrum. EHF has a range of 30 GHz to 300 GHz and a wavelength of 1 millimeter to 10 millimeters. Radio waves within this band may be referred to as millimeter waves. Sub-mmW may go down to frequencies of 3 GHz, with a wavelength of 100 millimeters. The super high frequency (SHF) band ranges from 3 GHz to 30 GHz and is also referred to as centimeter waves. Communications using mmW and / or quasi-mmW radio frequency bands have high path loss and relatively short distances. The mmW base station 180 and the UE 182 can utilize beamforming (transmit and / or receive) over the mmW communication link 184 to compensate for the extremely high path loss and short distances. It will be further understood that in alternative configurations, one or more base stations 102 can also transmit using mmW or quasi-mmW and beamforming. Accordingly, it will be understood that the above illustrations are merely examples and should not be construed as limiting various aspects disclosed herein.

[0051]

[0062] In some aspects related to 5G, the frequency spectrum in which wireless network nodes or entities (e.g., base stations 102 / 180, UEs 104 / 182) operate is categorized into multiple frequency ranges: FR1 (450-6000 Megahertz (MHz)), FR2 (24250-52600 MHz), FR3 (above 52600 MHz), and FR4 (between FR1 and FR2). In a multi-carrier system such as 5G, one of the carrier frequencies is referred to as the "primary carrier" or "anchor carrier" or "primary serving cell" or "PCell," and the remaining carrier frequencies are referred to as "secondary carriers" or "secondary serving cells" or "SCells." In carrier aggregation, the anchor carrier is the carrier operating on the primary frequency (e.g., FR1) utilized by the UE 104 / 182 and is the cell in which the UE 104 / 182 either performs an initial radio resource control (RRC) connection establishment procedure or initiates an RRC connection re-establishment procedure. The primary carrier carries all common and UE-specific control channels and may be a carrier in licensed frequencies (although this is not always the case). The secondary carrier is a carrier operating on a second frequency (e.g., FR2) that may be configured once an RRC connection is established between the UE 104 and the anchor carrier and may be used to provide additional radio resources. In some cases, the secondary carrier may be a carrier in unlicensed frequencies. Because both the primary uplink carrier and the primary downlink carrier are typically UE-specific, the secondary carrier should contain only necessary signaling information and signals; for example, there should be no UE-specific signaling information and signals in the secondary carrier. This means that different UEs 104 / 182 in a cell may have different downlink primary carriers. The same applies to the uplink primary carrier. The network can change the primary carrier of any UE 104 / 182 at any time.This is done, for example, to balance the load on different carriers. Since a "serving cell" (whether a PCell or an SCell) corresponds to the carrier frequency and / or component carrier on which a base station is communicating, terms such as "cell", "serving cell", "component carrier", "carrier frequency", etc. may be used interchangeably.

[0052]

[0063] For example, still referring to FIG. 1 , one of the frequencies utilized by the macrocell base station 102 may be an anchor carrier (or “PCell”), and other frequencies utilized by the macrocell base station 102 and / or the mmW base station 180 may be secondary carriers (“SCells”). In carrier aggregation, the base station 102 and / or the UE 104 may use up to Yx MHz of spectrum in total (x component carriers), with a bandwidth of up to Y MHz (e.g., 5, 10, 15, 20, 100 MHz) per carrier, for transmission in each direction. The component carriers may or may not be adjacent to each other in the frequency spectrum. Carrier allocation may be asymmetric with respect to the downlink and uplink (e.g., the downlink may be allocated more or fewer carriers than the uplink). Simultaneous transmission and / or reception of multiple carriers allows the UE 104 / 182 to significantly increase its data transmission and / or data reception rates. For example, two 20 MHz carriers bundled together in a multi-carrier system would theoretically provide a two-fold increase in data rate (i.e., 40 MHz) over the data rate achieved by a single 20 MHz carrier.

[0053]

[0064] To operate on multiple carrier frequencies, the base station 102 and / or the UE 104 may be equipped with multiple receivers and / or transmitters. For example, the UE 104 may have two receivers, "Receiver 1" and "Receiver 2," where "Receiver 1" is a multi-band receiver that can tune to band (i.e., carrier frequency) "X" or band "Y," and "Receiver 2" is a one-band receiver that can tune only to band "Z." In this example, if the UE 104 is served in band "X," band "X" would be referred to as the PCell or active carrier frequency, and "Receiver 1" would need to tune from band "X" to band "Y" (SCell) to measure band "Y" (or vice versa). In contrast, the separate "Receiver 2" allows the UE 104 to measure band "Z" without interrupting service on band "X" or band "Y," regardless of whether the UE 104 is served in band "X" or band "Y."

[0054]

[0065] Wireless communication system 100 may further include UE 164, which may communicate with macrocell base station 102 via communication link 120 and / or with mmW base station 180 via mmW communication link 184. For example, macrocell base station 102 may support a PCell and one or more SCells for UE 164, and mmW base station 180 may support one or more SCells for UE 164.

[0055]

[0066] The wireless communication system 100 may further include one or more UEs, such as UE 190, that indirectly connect to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links (referred to as “sidelinks”). In the example of FIG. 1, the UE 190 has a D2D P2P link 192 with one of the UEs 104 connected to one of the base stations 102 (e.g., through which the UE 190 may indirectly obtain cellular connectivity), and a D2D P2P link 194 with a WLAN STA 152 connected to the WLAN AP 150 (through which the UE 190 may indirectly obtain WLAN-based Internet connectivity). In one example, the D2D P2P links 192 and 194 may be supported using any known D2D RAT, such as LTE Direct (LTE-D), Wi-Fi Direct (Wi-Fi-D), Bluetooth®, etc.

[0056]

[0067] 2 shows a block diagram of a design of a base station 102 and a UE 104 that enables transmission and processing of signals exchanged between the UE and the base station in accordance with some aspects of the present disclosure. Design 200 includes components of a base station 102 and a UE 104, which may be one of the base stations 102 and one of the UEs 104 in FIG. 1. The base station 102 may be equipped with T antennas 234a through 234t, and the UE 104 may be equipped with R antennas 252a through 252r, where in general, T≧1 and R≧1.

[0057]

[0068] At base station 102, transmit processor 220 may receive data for one or more UEs from data source 212, select one or more modulation and coding schemes (MCS) for each UE based at least in part on the channel quality indicators (CQIs) received from that UE, process (e.g., encode and modulate) the data for each UE based at least in part on the MCS selected for that UE, and provide data symbols for all UEs. Transmit processor 220 may also process system information (e.g., related to semi-static resource partitioning information (SRPI) etc.) and control information (e.g., CQI requests, grants, upper layer signaling, etc.) and provide overhead symbols and control symbols. The transmit processor 220 may also generate reference symbols for a reference signal (e.g., a cell-specific reference signal (CRS)) and a synchronization signal (e.g., a primary synchronization signal (PSS) or a secondary synchronization signal (SSS)). The transmit (TX) multiple-input multiple-output (MIMO) processor 230 may perform spatial processing (e.g., precoding) on ​​the data symbols, control symbols, overhead symbols, and / or reference symbols, if applicable, and may provide T output symbol streams to T modulators (MODs) 232a through 232t. The modulators 232a through 232t are shown as combined modulator-demodulators (MOD-DEMOD). In some cases, the modulators and demodulators may be separate entities.Each modulator at modulators 232a through 232t may process a respective output symbol stream to obtain an output sample stream, e.g., for orthogonal frequency-division multiplexing (OFDM) techniques. Each modulator at modulators 232a through 232t may further process (e.g., convert to analog, amplify, filter, and upconvert) the output sample stream to obtain a downlink signal. T downlink signals may be transmitted from modulators 232a through 232t via T antennas 234a through 234t, respectively. According to certain aspects described in more detail below, synchronization signals may be generated using location coding to convey additional information.

[0058]

[0069] At the UE 104, the antennas 252a through 252r may receive downlink signals from the base station 102 and / or other base stations and may provide received signals to demodulators (DEMODs) 254a through 254r, respectively. The demodulators 254a through 254r are shown as combined modulator-demodulator (MOD-DEMOD) components. In some cases, the modulators and demodulators may be separate components. Each demodulator of the demodulators 254a through 254r may condition (e.g., filter, amplify, downconvert, and digitize) the received signal to obtain input samples. Each demodulator of the demodulators 254a through 254r may further process the input samples (e.g., for OFDM, etc.) to obtain received symbols. A MIMO detector 256 may obtain received symbols from all R demodulators 254a through 254r, perform MIMO detection on the received symbols, if applicable, and provide detected symbols. The receive processor 258 may process (e.g., demodulate and decode) the detected symbols, provide decoded data for the UE 104 to a data sink 260, and provide decoded control and system information to the controller / processor 280. The channel processor may determine a reference signal received power (RSRP), a received signal strength indicator (RSSI), a reference signal received quality (RSRQ), a channel quality indicator (CQI), etc.

[0059]

[0070] On the uplink, at the UE 104, the transmit processor 264 may receive and process data from a data source 262 and control information (e.g., for reports including RSRP, RSSI, RSRQ, CQI, etc.) from the controller / processor 280. The transmit processor 264 may also generate reference symbols for one or more reference signals (e.g., based at least in part on a beta value or set of beta values ​​associated with the one or more reference signals). The symbols from the transmit processor 264, if applicable, may be precoded by a TX-MIMO processor 266, further processed by modulators 254a-254r (e.g., for DFT-s-OFDM, CP-OFDM, etc.), and transmitted to the base station 102. At the base station 102, uplink signals from the UE 104 and other UEs may be received by antennas 234a-t, processed by demodulators 232a-t, detected by a MIMO detector 236 if applicable, and further processed by a receive processor 238 to obtain decoded data and control information sent by the UE 104. The receive processor 238 may provide the decoded data to a data sink 239 and the decoded control information to a controller (processor) 240. The base station 102 may include a communication unit 244 and may communicate with a network controller 231 via the communication unit 244. The network controller 231 may include a communication unit 294, a controller / processor 290, and a memory 292.

[0060]

[0071] In some aspects, one or more components of the UE 104 may be included within a housing. The controller 240 of the base station 102, the controller / processor 280 of the UE 104, and / or any other components of FIG. 2 may implement one or more techniques associated with implicit UCI beta value determination for NR.

[0061]

[0072] The memory 242 and the memory 282 may store data and program codes, respectively, for the base station 102 and the UE 104. The scheduler 246 may schedule the UE for data transmission on the downlink, uplink, and / or sidelink.

