Registration and security enhancements for WTRUs with multiple USIMs

Abstract

Described herein are methods and apparatus for registration and security for a wireless transmit / receive unit (WTRU) with multiple universal subscriber identity modules (USIMs). Described herein is an optimized registration and authentication procedure that enables a WTRU to register and authenticate multiple USIMs during a single registration and authentication procedure. The techniques described herein may eliminate the need for separate registration and authentication procedures for each USIM. A gateway device may inform the network in a registration request message that it is registering multiple devices (i.e., multiple WTRUs). The network and gateway may then perform the authentication procedure using an aggregate challenge / response (i.e., a single challenge for each WTRU). The WTRU may inform the network in a registration request message that it is registering multiple USIMs. The network and WTRU may then perform the authentication procedure using an aggregate challenge / response (i.e., a single challenge for all USIMs).

Description

[Technical field]

[0001] (CROSS REFERENCE TO RELATED APPLICATIONS) This application claims the benefit of U.S. Provisional Patent Application No. 62 / 888,109, filed Aug. 16, 2019, which is incorporated by reference in its entirety. [Background technology]

[0002] When a wireless transmit / receive unit (WTRU) has two or more SIM cards (e.g., two or more universal subscriber identity modules (USIMs)), under some systems, the WTRU performs a separate network registration and authentication procedure for each USIM in order for the user to access services offered by each USIM. This is inefficient because the registration and authentication procedures take time and resources. For example, the WTRU may perform two separate registration and authentication procedures to identify the SIM card, which is a time-consuming and resource-consuming process. Furthermore, security procedures for a WTRU with two or more SIM cards may result in multiple message exchanges to ensure that all subscriptions involved are authenticated.

[0003] Therefore, there is a need to enhance registration and security procedures for WTRUs with multiple universal subscriber identity modules (MUSIMs). Summary of the Invention

[0004] This Summary is provided to introduce a selection of concepts in a simplified form, which are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. Moreover, the claimed subject matter is not limited to limitations that solve any or all of the disadvantages noted in any part of this disclosure.

[0005] Described herein are methods and apparatus for registration and security for a wireless transmit / receive unit (WTRU) having multiple universal subscriber identity modules (USIMs). Described herein are optimized registration and authentication procedures that allow a WTRU to register and authenticate multiple USIMs during one registration and authentication procedure. The techniques described herein may eliminate the need for separate registration and authentication procedures for each USIM.

[0006] According to one embodiment, the WTRU may inform the network that it is registering multiple USIMs in a registration request message. The network and the WTRU may then perform the authentication procedure with an aggregate challenge / response (i.e., a single authentication challenge and a single authentication response for all USIMs). For example, the authentication procedure may be modified such that the challenge message includes multiple random numbers (RAND) and the response message includes multiple responses (RES). The WTRU may include one encrypted subscriber identifier (SUCI) for USIM1 and an indication for multiple USIM (MUSIM) registration (USIM1 and USIM2) to perform the authentication procedure with the MUSIM aggregate challenge / response. The WTRU may receive a single authentication challenge but not two ngKSIs. The ME may pass RES1 as an authentication challenge to USIM2 and obtain a first aggregate authentication response RES2. The WTRU may include the aggregate authentication response RES2 in the authentication response sent to the network. In another example, the gateway device may inform the network in the registration request message that it is registering multiple devices (i.e., multiple WTRUs). The network and gateway may then perform the authentication procedure with an aggregate challenge / response (i.e., a single authentication challenge and a single authentication response for all WTRUs).

[0007] According to another embodiment, the WTRU may perform registration of both USIM cards by inserting a flag and using a parent identity. Based on an operator configuration, the network sends only one Globally Unique Temporary Identifier (GUTI) for the first (parent) identity in the registration accept. The WTRU may then determine the second GUTI. In one example, the WTRU may send a registration message associated with two identities, where the registration includes a flag indicating the first identity of the two identities. The WTRU may then receive a registration accept message from the network including one identifier associated with the first identity. The WTRU may then determine a second identifier associated with the second identity of the two identities based on the registration accept message. [Brief description of the drawings]

[0008] In order to facilitate a more thorough understanding of the present application, reference is now made to the accompanying drawings, in which like elements are referred to with like reference numerals, and in which these drawings should not be construed as limiting the present application, but are intended for illustration only.

[0009] Additionally, like reference numbers in the figures refer to like elements.

[0010] [Figure 1A] FIG. 1 is a system diagram illustrating an example communication system in which one or more disclosed embodiments may be implemented.

[0011] [Figure 1B] 1 is a system diagram illustrating an example wireless transmit / receive unit (WTRU) that may be used within the communications system illustrated in FIG. 1A, according to one embodiment.

[0012] [Figure 1C]FIG. 1B is a system diagram illustrating an example radio access network (RAN) and an example core network (CN) that may be used within the communication system illustrated in FIG. 1A, according to one embodiment.

[0013] [Figure 1D] FIG. 1B is a system diagram illustrating a further exemplary RAN and a further exemplary CN that may be used within the communication system illustrated in FIG. 1A, according to one embodiment.

[0014] [Diagram 2] FIG. 1 is a diagram of a reference model of a potential architecture for a 5G or NextGen network.

[0015] [Diagram 3] 1 is a high-level diagram of a solution for MUSIM authentication in which the WTRU authenticates various USIMs with the network using a combined authentication procedure.

[0016] [Figure 4] FIG. 1 is a diagram of the identification part of the authentication procedure.

[0017] [Diagram 5] A diagram of the 5G AKA authentication procedure.

[0018] [Figure 6] 1 illustrates a high-level diagram of a solution for MUSIM authentication in which the WTRU authenticates various USIMs with the network using a combined authentication procedure.

[0019] [Figure 7] 1 illustrates a high-level diagram of a solution for MUSIM authentication in which a gateway authenticates various WTRUs with the network using a combined authentication procedure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0020] Described herein are methods and apparatus for registration and security of a wireless transmit / receive unit (WTRU) having multiple universal subscriber identity modules (USIMs). According to one embodiment, a WTRU may inform the network in a registration request message that it is registering multiple USIMs. The network and the WTRU may then perform an authentication procedure using an aggregate challenge / response (i.e., a single challenge and a single response for all USIMs). In another example, a gateway device may inform the network in a registration request message that it is registering multiple devices (i.e., multiple WTRUs). The network and the gateway may then perform an authentication procedure using an aggregate challenge / response (i.e., a single challenge and a single response for all WTRUs).

[0021] 1A is a diagram illustrating an example communication system 100 in which one or more disclosed embodiments may be implemented. The communication system 100 may be a multiple access system that provides content, such as voice, data, video, messaging, broadcasts, etc., to multiple wireless users. The communication system 100 may enable multiple wireless users to access such content through sharing of system resources, including wireless bandwidth. For example, the communications system 100 may employ one or more channel access methods, such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal FDMA (OFDMA), single-carrier FDMA (SC-FDMA), zero-tail unique-word DFT-Spread OFDM (ZT UW DTS-s OFDM), unique word OFDM (UW-OFDM), resource block filtered OFDM, filter bank multicarrier (FBMC), and / or the like.

[0022] 1A, the communications system 100 may include WTRUs 102a, 102b, 102c, 102d, a RAN 104 / 113, a CN 106 / 115, a public switched telephone network (PSTN) 108, the Internet 110, and other networks 112, although it will be understood that the disclosed embodiments contemplate any number of WTRUs, base stations, networks, and / or network elements. Each of the WTRUs 102a, 102b, 102c, 102d may be any type of device configured to operate and / or communicate in a wireless environment. By way of example, the WTRUs 102a, 102b, 102c, 102d, any of which may be referred to as a “station” and / or “STA,” may be configured to transmit and / or receive wireless signals and may include user equipment (UE), mobile stations, fixed or mobile subscriber units, subscription-based units, pagers, cellular phones, personal digital assistants (PDAs), smartphones, laptops, netbooks, personal computers, wireless sensors, hotspots or Mi-Fi devices, Internet of Things (IoT) devices, watches or other wearables, head-mounted displays (HMDs), vehicles, drones, medical devices and applications (e.g., remote surgery), industrial devices and applications (e.g., robots and / or other wireless devices operating in an industrial and / or automated processing chain context), consumer electronics devices, devices operating in commercial and / or industrial wireless networks, etc. Any of the WTRUs 102a, 102b, 102c, and 102d may be referred to interchangeably as a UE.

