User device parameter update header protection

Abstract

Various aspects of this disclosure relate to user equipment (UE) parameter update (UPU) header protection. Devices such as network equipment (NE) implement Unified Data Management (UDM). The UDM sends a request to the Authentication Server Function (AUSF) to apply UPU header protection and sends the UPU transparent container and / or UPU header information to the UE. The UPU transparent container and / or UPU header information includes an instruction that the UPU header is protected. The UE receives a non-accessible layer (NAS) message containing the instruction for UPU header protection, calculates a UPU message authentication code (MAC) using the UPU header as at least one input for UPU protection, and sends an acknowledgment indicating that the UPU header verification was successful.

Description

[Technical Field]

[0001] Related applications This application claims priority to U.S. Patent Application No. 18 / 898,172, entitled “User Equipment Parameter Update Header Protection,” filed on 26 September 2024, the disclosures of which application are incorporated herein by reference in their entirety. U.S. Patent Application No. 18 / 898,172 claims priority to U.S. Provisional Application No. 63 / 587,021, entitled “User Equipment Parameter Update Header Protection,” filed on 29 September 2023, the disclosures of which provisional application are incorporated herein by reference in their entirety.

[0002] This disclosure relates to wireless communications, and more specifically, to user equipment (UE) parameter update (UPU) procedures. [Background technology]

[0003] A wireless communication system may include one or more network communication devices, such as a base station, that can support wireless communication for one or more user communication devices, which may also be known by other preferred terms as user equipment (UE). The wireless communication system may support wireless communication with one or more user communication devices by utilizing the resources of the wireless communication system (e.g., time resources (e.g., symbols, slots, subframes, frames, etc.) or frequency resources (e.g., subcarriers, carriers, etc.)). In addition, the wireless communication system may support wireless communication across a variety of radio access technologies, including third-generation (3G) radio access technologies, fourth-generation (4G) radio access technologies, and fifth-generation (5G) radio access technologies, among many other suitable radio access technologies beyond 5G (e.g., sixth-generation (6G)).

[0004] In wireless communication systems, the UPU procedure is used by Unified Data Management (UDM) to update UE parameters such as routing indicators, default configured network slice selection assistance information (NSSAI), disaster roaming information, and mobile device (ME) routing indicators, collectively called UPU data. During the UPU procedure, the UDM uses a Message Authentication Code (MAC) (UPU data, UPU data length, Counter) to protect the UPU data. UPU , and Counter UPU For input of length K AUSF UPU-MAC-I derived from AUSF Requests the Authentication Server Function (AUSF) to generate and provide (identified as) [Overview of the Initiative] [Means for solving the problem]

[0005] The article “a” preceding an element is unrestricted and is understood to refer to “at least one” or “one or more” of those elements. The terms “a,” “at least one,” “one or more,” and “at least one of one or more” may be interchangeable. Where used herein, including in the claims, “or” in a list of items (for example, a list of items ending with a phrase such as “at least one of,” “one or more of,” or “one or both of”) indicates an inclusive list, such as a list of at least one of A, B, or C meaning A or B or C or AB or AC or BC or ABC (i.e., A and B and C). Also, where used herein, the phrase “based on” should not be interpreted as referring to a closed set of conditions. For example, an exemplary step described as “based on condition A” may be based on both condition A and condition B without departing from the scope of this disclosure. In other words, as used herein, the phrase “based on” should be interpreted in the same way as the phrase “based at least in part on.” Furthermore, as used herein, including in the claims, “set” may consist of one or more elements.

[0006] Some implementations of the methods and apparatus described herein may further include a UE for wireless communication that receives an Access Layer (NAS) message containing instructions for UPU header protection, calculates a UPU message authentication code (MAC) using the UPU header as at least one input for UPU protection, and sends an acknowledgment indicating that the UPU header verification was successful.

[0007] In some implementations of the methods and apparatus described herein, the UE decides to perform UPU header verification and calculates the UPU MAC at least in part based on the decision to perform UPU header verification. The UE uses the UPU header as at least one input for UPU protection to calculate the UPU MAC. AUSF The calculation is performed as follows. The UE determines that the UPU header verification was successful. The UE issues a MAC UPU-MAC-I indicating that the UPU header verification was successful. UE The UE generates a UPU header protection verification and determines that the verification was successful. The UE sends a verification instruction to the UDM via the Access and Mobility Management Function (AMF) indicating that the verification of the UPU header protection was successful. The UE receives a capability request regarding whether the UE supports UPU header protection and sends a capability response indicating that the UE supports UPU header protection. The capability response is sent to the AMF in a NAS message as at least one of the initial registration request message or registration update request message, and the NAS message is forwarded by the AMF to the UDM to indicate that the UE supports UPU header protection.

[0008] Some implementations of the methods and apparatus described herein may further include a processor for wireless communication that receives a NAS message containing instructions for UPU header protection, calculates a UPU MAC using a UPU header as at least one input for UPU protection, and sends an acknowledgment indicating that the UPU header verification was successful.

[0009] In some implementations of the methods and apparatus described herein, the processor decides to perform UPU header verification and calculates the UPU MAC at least in part based on the decision to perform UPU header verification. The processor uses the UPU header as at least one input for UPU protection to calculate the UPU MAC. AUSFis calculated as. The processor determines that UPU header verification has succeeded. The processor sends a MAC UPU-MAC-I that indicates that UPU header verification has succeeded UE is generated. The processor determines that the verification of UPU header protection has succeeded, and sends a verification instruction indicating that the verification of UPU header protection has succeeded to the UDM via the AMF. The processor receives a capability request regarding whether the UE supports UPU header protection, and sends a capability response indicating that the UE supports UPU header protection. The capability response is sent to the AMF in a NAS message as at least one of an initial registration request message or a registration update request message, and the NAS message is forwarded by the AMF to the UDM to indicate that the UE supports UPU header protection.

[0010] Some implementations of the methods and apparatuses described herein are a method performed by a UE, which may further comprise a step of receiving a NAS message including an indication of UPU header protection, a step of calculating a UPU MAC using the UPU header as at least one input for UPU protection, and a step of sending an acknowledgment indicating that UPU header verification has succeeded.

[0011] In some implementations of the methods and apparatuses described herein, the method further comprises a step of determining to perform UPU header verification, and a step of calculating a UPU MAC based at least in part on the determination to perform UPU header verification. The method uses the UPU header as at least one input for UPU protection to generate the UPU MAC as UPU-MAC-I AUSF the step of calculating is further included. The method further comprises the step of determining that UPU header verification has succeeded. The method sends a MAC UPU-MAC-I that indicates that UPU header verification has succeeded UEThe method further includes the step of generating a UPU header protection verification success, and the step of sending a verification instruction to the UDM via the AMF indicating that the UPU header protection verification was successful. The method further includes the step of receiving a capability request regarding whether the UE supports UPU header protection, and the step of sending a capability response indicating that the UE supports UPU header protection. The capability response is sent to the AMF in a NAS message as at least one of an initial registration request message or a registration update request message, the NAS message is forwarded by the AMF to the UDM to indicate that the UE supports UPU header protection.

[0012] Some implementations of the methods and apparatus described herein include a network equipment (NE) (e.g., UDM) for wireless communications that transmits a request to the AUSF to apply UPU header protection and transmits at least one of the UPU transparent container or UPU header information to the UE, wherein at least one of the UPU transparent container or UPU header information includes an instruction that the UPU header is protected.

[0013] In some implementations of the methods and apparatus described herein, an NE (e.g., a UDM) sends a capability request regarding whether a UE supports UPU header protection and receives a capability response indicating that the UE supports UPU header protection. The NE sends a capability request regarding whether a UE supports UPU header protection, receives a capability response indicating that the UE supports UPU header protection, and stores information regarding the UE capability to support UPU header protection. The NE decides to apply UPU header protection. The request to the AUSF to apply UPU header protection includes at least one of either a first instruction indicating that UPU header protection is required, or a second instruction indicating that UPU header verification and acknowledgment are required. The NE sets an instruction requiring acknowledgment, confirming that the UE has received and successfully verified the UPU data and UPU header information. The NE sends the relevant instruction for UPU header protection to the UE, which instructs the UE to compute the UPU MAC using the UPU header as at least one input for UPU protection. The relevant instructions use the UPU header as at least one input for UPU protection to set the UPU MAC to UPU-MAC-I AUSF The UE is instructed to calculate as follows. The NE generates a UPU transparent container with instructions that UPU header protection be set in the UPU header. The NE decides to apply UPU header protection and includes one or more of the following in the UPU data sent to a UE that supports UPU header protection: the UPU dataset type specific to the UPU header information, the length of the UPU dataset specific to the UPU header information, and the UPU header information. The UPU header information included in the UPU data provides integrity protection for the UPU header information. The NE decides to apply UPU header protection and includes instructions in the UPU header sent to the UE that the UPU header will be protected as part of the UPU data.

[0014] Some implementations of the methods and apparatus described herein may further include a method implemented by an NE (e.g., a UDM) that includes the steps of: sending a request to the AUSF to apply UPU header protection; and sending at least one of a UPU transparent container or UPU header information to the UE, wherein at least one of the UPU transparent container or UPU header information includes an instruction that the UPU header is protected.

[0015] In some implementations of the methods and apparatus described herein, the method further includes the steps of sending a capability request regarding whether a UE supports UPU header protection and receiving a capability response indicating that the UE supports UPU header protection. The method further includes the steps of sending a capability request regarding whether a UE supports UPU header protection, receiving a capability response indicating that the UE supports UPU header protection, and storing information regarding the UE capability to support UPU header protection. The method further includes the step of deciding to apply UPU header protection. A request to the AUSF to apply UPU header protection includes at least one of a first instruction indicating that UPU header protection is required, or a second instruction indicating that UPU header verification and acknowledgment are required. The method further includes the step of setting an instruction requiring acknowledgment to confirm that the UE has received UPU data and UPU header information and has successfully verified it. The method further includes the step of sending an associated instruction for UPU header protection to the UE, the associated instruction instructing the UE to compute a UPU MAC using the UPU header as at least one input for UPU protection. The relevant instructions use the UPU header as at least one input for UPU protection to set the UPU MAC to UPU-MAC-I AUSFThe method instructs the UE to calculate as follows. The method further includes the step of generating a UPU transparent container along with an instruction that UPU header protection is set in the UPU header. The method further includes the step of deciding to apply UPU header protection and including one or more of the following in the UPU data sent to a UE that supports UPU header protection: a UPU dataset type specific to the UPU header information, a UPU dataset length specific to the UPU header information, and the UPU header information. The UPU header information included in the UPU data provides integrity protection for the UPU header information. The method further includes the step of deciding to apply UPU header protection and including an instruction in the UPU header sent to the UE that the UPU header is protected as part of the UPU data.

