A terminal device, a wireless communication system equipped with it, and a program to be executed by a computer.

Abstract

To provide a terminal device capable of appropriately protecting data for which confidentiality is regarded important, without becoming over specification with respect to data for which communication characteristics are regarded important.SOLUTION: Session establishment means 13 establishes a legacy session Sn_1 for transmitting encrypted data encrypted by a first cryptographic key having a first key length and a secure session Sn_2 for transmitting encrypted data encrypted by a second cryptographic key having a second key length longer than the first key length. Encryption means 14 generates first encrypted data by encrypting communication characteristic type data D_1 using the first cryptographic key and generates second encrypted data by encrypting confidentiality data D_2 using the second cryptographic key. A radio unit 12 transmits the first encrypted data using the legacy session Sn_1 and transmits the second encrypted data using the secure session Sn_2.SELECTED DRAWING: Figure 3

Description

Technical Field

[0006] ,

[0001] This invention relates to a terminal device, a wireless communication system including the same, and a program for causing a computer to execute.

Background Art

[0002] Conventionally, the fifth-generation mobile communication system (5G) is known. In 5G Release 16 of 3GPP (Third Generation Partnership Project), which is a standardization project after the third-generation mobile communication, it has become possible to select, as the key length of the common key cryptography for encrypting the communication path between a UE (User Equipment) and a CU (Centralized Unit), 128 bits and 256 bits (Non-Patent Document 1).

[0003] In this case, the encryption algorithm and the key length are determined between the terminal device and the 5G core network in the setup when the UE (terminal device) connects to the mobile communication network.

Prior Art Documents

Non-Patent Documents

[0004]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, in 5G Release 16, when changing the encryption algorithm and the key length in the middle, it is necessary to reset the session using the mechanism of handover within the cell, and it is not assumed to properly use different communication paths depending on security requirements.

[0006] As a result, for example, in a terminal device where various applications are running in parallel, and data communication requiring high confidentiality is mixed with multimedia services where throughput and responsiveness are important, if the encryption key length is set to 256 bits when encrypting with a symmetric key to prioritize security strength, it becomes over-specced for multimedia services (e.g., video streaming services), leading to increased processing for encryption and higher power consumption.

[0007] On the other hand, prioritizing throughput and responsiveness by setting the encryption key length to 128 bits presents a problem: it compromises the security of services that require a high level of confidentiality.

[0008] Therefore, according to this embodiment of the invention, a terminal device is provided that can appropriately protect data for which confidentiality is important without being over-specified for data for which communication characteristics are important.

[0009] Furthermore, according to an embodiment of this invention, a wireless communication system is provided that includes a terminal device capable of appropriately protecting data for which confidentiality is important, without being over-specified for data for which communication characteristics are important.

[0010] Furthermore, according to embodiments of this invention, a program is provided that allows a computer to perform appropriate protection of data where confidentiality is important, without being over-specified for data where communication characteristics are important. [Means for solving the problem]

[0011] (Composition 1) According to an embodiment of this invention, the terminal device is a terminal device in a fifth-generation mobile communication system and comprises session establishment means, encryption means, and transmission means. The session establishment means performs a security setting procedure with the AMF (Access and Mobility Management Function), which is a network function for security, in the core network of the fifth-generation mobile communication system, to establish a first session, which is a logical communication path for transmitting encrypted data encrypted with a first encryption key having a first key length, and a second session, which is a logical communication path for transmitting encrypted data encrypted with a second encryption key having a second key length longer than the first key length. The encryption means generates first encrypted data by encrypting first data, which is data where communication characteristics are more important than confidentiality, with the first encryption key, and generates second encrypted data by encrypting second data, which is data where confidentiality is more important than communication characteristics, with the second encryption key. The transmission means transmits the first encrypted data using the first session and transmits the second encrypted data using the second session.

[0012] (Configuration 2) In Configuration 1, the session establishment means establishes the first and second sessions by selecting the encryption method and key length to be used from a list of encryption methods and key lengths sent from AMF, and sending the encryption method and key length to be used to AMF.

[0013] (Composition 3) In Configuration 1, the session establishment means establishes the first and second sessions by receiving from the core network's AMF the encryption method and key length selected by the core network's AMF from a list of encryption methods and key lengths.

[0014] (Composition 4) In Configuration 1, the session establishment means establishes the first and second sessions simultaneously with one base station using a mechanism for using multiple sessions simultaneously, instead of between the terminal device and the AMF, when MR-DC (Multi-Radio Dual Connectivity), which simultaneously establishes sessions with different radio base stations, is available. The transmission means transmits the first encrypted data using the first session established using the mechanism for using multiple sessions simultaneously, and transmits the second encrypted data using the second session established using the mechanism for using multiple sessions simultaneously.

[0015] (Composition 5) In configuration 1, the session establishment means further switches the session between the terminal device and the base station instead of between the terminal device and the AMF, and when MR-DC, which simultaneously sets a session with the terminal device to different wireless base stations, is unavailable, the session is switched to the first session or the second session by a handover mechanism within the base station's communication range. When the second session is switched to the first session, the transmission means transmits the first encrypted data using the first session, and when the first session is switched to the second session, it transmits the second encrypted data using the second session.

[0016] (Composition 6) In configuration 5, when the session establishment means has established a first session, if the proportion of uses requiring confidentiality exceeds a first threshold, it switches the session from the first session to the second session using a handover mechanism within the base station's communication range. When the second session has been established, if the proportion of uses requiring confidentiality falls below a second threshold which is smaller than the first threshold, it switches the session from the second session to the first session using a handover mechanism within the base station's communication range.

[0017] (Composition 7) Furthermore, according to an embodiment of this invention, the wireless communication system is a wireless communication system comprising a terminal device described in any of configurations 1 to 6.

[0018] (Composition 8) Furthermore, according to an embodiment of this invention, the program is a program to be executed by a computer in a terminal device of a fifth-generation mobile communication system, The session establishment means, in the core network of the fifth-generation mobile communication system, performs a security setting procedure with the AMF, which is a network function for security, to establish a first session, which is a logical communication path for transmitting encrypted data encrypted with a first encryption key having a first key length, and a second session, which is a logical communication path for transmitting encrypted data encrypted with a second encryption key having a second key length longer than the first key length. The encryption method involves a second step in which the first data, where communication characteristics are more important than confidentiality, is encrypted using a first encryption key to generate first encrypted data, and the second data, where confidentiality is more important than communication characteristics, is encrypted using a second encryption key to generate second encrypted data. The transmission means is a program that causes a computer to perform a third step of transmitting first encrypted data using a first session and second encrypted data using a second session.

[0019] (Composition 9) In configuration 8, the session establishment means establishes the first and second sessions in the first step by selecting the encryption method and key length to be used from the list of encryption methods and key lengths sent from AMF, and sending the encryption method and key length to be used to AMF.

[0020] (Composition 10) In Configuration 8, the session establishment means establishes the first and second sessions in the first step by receiving from the AMF of the core network the encryption method and key length selected from the list of encryption methods and key lengths.

[0021] (Configuration 11) In Configuration 8, the session establishment means, in the first step, when MR-DC that sets sessions for the terminal device simultaneously for different radio base stations between the terminal device and the base station instead of between the terminal device and the AMF is available, establishes the first and second sessions with one base station simultaneously using a mechanism for using multiple sessions simultaneously. The transmission means, in the third step, transmits the first encrypted data using the first session established using a mechanism for using multiple sessions simultaneously, and transmits the second encrypted data using the second session established using a mechanism for using multiple sessions simultaneously.

[0022] (Configuration 12) In Configuration 8, the session establishment means, in the first step, further, when MR-DC that sets sessions for the terminal device simultaneously for different radio base stations between the terminal device and the base station instead of between the terminal device and the AMF is not available, switches the session to the first session or the second session by means of handover within the communication range of the base station. The transmission means, in the third step, when the second session is switched to the first session, transmits the first encrypted data using the first session, and when the first session is switched to the second session, transmits the second encrypted data using the second session.

[0023] (Configuration 13) In configuration 12, in the first step, when the session establishment means has established the first session, if the proportion of uses requiring confidentiality exceeds the first threshold, it switches the session from the first session to the second session by a handover mechanism within the base station's communication range. When the second session has been established, if the proportion of uses requiring confidentiality falls below the second threshold, which is smaller than the first threshold, it switches the session from the second session to the first session by a handover mechanism within the base station's communication range. [Effects of the Invention]

[0024] It can adequately protect data where confidentiality is more important than communication characteristics without being over-specified for data where communication characteristics are more important. [Brief explanation of the drawing]

[0025] [Figure 1] This is a schematic diagram of a mobile communication system according to an embodiment of the present invention. [Figure 2] This figure shows the procedure for setting the security mode of 3GPP as described in Non-Patent Document 1. [Figure 3] Figure 1 is a schematic diagram of Embodiment 1 of the terminal device shown. [Figure 4] This diagram shows the procedure for setting the security mode in Embodiment 1. [Figure 5] Figure 3 is a flowchart illustrating the operation of the terminal device shown. [Figure 6] This is a flowchart illustrating the detailed operation of step S5 in Figure 5. [Figure 7] This is a flowchart illustrating the detailed operation of step S11 in Figure 5. [Figure 8] The first correspondence diagram shows the relationship between the number of executions in the flowchart shown in Figure 5, the session used for the i-th execution, the session used for the (i-1)-th execution, and the execution steps. [Figure 9]Figure 5 is a second correspondence diagram showing the correspondence between the number of executions in the flowchart, the session used for the i-th execution, the session used for the (i-1)-th execution, and the execution steps. [Figure 10] Figure 1 is a schematic diagram of Embodiment 2 of the terminal device shown. [Figure 11] This diagram shows the procedure for setting the security mode in Embodiment 2. [Figure 12] Figure 10 is a flowchart illustrating the operation of the terminal device shown. [Figure 13] This is a flowchart illustrating the detailed operation of step S5A in Figure 12. [Figure 14] This is a flowchart illustrating the detailed operation of step S11A in Figure 12. [Figure 15] This diagram shows the procedure for adding or modifying a 3GPP slave node. [Figure 16] This figure shows the procedure for adding or modifying a sub-session between the terminal device UE and the master node MN in Embodiment 3. [Figure 17] Figure 1 is a schematic diagram of Embodiment 3 of the terminal device shown. [Figure 18] This diagram shows the procedure for setting the security mode in Embodiment 3. [Figure 19] This is a schematic diagram illustrating the establishment of a session using MR-DC. [Figure 20] This is a diagram illustrating QoS Flow ID (5QI) in 5G. [Figure 21] This is a schematic diagram showing the packet flow from the server to the terminal device. [Figure 22] This diagram illustrates how to distribute data D to either legacy session Sn_1 or secure session Sn_2. [Figure 23] Figure 17 is a flowchart illustrating the operation of the terminal device shown. [Figure 24] This is a flowchart illustrating the detailed operation of step S21 in Figure 23. [Figure 25] This is a flowchart illustrating the detailed operation of step S24 in Figure 23. [Figure 26] This is a flowchart illustrating the detailed operation of step S27 in Figure 23. [Figure 27] This is a flowchart illustrating the detailed operation of step S273 in Figure 26. [Figure 28] This is a flowchart illustrating the detailed operation of step S275 in Figure 26. [Figure 29] This is a flowchart illustrating the detailed operation of step S276 in Figure 26. [Figure 30] This is a flowchart illustrating the detailed operation of step S28 in Figure 23. [Figure 31] This figure shows the time dependence of the proportion of applications requiring confidentiality. [Modes for carrying out the invention]

[0026] Embodiments of the present invention will be described in detail with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and their descriptions will not be repeated.

[0027] Figure 1 is a schematic diagram of a mobile communication system according to an embodiment of the present invention. Referring to Figure 1, the mobile communication system 10 according to an embodiment of the present invention comprises a terminal device 1, a base station 2, and a core network (5GC) 3. The mobile communication system 10 is a fifth-generation mobile communication system (5G).

[0028] Base station 2 consists of gNodeB in 5G. Core network 3 is configured with AMF (Access and Mobility Management Function), SMF (Session Management Function), and UPF (User Plane Function).

[0029] AMF is a network function for subscriber authentication, security, and terminal device location management. SMF is a network function for managing sessions. UPF is a network function that facilitates user plane operations such as packet routing and forwarding.

[0030] The connection between terminal device 1 and base station 2 is a wireless section, and the connection between base station 2 and core network 3 is a communication line (backhaul).

[0031] Figure 2 shows the procedure for setting the security mode of 3GPP as described in Non-Patent Document 1.

[0032] Referring to Figure 2, when the security mode is set, the AMF initiates tamper prevention as 1a, and sends a NAS Security Mode Command to the terminal device UE as 1b, which is an instruction to set the security mode for the terminal device UE.

[0033] In the current specification (5G Release 16), before initiating the NAS Security Mode Command procedure, which is the procedure for setting the security mode, the operator is provided with a list of encryption methods to be used by AMF. This list enumerates the available encryption methods in order of priority, and AMF automatically selects the highest-ranking available encryption method.

[0034] Therefore, the NAS Security Mode Command sent to the terminal device UE after AMF initiates tamper prevention includes the tamper check, the encryption method selected by AMF, and the key length of the shared key.

[0035] After AMF sends the NAS Security Mode Command to the terminal device UE, it starts upstream encryption as 1c.

[0036] On the other hand, when the terminal device UE receives a NAS Security Mode Command from the AMF, it verifies the NAS SMC (NAS Security Mode Command) as 2a, and if it passes the tampering check of the NAS SMC (NAS Security Mode Command), it starts upstream encryption and downstream encryption / tamper prevention.

[0037] Then, the terminal device UE, as 2b, sends a NAS Security Mode Complete message to the AMF on core network 3, indicating that it will initiate upstream encryption and downstream encryption / tamper prevention.

[0038] Subsequently, when the AMF receives "NAS Security Mode Complete" from the terminal device UE, it starts downstream encryption as step 1d.

[0039] This sets the security mode between the terminal device UE and the AMF of core network 3.

[0040] [Embodiment 1] Figure 3 is a schematic diagram of Embodiment 1 of the terminal device 1 shown in Figure 1. Referring to Figure 3, the terminal device 1 comprises an antenna 11, a wireless unit 12, a session establishment means 13, an encryption means 14, a decryption means 15, and a control means 16.

[0041] Antenna 11, for example, consists of a structure in which 256 antennas are arranged in a grid pattern.

[0042] The wireless unit 12 constitutes a transmitting means and a receiving means. The wireless unit 12 receives a list LS of encryption and tamper-proof algorithms and parameters from the AMF of the core network 3 via the antenna 11, and outputs the received list LS to the session establishment means 13.

[0043] Here, list LS includes, for example, four algorithms (Null Ciphering algorithm, SNOW 3G, AES, and ZUC) and, for example, two key lengths (128-bit key length and 256-bit key length) as parameters. Null Ciphering algorithm means that the data is not encrypted and remains in plaintext. SNOW 3G, AES, and ZUC are three encryption algorithms CRYAG_1, CRYAG_2, and CRYAG_3. In the protocol, when specifying an algorithm, symbols 128-EEA0, 128-EEA1, 128-EEA2, and 128-EEA3 are used instead of algorithm names. Symbol 128-EEA0 corresponds to Null Ciphering algorithm, symbol 128-EEA1 corresponds to SNOW 3G, symbol 128-EEA2 corresponds to AES, and symbol 128-EEA3 corresponds to ZUC. As a result, list LS contains eight combinations of algorithms (128-EEA0, 128-EEA1, 128-EEA2, 128-EEA3) and parameters (six combinations of encryption algorithms and parameters). SNOW 3G is one of the stream cipher schemes used in LTE (Long Term Evolution), AES is a public-key cryptography scheme, and ZUC is a stream cipher-based cryptography scheme and a backup cryptography scheme for AES.

[0044] Furthermore, the wireless unit 12 receives the algorithm and parameters used by the terminal device 1 from the session establishment means 13. The wireless unit 12 then transmits the received algorithm and parameters to the AMF of the core network 3 via the antenna 11.

[0045] Furthermore, the wireless unit 12 receives a NAS Security Mode Command from the AMF of the core network 3 via the antenna 11 and outputs the received NAS Security Mode Command to the session establishment means 13.

[0046] Furthermore, when the wireless unit 12 receives a NAS Security Mode Complete message from the session establishment means 13, indicating that upstream encryption and downstream encryption / tamper prevention have been initiated, it transmits the received NAS Security Mode Complete message to the AMF of the core network 3 via the antenna 11.

[0047] Furthermore, when the wireless unit 12 receives encrypted data from the encryption means 14, it transmits the received encrypted data via the antenna 11.

[0048] In this case, when the wireless unit 12 receives encrypted data ENCRY_D_1 from the encryption means 14, which is encrypted using the encryption key ENCRY_KY_1 having a key length of 128 bits, it transmits the received encrypted data ENCRY_D_1 to the destination via the antenna 11. When the wireless unit 12 receives encrypted data ENCRY_D_2 from the encryption means 14, which is encrypted using the encryption key ENCRY_KY_2 having a key length of 256 bits, it transmits the received encrypted data ENCRY_D_2 to the destination via the antenna 11.