[0062]

[0073] In some aspects, a communications system deployment, such as a 5G New Radio (NR) system, can be configured in multiple ways using various components or parts. In a 5G NR system or network, network equipment such as a network node, network entity, network mobility element, Radio Access Network (RAN) node, core network node, network element, or base station (BS), or one or more units (or one or more components) performing base station functionality, can be implemented in a centralized or disaggregated architecture. For example, a BS (such as a Node B (NB), evolved NB (eNB), NR BS, 5G NB, access point (AP), transmit / receive point (TRP), or cell) can be implemented as a centralized base station (also known as a standalone BS or monolithic BS) or a disaggregated base station.

[0063]

[0074] A centralized base station may be configured to utilize a radio protocol stack that is physically or logically integrated within a single RAN node. A disaggregated base station may be configured to utilize a protocol stack that is physically or logically distributed among two or more units (e.g., one or more centralized units (CUs), one or more distributed units (DUs), or one or more radio units (RUs)). In some aspects, a CU may be implemented within a RAN node, and one or more DUs may be co-located with the CU or alternatively geographically or virtually distributed across one or more other RAN nodes. A DU may be implemented to communicate with one or more RUs. Each of the CU, DU, and RU may also be implemented as a virtual unit, i.e., a virtual central unit (VCU), a virtual distributed unit (VDU), or a virtual radio unit (VRU).

[0064]

[0075] The operation of a base station type or network design may take into account the aggregation characteristics of base station functions. For example, a disaggregated base station may be utilized in an integrated access backhaul (IAB) network, an open radio access network (O-RAN, such as the network configuration supported by the O-RAN Alliance), or a virtualized radio access network (vRAN, also known as a cloud radio access network (C-RAN)). Disaggregation may include distributing functions across two or more units in different physical locations, as well as virtually distributing the functions of at least one unit, which may allow flexibility in network design. Various units of a disaggregated base station, or a disaggregated RAN architecture, may be configured for wired or wireless communication with at least one other unit.

[0065]

[0076] 3 shows a diagram illustrating the architecture of an exemplary disaggregated base station 300. The disaggregated base station 300 architecture may include one or more central units (CUs) 310, which may communicate directly with the core network 320 via a backhaul link or indirectly with the core network 320 through one or more disaggregated base station units (e.g., a near-real-time (Near-RT) RAN intelligent controller (RIC) 325 via an E2 link, or a non-real-time (Non-RT) RIC 315 associated with a Service Management and Orchestration (SMO) framework 305, or both). The CUs 310 may communicate with one or more distributed units (DUs) 330 via respective midhaul links, such as an F1 interface. The DUs 330 may communicate with one or more radio units (RUs) 340 via corresponding fronthaul links. The RUs 340 may communicate with corresponding UEs 104 via one or more radio frequency (RF) access links. In some implementations, a UE 104 may be served by multiple RUs 340 simultaneously.

[0066]

[0077] Each of the units, e.g., CU 310, DU 330, RU 340, quasi-RT RIC 325, non-RT RIC 315, and SMO framework 305, may include or be coupled to one or more interfaces configured to receive or transmit signals, data, or information (collectively, signals) over a wired or wireless transmission medium. Each of the units, or an associated processor or controller that provides instructions to the unit's communication interface, may be configured to communicate with one or more of the other units over a transmission medium. For example, a unit may include a wired interface configured to receive signals from or transmit signals to one or more of the other units over a wired transmission medium. Furthermore, the units may include a wireless interface, which may include a receiver, transmitter, or transceiver (e.g., a radio frequency (RF) transceiver) configured to receive, transmit, or transmit signals over a wireless transmission medium to one or more of the other units.

[0067]

[0078] In some aspects, the CU 310 can host one or more higher-layer control functions. Such control functions may include radio resource control (RRC), packet data convergence protocol (PDCP), service data adaptation protocol (SDAP), etc. Each control function may be implemented with an interface configured to communicate signals with other control functions hosted by the CU 310. The CU 310 may be configured to handle user plane functionality (i.e., Central Unit-User Plane (CU-UP)), control plane functionality (i.e., Central Unit-Control Plane (CU-CP)), or a combination thereof. In some implementations, the CU 310 may be logically divided into one or more CU-UP units and one or more CU-CP units. The CU-UP unit, when implemented in an O-RAN configuration, may communicate bidirectionally with the CU-CP unit via an interface, such as an E1 interface. The CU 310 may be implemented to communicate with the DU 330 as needed for network control and signaling.

[0068]

[0079] The DU 330 may correspond to a logical unit including one or more base station functions for controlling the operation of one or more RUs 340. In some aspects, the DU 330 may host one or more of a radio link control (RLC) layer, a medium access control layer, and one or more upper physical (PHY) layers (such as modules for forward error correction (FEC) encoding and decoding, scrambling, modulation and demodulation, etc.), at least in part according to a functional division such as that defined by the 3rd Generation Partnership Project (3GPP). In some aspects, the DU 330 may further host one or more lower PHY layers. Each layer (or module) may be implemented with an interface configured to communicate signals with other layers (and modules) hosted by the DU 330 or with a control function hosted by the CU 310.

[0069]

[0080] The lower layer functions may be implemented by one or more RUs 340. In some deployments, the RUs 340 controlled by the DU 330 may correspond to logical nodes hosting RF processing functions, lower PHY layer functions (such as performing fast Fourier transforms (FFTs), inverse FFTs (iFFTs), digital beamforming, physical random access channel (PRACH) extraction and filtering, etc.), or both, based at least in part on a functional division, such as a lower layer functional division. In such an architecture, the RUs 340 may be implemented to handle over-the-air (OTA) communications with one or more UEs 104. In some implementations, real-time and non-real-time aspects of control and user plane communications with the RUs 340 may be controlled by the corresponding DUs 330. In some scenarios, this configuration may enable the DUs 330 and CUs 310 to be implemented in a cloud-based RAN architecture, such as a vRAN architecture.

[0070]

[0081] The SMO framework 305 may be configured to support RAN deployment and provisioning of non-virtualized and virtualized network elements. For non-virtualized network elements, the SMO framework 305 may be configured to support deployment of dedicated physical resources for RAN coverage requirements, which may be managed via an operations and maintenance interface (such as an O1 interface). For virtualized network elements, the SMO framework 305 may be configured to interact with a cloud computing platform (such as an open cloud (O-cloud) 390) via a cloud computing platform interface (such as an O2 interface) to perform network element lifecycle management (such as to instantiate virtualized network elements). Such virtualized network elements may include, but are not limited to, the CU 310, DU 330, RU 340, and quasi-RT RIC 325. In some implementations, the SMO framework 305 may communicate with hardware aspects of a 4G RAN, such as an open eNB (O-eNB) 311, via the O1 interface. Additionally, in some implementations, the SMO framework 305 may communicate directly with one or more RUs 340 via an O1 interface. The SMO framework 305 may also include a non-RT RIC 315 configured to support the functionality of the SMO framework 305.

[0071]

[0082] The non-RT RIC 315 can be configured to include logic functions that enable non-real-time control and optimization of RAN elements and resources, artificial intelligence / machine learning (AI / ML) workflows including model training and updates, or policy-based guidance of applications / functions in the quasi-RT RIC 325. The non-RT RIC 315 can be coupled to or can communicate with the quasi-RT RIC 325 (e.g., via an A1 interface). The quasi-RT RIC 325 can be configured to include logic functions that enable near-real-time control and optimization of RAN elements and resources through data collection and action via interfaces (e.g., via an E2 interface) that connect one or more CUs 310, one or more DUs 330, or both, and the O-eNB to the quasi-RT RIC 325.

[0072]

[0083] In some implementations, the non-RT RIC 315 can receive parameters or external enrichment information from an external server to generate AI / ML models to be deployed in the quasi-RT RIC 325. Such information can be utilized by the quasi-RT RIC 325 and can be received at the SMO framework 305 or non-RT RIC 315 from non-network data sources or from network functions. In some embodiments, the non-RT RIC 315 or quasi-RT RIC 325 can be configured to adjust RAN behavior or performance. For example, the non-RT RIC 315 can employ AI / ML models to monitor long-term trends and patterns in performance and take corrective action through the SMO framework 305 (e.g., reconfiguration via O1) or through the creation of RAN management policies (e.g., A1 policies).

[0073]

[0084] 4 illustrates one embodiment of a computing system 470 of a wireless device 407. The wireless device 407 may include a client device such as a UE (e.g., UE 104, UE 152, UE 190) or other type of device (e.g., a station (STA) configured to communicate using a Wi-Fi interface) that may be used by an end user. For example, the wireless device 407 may include a mobile phone, a router, a tablet computer, a laptop computer, a tracking device, a wearable device (e.g., a smart watch, glasses, an extended reality (XR) device, such as a virtual reality (VR), an augmented reality (AR), or a mixed reality (MR) device), an Internet of Things (IoT), an access point, and / or another device configured to communicate over a wireless communications network. The computing system 470 includes software and hardware components that may be electrically or communicatively coupled (or may otherwise be in communication, as appropriate) via a bus 489. For example, the computing system 470 includes one or more processors 484. The one or more processors 484 may include one or more CPUs, ASICs, FPGAs, APs, GPUs, VPUs, NSPs, microcontrollers, special purpose hardware, any combination thereof, and / or other processing devices or systems. A bus 489 may be used by the one or more processors 484 to communicate between cores and / or with one or more memory devices 486.

[0074]

[0085] The computing system 470 may also include one or more memory devices 486, one or more digital signal processors (DSPs) 482, one or more subscriber identity modules (SIMs) 474, one or more modems 476, one or more wireless transceivers 478, one or more antennas 487, one or more input devices 472 (e.g., a camera, a mouse, a keyboard, a touch-sensitive screen, a touchpad, a keypad, a microphone, etc.), and one or more output devices 480 (e.g., a display, a speaker, a printer, etc.).

[0075]

[0086] In some aspects, computing system 470 may include one or more radio frequency (RF) interfaces configured to transmit and / or receive RF signals. In some examples, the RF interface may include components such as a modem 476, a wireless transceiver 478, and / or an antenna 487. The one or more wireless transceivers 478 may transmit and receive wireless signals (e.g., signals 488) via antenna 487 from one or more other devices, such as other wireless devices, network devices (e.g., base stations such as eNBs and / or gNBs, Wi-Fi access points (APs) such as routers, range extenders, etc.), cloud networks, etc. In some examples, computing system 470 may include multiple antennas or an antenna array that may facilitate simultaneous transmit and receive capabilities. Antenna 487 may be an omnidirectional antenna such that radio frequency (RF) signals can be received from and transmitted in all directions. Wireless signals 488 may be transmitted over a wireless network. The wireless network may be any wireless network, such as a cellular or telecommunications network (e.g., 3G, 4G, 5G, etc.), a wireless local area network (e.g., a Wi-Fi network), a Bluetooth™ network, and / or other network.