[0023] The communication system 100 may also include a base station 114a and / or a base station 114b. Each of the base stations 114a, 114b may be any type of device configured to wirelessly interface with at least one of the WTRUs 102a, 102b, 102c, 102d to facilitate access to one or more communication networks, such as the CN 106 / 115, the Internet 110, and / or other networks 112. By way of example, the base stations 114a, 114b may be a base transceiver station (BTS), a Node B, an eNodeB, a Home Node B, a Home eNodeB, a gNB, an NR NodeB, a site controller, an access point (AP), a wireless router, etc. Although the base stations 114a, 114b are each depicted as a single element, it will be understood that the base stations 114a, 114b may include any number of interconnected base stations and / or network elements.

[0024] The base station 114a may be part of the RAN 104 / 113, which may also include other base stations and / or network elements (not shown), such as a base station controller (BSC), a radio network controller (RNC), relay nodes, etc. The base station 114a and / or base station 114b may be configured to transmit and / or receive wireless signals on one or more carrier frequencies, which may be referred to as cells (not shown). These frequencies may be licensed spectrum, unlicensed spectrum, or a combination of licensed and unlicensed spectrum. A cell may provide coverage for wireless services in a particular geographic area, which may be relatively fixed or may change over time. A cell may be further divided into cell sectors. For example, the cell associated with the base station 114a may be divided into three sectors. Thus, in one embodiment, the base station 114a may include three transceivers, one for each sector of the cell. In one embodiment, the base station 114a may employ multiple-input multiple output (MIMO) technology and may utilize multiple transceivers for each sector of the cell, for example, using beamforming to transmit and / or receive signals in a desired spatial direction.

[0025] The base stations 114a, 114b may communicate with one or more of the WTRUs 102a, 102b, 102c, 102d over an air interface 116, which may be any suitable wireless communication link (e.g., radio frequency (RF), microwave, centimeter wave, micrometer wave, infrared (IR), ultraviolet (UV), visible light, etc.). The air interface 116 may be established using any suitable radio access technology (RAT).

[0026] More specifically, as discussed above, the communication system 100 may be a multiple access system and may employ one or more channel access schemes, such as CDMA, TDMA, FDMA, OFDMA, SC-FDMA, etc. For example, the base stations 114a and the WTRUs 102a, 102b, 102c in the RAN 104 / 113 may implement a radio technology such as Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access (UTRA), which may establish the air interface 115 / 116 / 117 using wideband CDMA (WCDMA). WCDMA may include communication protocols such as High-Speed ​​Packet Access (HSPA) and / or Evolved HSPA (HSPA+). HSPA may include High-Speed ​​Downlink (DL) Packet Access (HSDPA) and / or High-Speed ​​Uplink Packet Access (HSUPA).

[0027] In one embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement a radio technology such as Evolved UMTS Terrestrial Radio Access (E-UTRA), which may establish the air interface 116 using Long Term Evolution (LTE), and / or LTE-Advanced (LTE-Advanced, LTE-A), and / or LTE-Advanced Pro (LTE-Advanced Pro, LTE-APro).

[0028] In one embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement a radio technology such as NR radio access, which may establish the air interface 116 using New Radio (NR).

[0029] In one embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement multiple radio access technologies. For example, the base station 114a and the WTRUs 102a, 102b, 102c may implement LTE radio access and NR radio access together, e.g., using dual connectivity (DC) principles. Thus, the air interface utilized by the WTRUs 102a, 102b, 102c may be characterized by multiple types of radio access technologies and / or transmissions sent between multiple types of base stations (e.g., eNBs and gNBs).

[0030] In other embodiments, the base station 114a and the WTRUs 102a, 102b, 102c may implement a radio technology such as IEEE 802.11 (i.e., Wireless Fidelity, WiFi), IEEE 802.16 (i.e., Worldwide Interoperability for Microwave Access, WiMAX), CDMA2000, CDMA2000 1X, CDMA2000 EV-DO, Interim Standard 2000 (IS-2000), Interim Standard 95 (IS-95), Interim Standard 856 (IS-856), Global System for Mobile communication (GSM), Enhanced Data rates for GSM Evolution (EDGE), GSM EDGE (GERAN), etc.

[0031] 1A may be, for example, a wireless router, a Home NodeB, a Home eNodeB, or an access point, and may utilize any suitable RAT to facilitate wireless connectivity within a localized area, such as an office, a home, a vehicle, a campus, an industrial facility, an air corridor (e.g., for use by drones), a roadway, etc. In one embodiment, the base station 114b and the WTRUs 102c, 102d may implement a radio technology such as IEEE 802.11 to establish a wireless local area network (WLAN). In one embodiment, the base station 114b and the WTRUs 102c, 102d may implement a radio technology such as IEEE 802.15 to establish a wireless personal area network (WPAN). In yet another embodiment, the base station 114b and the WTRUs 102c, 102d may establish a picocell or a femtocell utilizing a cellular-based RAT (e.g., WCDMA, CDMA2000, GSM, LTE, LTE-A, LTE-A Pro, NR, etc.). As shown in FIG. 1A, the base station 114b may have a direct connection to the Internet 110. Thus, the base station 114b may not need to access the Internet 110 via the CN 106 / 115.

[0032] The RAN 104 / 113 may communicate with the CN 106 / 115, which may be any type of network configured to provide voice, data, application, and / or voice over internet protocol (VoIP) services to one or more of the WTRUs 102a, 102b, 102c, 102d. The data may have various quality of service (QoS) requirements, such as different throughput requirements, latency requirements, error tolerance requirements, reliability requirements, data throughput requirements, mobility requirements, etc. The CN 106 / 115 may provide call control, billing services, mobile location-based services, prepaid calls, Internet connectivity, video distribution, etc., and / or perform high-level security functions such as user authentication. Although not shown in FIG. 1A, it will be understood that the RAN 104 / 113 and / or the CN 106 / 115 may communicate directly or indirectly with other RANs that use the same RAT as the RAN 104 / 113 or a different RAT. For example, in addition to being connected to the RAN 104 / 113, which may utilize NR radio technology, the CN 106 / 115 may also communicate with another RAN (not shown) employing GSM, UMTS, CDMA2000, WiMAX, E-UTRA, or WiFi radio technology.

[0033] The CN 106 / 115 may also act as a gateway for the WTRUs 102a, 102b, 102c, 102d to access the PSTN 108, the Internet 110, and / or other networks 112. The PSTN 108 may include a circuit-switched telephone network providing plain old telephone service (POTS). The Internet 110 may include a global system of interconnected computer networks and devices that use common communications protocols, such as transmission control protocol (TCP), user datagram protocol (UDP), and / or internet protocol (IP) in the TCP / IP Internet protocol suite. The networks 112 may include wired and / or wireless communication networks owned and / or operated by other service providers. For example, the networks 112 may include another CN connected to one or more RANs, which may employ the same RAT as the RANs 104 / 113 or a different RAT.

[0034] Some or all of the WTRUs 102a, 102b, 102c, 102d in the communications system 100 may include multi-mode capabilities (e.g., the WTRUs 102a, 102b, 102c, 102d may include multiple transceivers for communicating with different wireless networks over different wireless links). For example, the WTRU 102c shown in FIG. 1A may be configured to communicate with a base station 114a, which may employ a cellular-based wireless technology, and with a base station 114b, which may employ an IEEE 802 wireless technology.

[0035] 1B is a system diagram illustrating an example WTRU 102. As shown in FIG. 1B, the WTRU 102 may include, among other things, a processor 118, a transceiver 120, a transmit / receive element 122, a speaker / microphone 124, a keypad 126, a display / touchpad 128, non-removable memory 130, removable memory 132, a power source 134, a global positioning system (GPS) chipset 136, and / or other peripherals 138. It will be understood that the WTRU 102 may include any sub-combination of the foregoing elements while remaining consistent with an embodiment.