[0049] Furthermore, the wireless unit 12 receives encrypted data ENCRY_D_1 or encrypted data ENCRY_D_2 from the destination via the antenna 11, and outputs the received encrypted data ENCRY_D_1 or encrypted data ENCRY_D_2 to the decryption means 15.

[0050] The session establishment means 13 receives a list LS from the wireless unit 12. Based on the received list LS, the session establishment means 13 selects an algorithm and parameters related to encryption and tamper prevention. Then, the session establishment means 13 outputs the selected algorithm and parameters to the wireless unit 12.

[0051] Furthermore, the session establishment means 13 receives a NAS Security Mode Command from the wireless unit 12. If the session establishment means 13 passes the NAS SMCNAS (NAS Security Mode Command) tampering check and the encryption and tamper prevention algorithms and parameters are deemed appropriate, it initiates upstream encryption and downstream encryption and tamper prevention.

[0052] In this case, the session establishment means 13 determines that the encryption and tamper-proofing algorithm and parameters (key length) are valid if they are available, and determines that the encryption and tamper-proofing algorithm and parameters (key length) are invalid if they are unavailable.

[0053] Furthermore, when the session establishment means 13 initiates upstream encryption and downstream encryption / tamper prevention, it generates a NAS Security Mode Complete message that includes the initiation of upstream encryption and downstream encryption / tamper prevention, and outputs the generated NAS Security Mode Complete message to the wireless unit 12.

[0054] When the session establishment means 13 receives a control signal CTL_1 from the control means 16 to control the session establishment means 13 to establish a legacy session Sn_1 with the AMF of the core network 3, for transmitting encrypted data ENCRY_D_1, which is encrypted using an encryption key ENCRY_KY_1 having a key length of 128 bits, the session establishment means 13 performs the above-described operation based on the control signal CTL_1 and establishes the legacy session Sn_1 with the AMF of the core network 3.

[0055] On the other hand, when the session establishment means 13 receives a control signal CTL_2 from the control means 16 to control the session establishment means 13 to establish a secure session Sn_2 with the AMF of the core network 3, for transmitting encrypted data ENCRY_D_2, which is encrypted using an encryption key ENCRY_KY_2 having a key length of 256 bits, the session establishment means 13 executes the above-described operation based on the control signal CTL_2 and establishes a secure session Sn_2 with the AMF of the core network 3.

[0056] Then, when the session establishment means 13 establishes legacy session Sn_1 with the AMF of the core network 3, it generates a session establishment signal SG_1 indicating that legacy session Sn_1 has been established, and outputs the generated session establishment signal SG_1 to the encryption means 14 and the decryption means 15.

[0057] Meanwhile, when the session establishment means 13 establishes a secure session Sn_2 with the AMF of the core network 3, it generates a session establishment signal SG_2 indicating that the secure session Sn_2 has been established, and outputs the generated session establishment signal SG_2 to the encryption means 14 and the decryption means 15.

[0058] The encryption means 14 holds encryption keys ENCRY_KY_1 and ENCRY_KY_2. The encryption means 14 receives a session establishment signal SG_1 or a session establishment signal SG_2 from the session establishment means 13. When the encryption means 14 receives a session establishment signal SG_1 from the session establishment means 13, it selects the encryption key ENCRY_KY_1, encrypts the data received from the control means 16 using the encryption key ENCRY_KY_1, and outputs the encrypted data ENCRY_D_1 to the wireless unit 12.

[0059] On the other hand, when the encryption means 14 receives the session establishment signal SG_2 from the session establishment means 13, it selects the encryption key ENCRY_KY_2, encrypts the data received from the control means 16 using the encryption key ENCRY_KY_2, and outputs the encrypted data D_2 to the wireless unit 12.

[0060] The decryption means 15 holds the decryption keys DECRY_KY_1 and DECRY_KY_2. The decryption means 15 receives either the session establishment signal SG_1 or the session establishment signal SG_2 from the session establishment means 13. When the decryption means 15 receives the session establishment signal SG_1 from the session establishment means 13, it selects the decryption key DECRY_KY_1. When it receives the encrypted data ENCRY_D_1 from the wireless unit 12, it decrypts the encrypted data ENCRY_D_1 using the decryption key DECRY_KY_1 and outputs the decrypted data to an application (not shown).

[0061] On the other hand, when the decryption means 15 receives the session establishment signal SG_2 from the session establishment means 13, it selects the decryption key DECRY_KY_2. When it receives the encrypted data ENCRY_D_2 from the wireless unit 12, it decrypts the encrypted data ENCRY_D_2 using the decryption key DECRY_KY_2 and outputs the decrypted data to the application (not shown).

[0062] The control means 16 receives data D from the application (not shown). Data D is communication-specific data D_1, where communication characteristics such as throughput and responsiveness are more important than confidentiality. And, Confidentiality data D_2 is data where confidentiality is prioritized over communication characteristics such as loop rate and responsiveness. And, among data D_3, where confidentiality and communication characteristics are equally important, there are communication characteristic type data D_1 and confidentiality data D_2. It consists of.

[0063] An application providing multimedia services (not shown) outputs communication characteristic data D_1 and an identification symbol IDS indicating that the communication characteristic data D_1 is data for a multimedia service to the control means 16.

[0064] On the other hand, the application providing the confidentiality data D_2 (not shown) outputs only the confidentiality data D_2 to the control means 16 without outputting the identification symbol IDS.

[0065] When the control means 16 receives communication characteristic data D_1 and identification symbol IDS from an application providing multimedia services (not shown), it generates a control signal CTL_1, outputs the generated control signal CTL_1 to the session establishment means 13, and outputs the communication characteristic data D_1 to the encryption means 14.

[0066] On the other hand, when the control means 16 receives only the confidential data D_2 from the application (not shown) that provides the confidential data D_2, it generates a control signal CTL_2, outputs the generated control signal CTL_2 to the session establishment means 13, and outputs the confidential data D_2 to the encryption means 14.

[0067] Therefore, in terminal device 1, when control means 16 receives communication characteristic data D_1 and identification code IDS from application (not shown), legacy session Sn_1 is established with AMF, and when control means 16 receives only confidentiality data D_2 from application (not shown), secure session Sn_2 is established with AMF.

[0068] Figure 4 shows the procedure for setting the security mode in Embodiment 1. Referring to Figure 4, when the setting of the security mode is initiated, the AMF sends a list LS of encryption and tamper-proof algorithms and parameters to the terminal device UE (terminal device 1) as 1-1.

[0069] When terminal device UE (terminal device 1) receives list LS from AMF of core network 3, it selects an encryption and tamper-proofing algorithm and parameters as 1-1.

[0070] Here, when the terminal device UE (terminal device 1) establishes a legacy session Sn_1, it selects, for example, a combination of encryption algorithm CRYAG_1 and a key length of 128 bits, and when it establishes a secure session Sn_2, it selects a combination of encryption algorithm CRYAG_2 and a key length of 256 bits. That is, when the terminal device UE (terminal device 1) establishes a legacy session Sn_1, it selects encryption algorithm CRYAG_1, which encrypts data using encryption key ENCRY_KY_1 with a key length of 128 bits, and when it establishes a secure session Sn_2, it selects encryption algorithm CRYAG_2, which encrypts data using encryption key ENCRY_KY_2 with a key length of 256 bits.

[0071] After step 1-1, terminal device UE (terminal device 1) sends the selected algorithm and parameters to the AMF of core network 3 as step 2-1.

[0072] When AMF receives the selected algorithm and parameters from the terminal device UE (Terminal Device 1), it sequentially executes "1a. Start tamper prevention" and "1b. Send NAS Security Mode Command to Terminal Device UE (Terminal Device 1)" as described in Figure 2.

[0073] When terminal device UE (terminal device 1) receives a NAS Security Mode Command from AMF, it acts as 2a, passes the NAS SMC (NAS Security Mode Command) inspection, and if the encryption and tamper-proofing algorithms and parameters are valid, it starts upstream encryption and downstream encryption and tamper-proofing.

[0074] In this case, the terminal device UE (terminal device 1) determines whether the encryption and tamper-proofing algorithms and parameters are appropriate using the method described above.

[0075] Furthermore, since the NAS Security Mode Command in 1b includes the algorithm and parameters selected by the terminal device UE (terminal device 1) in "1-1", the terminal device UE (terminal device 1) usually determines in 2a that the encryption and tamper-proofing algorithm and parameters are appropriate.

[0076] After 2a, terminal device UE (terminal device 1) sends the NAS Security Mode Complete message, as explained in Figure 2, to the AMF as 2b.

[0077] Then, when AMF receives NAS Security Mode Complete from terminal device UE (terminal device 1), it performs downstream encryption start as 1d.

[0078] This establishes a session (logical communication channel) between the terminal device UE (terminal device 1) and the core network 3, where data is encrypted using a shared key for communication.

[0079] Thus, in Embodiment 1, the terminal device UE (terminal device 1) selects the encryption and tamper-proofing algorithm and parameters (see 1-1), so the terminal device UE (terminal device 1) can select the encryption and tamper-proofing algorithm and parameters suitable for the session it wants to establish.

[0080] When terminal device 1 receives data D and identification code IDS from the application (not shown), it executes the security mode setting procedure shown in Figure 4 with AMF and establishes legacy session Sn_1.

[0081] Furthermore, when terminal device 1 receives only data D from the application (not shown), it executes the security mode setting procedure shown in Figure 4 with AMF to establish a secure session Sn_2.

[0082] Figure 5 is a flowchart illustrating the operation of terminal device 1 shown in Figure 3. Referring to Figure 5, when the operation of terminal device 1 begins, the control means 16 sets i=1 (step S1). Here, i is an argument indicating which time the flowchart shown in Figure 5 will be executed, and is an integer of 1 or more.

[0083] After step S1, the control means 16 determines whether or not it has received data D from the application (not shown) (step S2).

[0084] In step S2, if it is determined that data D has been received from the application (not shown), the control means 16 determines whether or not to use legacy session Sn_1 (step S3).

[0085] In this case, when the control means 16 receives data D and identification code IDS (an identification code indicating that data D is data transmitted using legacy session Sn_1) from the application (not shown), it determines to use legacy session Sn_1, and when it receives only data D from the application (not shown) (i.e., when it does not receive the identification code IDS), it determines not to use legacy session Sn_1.

[0086] In Embodiment 1, the session Sn used consists of two sessions, Legacy Session Sn_1 and Secure Session Sn_2. Therefore, in step S3, determining "Do not use Legacy Session Sn_1" is equivalent to determining "Use Secure Session Sn_2".

[0087] In step S3, when it is determined that legacy session Sn_1 should be used, the control means 16 determines whether or not legacy session Sn_1 was used during the (i-1)th execution of the flowchart (step S4).

[0088] In step S4, if it is determined that legacy session Sn_1 was not used during the (i-1)th execution of the flowchart, the control means 16 generates a control signal CTL_1 and outputs it to the session establishment means 13, and outputs data D to the encryption means 14.

[0089] The session establishment means 13, in response to the control signal CTL_1 from the control means 16, executes the security mode setting procedure shown in Figure 4 to establish a legacy session Sn_1 with the AMF of the core network 3 (step S5).

[0090] Then, in step S4, when it is determined that legacy session Sn_1 was used during the (i-1)th execution of the flowchart, or after step S5, the session establishment means 13 generates a session establishment signal SG_1 and outputs the generated session establishment signal SG_1 to the encryption means 14 and the decryption means 15.

[0091] When the encryption means 14 receives a session establishment signal SG_1 from the session establishment means 13, it encrypts the data D (=communication characteristic type data D_1) received from the control means 16 using the encryption key ENCRY_KY_1 to generate encrypted data ENCRY_D_1 (step S6), and outputs the generated encrypted data ENCRY_D_1 to the wireless unit 12.

[0092] When the wireless unit 12 receives encrypted data ENCRY_D_1 from the encryption means 14, it transmits the encrypted data ENCRY_D_1 to the destination using legacy session Sn_1 via the antenna 11 and base station 2 (step S7).

[0093] Subsequently, the wireless unit 12 receives encrypted data ENCRY_D_1 from the destination via the base station 2 and antenna 11 (step S8), and outputs the received encrypted data ENCRY_D_1 to the decryption means 15.

[0094] When the decryption means 15 receives encrypted data ENCRY_D_1 from the wireless unit 12, it selects a decryption key DECRY_KY_1 in accordance with the session establishment signal SG_1 received from the session establishment means 13, decrypts the encrypted data ENCRY_D_1 using the selected decryption key DECRY_KY_1, and transmits the decrypted communication characteristic data D_1 to the application (not shown) (step S9).

[0095] Then, the control means 16 sets i = i + 1 (step S16). After that, the operation of the terminal device 1 proceeds to step S2.

[0096] On the other hand, if in step S3 it is determined that legacy session Sn_1 will not be used (i.e., it is determined that secure session Sn_2 will be used), the control means 16 determines whether or not secure session Sn_2 was used during the (i-1)th execution of the flowchart (step S10).

[0097] In step S10, if it is determined that the secure session Sn_2 was not used during the (i-1)th execution of the flowchart, the control means 16 generates a control signal CTL_2 and outputs it to the session establishment means 13, and also outputs the data (confidential data D_2) to the encryption means 14.

[0098] The session establishment means 13, in response to the control signal CTL_2 from the control means 16, executes the security mode setting procedure shown in Figure 4 to establish a secure session Sn_2 with the AMF of the core network 3 (step S11).

[0099] Then, in step S10, when it is determined that secure session Sn_2 was used during the (i-1)th execution of the flowchart, or after step S11, the session establishment means 13 generates a session establishment signal SG_2 and outputs the generated session establishment signal SG_2 to the encryption means 14 and the decryption means 15.

[0100] When the encryption means 14 receives a session establishment signal SG_2 from the session establishment means 13, it selects the encryption key ENCRY_KY_2, encrypts the data (confidentiality data D_2) received from the control means 16 using the encryption key ENCRY_KY_2 to generate encrypted data ENCRY_D_2 (step S12), and outputs the generated encrypted data ENCRY_D_2 to the wireless unit 12.

[0101] When the wireless unit 12 receives encrypted data ENCRY_D_2 from the encryption means 14, it transmits the encrypted data ENCRY_D_2 to the destination using the secure session Sn_2 via the antenna 11 and base station 2 (step S13).

[0102] Subsequently, the wireless unit 12 receives the encrypted data ENCRY_D_2 from the destination via the base station 2 and antenna 11 (step S14), and outputs the received encrypted data ENCRY_D_2 to the decryption means 15.

[0103] When the decryption means 15 receives encrypted data ENCRY_D_2 from the wireless unit 12, it selects a decryption key DECRY_KY_2 in accordance with the session establishment signal SG_2 received from the session establishment means 13, decrypts the encrypted data ENCRY_D_2 using the selected decryption key DECRY_KY_2, and transmits the decrypted confidential data D_2 to the application (not shown) (step S15). Subsequently, the control means 16 executes step S16. Then, the operation of the terminal device 1 proceeds to step S2. Thereafter, each time it is determined in step S2 that data has been received from the application (not shown), steps S2 to S16 shown in Figure 5 are repeatedly executed.

[0104] Figure 6 is a flowchart illustrating the detailed operation of step S5 in Figure 5. Referring to Figure 6, when it is determined in step S4 of Figure 5 that legacy session Sn_1 was not used during the (i-1)th execution of the flowchart, the wireless unit 12 of terminal device 1 receives a list LS of encryption and tamper-proof algorithms and parameters from the AMF of core network 3 via base station 2 (gNodeb) and antenna 11 (step S51), and outputs the received list LS to session establishment means 13.

[0105] When the session establishment means 13 receives the list LS from the wireless unit 12, it selects the encryption and tamper-proofing algorithm CRYAG_1 and parameters (128-bit key length) from the algorithms and parameters included in the list LS (step S52).

[0106] The session establishment means 13 outputs the algorithm CRYAG_1 to be used and its parameters (128-bit key length) to the wireless unit 12, and the wireless unit 12 transmits the algorithm CRYAG_1 and its parameters (128-bit key length) received from the session establishment means 13 to the AMF of the core network 3 via the antenna 11 and the base station 2 (gNodeB) (step S53).

[0107] Subsequently, the wireless unit 12 receives a NAS Security Mode Command from the AMF of the core network 3 via the base station 2 (gNodeB) and antenna 11 (step S54), and outputs the received NAS Security Mode Command to the session establishment means 13.

[0108] In response to the NAS Security Mode Command received from the wireless unit 12, the session establishment means 13, if it passes the NAS SMC tampering check and the encryption / tamper prevention algorithm and parameters are valid, starts upstream encryption and downstream encryption / tamper prevention using the algorithm CRYAG_1 and parameters (128-bit key length) (step S55).

[0109] Then, the session establishment means 13 outputs "NAS Security Mode Complete," which includes initiating upstream encryption and downstream encryption / tamper prevention using the algorithm CRYAG_1 and parameters (128-bit key length), to the wireless unit 12. The wireless unit 12 then transmits the "NAS Security Mode Complete," which includes initiating upstream encryption and downstream encryption / tamper prevention using the algorithm CRYAG_1 and parameters (128-bit key length), received from the session establishment means 13 to the AMF of the core network 3 via the antenna 11 and base station 2 (gNodeB) (step S56). After that, the operation of the terminal device 1 proceeds to step S6 in Figure 5.