[0076]

[0087] In some embodiments, the wireless signal 488 can be transmitted directly to other wireless devices using sidelink communication (e.g., using a PC5 interface, using a DSRC interface, etc.). The wireless transceiver 478 can be configured to transmit RF signals for conducting sidelink communication via the antenna 487 in accordance with one or more transmit power parameters that can be associated with one or more coordination modes. The wireless transceiver 478 can also be configured to receive sidelink communication signals having different signal parameters from other wireless devices.

[0077]

[0088] In some examples, one or more wireless transceivers 478 may include an RF front end that includes one or more components such as an amplifier, a mixer (also called a signal multiplier) for signal downconversion, a frequency synthesizer (also called an oscillator) that provides signals to the mixer, a baseband filter, an analog-to-digital converter (ADC), one or more power amplifiers, etc. The RF front end may generally handle the selection of the wireless signal 488 and its conversion to a baseband or intermediate frequency, and may convert the RF signal to the digital domain, among other components.

[0078]

[0089] In some cases, computing system 470 may include a coding-decoding device (or CODEC) configured to encode and / or decode data transmitted and / or received using one or more wireless transceivers 478. In some cases, computing system 470 may include an encryption-decryption device or component configured to encrypt and / or decrypt data transmitted and / or received by one or more wireless transceivers 478 (e.g., according to the AES and / or DES standards).

[0079]

[0090] Each of the one or more SIMs 474 may securely store an international mobile subscriber identity (IMSI) number and associated keys assigned to a user of the wireless device 407. The IMSI and keys may be used to identify and authenticate a subscriber when accessing a network provided by a network service provider or operator associated with the one or more SIMs 474. The one or more modems 476 may modulate one or more signals to encode information for transmission using the one or more wireless transceivers 478. The one or more modems 476 may also demodulate signals received by the one or more wireless transceivers 478 to decode the transmitted information. In some examples, the one or more modems 476 may include a Wi-Fi modem, a 4G (or LTE) modem, a 5G (or NR) modem, and / or other types of modems. The one or more modems 476 and the one or more wireless transceivers 478 may be used to communicate data for the one or more SIMs 474.

[0080]

[0091] Computing system 470 may also include (and / or be in communication with) one or more non-transitory machine-readable storage media or devices (e.g., one or more memory devices 486), which may include, but are not limited to, local and / or network-accessible storage, disk drives, drive arrays, optical storage devices, solid-state storage devices such as RAM and / or ROM, which may be programmable, flash-updateable, etc. Such storage devices may be configured to implement any suitable data storage mechanism, including, but not limited to, various file systems, database structures, etc.

[0081]

[0092] In various embodiments, functions may be stored as one or more computer program products (e.g., instructions or code) in memory device 486 and executed by one or more processors 484 and / or one or more DSPs 482. Computing system 470 may also include software elements (e.g., located in one or more memory devices 486) including, for example, an operating system, device drivers, executable libraries, and / or other code such as one or more application programs, which may include computer programs that implement the functions provided by various embodiments and / or may be designed to implement the methods and / or to configure the systems described herein.

[0082]

[0093] Figures 5A-5D illustrate various example aspects of data structures for a wireless communication system, such as the wireless communication system 100 of Figure 1. Figures 5A-5D illustrate aspects of data structures for a wireless communication network, such as the wireless communication network 100 of Figure 1. In particular, Figure 5A is a diagram 500 illustrating an example first subframe in a 5G (e.g., 5G NR) frame structure, Figure 5B is a diagram 530 illustrating an example DL channel in the 5G subframe, Figure 5C is a diagram 550 illustrating an example second subframe in the 5G frame structure, and Figure 5D is a diagram 580 illustrating an example UL channel in the 5G subframe.

[0083]

[0094] In various aspects, the 5G frame structure may be frequency division duplex (FDD), where for a particular set of subcarriers (carrier system bandwidth), subframes within the set of subcarriers are dedicated to either DL or UL. The 5G frame structure may also be time division duplex (TDD), where for a particular set of subcarriers (carrier system bandwidth), subframes within the set of subcarriers are dedicated to both DL and UL. In the example provided by FIGS. 5A and 5C, the 5G frame structure is assumed to be TDD, subframe 4 is configured with (mostly DL) slot format 28, where D is DL, U is UL, and X is flexible with respect to use between DL / UL, and subframe 3 is configured with (mostly UL) slot format 34. While subframes 3 and 4 are shown with slot formats 34 and 28, respectively, any particular subframe may be configured with any of the various available slot formats 0 through 61. Slot formats 0 and 1 are all DL and UL, respectively. The other slot formats 2 to 61 contain a mix of DL symbols, UL symbols, and flexible symbols. The UE is configured with the slot format through a received slot format indicator (SFI) (either dynamically through DL control information (DCI) or semi-statically / statically through Radio Resource Control (RRC) signaling). Note that the following description also applies to the 5G frame structure, which is TDD.

[0084]

[0095] Other wireless communication technologies may have different frame structures and / or different channels. A frame (10 ms) may be divided into 10 equally sized subframes (1 ms). Each subframe may include one or more time slots. A subframe may also include a minislot, which may include 7, 4, or 2 symbols. In some examples, each slot may include 7 or 14 symbols, depending on the slot configuration.

[0085]

[0096] For example, in slot configuration 0, each slot may contain 14 symbols, and in slot configuration 1, each slot may contain 7 symbols. Symbols on the DL may be cyclic prefix (CP) OFDM (CP-OFDM) symbols. Symbols on the UL may be CP-OFDM symbols (for high-throughput scenarios) or discrete Fourier transform (DFT) spread OFDM (DFT-s-OFDM) symbols (also called single-carrier frequency division multiple access (SC-FDMA) symbols) (for power-limited scenarios, i.e., when limited to single-stream transmission).

[0086]

[0097] The number of slots in a subframe is based on the slot configuration and numerology. In slot configuration 0, different numerologies (μ) 0-5 allow 1, 2, 4, 8, 16, and 32 slots per subframe, respectively. In slot configuration 1, different numerologies 0-2 allow 2, 4, and 8 slots per subframe, respectively. Thus, for slot configuration 0 and numerology μ, there are 14 symbols / slot and 2μ slots / subframe. Subcarrier spacing and symbol length / duration are functions of numerology. Subcarrier spacing is 2 μ× 15 kHz, where μ is a numerology between 0 and 5. Thus, numerology μ=0 has a subcarrier spacing of 15 kHz, and numerology μ=5 has a subcarrier spacing of 480 kHz. The symbol length / duration is inversely proportional to the subcarrier spacing. Figures 5A-5D provide examples of slot configuration 0 with 14 symbols per slot and numerology μ=2 with 4 slots per subframe. The slot duration is 0.25 ms, the subcarrier spacing is 60 kHz, and the symbol duration is approximately 16.67 μs.

[0087]

[0098] A resource grid may be used to represent the frame structure. Each time slot contains resource blocks (RBs) (also called physical RBs (PRBs)), spanning 12 consecutive subcarriers. The resource grid is divided into multiple resource elements (REs). The number of bits carried by each RE depends on the modulation scheme.

[0088]

[0099] As shown in Figure 5A, some of the REs carry reference (pilot) signals (RS) for UEs (e.g., UE 104, UE 152, UE 190). The RSs may include demodulation RSs (DM-RSs) (shown as Rx for one particular configuration where 100x is the port number, but other DM-RS configurations are possible) and channel state information reference signals (CSI-RSs) for channel estimation at the UEs. The RSs may also include beam measurement RSs (BRSs), beam refinement RSs (BRRSs), and phase tracking RSs (PT-RSs).

[0089]

[0100] 5B shows an example of various DL channels within a subframe of a frame. The physical downlink control channel (PDCCH) carries DCI within one or more control channel elements (CCEs), each of which contains 9 RE groups (REGs), and each REG contains 4 consecutive REs within one OFDM symbol.

[0090]

[0101] A primary synchronization signal (PSS) may be present in symbol 2 of a particular subframe of a frame. The PSS is used by a UE (e.g., UE 104, UE 152, UE 190) to determine subframe / symbol timing and physical layer identification information.

[0091]

[0102] A secondary synchronization signal (SSS) may be present in symbol 4 of a particular subframe of a frame. The SSS is used by the UE to determine the group number of the physical layer cell identity and the timing of the radio frame.

[0092]

[0103] Based on the physical layer identity and the group number of the physical layer cell identity, the UE can determine the physical cell identifier (PCI). Based on the PCI, the UE can determine the location of the above-mentioned DM-RS. The physical broadcast channel (PBCH), which carries the master information block (MIB), may be logically grouped with the PSS and SSS to form a synchronization signal (SS) / PBCH block. The MIB provides the number of RBs in the system bandwidth and the system frame number (SFN). The physical downlink shared channel (PDSCH) carries user data, broadcast system information not transmitted over the PBCH, such as system information blocks (SIBs), and paging messages.

[0093]

[0104] As shown in FIG. 5C , some of the REs carry DM-RS (denoted as R for one particular configuration, although other DM-RS configurations are possible) for channel estimation at the base station. The UE may transmit DM-RS for the physical uplink control channel (PUCCH) and DM-RS for the physical uplink shared channel (PUSCH). The PUSCH DM-RS may be transmitted in the first one or two symbols of the PUSCH. The PUCCH DM-RS may be transmitted in different configurations depending on whether a short or long PUCCH is transmitted and on the specific PUCCH format used. The UE may transmit sounding reference signals (SRS). The SRS may be transmitted in the last symbol of a subframe. The SRS may have a comb structure, and the UE may transmit the SRS in one of the combs. The SRS may be used by the base station for channel quality estimation to enable frequency-dependent scheduling on the UL.

[0094]

[0105] 5D shows an example of various UL channels within a subframe of a frame. The PUCCH, in one configuration, may be arranged as shown. The PUCCH carries uplink control information (UCI), such as scheduling requests, channel quality indicators (CQIs), precoding matrix indicators (PMIs), rank indicators (RIs), and HARQ ACK / NACK feedback. The PUSCH carries data and, in addition, may be used to carry buffer status reports (BSRs), power headroom reports (PHRs), and / or UCIs.

[0095]

[0106] In some cases, certain wireless systems may include authentication systems. For example, certain cellular wireless systems, such as 5G systems, may include, among other procedures, a 5G-Authentication and Key Management (AKA) procedure. The 5G-AKA procedure may be a procedure in which a UE and a network mutually authenticate each other and derive encryption keys to protect data. In some cases, additional encryption keys may be derived based on the authentication procedure.