[0016] Some implementations of the methods and apparatus described herein may further include an NE (e.g., AMF) for wireless communications that receives from a UDM at least one of a UPU transparent container or UPU header information including a UPU header protection instruction for a UE, and transmits the UPU transparent container or UPU header information to the UE.

[0017] In some implementations of the methods and apparatus described herein, the NE (e.g., AMF) sends a UPU transparent container or UPU header information as a NAS message containing a UPU header protection instruction. If the transparent container is not received from the UDM, and the UPU header protection instruction information element is received, the NE generates a UPU transparent container with a UPU header containing the UPU header protection instruction.

[0018] Some implementations of the methods and apparatus described herein may further include a method implemented by an NE (e.g., an AMF) that includes the steps of receiving from a UDM at least one of a UPU transparent container or UPU header information including a UPU header protection instruction for a UE, and transmitting the UPU transparent container or UPU header information to the UE.

[0019] In some implementations of the methods and apparatus described herein, the method further includes the step of sending a UPU transparent container or UPU header information to the UE as a NAS message containing a UPU header protection instruction. If a transparent container is not received from the UDM, and if a UPU header protection instruction information element is received, the method further includes the step of generating a UPU transparent container together with a UPU header containing a UPU header protection instruction. [Brief explanation of the drawing]

[0020] [Figure 1] This figure shows an example of a wireless communication system according to the embodiments of this disclosure. [Figure 2] This figure shows an example of a UPU procedure extension that supports UPU header protection and related network capability instructions (as a standalone IE) according to an aspect of this disclosure. [Figure 3] This figure shows an example of a UPU procedure extension that supports UPU header protection and related network capability instructions as part of UPU data, according to the aspects of this disclosure. [Figure 4] This figure shows an example of a UE according to the aspects of this disclosure. [Figure 5] This figure shows an example of a processor according to the embodiments of this disclosure. [Figure 6] This figure shows an example of a network device (NE) according to the embodiments of this disclosure. [Figure 7] This is a flowchart of the method implemented by the UE according to the aspects of this disclosure. [Figure 8] This is a flowchart of a method implemented by an NE (e.g., UDM) according to the aspects of this disclosure. [Figure 9] This is a flowchart of the method implemented by NE (e.g., AMF) according to the aspects of this disclosure. [Modes for carrying out the invention]

[0021] In wireless communication systems, the UPU procedure is used by the UDM to update UE parameters such as routing indicators, default configured network slice selection assistance information (NSSAI), disaster roaming information, and ME routing indicators, collectively called UPU data. During the UPU procedure, the UDM uses MAC (UPU data, UPU data length, Counter) to protect the UPU data. UPU , and Counter UPU For input of length K AUSF UPU-MAC-I derived from AUSF The UDM requests AUSF to generate and provide the UPU header, which is identified as [name of UDM]. Furthermore, the UDM requests the UPU header, Counter via AMF. UPU , UPU data, and UPU-MAC-I AUSF The UPU header is sent to the UE. Given that the UPU header sent to the UE is not protected by any MAC for integrity protection, any intermediary (e.g., AMF) could modify the UPU header bit values, potentially causing a UPU procedure failure. In particular, the lack of UPU header protection in the UPU procedure could lead to malicious modification of the UPU header values, which could result in a UPU procedure failure.

[0022] Aspects of this disclosure relate to implementations that provide several extensions for UPU header protection during UE parameter update procedures for 3GPP® 5G systems. By utilizing the techniques described, a network (e.g., UDM, AUSF via AMF) provides the UE with an instruction that the network supports UPU header protection (e.g., and / or UPU header protection is applied). If the network supports UPU header protection and the network is aware that the UE also supports UPU header protection, the network decides to apply UPU header protection and then sends an instruction to the UE that the network supports and applies UPU header protection. If the network supports UPU header protection but the UE is not aware that the UE also supports UPU header protection (e.g., the relevant UE capability was not received from the UE in any previous step of the registration process), the network decides not to apply UPU header protection. If the UE supports UPU header protection and the UE has received a UPU header protection-related instruction from the network, the UE receives the MAC (i.e., UPU-MAC-I) from the network. AUSF ) in order to verify MAC calculation (the same UPU-MAC-I as AUSF) AUSF The UE decides to use the UPU header as one of the inputs in the UE. Furthermore, the UE confirms that it has successfully received and validated the UPU header along with the UPU data, along with the UPU-MAC-I UE It can also generate and send related instructions to the network.

[0023] The aspects of this disclosure will be described in the context of wireless communication systems.

[0024] Figure 1 shows an example of a wireless communication system 100 according to an aspect of this disclosure. The wireless communication system 100 may include one or more NEs 102, one or more UEs 104, and a core network (CN) 106. The wireless communication system 100 may support various radio access technologies. In some implementations, the wireless communication system 100 may be a 4G network such as an LTE network or an LTE Advanced (LTE-A) network. In some other implementations, the wireless communication system 100 may be an NR network such as a 5G network, a 5G Advanced (5G-A) network, or a 5G Ultra Wideband (5G-UWB) network. In other implementations, the wireless communication system 100 may be a combination of 4G and 5G networks, or other suitable radio access technologies including IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), and IEEE 802.20. The wireless communication system 100 may support wireless access technologies beyond 5G, such as 6G. In addition, the wireless communication system 100 may support technologies such as time division multiple access (TDMA), frequency division multiple access (FDMA), or code division multiple access (CDMA).

[0025] One or more NE102s may be distributed across a geographical area to form a wireless communication system 100. One or more of the NE102s described herein may be, include, or be referred to as network nodes, base stations, network elements, network functions, network entities, radio access networks (RANs), node B, e-node B (eNB), next-generation node B (gNB), or other preferred terms. The NE102s and UE104s may communicate via a communication link that may be a wireless or wired connection. For example, the NE102s and UE104s may perform wireless communication via a Uu interface (e.g., receiving signaling, transmitting signaling).

[0026] An NE102 may provide a geographic coverage area in which the NE102 can support services for one or more UE104 within the geographic coverage area. For example, an NE102 and a UE104 may support wireless communication of signals related to services (e.g., voice, video, packet data, messaging, broadcast, etc.) according to one or more radio access technologies. In some implementations, an NE102 may be a mobile satellite, for example, associated with a non-terrestrial network (NTN). In some implementations, different geographic coverage areas associated with the same or different radio access technologies may overlap, but different geographic coverage areas may be associated with different NE102s.

[0027] One or more UE104 may be distributed across the geographical area of ​​the wireless communication system 100. UE104 may include, or be referred to as, a remote unit, mobile device, wireless device, remote device, subscriber device, transmitter device, receiver device, or any other preferred term. In some implementations, UE104 may be referred to as a unit, station, terminal, or client, among many other examples. Additionally or alternatively, UE104 may be referred to as an Internet of Things (IoT) device, an Internet of Things (IoE) device, or a machine-type communications (MTC) device, among many other examples.

[0028] A UE104 may be capable of directly supporting wireless communication with other UE104s via a communication link. For example, a UE104 may directly support wireless communication with another UE104 via a device-to-device (D2D) communication link. In some implementations, such as vehicle-to-vehicle (V2V) deployments, vehicle-to-everything (V2X) deployments, or cellular-V2X deployments, the communication link may be called a side link. For example, a UE104 may directly support wireless communication with another UE104 via a PC5 interface.

[0029] An NE102 may support communication with a CN106, or with another NE102, or both. For example, an NE102 may interface with other NE102s or CN106s through one or more backhaul links (e.g., S1, N2, N6, or another network interface). In some implementations, NE102s may communicate directly with each other. In some other implementations, NE102s may communicate indirectly with each other (e.g., via a CN106). In some implementations, one or more NE102s may include subordinate components such as an access network entity, which may be an example of an access node controller (ANC). An ANC may communicate with one or more UE104s through one or more other access network transmitting entities, which may be called radio heads, smart radio heads, or transmit / receive points (TRPs).

[0030] CN106 may support user authentication, access authorization, tracking, connectivity, and other access, routing, or mobility functions. CN106 may be an advanced packet core (EPC) or 5G core (5GC) that includes a control plane entity that manages access and mobility (e.g., a Mobility Management Entity (MME), Access and Mobility Management Function (AMF)) and a user plane entity that routes packets or interconnects to external networks (e.g., a Serving Gateway (S-GW), Packet Data Network (PDN) Gateway (P-GW), or User Plane Function (UPF)). In some implementations, the control plane entity may manage non-access layer (NAS) functions such as mobility, authentication, and bearer management (e.g., data bearers, signal bearers, etc.) for one or more UE104s serviced by one or more NE102s associated with CN106.

[0031] CN106 may communicate with the packet data network over one or more backhaul links (e.g., via S1, N2, N6, or another network interface). The packet data network may include an application server. In some implementations, one or more UE104s may communicate with the application server. UE104s may establish a session with CN106 via NE102 (e.g., a protocol data unit (PDU) session). CN106 may use the established session (e.g., an established PDU session) to route traffic (e.g., control information, data, etc.) between UE104 and the application server. A PDU session may be an example of a logical connection between UE104 and CN106 (e.g., one or more network functions of CN106).