[0110] Figure 7 is a flowchart illustrating the detailed operation of step S11 in Figure 5. The flowchart in Figure 7 is the same as the flowchart in Figure 6, except that steps S52, S53, S55, and S56 are replaced with steps S52A, S53A, S55A, and S56A, respectively.

[0111] Referring to Figure 7, if it is determined in step S10 of Figure 5 that secure session Sn_2 was not used during the (i-1)th execution of the flowchart, then step S51 described above is executed.

[0112] Subsequently, when the session establishment means 13 receives list LS from the wireless unit 12, it selects the encryption and tamper-proof algorithm CRYAG_2 and parameters (256-bit key length) from the algorithms and parameters included in list LS (step S52A).

[0113] The session establishment means 13 outputs the algorithm CRYAG_2 to be used and its parameters (256-bit key length) to the wireless unit 12, and the wireless unit 12 transmits the algorithm CRYAG_2 and its parameters (256-bit key length) received from the session establishment means 13 to the AMF of the core network 3 via the antenna 11 and the base station 2 (gNodeB) (step S53A).

[0114] Subsequently, step S54 described above is performed. After step S54, the session establishment means 13, in response to the NAS Security Mode Command received from the wireless unit 12, if it passes the NAS SMC tampering check and the algorithm and parameters for encryption and tamper prevention are valid, starts upstream encryption and downstream encryption / tamper prevention using the algorithm CRYAG_2 and parameters (256-bit key length) (step S55A).

[0115] The session establishment means 13 then outputs "NAS Security Mode Complete," which includes initiating upstream encryption and downstream encryption / tamper prevention using the algorithm CRYAG_2 and parameters (256-bit key length), to the wireless unit 12. The wireless unit 12 then transmits the "NAS Security Mode Complete," which includes initiating upstream encryption and downstream encryption / tamper prevention using the algorithm CRYAG_2 and parameters (256-bit key length), received from the session establishment means 13 to the AMF of the core network 3 via the antenna 11 and base station 2 (gNodeB) (step S56A). Subsequently, the operation of the terminal device 1 proceeds to step S12 in Figure 5.

[0116] Figures 8 and 9 are the first and second correspondence diagrams, respectively, showing the correspondence between the number of executions of the flowchart shown in Figure 5, the session used for the i-th execution, the session used for the (i-1)-th execution, and the execution steps.

[0117] Referring to Figure 8, when terminal device 1 executes the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the first time, if the session used for the i (i=1) time is legacy session Sn_1 and there is no session used for the (i-1) time, it sequentially executes steps S2 “YES” in Figure 5 → step S3 “YES” → step S4 “NO” → steps S5 to S9, S16 (the flowchart in Figure 6 showing the detailed operation of step S5).

[0118] As a result, terminal device 1 uses legacy session Sn_1 to send and receive "multimedia service data (communication-specific data D_1)" received from the application (not shown) to and from the destination.

[0119] Furthermore, when terminal device 1 executes the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the second time, if the session used for the i (i=2) time is legacy session Sn_1, and the session used for the (i-1) time (=1 time) was also legacy session Sn_1, then it sequentially executes "YES" in step S2 of Figure 5 → "YES" in step S3 → "YES" in step S4 → steps S6~S9, S16.

[0120] In this case, when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the (i-1)th time (=1st time), the legacy session Sn_1 is already established in step S5 of Figure 5. Therefore, when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the ith time, the terminal device 1 does not execute step S5 of Figure 5, but uses the already established legacy session Sn_1 to send and receive "multimedia service data (=communication characteristic data D_1)" received from the application (not shown) to the destination (see steps S6 to S8).

[0121] Furthermore, when terminal device 1 executes the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the second time, if the session used for the i (i=2) time is secure session Sn_2 and the session used for the (i-1) time (=1 time) is legacy session Sn_1, then it sequentially executes "YES" in step S2 of Figure 5 → "NO" in step S3 → "NO" in step S10 → steps S11 to S16 (the flowchart in Figure 7 showing the detailed operation of step S11).

[0122] In this case, since secure session Sn_2 is being used for the first time, terminal device 1 executes step S11 in Figure 5 (flowchart shown in Figure 7) to establish secure session Sn_2, and then uses the established secure session Sn_2 to send and receive confidential data D_2 with the destination (see steps S12 to S14).

[0123] Furthermore, when terminal device 1 executes the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the third time, if the session used for the i (i=3) time is legacy session Sn_1, and the session used for the (i-1) time (=1 time) was also legacy session Sn_1, then it sequentially executes "YES" in step S2 of Figure 5 → "YES" in step S3 → "YES" in step S4 → steps S6~S9, S16.

[0124] In this case, when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the (i-1)th time (=2nd time), the legacy session Sn_1 is already established in step S5 of Figure 5. Therefore, when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the third time, the terminal device 1 does not execute step S5 of Figure 5, but uses the already established legacy session Sn_1 to send and receive "multimedia service data (=communication characteristic data D_1)" received from the application (not shown) to the destination (see steps S6 to S8).

[0125] Furthermore, when terminal device 1 executes the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the third time, if the session used for the i (i=3) time is legacy session Sn_1 and the session used for the (i-1) time (=2) time is secure session Sn_2, then it sequentially executes "YES" in step S2 of Figure 5 → "YES" in step S3 → "NO" in step S4 → steps S5~S9, S16.

[0126] In this case, since the session used for the (i-1)th time (=2nd time) is secure session Sn_2, terminal device 1 executes step S5 (flowchart shown in Figure 6) when executing the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the third time to establish legacy session Sn_1, and uses the established legacy session Sn_1 to send and receive "multimedia service data (=communication characteristic data D_1)" received from the application (not shown) to the destination (see steps S6 to S8).

[0127] Furthermore, when terminal device 1 executes the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the third time, if the session used for the i (i=3) time is secure session Sn_2 and the session used for the (i-1) time (=2) time is legacy session Sn_1, then it sequentially executes "YES" in step S2 of Figure 5 → "NO" in step S3 → "NO" in step S10 → steps S11 to S16.

[0128] In this case, since the session used for the (i-1)th time (=2nd time) is legacy session Sn_1, terminal device 1 executes step S11 in Figure 5 (flowchart shown in Figure 7) when executing the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the third time to establish secure session Sn_2, and uses the established secure session Sn_2 to send and receive "confidential data" received from the application (not shown) with the destination (see steps S12 to S14).

[0129] Furthermore, when terminal device 1 executes the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the third time, if the session used for the i (i=3) time is secure session Sn_2, and the session used for the (i-1) time (=2) time is also secure session Sn_2, then it sequentially executes "YES" in step S2 of Figure 5 → "NO" in step S3 → "YES" in step S10 → steps S12 to S16.

[0130] In this case, since the session used in the (i-1)th time (=2nd time) is secure session Sn_2, terminal device 1 does not execute step S11 in Figure 5 (flowchart shown in Figure 7) when executing the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the third time, but instead uses the secure session Sn_2 established in the (i-1)th time (=2nd time) to send and receive "confidential data" received from the application (not shown) with the destination (see steps S12 to S14).

[0131] Furthermore, when terminal device 1 executes the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the fourth time or later (i≧4), it sends and receives "data in multimedia services (=communication characteristic type data D_1)" received from the application (not shown) to the destination (see steps S6~S7), in the same manner as when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the third time (i=3) (see steps S6~S7), or sends and receives "confidentiality data" received from the application (not shown) to the destination (see steps S12~S14).

[0132] Referring to Figure 9, when terminal device 1 executes the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the first time, if the session to be used for the i (i=1) time is secure session Sn_2 and there is no session to be used for the (i-1) time, it sequentially executes steps S2 “YES” in Figure 5 → step S3 “NO” → step S10 “NO” → steps S11 to S16 (the flowchart in Figure 7 showing the detailed operation of step S11).

[0133] As a result, terminal device 1 establishes a secure session Sn_2 when executing the i (i=1)th flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) (see step S11), and uses the established secure session Sn_2 to send and receive "confidential data" received from the application (not shown) to the destination (see steps S12 to S14).

[0134] Furthermore, when terminal device 1 executes the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the second time, if the session used for the i (i=2) time is legacy session Sn_1 and the session used for the (i-1) time (=1 time) is secure session Sn_2, then it sequentially executes "YES" in step S2 of Figure 5 → "YES" in step S3 → "NO" in step S4 → steps S5 to S9, S16.

[0135] In this case, since legacy session Sn_1 is being used for the first time, terminal device 1, when executing the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the i (i=2)th time, executes step S5 in Figure 5 (the flowchart shown in Figure 6) to establish legacy session Sn_1, and uses the established legacy session Sn_1 to send and receive "multimedia service data (=communication characteristic data D_1)" received from the application (not shown) to the destination (see steps S6 to S8).

[0136] Furthermore, when terminal device 1 executes the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) for the second time, if the session used for the i (i=2) time is secure session Sn_2, and the session used for the (i-1) time (=1 time) was also secure session Sn_2, then it sequentially executes "YES" in step S2 of Figure 5 → "NO" in step S3 → "YES" in step S10 → steps S12 to S16.

[0137] In this case, since the secure session Sn_2 is already established during the (i-1)th execution (=1st execution) of the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7), terminal device 1 does not execute step S11 in Figure 5 (flowchart shown in Figure 7) during the i(i=2)th execution of the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7), but instead uses the already established secure session Sn_2 to send and receive confidential data D_2 with the destination (see steps S12 to S14).

[0138] In Figure 9, the "execution steps" when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the third time and from the fourth time onward are the same as the "execution steps" when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the third time and from the fourth time onward in Figure 8.

[0139] As shown in Figures 8 and 9, when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the first time, the "execution steps" when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the first time differ depending on whether the session used for the first execution is legacy session Sn_1 or secure session Sn_2. Similarly, when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the second time, the session used for the i(i=2)th time, the session used for the (i-1)th time, and the "execution steps" also differ.

[0140] However, as shown in Figures 8 and 9, when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the third time or later (i≧3), the session used for the i (i≧3) time, the session used for the (i-1) time, and the "execution step" are the same (see the hatched areas in Figures 8 and 9).

[0141] Therefore, when the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) is executed for the first time, regardless of whether the data received from the application (not shown) is "data in multimedia services (=communication-specific data D_1)" or "confidential data D_2", terminal device 1 will establish a legacy session Sn_1 or a secure session Sn_2 according to the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7) based on the data received from the application (not shown) ("data in multimedia services (=communication-specific data D_1)" or "confidential data D_2"), and will use the established legacy session Sn_1 or secure session Sn_2 to send and receive "data in multimedia services (=communication-specific data D_1)" or "confidential data D_2" with the destination.

[0142] According to the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7), terminal device 1 establishes a legacy session Sn_1 or a secure session Sn_2 with the AMF of core network 3 in response to data received from an application (not shown) (data in multimedia services (=communication-specific data D_1) or confidential data D_2), and uses the established legacy session Sn_1 or secure session Sn_2 to send and receive data in multimedia services (=communication-specific data D_1) or confidential data D_2 with the destination.

[0143] Legacy session Sn_1 is a session for transmitting encrypted data, which is data in multimedia services where throughput or responsiveness is important (=communication-specific data D_1), encrypted with the encryption key ENCRY_KY_1 having a key length of 128 bits. Secure session Sn_2 is a session for transmitting encrypted data, which is data requiring confidentiality D_2, encrypted with the encryption key ENCRY_KY_2 having a key length of 256 bits.

[0144] Therefore, depending on the application, the communication channel (legacy session Sn_1 or secure session Sn_2) can be used to transmit either data in multimedia services (=communication-specific data D_1) or confidential data D_2. As a result, confidential data D_2 can be appropriately protected without being over-specified for data in multimedia services (=communication-specific data D_1).

[0145] Furthermore, in the security mode setting procedure with the AMF of the core network 3, terminal device 1 selects and transmits encryption and tamper-proofing algorithms and parameters to the AMF of the core network 3 (see “1_1” in Figure 4).

[0146] Therefore, terminal device 1 can select executable algorithms and parameters to set the security mode with the AMF of core network 3.

[0147] In Embodiment 1, the operation of the terminal device 1 may be implemented by software. In this case, the terminal device 1 includes a CPU (Central Processing Unit), ROM (Read Only Memory), and RAM (Random Access Memory). The ROM stores a program Prog_A consisting of each step of the flowchart shown in Figure 5 (including the flowcharts shown in Figures 6 and 7).

[0148] The CPU reads program Prog_A from ROM, executes the read program Prog_A, establishes either legacy session Sn_1 or secure session Sn_2 with the AMF of core network 3, and sends communication characteristic data D_1 or confidential data D_2 using legacy session Sn_1 or secure session Sn_2 depending on the application. RAM temporarily stores the encryption keys ENCRY_KY_1, ENCRY_KY_2 and decryption keys DECRY_KY_1, DECRY_KY_2 mentioned above.

[0149] Furthermore, program Prog_A may be recorded on a recording medium such as a CD or DVD and distributed. When a recording medium containing program Prog_A is inserted into a computer, the computer reads and executes program Prog_A from the recording medium, establishes either a legacy session Sn_1 or a secure session Sn_2 with the AMF of core network 3, and transmits communication-specific data D_1 or confidential data D_2 using either legacy session Sn_1 or secure session Sn_2 depending on the application.

[0150] Therefore, the recording medium on which program Prog_A is recorded is a computer-readable recording medium.

[0151] [Embodiment 2] Figure 10 is a schematic diagram of Embodiment 2 of the terminal device shown in Figure 1. Referring to Figure 10, the terminal device 1 shown in Figure 1 is equivalent to the terminal device 1A shown in Figure 10 in Embodiment 2.

[0152] Terminal device 1A is the same as terminal device 1 shown in Figure 3, except that the wireless unit 12 is replaced with wireless unit 12A and the session establishment means 13 is replaced with session establishment means 13A.

[0153] The wireless unit 12A constitutes a transmitting means and a receiving means. When the wireless unit 12A receives a list LS of algorithms and parameters related to encryption and tamper prevention from the session establishment means 13A, it transmits the received list LS to the AMF of the core network 3 via the antenna 11.

[0154] Furthermore, the wireless unit 12A receives the NAS Security Mode Command from the AMF of the core network 3 via the antenna 11 and outputs the received NAS Security Mode Command to the session establishment means 13A.

[0155] Furthermore, when the wireless unit 12A receives a NAS Security Mode Complete message from the session establishment means 13A, it transmits the received NAS Security Mode Complete message to the AMF of the core network 3 via the antenna 11.

[0156] Furthermore, when the wireless unit 12A receives encrypted data (encrypted data ENCRY_D_1 or encrypted data ENCRY_D_2) from the encryption means 14, it transmits the received encrypted data (encrypted data ENCRY_D_1 or encrypted data ENCRY_D_2) via the antenna 11.

[0157] Furthermore, the wireless unit 12A receives encrypted data (encrypted data ENCRY_D_1 or encrypted data ENCRY_D_2) via the antenna 11 and outputs the received encrypted data (encrypted data ENCRY_D_1 or encrypted data ENCRY_D_2) to the decryption means 15.

[0158] The session establishment means 13A holds a list LS of algorithms and parameters related to encryption and tamper prevention, which is provided by the 5G operator.

[0159] Before receiving a NAS Security Mode Command from the AMF of the core network 3, the session establishment means 13A outputs a list LS of encryption and tamper-proof algorithms and parameters to the wireless unit 12A and transmits it to the AMF of the core network 3.

[0160] Session establishment means 13A performs the same functions as session establishment means 13.

[0161] When the AMF in core network 3 receives list LS from terminal device 1A, it selects an algorithm and parameters related to encryption and tamper prevention.

[0162] Figure 11 shows the procedure for setting the security mode in Embodiment 2. Referring to Figure 11, when the setting of the security mode is initiated, the terminal device UE (terminal device 1A) sends a list LS of encryption and tamper-proof algorithms and parameters to the AMF of the core network 3 as 2-1.

[0163] When the AMF of core network 3 receives list LS from terminal device UE (terminal device 1A), it selects an encryption and tamper-proofing algorithm and parameters as 1-1.

[0164] After step 1-1, the AMF on core network 3 sequentially executes "1a. Start of tamper prevention" and "1b. Sending of NAS Security Mode Command to terminal device UE (terminal device 1A)" as described in Figure 2.

[0165] When terminal device UE (terminal device 1A) receives a NAS Security Mode Command from AMF, it acts as 2a, passes the NAS SMC (NAS Security Mode Command) inspection, and if the encryption and tamper-proofing algorithms and parameters are valid, it starts upstream encryption and downstream encryption and tamper-proofing.

[0166] After 2a, terminal device UE (terminal device 1A) sends the NAS Security Mode Complete message, as explained in Figure 2, to the AMF as 2b.

[0167] Then, when AMF receives NAS Security Mode Complete from terminal device UE (terminal device 1A), it performs downstream encryption in step 1d.

[0168] This establishes a session (logical communication channel) between the terminal device UE (terminal device 1A) and the core network 3, where data is encrypted using a shared key for communication.

[0169] Thus, in Embodiment 2, the terminal device UE (terminal device 1A) sends a list LS of encryption and tamper-proofing algorithms and parameters to the core network's AMF (see 2-1). Therefore, the terminal device UE (terminal device 1A) can include the encryption and tamper-proofing algorithms and parameters suitable for the session it wants to establish in the list LS and send it to the core network's AMF.