[0096]

[0107] FIG. 6 illustrates an example 600 of a primary authentication and key derivation procedure according to an aspect of the present disclosure. In some cases, prior to primary authentication 612, the UE 602 may transmit a temporary identifier or an encrypted persistent identifier, such as a 5G global unique identifier (5G-GUTI), to the network (not shown). In some cases, the transmission may be performed through a NAS signaling message. In example 600, the UE 602 may perform the primary authentication procedure 612 with an access and mobility management function (AMF) 604 and an authentication server function (AUSF) 606. The AUSF 606 may interact with a unified data manager (UDM) 608 to obtain authentication information, such as subscription credentials (e.g., AKA authentication vector) and an authentication method using a Nudm_UEAuthentication_Get Request service operation. In some cases, in a response 614 from the UDM 608 to the AUSF 606, the UDM 608 may obtain an AKMA anchor key (K) for the UE 602. AKMA ) should be generated. AKMA AKMA application function key (K AF ) for the UE. In some cases, a routing indicator (RID) may also be included in the response 614. AKMA If AUSF 606 receives an instruction that AUSF 606's authentication server function key K should be generated, AUSF 606 AUSF From KAKMA and an AKMA key identifier (A-KID) 616. AUSF is a specific K AKMA In some cases, the A-TID, or AKMA temporary UE identifier (e.g., temporary device identifier) ​​may also be used to derive the AUSF 606's key K. AUSF The A-TID may be included as part of the A-KID along with the home network identifier for the UE. AUSF may be derived, and the UE 602 may also AUSF From K AKMA and generate an A-KID 618. In some cases, the A-KID may be a specific K AKMA The AUSF 606 selects an AKMA anchor function (AAnF) 610 and associates the generated A-KID with the K AKMA The AAnF 610 may send an anchor key registration request 620 including the following to the AAnF 610. The AAnF 610 may store the information sent by the AUSF 606 and send an anchor key registration response 622 back to the AUSF 606.

[0097]

[0108] FIG. 7 illustrates a K-based A-KID according to an embodiment of the present disclosure. AF 7 shows an example procedure 700 for obtaining primary authentication and K AKMA After establishing 702 the A-KID, the UE 602 may initiate communication with an application function (AF) 704 (e.g., a remote application running on a server connected to a network such as the core network 170 of FIG. 1 ) by sending an application session establishment request message 706 to the AF 704, where the application session establishment request message 706 includes the A-KID. If the AF 704 does not have an active context associated with the A-KID, the AF 704 may establish a KID for the UE 602. AFTo request the A-KID, the AF 704 may send a message 708 (e.g., Naanf_AKMA_ApplicationKey_Get request) with the A-KID to the AAnF 610. The AF 704 also includes its identification information (AF_ID) in the request. In some cases, the AAnF 610 may AF If you don't already have AAnF610, AKMA From K AF AAnF 610 can then derive SUPI, K AF , and K AF The AF 704 may then send a response 712 (e.g., Naanf_AKMA_ApplicationKey_Get response) with an expiration time to the AF 704. AF The UE and AF 704 may then send an application session establishment response 714 to the UE, which includes K AF may be used to communicate securely via an encrypted protocol, such as via a transport layer security (TLS) tunnel or digest authentication.

[0098]

[0109] In some cases, K AF is a key derivation function (KDF) based on a set of parameters. AKMA For example, K AF uses three parameters along with the input key to generate K AKMA In some cases, the parameters may include FC, which may be equal to 0x82, P0, which may be equal to an AF identifier (AF_ID), and L0, which may be equal to the length of the AF_ID. In some cases, the AF_ID may be constructed based on the fully qualified domain name of the AF 704 and a specified Ua* security protocol identifier (e.g., an alphanumeric identifier of the security protocol being used). The input key to the KDF is K AKMAIn some cases, a KDF may be a predefined function that can generate a set of numbers (e.g., a key) based on a set of input parameters, where different parameter values ​​and the number of parameters in the set of parameters can be used to define the output of the KDF.

[0099]

[0110] In some cases, primary authentication is performed and a K key is used between the UE602 and the AF704. AF To generate K AKMA When is used, K AF may have a fixed value (e.g., K AF (The value of K remains the same until a new primary authentication procedure is performed.) In some cases, the primary authentication procedure may not be performed for a significant amount of time (e.g., multiple hours or multiple days), and the value of K may be increased to increase the communication security between the UE 602 and the AF 704. AF It may be helpful to refresh the AF may be used to establish a TLS connection with an application server on the network, with a different K for each session. AF Therefore, when a user accesses an application server, the user must have a first K for that session. AF If the session expires (e.g., times out, the user logs out, etc.) and the user accesses the application server again, the user may use a different second K for the second session. AF can be used.

[0100]

[0111] In some cases, K AF To extend the procedure for generating K AKMA may be modified to include an associated count value. For example, the count value may be K AKMA In some cases, the count value may be a number associated with K AKMA When A-KID, K is first generated by UE 602, it may be initially set to 0.AF Pair is K AKMA In some cases, the AAnF 610 may keep track of the highest count value received, and the AAnF 610 may increment the newly received K to ensure that the key is fresh (e.g., up-to-date). AKMA The AAnF 610 may check that the count value is higher than the stored count value. In some cases, the AAnF 610 may check the last few K counts received, for example to handle race conditions. AKMA The count value may be saved.

[0101]

[0112] In some cases, the UE 602 may AF The UE 602 may be provisioned to use an extended procedure for generating an A-KID with an associated count value. The UE 602 may include a universal subscriber identity module (USIM) and a mobile equipment (ME). For example, the UE 602 may receive instructions to use the extended A-KID from the USIM or from memory on the ME. AKMA In some cases, the AUSF 606 and AAnF 610 of the network may also be acquired with K AF and supports an extension procedure to generate an extended A-KID and an associated count value. AKMA If the device supports using the .

[0102]

[0113] In some cases, K AF The procedure for generating K (e.g., as shown in Figure 7) also AF can be refreshed. For example, AFA UE 602 that supports an extended procedure for generating an A-KID may send the extended A-KID to the AF 704 as part of the application session establishment request message 706. In some cases, the UE 602 may perform primary authentication (e.g., primary authentication procedure 612 of FIG. 6) and key derivation procedures (e.g., K AUSF From K AKMA The UE 602 may generate a normal A-KID during generating 618 the extended A-KID and the KID. The UE 602 may then decide to use the extended A-KID based on an instruction to use the extended A-KID, for example, from the USIM or from memory on the ME. The UE 602 may generate the extended A-KID and the KID before sending it to the AF 704 in the application session establishment request message 706. AF For example, the UE 602 may generate K AKMA The count value is incremented and the incremented count value is set to K. AF Add to generate and expand K AF , generate an extended A-KID, and include the extended K in the application session establishment request message 706. AF and may transmit the extended A-KID to the AF 704. In some cases, the UE 602 may decide to use the extended A-KID and generate the extended A-KID directly without first generating a regular A-KID. In such cases, the UE 602 may generate and transmit the extended A-KID in substantially the same manner as described above and below. By allowing the extended A-KID to include a count (e.g., a freshness parameter), the A-KID may be used to generate a fresh KID. AF can be used to derive

[0103]

[0114] In some cases, A-KID may be added to the new extended K AF (e.g., the extended K AF In some examples, a regular A-KID may be extended by including parameters such as a freshness parameter (e.g., a count value) that may be used to refresh the K AKMAThe A-TID may include a 256-bit A-TID derived from the A-TID. In some cases, an extended A-TID may be formed from the shortened A-TID. The extended A-TID may also include an encrypted count and / or a message authentication code (MAC). The shortened A-TID may be the first 128 bits of the A-TID. The encrypted count value may be 32 bits long and may be an encrypted version of the count value. The count value may be encrypted to prevent an eavesdropper from easily determining the count value. The encrypted count value may be determined by XORing the count value with the output of a first function. In some cases, the first function may be a KDF function having a set of parameters. The set of parameters for the first function may include a key K enc , MAC, and / or AF Identifier (AF_ID). In some cases, the set of parameters for the first function may also include an A-TID (e.g., either a regular A-KID or an extended A-KID). In some cases, K enc is K AKMA In some cases, the key K enc is K AKMA In some cases, the MAC may be 96 bits long. The MAC may be determined based on a second function. In some cases, the second function may be a KDF function having a set of parameters. The set of parameters for the second function may be K mac , A-TID, and / or AF_ID. mac K can also be derived statically using a KDF function. enc and K. mac The fixed set of parameters for deriving Λ may include different parameter values ​​and / or several parameters. Including the count value in the MAC allows the MAC to be updated when the count value is updated.

[0104]

[0115] In some cases, extended K AF is the count value along with KAKMA For example, the extended K AF The set of parameters for the KDF function used to generate ∑ may include parameters related to the count value. In some cases, the set of parameters may include a P1 parameter set to the count value and an L1 parameter set to the length of the count value.

[0105]

[0116] The AF 704 may send the extended A-KID to the AAnF 610, as shown in message 708. In some cases, the AAnF 610 may have previously received a regular A-KID for the UE 602 from the AUSF 606 in an anchor key registration request 620. The AAnF 610 may match a portion of the extended A-KID from the AF 704 with a stored regular A-KID and determine that the extended A-KID is being used. If the first 128 bits of the extended A-KID match the first 128 bits of the stored A-KID, the AAnF 610 may determine that the extended A-KID is being used. In some cases, the AAnF 610 may update the received KID to ensure that the key is fresh (e.g., up to date). AKMA The AAnF 610 may check that the count value is higher than the stored count value. Optionally, the AAnF 610 may XOR the encrypted count value that is part of the extended A-KID with the output of the first function to obtain the count value included in the extended A-KID. Optionally, the AAnF may also check the MAC value included in the extended A-KID.

[0106]

[0117] The AAnF610 uses the count value in the extended A-KID to generate a new extended K AF The AAnF 610 may derive 710 a new extended KID value in a response 712 along with an indication that the extended A-KID is being used by the UE. AF If the AF 704 is a legacy AF 704 that does not support the extended A-KID, the new extended K AFWhile still using the value, the indication that the UE is using the extended A-KID may be discarded or ignored by the legacy AF 704. If the AF 704 supports using the extended A-KID, the AF 704 may request a new extended A-KID from the UE 602 at any time. In some cases, the AF 704 may request a new A-KID in the application session establishment response 714. The UE 602 may send the K AKMA Increment the count associated with the new extension K AF The UE 602 may generate a new extended A-KID. The UE 602 may send a new application session establishment request message 706 based on the new A-KID. The AF 704 may then send the new extended A-KID to the AAnF 610 in message 708, and the AAnF 610 may send a new extended KID based on the new A-KID in response 712. AF The AF 704 may then return a response to the UE 602 in a new application session establishment response 714. The AF 704 may then return the new extension K AF An application session with the UE 602 may be established using the

[0107]

[0118] 8 is a flow diagram 800 of a process for AKMA application key refresh according to an aspect of the present disclosure. Process 800 may be performed by a computing device (or apparatus) or a component of a computing device (e.g., a chipset, a codec, etc.). The computing device may be a mobile device (e.g., a mobile phone), a network-connected wearable device such as a wristwatch, an extended reality (XR) device such as a virtual reality (VR) device or an augmented reality (AR) device, a vehicle or a vehicle component or system, a network component, or another type of computing device. The operations of process 800 may be implemented as software components running executed on one or more processors. In some cases, the computing device may include instructions, such as a configuration, that the UE may use enhanced privacy techniques, such as the techniques discussed according to aspects of the present disclosure.