[0032] In the wireless communication system 100, the NE102 and UE104 may use the resources of the wireless communication system 100 (e.g., time resources (e.g., symbols, slots, subframes, frames, etc.) or frequency resources (e.g., subcarriers, carriers)) to perform various operations (e.g., wireless communication). In some implementations, the NE102 and UE104 may support different resource structures. For example, the NE102 and UE104 may support different frame structures. In some implementations, such as in 4G, the NE102 and UE104 may support a single frame structure. In some other implementations, such as in 5G among several suitable wireless access technologies, the NE102 and UE104 may support various frame structures (i.e., multiple frame structures). The NE102 and UE104 may support various frame structures based on one or more numerologies.

[0033] One or more numerologies may be supported in the wireless communication system 100, and a numerology may include a subcarrier interval and a cyclic prefix. A first numerology (e.g., μ=0) may be associated with a first subcarrier interval (e.g., 15 kHz) and a normal cyclic prefix. In some implementations, the first numerology (e.g., μ=0) associated with the first subcarrier interval (e.g., 15 kHz) may utilize one slot per subframe. A second numerology (e.g., μ=1) may be associated with a second subcarrier interval (e.g., 30 kHz) and a normal cyclic prefix. A third numerology (e.g., μ=2) may be associated with a third subcarrier interval (e.g., 60 kHz) and a normal cyclic prefix or an extended cyclic prefix. A fourth numerology (e.g., μ=3) can be associated with a fourth subcarrier interval (e.g., 120 kHz) and a normal cyclic prefix. A fifth numerology (e.g., μ=4) can be associated with a fifth subcarrier interval (e.g., 240 kHz) and a normal cyclic prefix.

[0034] The time intervals of resources (e.g., communication resources) can be organized according to frames (also called wireless frames). Each frame may have a duration, for example, 10 milliseconds (ms). In some implementations, each frame may contain multiple subframes. For example, each frame may contain 10 subframes, each subframe may have a duration, for example, 1 ms. In some implementations, each frame may have the same duration. In some implementations, each subframe of a frame may have the same duration.

[0035] As an addition or alternative, the time intervals of resources (e.g., communication resources) may be organized according to slots. For example, a subframe may contain a certain number (e.g., a quantity) of slots. The number of slots in each subframe may also depend on one or more numerologies supported in the wireless communication system 100. For example, the first, second, third, fourth, and fifth numerologies (i.e., μ=0, μ=1, μ=2, μ=3, μ=4) associated with the respective subcarrier intervals of 15kHz, 30kHz, 60kHz, 120kHz, and 240kHz may utilize a single slot per subframe, two slots per subframe, four slots per subframe, eight slots per subframe, and sixteen slots per subframe, respectively. Each slot may contain a certain number (e.g., a quantity) of symbols (e.g., OFDM symbols). In some implementations, the number (e.g., a quantity) of slots for a subframe may depend on the numerology. For a normally cyclic prefix, a slot may contain 14 symbols. In the case of an extended cyclic prefix (e.g., applicable to a 60 kHz subcarrier interval), a slot may contain 12 symbols. The relationship between the number of symbols per slot, the number of slots per subframe, and the number of slots per frame in the case of normal and extended cyclic prefixes may depend on the numerology. It should be understood that references to a first numerology (e.g., μ=0) associated with a first subcarrier interval (e.g., 15 kHz) can be used interchangeably between subframes and slots.

[0036] In the wireless communication system 100, the electromagnetic (EM) spectrum can be split into various classes, frequency bands, frequency channels, etc., based on frequency or wavelength. For example, the wireless communication system 100 may support one or more operating frequency bands such as frequency range designations FR1 (410 MHz to 7.125 GHz), FR2 (24.25 GHz to 52.6 GHz), FR3 (7.125 GHz to 24.25 GHz), FR4 (52.6 GHz to 114.25 GHz), FR4a or FR4-1 (52.6 GHz to 71 GHz), and FR5 (114.25 GHz to 300 GHz). In some implementations, the NE102 and UE104 may conduct wireless communication over one or more of these operating frequency bands. In some implementations, FR1 may be used by the NE102 and UE104 among several instruments or devices for cellular communication traffic (e.g., control information, data). In some implementations, FR2 can be used by the NE102 and UE104, among many other instruments or devices, for short-range, high-data-rate capabilities.

[0037] FR1 may be associated with one or more numerologies (e.g., at least three). For example, FR1 may be associated with a first numerology (e.g., μ=0) with a subcarrier interval of 15 kHz, a second numerology (e.g., μ=1) with a subcarrier interval of 30 kHz, and a third numerology (e.g., μ=2) with a subcarrier interval of 60 kHz. FR2 may be associated with one or more numerologies (e.g., at least two). For example, FR2 may be associated with a third numerology (e.g., μ=2) with a subcarrier interval of 60 kHz, and a fourth numerology (e.g., μ=3) with a subcarrier interval of 120 kHz.

[0038] Depending on the implementation, one or more of the NE102 and UE104 can operate to implement various aspects of the techniques described in this disclosure. For example, the NE102 (e.g., UDM) communicates (e.g., sends) a request to apply UPU header protection and sends the UPU transparent container and / or UPU header information to the UE104. The UPU transparent container and / or UPU header information includes an instruction that the UPU header is protected. The UE104 receives the NAS message containing the instruction for UPU header protection, uses the UPU header as at least one input for UPU protection to calculate the UPU MAC, and sends an acknowledgment indicating that the UPU header verification was successful. In another example, the NE102 (e.g., AMF) receives from the UDM at least one of the UPU transparent container or UPU header information containing the instruction for UPU header protection for the UE104 and sends the UPU transparent container or UPU header information to the UE.

[0039] Regarding the UPU procedure, the UDM sends a UE parameter update transparent container to the UE (via the AMF). The UE parameter update transparent container includes a UPU header to indicate various information, such as an acknowledgment (ACK) value indicating whether an acknowledgment is requested by the UE (i.e., an acknowledgment for successful receipt of the UPU data list) and a re-registration (REG) value indicating whether re-registration is requested by the UE. Acknowledgment (ACK) value (4 octets, 2 bits) 0: No acknowledgment is required; 1: An acknowledgment is required. Re-registration (REG) value (4 octets, 3 bits) 0: No re-registration required; 1: Re-registration required Furthermore, note that if the UDM sends individual information elements (IEs) related to the UPU based on the received information (as in this case) and if AMF supports it, the UDM can generate a "UE parameter update transparent container" and send it to the UE.

[0040] Regarding the "UE Parameter Update Transparent Container," the UPU Transparent Container is sent from the UDM (via AMF) to the UE. For example, the UE Parameter Update Transparent Container information element for a UE Parameter Update data type with a value of "0":

[0041] [Table 1]

[0042] Here is an example of a UE parameter update header for a UE parameter update data type with a value of "0":

[0043] [Table 2]

[0044] In another example, the UPU transparent container is sent from the UE to the UDM (via AMF). For example, the UE parameter update transparent container information element for a UE parameter update data type with the value "1":

[0045] [Table 3]

[0046] Here is an example of a UE parameter update header for a UE parameter update data type with the value "1":

[0047] [Table 4]

[0048] Regarding the UE parameter update capability check, the previous explanation mentioned UPU-MAC-I to provide UPU header protection. AUSFThe UPU header is used as an additional input in the calculation, which needs to be supported by both the UE and the network. This may be possible in newer 5G releases (e.g., Rel.19 and later), but this solution is not perfect. For example, constraints of legacy UEs (i.e., older release UEs) and legacy networks include UPU-MAC-I on the network side. AUSF This extension does not support the use of UPU headers as additional inputs in computation and related validation on the UE side. This solution does not explain how UE and network capabilities regarding UPU header protection are exchanged between the UE and the network if they are supported in new release features. Therefore, applying UPU header protection cannot be implemented in scenarios involving legacy UEs and / or legacy networks. For example, if the network supports UPU header protection, the UDM will compute UPU-MAC-I using UPU headers as one of its inputs. AUSF It is possible to send UPU-MAC-I, but if the receiving UE is a legacy UE that does not support UPU header protection, the UE will send UPU-MAC-I without using the UPU header as input. AUSF Generates the computed UPU-MAC-I. AUSF The received UPU-MAC-I AUSF It does not match, therefore, UPU-MAC-I AUSF The verification fails.

[0049] Regarding the previous contributions related to the protection of the UPU header, the UE has notified the UDM that the UE will support UPU header information in UPU data. If the UE supports receiving UPU header information in UPU data, the UDM shall further include the UPU header information in the UPU data. Including the UPU header information in the UPU data provides integrity protection for that information. If the UPU data includes UPU header information, the UE shall use such information as a UPU header and behave accordingly.

[0050] However, this solution is that the UPU header is inside the UPU data, and as a result UPU-MAC-I AUSF Considering that this is generated, by placing the "UPU header" inside the "UPU data", we can avoid the influence of AUSF and indirectly protect the UPU header while using existing inputs for AUSF, thereby enabling UPU-MAC-I AUSF This attempts to generate UPU-MAC-I. In this solution, the UE informs the network that it supports "UPU header information in UPU data," but the network does not provide the UE with any of its UPU header protection capabilities. If the UE is connected to a 5G system with legacy AUSF and legacy UDM (i.e., older release systems), the network (i.e., AUSF, UDM) cannot protect the UPU header. Even if the UE informs the network about its ability to support UPU header protection in UPU data, legacy network functions cannot understand this new capability of the UE. Furthermore, the UE cannot obtain UPU-MAC-I from the network. AUSF When it receives the UPU, the UE assumes that the UPU header is protected in the UPU data and places the UPU header within the UPU data to implement UPU-MAC-I. AUSF It calculates the UPU-MAC-I calculated by the UE. AUSF The UPU-MAC-I calculated by the received network. AUSF It does not match UPU-MAC-I AUSF The verification fails.