[0170] As a result, in step 2a, terminal device UE (terminal device 1A) normally determines that the encryption and tamper-proofing algorithms and parameters are appropriate and initiates upstream encryption and downstream encryption and tamper-proofing.

[0171] When terminal device 1A receives communication characteristic data D_1 and identification code IDS from the application (not shown), it executes the security mode setting procedure shown in Figure 11 with the AMF and establishes legacy session Sn_1.

[0172] Furthermore, when terminal device 1A receives only confidential data D_2 from the application (not shown), it executes the security mode setting procedure shown in Figure 11 with AMF to establish a secure session Sn_2.

[0173] Therefore, when terminal device 1A receives communication characteristic data D_1 and identification code IDS from the application (not shown), in 2-1, it sends a list LS of encryption and tamper-proof algorithms and parameters (128-bit key length) to the AMF of core network 3.

[0174] Furthermore, when terminal device 1A receives only confidential data D_2 from the application (not shown), it sends a list LS of encryption and tamper-proof algorithms and parameters (256-bit key length) to the AMF of core network 3 in 2-1.

[0175] Figure 12 is a flowchart illustrating the operation of terminal device 1A shown in Figure 10. The flowchart in Figure 12 is the same as the flowchart in Figure 5, except that steps S5 and S11 are replaced with steps S5A and S11A, respectively.

[0176] Referring to Figure 12, when the operation of terminal device 1A begins, steps S1 to S4 described above are executed sequentially.

[0177] Then, in step S4, if it is determined that legacy session Sn_1 was not used during the execution of the (i-1)th flowchart (=the flowchart shown in Figure 12), the session establishment means 13A executes the security mode setting procedure shown in Figure 11 to establish legacy session Sn_1 with the AMF of the core network 3 (step S5A).

[0178] After steps S6 to S9 and S16 described above are executed sequentially, the operation of terminal device 1A proceeds to step S2.

[0179] On the other hand, if it is determined in step S3 that legacy session Sn_1 will not be used, and in step S10 that secure session Sn_2 was not used during the execution of the (i-1)th flowchart (=the flowchart shown in Figure 12), the session establishment means 13A executes the security mode setting procedure shown in Figure 11 to establish secure session Sn_2 with the AMF of core network 3 (step S11A).

[0180] After steps S12 to S16 described above are executed sequentially, the operation of terminal device 1A proceeds to step S2.

[0181] Figure 13 is a flowchart illustrating the detailed operation of step S5A in Figure 12. The flowchart shown in Figure 13 is the same as the flowchart in Figure 6, except that step S51 is changed to step S51A and steps S52 and S53 are deleted.

[0182] Referring to Figure 13, if it is determined in step S4 of Figure 12 that legacy session Sn_1 was not used during the execution of the (i-1)th flowchart (=the flowchart shown in Figure 12), the session establishment means 13A outputs the "list of algorithms and parameters related to encryption and tamper prevention LS" that it holds to the wireless unit 12, and transmits the list LS to the AMF of the core network 3 via the wireless unit 12 and antenna 11 (step S51A).

[0183] After step S51A, steps S54 to S56 described above are executed sequentially, and after step S56, the operation of terminal device 1A proceeds to step S6 in Figure 12.

[0184] According to the flowchart shown in Figure 13, the session establishment means 13A establishes legacy session Sn_1 by sequentially executing steps S51A, S54 to S56.

[0185] In this case, the session establishment means 13A can, in step S51A, include an encryption method in the algorithm CRYAG_1 of the list LS that encrypts the data using the encryption key ENCRY_KY_1 used in legacy session Sn_1, and include a 128-bit key length in the parameters of the list LS, and send it to the AMF of the core network 3. This makes it easier to determine in step S55 whether the encryption and tamper-proofing algorithm and parameters are appropriate.

[0186] Figure 14 is a flowchart illustrating the detailed operation of step S11A in Figure 12. The flowchart in Figure 14 is the same as the flowchart in Figure 7, except that step S51 is changed to step S51A and steps S52A and S53A are deleted.

[0187] Referring to Figure 14, if it is determined in step S10 of Figure 12 that secure session Sn_2 was not used during the execution of the (i-1)th flowchart (=the flowchart shown in Figure 12), the session establishment means 13A outputs the "list of encryption and tamper-proof algorithms and parameters LS" it holds to the wireless unit 12, and transmits the list LS to the AMF of the core network 3 via the wireless unit 12 and antenna 11 (step S51A).

[0188] After step S51A, steps S54, S55A, and S56A described above are executed in sequence, and after step S56A, the operation of terminal device 1A proceeds to step S12 in Figure 12.

[0189] According to the flowchart shown in Figure 14, the session establishment means 13A establishes a secure session Sn_2 by sequentially executing steps S51A, S54, S55A, and S56A.

[0190] In this case, the session establishment means 13A can, in step S51A, include an encryption method in the algorithm CRYAG_2 of list LS that encrypts the data using the encryption key ENCRY_KY_2 used in secure session Sn_2, and include a 256-bit key length in the parameters of list LS, and send it to the AMF of core network 3. This makes it easier to determine in step S55A whether the encryption and tamper-proofing algorithms and parameters are appropriate.

[0191] According to the flowchart shown in Figure 12 (including the flowcharts shown in Figures 13 and 14), terminal device 1A establishes a legacy session Sn_1 or a secure session Sn_2 with the AMF of core network 3 in accordance with the data (communication characteristic data D_1 or confidential data D_2) received from the application (not shown), and uses the established legacy session Sn_1 or secure session Sn_2 to send and receive the communication characteristic data D_1 or confidential data D_2 with the destination.

[0192] Legacy session Sn_1 is a session for sending encrypted data, in which communication-specific data D_1 is encrypted with the encryption key ENCRY_KY_1, which has a key length of 128 bits. Secure session Sn_2 is a session for sending encrypted data, in which confidential data D_2 is encrypted with the encryption key ENCRK_KY_2, which has a key length of 256 bits.

[0193] Therefore, depending on the application, the communication channel (legacy session Sn_1 or secure session Sn_2) can be used to transmit either communication-specific data D_1 or confidential data D_2. As a result, confidential data D_2 can be properly protected without over-specifying the communication-specific data D_1.

[0194] Furthermore, when establishing a legacy session Sn_1 or a secure session Sn_2, the risk LS of the encryption and tamper-proof algorithm and parameters is transmitted from terminal device 1A to the AMF of core network 3 (see step S51A in Figures 13 and 14), making it easier for terminal device 1A to determine whether the encryption and tamper-proof algorithm and parameters are appropriate.

[0195] In Embodiment 2, the operation of the terminal device 1A may be implemented by software. In this case, the terminal device 1A includes a CPU, ROM, and RAM. The ROM stores a program Prog_B consisting of each step of the flowchart shown in Figure 12 (including the flowcharts shown in Figures 13 and 14).

[0196] The CPU reads program Prog_B from ROM, executes the read program Prog_B, establishes either legacy session Sn_1 or secure session Sn_2 with the AMF of core network 3, and sends communication characteristic data D_1 or confidential data D_2 using legacy session Sn_1 or secure session Sn_2 depending on the application. RAM temporarily stores the encryption keys ENCRY_KY_1 and ENCRY_KY_2 and decryption keys DECRY_KY_1 and DECRY_KY_2 mentioned above.

[0197] Furthermore, program Prog_B may be recorded on a recording medium such as a CD or DVD and distributed. When a recording medium containing program Prog_B is inserted into a computer, the computer reads and executes program Prog_B from the recording medium, establishes either a legacy session Sn_1 or a secure session Sn_2 with the AMF of core network 3, and transmits communication-specific data D_1 or confidential data D_2 using either legacy session Sn_1 or secure session Sn_2, depending on the application.

[0198] Therefore, the recording medium on which the program Prog_B is stored is a computer-readable recording medium.

[0199] Other details in Embodiment 2 are the same as those in Embodiment 1.

[0200] [Embodiment 3] 3GPP TS 37.340 defines a mechanism for using multiple sessions simultaneously using MR-DC (Multi-Radio Dual Connectivity).

[0201] This mechanism is designed to establish a session with a base station (slave node SN) that is different from the base station (master node MN) currently in use. MR-DC is used in areas where 4G (fourth-generation mobile communication system) / LTE and 5G coexist, with the aim of simultaneously establishing 4G and 5G sessions and taking advantage of the high speed of 5G.

[0202] Figure 15 shows the 3GPP slave node addition / modification procedure. Referring to Figure 15, when the 3GPP slave node addition / modification procedure is initiated, the terminal device UE and the master node MN establish a Radio Resource Control (RRC) connection between the terminal device UE and the master node MN as follows:

[0203] Then, as step 2, the master node MN requests the slave node SN to perform additional modifications to SN.

[0204] The slave node SN negotiates for functionality as described in step 3, in response to a request for SN additions or modifications from the master node MN. More specifically, the slave node SN enables upstream protection and selects the algorithm.

[0205] Then, as step 4, the slave node SN approves the SN addition and modification to the master node MN.

[0206] The master node MN, upon approval of the SN addition / modification from the slave node SN, reconfigures the RRC connection with the terminal device UE as described in step 5. In this case, the master node MN specifies the encryption and tamper-proof algorithm and parameters to the terminal device UE.

[0207] In response to the RRC connection being reconfigured, the terminal device UE sends a message to the master node MN indicating that the RRC connection reconfiguration is complete, as in step 6.

[0208] When the master node MN receives confirmation from the terminal device UE that the RRC connection has been reconfigured, it performs step 7, completing the SN reconfiguration with the slave node SN.

[0209] Then, the terminal device UE and the slave node SN initiate encryption and tamper-proofing. Subsequently, the terminal device UE and the slave node SN perform a random access procedure between the terminal device UE and the slave node SN.

[0210] Figure 16 shows the procedure for adding or modifying a sub-session between the terminal device UE and the master node MN in Embodiment 3.

[0211] Referring to Figure 16, when the procedure for adding or modifying a sub-session is initiated between the terminal device UE and the master node MN, the terminal device UE and the master node MN establish a wireless resource control connection between the terminal device UE and the master node MN as follows: 1.

[0212] Then, the master node MN negotiates the functions as described in step 3. More specifically, the master node MN enables upstream protection and selects the algorithm.

[0213] Subsequently, the master node MN, as step 5, reconfigures the RRC connection with the terminal device UE. In this case, the master node MN specifies the encryption and tamper-proof algorithm and parameters to the terminal device UE.

[0214] In response to the RRC connection being reconfigured, the terminal device UE sends a message to the master node MN indicating that the RRC connection reconfiguration is complete, as in step 6.

[0215] Then, the terminal device UE and the master node MN initiate encryption and tamper-proofing. Subsequently, the terminal device UE and the master node MN perform a random access procedure between the terminal device UE and the master node MN.

[0216] The procedure for adding or modifying a sub-session shown in Figure 16 is the procedure for adding or modifying a sub-session when the master node MN and the slave node SN are considered to be the same. When the terminal device UE and the master node MN perform the procedure for adding or modifying a sub-session shown in Figure 16 between the terminal device UE and the master node MN, the sub-session between the terminal device UE and the slave node SN is considered to have been established between the terminal device UE and the master node MN.

[0217] Therefore, terminal device UE and master node MN can use MR-DC to consider master node MN and slave node SN as the same entity and perform the sub-session addition and modification procedure shown in Figure 16 to establish two sessions: a primary session between terminal device UE and master node MN (= slave node SN).

[0218] Figure 17 is a schematic diagram of Embodiment 3 of the terminal device 1 shown in Figure 1. In Embodiment 3, the terminal device 1 shown in Figure 1 consists of the terminal device 1B shown in Figure 17.

[0219] Referring to Figure 17, terminal device 1B is the same as terminal device 1, except that the control means 16 shown in Figure 1 is removed, and the wireless unit 12, session establishment means 13, encryption means 14, and decryption means 15 are replaced with wireless unit 12B, session establishment means 13B, encryption means 14A, and decryption means 15A, respectively.

[0220] Wireless unit 12B constitutes a transmitting means and a receiving means. Instead of wireless unit 12A, shown in Figure 10, transmitting a "list of algorithms and parameters LS related to encryption and tamper prevention" to the AMF of core network 3, wireless unit 12B performs the function of transmitting a session addition setting request (= a request to set up an additional session) including the "list of algorithms and parameters LS related to encryption and tamper prevention" to the AMF of core network 3.

[0221] Furthermore, the wireless unit 12B maintains a routing table RT, which will be described later. When MR-DC is available, the wireless unit 12B receives a session establishment signal SG_3 from the session establishment means 13B indicating that legacy session Sn_1 and secure session Sn_2 have been established simultaneously. When the wireless unit 12B receives a packet PKT (=packet PKT_1 or packet PKT_2) from the encryption means 14, it refers to the routing table RT and distributes the packet PKT (=packet PKT_1 or packet PKT_2) to either legacy session Sn_1 or secure session Sn_2 and transmits the packet PKT (=packet PKT_1 or packet PKT_2).

[0222] Furthermore, if MR-DC is unavailable, the wireless unit 12B receives a session establishment signal SG_1 or a session establishment signal SG_2 from the session establishment means 13B. After receiving the session establishment signal SG_1, the wireless unit 12B receives a packet PKT_ENCRY_1 from the encryption means 14A, which contains encrypted data ENCRY_D_1 obtained by encrypting communication characteristic data D_1 with the encryption key ENCRY_KY_1. The wireless unit 12B then uses legacy session Sn_1 to send the packet PKT_ENCRY_1 to the destination. Subsequently, the wireless unit 12B receives the packet PKT_ENCRY_1 from the destination and outputs the received packet PKT_ENCRY_1 to the decryption means 15A.

[0223] Meanwhile, after receiving the session establishment signal SG_2, the wireless unit 12B receives a packet PKT_ENCRY_2 from the encryption means 14A containing encrypted data ENCRY_D_2, which is obtained by encrypting confidentiality data D_2 with the encryption key ENCRY_KY_2. The wireless unit 12B then uses the secure session Sn_2 to send the packet PKT_ENCRY_2 to the destination. Subsequently, the wireless unit 12B receives the packet PKT_ENCRY_2 from the destination and outputs the received packet PKT_ENCRY_2 to the decryption means 15A.

[0224] Furthermore, the wireless unit 12B incorporates a timer. When the wireless unit 12B starts sending packet PKT_ENCRY_1 to its destination using legacy session Sn_1, it uses the timer to measure the communication time CM_t_1 from the start of sending packet PKT_ENCRY_1 to its destination until it finishes receiving packet PKT_ENCRY_1 from its destination.

[0225] Meanwhile, when the wireless unit 12B starts sending packet PKT_ENCRY_2 to its destination using secure session Sn_2, it uses a timer to measure the communication time CM_t_2 from the start of sending packet PKT_ENCRY_2 to its destination until it finishes receiving packet PKT_ENCRY_2 from its destination.

[0226] The wireless unit 12B then outputs the communication time CM_t_1 and the communication time CM_t_2 to the session establishment means 13B.

[0227] When the session establishment means 13B receives a NAS Security Mode Command from the wireless unit 12B, if it passes the NAS SMC tampering check, it starts upstream encryption and downstream encryption / tamper prevention.

[0228] The session establishment means 13B then outputs "NAS Security Mode Complete" to the wireless unit 12B.

[0229] Subsequently, the session establishment means 13B generates a session addition setting request (= a request to set up an additional session) that includes "a list of algorithms and parameters related to encryption and tamper prevention LS", and outputs the generated session addition setting request (= a request to set up an additional session) to the wireless unit 12B.

[0230] Subsequently, when the session establishment means 13B receives a NAS Security Mode Command from the wireless unit 12B, if it passes the NAS SMC tampering check, it starts upstream encryption and downstream encryption / tamper prevention.

[0231] The session establishment means 13B then outputs "NAS Security Mode Complete" to the wireless unit 12B.

[0232] Furthermore, if the session establishment means 13B determines that the MR-DC is available after establishing the secure session Sn_2, it establishes the legacy session Sn_1 using the MR-DC. That is, when the MR-DC is available, the session establishment means 13B simultaneously establishes the legacy session Sn_1 and the secure session Sn_2 with one base station 2 using a mechanism that allows for the simultaneous use of multiple sessions. The session establishment means 13B then generates a session establishment signal SG_3 indicating that the legacy session Sn_1 and the secure session Sn_2 have been established simultaneously, and outputs the generated session establishment signal SG_3 to the radio unit 12B, the encryption means 14A, and the decryption means 15A.

[0233] On the other hand, if the session establishment means 13B determines that the MR-DC is unavailable after establishing secure session Sn_2, and if the predetermined conditions described later are met, it switches the session from secure session Sn_2 to legacy session Sn_1, or from legacy session Sn_1 to secure session Sn_2.

[0234] Then, when the session establishment means 13B switches the session from secure session Sn_2 to legacy session Sn_1, it outputs a session establishment signal SG_1 to the wireless unit 12B, encryption means 14A, and decryption means 15A, and when the session switches from legacy session Sn_1 to secure session Sn_2, it outputs a session establishment signal SG_2 to the wireless unit 12B, encryption means 14A, and decryption means 15A.