[0036] The processor 118 may be a general purpose processor, a special purpose processor, a conventional processor, a digital signal processor (DSP), multiple microprocessors, one or more microprocessors associated with a DSP core, a controller, a microcontroller, an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) circuit, any other type of integrated circuit (IC), a state machine, etc. The processor 118 may perform signal coding, data processing, power control, input / output processing, and / or any other functionality that enables the WTRU 102 to operate in a wireless environment. The processor 118 may be coupled to the transceiver 120, which may be coupled to the transmit / receive element 122. Although FIG. 1B depicts the processor 118 and the transceiver 120 as separate components, it will be understood that the processor 118 and the transceiver 120 may be integrated together in an electronic package or chip.

[0037] The transmit / receive element 122 may be configured to transmit signals to or receive signals from a base station (e.g., base station 114a) over the air interface 116. For example, in one embodiment, the transmit / receive element 122 may be an antenna configured to transmit and / or receive RF signals. In one embodiment, the transmit / receive element 122 may be an emitter / detector configured to transmit and / or receive IR, UV, or visible light signals, for example. In yet another embodiment, the transmit / receive element 122 may be configured to transmit and / or receive both RF and light signals. It will be appreciated that the transmit / receive element 122 may be configured to transmit and / or receive any combination of wireless signals.

[0038] 1B as a single element, the WTRU 102 may include any number of transmit / receive elements 122. More specifically, the WTRU 102 may employ MIMO technology. Thus, in one embodiment, the WTRU 102 may include two or more transmit / receive elements 122 (e.g., multiple antennas) for transmitting and receiving wireless signals over the air interface 116.

[0039] The transceiver 120 may be configured to modulate signals to be transmitted by the transmit / receive element 122 and demodulate signals received by the transmit / receive element 122. As mentioned above, the WTRU 102 may have multi-mode capabilities. Thus, the transceiver 120 may include multiple transceivers to enable the WTRU 102 to communicate via multiple RATs, such as, for example, NR and IEEE 802.11.

[0040] The processor 118 of the WTRU 102 may be coupled to and may receive user input data from a speaker / microphone 124, a keypad 126, and / or a display / touchpad 128 (e.g., a liquid crystal display (LCD) display unit or an organic light-emitting diode (OLED) display unit). The processor 118 may also output user data to the speaker / microphone 124, the keypad 126, and / or the display / touchpad 128. In addition, the processor 118 may access information from and store data in any type of suitable memory, such as a non-removable memory 130 and / or a removable memory 132. The non-removable memory 130 may include random-access memory (RAM), read-only memory (ROM), a hard disk, or any other type of memory storage device. The removable memory 132 may include a subscriber identity module (SIM) card, a memory stick, a secure digital (SD) memory card, or the like. In other embodiments, the processor 118 may access information from and store data in memory that is not physically located on the WTRU 102, such as on a server or home computer (not shown).

[0041] The processor 118 may receive power from the power source 134 and may be configured to distribute and / or control the power to other components within the WTRU 102. The power source 134 may be any suitable device for powering the WTRU 102. For example, the power source 134 may include one or more dry batteries (e.g., nickel-cadmium (NiCd), nickel-zinc (NiZn), nickel metal hydride (NiMH), lithium-ion (Li-ion), etc.), solar cells, fuel cells, etc.

[0042] The processor 118 may also be coupled to a GPS chipset 136, which may be configured to provide location information (e.g., longitude and latitude) regarding a current location of the WTRU 102. In addition to, or in lieu of, information from the GPS chipset 136, the WTRU 102 may receive location information from a base station (e.g., base stations 114a, 114b) over the air interface 116 and / or determine its location based on the timing of signals being received from two or more nearby base stations. It will be appreciated that the WTRU 102 may acquire location information by way of any suitable location determination method while remaining consistent with an embodiment.

[0043] The processor 118 may further be coupled to other peripherals 138, which may include one or more software and / or hardware modules that provide additional features, functionality, and / or wired or wireless connectivity. For example, the peripherals 138 may include an accelerometer, an electronic compass, a satellite transceiver, a digital camera (for photos and / or videos), a universal serial bus (USB) port, a vibration device, a television transceiver, a hands-free headset, a Bluetooth® module, a frequency modulated (FM) radio unit, a digital music player, a media player, a video game player, an Internet browser, a Virtual Reality and / or Augmented Reality (VR / AR) device, an activity tracker, and the like. The peripherals 138 may include one or more sensors, which may be one or more of a gyroscope, an accelerometer, a Hall effect sensor, a magnetometer, an orientation sensor, a proximity sensor, a temperature sensor, a time sensor, a geolocation sensor, an altimeter, a light sensor, a touch sensor, a magnetometer, a barometer, a gesture sensor, a biometric sensor, and / or a humidity sensor.

[0044] The WTRU 102 may include a full-duplex radio where the transmission and reception of some or all of the signals (e.g., associated with a particular subframe for both the UL (e.g., for transmission) and the downlink (e.g., for reception)) may be parallel and / or simultaneous. The full-duplex radio may include an interference management unit 139 to reduce and or substantially eliminate self-interference via either hardware (e.g., chokes) or signal processing via a processor (e.g., via a separate processor (not shown) or processor 118). In one embodiment, the WRTU 102 may include a half-duplex radio for the transmission and reception of some or all of the signals (e.g., associated with a particular subframe for either the UL (e.g., for transmission) or the downlink (e.g., for reception)).

[0045] 1C is a system diagram illustrating the RAN 104 and the CN 106, according to one embodiment. As mentioned above, the RAN 104 may employ E-UTRA radio technology to communicate with the WTRUs 102a, 102b, 102c over the air interface 116. The RAN 104 may also communicate with the CN 106.

[0046] The RAN 104 may include eNode-Bs 160a, 160b, 160c, although it will be understood that the RAN 104 may include any number of eNode-Bs while remaining consistent with an embodiment. The eNode-Bs 160a, 160b, 160c may each include one or more transceivers for communicating with the WTRUs 102a, 102b, 102c over the air interface 116. In one embodiment, the eNode-Bs 160a, 160b, 160c may implement MIMO technology. Thus, the eNode-B 160a may, for example, use multiple antennas to transmit wireless signals to and / or receive wireless signals from the WTRU 102a.

[0047] Each of the eNode-Bs 160a, 160b, 160c may be associated with a particular cell (not shown) and may be configured to handle radio resource management decisions, handover decisions, scheduling of users in the UL and / or DL, etc. As shown in FIG 1C, the eNode-Bs 160a, 160b, 160c may communicate with one another over an X2 interface.

[0048] 1C may include a mobility management entity (MME) 162, a serving gateway (SGW) 164, and a packet data network (PDN) gateway (or PGW) 166. Although each of the foregoing elements is depicted as part of the CN 106, it will be understood that any of these elements may be owned and / or operated by an entity other than the CN operator.

[0049] The MME 162 may be connected to each of the eNode-Bs 162a, 162b, 162c in the RAN 104 via an S1 interface and may act as a control node. For example, the MME 162 may be responsible for authenticating users of the WTRUs 102a, 102b, 102c, activating / deactivating bearers, selecting a particular serving gateway during initial attachment of the WTRUs 102a, 102b, 102c, etc. The MME 162 may provide a control plane function for switching between the RAN 104 and other RANs (not shown) that employ other radio technologies, such as GSM and / or WCDMA.

[0050] The SGW 164 may be connected to each of the eNodeBs 160a, 160b, 160c in the RAN 104 via an S1 interface. The SGW 164 may generally route and forward user data packets to / from the WTRUs 102a, 102b, 102c. The SGW 164 may perform other functions such as anchoring the user plane during inter-eNodeB handover, triggering paging when DL data is available for the WTRUs 102a, 102b, 102c, managing and storing the context of the WTRUs 102a, 102b, 102c, etc.

[0051] The SGW 164 may be connected to a PGW 166, which may provide the WTRUs 102a, 102b, 102c with access to packet-switched networks, such as the Internet 110, to facilitate communications between the WTRUs 102a, 102b, 102c and IP-enabled devices.