[0108]

[0119] In block 802, the computing device (or a component thereof) may generate an anchor key based on a key from an authentication server function. In some cases, the computing device (or a component thereof) may determine to use an extended key identifier (e.g., an extended A-KID) based on instructions stored in at least one of a memory or a universal subscriber identity module.

[0109]

[0120] At block 804, the computing device (or a component thereof) may associate the count value with the anchor key.

[0110]

[0121] At block 806, the computing device (or a component thereof) may generate a temporary device identifier based on the authentication server function key.

[0111]

[0122] At block 808, the computing device (or a component thereof) may generate an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier. In some cases, the extended key identifier includes an encrypted count value. In some cases, the computing device (or a component thereof) may generate the encrypted count value based on the count value and a result from the first function. In some cases, the result from the first function is based on a first key derived from an anchor key. In some cases, the extended key identifier is further generated based on a message authentication code. In some examples, the message authentication code is further generated based on at least one of a portion of the temporary device identifier or an identifier of the remote application. In some cases, the message authentication code is generated based on a second key derived from the anchor key. In some cases, the computing device (or a component thereof) may determine to use the extended key identifier based on instructions stored in at least one of a memory or a universal subscriber identity module. In some examples, the portion of the temporary device identifier includes the first 128 bits of the temporary device identifier.

[0112]

[0123] At block 810, the computing device (or a component thereof) may send the extended key identifier to the remote application. In some cases, the computing device (or a component thereof) may receive an instruction to refresh the extended key identifier from the remote application, increment the count value based on the received instruction, generate a refreshed extended key identifier based on the incremented count value, and send the refreshed extended key identifier to the remote application. In some cases, the computing device (or a component thereof) may generate an application key for use with the remote application based on the anchor key and the count value.

[0113]

[0124] 9 is a flow diagram 900 of a process for AKMA application key refresh according to an aspect of the present disclosure. Process 900 may be performed by a computing device (or apparatus) or a component of a computing device (e.g., a chipset, a codec, etc.). The computing device may be a mobile device (e.g., a mobile phone), a network-connected wearable device such as a wristwatch, an extended reality (XR) device such as a virtual reality (VR) device or an augmented reality (AR) device, a vehicle or a vehicle component or system, a network component, or another type of computing device. The operations of process 900 may be implemented as software components running executed on one or more processors. In some cases, the computing device may include instructions, such as a configuration, that the UE may use enhanced privacy techniques, such as the techniques discussed according to aspects of the present disclosure.

[0114]

[0125] At block 902, the computing device (or a component thereof) may receive an anchor key and a key identifier associated with the user device from an authentication server function. At block 904, the computing device (or a component thereof) may receive a first request for an application key from a remote application, the first request including the first key identifier.

[0115]

[0126] At block 906, the computing device (or a component thereof) may determine that the first key identifier is a first extended key identifier that includes a count value. In some cases, the count value associated with the first extended key identifier includes an encrypted count value.

[0116]

[0127] At block 908, the computing device (or a component thereof) may generate a first extended application key based on a count value associated with the first extended key identifier. In some cases, an anchor key is associated with the initial count value. In some cases, the computing device (or a component thereof) may decrypt the encrypted count value based on the initial count value and a result from the first function. In some cases, the result from the first function is based on a first key derived from the anchor key. In some cases, the extended key identifier is further generated based on a message authentication code. In some cases, the message authentication code is generated based on a second key derived from the anchor key.

[0117]

[0128] In block 910, the computing device (or a component thereof) may send the first extended application key and an indication that the user device is using the extended key identifier to the remote application. In some cases, the computing device (or a component thereof) may receive a second request for an application key from the remote application, the second request including the second key identifier, determine that the second key identifier is a second extended key identifier, generate a second extended application key based on a count value associated with the second extended key identifier, and send the second extended application key to the remote application.

[0118]

[0129] 10 is a flow diagram 1000 of a process for AKMA application key refresh according to an aspect of the present disclosure. Process 1000 may be performed by a computing device (or apparatus) or a component of a computing device (e.g., a chipset, a codec, etc.). The computing device may be a mobile device (e.g., a mobile phone), a network-connected wearable device such as a wristwatch, an extended reality (XR) device such as a virtual reality (VR) device or an augmented reality (AR) device, a vehicle or a vehicle component or system, a network component, or another type of computing device. The operations of process 1000 may be implemented as software components running executed on one or more processors. In some cases, the computing device may include instructions, such as a configuration, that the UE may use enhanced privacy techniques, such as the techniques discussed according to aspects of the present disclosure.

[0119]

[0130] At block 1010, the computing device (or a component thereof) may receive a first key identifier from the user device. At block 1010, the computing device (or a component thereof) may send the first key identifier to an authentication server function. At block 1010, the computing device (or a component thereof) may receive from the authentication server function the first extended application key and an indication that the user device is using the extended key identifier.

[0120]

[0131] At block 1010, the computing device (or a component thereof) may send a response to the user device including a request for an updated key identifier. At block 1010, the computing device (or a component thereof) may receive a second key identifier from the user device. At block 1010, the computing device (or a component thereof) may send the second key identifier to the authentication server function.

[0121]

[0132] At block 1010, the computing device (or a component thereof) may receive a second extended application key from the authentication server function. At block 1010, the computing device (or a component thereof) may communicate with the user device based on the second extended application key.

[0122]

[0133] In some examples, the processes described herein (e.g., process 800, process 900, process 1000, and / or other processes described herein) may be performed by a computing device or apparatus (e.g., a UE or a base station). In another example, process 800, process 900, and / or process 1000 may be performed by components of UE 104, base station 102, and / or core network 170 of FIG. 1. In another example, process 800, process 800, process 900, and / or 1000 may be performed by a computing device having computing system 1100 shown in FIG. 11.

[0123]

[0134] Figure 11 illustrates an example of a system for implementing certain aspects of the present technology. In particular, Figure 11 illustrates an example of a computing system 1100, which may be, for example, an internal computing system, a remote computing system, a camera, or any computing device making up any of these components, the components of the system communicating with each other using a connection 1105. The connection 1105 may be a physical connection using a bus or a direct connection to a processor 1110, such as in a chipset architecture. The connection 1105 may also be a virtual connection, a networked connection, or a logical connection.

[0124]

[0135] In some embodiments, computing system 1100 is a distributed system, allowing the functionality described in this disclosure to be distributed across one data center, multiple data centers, within a peer network, etc. In some embodiments, one or more of the system components described represent many such components, each performing some or all of the functionality described with respect to that component. In some embodiments, the components may be physical or virtual devices.

[0125]

[0136] The exemplary system 1100 includes at least one processing unit (CPU or processor) 1110 and a connection 1105 that communicatively couples various system components to the processor 1110, including system memory 1115, such as read-only memory (ROM) 1120 and random access memory (RAM) 1125. The computing system 1100 may include a cache 1112 of high-speed memory that is directly connected to the processor 1110, connected in close proximity to the processor 1110, or integrated as part of the processor 1110.

[0126]

[0137] Processor 1110 may include any general-purpose processor, hardware or software services such as services 1132, 1134, and 1136 stored in storage device 1130 configured to control processor 1110, and special-purpose processors where software instructions are embedded in the actual processor design. Processor 1110 may essentially be a completely self-contained computing system including multiple cores or processors, buses, memory controllers, caches, etc. Multi-core processors may be symmetric or asymmetric.

[0127]

[0138] To enable user interaction, computing system 1100 includes input devices 1145, which may represent any number of input mechanisms, such as a microphone for speaking, a touch-sensitive screen for gesture or graphical input, a keyboard, a mouse, motion input, speech, etc. Computing system 1100 may also include output devices 1135, which may be one or more of several output mechanisms. In some instances, a multimodal system may enable a user to provide multiple types of input / output for communicating with computing system 1100.

[0128]

[0139] Computing system 1100 may include a communications interface 1140 that may generally manage and administer user input and system output. The communications interface may include audio jacks / plugs, microphone jacks / plugs, universal serial bus (USB) ports / plugs, Apple™ Lightning™ ports / plugs, Ethernet ports / plugs, fiber optic ports / plugs, proprietary wired ports / plugs, 3G, 4G, 5G, and / or other cellular data network wireless signal transmissions, Bluetooth™ wireless signal transmissions, Bluetooth™ low energy (BLE) wireless signal transmissions, IBEACON™ wireless signal transmissions, radio-frequency identification (RFID) wireless signal transmissions, near-field communications (NFC) wireless signal transmissions, dedicated short range communication (DSRC) wireless signal transmissions, 802.11 Wi-Fi wireless signal transmissions, wireless local area network (WLAN) signal transmissions, Visible Light Communication (VLC), and Worldwide Interoperability for Microwave The device may perform or facilitate the reception and / or transmission of wired or wireless communications using wired and / or wireless transceivers, including those utilizing WiMAX, Infrared (IR) communications wireless signal transmission, Public Switched Telephone Network (PSTN) signal transmission, Integrated Services Digital Network (ISDN) signal transmission, ad hoc network signal transmission, radio wave signal transmission, microwave signal transmission, infrared signal transmission, visible light signal transmission, ultraviolet light signal transmission, wireless signal transmission along the electromagnetic spectrum, or any combination thereof.Communications interface 1140 may also include one or more Global Navigation Satellite System (GNSS) receivers or transceivers used to determine the location of computing system 1100 based on reception of one or more signals from one or more satellites associated with one or more GNSS systems. GNSS systems include, but are not limited to, the U.S.-based Global Positioning System (GPS), the Russian-based Global Navigation Satellite System (GLONASS), the Chinese-based BeiDou Navigation Satellite System (BDS), and the European-based Galileo GNSS. There is no restriction to operating on any particular hardware configuration, and therefore, the basic features herein can be easily replaced as improved hardware or firmware configurations are developed.