[0235] After the session establishment means 13B outputs the session establishment signal SG_1 to the radio unit 12B, it receives the communication time CM_t_1 from the radio unit 12B. After outputting the session establishment signal SG_2 to the radio unit 12B, it receives the communication time CM_t_2 from the radio unit 12B.

[0236] Then, the session establishment means 13B calculates the total SUM of the communication time CM_t_1 and the communication time CM_t_2, and divides the communication time CM_t_2 by the total SUM to calculate the "proportion CFDR of applications requiring confidentiality".

[0237] The session establishment means 13B holds the threshold value PU and the threshold value PL. The threshold value PL is smaller than the threshold value PU (PL < PU). Then, after the session establishment means 13B outputs the session establishment signal SG_1 to the radio unit 12B, if the "proportion CFDR of applications requiring confidentiality" exceeds the threshold value PU, it generates a "session switching request SW_2" indicating a request to switch the session from the legacy session Sn_1 to the secure session Sn_2 and transmits it to the AMF of the core network 3. After the session establishment means 13B outputs the session establishment signal SG_2 to the radio unit 12B, if the "proportion CFDR of applications requiring confidentiality" is below the threshold value PL, it generates a "session switching request SW_1" indicating a request to switch the session from the secure session Sn_2 to the legacy session Sn_1 and transmits it to the AMF of the core network 3.

[0238] When the session is switched to the legacy session Sn_1, the session establishment means 13B generates the session establishment signal SG_1 and outputs it to the radio unit 12B, the encryption means 14A, and the decryption means 15A. When the session is switched to the secure session Sn_2, the session establishment means 13B generates the session establishment signal SG_2 and outputs it to the radio unit 12B, the encryption means 14A, and the decryption means 15A.

[0239] If MR-DC is unavailable, session establishment means 13B continues to calculate the "percentage of applications requiring confidentiality (CFDR)", determine whether the "percentage of applications requiring confidentiality (CFDR)" exceeds the threshold PU, determine whether the "percentage of applications requiring confidentiality (CFDR)" falls below the threshold PL, and send session switching requests SW_1 and SW_2 to the AMF of core network 3 until it stops receiving data D from the application (not shown).

[0240] When the encryption means 14A receives the session establishment signal SG_3 from the session establishment means 13B, it recognizes that legacy session Sn_1 and secure session Sn_2 have been established simultaneously.

[0241] Subsequently, when the encryption means 14A receives data D and identification code IDS from the application (not shown), it determines that it has received communication characteristic data D_1 from the application (not shown). Then, the encryption means 14A encrypts the communication characteristic data D_1 with the encryption key ENCRY_KT_1 to generate encrypted data ENCRY_D_1, and generates a packet PKT_ENCRY_1 containing the generated encrypted data ENCRY_D_1.

[0242] Subsequently, the encryption means 14A generates a tag TAG_1 containing a dedicated 5G QoS Flow ID=5QI, places the generated tag TAG_1 at the beginning of packet PKT_ENCRY_1 to generate packet PKT_1=[TAG_1 / PKT_ENCRY_1], and outputs the generated packet PKT_1=[TAG_1 / PKT_ENCRY_1] to the wireless unit 12B.

[0243] On the other hand, if the encryption means 14A receives only data D from the application (not shown) without receiving the identification symbol IDS, it determines that it has received confidential data D_2 from the application (not shown). Then, the encryption means 14A encrypts the confidential data D_2 with the encryption key ENCRY_KT_2 to generate encrypted data ENCRY_D_2, and generates a packet PKT_ENCRY_2 containing the generated encrypted data ENCRY_D_2.

[0244] Subsequently, the encryption means 14A generates a tag TAG_2 that does not contain 5QI, places the generated tag TAG_2 at the beginning of packet PKT_ENCRY_2 to generate packet PKT_2=[TAG_2 / PKT_ENCRY_2], and outputs the generated packet PKT_2=[TAG_2 / PKT_ENCRY_2] to the wireless unit 12B.

[0245] Furthermore, when the encryption means 14A receives the session establishment signal SG_1 from the session establishment means 13B, it recognizes that legacy session Sn_1 has been established.

[0246] After recognizing that legacy session Sn_1 has been established, encryption means 14A receives data D and identification code IDS from the application (not shown) and determines that it has received communication characteristic data D_1 from the application (not shown). Encryption means 14A then encrypts the communication characteristic data D_1 with the encryption key ENCRY_KT_1 to generate encrypted data ENCRY_D_1, and generates packet PKT_ENCRY_1 containing the generated encrypted data ENCRY_D_1. Subsequently, encryption means 14A outputs packet PKT_ENCRY_1 to wireless unit 12B.

[0247] Furthermore, when the encryption means 14A receives the session establishment signal SG_2 from the session establishment means 13B, it recognizes that a secure session Sn_2 has been established.

[0248] After the encryption means 14A recognizes that a secure session Sn_2 has been established, and receives only data D from the application (not shown), it determines that it has received confidential data D_2 from the application (not shown). The encryption means 14A then encrypts the confidential data D_2 with the encryption key ENCRY_KT_2 to generate encrypted data ENCRY_D_2, and generates a packet PKT_ENCRY_2 containing the generated encrypted data ENCRY_D_2. Subsequently, the encryption means 14A outputs the packet PKT_ENCRY_2 to the wireless unit 12B.

[0249] When the decryption means 15A receives the session establishment signal SG_3 from the session establishment means 13B, it recognizes that legacy session Sn_1 and secure session Sn_2 have been established simultaneously.

[0250] Then, when the decryption means 15A receives packet PKT_1=[TAG_1 / PKT_ENCRY_1] from the wireless unit 12B, it determines that communication characteristic data D_2 is included in packet PKT_ENCRY_1 based on the "5QI" contained in the tag TAG_1 of packet PKT_1=[TAG_1 / PKT_ENCRY_1], and uses the decryption key DECRY_KY_1 to decrypt the encrypted data ENCRY_D_1 in packet PKT_ENCRY_1, and outputs the decrypted communication characteristic data D_1 to the application (not shown).

[0251] On the other hand, when the decryption means 15A receives packet PKT_2=[TAG_2 / PKT_ENCRY_2] from the wireless unit 12B, it determines that confidentiality data D_2 is included in packet PKT_ENCRY_2 based on the fact that the tag TAG_2 of packet PKT_2=[TAG_2 / PKT_ENCRY_2] does not contain "5QI". It then uses the decryption key DECRY_KY_2 to decrypt the encrypted data ENCRY_D_2 in packet PKT_ENCRY_2 and outputs the decrypted confidentiality data D_2 to the application (not shown).

[0252] Furthermore, when the decoding means 15A receives the session establishment signal SG_1 from the session establishment means 13B, it recognizes that legacy session Sn_1 has been established.

[0253] When the decryption means 15A receives packet PKT_ENCRY_1 from the wireless unit 12B, it uses the decryption key DECRY_KY_1 to decrypt the encrypted data ENCRY_D_1 within packet PKT_ENCRY_1 and outputs the decrypted communication characteristic data D_1 to the application (not shown).

[0254] On the other hand, when the decryption means 15A receives the session establishment signal SG_2 from the session establishment means 13B, it recognizes that a secure session Sn_2 has been established.

[0255] Then, when the decryption means 15A receives packet PKT_ENCRY_2 from the wireless unit 12B, it decrypts the encrypted data ENCRY_D_2 in packet PKT_ENCRY_2 using the decryption key DECRY_KY_2, and outputs the decrypted confidentiality data D_2 to the application (not shown).

[0256] Figure 18 shows the security mode setting procedure in Embodiment 3. The security mode setting procedure shown in Figure 18 is a procedure using MR-DC to simultaneously set sessions for different wireless base stations using a terminal device UE.

[0257] Referring to Figure 18, when the security mode setting procedure in Embodiment 3 is initiated, the AMF of the core network 3 starts tamper prevention as 1a. Then, the AMF of the core network 3 sends a NAS Security Mode Command to the terminal device UE (terminal device 1B) as 1b. After that, the AMF of the core network 3 starts upstream encryption as 1c.

[0258] In the terminal device UE (terminal device 1B), the wireless unit 12B receives a NAS Security Mode Command via the antenna 11 and outputs the received NAS Security Mode Command to the session establishment means 13B.

[0259] In response to the NAS Security Mode Command received from the wireless unit 12B, the session establishment means 13B, as 2a., if it passes the NAS SMC tampering check, starts upstream encryption and downstream encryption / tamper prevention.

[0260] Then, the session establishment means 13B outputs a NAS Security Mode Complete message to the wireless unit 12B as 2b., indicating that upstream encryption and downstream encryption / tamper prevention have been initiated. The wireless unit 12B then transmits the NAS Security Mode Complete message received from the session establishment means 13B to the AMF of the core network 3 via the antenna 11.

[0261] When the AMF on core network 3 receives "NAS Security Mode Complete" from terminal device UE (terminal device 1B), it starts downstream encryption as step 1d.

[0262] Subsequently, the session establishment means 13B of the terminal device UE (terminal device 1B) generates a session addition setting request (= request to set up an additional session) as 2c., which includes a "list of algorithms and parameters LS related to encryption and tamper prevention", outputs the generated session addition setting request (= request to set up an additional session) to the wireless unit 12B, and transmits the session addition setting request (= request to set up an additional session) to the AMF of the core network 3 via the wireless unit 12B.

[0263] When the AMF of the core network 3 receives a session addition setup request (= a request to set up a session additionally) from the terminal device UE (terminal device 1B), as 1e., it starts preventing session tampering.

[0264] Then, as 1f., the AMF of the core network 3 transmits a NAS Security Mode Command to the terminal device UE (terminal device 1B). After that, as 1g., the AMF of the core network 3 starts upstream encryption of session 2.

[0265] When the radio unit 12B of the terminal device UE (terminal device 1B) receives a NAS Security Mode Command via the antenna 11, it outputs the received NAS Security Mode Command to the session establishment means 13B.

[0266] In response to the NAS Security Mode Command from the radio unit 12B, as 2d., if the session establishment means 13B passes the NAS SMC tampering inspection, it starts upstream encryption and downstream encryption and tampering prevention.

[0267] Then, as 2e., the session establishment means 13B outputs a NAS Security Mode Complete that answers that it has started upstream encryption and downstream encryption and tampering prevention to the radio unit 12B, and transmits the NAS Security Mode Complete to the AMF of the core network 3 via the radio unit 12B.

[0268] When the AMF of the core network 3 receives a NAS Security Mode Complete from the terminal device UE (terminal device 1B), as 1h., it starts downstream encryption of session 2.

[0269] Thus, the security mode setting procedure in Embodiment 3 is completed.

[0270] Figure 19 is a schematic diagram illustrating the establishment of a session using MR-DC. Referring to Figure 19(a), in the conventional use of MR-DC, two sessions are set up for communication: Session 1 using the 1.5GHz frequency band of 4G / LTE and Session 2 using the 4.5GHz frequency band of 5G. Session 1 is established between the terminal device UE and the master node MN, and Session 2 is established between the terminal device UE and the slave node SN.

[0271] Referring to Figure 19(b), in Embodiment 3, two sessions are set up in the terminal device UE, Session 1, which uses the 28GHz frequency band of 5G, and Session 2, which also uses the 28GHz frequency band of 5G, to perform communication. Sessions 1 and 2 are established between the terminal device UE and the master node MN.

[0272] In the security mode configuration procedure shown in Figure 18, when configuration procedure PRCD_1 is completed, one session (e.g., secure session Sn_2) is established between the terminal device UE and the master node MN, and when configuration procedure PRCD_2 is completed, another session (e.g., legacy session Sn_1) is established between the terminal device UE and the master node MN.

[0273] Therefore, by performing the security mode setting procedure shown in Figure 18, two sessions (legacy session Sn_1 and secure session Sn_2) are simultaneously established between the terminal device UE and the master node MN.

[0274] If two sessions (legacy session Sn_1 and secure session Sn_2) are established simultaneously according to the security mode setting procedure shown in Figure 18, data D (consisting of communication characteristic data D_1 or confidentiality data D_2) must be distributed to either legacy session Sn_1 or secure session Sn_2.

[0275] This document describes how to distribute data D (consisting of either communication-specific data D_1 or confidential data D_2) to either legacy session Sn_1 or secure session Sn_2.

[0276] Figure 20 is a diagram illustrating QoS Flow ID (5QI) in 5G.

[0277] Referring to Figure 20(a), an IP packet, which is an Internet (IP: Internet Protocol) packet sent from a server, includes an IP header and a payload. The payload includes IP data.

[0278] The 5G core network transmits IP packets to terminal devices (UEs) using a protocol called SDAP (Service Data Adaptation Protocol). In this case, the UPF (Urban Processing Unit) of the 5G core network adds a header (SDAP Header) to the beginning of the IP packet to create a data packet within the 5G core network. The payload of this data packet consists of IP packets.

[0279] When UPF adds an SDAP Header, it sets a 6-bit identifier (5G QoS Flow ID (5QI)) in the SDAP Header that specifies how Quality of Service (QoS) will be handled in the 5G core network, depending on the type of data being transmitted.

[0280] Figure 20(b) shows the correspondence between a flow (a collection of packets), a QoS request, and a 5QI value. Referring to Figure 20(b), data with a QoS request of "low latency" is associated with Flow_1, data with a QoS request of "high bandwidth" is associated with Flow_2, and data with a QoS request of "confidentiality" is associated with Flow_3.

[0281] Furthermore, a value of "1" in 5QI corresponds to data where the QoS request is "low latency," a value of "2" in 5QI corresponds to data where the QoS request is "high bandwidth," and a value of "3" in 5QI corresponds to data where the QoS request is "confidentiality."

[0282] Therefore, UPF creates data packets in the 5G core network by setting a 6-bit 5QI consisting of "1", "2", or "3" in the SDAP Header in response to QoS requests for the data contained in the IP packet payload.

[0283] Figure 21 is a schematic diagram showing the packet flow from the server to the terminal device UE. Referring to Figure 21, when the UPF of the 5G core network receives a set of packets from the server, it identifies the flow based on the characteristics of the packets, and based on the identification result it generates Flow_1 with 5QI=1 set in the SDAP Header, Flow_2 with 5QI=2 set in the SDAP Header, and Flow_3 with 5QI=3 set in the SDAP Header, and transmits the generated flows Flow_1, Flow_2, and Flow_3 to the 5G wireless access network via the communication line.

[0284] The SDAP of the 5G wireless access network receives flows Flow_1, Flow_2, and Flow_3 from the UPF of the 5G core network via the communication line, and transmits the received flows Flow_1, Flow_2, and Flow_3 to the terminal device UE via wireless communication.

[0285] Thus, in 5G, the standard specification defines a mechanism for setting identification information (QoS Flow ID (5QI)) in the SDAP Header to identify flows (sets of packets) in response to data QoS requests.

[0286] Therefore, in Embodiment 3, the mechanism of "setting the identification information (QoS Flow ID (5QI)) for identifying a flow (a set of packets) according to the QoS requirements of data in the SDAP Header", which is defined in the 5G standard specification, is used to set 5QI = 2 for the communication characteristic type data D_1 and set 5QI = 3 for the confidentiality data D_2.

[0287] FIG. 22 is a diagram for explaining a method of distributing the data D to the legacy session Sn_1 or the secure session Sn_2.

[0288] Referring to (a) of FIG. 22, when the encryption means 14A determines that it has received the communication characteristic type data D_1 from an application (not shown) based on the data D and the identification symbol IDS, the encryption means 14A encrypts the communication characteristic type data D_1 using the encryption key ENCRY_KY_1 to generate encrypted data ENCRY_D_1, and generates a packet PKT_ENCRY_1 including the generated encrypted data ENCRY_D_1.

[0289] The encryption means 14A holds the "correspondence relationship between the flow, the QoS requirement, and the 5QI" shown in FIG. 21. When generating the packet PKT_ENCRY_1, the encryption means 14A uses the mechanism of "setting the identification information (QoS Flow ID (5QI)) for identifying a flow (a set of packets) according to the QoS requirements of data in the SDAP Header", which is defined in the 5G standard specification, to generate a tag TAG_1 including 5QI = 2.

[0290] Thereafter, the encryption means 14A generates a packet PKT_1 by arranging the tag TAG_1 at the head of the packet PKT_ENCRY_1.

[0291] Referring to Figure 22(b), when the encryption means 14A receives data D from an application (not shown) without receiving an identification symbol IDS, it determines that it has received confidential data D_2 from the application (not shown), encrypts the confidential data D_2 using the encryption key ENCRY_KY_2 to generate encrypted data ENCRY_D_2, and generates a packet PKT_ENCRY_2 containing the generated encrypted data ENCRY_D_2.

[0292] Then, encryption method 14A uses the "mechanism to set identification information (QoS Flow ID (5QI)) that identifies a flow (a collection of packets) in response to a QoS request for data, as defined in the 5G standard specification" to set a value (=3) different from the 5QI value (=2) set for communication characteristic data D_1 to 5QI, and generates a tag TAG_2 that includes 5QI=3.

[0293] Subsequently, the encryption means 14A generates packet PKT_2 with the tag TAG_2 placed at the beginning of packet PKT_ENCRY_2.