[0052] The CN 106 may facilitate communications with other networks. For example, the CN 106 may provide the WTRUs 102a, 102b, 102c with access to circuit-switched networks, such as the PSTN 108, to facilitate communications between the WTRUs 102a, 102b, 102c and traditional land-line communications devices. For example, the CN 106 may include or communicate with an IP gateway (e.g., an IP multimedia subsystem (IMS) server) that serves as an interface between the CN 106 and the PSTN 108. In addition, the CN 106 may provide the WTRUs 102a, 102b, 102c with access to other networks 112, which may include other wired and / or wireless networks owned and / or operated by other service providers.

[0053] Although the WTRU is described in FIGS. 1A-1D as a wireless terminal, it is contemplated that in some representative embodiments such a terminal may use a wired communications interface (e.g., temporarily or permanently) with the communications network.

[0054] In an exemplary embodiment, the other network 112 may be a WLAN.

[0055] A WLAN in infrastructure Basic Service Set (BSS) mode may have an access point (AP) for the BSS and one or more stations (STAs) associated with the AP. The AP may have access or interface to a Distribution System (DS) or another type of wired / wireless network that carries traffic into and / or out of the BSS. Traffic to a STA originating from outside the BSS may arrive through the AP and be delivered to the STA. Traffic originating from a STA to a destination outside the BSS may be sent to the AP and delivered to the respective destination. Traffic between STAs within a BSS may be sent through the AP, for example, where a source STA may send traffic to the AP, which may deliver the traffic to the destination STA. Traffic between STAs within a BSS may be considered and / or referred to as peer-to-peer traffic. Peer-to-peer traffic may be sent between (e.g., directly between) a source STA and a destination STA using a direct link setup (DLS). In some representative embodiments, the DLS may use 802.11e DLS or 802.11z tunneled DLS (TDLS). A WLAN using an Independent BSS (IBSS) mode may not have an AP, and STAs (e.g., all of the STAs) in or using the IBSS may communicate directly with each other. The IBSS communication mode may sometimes be referred to herein as an "ad-hoc" communication mode.

[0056] When using an 802.11ac infrastructure mode of operation or a similar mode of operation, an AP may transmit a beacon on a fixed channel, such as a primary channel. The primary channel may be a fixed width (e.g., a 20 MHz wide bandwidth) or a width that is dynamically set via signaling. The primary channel may be an operating channel of the BSS and may be used by STAs to establish a connection with the AP. In some representative embodiments, for example, in an 802.11 system, Carrier Sense Multiple Access / Collision Avoidance (CSMA / CA) with collision avoidance may be implemented. With CSMA / CA, STAs (e.g., every STA), including the AP, may sense the primary channel. If the primary channel is sensed / detected by a particular STA and / or determined to be busy, the particular STA may back off. One STA (e.g., only one station) may transmit at any given time in a given BSS.

[0057] A High Throughput (HT) STA may use a 40 MHz wide channel for communication, for example, via a combination of a primary 20 MHz channel and adjacent or non-adjacent 20 MHz channels to form a 40 MHz wide channel.

[0058] A Very High Throughput (VHT) STA may support 20 MHz, 40 MHz, 80 MHz, and / or 160 MHz wide channels. A 40 MHz channel and / or an 80 MHz channel may be formed by combining consecutive 20 MHz channels. A 160 MHz channel may be formed by combining eight consecutive 20 MHz channels or by combining two non-consecutive 80 MHz channels, which may be referred to as an 80+80 configuration. For the 80+80 configuration, the data may be passed through a segment parser that may split the data into two streams after channel coding. Inverse Fast Fourier Transform (IFFT) processing and time domain processing may be performed separately on each stream. The streams may be mapped onto two 80 MHz channels and the data may be transmitted by the transmitting STA. At the receiver of the receiving STA, the operations described above for the 80+80 configuration may be reversed and the combined data may be sent to the Medium Access Control (MAC).

[0059] Sub-1 GHz operation modes are supported by 802.11af and 802.11ah. Channel operating bandwidths and carriers are reduced in 802.11af and 802.11ah compared to those used in 802.11n and 802.11ac. 802.11af supports 5 MHz, 10 MHz, and 20 MHz bandwidths in TV White Space (TVWS) spectrum, and 802.11ah supports 1 MHz, 2 MHz, 4 MHz, 8 MHz, and 16 MHz bandwidths using non-TVWS spectrum. According to a representative embodiment, 802.11ah may support meter-type control / machine-type communication, such as MTC devices in macro coverage areas. MTC devices may have limited functionality, including some functions, such as support for (e.g., support for only) some and / or limited bandwidths. MTC devices may include batteries with above-threshold battery life (e.g., to maintain very long battery life).

[0060] A WLAN system that may support multiple channels and channel bandwidths, such as 802.11n, 802.11ac, 802.11af, and 802.11ah, includes a channel that may be designated as a primary channel. The primary channel may have a bandwidth equal to the largest common operating bandwidth supported by all STAs in the BSS. The bandwidth of the primary channel may be configured and / or limited by the STA from among all STAs operating in the BSS that support the smallest bandwidth operating mode. In an 802.11ah example, the primary channel may be 1 MHz wide for STAs (e.g., MTC type devices) that support (e.g., only support) 1 MHz mode, even if the AP and other STAs in the BSS support 2 MHz, 4 MHz, 8 MHz, 16 MHz, and / or other channel bandwidth operating modes. Carrier sensing and / or network allocation vector (k, NAV) configuration may depend on the status of the primary channel. For example, if the primary channel is busy due to STAs (that only support the 1 MHz mode of operation) transmitting to the AP, the entire available frequency band may be considered busy even though most of the frequency band may remain idle and available for use.

[0061] In the United States, the available frequency bands that can be used by 802.11ah are 902MHz to 928MHz. In South Korea, the available frequency bands are 917.5MHz to 923.5MHz. In Japan, the available frequency bands are 916.5MHz to 927.5MHz. The total bandwidth available for 802.11ah is 6MHz to 26MHz depending on the country code.

[0062] 1D is a system diagram illustrating the RAN 113 and the CN 115, according to one embodiment. As mentioned above, the RAN 113 may employ NR radio technology and communicate with the WTRUs 102a, 102b, 102c over the air interface 116. The RAN 113 may also communicate with the CN 115.

[0063] The RAN 113 may include gNBs 180a, 180b, 180c, although it will be understood that the RAN 113 may include any number of gNBs while remaining consistent with an embodiment. The gNBs 180a, 180b, 180c may each include one or more transceivers for communicating with the WTRUs 102a, 102b, 102c over the air interface 116. In an embodiment, the gNBs 180a, 180b, 180c may implement MIMO technology. For example, the gNBs 180a, 108b may utilize beamforming to transmit signals to and / or receive signals from the gNBs 180a, 180b, 180c. Thus, the gNB 180a may transmit wireless signals to and / or receive wireless signals from the WTRU 102a using, for example, multiple antennas. In one embodiment, the gNBs 180a, 180b, 180c may implement carrier aggregation technology. For example, the gNB 180a may transmit multiple component carriers to the WTRU 102a (not shown). A subset of these component carriers may be on an unlicensed spectrum, while the remaining component carriers may be on a licensed spectrum. In one embodiment, the gNBs 180a, 180b, 180c may implement Coordinated Multi-Point (CoMP) technology. For example, the WTRU 102a may receive coordinated transmissions from the gNBs 180a and 180b (and / or gNB 180c).

[0064] The WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using transmissions associated with scalable numerology. For example, the OFDM symbol spacing and / or OFDM subcarrier spacing may vary for different transmissions, different cells, and / or different portions of the wireless transmission spectrum. The WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using subframes or transmission time intervals (TTIs) of different or scalable lengths (e.g., including different numbers of OFDM symbols and / or lasting different lengths of absolute time).