[0129]

[0140] The storage device 1130 may be a non-volatile memory device and / or a non-transitory memory device and / or a computer readable memory device, such as a magnetic cassette, a flash memory card, a solid state memory device, a digital versatile disk, a cartridge, a floppy disk, a flexible disk, a hard disk, a magnetic tape, a magnetic strip / stripe, any other magnetic storage medium, a flash memory, a memristor memory, any other solid state memory, a compact disc read only memory (CD-ROM) optical disk, a rewritable compact disc (CD) optical disk, a digital video disk (DVD) optical disk, a blu-ray disc (BDD) optical disk, a holographic optical disk, another optical media, a secure digital (SD) card, a micro secure digital (microSD) card, a Memory Stick® card, a smart card chip, an EMV chip, a subscriber identity module (SIM) card, a mini / micro / nano / pico SIM card, another integrated circuit (ICC), circuit (IC) chip / card, random access memory (RAM), static RAM (SRAM), dynamic RAM (DRAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable ROM (EPROM), electrically erasable programmable read-only memory (EEPROM), flash EPROM, cache memory (e.g., level 1 (L1) cache, level 2 (L2) cache, level 3 (L3) cache, level 4 (L4) cache, level 5 (L5) cache, or other (L#) cache), resistive random-access memory (RRAM),The memory may be a hard disk or other type of computer-readable medium capable of storing data that is accessible by a computer, such as RRAM / ReRAM, phase change memory (PCM), spin transfer torque RAM (STT-RAM), another memory chip or cartridge, and / or any combination thereof.

[0130]

[0141] The storage devices 1130 may include software services, servers, services, etc., which, when code defining such software is executed by the processor 1110, cause the processor 1110 to perform functions on the system. In some embodiments, hardware services that perform a particular function may include software components stored in computer-readable media in association with hardware components, such as the processor 1110, connections 1105, output devices 1135, etc., necessary to perform that function. The term "computer-readable medium" includes, but is not limited to, portable or non-portable storage devices, optical storage devices, and various other media capable of storing, storing, or conveying instructions and / or data. Computer-readable media may include non-transitory media capable of storing data, which does not include carrier waves and / or ephemeral electronic signals propagating wirelessly or over wired connections. Examples of non-transitory media may include, but are not limited to, magnetic disks or tapes, optical storage media such as compact disks (CDs) or digital versatile disks (DVDs), flash memory, memories, or memory devices. Code and / or machine-executable instructions can be stored on a computer-readable medium, which can represent a procedure, a function, a subprogram, a program, a routine, a subroutine, a module, a software package, a class, or any combination of instructions, data structures, or program statements. A code segment can be coupled to another code segment or a hardware circuit by passing and / or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc. can be passed, forwarded, or transmitted via any suitable means including memory sharing, message passing, token passing, network transmission, etc.

[0131]

[0142] Although specific details have been provided in the foregoing description to provide a thorough understanding of the embodiments and examples provided herein, those skilled in the art will recognize that the present application is not limited thereto. Therefore, while exemplary embodiments of the present application have been described in detail herein, it should be understood that, except as limited by the prior art, the concepts of the present application may be variously embodied and employed in other manners, and the appended claims are intended to be construed to include such variations. The various features and aspects of the present application described above may be used individually or in combination. Furthermore, the embodiments may be utilized in any number of environments and applications other than those described herein without departing from the broader scope of the present application. Accordingly, the specification and drawings should be regarded as illustrative and not restrictive. For illustrative purposes, methods have been described in a particular order. It should be understood that in alternative embodiments, the methods may be performed in an order different from that described.

[0132]

[0143] For clarity of explanation, in some instances, the technology may be presented as including individual functional blocks, including devices, device components, and method steps or routines embodied in software or a combination of hardware and software. Additional components other than those shown in the figures and / or described herein may also be used. For example, circuits, systems, networks, processes, and other components may be shown as components in block diagram form so as not to obscure the embodiments in unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail so as to avoid obscuring the embodiments.

[0133]

[0144] Furthermore, those skilled in the art will understand that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the aspects disclosed herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or performed as software depends on the particular application and design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in various ways for each particular application, and such implementation decisions should not be interpreted as causing a departure from the scope of the present disclosure.

[0134]

[0145] Particular embodiments may be described above as a process or method that is depicted as a flowchart, a flow diagram, a data flow diagram, a structure diagram, or a block diagram. While a flowchart may describe operations as a sequential process, many of the operations may be performed in parallel or simultaneously. Moreover, the order of operations may be rearranged. A process terminates when its operations are completed, but may have additional steps not included in the figures. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination may correspond to a return of the function to the calling function or to the main function.

[0135]

[0146] The processes and methods according to the above-described examples may be implemented using computer-executable instructions stored on or otherwise available from a computer-readable medium. Such instructions may include, for example, instructions and data that cause a general-purpose computer, special-purpose computer, or processing device to perform a particular function or group of functions, or otherwise configure a general-purpose computer, special-purpose computer, or processing device to perform a particular function or group of functions. Portions of the computer resources used may be accessible over a network. The computer-executable instructions may be, for example, binary or intermediate format instructions such as assembly language, firmware, source code, etc. Examples of computer-readable media that can be used to store instructions, information used, and / or information created during the execution of methods according to the described embodiments include magnetic or optical disks, flash memory, USB devices with non-volatile memory, networked storage devices, etc.

[0136]

[0147] In some embodiments, computer-readable storage devices, media, and memories may include cables or wireless signals containing bitstreams, etc. However, when referred to, non-transitory computer-readable storage media explicitly excludes media such as energy, carrier signals, electromagnetic waves, and the signals themselves.

[0137]

[0148] Those skilled in the art will understand that information and signals may be represented using any of a variety of different technologies and techniques. For example, the data, instructions, commands, information, signals, bits, symbols, and chips that may be referred to throughout the above description may in some cases be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof, depending in part on the particular application, desired design, corresponding technology, etc.

[0138]

[0149] The various illustrative logical blocks, modules, and circuits described in connection with aspects disclosed herein may be implemented or performed using hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof, and may take any of a variety of form factors. When implemented in software, firmware, middleware, or microcode, program code or code segments (e.g., a computer program product) to perform the necessary tasks may be stored in a computer-readable or machine-readable medium. A processor may perform the necessary tasks. Example form factors include laptops, smartphones, mobile phones, tablet devices or other small form factor personal computers, personal digital assistants, rack-mounted devices, standalone devices, etc. The functionality described herein may also be embodied in peripheral devices or add-in cards. Such functionality may also be implemented on a circuit board, among different chips, or on different processes executing in a single device, as further examples.

[0139]

[0150] The instructions, media for carrying such instructions, computing resources for executing those instructions, and other structures for supporting such computing resources are exemplary means for providing the functionality described in this disclosure.

[0140]

[0151] The techniques described herein may also be implemented in electronic hardware, computer software, firmware, or any combination thereof. Such techniques may be implemented in any of a variety of devices, such as a general-purpose computer, a wireless communication device handset, or an integrated circuit device having multiple uses, including applications in wireless communication device handsets and other devices. Any features described as modules or components may be implemented together in an integrated logic device or separately as discrete but interoperable logic devices. If implemented in software, the techniques may be realized at least in part by a computer-readable data storage medium having program code including instructions that, when executed, perform one or more of the methods, algorithms, and / or operations described above. The computer-readable data storage medium may form part of a computer program product, which may include packaging materials. The computer-readable medium may include memory or data storage media, such as random access memory (RAM), such as synchronous dynamic random access memory (SDRAM), read-only memory (ROM), non-volatile random access memory (NVRAM), electrically erasable programmable read-only memory (EEPROM), FLASH memory, magnetic or optical data storage media, etc. The techniques may additionally or alternatively be realized at least in part by a computer-readable communications medium, such as a propagated signal or wave, that carries or communicates program code in the form of instructions or data structures and that can be accessed, read, and / or executed by a computer.

[0141]

[0152] The program code may be executed by a processor, which may include one or more processors, such as one or more digital signal processors (DSPs), general-purpose microprocessors, application specific integrated circuits (ASICs), field programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuitry. Such a processor may be configured to perform any of the techniques described in this disclosure. A general-purpose processor may be a microprocessor, but alternatively, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, such as a DSP and a microprocessor, a combination of multiple microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. Accordingly, the term “processor,” as used herein, may refer to any of the above structures, any combination of the above structures, or any other structure or apparatus suitable for implementing the techniques described herein.

[0142]

[0153] Those skilled in the art will understand that the less than ("<") and greater than (">") symbols or terms used herein may be replaced with the less than or equal to ("≦") and greater than or equal to ("≧") symbols, respectively, without departing from the scope of this description.

[0143]

[0154] When a component is described as being "configured to" perform certain operations, such configuration may be achieved, for example, by designing electronic circuitry or other hardware to perform the operations, by programming programmable electronic circuitry (e.g., a microprocessor or other suitable electronic circuitry) to perform the operations, or any combination thereof.

[0144]

[0155] The phrases "coupled to" or "communicatively coupled to" refer to any component that is physically connected to another component, either directly or indirectly, and / or that is in communication with another component, either directly or indirectly (e.g., connected to the other component via a wired or wireless connection and / or other suitable communication interface).

[0145]

[0156] Claim language or other language referring to "at least one of" a set and / or "one or more" of a set indicates that one member of the set or multiple members of the set (in any combination) satisfies the claim. For example, a claim language referring to "at least one of A and B" or "at least one of A or B" means A, B, or A and B. As another example, a claim language referring to "at least one of A, B, and C" or "at least one of A, B, or C" means A, B, C, or A and B, or A and C, or B and C, or A and B and C, or any other ordering, overlap, or combination of A, B, and C, or any overlapping information or data (e.g., A and A, B and B, C and C, A and A and B, etc.), or A, B, and C. The phrases "at least one of" a set and / or "one or more" of a set do not limit the set to the items listed in the set. For example, claim language reciting "at least one of A and B" or "at least one of A or B" can mean A, B, or A and B, and may also include items not listed in the set of A and B.

[0146]

[0157] Exemplary aspects of the present disclosure include:

[0158] Aspect 1. An apparatus for wireless communications, comprising: at least one memory including instructions; and at least one processor coupled to the at least one memory, wherein the at least one processor is configured to: generate an anchor key based on a key from an authentication server function; associate a count value with the anchor key; generate an extended key identifier based on the count value; and send the extended key identifier to a remote application.

[0147]

[0159] Aspect 2. The apparatus of Aspect 1, wherein the at least one processor is further configured to receive, from a remote application, an instruction to refresh the extended key identifier, increment a count value, generate a refreshed extended key identifier based on the incremented count value, and send the refreshed extended key identifier to the remote application.

[0148]

[0160] Aspect 3. The apparatus of Aspect 1 or 2, wherein the extended key identifier is generated based on the encrypted count value.

[0149]

[0161] Aspect 4. The apparatus of Aspect 3, wherein the at least one processor is further configured to generate an encrypted count value based on the count value and a result from the first function.

[0150]

[0162] Aspect 5. The apparatus of aspect 4, wherein the result from the first function is based on a first key derived from the anchor key.

[0151]

[0163] Aspect 6. The apparatus of Aspect 3, wherein the extended key identifier is further generated based on a message authentication code.