[0051] In aspects of this disclosure, the described implementation provides several enhancements for UPU header protection during UE parameter update procedures for 3GPP 5G systems. The network (e.g., UDM via AMF, AUSF) provides the UE with instructions that the network supports UPU header protection (e.g., and / or UPU header protection is applied). If the network supports UPU header protection, and the network is aware that the UE also supports UPU header protection, the network decides to apply UPU header protection and then sends an instruction to the UE that the network supports and applies UPU header protection. If the network supports UPU header protection, but the UE is unaware that it also supports UPU header protection (for example, if the relevant UE capability was not received from the UE at any previous step in the registration process), the network will decide not to apply UPU header protection. • If the UE supports UPU header protection and receives UPU header protection-related instructions from the network, the UE will receive the MAC (i.e., UPU-MAC-I) from the network. AUSF ) in order to verify MAC calculation (the same UPU-MAC-I as AUSF) AUSF It is decided to use the UPU header as one of the inputs in ). Furthermore, the UE will send an acknowledgment that the UE successfully received and validated the UPU header along with the UPU data, along with the UPU-MAC-I UE It can also generate and send related instructions to the network.

[0052] In aspects of this disclosure, one implementation notifies the network of its UPU header protection capability and applies UPU header protection (with AUSF influence). This specification describes how network capability to support UPU header protection is demonstrated to the UE, and how UPU header protection is uniformly applied and verified between the network and the UE during the UPU procedure.

[0053] Figure 2 shows an example of a UPU procedure extension 200 that supports UPU header protection and associated network capability instructions (as a standalone IE) according to an aspect of this disclosure.

[0054] In step 0, UE104, which supports UPU header protection, sends an instruction to AMF202 in any NAS / N1 message regarding the UE's ability to support UPU header protection. AMF may send or forward the received instruction regarding the UE's ability to support UPU header protection to UDM206 in any Nudm service operation message or any Namf service operation message.

[0055] In Step 1, the UDM decides to implement the UPU using control plane procedures while the UE is registering with the 5G system. If the end consumer of any of the UE parameters to be updated (e.g., routing ID data to be updated) is the USIM, the UDM uses a secure packet mechanism to protect these parameters to update the parameters stored on the USIM. The UDM then prepares UE parameter update data (UPU data) by including, if any, the parameters protected by secure packets, as well as any UE parameters whose end consumer is the ME. If the UDM supports UPU header protection, and the UDM has previously received a UE capability instruction (during any authentication or registration procedure, or subscription data management) indicating that the UE supports UPU header protection for any UE, the UDM decides to apply UPU header protection.

[0056] In steps 2 and 3, UDM uses UPU-MAC-I AUSF and Counter UPU To obtain this, the Nausf_UPUProtection service operation message to AUSF204 can be invoked by including UPU data. The UDM is the latest K of the UE. AUSFYou can choose to hold the AUSF. If the UDM decides that the UE should acknowledge the success of the security check of the received UPU data, the UDM includes an ACK instruction in the Nausf_UPUProtection service operation message, and the UDM will confirm the expected UPU-XMAC-I UE It can also signal that it is needed. If UDM determines that the UPU header should be protected by AUSF, UDM will include the UPU header in the Nausf_UPUProtection service operation message, along with a UPU header protection instruction, so that AUSF can use UPU-MAC-I AUSF You may signal that the UPU header needs to be used during generation. The UE parameter update header should be UPU-MAC-I AUSF Including this in the calculation allows the UE to verify that it is not being interfered with by any intermediary.

[0057] Counter UPU Further details are explained below, referring to Figure 3. UPU data is then transferred to UPU-MAC-I AUSF Including this in the calculation allows the UE to verify that it is not being interfered with by any intermediary. Expected UPU-XMAC-I UE This allows the UDM to verify that the UE has correctly received the UPU data. The AUSF, along with the UPU data and UPU header (if received or self-generated based on a UPU header protection directive) received from the requesting network function (NF), contains the UE-specific home key (K AUSF ) use UPU-MAC-I as described below AUSF Calculate UPU-MAC-I AUSF and Counter UPU Distributes to the requesting NF. If an ACK instruction input exists, AUSF sends UPU-XMAC-I UE It also calculates the calculated UPU-XMAC-I UE The expected UPU-XMAC-I is returned in the response. UEThe calculation may also include a UPU header validation acknowledgment response stating that "the UE successfully validated the UPU header," which allows the UDM to verify that the UE correctly received the UPU header.

[0058] Extended UPU-MAC-I AUSF Regarding the generating function, K AUSF From UPU-MAC-I AUSF The following parameters are used by AUSF to form the input S to the key derivation function (KDF) when deriving the following: FC = 0x7B, P0 = UE parameter update data (i.e., UE parameter update list (starting from octet 23)), L0 = length of UE parameter update data, P1 = Counter UPU L1=Counter UPU Length, P2=UPU header, L2=UPU header length, and input key Key is K AUSF UPU-MAC-I AUSF This is identified by the 128th least significant bit of the KDF output.

[0059] Extended UPU-MAC-I UE / UPU-XMAC-I UE Regarding the generating function, K AUSF From UPU-MAC-I UE / UPU-XMAC-I UE The following parameters are used by AUSF to form the input S to the KDF when deriving the following: FC=0x7C, P0=0x01 (UPU acknowledgment: UE parameter update data successfully validated), L0=Length of UPU acknowledgment (i.e., 0x00 0x01), P1=Counter UPU L1=Counter UPU The length of the input key is K, P0 = 0x02 (UPU header acknowledgment: UE parameter update header successfully validated), L0 = length of the UPU header acknowledgment (i.e., 0x00 0x01), and the input key Key is K AUSF This can be done. UPU-MAC-I UE / UPU-XMAC-I UEThis is identified by the 128th least significant bit of the KDF output.

[0060] In step 4, the UDM calls the Nudm_SDM_Notification service operation. The Nudm_SDM_Notification service operation includes the UPU transparent container if the AMF supports it, or the UPU header protection instruction within the access and mobility subscription data, the UPU header, UE parameter update data, and UPU-MAC-I AUSF And, Counter UPU This includes individual IEs that include and. If UDM requests an acknowledgment, UDM will request the expected UPU-XMAC-I UE It temporarily stores the following. If the UDM includes a UPU transparent container, the UPU header may include UPU header protection (support / enable) related instructions as shown below.

[0061] In step 5, based on the receipt of the Nudm_SDM_Notification message, AMF sends a DL NAS transport message to the serviced UE. If AMF received the transparent container from the UDM in step 4, AMF includes it in the DL NAS transport message. If not, and the UDM provided individual IEs in step 4, AMF constructs the UPU transparent container by including the UPU header and UPU header protection instructions (if those information elements (IEs) were received from the UDM in step 4).

[0062] In step 6, based on the receipt of the DL NAS transport message, the UE receives the received UE parameter update data, the UPU header (if UPU header protection is instructed and received in step 5), and the Counter UPU Based on (as shown in steps 2-3), UPU-MAC-I in the same way as AUSF AUSFCalculate the UPU-MAC-I that was received within the UPU transparent container in the DL NAS transport message. AUSF Verify if the value matches. UPU-MAC-I AUSF If the verification is successful and the UPU data contains any parameters that are protected by the secure packet, the ME can forward the secure packet to the USIM using the given procedure. UPU-MAC-I AUSF If the verification is successful and the UPU data contains any parameters that are not protected by the secure packet, the ME can update those stored parameters with the received parameters in the UDM update data.

[0063] In step 7, if the UDM requests an acknowledgment from the UE, and (i) the UE successfully validates and updates the UE parameter update data provided by the UDM, and (ii) the UE successfully validates the UE parameter update header provided by the UDM, the UE can send a UL NAS transport message to the serving AMF. The UE then sends the UPU-MAC-I message (as specified in steps 2-3, the same as AUSF). UE Generates the generated UPU-MAC-I UE This is included in the transparent container within the UL NAS transport message. The UE can also send UPU header validation success instructions or information in the transparent container within the UL NAS transport message.

[0064] Additionally, if the UE sends a UPU transparent container, the UE can indicate in the UPU header whether "UPU header protection verification was successful / UPU header is protected by the UE" or, accordingly, "UPU header protection verification failed / UPU header is not protected by the UE," as shown below. Alternatively, if the UE supports UPU header protection, and the UE calculates UPU-MAC-I UE UPU-MAC-I received AUSFIf they do not match, the UE sends a UPU header verification failure message, regardless of whether the UE has received a UPU header protection instruction from the UDM, sets the relevant bits in the UPU header as shown below, and the response in step 7 includes a UPU header verification failure message.

[0065] In step 8, UPU-MAC-I UE If a transparent container containing a UPU header verification success instruction or information is received in the UL NAS transport message, the AMF sends a Nudm_SDM_Info request message to the UDM along with the transparent container. Alternatively, UPU-MAC-I UE If a transparent container containing a UPU header verification failure instruction or information is received in a UL NAS transport message, the AMF may send a Nudm_SDM_Info request message to the UDM along with the transparent container.

[0066] In step 9, if the UDM instructs the UE to acknowledge the success of the security check of the received UE parameter update data, and if the UDM receives a UPU header validation success instruction or information, the UDM will respond to the received UPU-MAC-I UE The expected UPU-XMAC-I that UDM temporarily stored in step 4. UE Compare this to the above. Alternatively, if the UDM receives a UPU header validation failure instruction or information in step 9, the UDM can log that information and retry the UPU procedure based on its local policy. If the UDM supports home-triggered authentication, the UDM may decide to trigger primary authentication based on its local policy and refresh the UPU counters based on the counter values ​​received in step 3.

[0067] One example shows a UE parameter update header (from network to UE) for a UE parameter update data type with a value of "0".

[0068] [Table 5]

[0069] UE parameter update transparent container information element holder Option 1: UPU Header Protection Instruction (UPU HPI) value (4 octets, 4 bits) 0 - UPU header is not protected, or UPU header protection is not supported / enabled. 1 - The UPU header is protected, or UPU header protection is supported / enabled. Option 2: UPU Header Protection Instruction (UPU HPI) value (4 octets, bit x) - A common definition to cover both "Network to UE" and "UE to Network" (as shown in the two examples below). 0 - The UPU header is protected by the network. 1 - The UPU header is protected by the UE.

[0070] An alternative example shows a UPU header extension (which will be sent from the network to the UE).

[0071] [Table 6]

[0072] Another example shows a UPU header extension (which will be sent from UE to network) that has a UE parameter update header (UE to network) for a UE parameter update data type with a value of "1".