[0294] Referring to Figure 22(c), the routing table RT contains flows and sessions. Flows and sessions are associated with each other. A flow consists of an LS flow indicating that it is a flow that preferentially uses legacy session Sn_1. A session consists of legacy session Sn_1. The wireless unit 12B then holds the routing table RT.

[0295] Referring to Figure 22(d), when the wireless unit 12B receives packet PKT_1 from the encryption means 14A, it detects that the tag TAG_1 of packet PKT_1 contains "5QI=2" and determines that packet PKT_1 is a packet in the flow LS flow. Then, the wireless unit 12B refers to the routing table RT and distributes packet PKT_1 to legacy session Sn_1.

[0296] Meanwhile, when wireless unit 12B receives packet PKT_2 from encryption means 14A, it detects that the tag TAG_2 of packet PKT_2 contains "5QI=3" and determines that packet PKT_2 is not a packet in flow LS flow. Then, wireless unit 12B refers to routing table RT and, based on the fact that no flows other than flow LS flow are set in routing table RT, determines that packet PKT_2 is a packet in a flow that uses secure session Sn_2, and distributes packet PKT_2 to secure session Sn_2.

[0297] Furthermore, routing table RT is also configured in the UPF of core network 3. As a result, the UPF refers to routing table RT and, when the destination sends packet PKT_1 to terminal device 1B, it routes packet PKT_1, which includes tag TAG_1 with "5QI=2" set, to legacy session Sn_1. When the destination sends packet PKT_2 to terminal device 1B, it routes packet PKT_2, which includes tag TAG_2 with "5QI=3" set, to secure session Sn_2.

[0298] The handover mechanism within the cell of base station 2 will be explained. The AMF of core network 3 determines whether or not the MR-DC can be used between terminal device UE (terminal device 1B) and master node MN based on whether or not the MR-DC can be used in operation. In this case, if the MR-DC cannot be used in operation, the AMF determines that the MR-DC cannot be used between terminal device UE (terminal device 1B) and master node MN, and if the MR-DC can be used in operation, the AMF determines that the MR-DC can be used between terminal device UE (terminal device 1B) and master node MN.

[0299] Then, if AMF determines that MR-DC cannot be used between terminal device UE (terminal device 1B) and master node MN, it instructs SMF to disconnect the current session between terminal device UE (terminal device 1B) and master node MN (legacy session Sn_1 or secure session Sn_2) and switch the session between terminal device UE (terminal device 1B) and master node MN.

[0300] In response to instructions from AMF, SMF instructs UPF to disconnect the current session between terminal device UE (terminal device 1B) and master node MN (legacy session Sn_1 or secure session Sn_2) and switch the session between terminal device UE (terminal device 1B) and master node MN.

[0301] Then, UPF disconnects the current session between terminal device UE (terminal device 1B) and master node MN (legacy session Sn_1 or secure session Sn_2) and switches the session between terminal device UE (terminal device 1B) and master node MN.

[0302] As a result, if either legacy session Sn_1 or secure session Sn_2 is currently established between terminal device UE (terminal device 1B) and master node MN, the session will be switched to the other of legacy session Sn_1 and secure session Sn_2.

[0303] Thus, the reason for switching sessions using the handover mechanism within the cell of base station 2 (master node MN) is that, when MR-DC is unavailable, only one of either legacy session Sn_1 or secure session Sn_2 can be used at a time, and both legacy session Sn_1 and secure session Sn_2 cannot be used simultaneously.

[0304] Figure 23 is a flowchart illustrating the operation of terminal device 1B shown in Figure 17. Referring to Figure 23, when terminal device 1B starts operating, the session establishment means 13B of terminal device 1B establishes a secure session Sn_2 according to the setup procedure PRCD_1 in Figure 18 (step S21).

[0305] Then, the session establishment means 13B determines whether it is necessary to use secure session Sn_2 and legacy session Sn_1 separately (step S22). In this case, the session establishment means 13B determines that it is necessary to use secure session Sn_2 and legacy session Sn_1 separately when 5G is available, and determines that it is not necessary to use secure session Sn_2 and legacy session Sn_1 separately when 5G is not available.

[0306] In step S22, if it is determined that it is necessary to use both secure session Sn_2 and legacy session Sn_1, the session establishment means 13B determines whether or not MR-DC can be used between terminal device UE (terminal device 1B) and master node MN (step S23). In this case, if MR-DC can be used in operation, the session establishment means 13B determines that MR-DC can be used between terminal device UE (terminal device 1B) and master node MN, and if MR-DC cannot be used in operation, it determines that MR-DC cannot be used between terminal device UE (terminal device 1B) and master node MN.

[0307] In step S23, when it is determined that the MR-DC is available between the terminal device UE (terminal device 1B) and the master node MN, the session establishment means 13B establishes legacy session Sn_1 using the MR-DC according to the setup procedure PRCD_2 in Figure 18 (step S24).

[0308] Then, the encryption means 14A sets the 5G QoS Flow ID (5QI=2) for the flow LS flow that preferentially uses legacy session Sn_1, and sets the 5G QoS Flow ID (5QI=3) for the flow that uses secure session Sn_2, using the method described in Figure 22 (that is, using the mechanism defined in the 5G standard specification to set identification information (QoS Flow ID (5QI)) that identifies a flow (a collection of packets) in response to a data QoS request) in the SDAP Header (step S25).

[0309] Furthermore, the session establishment means 13B sets the routing table RT in the wireless unit 12B to forward the flow LS flow to legacy session Sn_1 (step S26).

[0310] Then, the terminal device UE (terminal device 1B) sends and receives data D (communication-specific data D_1 and confidentiality data D_2) to and from the destination using legacy session Sn_1 and secure session Sn_2 (step S27).

[0311] On the other hand, in step S23, if it is determined that MR-DC cannot be used between terminal device UE (terminal device 1B) and master node MN, terminal device UE (terminal device 1B) uses the handover mechanism within the cell of base station 2 (master node MN) to switch the session according to the RRC Connection re-establishment procedure and send and receive data D (communication characteristic data D_1 or confidential data D_2) with the destination (step S28).

[0312] Then, in step S22, if it is determined that there is no need to differentiate between secure session Sn_2 and legacy session Sn_1, or after either step S27 or S28, the operation of terminal device 1B ends.

[0313] In step S23, determining that MR-DC cannot be used between terminal device UE (terminal device 1B) and master node MN is equivalent to determining that two sessions (legacy session Sn_1 and secure session Sn_2) cannot be used simultaneously between terminal device UE (terminal device 1B) and master node MN.

[0314] Furthermore, the inability to use two sessions simultaneously (legacy session Sn_1 and secure session Sn_2) between terminal device UE (terminal device 1B) and master node MN includes hot standby.

[0315] Here, hot standby is a method of improving reliability by making equipment and systems redundant, in which multiple systems are kept running at all times, and if a failure occurs in one system, processing is immediately taken over by another system. Therefore, in step S28, legacy session Sn_1 and secure session Sn_2 may be kept ready at all times, and if either legacy session Sn_1 or secure session Sn_2 becomes unavailable, the system may immediately switch to the other session.

[0316] Figure 24 is a flowchart illustrating the detailed operation of step S21 in Figure 23.

[0317] Referring to Figure 24, after the “start” in Figure 23, the session establishment means 13B of the terminal device 1B receives the NAS Security Mode Command from the AMF of the core network 3 via the antenna 11 and the wireless unit 12B (step S211).

[0318] Then, if the session establishment means 13B passes the NAS SMC tampering check, it starts upstream encryption and downstream encryption / tamper prevention (step S212).

[0319] Subsequently, the session establishment means 13B sends "NAS Security Mode Complete" to the AMF of the core network 3 (step S213). After step S213, the operation of the terminal device 1B proceeds to step S22 in Figure 23.

[0320] Figure 25 is a flowchart illustrating the detailed operation of step S24 in Figure 23.

[0321] The flowchart shown in Figure 25 is the same as the flowchart in Figure 24, with the addition of step S210; otherwise, it is identical to the flowchart in Figure 24.

[0322] Referring to Figure 25, in step S23 of Figure 23, when it is determined that MR-DC is available between terminal device UE (terminal device 1B) and master node MN, session establishment means 13B sends a request to the AMF of core network 3 via wireless unit 12B and antenna 11 to set up an additional session (step S210).

[0323] Then, after step S210, steps S211 to S213 described above are executed sequentially. After step S213, the operation of terminal device 1B proceeds to step S25 in Figure 23.

[0324] Figure 26 is a flowchart illustrating the detailed operation of step S27 in Figure 23.

[0325] Referring to Figure 26, after step S26 in Figure 23, the encryption means 14A determines whether or not it has received data D from the application (not shown) (step S271).

[0326] In step S271, when it is determined that data D has been received, the encryption means 14A determines whether or not it has received communication characteristic data D_1 and confidentiality data D_2 (step S272).

[0327] In step S272, when it is determined that communication characteristic data D_1 and confidentiality data D_2 have been received, the wireless unit 13B, encryption means 14A, and decryption means 15A send and receive encrypted data ENCRY_D_1 and ENCRY_D_2, which are obtained by encrypting communication characteristic data D_1 and confidentiality data D_2 respectively, to and from the destination using legacy session Sn_1 and secure session Sn_2, respectively (step S273).

[0328] On the other hand, if it is determined in step S272 that communication characteristic data D_1 and confidentiality data D_2 were not received, the encryption means 14A determines whether or not it received communication characteristic data D_1 (step S274).

[0329] In step S274, when it is determined that communication characteristic data D_1 has been received, the wireless unit 13B, encryption means 14A, and decryption means 15A send and receive encrypted data ENCRY_D_1, which is the communication characteristic data D_1 encrypted, with the destination using legacy session Sn_1 (step S275).

[0330] In step S274, if it is determined that communication characteristic data D_1 was not received (i.e., if confidentiality data D_2 was received), the wireless unit 13B, encryption means 14A, and decryption means 15A send and receive encrypted data ENCRY_D_2, which is the confidentiality data D_2 encrypted, with the destination using secure session Sn_2 (step S276).

[0331] Furthermore, in step S274, when it is determined that communication characteristic data D_1 was not received, it is determined that confidentiality data D_2 was received because, in this embodiment of the invention, data D consists of communication characteristic data D_1 and confidentiality data D_2, and since step S274 is executed after it is determined in step S271 that data D has been received, determining that communication characteristic data D_1 was not received in step S274 is equivalent to determining that confidentiality data D_2 was received.

[0332] Then, if it is determined in step S271 that data D was not received, or after any of steps S273, S275, or S276, the operation of terminal device 1B proceeds to “termination” as shown in Figure 23.

[0333] Figure 27 is a flowchart illustrating the detailed operation of step S273 in Figure 26.

[0334] Referring to Figure 27, when it is determined in step S272 of Figure 26 that communication characteristic data D_1 and confidentiality data D_2 have been received, the encryption means 14A encrypts the communication characteristic data D_1 using the encryption key ENCRY_KY_1 to generate encrypted data ENCRY_D_1, and encrypts the confidentiality data D_2 using the encryption key ENCRY_KY_2 to generate encrypted data ENCRY_D_2 (step S273-1).

[0335] Then, the encryption means 14A generates a packet PKT_ENCRY_1 containing encrypted data ENCRY_D_1 and a packet PKT_ENCRY_2 containing encrypted data ENCRY_D_2 (step S273-2).

[0336] Subsequently, the encryption method 14A uses the "mechanism for setting identification information (QoS Flow ID (5QI)) that identifies a flow (a collection of packets) in response to a QoS request for data in the SDAP Header" defined in the 5G standard specifications to generate tag TAG_1 containing 5QI=2 and tag TAG_2 containing 5QI=3 (step S273-3).

[0337] Subsequently, the encryption means 14A generates packet PKT_1 with tag TAG_1 placed at the beginning of packet PKT_ENCRY_1, and packet PKT_2 with tag TAG_2 placed at the beginning of packet PKT_ENCRY_2 (step S273-4).

[0338] Then, the encryption means 14A outputs packets PKT_1 and PKT_2 to the wireless unit 12B.

[0339] The wireless unit 12B receives packets PKT_1 and PKT_2 from the encryption means 14A. Then, referring to the routing table RT, the wireless unit 12B forwards packet PKT_1 to legacy session Sn_1 based on the fact that the tag TAG_1 of packet PKT_1 contains 5QI=2, and forwards packet PKT_2 to secure session Sn_2 based on the fact that the tag TAG_2 of packet PKT_2 contains 5QI=3, and sends packets PKT_1 and PKT_2 to their destinations (step S273-5).

[0340] Subsequently, the wireless unit 12B receives packet PKT_1 from the destination using legacy session Sn_1 and packet PKT_2 from the destination using secure session Sn_2 (step S273-6). Then, the wireless unit 12B outputs the received packets PKT_1 and PKT_2 to the decoding means 15A.

[0341] The decryption means 15A receives packets PKT_1 and PKT_2 from the wireless unit 12B. The decryption means 15A then decrypts the encrypted data ENCRY_D_1 contained in packet PKT_1 using the decryption key DECRY_KY_1, and decrypts the encrypted data ENCRY_D_2 contained in packet PKT_2 using the decryption key DECRY_KY_2, and outputs the communication characteristic data D_1 and confidentiality data D_2 to the application (not shown) (step S273-7). After that, the operation of the terminal device 1B proceeds to "Termination" as shown in Figure 23.

[0342] Thus, in step S272 of Figure 26, when it is determined that communication characteristic data D_1 and confidentiality data D_2 have been received, terminal device 1B encrypts the communication characteristic data D_1 and confidentiality data D_2 using the encryption keys ENCRY_KY_1 and ENCRY_KY_2, respectively, to obtain encrypted data ENCRY_D_1 and ENCRY_D_2, which are then forwarded to legacy session Sn_1 and secure session Sn_2, respectively, and sent to the destination. At the same time, it receives the encrypted data ENCRY_D_1 and ENCRY_D_2 from the destination using legacy session Sn_1 and secure session Sn_2, respectively, and decrypts the received encrypted data ENCRY_D_1 and ENCRY_D_2 using the decryption keys DECRY_KY_1 and DECRY_KY_2, respectively, and outputs the communication characteristic data D_1 and confidentiality data D_2 to the application (not shown).

[0343] In other words, terminal device 1B uses both legacy session Sn_1 and secure session Sn_2 to send and receive communication characteristic data D_1 and confidentiality data D_2 with the destination, respectively.

[0344] In this case, terminal device 1B may use legacy session Sn_1 and secure session Sn_2 simultaneously. In this embodiment of the invention, "simultaneous use" means that the period during which communication characteristic data D_1 is transmitted or received using legacy session Sn_1 overlaps, at least partially, with the period during which confidentiality data D_2 is transmitted or received using secure session Sn_2.

[0345] Figure 28 is a flowchart illustrating the detailed operation of step S275 in Figure 26.

[0346] Referring to Figure 28, when it is determined in step S274 of Figure 26 that communication characteristic data D_1 has been received, the encryption means 14A encrypts the communication characteristic data D_1 using the encryption key ENCRY_KY_1 to generate encrypted data ENCRY_D_1 (step S275-1).

[0347] Then, the encryption means 14A generates a packet PKT_ENCRY_1 containing encrypted data ENCRY_D_1 (step S275-2).

[0348] Subsequently, the encryption method 14A generates a tag TAG_1 containing 5QI=2 using the "mechanism for setting identification information (QoS Flow ID (5QI)) that identifies a flow (a collection of packets) in response to a QoS request for data in the SDAP Header" as defined in the 5G standard specifications (step S275-3).

[0349] Subsequently, the encryption means 14A generates packet PKT_1 with the tag TAG_1 placed at the beginning of packet PKT_ENCRY_1 (step S275-4).

[0350] Then, the encryption means 14A outputs packet PKT_1 to the wireless unit 12B.

[0351] The wireless unit 12B receives packet PKT_1 from the encryption means 14A. Then, the wireless unit 12B refers to the routing table RT and, based on the fact that the tag TAG_1 of packet PKT_1 contains 5QI=2, forwards packet PKT_1 to legacy session Sn_1 and sends packet PKT_1 to the destination (step S275-5).

[0352] Subsequently, the wireless unit 12B receives packet PKT_1 from the destination using legacy session Sn_1 (step S275-6). Then, the wireless unit 12B outputs the received packet PKT_1 to the decoding means 15A.

[0353] The decryption means 15A receives packet PKT_1 from the wireless unit 12B. The decryption means 15A then decrypts the encrypted data ENCRY_D_1 contained in packet PKT_1 using the decryption key DECRY_KY_1 and outputs the communication characteristic data D_1 to the application (not shown) (step S275-7). After that, the operation of the terminal device 1B proceeds to “Termination” in Figure 23.

[0354] Thus, in step S274 of Figure 26, when it is determined that communication characteristic data D_1 has been received, terminal device 1B encrypts the communication characteristic data D_1 using the encryption key ENCRY_KY_1 to obtain encrypted data ENCRY_D_1, which is then transferred to legacy session Sn_1 and sent to the destination. At the same time, it receives encrypted data ENCRY_D_1 from the destination using legacy session Sn_1, decrypts the received encrypted data ENCRY_D_1 using the decryption key DECRY_KY_1, and outputs the communication characteristic data D_1 to the application (not shown).

[0355] Figure 29 is a flowchart illustrating the detailed operation of step S276 in Figure 26.