[0152]

[0164] Embodiment 7. The apparatus of embodiment 6, wherein the message authentication code is generated based on a second key derived from the anchor key.

[0153]

[0165] Aspect 8. The apparatus of any of Aspects 1-7, wherein the at least one processor is configured to determine to use the extended key identifier based on instructions stored in at least one of the memory or the universal subscriber identity module.

[0154]

[0166] Aspect 9. The apparatus of any of Aspects 1-8, wherein the at least one processor is further configured to generate an application key for use with the remote application based on the anchor key and the count value.

[0155]

[0167] Aspect 10. An apparatus for wireless communications, comprising: at least one memory including instructions; and at least one processor coupled to the at least one memory, wherein the at least one processor is configured to: receive, from an authentication server function, an anchor key and a key identifier associated with a user device; receive, from a remote application, a first request for an application key, the first request including the first key identifier; determine that the first key identifier is a first extended key identifier including a count value; generate a first extended application key based on the count value associated with the first extended key identifier; and send the first extended application key and an indication that the user device is using the extended key identifier to the remote application.

[0156]

[0168] Aspect 11. The apparatus of Aspect 10, wherein the at least one processor is further configured to receive, from the remote application, a second request for an application key, the second request including a second key identifier, determine that the second key identifier is a second extended key identifier, generate a second extended application key based on a count value associated with the second extended key identifier, and send the second extended application key to the remote application.

[0157]

[0169] Aspect 12. The apparatus of any of Aspects 10-12, wherein the count value associated with the first extended key identifier includes an encrypted count value.

[0158]

[0170] Aspect 13. The apparatus of Aspect 12, wherein the anchor key is associated with the initial count value, and wherein the at least one processor is further configured to decrypt the encrypted count value based on the initial count value and a result from the first function.

[0159]

[0171] Aspect 14. The apparatus of aspect 13, wherein the result from the first function is based on a first key derived from the anchor key.

[0160]

[0172] Aspect 15. The apparatus of Aspect 12, wherein the extended key identifier is further generated based on a message authentication code.

[0161]

[0173] Embodiment 16. The apparatus of embodiment 15, wherein the message authentication code is generated based on a second key derived from the anchor key.

[0162]

[0174] Aspect 17. The apparatus of any of Aspects 10-17, wherein the at least one processor is further configured to generate, based on the anchor key, a first extended application key for use in the remote application.

[0163]

[0175] Aspect 18. An apparatus for wireless communications, comprising: at least one memory including instructions; and at least one processor coupled to the at least one memory, wherein the at least one processor is configured to: receive a first key identifier from a user device; send the first key identifier to an authentication server function; receive from the authentication server function a first extended application key and an indication that the user device is using the extended key identifier; send a response to the user device including a request for an updated key identifier; receive a second key identifier from the user device; send the second key identifier to the authentication server function; receive a second extended application key from the authentication server function; and communicate with the user device based on the second extended application key.

[0164]

[0176] Aspect 19. A method for wireless communications, comprising: generating an anchor key based on a key from an authentication server function; associating a count value with the anchor key; generating an extended key identifier based on the count value; and transmitting the extended key identifier to a remote application.

[0165]

[0177] Aspect 20. The method of aspect 19, further including: receiving an instruction from a remote application to refresh the extended key identifier; incrementing a count value; generating a refreshed extended key identifier based on the incremented count value; and sending the refreshed extended key identifier to the remote application.

[0166]

[0178] Aspect 21. The method of any one of aspects 19-21, wherein the extended key identifier is generated based on the encrypted count value.

[0167]

[0179] Aspect 22. The method of aspect 21, further comprising generating an encrypted count value based on the count value and a result from the first function.

[0168]

[0180] Aspect 23. The method of aspect 22, wherein the result from the first function is based on a first key derived from the anchor key.

[0169]

[0181] Aspect 24. The method of aspect 21, wherein the extended key identifier is further generated based on a message authentication code.

[0170]

[0182] Embodiment 25. The method of embodiment 24, wherein the message authentication code is generated based on a second key derived from the anchor key.

[0171]

[0183] Aspect 26. The method of any of Aspects 19-26, further comprising using the extended key identifier based on instructions stored in at least one of the memory or the universal subscriber identity module.

[0172]

[0184] Aspect 27. The method of any one of Aspects 19-26, further comprising generating an application key for use in the remote application based on the anchor key and the count value.

[0173]

[0185] Aspect 28. A method for wireless communications, comprising: receiving, from an authentication server function, an anchor key and a key identifier associated with a user device; receiving, from a remote application, a first request for an application key, the first request including the first key identifier; determining that the first key identifier is a first extended key identifier including a count value; generating a first extended application key based on the count value associated with the first extended key identifier; and sending the first extended application key and an indication that the user device is using the extended key identifier to the remote application.

[0174]

[0186] Aspect 29. The method of Aspect 28, further including: receiving a second request for an application key from the remote application, the second request including a second key identifier; determining that the second key identifier is a second extended key identifier; generating a second extended application key based on a count value associated with the second extended key identifier; and sending the second extended application key to the remote application.

[0175]

[0187]

[0071] Aspect 30. The method of aspect 28 or 29, wherein the count value associated with the first extended key identifier comprises an encrypted count value.

[0176]

[0188] Aspect 31. The method of aspect 30, wherein the anchor key is associated with the initial count value, and further comprising decrypting the encrypted count value based on the initial count value and a result from the first function.

[0177]

[0189] Aspect 32. The method of aspect 31, wherein the result from the first function is based on a first key derived from the anchor key.

[0178]

[0190] Aspect 33. The method of aspect 30, wherein the extended key identifier is further generated based on a message authentication code.

[0179]

[0191] Embodiment 34. The method of embodiment 33, wherein the message authentication code is generated based on a second key derived from the anchor key.

[0180]

[0192] Aspect 35. The method of any of Aspects 28-34, further comprising generating a first extended application key for use in the remote application based on the anchor key and the count value.

[0181]

[0193] Aspect 36. A method for wireless communications, comprising: receiving a first key identifier from a user device; sending the first key identifier to an authentication server function; receiving from the authentication server function a first extended application key and an indication that the user device is using the extended key identifier; sending a response to the user device including a request for an updated key identifier; receiving a second key identifier from the user device; sending the second key identifier to the authentication server function; receiving a second extended application key from the authentication server function; and communicating with the user device based on the second extended application key.

[0182]

[0194] Aspect 37. A non-transitory computer-readable medium having stored thereon instructions that, when executed by at least one processor, cause the at least one processor to generate an anchor key based on a key from an authentication server function, associate a count value with the anchor key, generate an extended key identifier based on the count value, and send the extended key identifier to a remote application.

[0183]

[0195] Aspect 38. The instructions further cause the at least one processor to receive, from a remote application, an indication to refresh the extended key identifier; 38. The non-transitory computer-readable medium of aspect 37, incrementing a count value, generating a refreshed extended key identifier based on the incremented count value, and transmitting the refreshed extended key identifier to a remote application.

[0184]

[0196] Aspect 39. The non-transitory computer-readable medium of aspect 37 or 38, wherein the extended key identifier is generated based on the encrypted count value.

[0185]

[0197] Aspect 40. The non-transitory computer-readable medium of aspect 39, wherein the instructions further cause the at least one processor to generate an encrypted count value based on the count value and a result from the first function.

[0186]

[0198] Aspect 41. The non-transitory computer-readable medium of aspect 40, wherein the result from the first function is based on a first key derived from an anchor key.

[0187]

[0199] Aspect 42. The non-transitory computer-readable medium of aspect 39, wherein the extended key identifier is further generated based on a message authentication code.

[0188]

[0200] Aspect 43. The non-transitory computer-readable medium of aspect 42, wherein the message authentication code is generated based on a second key derived from the anchor key.

[0189]

[0201] Aspect 44. The non-transitory computer-readable medium of any of Aspects 37-43, wherein the instructions further cause the at least one processor to determine, based on instructions stored in at least one of a memory or a universal subscriber identity module, to use the extended key identifier.

[0190]

[0202] Aspect 45. The non-transitory computer-readable medium of any of aspects 37-44, wherein the instructions further cause at least one processor to generate an application key for use in the remote application based on the anchor key and the count value.

[0191]

[0203] Aspect 46. A non-transitory computer-readable medium having stored thereon instructions that, when executed by at least one processor, cause the at least one processor to receive from an authentication server function an anchor key and a key identifier associated with a user device; receive from a remote application a first request for an application key, the first request including the first key identifier; determine that the first key identifier is a first extended key identifier including a count value; generate a first extended application key based on the count value associated with the first extended key identifier; and send to the remote application the first extended application key and an indication that the user device is using the extended key identifier.

[0192]

[0204] Aspect 47. The non-transitory computer-readable medium of aspect 46, wherein the instructions further cause the at least one processor to receive, from the remote application, a second request for an application key, the second request including a second key identifier; determine that the second key identifier is a second extended key identifier; generate a second extended application key based on a count value associated with the second extended key identifier; and send the second extended application key to the remote application.

[0193]

[0205] Aspect 48. The non-transitory computer-readable medium of aspect 46 or 47, wherein the count value associated with the first extended key identifier comprises an encrypted count value.

[0194]

[0206] Aspect 49. The non-transitory computer-readable medium of aspect 48, wherein the anchor key is associated with the initial count value, and the instructions further cause the at least one processor to decrypt the encrypted count value based on the initial count value and a result from the first function.

[0195]

[0207] Aspect 50. The non-transitory computer-readable medium of aspect 49, wherein the result from the first function is based on a first key derived from an anchor key.

[0196]

[0208] Aspect 51. The non-transitory computer-readable medium of aspect 48, wherein the extended key identifier is further generated based on a message authentication code.

[0197]

[0209] Aspect 52. The non-transitory computer-readable medium of aspect 51, wherein the message authentication code is generated based on a second key derived from the anchor key.

[0198]

[0210] Aspect 53. The non-transitory computer-readable medium of any of aspects 46-52, wherein the instructions further cause at least one processor to generate a first extended application key for use in the remote application based on the anchor key and the count value.

[0199]

[0211] Aspect 54. A non-transitory computer-readable medium having stored thereon instructions that, when executed by at least one processor, cause the at least one processor to: at least one memory including the instructions; and at least one processor coupled to the at least one memory and configured to receive a first key identifier from a user device; send the first key identifier to an authentication server function; receive from the authentication server function the first extended application key and an indication that the user device is using the extended key identifier; send to the user device a response including a request for an updated key identifier; receive a second key identifier from the user device; send the second key identifier to the authentication server function; receive a second extended application key from the authentication server function; and communicate with the user device based on the second extended application key.

[0200]

[0212] Embodiment 55. An apparatus comprising means for carrying out the method according to any of embodiments 18 to 36.