[0073] [Table 7]

[0074] Option 3: UPU Header Protection Instruction (UPU HPI) value (4 octets, 2 bits) 0 - The UPU header is not protected by the UE, or UPU header validation failed in the UE. 1 - The UPU header is protected by the UE, or UPU header verification is successful in the UE.

[0075] In aspects of this disclosure, one implementation notifies the network of its UPU header protection capability and applies UPU header protection (without impact on AUSF). This specification describes how network capability to support UPU header protection is indicated to the UE, and how UPU header protection is uniformly applied and verified between the network and the UE during a UE parameter update (UPU) procedure without impact on AUSF.

[0076] Figure 3 shows an example of a UPU procedure extension 300 that supports UPU header protection and associated network capability instructions as part of the UPU data, according to an aspect of this disclosure.

[0077] In step 0, UE104 notifies UDM306 (for example, during the authentication or registration procedure) that UE104 supports UPU header information in UPU data or the UE's UPU header protection capability indication.

[0078] In step 1, the UDM decides to perform UPU using control plane procedures while the UE is registered in the 5G system. If the ultimate consumer of any of the UE parameters to be updated (e.g., updated routing ID data) is the USIM, the UDM protects these parameters using the secured packet mechanism to update the parameters stored on the USIM. Then, the UDM can prepare UE parameter update data (UPU data) by including the parameters, if any, protected by the secured packet, as well as any UE parameters whose ultimate consumer is the ME. If the UE supports receiving UPU header information in the UPU data, or if the UE supports the capability of UPU header protection, the UDM may further include the UPU header information in the UPU data (as shown below). If the UDM supports UPU header protection, and if the UDM has previously (during any authentication or registration procedure, or subscription data management) received a UE capability indication that the UE supports "UPU header protection (as part of UPU data)" or "UPU header information in UPU data" for any UE, the UDM decides to apply UPU header protection. Including the UPU header information in the UPU data provides integrity protection for that information.

[0079] In steps 2 and 3, the UDM uses UPU-MAC-I AUSF and Counter UPU to invoke the Nausf_UPUProtection service operation message to the AUSF 304 by including the UPU data, in order to obtain them. The UDM can select the AUSF that holds the latest K of the UE. If the UDM determines that the UE should acknowledge the successful security check of the received UPU data, the UDM includes an ACK indication in the Nausf_UPUProtection service operation message as specified, and the UDM uses the expected UPU-XMAC-I AUSF can select the AUSF that holds. If the UDM determines that the UE should acknowledge the successful security check of the received UPU data, the UDM includes an ACK indication in the Nausf_UPUProtection service operation message as specified, and the UDM uses the expected UPU-XMAC-I UEcan signal that it is also required. Alternatively, if the UDM determines that the UE should acknowledge the successful security check of the received UPU data and UPU header, the UDM shall include an ACK indication (specific to the case of successful security check of both the UPU data and the UPU header) in the Nausf_UPUProtection service operation message, and the UDM shall generate the expected UPU-XMAC-I UE can signal that it is also required. Counter UPU are described in detail below. Including the UPU data in the calculation of UPU-MAC-I AUSF allows the UE to verify that it has not been interfered with by any intermediary. The expected UPU-XMAC-I UE allows the UDM to verify that the UE has received the UPU data correctly.

[0080] Regarding the UE parameter update counter (Counter UPU ), the AUSF and the UE associate a 16-bit counter Counter UPU with the key K AUSF . When the newly derived K AUSF is stored, the UE initializes Counter UPU to 0x00 0x00. The UE stores the UPU counter. If the USIM supports both storage of 5G parameters and extended storage of 5G parameters, Counter UPU is stored in the USIM. Otherwise, Counter UPU is stored in the non-volatile memory of the ME. To generate UPU-MAC-I AUSF , the AUSF uses Counter UPU . Counter UPU may be incremented by the AUSF for each new calculation of UPU-MAC-I AUSF . Counter UPU may be used to mitigate replay attacks, as described above, for UPU-MAC-I AUSF and UPU-MAC-I UEIt is used as the freshness input to the derivation of AUSF. AUSF is (UPU-MAC-I AUSF (Used to generate Counter) UPU The value of UPU-MAC-I AUSF It is sent to the UE along with the stored Counter. UPU A Counter greater than the value UPU Only values ​​are accepted. Then the UE receives the UPU-MAC-I AUSF Only if the verification is successful, the stored Counter UPU Counter that received UPU Update with UPU-MAC-I for UE parameter update data acknowledgment. UE When deriving the Counter received from the UDM UPU Use this.

[0081] AUSF and UE are K AUSF During its lifespan, Counter UPU Maintain. AUSF, which supports UE parameter updates using control plane procedures, uses newly derived K AUSF When it is stored, Counter UPU Initialize it to 0x00 0x01. AUSF is the first computed UPU-MAC-I AUSF Counter after UPU Set to 0x00 0x02 and add the UPU-MAC-I AUSF Each time it is calculated, it can be monotonically incremented. The UPU counter value of 0x00 0x00 is UPU-MAC-I AUSF and UPU-MAC-I UE It is not used to calculate UE's K. AUSF Counter associated with UPU If a wraparound is attempted, AUSF will suspend the UE parameter update protection service for the UE. AUSF When a Counter is generated in AUSF UPUThis is reset to 0x00 0x01 as defined above, and AUSF restarts the UE parameter update protection service for the UE.

[0082] Extended UPU-MAC-I AUSF Regarding the generating function, K AUSF From UPU-MAC-I AUSF The following parameters are used by AUSF to form the input S to the KDF when deriving the following: FC=0x7B, P0=UE parameter update data (i.e., UE parameter update list (starting from octet 23)) and UPU header, L0=length of UE parameter update data, P1=Counter UPU L1=Counter UPU The length, and the input key Key is K AUSF UPU-MAC-I AUSF This is identified by the 128th least significant bit of the KDF output.

[0083] Extended UPU-MAC-I UE / UPU-XMAC-I UE Regarding the generating function, K AUSF From UPU-MAC-I UE / UPU-XMAC-I UE The following parameters are used by AUSF to form the input S to the KDF when deriving the following: FC=0x7C, P0=0x02 (UPU acknowledgment: UE parameter update data successfully validated and UE parameter update header successfully validated), L0=length of UPU acknowledgment (i.e., 0x00 0x02), P1=Counter UPU L1=Counter UPU The length, and the input key Key is K AUSF UPU-MAC-I UE / UPU-XMAC-I UE This is identified by the 128th least significant bit of the KDF output.

[0084] In step 4, the UDM can call the Nudm_SDM_Notification service operation. The Nudm_SDM_Notification service operation includes the UPU transparent container if the AMF supports it, or the UE parameter update header (UPU header) protection instruction within the access and mobility subscription data, the UPU header, the UE parameter update data, and the UPU-MAC-I AUSF And, Counter UPU This includes individual IEs that include and. If UDM requests an acknowledgment, UDM will request the expected UPU-XMAC-I UE This shall be temporarily stored. Alternatively, a UE parameter update header (UPU header) protection directive may be referred to as UPU data with a UPU header or UPU header within a UPU data protection directive.

[0085] In step 5, based on the receipt of the Nudm_SDM_Notification message, the AMF302 can send the DL NAS transport message to the serviced UE. The AMF can include the transparent container in the DL NAS transport message if it was received from the UDM in step 4. Otherwise, if the UDM provided individual IEs in step 4, the AMF can construct the UPU transparent container by including the UPU header and UPU header protection instructions (if those information elements (IEs) were received from the UDM in step 4).

[0086] In step 6, based on the receipt of the DL NAS transport message, the UE receives the received UE parameter update data, the UPU header (if UPU header protection is instructed and received in step 5, and if the UE supports the UPU header protection capability described in step 0), and the Counter UPUBased on (as shown in steps 2-3), UPU-MAC-I in the same way as AUSF AUSF Calculate the UPU-MAC-I that was received within the UPU transparent container in the DL NAS transport message. AUSF It is possible to verify whether the value matches. UPU-MAC-I AUSF If the verification is successful and the UPU data contains any parameters that are protected by the secure packet, the ME shall forward the secure packet to the USIM using the given procedure. UPU-MAC-I AUSF If the verification is successful and the UPU data contains any parameters not protected by the secure packet, the ME shall update the stored parameters with the received parameters in the UDM update data. If the UPU data contains UPU header information, the UE shall use such information as a UPU header and behave accordingly.

[0087] In step 7, the UDM requests an acknowledgment from the UE, and if (i) the UE successfully validates and updates the UE parameter update data provided by the UDM, and (ii) the UE successfully validates the UE parameter update header provided by the UDM, the UE can send the UL NAS transport message to the serving AMF. The UE then sends the UPU-MAC-I message (as shown in steps 2-3, the same as for the AUSF). UE Generates the generated UPU-MAC-I UEThis can be included in the transparent container within the UL NAS transport message. The UE can also send a UPU header verification success instruction or information in the transparent container within the UL NAS transport message. Additionally, if the UE sends a UPU transparent container, the UE can indicate in the UPU header whether "UPU header protection verification was successful or the UPU header is protected by the UE" or, accordingly, "UPU header protection verification was unsuccessful or the UPU header is not protected by the UE," as shown above. Alternatively, if the UE supports UPU header protection and the UE calculates the UPU-MAC-I UE UPU-MAC-I received AUSF If they do not match, the UE sends a UPU header verification failure message, regardless of whether the UE has received a UPU header protection instruction from the UDM, sets the relevant bits in the UPU header as shown above, and the response in step 7 includes a UPU header verification failure message.

[0088] In step 8, UPU-MAC-I UE If a transparent container containing a UPU header verification success instruction or information is received in a UL NAS transport message, the AMF can send a Nudm_SDM_Info request message to the UDM along with the transparent container. Alternatively, UPU-MAC-I UE If a transparent container containing a UPU header verification failure instruction or information is received in a UL NAS transport message, the AMF may send a Nudm_SDM_Info request message to the UDM along with the transparent container.