[0065] The gNBs 180a, 180b, 180c may be configured to communicate with the WTRUs 102a, 102b, 102c in a standalone configuration and / or a non-standalone configuration. In a standalone configuration, the WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c without accessing another RAN (e.g., eNode-Bs 160a, 160b, 160c). In a standalone configuration, the WTRUs 102a, 102b, 102c may utilize one or more of the gNBs 180a, 180b, 180c as mobility anchor points. In a standalone configuration, the WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using signals in unlicensed bands. In a non-standalone configuration, the WTRUs 102a, 102b, 102c may communicate with / connect to a gNB 180a, 180b, 180c while also communicating with / connecting to another RAN, such as an eNode-B 160a, 160b, 160c. For example, the WTRUs 102a, 102b, 102c may implement DC principles to communicate with one or more gNBs 180a, 180b, 180c and one or more eNode-Bs 160a, 160b, 160c substantially simultaneously. In a non-standalone configuration, the eNode-Bs 160a, 160b, 160c may act as mobility anchors for the WTRUs 102a, 102b, 102c, and the gNBs 180a, 180b, 180c may provide additional coverage and / or throughput for serving the WTRUs 102a, 102b, 102c.

[0066] Each of the gNBs 180a, 180b, 180c may be associated with a particular cell (not shown) and may be configured to handle radio resource management decisions, handover decisions, scheduling of users in the UL and / or DL, support for network slicing, dual connectivity, interworking between NR and E-UTRA, routing of user plane data to User Plane Functions (UPFs) 184a, 184b, routing of control plane information to Access and Mobility Management Functions (AMFs) 182a, 182b, etc. As shown in FIG. 1D, the gNBs 180a, 180b, 180c may communicate with each other over an Xn interface.

[0067] 1D may include at least one AMF 182a, 182b, at least one UPF 184a, 184b, at least one Session Management Function (SMF) 183a, 183b, and possibly a Data Network (DN) 185a, 185b. Although each of the foregoing elements is depicted as part of the CN 115, it will be understood that any of these elements may be owned and / or operated by an entity other than the CN operator.

[0068] The AMF 182a, 182b may be connected to one or more of the gNBs 180a, 180b, 180c in the RAN 113 via an N2 interface and may act as a control node. For example, the AMF 182a, 182b may be responsible for authenticating users of the WTRUs 102a, 102b, 102c, support for network slicing (e.g., handling different PDU sessions with different requirements), selecting a particular SMF 183a, 183b, managing registration areas, terminating NAS signaling, mobility management, etc. Network slicing may be used by the AMF 182a, 182b to customize CN support for the WTRUs 102a, 102b, 102c based on the type of service being utilized by the WTRUs 102a, 102b, 102c. For example, different network slices may be established for different use cases, such as services relying on ultra-reliable low latency (URLLC) access, services relying on enhanced massive mobile broadband (eMBB) access, services for machine type communication (MTC) access, and / or the like. The AMF 162 may provide a control plane function for switching between the RAN 113 and other RANs (not shown) that employ other radio technologies, such as LTE, LTE-A, LTE-A Pro, and / or non-3GPP access technologies such as WiFi.

[0069] The SMFs 183a, 183b may be connected to the AMFs 182a, 182b in the CN 115 via an N11 interface. The SMFs 183a, 183b may also be connected to the UPFs 184a, 184b in the CN 115 via an N4 interface. The SMFs 183a, 183b may select and control the UPFs 184a, 184b and configure the routing of traffic through the UPFs 184a, 184b. The SMFs 183a, 183b may perform other functions such as managing and assigning UE IP addresses, managing PDU sessions, controlling policy enforcement and QoS, providing downlink data notification, etc. The PDU session type may be IP-based, non-IP-based, Ethernet-based, etc.

[0070] The UPFs 184a, 184b may be connected to one or more of the gNBs 180a, 180b, 180c in the RAN 113 via an N3 interface, which may provide the WTRUs 102a, 102b, 102c with access to packet-switched networks, such as the Internet 110, to facilitate communications between the WTRUs 102a, 102b, 102c and IP-enabled devices. The UPFs 184, 184b may perform other functions, such as routing and forwarding packets, enforcing user plane policies, supporting multi-homed PDU sessions, handling user plane QoS, buffering downlink packets, providing mobility anchoring, etc.

[0071] The CN 115 may facilitate communication with other networks. For example, the CN 115 may include or communicate with an IP gateway (e.g., an IP Multimedia Subsystem (IMS) server) that serves as an interface between the CN 115 and the PSTN 108. In addition, the CN 115 may provide the WTRUs 102a, 102b, 102c with access to other networks 112, which may include other wired and / or wireless networks owned and / or operated by other service providers. In an embodiment, the WTRUs 102a, 102b, 102c may be connected to local Data Networks (DNs) 185a, 185b through the UPFs 184a, 184b via an N3 interface to the UPFs 184a, 184b and an N6 interface between the UPFs 184a, 184b and the DNs 185a, 185b.

[0072] 1A-1D and the corresponding description thereof, one or more, or all of the functions described herein with respect to one or more of the WTRUs 102a-d, base stations 114a-b, eNode-Bs 160a-c, MME 162, SGW 164, PGW 166, gNBs 180a-c, AMFs 182a-ab, UPFs 184a-b, SMFs 183a-b, DNs 185a-b, and / or any other devices described herein may be performed by one or more emulation devices (not shown). The emulation devices may be one or more devices configured to emulate one or more, or all of the functions described herein. For example, the emulation devices may be used to test other devices and / or to simulate network and / or WTRU functions.

[0073] The emulation device may be designed to implement one or more tests of other devices in a lab environment and / or in an operator network environment. For example, one or more emulation devices may perform one or more, or all of the functions while fully or partially implemented and / or deployed as part of a wired and / or wireless communication network to test other devices in the communication network. One or more emulation devices may perform one or more, or all of the functions while temporarily implemented / deployed as part of a wired and / or wireless communication network. The emulation device may be directly coupled to another device for testing purposes and / or may implement the tests using terrestrial wireless communication.

[0074] The one or more emulation devices may perform one or more functions, including but not limited to, being implemented / deployed as part of a wired and / or wireless communication network. For example, the emulation devices may be utilized in a test scenario in a test laboratory and / or in a non-deployed (e.g., test) wired and / or wireless communication network to implement testing of one or more components. The one or more emulation devices may be test equipment. Direct RF coupling and / or wireless communication via RF circuitry (which may include, for example, one or more antennas) may be used by the emulation devices to transmit and / or receive data.

[0075] As mentioned above, the methods and apparatus described herein are directed to registration and security of a WTRU having a MUSIM. Multiple USIMs may be registered using an authentication procedure with an aggregate challenge / response (i.e., a single challenge / response for all USIMs). The aggregate challenge / response may be used by the gateway to register multiple WTRU devices (e.g., MTC / IoT devices).

[0076] 2 is an example architecture reference model of a 5G or NextGen network. RAN used in this embodiment refers to a radio access network based on 5G RAT or evolved E-UTRA connecting to a NextGen core network. Access Control and Mobility Management Function (AMF) 212 includes functionality such as registration management, connection management, reachability management, mobility management, etc. Session Management Function (SMF) 213 includes functionality such as session management (including session establishment, modification and release), WTRU IP address allocation, UP function selection and control, etc. User Plane Function (UPF) 203 includes functionality such as packet routing and forwarding, packet inspection, traffic usage reporting, etc.

[0077] As shown in the example of Figure 2, the WTRU 201 accesses the AMF 212 via the RAN 202 through the N1 interface 220. An N14 interface 232 is also shown. The RAN 202 accesses the AMF 212 via the N2 interface 221. The RAN 202 accesses the UPF 203 via the N3 interface 222. The UPF 203 accesses the SMF 213 via the N4 interface 223. An N9 interface 234 is also shown. The UPF 203 accesses the DN 204 via the N6 interface 225. The example of Figure 2 also shows other NFs in the control plane. The PCF 214 may communicate with the SMF 213 via the N7 interface 226. The PCF 214 may communicate with the SMF 213 via the N7 interface 226. The PCF 214 may communicate with the AMF 212 via the N15 interface 233. The SMF 213 may communicate with the AMF 212 via the N11 interface 229. The SMF 213 may communicate with the UDM 211 via an N10 interface 228. The AMF 212 may communicate with the UDM 211 via an N8 interface 227. The AMF 212 may communicate with the AUSF 210 via an N12 interface 230. The UDM 211 may communicate with the AUSF 210 via an N13 interface 231.