[0201]

[0213] Aspect 61. An apparatus for wireless communication, comprising: at least one memory including instructions; and at least one processor coupled to the at least one memory, wherein the at least one processor is configured to: generate an anchor key based on an authentication server function key; associate a count value with the anchor key; generate a temporary device identifier based on the authentication server function key; generate an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier; and send the extended key identifier to a remote application.

[0202]

[0214] Aspect 62. The apparatus of aspect 61, wherein the extended key identifier includes an encrypted count value.

[0203]

[0215] Aspect 63. The apparatus of aspect 62, wherein the at least one processor is further configured to generate an encrypted count value based on the count value and a result from the first function.

[0204]

[0216] Aspect 64. The apparatus of aspect 63, wherein the result from the first function is based on a first key derived from the anchor key.

[0205]

[0217] Aspect 65. The apparatus of aspect 64, wherein the extended key identifier is further generated based on a message authentication code.

[0206]

[0218] Embodiment 66. The apparatus of embodiment 65, wherein the message authentication code is generated based on a second key derived from the anchor key.

[0207]

[0219] Aspect 67. The apparatus of aspect 66, wherein the message authentication code is further generated based on at least one of a portion of the temporary device identifier or an identifier of the remote application.

[0208]

[0220] Embodiment 68. The apparatus of any of embodiments 61-67, wherein the portion of the temporary device identifier comprises the first 128 bits of the temporary device identifier.

[0209]

[0221] Aspect 69. The apparatus of any of Aspects 61 to 68, wherein the at least one processor is further configured to: receive, from a remote application, an instruction to refresh the extended key identifier; increment a count value based on the received instruction; generate a refreshed extended key identifier based on the incremented count value; and send the refreshed extended key identifier to the remote application.

[0210]

[0222] Aspect 70. The apparatus of any of Aspects 61-69, wherein the at least one processor is configured to determine to use the extended key identifier based on instructions stored in at least one of the memory or the universal subscriber identity module.

[0211]

[0223] Aspect 71. The apparatus of any of Aspects 61-70, wherein the at least one processor is further configured to generate an application key for use in the remote application based on the anchor key and the count value.

[0212]

[0224] Aspect 72. A method for wireless communication, comprising: generating an anchor key based on an authentication server function key; associating a count value with the anchor key; generating a temporary device identifier based on the authentication server function key; generating an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier; and sending the extended key identifier to a remote application.

[0213]

[0225] Aspect 73. The method of aspect 72, wherein the extended key identifier includes an encrypted count value.

[0214]

[0226] Embodiment 74. The method of embodiment 73, further comprising generating an encrypted count value based on the count value and a result from the first function.

[0215]

[0227] Aspect 75. The method of aspect 74, wherein the result from the first function is based on a first key derived from the anchor key.

[0216]

[0228] Aspect 76. The method of aspect 75, wherein the extended key identifier is further generated based on a message authentication code.

[0217]

[0229] Embodiment 77. The method of embodiment 76, wherein the message authentication code is generated based on a second key derived from the anchor key.

[0218]

[0230] Aspect 78. The method of aspect 77, wherein the message authentication code is further generated based on at least one of a portion of the temporary device identifier or an identifier of the remote application.

[0219]

[0231] Embodiment 79. The method of any of embodiments 72-77, wherein the portion of the temporary device identifier comprises the first 128 bits of the temporary device identifier.

[0220]

[0232] Aspect 80. The method of any of aspects 72 to 79, further including: receiving an instruction to refresh the extended key identifier from a remote application; incrementing a count value based on the received instruction; generating a refreshed extended key identifier based on the incremented count value; and sending the refreshed extended key identifier to the remote application.

[0221]

[0233] Aspect 81. The method of any of aspects 72-80, further comprising determining to use the extended key identifier based on instructions stored in the memory or the universal subscriber identity module.

[0222]

[0234] Aspect 82. The method of any of aspects 72-81, further comprising generating an application key for use in the remote application based on the anchor key and the count value.

[0223]

[0235] Aspect 83. A non-transitory computer-readable medium having stored thereon instructions that, when executed by at least one processor, cause the at least one processor to generate an anchor key based on an authentication server function key, associate a count value with the anchor key, generate a temporary device identifier based on the authentication server function key, generate an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier, and send the extended key identifier to a remote application.

[0224]

[0236] Aspect 84. The non-transitory computer-readable medium of aspect 83, wherein the extended key identifier includes an encrypted count value.

[0225]

[0237] Embodiment 85. The non-transitory computer-readable medium of embodiment 84, wherein the at least one processor is further configured to generate an encrypted count value based on the count value and a result from the first function.

[0226]

[0238] Aspect 86. The non-transitory computer-readable medium of aspect 85, wherein the result from the first function is based on a first key derived from an anchor key.

[0227]

[0239] Aspect 87. The non-transitory computer-readable medium of aspect 86, wherein the extended key identifier is further generated based on a message authentication code.

[0228]

[0240] Aspect 88. The non-transitory computer-readable medium of aspect 87, wherein the message authentication code is generated based on a second key derived from the anchor key.

[0229]

[0241] Aspect 89. The non-transitory computer-readable medium of aspect 88, wherein the message authentication code is further generated based on at least one of a portion of the temporary device identifier or an identifier of the remote application.

[0230]

[0242] Embodiment 90. The non-transitory computer-readable medium of any of embodiments 83-89, wherein the portion of the temporary device identifier comprises the first 128 bits of the temporary device identifier.

[0231]

[0243] Aspect 91. The non-transitory computer-readable medium of any of aspects 83 to 90, wherein at least one processor is further configured to receive, from a remote application, an instruction to refresh the extended key identifier, increment a count value based on the received instruction, generate a refreshed extended key identifier based on the incremented count value, and send the refreshed extended key identifier to the remote application.

[0232]

[0244] Aspect 92. The non-transitory computer-readable medium of any of aspects 83-91, wherein at least one processor is configured to determine to use the extended key identifier based on instructions stored in at least one of a memory or a universal subscriber identity module.

[0233]

[0245] Aspect 93. The non-transitory computer-readable medium of any of aspects 83 to 92, wherein the at least one processor is further configured to generate an application key for use in the remote application based on the anchor key and the count value.

[0234]

[0246] Embodiment 94. An apparatus comprising means for carrying out the method according to any of embodiments 72 to 82.

Claims

1. 1. An apparatus for wireless communication, comprising: at least one memory containing instructions; at least one processor coupled to the at least one memory, the at least one processor: generating an anchor key based on the authentication server function key; Associating a count value with the anchor key; generating a temporary device identifier based on the authentication server function key; generating an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier; The device is configured to send the extended key identifier to a remote application.

2. The apparatus of claim 1 , wherein the extended key identifier comprises an encrypted count value.

3. The apparatus of claim 2 , wherein the at least one processor is further configured to generate the encrypted count value based on the count value and a result from a first function.

4. The apparatus of claim 3 , wherein the result from the first function is based on a first key derived from the anchor key.

5. The apparatus of claim 4 , wherein the extended key identifier is further generated based on a message authentication code.

6. The apparatus of claim 5 , wherein the message authentication code is generated based on a second key derived from the anchor key.

7. The apparatus of claim 6 , wherein the message authentication code is further generated based on at least one of the portion of the temporary device identifier or an identifier of a remote application.

8. The apparatus of claim 1 , wherein the portion of the temporary device identifier comprises a first 128 bits of the temporary device identifier.

9. the at least one processor: receiving an instruction from the remote application to refresh the extended key identifier; incrementing the count value based on the received instruction; generating a refreshed extended key identifier based on the incremented count value; The apparatus of claim 1 , further configured to send the refreshed extended key identifier to the remote application.

10. 2. The apparatus of claim 1, wherein the at least one processor is configured to determine to use the extended key identifier based on instructions stored in at least one of the memory or a universal subscriber identity module.

11. The apparatus of claim 1 , wherein the at least one processor is further configured to generate an application key for use with the remote application based on the anchor key and the count value.

12. 1. A method for wireless communication, comprising: generating an anchor key based on the authentication server function key; Associating a count value with the anchor key; generating a temporary device identifier based on the authentication server function key; generating an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier; and sending the extended key identifier to a remote application.

13. The method of claim 12 , wherein the extended key identifier comprises an encrypted count value.

14. The method of claim 13 , further comprising generating the encrypted count value based on the count value and a result from a first function.

15. The method of claim 14 , wherein the result from the first function is based on a first key derived from the anchor key.

16. 16. The method of claim 15, wherein the extended key identifier is further generated based on a message authentication code.

17. 17. The method of claim 16, wherein the message authentication code is generated based on a second key derived from the anchor key.

18. 20. The method of claim 17, wherein the message authentication code is further generated based on at least one of the portion of the temporary device identifier or an identifier of a remote application.

19. The method of claim 12 , wherein the portion of the temporary device identifier comprises the first 128 bits of the temporary device identifier.

20. receiving an instruction from the remote application to refresh the extended key identifier; incrementing the count value based on the received instruction; generating a refreshed extended key identifier based on the incremented count value; 13. The method of claim 12, further comprising: sending the refreshed extended key identifier to the remote application.

21. 13. The method of claim 12, further comprising determining to use the extended key identifier based on instructions stored in a memory or a universal subscriber identity module.

22. The method of claim 12 , further comprising generating an application key for use in the remote application based on the anchor key and the count value.

23. A non-transitory computer-readable medium having stored thereon instructions that, when executed by at least one processor, cause the at least one processor to: generating an anchor key based on the authentication server function key; Associating a count value with the anchor key; generating a temporary device identifier based on the authentication server function key; generating an extended key identifier based on the count value, the extended key identifier including a portion of the temporary device identifier, the portion of the temporary device identifier being smaller in size than the entire temporary device identifier; A non-transitory computer-readable medium that causes the extended key identifier to be transmitted to a remote application.

24. 24. The non-transitory computer-readable medium of claim 23, wherein the extended key identifier comprises an encrypted count value.

25. 25. The non-transitory computer-readable medium of claim 24, wherein the at least one processor is further configured to generate the encrypted count value based on the count value and a result from a first function.

26. 26. The non-transitory computer-readable medium of claim 25, wherein the result from the first function is based on a first key derived from the anchor key.

27. 27. The non-transitory computer-readable medium of claim 26, wherein the extended key identifier is further generated based on a message authentication code.

28. 30. The non-transitory computer-readable medium of claim 27, wherein the message authentication code is generated based on a second key derived from the anchor key.

29. 30. The non-transitory computer-readable medium of claim 28, wherein the message authentication code is further generated based on at least one of the portion of the temporary device identifier or an identifier of a remote application.

30. 24. The non-transitory computer-readable medium of claim 23, wherein the portion of the temporary device identifier comprises a first 128 bits of the temporary device identifier.

Images