[0089] In step 9, if the UDM instructs the UE to acknowledge the success of the security check of the received UE parameter update data, and if the UDM receives a UPU header validation success instruction or information, the UDM will respond to the received UPU-MAC-I UEThe expected UPU-XMAC-I that UDM temporarily stored in step 4. UE This shall be compared to the above. Alternatively, if the UDM receives a UPU header validation failure instruction or information in step 9, the UDM may log this information and retry the UPU procedure based on local policy. If the UDM supports home-triggered authentication, the UDM may decide to trigger primary authentication based on its local policy and refresh the UPU counters based on the counter values ​​received in step 3.

[0090] One example shows a UE parameter update list that includes a UPU header, where the UPU header has a new data type, which is specific to the UPU header information and length information associated with the UPU header, and is included as part of the UPU data (i.e., the UE parameter update list).

[0091] [Table 8]

[0092] Figure 4 shows an example of a UE400 according to an aspect of this disclosure. The UE400 may include a processor 402, memory 404, controller 406, and transceiver 408. The processor 402, memory 404, controller 406, or transceiver 408, or various combinations thereof or various components thereof, may be examples of means for carrying out various aspects of this disclosure as described herein. These components may be coupled (for example, operationally, communicatively, functionally, electronically, or electrically) via one or more interfaces.

[0093] The processor 402, memory 404, controller 406, or transceiver 408, or various combinations thereof or their components, may be implemented in hardware (e.g., circuit configuration). The hardware may include a processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), or other programmable logic device, or any combination thereof configured as or otherwise supporting means for performing the functions described herein.

[0094] The processor 402 may include an intelligent hardware device (e.g., a general-purpose processor, DSP, CPU, ASIC, FPGA, or any combination thereof). In some implementations, the processor 402 may be configured to operate the memory 404. In some other implementations, the memory 404 may be integrated into the processor 402. The processor 402 may be configured to execute computer-readable instructions stored in the memory 404 in order to cause the UE 400 to perform various functions of this disclosure.

[0095] Memory 404 may include volatile or non-volatile memory. Memory 404 may store computer-readable, computer-executable code, which, when executed by processor 402, causes UE 400 to perform various functions described herein. The code may be stored in a non-temporary computer-readable medium, such as memory 404 or another type of memory. Computer-readable mediums include both non-temporary computer storage mediums and communication mediums, which include any medium that facilitates the transfer of computer programs from one place to another. Non-temporary storage mediums may be any available medium that can be accessed by a general-purpose or dedicated computer.

[0096] In some implementations, the processor 402 and the memory 404 coupled to the processor 402 may be configured to cause the UE400 to perform one or more of the functions described herein (for example, the processor 402 to execute instructions stored in the memory 404). For example, the processor 402 may support wireless communication in the UE400 according to the examples disclosed herein. The UE400 may be configured or operable to support means for receiving a NAS message containing instructions for UPU header protection, calculating a UPU MAC using the UPU header as at least one input for UPU protection, and sending an acknowledgment indicating that UPU header verification was successful.

[0097] In addition, the UE400 may be configured to support any one or a combination of the following: The method further includes the steps of deciding to perform UPU header verification and calculating the UPU MAC at least in part based on the decision to perform UPU header verification. The method uses the UPU header as at least one input for UPU protection to calculate the UPU MAC. AUSF The method further includes a step of calculating as follows: The method further includes a step of determining that UPU header verification was successful. The method indicates that MAC UPU-MAC-I is successful UE The method further includes the step of generating a UPU header protection verification success, and the step of sending a verification instruction to the UDM via the AMF indicating that the UPU header protection verification was successful. The method further includes the step of receiving a capability request regarding whether the UE supports UPU header protection, and the step of sending a capability response indicating that the UE supports UPU header protection. The capability response is sent to the AMF in a NAS message as at least one of an initial registration request message or a registration update request message, the NAS message is forwarded by the AMF to the UDM to indicate that the UE supports UPU header protection.

[0098] As an addition or alternative, the UE400 may support at least one memory and at least one processor coupled to the memory, configured to cause the UE to receive NAS messages containing instructions for UPU header protection, calculate a UPU MAC using the UPU header as at least one input for UPU protection, and send an acknowledgment indicating that the UPU header verification was successful.

[0099] In addition, the UE400 may be configured to support any one or a combination of the following: At least one processor is configured to cause the UE to decide to perform UPU header verification and to calculate the UPU MAC based at least in part on the decision to perform UPU header verification. At least one processor is configured to cause the UE to use the UPU header as at least one input for UPU protection to calculate the UPU MAC. AUSF It is configured to perform calculations as follows. At least one processor is configured to cause the UE to determine that UPU header verification was successful. At least one processor is configured to cause the UE to send a MAC UPU-MAC-I indicating that UPU header verification was successful. UE The processor is configured to generate the following: At least one processor is configured to cause the UE to determine the success of the UPU header protection verification and to send a verification instruction to the UDM via the AMF indicating that the UPU header protection verification was successful. At least one processor is configured to cause the UE to receive a capability request regarding whether the UE supports UPU header protection and to send a capability response indicating that the UE supports UPU header protection. The capability response is sent to the AMF in a NAS message as at least one of an initial registration request message or a registration update request message, and the NAS message is forwarded by the AMF to the UDM to indicate that the UE supports UPU header protection.

[0100] The controller 406 can manage input and output signals for the UE400. The controller 406 can also manage peripherals not integrated into the UE400. In some implementations, the controller 406 may utilize an operating system such as iOS®, Android®, Windows®, or other operating systems. In some implementations, the controller 406 may be implemented as part of the processor 402.

[0101] In some implementations, the UE400 may include at least one transceiver 408. In some other implementations, the UE400 may have two or more transceivers 408. A transceiver 408 may represent a wireless transceiver. A transceiver 408 may include one or more receiver chains 410, one or more transmitter chains 412, or a combination thereof.

[0102] The receiver chain 410 may be configured to receive signals (e.g., control information, data, packets) over a wireless medium. For example, the receiver chain 410 may include one or more antennas for receiving signals over air or a wireless medium. The receiver chain 410 may include at least one amplifier (e.g., a low-noise amplifier (LNA)) configured to amplify the received signal. The receiver chain 410 may include at least one demodulator configured to demodulate the received signal and obtain transmitted data by inverting the modulation technique applied during the transmission of the signal. The receiver chain 410 may include at least one decoder for decoding the demodulated signal and receiving transmitted data.

[0103] The transmitter chain 412 may be configured to generate and transmit signals (e.g., control information, data, packets). The transmitter chain 412 may include at least one modulator for modulating data over a carrier signal and preparing a signal for transmission over a wireless medium. The at least one modulator may be configured to support one or more techniques, such as amplitude modulation (AM), frequency modulation (FM), or digital modulation schemes such as phase-shift keying (PSK) or quadrature amplitude modulation (QAM). The transmitter chain 412 may also include at least one power amplifier configured to amplify the modulated signal to an appropriate power level suitable for transmission over a wireless medium. The transmitter chain 412 may also include one or more antennas for transmitting the amplified signal into the air or wireless medium.

[0104] Figure 5 shows an example of a processor 500 according to an aspect of the present disclosure. The processor 500 may be an example of a processor configured to perform various operations according to the examples described herein. The processor 500 may include a controller 502 configured to perform various operations according to the examples described herein. The processor 500 may optionally include at least one memory 504, which may be, for example, an L1 / L2 / L3 cache. Additionally or alternatively, the processor 500 may optionally include one or more arithmetic logic units (ALUs) 506. One or more of these components may communicate electronically via one or more interfaces (e.g., buses) or otherwise be coupled (e.g., operationally, communicatively, functionally, electronically, electrically).

[0105] The processor 500 may be a processor chipset and may include a protocol stack (e.g., a software stack) executed by the processor chipset to perform various operations (e.g., receive, acquire, retrieve, transmit, output, transfer, store, determine, identify, access, write, read) in accordance with the examples described herein. The processor chipset may include one or more cores, one or more caches (e.g., memory local to or included in the processor chipset (e.g., processor 500), or other memory (e.g., random access memory (RAM), read-only memory (ROM), dynamic RAM (DRAM), synchronous dynamic RAM (SDRAM), static RAM (SRAM), ferroelectric RAM (FeRAM), magnetic RAM (MRAM), resistive RAM (RRAM), flash memory, phase-change memory (PCM), etc.)).

[0106] The controller 502 may be configured to manage and coordinate various operations of the processor 500 (e.g., signaling, receiving, acquiring, retrieving, transmitting, outputting, transferring, storing, determining, identifying, accessing, writing, reading) in order to enable the processor 500 to support various operations according to the examples described herein. For example, the controller 502 may act as a control unit of the processor 500, generating control signals that manage the operation of various components of the processor 500. These control signals include enabling or disabling functional units, selecting data paths, initiating memory access, and coordinating the timing of operations.

[0107] The controller 502 may be configured to fetch instructions from memory 504 (e.g., retrieve, retrieve, receive) and determine subsequent instructions to be executed in order to enable the processor 500 to support various operations according to the examples described herein. The controller 502 may be configured to track the memory address of the instruction associated with memory 504. The controller 502 may be configured to decode instructions to determine the operation to be performed and the operands involved. For example, the controller 502 may be configured to interpret instructions and determine control signals to be output to other components of the processor 500 in order to enable the processor 500 to support various operations according to the examples described herein. Additionally or alternatively, the controller 502 may be configured to manage the flow of data within the processor 500. The controller 502 may be configured to control the transfer of data between registers, ALU 506, and other functional units of the processor 500.

[0108] Memory 504 may include one or more caches (for example, memory local to or contained within the processor 500, or other memory such as RAM, ROM, DRAM, SDRAM, SRAM, MRAM, flash memory, etc.). In some implementations, memory 504 may reside within or on the processor chipset (for example, locally to the processor 500). In some other implementations, memory 504 may reside outside the processor chipset (for example, remotely to the processor 500).

[0109] Memory 504 may store computer-readable, computer-executable code, which, when executed by the processor 500, causes the processor 500 to perform various functions described herein. The code may be stored in a non-temporary computer-readable medium, such as system memory or another type of memory. The controller 502 and / or the processor 500 may be configured to execute the computer-readable instructions stored in memory 504 in order to cause the processor 500 to perform various functions. For example, the processor 500 and / or the controller 502 may be coupled to or connected to memory 504, and the processor 500 and the controller 502 may be configured to perform various functions described herein. In some examples, the processor 500 may include multiple processors, and memory 504 may include multiple memories. One or more of the multiple processors may be coupled to one or more of the multiple memories, and the multiple memories may be configured individually or collectively to perform various functions described herein.