[0356] Referring to Figure 29, in step S274 of Figure 26, if it is determined that communication characteristic data D_1 was not received (i.e., if confidentiality data D_2 was received), the encryption means 14A encrypts the confidentiality data D_2 using the encryption key ENCRY_KY_2 to generate encrypted data ENCRY_D_2 (step S276-1).

[0357] Then, the encryption means 14A generates a packet PKT_ENCRY_2 containing encrypted data ENCRY_D_2 (step S276-2).

[0358] Subsequently, the encryption method 14A generates a tag TAG_2 containing 5QI=3 using the "mechanism for setting identification information (QoS Flow ID (5QI)) that identifies a flow (a collection of packets) in response to a QoS request for data in the SDAP Header" as defined in the 5G standard specifications (step S276-3).

[0359] Subsequently, the encryption means 14A generates a packet PKT_2 with the tag TAG_2 placed at the beginning of the packet PKT_ENCRY_2 (step S276-4).

[0360] Then, the encryption means 14A outputs packet PKT_2 to the wireless unit 12B.

[0361] The wireless unit 12B receives packet PKT_2 from the encryption means 14A. Then, the wireless unit 12B refers to the routing table RT and, based on the fact that the tag TAG_2 of packet PKT_2 contains 5QI=3, forwards packet PKT_2 to secure session Sn_2 and sends packet PKT_2 to the destination (step S276-5).

[0362] Subsequently, the wireless unit 12B receives packet PKT_2 from the destination using secure session Sn_2 (step S276-6). Then, the wireless unit 12B outputs the received packet PKT_2 to the decryption means 15A.

[0363] The decryption means 15A receives packet PKT_2 from the wireless unit 12B. The decryption means 15A then decrypts the encrypted data ENCRY_D_2 contained in packet PKT_2 using the decryption key DECRY_KY_2 and outputs the confidentiality data D_2 to the application (not shown) (step S276-7). After that, the operation of the terminal device 1B proceeds to “Termination” in Figure 23.

[0364] Thus, in step S274 of Figure 26, when it is determined that confidential data D_2 has been received, terminal device 1B encrypts the confidential data D_2 using the encryption key ENCRY_KY_2 to obtain encrypted data ENCRY_D_2, transfers it to secure session Sn_2, and sends it to the destination. At the same time, it receives encrypted data ENCRY_D_2 from the destination using secure session Sn_2, decrypts the received encrypted data ENCRY_D_2 using the decryption key DECRY_KY_2, and outputs the confidential data D_2 to the application (not shown).

[0365] Figure 30 is a flowchart illustrating the detailed operation of step S28 in Figure 23.

[0366] Referring to Figure 30, in step S23 of Figure 23, if it is determined that MR-DC is unavailable between terminal device UE (terminal device 1B) and master node MN, the encryption means 14A determines whether or not it has received data D from the application (not shown) (step S281).

[0367] In step S281, when it is determined that data D has been received from the application (not shown), the encryption means 14A determines whether or not it has received confidential data D_2 (step S282).

[0368] In this case, the encryption means 14A determines that it has received confidentiality data D_2 when it has not received the identification code IDS, and determines that it has not received confidentiality data D_2 when it has received the identification code IDS. The reason why it is determined that it has not received confidentiality data D_2 when it has received the identification code IDS is that the identification code IDS is output from the application (not shown) to the encryption means 14A together with the communication characteristic data D_1, and therefore the data D when the identification code IDS is received is the communication characteristic data D_1.

[0369] Furthermore, determining in step S282 that confidentiality data D_2 was not received is equivalent to determining that communication characteristic data D_1 was received. This is because step S282 is executed when it is determined in step S281 that data D has been received, and since data D from the application (not shown) consists of either communication characteristic data D_1 or confidentiality data D_2, when it is determined in step S282 that confidentiality data D_2 was not received, the data D received in step S281 is communication characteristic data D_1.

[0370] In step S282, when it is determined that confidential data D_2 has been received, the encryption means 14A encrypts the confidential data D_2 using the encryption key ENCRY_KY_2 to generate encrypted data ENCRY_D_2, generates a packet PKT_ENCRY_2 containing the encrypted data ENCRY_D_2 and outputs it to the wireless unit 12B, and the wireless unit 12B uses the secure session Sn_2 to send the packet PKT_ENCRY_2 received from the encryption means 14A to the destination (step S283).

[0371] Subsequently, the wireless unit 12B receives packet PKT_ENCRY_2 from the destination (step S284) and outputs the received packet PKT_ENCRY_2 to the decoding means 15A.

[0372] The decryption means 15A decrypts the encrypted data ENCRY_D_2 contained in the packet PKT_ENCRY_2 received from the wireless unit 12B using the decryption key DECRY_KY_2, and outputs the confidentiality data D_2 to the application (not shown) (step S285).

[0373] Then, the session establishment means 13B calculates the percentage of CFDR for applications requiring confidentiality using the method described above (step S286).

[0374] Then, the session establishment means 13B determines whether or not it has received communication characteristic data D_1 from the application (not shown) (step S287).

[0375] In this case, the session establishment means 13B determines that it has received communication characteristic data D_1 when it receives data D from the application (not shown) along with the identification code IDS, and determines that it has not received communication characteristic data D_1 when it receives data D from the application (not shown) without receiving the identification code IDS.

[0376] In step S287, when it is determined that communication characteristic data D_1 has been received, the session establishment means 13B determines whether the percentage of applications requiring confidentiality (CFDR) falls below the threshold PL (step S288).

[0377] In step S288, if it is determined that the percentage of applications requiring confidentiality (CFDR) falls below the threshold PL, the operation of terminal device 1B proceeds to step S291.

[0378] On the other hand, if it is determined in step S287 that communication characteristic data D_1 was not received, or if it is determined in step S288 that the percentage of applications requiring confidentiality (CFDR) does not fall below the threshold PL, the operation of terminal device 1B proceeds to step S281.

[0379] On the other hand, if it is determined in step S282 that confidentiality data D_2 was not received (i.e., that communication characteristic data D_1 was received), the session establishment means 13B calculates the percentage of applications requiring confidentiality (CFDR) using the method described above (step S289).

[0380] Subsequently, the session establishment means 13B determines whether the proportion of CFDRs used for purposes requiring confidentiality falls below the threshold PL (step S290).

[0381] Then, in step S288, when it is determined that the percentage of applications requiring confidentiality (CFDR) falls below the threshold PL, or in step S290, when it is determined that the percentage of applications requiring confidentiality (CFDR) falls below the threshold PL, the session establishment means 13B transmits a session switching request SW_1 to the AMF of the core network 3 via the wireless unit 12B and antenna 11. When the AMF of the core network 3 receives the session switching request SW_1, it instructs the SMF to disconnect the current secure session Sn_2 between the terminal device UE (terminal device 1B) and the master node MN, and to switch the session between the terminal device UE (terminal device 1B) and the master node MN.

[0382] In response to instructions from AMF, SMF instructs UPF to disconnect the current secure session Sn_2 between terminal device UE (terminal device 1B) and master node MN, and to switch the session between terminal device UE (terminal device 1B) and master node MN.

[0383] Then, UPF disconnects the current secure session Sn_2 between terminal device UE (terminal device 1B) and master node MN, and switches the session between terminal device UE (terminal device 1B) and master node MN from secure session Sn_2 to legacy session Sn_1.

[0384] As a result, the session establishment means 13B sends a session switching request SW_1 to the AMF of the core network 3, and the secure session Sn_2 is switched to legacy session Sn_1 by the cell handover mechanism (step S291).

[0385] The session establishment means 13B then generates a session establishment signal SG_1 and outputs it to the encryption means 14A and the decryption means 15A.

[0386] When the encryption means 14A receives a session establishment signal SG_1 from the session establishment means 13B, it detects that the session has switched to legacy session Sn_1. The encryption means 14A then encrypts the communication characteristic data D_1 using the encryption key ENCRY_KY_1 to generate encrypted data ENCRY_D_1, and outputs a packet PKT_ENCRY_1 containing the encrypted data ENCRY_D_1 to the wireless unit 12B. The wireless unit 12B then transmits the packet PKT_ENCRY_1 received from the encryption means 14A to the destination using legacy session Sn_1 (step S292).

[0387] Subsequently, the wireless unit 12B receives packet PKT_ENCRY_1 from the destination (step S293) and outputs the received packet PKT_ENCRY_1 to the decoding means 15A.

[0388] When the decoding means 15A receives the session establishment signal SG_1 from the session establishment means 13B, it detects that the session has switched to legacy session Sn_1.

[0389] Then, the decryption means 15A decrypts the encrypted data ENCRY_D_1 contained in the packet PKT_ENCRY_1 received from the wireless unit 12B using the decryption key DECRY_KY_1, and outputs the communication characteristic data D_1 to the application (not shown) (step S294).

[0390] Then, the session establishment means 13B calculates the percentage of CFDR for applications requiring confidentiality using the method described above (step S295).

[0391] Then, the session establishment means 13B determines whether or not it has received confidentiality data D_2 from the application (not shown) (step S296).

[0392] In step S296, when it is determined that confidentiality data D_2 has been received, the session establishment means 13B determines whether the percentage of applications requiring confidentiality (CFDR) exceeds the threshold PU (step S297).

[0393] In step S297, when it is determined that the percentage CFDR exceeds the threshold PU, the session establishment means 13B outputs a session switching request SW_2 to the AMF of the core network 3, thereby switching the legacy session Sn_1 to the secure session Sn_2 using the cell handover mechanism described above (step S298). After that, the operation of the terminal device 1B proceeds to step S283.

[0394] Then, in step S290, if it is determined that the percentage of applications requiring confidentiality (CFDR) did not fall below the threshold PL, or in step S296, if it is determined that confidentiality data D_2 was not received, or in step S297, if it is determined that the percentage of applications requiring confidentiality (CFDR) did not exceed the threshold PU, the operation of terminal device 1B proceeds to step S281.

[0395] Then, in step S281, if it is determined that data D was not received from the application (not shown), the operation of the terminal device 1B proceeds to “termination” as shown in Figure 23.

[0396] In the flowchart shown in Figure 30, when it is determined in step S282 that confidential data D_2 has been received, the confidential data D_2 is encrypted and sent and received with the destination using secure session Sn_2 (see steps S283 to S285).

[0397] Subsequently, in step S287, if it is determined that communication characteristic data D_1 has been received from the application (not shown), and in step S288, if it is determined that the CFDR (Censorship, Distance

[0398] Thus, when two conditions (= predetermined conditions) are met—that it is determined that communication characteristic data D_1 has been received from the application (not shown), and that the proportion of usage requiring confidentiality (CFDR) falls below the threshold PL—the secure session Sn_2 is switched to the legacy session Sn_1 because switching from the secure session Sn_2 to the legacy session Sn_1 requires that there is a request to send communication characteristic data D_1 from the application (not shown) (i.e., that communication characteristic data D_1 has been received from the application (not shown)), and that the proportion of usage requiring confidentiality (CFDR) falls below the threshold PL.

[0399] Furthermore, if the condition that communication characteristic data D_1 is received from the application (not shown) is not met, or if the percentage of applications requiring confidentiality (CFDR) does not fall below the threshold PL, the secure session Sn_2 cannot be switched to the legacy session Sn_1, and the operation of the terminal device 1B proceeds to step S281.

[0400] Furthermore, in the flowchart shown in Figure 30, in step S282, if it is determined that confidentiality data D_2 was not received (i.e., communication characteristic data D_1 was received), and the percentage of applications requiring confidentiality (CFDR) is determined to be below the threshold PL, then the secure session Sn_2 is switched to legacy session Sn_1 (see step S291). Subsequently, communication characteristic data D_1 is encrypted and sent and received with the destination using legacy session Sn_1 (see steps S292 to S294).

[0401] Subsequently, after step S295, in step S296, if it is determined that confidential data D_2 has been received from the application (not shown), and in step S297, if it is determined that the percentage of applications requiring confidentiality (CFDR) exceeds the threshold PU, then in step S298, the legacy session Sn_1 is switched to the secure session Sn_2 by the cell's handover mechanism.

[0402] Thus, when two conditions (= predetermined conditions) are met—that confidential data D_2 has been received from the application (not shown), and that the percentage of usage requiring confidentiality (CFDR) exceeds the threshold PU—the legacy session Sn_1 is switched to a secure session Sn_2 because switching from legacy session Sn_1 to secure session Sn_2 requires a request for transmission of confidential data D_2 from the application (not shown) (i.e., confidential data D_2 has been received from the application (not shown)) and that the percentage of usage requiring confidentiality (CFDR) exceeds the threshold PU.

[0403] Furthermore, if the condition that confidential data D_2 is received from the application (not shown) is not met, or if the percentage of applications requiring confidentiality (CFDR) does not exceed the threshold PU, the legacy session Sn_1 cannot be switched to a secure session Sn_2, and the operation of terminal device 1B proceeds to step S281.

[0404] As shown in the flowchart in Figure 30, in step S282, when confidential data D_2 is received from an application (not shown), the confidential data D_2 is encrypted with the encryption key ENCRY_KY_2 (an encryption key with a key length of 256 bits) and sent and received with the destination using secure session Sn_2 (see steps S283 to S285). When the conditions for switching secure session Sn_2 to legacy session Sn_1 are met (see "YES" in steps S287 and S288), the secure session Sn_2 is switched to legacy session Sn_1 by the handover mechanism within the cell (see step S291).

[0405] Then, when secure session Sn_2 is switched to legacy session Sn_1, the communication characteristic data D_1 is encrypted with the encryption key ENCRY_KY_1 (an encryption key with a key length of 128 bits) and sent and received with the destination using legacy session Sn_1 (see steps S292 to S294). When the conditions for switching legacy session Sn_1 to secure session Sn_2 are met (see "YES" in step S296 and "YES" in step S297), the cell's handover mechanism switches legacy session Sn_1 to secure session Sn_2 (see step S298).

[0406] Then, when the legacy session Sn_1 is switched to the secure session Sn_2, the operation of the terminal device 1B proceeds to step S283, where the confidential data D_2 is encrypted with the encryption key ENCRY_KY_2 (an encryption key with a key length of 256 bits) and sent and received with the destination using the secure session Sn_2 (see steps S283 to S285).

[0407] Therefore, in the flowchart shown in Figure 30, if it is determined in step S282 that confidential data D_2 has been received, confidential data D_2 is sent and received with the destination using secure session Sn_2 (see steps S283 to S285), and if the conditions for switching secure session Sn_2 to legacy session Sn_1 are met (see "YES" in step S287 and "YES" in step S288), secure session Sn_2 is switched to legacy session Sn_1 (see step S291), and legacy - Using session Sn_1, communication characteristic data D_1 is sent and received with the destination (see steps S292 to S294). If the conditions for switching legacy session Sn_1 to secure session Sn_2 are met (see "YES" in step S296 and "YES" in step S297), legacy session Sn_1 is switched to secure session Sn_2 (see step S298), and confidential data D_2 is sent and received with the destination using secure session Sn_2 (see steps S283 to S285).

[0408] Therefore, in the flowchart shown in Figure 30, as long as the conditions for switching secure session Sn_2 to legacy session Sn_1 are met (see “YES” in step S287 and “YES” in step S288), and the conditions for switching legacy session Sn_1 to secure session Sn_2 are met (see “YES” in step S296 and “YES” in step S297), the communication characteristic data D_1 or confidentiality data D_2 will continue to be sent and received between the destination and the session while switching between legacy session Sn_1 or secure session Sn_2 (see “YES” in steps S283-S287 and “YES” in Figure 28 → “YES” in steps S291-S296 and “YES” in S297 and S298 → “YES” in steps S283-S287 and “YES” in Figure 28).

[0409] Then, in step S281, if it is determined that data D was not received, the operation of terminal device 1B ends.

[0410] Figure 31 shows the time dependence of the percentage of CFDR used in applications requiring confidentiality. In Figure 31, the vertical axis represents the percentage of CFDR used in applications requiring confidentiality, and the horizontal axis represents time.

[0411] Referring to Figure 31, the proportion of CFDRs used in applications requiring confidentiality changes over time as shown by curve k1.

[0412] Furthermore, the proportion of CFDR applications requiring confidentiality exceeds the threshold PU in the hatched area, while falling below the threshold PL in the non-hatched area.

[0413] Therefore, in step S297 of Figure 30, if the percentage of applications requiring confidentiality (CFDR) enters the hatched area, it is determined that the percentage of applications requiring confidentiality (CFDR) exceeds the threshold PU. In steps S288 and S290 of Figure 30, if the percentage of applications requiring confidentiality (CFDR) enters the non-hatched area, it is determined that the percentage of applications requiring confidentiality (CFDR) falls below the threshold PL.

[0414] Then, when the percentage of applications requiring confidentiality (CFDR) is above the threshold PL and below the threshold PU, in steps S288 and S290 of Figure 30, it is determined that the percentage of applications requiring confidentiality (CFDR) does not fall below the threshold PL, and in step S297 of Figure 30, it is determined that the percentage of applications requiring confidentiality (CFDR) does not exceed the threshold PU. As a result, the session is not switched, but the operation of terminal device 1B proceeds to step S281, and in step S282, if it is determined that confidentiality data D_2 has been received, confidentiality data D_2 is sent and received with the destination (see steps S283 to S285).