[0078] Registration for a dual-SIM WTRU is described herein. When a WTRU needs to access a service in 3GPP, it may initiate a registration procedure. The procedure may be referred to as location update, attach, routing / tracking area update. In all the above cases, the common point is that the WTRU and the network establish a signaling connection, and then a Mobility Management (MM) context is established in both the WTRU and the anchor node of the core network. The parameters that build the MM context may include different parameters for different access technologies, also referred to as the "mode" in which the WTRU is operating. For example, when the access technology is E-UTRAN, the mode may be referred to as "S1 mode". Conventional WTRUs in the market are equipped with one SIM card. This means that when the WTRU initiates a registration procedure, it needs to identify itself based on the SIM card that is inserted in the device. It is then common practice for the network (NW) to authenticate the SIM card and also create a security context for, for example, integrity protection and encryption of both signaling and user data.

[0079] 3GPP Release 16 introduces requirements for devices to be able to have more than one SIM card, which means that if a user wants to access services offered by both SIM cards, they will need to register both.

[0080] In this specification, authentication and security mode control procedures are described. The NW can trigger the creation of a security context whenever a signaling connection exists between the WTRU and the core NW, but it is usually done during the registration procedure. The NW first initiates an authentication challenge to verify the SIM card used in the device. The authentication procedure can be referred to as an Authentication and Key Agreement (AKA) procedure because the WTRU can create specific master and session keys locally on the SIM card for integrity and encryption purposes. The serving NW also receives the same master key from the home NW and derives the same session key when the anchor node requires a vector for security.

[0081] The NW may initiate the procedure by sending an "Authentication Request" message to the WTRU, carrying a random challenge referred to as "RAND". The WTRU is then to use this parameter (RAND) together with a long-term key ("K") stored in the SIM card to derive a response (commonly referred to as "RES") and then respond to the challenge by sending an "Authentication Response" message. The NW may then perform local verification between the RES received from the WTRU and the RES received from the home NW in the authentication vector. Upon successfully passing this stage, the NW may continue with the security mode control procedure.

[0082] The authentication procedure, which in previous systems was a one-way procedure (the NW authenticates the WTRU), has been extended from 3G onwards to be a mutual authentication procedure, in order to allow the WTRU to also verify the core NW. Starting with UMTS (3G), the NW also includes a parameter called Authentication Token (AUTN) in the Authentication Request message. The USIM checks if the AUTN can be accepted and, if so, generates a response RES that is sent back to the NW. If the AUTN verification is successful, the WTRU considers the NW to be valid.

[0083] If the WTRU passes the authentication challenge, the NW continues with the security mode control procedure by sending a "Security Mode Command" message that contains some selected algorithms. Note that the keys for these algorithms are ultimately derived from the long-term key "K" by the WTRU and the NW during the AKA procedure, as described above.

[0084] Several issues related to the registration, authentication, and security mode control procedures described above are addressed by the embodiments described herein.

[0085] When a WTRU has two or more SIM cards, under some systems the WTRU goes through two separate registration procedures to identify the SIM cards. This procedure can also be more complicated based on the core NW operator, i.e., whether both UICC cards or USIMs belong to the same operator (same PLMN) or different operators. The device can perform two completely separate and unrelated registration procedures, one for each UICC card or USIM. However, since the registration procedures take time and resources (and in the case of a single TX WTRU, collisions may occur when the WTRU needs to perform two registration procedures simultaneously for each USIM, e.g., due to WTRU mobility), the WTRU and NW can benefit from saving time and resources. The embodiments described herein allow the WTRU to identify itself as "two" different users with different identities in the same procedure.

[0086] As mentioned above, security procedures are typically performed in conjunction with the registration procedure. Given that the WTRU identifies itself as two separate users / identities, there is also a need to separate the authentication and security mode control procedures. A solution is provided herein for the WTRU and NW to ensure that all subscriptions involved (i.e., USIMs) are authenticated while minimizing the number of messages exchanged to maintain at least the same level of security as a configuration with a single USIM.

[0087] In some systems, a subscription identifier (Subscription Permanent Identifier, SUPI in 5GS or International Mobile Subscriber Identity, IMSI in 4G and below) is used for WTRU identification. With multiple removable UICCs, the use of one of the removable UICCs as the authenticated identity of the WTRU is questionable from a security perspective and may require additional encryption or hardware binding between the two or more removable UICCs. However, with multiple USIMs, such binding is already established based on a single UICC and can be used to provide an authenticated identity for the WTRU. Such an authenticated identity may be used for any interaction of the WTRU with the network. In the absence of encryption or hardware binding between two or more removable UICCs, it is recommended to restrict the use cases to UICCs with multiple USIMs based on a single UICC.

[0088] Described herein is a solution for use in a registration procedure for the identification of two or more SIMs. For illustrative purposes, two separate cases are analyzed herein.

[0089] (1) Both USIMs are from the same operator (same PLMN), and

[0090] (2) The USIMs belong to two different operators.

[0091] When both USIMs are from the same operator, the WTRU may inform the NW in the registration request message that it is performing dual registration by performing the following steps.

[0092] The WTRU may insert a flag or a new code point into an information element, such as a registration type information element, to indicate that this particular registration is associated with two SIM cards. If dual registration was enabled during the initial registration procedure, the WTRU may implicitly indicate that all subsequent registration update procedures are for both USIMs (i.e., the WTRU does not need to insert a flag or a new code point into every registration request).

[0093] Based on the type of subscription, the WTRU may identify itself with one (parent) identity, which implicitly means that the other SIM card is also requesting registration. This means that the core NW recognizes that both identities (e.g., parent identity and child identity) are related to each other, and when the WTRU uses one of them (e.g., parent identity) for identification purposes, the other one (e.g., child identity) is also required.

[0094] Alternatively, the WTRU may send both identities (eg, parent identity and child identity) in the same registration request message in two different IEs.

[0095] In yet another alternative, the WTRU may provide a multi-SIM-SUPI that may be enabled by subscription. This is similar to the single parent identity case described above, except that there is a single identity for all SIM cards that are part of the multi-SIM subscription. When a subscriber acquires a new SIM card that the subscriber wants to be part of multiple subscriptions, the operator configures the new SIM's credentials and a new multi-SIM 5G-GUTI may be associated with the subscription that the subscriber wants to link to the multiple subscriptions.

[0096] Once registration is complete, the NW may send a registration accept message and include the "two" different GUTIs in the message. Or, the multi-USIM-GUTI may be included in the message if the WTRU provided a multi-USIM-SUPI. Note that the network may still provide different parameters for each USIM card that is part of the multi-SIM subscription. This is similar to the 3GPP / non-3GPP case where a single 5G GUTI is used with different Registration Management (RM) contexts per access, except that here the network creates different RM contexts per USIM. In addition, the NW may associate the USIM with the access if the configuration authorizes the NW.

[0097] The NW may also provide different parameters to different GUTIs in the same registration accept message, for example, each GUTI may be assigned to a different registration area.

[0098] In the alternative, based on operator configuration and agreement, the NW may send only the first GUTI for the first identity, and then both the WTRU and the NW may locally calculate the second GUTI that applies to the second identity. An algorithm for doing so may be provided on the SIM card.

[0099] When the USIM belongs to two different operators, the following steps may be implemented.

[0100] The WTRU may inform the NW that the registration request contains a request for two different SIM cards, for example, by using a special codepoint in the registration type IE or by inserting a new IE.

[0101] The WTRU may send two identities if the second identity is not provisioned by the NW to which the WTRU is attached, or the WTRU may send one identity. The WTRU may further provide a PLMN ID and security information for the second identity (e.g., a second USIM) so that the NW can establish a connection with another NW for the second identity.

[0102] In the latter case, the core NW may first create a secure signaling connection and then determine the IMSI / SUPI number of the WTRU that corresponds to the second identity used. The core NW may then take the second identity (IMSI / SUPI or GUTI) and route the request to the other PLMN.

[0103] When the procedure is finished, the core NW may send two different GUTIs to the WTRU if a new GUTI has been assigned.

[0104] This specification describes a solution for use in security aspects. For illustrative purposes, the following solution assumes that the USIMs are from the same MNO. This specification describes a combined multiple challenge-response authentication procedure.