[0110] One or more ALU506s may be configured to support various operations according to the examples described herein. In some implementations, one or more ALU506s may reside within or on a processor chipset (e.g., processor 500). In some other implementations, one or more ALU506s may reside outside of a processor chipset (e.g., processor 500). One or more ALU506s may perform one or more calculations on data, such as addition, subtraction, multiplication, and division. For example, one or more ALU506s may receive input operands and an arithmetic code that determines the operation to be performed. One or more ALU506s may consist of various logic and arithmetic circuits, including adders, subtractors, shifters, and logic gates, to process and manipulate data according to the calculations. As an addition or alternative, one or more ALU506s may support logical operations such as AND, OR, exclusive OR (XOR), negated OR (NOR), and negated AND (NAND), enabling one or more ALU506s to handle conditional operations, comparisons, and bitwise operations.

[0111] The processor 500 may support wireless communication in accordance with the examples disclosed herein. The processor 500 may be coupled with at least one memory and configured to support at least one controller configured to cause the processor to receive a NAS message containing instructions for UPU header protection, to calculate a UPU MAC using the UPU header as at least one input for UPU protection, and to send an acknowledgment indicating that the UPU header verification was successful.

[0112] In addition, the processor 500 may be configured or operable to support any one or a combination of the following: At least one controller is configured to cause the processor to decide to perform UPU header verification and to calculate the UPU MAC at least in part based on the decision to perform UPU header verification. At least one controller is configured to cause the processor to use the UPU header as at least one input for UPU protection to calculate the UPU MAC. AUSF The controller is configured to perform calculations as follows: At least one controller is configured to cause the processor to determine that UPU header verification was successful. At least one controller is configured to cause the processor to send a MAC UPU-MAC-I indicating that UPU header verification was successful. UE The controller is configured to generate the following: At least one controller is configured to cause the processor to determine the success of the UPU header protection verification and to send a verification instruction to the UDM via the AMF indicating that the UPU header protection verification was successful. At least one controller is configured to cause the processor to receive a capability request regarding whether the UE supports UPU header protection and to send a capability response indicating that the UE supports UPU header protection. The capability response is sent to the AMF in a NAS message as at least one of an initial registration request message or a registration update request message, and the NAS message is forwarded by the AMF to the UDM to indicate that the UE supports UPU header protection.

[0113] Figure 6 shows an example of an NE600 according to an aspect of this disclosure. The NE600 may include a processor 602, a memory 604, a controller 606, and a transceiver 608. The processor 602, the memory 604, the controller 606, or the transceiver 608, or various combinations thereof, or various components thereof, may be examples of means for carrying out various aspects of this disclosure as described herein. These components may be coupled (for example, operationally, communicatively, functionally, electronically, or electrically) via one or more interfaces.

[0114] The processor 602, memory 604, controller 606, or transceiver 608, or various combinations or components thereof, may be implemented in hardware (e.g., circuit configuration). The hardware may include a processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), or other programmable logic device, or any combination thereof configured as or otherwise supporting means for performing the functions described herein.

[0115] The processor 602 may include an intelligent hardware device (e.g., a general-purpose processor, DSP, CPU, ASIC, FPGA, or any combination thereof). In some implementations, the processor 602 may be configured to operate memory 604. In some other implementations, memory 604 may be integrated into the processor 602. The processor 602 may be configured to execute computer-readable instructions stored in memory 604 in order to cause the UE 600 to perform various functions of this disclosure.

[0116] Memory 604 may include volatile or non-volatile memory. Memory 604 may store computer-readable, computer-executable code, which, when executed by processor 602, causes NE600 to perform various functions described herein. The code may be stored in a non-temporary computer-readable medium, such as memory 604 or another type of memory. Computer-readable mediums include both non-temporary computer storage mediums and communication mediums, which include any medium that facilitates the transfer of computer programs from one place to another. Non-temporary storage mediums may be any available medium that can be accessed by a general-purpose or dedicated computer.

[0117] In some implementations, the processor 602 and the memory 604 coupled to the processor 602 may be configured to cause the NE600 to perform one or more of the functions described herein (for example, the processor 602 to execute instructions stored in the memory 604). For example, the processor 602 may support wireless communication in the NE600 according to the examples disclosed herein. The NE600 (e.g., UDM) may be configured or operable to support means for sending a request to the AUSF to apply UPU header protection and sending at least one of the UPU transparent container or UPU header information to the UE, wherein at least one of the UPU transparent container or UPU header information includes an instruction that the UPU header is protected.

[0118] In addition, the NE600 may be configured or operable to support any one or a combination of the following: The method further includes the steps of sending a capability request regarding whether the UE supports UPU header protection and receiving a capability response indicating that the UE supports UPU header protection. The method further includes the steps of sending a capability request regarding whether the UE supports UPU header protection, receiving a capability response indicating that the UE supports UPU header protection, and storing information about the UE capability to support UPU header protection. The method further includes the step of deciding to apply UPU header protection. The request to the AUSF to apply UPU header protection includes at least one of a first instruction indicating that UPU header protection is required, or a second instruction indicating that UPU header validation and acknowledgment are required. The method further includes the step of setting an instruction indicating that an acknowledgment is required, confirming that the UE has received the UPU data and UPU header information and has successfully validated it. The method includes the step of sending an associated instruction for UPU header protection to the UE, the associated instruction instructing the UE to compute a UPU MAC using the UPU header as at least one input for UPU protection. AUSFThe method instructs the UE to calculate as follows. The method further includes the step of generating a UPU transparent container along with an instruction that UPU header protection is set in the UPU header. The method further includes the step of deciding to apply UPU header protection and including one or more of the following in the UPU data sent to a UE that supports UPU header protection: a UPU dataset type specific to the UPU header information, a UPU dataset length specific to the UPU header information, and the UPU header information. The UPU header information included in the UPU data provides integrity protection for the UPU header information. The method further includes the step of deciding to apply UPU header protection and including an instruction in the UPU header sent to the UE that the UPU header is protected as part of the UPU data.

[0119] As an addition or alternative, the NE600 may support at least one memory and at least one processor coupled to the memory, configured to cause the NE to send a request to the AUSF to apply UPU header protection and to send at least one of the UPU transparent container or UPU header information to the UE, wherein at least one of the UPU transparent container or UPU header information includes an instruction that the UPU header is protected.

[0120] In addition, the NE600 may be configured to support any one or a combination of the following: At least one processor is configured to cause the NE to send a capability request regarding whether the UE supports UPU header protection and to receive a capability response indicating that the UE supports UPU header protection. At least one processor is configured to cause the NE to send a capability request regarding whether the UE supports UPU header protection, to receive a capability response indicating that the UE supports UPU header protection and to store information regarding the UE capability to support UPU header protection. At least one processor is configured to cause the NE to decide to apply UPU header protection. The request to the AUSF to apply UPU header protection includes at least one of a first instruction indicating that UPU header protection is required, or a second instruction indicating that UPU header verification and acknowledgment are required. At least one processor is configured to cause the NE to set an instruction indicating that an acknowledgment is required, confirming that the UE has received and successfully verified the UPU data and UPU header information. At least one processor is configured to send an associated instruction for UPU header protection to the UE, which instructs the UE to compute a UPU MAC using the UPU header as at least one input for UPU protection. The associated instruction computes a UPU MAC using the UPU header as at least one input for UPU protection. AUSFThe UE is instructed to perform the calculation as follows. At least one processor is configured to cause the NE to generate a UPU transparent container with instructions that UPU header protection be set in the UPU header. At least one processor is configured to cause the NE to decide to apply UPU header protection and to include one or more of the following in the UPU data sent to a UE that supports UPU header protection: a UPU dataset type specific to the UPU header information, a UPU dataset length specific to the UPU header information, and UPU header information. The UPU header information included in the UPU data provides integrity protection for the UPU header information. At least one processor is configured to cause the NE to decide to apply UPU header protection and to include instructions in the UPU header sent to the UE that the UPU header will be protected as part of the UPU data.

[0121] In some implementations, the processor 602 and the memory 604 coupled to the processor 602 may be configured to cause the NE600 to perform one or more of the functions described herein (for example, the processor 602 executing instructions stored in the memory 604). For example, the processor 602 may support wireless communication in the NE600 according to the examples disclosed herein. The NE600 (e.g., AMF) may be configured or operable to support means for receiving from the UDM at least one of a UPU transparent container or UPU header information including a UPU header protection instruction for the UE, and for transmitting the UPU transparent container or UPU header information to the UE.

[0122] In addition, the NE600 may be configured or operable to support any one or a combination of the following: The method further includes the step of sending a UPU transparent container or UPU header information to the UE as a NAS message containing a UPU header protection instruction. The method further includes the step of generating a UPU transparent container with a UPU header containing a UPU header protection instruction if a transparent container is not received from the UDM and a UPU header protection instruction information element is received.

[0123] As an addition or alternative, the NE600 may support at least one memory and at least one processor coupled to the memory, configured to cause the NE to receive at least one of either a UPU transparent container or UPU header information containing UPU header protection instructions for the UE from the UDM, and to send the UPU transparent container or UPU header information to the UE.

[0124] In addition, the NE600 may be configured to support any one or a combination of the following: At least one processor is configured to cause the NE to send a UPU transparent container or UPU header information to the UE as a NAS message containing a UPU header protection instruction. At least one processor is configured to cause the NE to generate a UPU transparent container with a UPU header containing a UPU header protection instruction if a transparent container is not received from the UDM and a UPU header protection instruction information element is received.

[0125] The controller 606 can manage input and output signals for the NE600. The controller 606 can also manage peripheral devices not integrated into the NE600. In some implementations, the controller 606 may utilize an operating system such as iOS®, ANDROID®, WINDOWS®, or other operating systems. In some implementations, the controller 606 may be implemented as part of the processor 602.