[0415] The reason why the threshold values ​​PU and PL have hysteresis, such as PU > PL, is to suppress frequent session switching. For example, PL is 0.1 and PU is 0.3.

[0416] According to the flowchart shown in Figure 23 (including the flowcharts shown in Figures 24 to 30), a secure session Sn_2 is established first (see step S21 in Figure 23).

[0417] The secure session Sn_2 is established first for the following reason: In Embodiment 3, assuming that the master node MN and the slave node SN are the same, a second session (legacy session Sn_1) is established between the terminal device UE (terminal device 1B) and the master node MN using MR-DC.

[0418] On the other hand, the configuration procedure PRCD_1 in Figure 18 is a 3GPP standard specification, so regardless of whether MR-DC can be used or not, a session that satisfies security requirements (passing the NAS SMC tampering check) can be established by following the configuration procedure PRCD_1 in Figure 18. Therefore, the session established according to the configuration procedure PRCD_1 in Figure 18 is designated as the secure session Sn_2 used for transmitting confidential data D_2, where confidentiality is paramount, in order to guarantee the security of confidential data D_2.

[0419] Then, according to the flowchart shown in Figure 23 (including the flowcharts shown in Figures 24 to 30), first, after the secure session Sn_2 is established (i.e., after ensuring the security of confidential data D_2), if the MR-DC can be used (see "YES" in step S23 of Figure 23), two sessions (legacy session Sn_1 and secure session Sn_2) are established by establishing legacy session Sn_1 according to the setup procedure PRCD_2 in Figure 18, and communication characteristic data D_1 is used with the established legacy session Sn_1 and secure session Sn_2 respectively. The confidential data D_2 is sent and received with the destination (see steps S25 to S27 in Figure 23). If MR-DC is unavailable (see "NO" in step S23 in Figure 23), i.e., if legacy session Sn_1 and secure session Sn_2 cannot be established simultaneously, the communication characteristic data D_1 or confidential data D_2 is sent and received with the destination while switching the session to either legacy session Sn_1 or secure session Sn_2 using the handover mechanism within the cell of base station 2 (master node MN) (see step S28 in Figure 23 (flowchart shown in Figure 30)).

[0420] As a result, regardless of whether MR-DC can be used or not, communication-specific data D_1 and confidentiality data D_2 can be sent and received with the destination using legacy session Sn_1 and secure session Sn_2, respectively.

[0421] Therefore, depending on the application, the communication channel (legacy session Sn_1 or secure session Sn_2) can be used to transmit either communication-specific data D_1 or confidential data D_2, and confidential data D_2 can be appropriately protected without being over-specified for communication-specific data D_1.

[0422] Furthermore, according to the flowchart shown in Figure 23 (including the flowcharts shown in Figures 24 to 30), if MR-DC is available, legacy session Sn_1 and secure session Sn_2 are established simultaneously between terminal device 1B and base station 2 (master node MN). Therefore, for example, even if communication characteristic data D_1 and confidentiality data D_2 arrive simultaneously from an application (not shown), communication characteristic data D_1 and confidentiality data D_2 can be quickly transmitted using legacy session Sn_1 and secure session Sn_2, respectively (see step S273 in Figure 26 (= flowchart shown in Figure 27)).

[0423] On the other hand, if MR-DC is unavailable, the session is switched to legacy session Sn_1 or secure session Sn_2 depending on whether the communication characteristic data D_1 or confidential data D_2 is transmitted. Therefore, even if MR-DC cannot be used, both communication characteristic data D_1 and confidential data D_2 can be transmitted using a dedicated session.

[0424] In the above, it was explained that 5QI=2 is set for communication characteristic type data D_1, but in Embodiment 3, it is not limited to this, and 5QI=1 may be set for communication characteristic type data D_1. As shown in Figure 20(b), data for which the QoS request is "low latency" corresponds to communication characteristic type data D_1, which prioritizes the communication characteristic of "low latency" over confidentiality.

[0425] Therefore, in Embodiment 3, a mechanism is used, as defined in the 5G standard specifications, to set identification information (QoS Flow ID (5QI)) that identifies a flow (a collection of packets) in response to a QoS request for data in the SDAP Header. This generates a tag TAG_1 containing 5QI=1 or 5QI=2 for communication-characteristic data D_1, and a tag TAG_2 containing 5QI=3 for confidential data D_2. As a result, a different 5QI is set for confidential data D_2 than for communication-characteristic data D_1.

[0426] Then, tag TAG_1 or tag TAG_2 corresponds to the SDAP Header shown in Figure 20(a).

[0427] In Embodiment 3, the operation of the terminal device 1B may be implemented by software. In this case, the terminal device 1B includes a CPU, ROM, and RAM. The ROM stores a program Prog_C consisting of each step of the flowchart shown in Figure 23 (including the flowcharts shown in Figures 24 to 30).

[0428] The CPU reads the program Prog_C from ROM, executes the read program Prog_C, establishes legacy session Sn_1 and secure session Sn_2 (or legacy session Sn_1 or secure session Sn_2) with the AMF of core network 3, and transmits data using legacy session Sn_1 and secure session Sn_2 (or legacy session Sn_1 or secure session Sn_2) as needed. RAM temporarily stores the encryption keys ENCRY_KY_1, ENCRY_KY_2 and decryption keys DECRY_KY_1, DECRY_KY_2 mentioned above.

[0429] Furthermore, the program Prog_C may be recorded on a recording medium such as a CD or DVD and distributed. When a recording medium containing the program Prog_C is inserted into a computer, the computer reads and executes the program Prog_C from the recording medium, establishes a legacy session Sn_1 and a secure session Sn_2 (or legacy session Sn_1 or secure session Sn_2) with the AMF of the core network 3, and transmits data using the legacy session Sn_1 and secure session Sn_2 (or legacy session Sn_1 or secure session Sn_2) as needed.

[0430] Therefore, the recording medium on which the program Prog_C is stored is a computer-readable recording medium.

[0431] In the embodiments 1 and 2 described above, when communication characteristic data D_1 is received from an application (not shown), a legacy session Sn_1 is established and communication characteristic data D_1 is transmitted, and when confidentiality data D_2 is received from an application (not shown), a secure session Sn_2 is established and confidentiality data D_2 is transmitted (see flowcharts shown in Figure 5 and Figure 12).

[0432] Furthermore, in the above-described embodiment 3, when MR-DC is available between terminal device UE and master node MN, legacy session Sn_1 and secure session Sn_2 are established simultaneously, and communication characteristic data D_1 and confidentiality data D_2 are transmitted using the established legacy session Sn_1 and secure session Sn_2, respectively. When MR-DC is not available between terminal device UE and master node MN, the session is switched to legacy session Sn_1 or secure session Sn_2 using the handover mechanism within the cell of base station 2, and communication characteristic data D_1 or confidentiality data D_2 is transmitted (see flowchart shown in Figure 23).

[0433] As a result, Embodiments 1 to 3 share the common feature of establishing a legacy session Sn_1 and a secure session Sn_2, and transmitting communication characteristic data D_1 and confidentiality data D_2, respectively, using the established legacy session Sn_1 and secure session Sn_2.

[0434] Therefore, the terminal device according to the embodiment of this invention is a terminal device in a fifth-generation mobile communication system, In the core network of a fifth-generation mobile communication system, a session establishment means establishes a first session (legacy session Sn_1), which is a logical communication path for transmitting encrypted data encrypted with a first encryption key (encryption key ENCRY_KY_1) having a first key length (128 bits), and a second session (secure session Sn_2), which is a logical communication path for transmitting encrypted data encrypted with a second encryption key (encryption key ENCRY_KY_2) having a second key length (256 bits) longer than the first key length (128 bits), by performing a security setting procedure with the AMF, which is a network function for security. An encryption method that generates first encrypted data by encrypting first data (communication characteristics data D_1), which is data where communication characteristics are more important than confidentiality, with a first encryption key (encryption key ENCRY_KY_1), and generates second encrypted data by encrypting second data (confidentiality data D_2), which is data where confidentiality is more important than communication characteristics, with a second encryption key (encryption key ENCRY_KY_2), The system only needs to include a transmission means for transmitting the first encrypted data using the first session (legacy session Sn_1) and the second encrypted data using the second session (secure session Sn_2).

[0435] If the terminal device is equipped with session establishment means, encryption means, and transmission means, it can send communication characteristic data D_1 and confidentiality data D_2 to the destination using legacy session Sn_1 and secure session Sn_2, respectively.

[0436] Therefore, depending on the application, it is possible to use different communication channels (legacy session Sn_1 or secure session Sn_2) to transmit either communication-specific data or confidential data, and confidential data can be appropriately protected without being over-specified for communication-specific data.

[0437] Furthermore, the program according to the embodiment of this invention is a program to be executed by a computer in a terminal device of a fifth-generation mobile communication system, The session establishment means, in the core network of the fifth-generation mobile communication system, performs a security setting procedure with the AMF, which is a network function for security, to establish a first session (legacy session Sn_1), which is a logical communication channel for transmitting encrypted data encrypted with a first encryption key (encryption key ENCRY_KY_1) having a first key length (128 bits), and a second session (secure session Sn_2), which is a logical communication channel for transmitting encrypted data encrypted with a second encryption key (encryption key ENCRY_KY_2) having a second key length (256 bits) longer than the first key length (128 bits), in a first step, The encryption method involves a second step in which the first data (communication characteristics data D_1), where communication characteristics are more important than confidentiality, is encrypted using a first encryption key (encryption key ENCRY_KY_1) to generate first encrypted data, and the second data (confidentiality data D_2), where confidentiality is more important than communication characteristics, is encrypted using a second encryption key (encryption key ENCRY_KY_2) to generate second encrypted data, The transmission means can simply have the computer perform a third step: sending the first encrypted data using the first session (legacy session Sn_1), and sending the second encrypted data using the second session (secure session Sn_2).

[0438] Once the program has the computer perform the first, second, and third steps, it can send communication-specific data D_1 and confidentiality data D_2 to the destination using legacy session Sn_1 and secure session Sn_2, respectively.

[0439] Therefore, depending on the application, it is possible to use different communication channels (legacy session Sn_1 or secure session Sn_2) to transmit either communication-specific data or confidential data, and confidential data can be appropriately protected without being over-specified for communication-specific data.

[0440] In this embodiment of the invention, a 128-bit key length constitutes the "first key length," the encryption key ENCRY_KY_1 constitutes the "first encryption key," a 256-bit key length constitutes the "second key length," and the encryption key ENCRY_KY_2 constitutes the "second encryption key."

[0441] Furthermore, in this embodiment of the invention, legacy session Sn_1 constitutes a "first session" which is a logical communication path, and secure session Sn_2 constitutes a "second session" which is a logical communication path.

[0442] Furthermore, in this embodiment of the invention, communication characteristic data D_1 constitutes "first data," and confidentiality data D_2 constitutes "second data."

[0443] Furthermore, in this embodiment of the invention, threshold value PU constitutes a "first threshold value," and threshold value PL constitutes a "second threshold value."

[0444] Furthermore, in this embodiment of the invention, terminal device 1 (or terminal device 1A or terminal device 1B) and base station 2 constitute a "wireless communication system" according to this embodiment of the invention.

[0445] The embodiments disclosed herein should be considered in all respects to be illustrative and not restrictive. The scope of the present invention is indicated by the claims rather than by the description of the embodiments above, and all modifications within the meaning and scope equivalent to the claims are intended to be included. [Industrial applicability]

[0446] This invention applies to terminal devices, wireless communication systems equipped therewith, and programs for execution by computers. [Explanation of symbols]

[0447] 1,1A,1B Terminal device, 2 Base station, 3 Core network, 10 Mobile communication system, 11 Antenna, 12,12A,12B Wireless unit, 13,13A,13B Session establishment means, 14,14A Encryption means, 15,15A Decryption means, 16 Control means.

Claims

1. A terminal device that transmits the first data and the second data, excluding the third data, from among the following: first data, which is data for which communication characteristics are given more importance than confidentiality in a fifth-generation mobile communication system; second data, for which confidentiality is given more importance than the communication characteristics; and third data, for which confidentiality and communication characteristics are given equal importance. In the core network of the fifth-generation mobile communication system, a session establishment means that performs a security setting procedure with the AMF, which is a network function for security, to establish a first session, which is a logical communication path for transmitting encrypted data encrypted with a first encryption key having a first key length, and a second session, which is a logical communication path for transmitting encrypted data encrypted with a second encryption key having a second key length longer than the first key length. An encryption means that encrypts the first data with the first encryption key to generate first encrypted data, and encrypts the second data with the second encryption key to generate second encrypted data, A terminal device comprising a transmission means for transmitting the first encrypted data using the first session and transmitting the second encrypted data using the second session.

2. The terminal device according to claim 1, wherein the session establishment means establishes the first and second sessions by selecting an encryption method and key length to be used from a list of encryption methods and key lengths transmitted from the AMF, and transmitting the encryption method and key length to be used to the AMF.

3. The terminal device according to claim 1, wherein the session establishment means establishes the first and second sessions by receiving from the AMF of the core network an encryption method and key length selected by the AMF of the core network from a list of encryption methods and key lengths.

4. The session establishment means, instead of between the terminal device and the AMF, establishes the first and second sessions simultaneously with one base station using a mechanism that allows simultaneous use of multiple sessions when MR-DC is available to set up sessions with different radio base stations at the terminal device. The terminal device according to claim 1, wherein the transmission means transmits the first encrypted data using the first session established using the mechanism for using the plurality of sessions simultaneously, and transmits the second encrypted data using the second session established using the mechanism for using the plurality of sessions simultaneously.

5. The session establishment means further, instead of between the terminal device and the AMF, between the terminal device and the base station, when MR-DC is unavailable for simultaneously setting a session with different wireless base stations, switches the session to the first session or the second session by a handover mechanism within the base station's communication range. The terminal device according to claim 1, wherein the transmission means transmits the first encrypted data using the first session when the second session is switched to the first session, and transmits the second encrypted data using the second session when the first session is switched to the second session.

6. The terminal device according to claim 5, wherein the session establishment means, when the first session is established, switches the session from the first session to the second session by a handover mechanism within the base station's communication range when the proportion of uses requiring confidentiality exceeds a first threshold, and when the second session is established, switches the session from the second session to the first session by a handover mechanism within the base station's communication range when the proportion of uses requiring confidentiality falls below a second threshold smaller than the first threshold.

7. A wireless communication system comprising a terminal device according to any one of claims 1 to 6.

8. A program for causing a computer to transmit the first data and the second data, excluding the third data, from among the following: first data, which is data for which communication characteristics are more important than confidentiality in a fifth-generation mobile communication system; second data, for which confidentiality is more important than the communication characteristics; and third data, for which confidentiality and communication characteristics are equally important. The session establishment means performs a security setting procedure with the AMF, which is a network function for security, in the core network of the fifth-generation mobile communication system, to establish a first session, which is a logical communication path for transmitting encrypted data encrypted with a first encryption key having a first key length, and a second session, which is a logical communication path for transmitting encrypted data encrypted with a second encryption key having a second key length longer than the first key length. The encryption means includes a second step of generating first encrypted data by encrypting the first data with the first encryption key, and generating second encrypted data by encrypting the second data with the second encryption key, A program that causes a computer to perform the following steps: a transmission means transmits the first encrypted data using the first session, and a third step transmits the second encrypted data using the second session.

9. The program for a computer to be executed according to claim 8, wherein the session establishment means, in the first step, establishes the first and second sessions by selecting an encryption method and key length to be used from a list of encryption methods and key lengths transmitted from the AMF, and transmitting the encryption method and key length to be used to the AMF.

10. The program for a computer to be executed according to claim 8, wherein the session establishment means establishes the first and second sessions in the first step by receiving from the AMF of the core network an encryption method and key length selected by the AMF of the core network from a list of encryption methods and key lengths.

11. In the first step, the session establishment means, instead of establishing a session between the terminal device and the AMF, establishes the first and second sessions simultaneously with one base station using a mechanism for simultaneously using multiple sessions, when an MR-DC that simultaneously sets up sessions with different radio base stations is available, between the terminal device and the base station. The program for a computer to be executed according to claim 8, wherein the transmission means transmits the first encrypted data using the first session established using the mechanism for using the plurality of sessions simultaneously in the third step, and transmits the second encrypted data using the second session established using the mechanism for using the plurality of sessions simultaneously.

12. In the first step, the session establishment means further, instead of between the terminal device and the AMF, between the terminal device and the base station, if MR-DC is unavailable for simultaneously setting a session with different radio base stations, switches the session to the first session or the second session by a handover mechanism within the communication range of the base station. The program for a computer to be executed according to claim 8, wherein the transmission means, in the third step, transmits the first encrypted data using the first session when the second session is switched to the first session, and transmits the second encrypted data using the second session when the first session is switched to the second session.

13. The program for a computer to be executed according to claim 12, wherein the session establishment means, in the first step, when the first session is established, switches the session from the first session to the second session by a handover mechanism within the communication range of the base station if the proportion of uses requiring confidentiality exceeds a first threshold, and when the second session is established, switches the session from the second session to the first session by a handover mechanism within the communication range of the base station if the proportion of uses requiring confidentiality falls below a second threshold which is smaller than the first threshold.

Images