[0105] FIG. 3 illustrates a high-level example 300 of MUSIM authentication in which a WTRU authenticates various USIMs with a network using a combined authentication procedure, according to one embodiment, which may be used in combination with any of the embodiments described herein. Multiple identities, authentication challenges, and responses (i.e., one response for each USIM) may be exchanged using a common single message exchange among the WTRU, the serving network, and the home network. In the example of FIG. 3, the WTRU 301 may include two USIMs (e.g., USIM1 304 and USIM2 305). However, the principles and steps outlined herein may be generalized for N (>2) MUSIMs. In the example of FIG. 3, the ME 306 may be responsible for dispatching (e.g., in parallel) authentication challenges from the network to various USIMs (e.g., USIM1 304 and USIM2 305) and collecting various authentication responses to be sent back to the network. Each USIM may have an associated subscription in the Home Public Land Mobile Network (HPLMN) 303. For example, USIM1 304 may be associated with subscription 1 307 and USIM2 305 may be associated with subscription 2 308. Subscription 1 307 and subscription 2 308 may comprise linked subscriptions for MUSIM users (e.g., WTRU 301). This solution does not impact the existing ME-USIM interface. The authentication procedure steps may include:

[0106] In step 311, the WTRU 301 may send the encrypted long-term identities (i.e., SUCI1 and SUCI2) in an initial identification message to the VPLMN 302. Alternatively, the WTRU may include only one of the SUCIs (e.g., primary subscription) and an index for MUSIM authentication. In that case, the HPLMN may search for the linked subscriptions, assuming that a linkage exists in the subscription database (e.g., one or more linked secondary subscriptions). The HPLMN 302 may resolve the long-term identities (i.e., SUPI) from the provided SUCI to generate a respective authentication vector. If only one SUCI was provided by the WTRU (with an index for MUSIM authentication), the HPLMN may implicitly retrieve one or more linked SUPIs and generate their respective authentication vectors.

[0107] In step 312, the WTRU 301 may receive an authentication challenge message from the VPLMN 302 that includes multiple RANDs (e.g., RAND1 and RAND2). The challenge message may also include multiple AUTNs (e.g., one for each USIM). The RANDs may be provided in the same order as used for the SUCI in the Initial Identification message from the WTRU in step 311. With each RAND, a Key Set Identifier (ngKSI) may be provided for later identification of the security context in the SMC.

[0108] ME306 may dispatch each RAND / AUTN pair to each USIM (e.g., in parallel). ME306 may obtain a response RES from each USIM. Note that generation of the RES parameter by the USIM may indicate successful AUTN verification. In step 312a, ME306 may send RAND1 to USIM1 304. In step 312b, ME306 may receive a response RES (RES1) from USIM1 304. In step 312a', ME306 may send RAND2 to USIM2 305. In step 312b', ME306 may receive a response RES (RES2) from USIM2 305.

[0109] In step 313, the WTRU 301 may reply with an Authentication Response message that includes multiple RES (e.g., RES1 and RES2, one for each USIM). The RES may be provided in the same order as used for the SUCI in the initial message from the WTRU.

[0110] In step 314, upon successful authentication for a given USIM, the VPLMN 302 may perform an SMC procedure with that USIM to establish a NAS security context between the WTRU 301 and the VPLMN 302. The ME 303 may determine which USIM is the target of the SMC procedure based on the ngKSI parameter in the security mode command message, which is the ngKSI that points to the individual security contexts corresponding to the individual AKAs running on the given USIM.

[0111] FIG. 4 illustrates an identification portion of an authentication procedure 400 according to one embodiment, which may be used in combination with any of the embodiments described herein. In the example of FIG. 4, the 5G AKA authentication protocol may be used as a baseline. In step 410, the WTRU 401 may send multiple SUCIs in an initial NAS registration message to the SEAF / AMF 402 in the serving network. In step 411, the SEAF 402 may forward the SUCI to the AUSF 403 in the home network. In step 412, the AUSF 403 may send the SUCI to a subscription database (UDM / ARPF) 404. In step 413, the UDM 404 may determine that the request is for authentication of a MUSIM-capable WTRU based on the subscription. In step 414, the UDM 404 may select a MUSIM-optimized authentication method. In step 415, as described above, the other USIM long term identifier may be omitted by the WTRU and obtained implicitly by the UDM 404 (eg, based on linkage of WTRU provided indicators and subscription data).

[0112] FIG. 5 illustrates a 5G AKA authentication procedure 500 according to one embodiment, which may be used in combination with any of the embodiments described herein. In the example of FIG. 5, the 5G AKA authentication protocol may be used as a baseline. In step 511, the UDM 504 may generate multiple Authentication Vectors (AVs) for multiple SUPIs (i.e., one for each USIM). In step 512, the UDM 504 may send multiple 5G Home Environment (HE) AVs and multiple SUPIs in response to the AUSF 503. In step 513, the AUSF 503 may store the XRES*. In step 514, the AUSF 503 may calculate multiple XRES* / HXRES*. In step 515, the AUSF 503 may send multiple 5G Serving Environment (k,SE) AVs in response to the SEAF 502. In step 516, the SEAF 502 may send the multiple (ngKSI, RAND) in an authentication request message to the WTRU 501. The RAND may be provided in the order that the SUCI was provided by the WTRU 501 during the authentication initiation phase.

[0113] In step 517, the ME of the WTRU 501 may dispatch the RANDs to their respective USIMs and collect the RES* from the USIMs. In step 518, the WTRU 501 may send the RES* in the authentication response (e.g., in the same order as the SUCI and / or RAND) to the SEAF 502. In step 519, the SEAF may calculate the HRES* and match the RES* with the values ​​of the AVs in the serving network and the home network.

[0114] Successful authentication may be followed by SMC procedures for each USIM to establish its individual security context. The registration procedure may be completed with separate registration accept messages (one for each USIM), each with a unique GUTI and using its own separate security context. In step 520, SEAF 504 may send an authentication request to AUSF 503. In step 521, AUSF 503 may perform RES* verification. In step 522, AUSF 503 may send an authentication response to SEAF 502.

[0115] An authentication procedure with an aggregate challenge response is described herein. For example, the network and the WTRU may perform the authentication procedure with an aggregate challenge / response (i.e., a single challenge / response for all USIMs), or in another example, the gateway device and the network may perform the authentication procedure with an aggregate challenge / response (i.e., a single challenge / response for all WTRUs).

[0116] FIG. 6 illustrates a high-level example 600 of MUSIM authentication in which a WTRU authenticates various USIMs with a network using a combined authentication procedure, according to one embodiment, which may be used in combination with any of the embodiments described herein. A single authentication challenge and response (i.e., one for all USIMs) may be exchanged between the WTRU 601, the serving network, and the home network. In the example of FIG. 6, the WTRU 601 may include two USIMs (e.g., USIM1 604 and USIM2 605). However, the principles and steps outlined herein may be generalized for N (>2) MUSIMs. In the example of FIG. 6, the ME 606 may be responsible for obtaining a collective authentication response from the USIMs (e.g., USIM1 604 and USIM2 605) based on a collective authentication challenge from the network. Each USIM may have an associated subscription in the HPLMN 603. For example, USIM1 604 may be associated with subscription 1 607, and USIM2 605 may be associated with subscription 2 608. Subscription 1 607 and subscription 2 608 may comprise linked subscriptions for a MUSIM user (e.g., WTRU 601). This solution may include an extension to the existing ME-USIM interface.

[0117] In step 611, the WTRU 601 may send one SUCI1 (for USIM1 604), SUCI2 (for USIM2 605), and indicators for MUSIM registration (USIM1 604 and USIM2 605) to the VPLMN 602 and perform the authentication procedure using a MUSIM aggregate challenge / response (i.e., a single challenge for all USIMs).

[0118] At step 612, during the authentication procedure, the WTRU 601 may receive a single authentication challenge (RAND) but not two ngKSIs (for each Kamf identity) in a single authentication request message. At step 612a, the ME 606 may pass the challenge RAND to USIM1 604. At step 612b, the ME 606 may receive a response RES1. At step 612c, the ME 606 may send RES1 as an authentication challenge to USIM2 605. At step 612, the ME 606 may receive a first collective authentication response RES2. The ME 606 may continue this process of "daisy chaining" for the number of USIMs.