[0126] In some implementations, the NE600 may include at least one transceiver 608. In some other implementations, the NE600 may have two or more transceivers 608. A transceiver 608 may represent a wireless transceiver. A transceiver 608 may include one or more receiver chains 610, one or more transmitter chains 612, or a combination thereof.

[0127] The receiver chain 610 may be configured to receive signals (e.g., control information, data, packets) over a wireless medium. For example, the receiver chain 610 may include one or more antennas for receiving signals over air or a wireless medium. The receiver chain 610 may include at least one amplifier (e.g., a low-noise amplifier (LNA)) configured to amplify the received signal. The receiver chain 610 may include at least one demodulator configured to demodulate the received signal and obtain transmitted data by inverting the modulation technique applied during the transmission of the signal. The receiver chain 610 may include at least one decoder for decoding the demodulated signal and receiving transmitted data.

[0128] The transmitter chain 612 may be configured to generate and transmit signals (e.g., control information, data, packets). The transmitter chain 612 may include at least one modulator for modulating data over a carrier signal and preparing a signal for transmission over a wireless medium. The at least one modulator may be configured to support one or more techniques, such as amplitude modulation (AM), frequency modulation (FM), or digital modulation schemes such as phase-shift keying (PSK) or quadrature amplitude modulation (QAM). The transmitter chain 612 may also include at least one power amplifier configured to amplify the modulated signal to an appropriate power level suitable for transmission over a wireless medium. The transmitter chain 612 may also include one or more antennas for transmitting the amplified signal into the air or wireless medium.

[0129] Figure 7 shows a flowchart of Method 700 according to an aspect of the present disclosure. The operation of the Method may be implemented by a UE as described herein. In some implementations, the UE may execute a set of instructions to control the functional elements of the UE to perform the function described herein. Note that the Method described herein describes possible implementations, and the operation and steps may be rearranged or otherwise modified, and other implementations are possible.

[0130] In 702, the method may include the step of receiving a NAS message containing instructions for UPU header protection. The operation of 702 may be carried out according to the examples described herein. In some implementations, the operation of 702 may be carried out by the UE described with reference to Figure 4.

[0131] In 704, the method may include the step of computing a UPU MAC using a UPU header as at least one input for UPU protection. The operation of 704 may be carried out according to the examples described herein. In some implementations, the operation of 704 may be carried out by the UE described with reference to Figure 4.

[0132] In 706, the method may include the step of sending an acknowledgment indicating that the UPU header verification was successful. The operation of 706 may be carried out according to the examples described herein. In some implementations, the operation of 706 may be carried out by the UE described with reference to Figure 4.

[0133] Figure 8 shows a flowchart of Method 800 according to an aspect of the present disclosure. The operation of the Method may be implemented by an NE (e.g., UDM) as described herein. In some implementations, the NE may execute a set of instructions to control the functional elements of the NE to perform the function described herein. Note that the Method described herein describes possible implementations, and the operation and steps may be rearranged or otherwise modified, and other implementations are possible.

[0134] In 802, the method may include the step of sending a request to the AUSF to apply UPU header protection. The operation of 802 may be carried out according to the examples described herein. In some implementations, the operation of 802 may be carried out by the NE described with reference to Figure 6.

[0135] In 804, the method may include the step of sending at least one of UPU transparent container or UPU header information to the UE, wherein at least one of UPU transparent container or UPU header information includes an instruction that the UPU header is protected. The operation of 804 may be carried out according to the examples described herein. In some implementations, the operation of 804 may be carried out by the NE described with reference to Figure 6.

[0136] Figure 9 shows a flowchart of Method 900 according to an aspect of the present disclosure. The operation of the Method may be implemented by a NE (e.g., AMF) as described herein. In some implementations, the NE may execute a set of instructions for controlling the functional elements of the NE to perform the function described herein. Note that the Method described herein describes possible implementations, and the operation and steps may be rearranged or otherwise modified, and other implementations are possible.

[0137] In 902, the method may include the step of receiving from the UDM at least one of either a UPU transparent container or UPU header information containing instructions for UPU header protection for the UE. The operation of 902 may be carried out according to the examples described herein. In some implementations, the operation of 902 may be carried out by the NE described with reference to Figure 6.

[0138] In 904, the method may include the step of sending UPU transparent container or UPU header information to the UE. The operation of 904 may be carried out according to the examples described herein. In some implementations, the operation of 904 may be carried out by the NE described with reference to Figure 6.

[0139] The descriptions herein are provided to enable those skilled in the art to create or use this disclosure. Various modifications to this disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other variations without departing from the scope of this disclosure. Thus, this disclosure is not limited to the examples and designs described herein, but is given the broadest scope that is consistent with the principles and novel features disclosed herein. [Explanation of symbols]

[0140] 102 NE 104 UE 106 Core Network (CN), CN 200 Example 202 AMF 204 AUSF 206 UDM 300 Example 302 AMF 304 AUSF 306 UDM 400 UE 402 Processors 404 memory 406 Controller 408 Transceiver 410 Receiver Chain 412 Transmitter Chain 500 processors 502 Controller 504 memory 506 Arithmetic Logic Unit (ALU), ALU 600 UE, NE 602 Processors 604 memory 606 Controller 608 Transceiver 610 Receiver Chain 612 Transmitter Chain 700 methods 800 ways 900 methods

Claims

1. User equipment (UE) for wireless communication, At least one memory, The system comprises at least one processor coupled to the at least one memory, and the at least one processor provides the UE, Receiving a Non-Access Layer (NAS) message containing instructions for protecting the UE Parameter Update (UPU) header, The UPU Message Authentication Code (MAC) is calculated using the UPU header as at least one input for UPU protection, Send an acknowledgment indicating that UPU header verification was successful. A UE configured to perform the following actions.

2. The aforementioned at least one processor provides the UE, The decision was made to perform the aforementioned UPU header verification, Calculating the UPU MAC based at least in part on the decision to perform the UPU header verification. The UE according to claim 1, configured to perform the following.

3. The at least one processor sends the UPU MAC to the UE using the UPU header as the at least one input for UPU protection. AUSF The UE according to claim 1, configured to perform calculations as follows.

4. The UE according to claim 1, wherein the at least one processor is configured to cause the UE to determine that the UPU header verification was successful.

5. The at least one processor sends a MAC UPU-MAC-I to the UE indicating that the UPU header verification was successful. UE The UE according to claim 1, configured to cause the generation of

6. The aforementioned at least one processor provides the UE, To determine the success of the verification of the UPU header protection, The Access and Mobility Management Function (AMF) sends a verification instruction to the Unified Data Management (UDM) indicating that the verification of the UPU header protection has been successful. The UE according to claim 1, configured to perform the following.

7. The aforementioned at least one processor provides the UE, The UE receives a capability request regarding whether it supports the UPU header protection, The UE sends a capability response indicating that it supports the UPU header protection. The UE according to claim 1, configured to perform the following.

8. The UE according to claim 7, wherein the capability response is sent to the Access and Mobility Management Function (AMF) in a NAS message as at least one of an initial registration request message or a registration update request message, and the NAS message is forwarded by the AMF to Unified Data Management (UDM) to indicate that the UE supports the UPU header protection.

9. A processor for wireless communication, It comprises at least one controller coupled to at least one memory, and the at least one controller provides the processor, Receiving a Non-Access Layer (NAS) message containing instructions for protecting the UE Parameter Update (UPU) header, The UPU Message Authentication Code (MAC) is calculated using the UPU header as at least one input for UPU protection, Send an acknowledgment indicating that UPU header verification was successful. A processor configured to perform the following task.

10. The at least one controller provides the processor with The decision was made to perform the aforementioned UPU header verification, Calculating the UPU MAC based at least in part on the decision to perform the UPU header verification. A processor according to claim 9, configured to perform the following:

11. The at least one controller provides the processor with the UPU MAC using the UPU header as the at least one input for UPU protection. AUSF The processor according to claim 9, configured to perform calculations as follows.

12. The processor according to claim 9, wherein the at least one controller is configured to cause the processor to determine that the UPU header verification was successful.

13. The at least one controller sends a MAC UPU-MAC-I to the processor indicating that the UPU header verification was successful. UE The processor according to claim 9, configured to perform the task of generating.

14. The at least one controller provides the processor with To determine the success of the verification of the UPU header protection, The Access and Mobility Management Function (AMF) sends a verification instruction to the Unified Data Management (UDM) indicating that the verification of the UPU header protection has been successful. A processor according to claim 9, configured to perform the following:

15. The at least one controller provides the processor with The UE receives a capability request regarding whether it supports the UPU header protection, The UE sends a capability response indicating that it supports the UPU header protection. A processor according to claim 9, configured to perform the following:

16. The processor according to claim 15, wherein the capability response is transmitted to the Access and Mobility Management Function (AMF) in a NAS message as at least one of an initial registration request message or a registration update request message, and the NAS message is forwarded by the AMF to Unified Data Management (UDM) to indicate that the UE supports the UPU header protection.

17. A method performed by user equipment (UE), The steps include receiving an Accessible Layer (NAS) message containing instructions for protecting the UE Parameter Update (UPU) header, A step of calculating a UPU message authentication code (MAC) using the UPU header as at least one input for UPU protection, The steps include sending an acknowledgment indicating that UPU header verification was successful, and Methods that include...

18. The step of deciding to perform the aforementioned UPU header verification, A step of calculating the UPU MAC based at least in part on the decision to perform the UPU header verification; The method according to claim 17, further comprising:

19. The UPU MAC is configured using the UPU header as the at least one input for UPU protection. AUSF Steps to calculate as The method according to claim 17, further comprising:

20. Network equipment (NE) for wireless communication, At least one memory, The system comprises at least one processor coupled to the at least one memory, and the at least one processor provides the NE, Sending a request to the Authentication Server Function (AUSF) to apply User Device Parameter Update (UPU) header protection, Transmitting at least one of UPU transparent container or UPU header information to a user device (UE), wherein the UPU transparent container or at least one of the UPU header information includes an instruction that the UPU header is protected. NE is configured to perform the following action.

Images