[0119] In step 613, the WTRU 601 may send a collective authentication response RES2 in an authentication response to the network (eg, VPLMN 602). The SEAF / AMF may obtain two SUPI / Kseaf after successful collective authentication.

[0120] The WTRU 601 may perform multiple SMC procedures (one for each USIM) to establish security in step 614. The WTRU may receive multiple registration accept messages (each with its own GUTI / NAS security).

[0121] The authentication procedure with collective challenge response can be extended to apply to other use cases. For example, the authentication procedure with collective challenge response described above can also be applied to MTC / IoT cases. A subscriber may have a certain service with several (machine type) devices. Examples include a subscriber in a home or a "smart" factory with several devices connected to the network. For example, a home or factory with a gateway operating in the network may have several WTRUs (e.g., IoT devices) operating in the network behind the gateway. All these devices may connect to a "master" device, which may then communicate with the operator's network. This master device may also act as a "gateway" between all other devices and the network. To facilitate the authentication procedure for each and every device that needs to be verified by the network, the network may send only one authentication challenge (e.g., one RAND) to the gateway in line with the process described above.

[0122] FIG. 7 illustrates a high level example 700 of MUSIM authentication where only one authentication challenge is sent according to one embodiment, which may be used in combination with any of the embodiments described herein. In step 711, the gateway 705 may send one SUCI1 (for WTRU 701), SUCI2 (for WTRU 702), and an indication for MUSIM registration to 703 602 to perform the authentication procedure with the MUSIM collective challenge / response (i.e., single challenge). In another example, the gateway may send a single "master" SUCI1 to the network linked to one or more subscriptions associated with multiple WTRUs operating behind the gateway. Each WTRU may have an associated subscription in the HPLMN 704. For example, WTRU 701 may be associated with subscription 1 706, and WTRU 702 may be associated with subscription 2 707. Subscription 1 706 and subscription 2 707 may include linked subscriptions for the MUSIM user (e.g., gateway 705).

[0123] In step 712, the gateway 705 may receive a single authentication challenge (RAND). In step 712a, the gateway device 705 may pass the authentication challenge (RAND) to the first device (e.g., WTRU 701). In step 712b, the gateway 705 may receive a response RES1 from the WTRU 702. In step 712c, the gateway 705 may send RES1 as an authentication challenge to the second device (WTRU 702). In step 712d, the gateway 705 may receive a first collective authentication response RES2. The gateway 705 may continue this process of "daisy chaining" for as many devices (e.g., WTRUs). In step 713, the gateway 705 may send the collective authentication response RES2 in an authentication response sent to the network (e.g., VPLMN 703). As described above, the SEAF / AMF may obtain two SUPI / Kseaf after successful collective authentication.

[0124] Having thus described various embodiments, it will be understood and apparent to those skilled in the art that the present embodiments are considered to be illustrative and not restrictive in all respects. Although features and elements are described above in a particular combination, it will be understood that each feature or element can be used alone or in any combination or subcombination with or without other features and elements. Any single embodiment described herein may be supplemented with one or more elements from any one or more of the other embodiments described herein. Any single element of an embodiment may be replaced with one or more elements from any one or more of the other embodiments described herein.

Claims

1. 11. A wireless transmit / receive unit (WTRU) comprising: a processor; and a memory, the WTRU further comprising computer-executable instructions stored in the memory of the WTRU, the instructions, when executed by the processor of the WTRU, causing the WTRU to: At least, the network a first subscriber identity module associated with the WTRU; and sending a request message indicating a request to authenticate a second subscriber identity module associated with the WTRU; receiving a first challenge message from the network; sending the first challenge message to the first subscriber identity module; receiving a first response message from the first subscriber identity module based on the first challenge message; sending the first response message to the second subscriber identity module as an indication of a second challenge message; receiving an aggregate response message from the second subscriber identity module based on the first response message, the aggregate response message including a different response than the first response message received from the first subscriber identity module; sending the aggregate response message to the network in response to the first challenge message; The WTRU performs the above.

2. 2. The WTRU of claim 1, wherein the first subscriber identity module comprises a first universal subscriber identity module (USIM) and the second subscriber identity module comprises a second USIM.

3. The WTRU of claim 1 , wherein the first challenge message includes one or more random numbers (RAND).

4. The WTRU of claim 1 , wherein the aggregation response message enables authentication of the WTRU with the network.

5. The request message is a first encrypted subscriber identifier (SUCI) associated with the first subscriber identity module; and The WTRU of claim 1 , comprising a second SUCI associated with the second subscriber identity module.

6. 6. The WTRU of claim 5, wherein the first SUCI is associated with a first subscription stored in a Home Public Land Mobile Network (HPLMN), and the second SUCI is associated with a second subscription stored in the HPLMN.

7. The request message is a first encrypted subscriber identifier (SUCI) associated with the first subscriber identity module; and 10. The WTRU of claim 1, comprising a plurality of Universal Subscriber Identity Modules (MUSIMs) for MUSIM authentication indices.

8. 1. A method for use in a wireless transmit / receive unit (WTRU), comprising: At least, the network a first subscriber identity module associated with the WTRU; and sending a request message indicating a request to authenticate a second subscriber identity module associated with the WTRU; receiving a first challenge message from the network; sending the first challenge message to the first subscriber identity module; receiving a first response message from the first subscriber identity module based on the first challenge message; sending the first response message to the second subscriber identity module as an indication of a second challenge message; receiving an aggregate response message from the second subscriber identity module based on the first response message, the aggregate response message including a different response than the first response message received from the first subscriber identity module; sending the aggregate response message to the network in response to the first challenge message; A method comprising:

9. 9. The method of claim 8, wherein the first subscriber identity module comprises a first universal subscriber identity module (USIM) and the second subscriber identity module comprises a second USIM.

10. The method of claim 8 , wherein the first challenge message includes one or more random numbers (RAND).

11. The method of claim 8 , wherein the aggregation response message enables authentication of the WTRU with the network.

12. The request message is a first encrypted subscriber identifier (SUCI) associated with the first subscriber identity module; and The method of claim 8 , further comprising a second SUCI associated with the second subscriber identity module.

13. 13. The method of claim 12, wherein the first SUCI is associated with a first subscription stored in a Home Public Land Mobile Network (HPLMN) and the second SUCI is associated with a second subscription stored in the HPLMN.

14. The request message is a first encrypted subscriber identifier (SUCI) associated with the first subscriber identity module; and 10. The method of claim 8, comprising multiple Universal Subscriber Identity Modules (MUSIMs) for MUSIM authentication.

15. 1. An apparatus comprising a processor and a memory, the apparatus further comprising computer-executable instructions stored in the memory of the apparatus, the instructions, when executed by the processor of the apparatus, causing the apparatus to: At least, the network a first subscriber identity associated with a first wireless transmit / receive unit (WTRU); and sending a request message indicating a request to authenticate a second subscriber identity associated with a second WTRU; receiving a first challenge message from the network; sending the first challenge message to the first WTRU; receiving a first response message from the first WTRU based on the first challenge message; sending the first response message to the second WTRU as an indication of a second challenge message; receiving an aggregate response message from the second WTRU based on the first response message, the aggregate response message including a different response than the first response message received from the first WTRU; sending the aggregate response message to the network in response to the first challenge message; A device that performs the above function.

16. 16. The apparatus of claim 15, wherein the first WTRU comprises a first Internet of Things (IoT) device and the second WTRU comprises a second IoT device.

17. The apparatus of claim 15 , wherein the first challenge message includes one or more random numbers (RAND).

18. The apparatus of claim 15 , wherein the aggregation response message enables authentication of the first and second WTRUs with the network.

19. The request message is a first encrypted subscriber identity (SUCI) associated with the first WTRU; and a second SUCI associated with the second WTRU; 16. The apparatus of claim 15.

20. 20. The apparatus of claim 19, wherein the first SUCI is associated with a first subscription stored in a Home Public Land Mobile Network (HPLMN) and the second SUCI is associated with a second subscription stored in the HPLMN.

Images