Network node, communication system, and communication method

Abstract

Provided is a network node which, in order to establish a safe communication path between another network node and a terminal, comprises a control unit which generates a key used in the other network node on the basis of information indicating the type of the other network node or a network slice to which the other network node belongs such that the key has a value unique to the type or the network slice, and a transmission unit which transmits a message including the key to the other network node.

Description

Technical Field

[0001] The present invention relates to a network node, a communication system, and a communication method in a wireless communication system.

Background Art

[0002] In NR (also referred to as "5G"), which is a successor system to LTE (Long Term Evolution), a network architecture including a 5GC (5G Core Network) corresponding to the EPC (Evolved Packet Core), which is the core network in the LTE network architecture, and an NG-RAN (Next Generation - Radio Access Network) corresponding to the E-UTRAN (Evolved Universal Terrestrial Radio Access Network), which is the RAN (Radio Access Network) in the LTE network architecture, is being considered (for example, Non-Patent Document 1 and Non-Patent Document 2).

[0003] Also, the specifications of 6G, which is a successor system to NR, are being considered. For example, in 6G, configurations for realizing localization or shortening of the transmission path of NAS (Non-Access Stratum) signals are being considered (for example, Non-Patent Document 3).

Prior Art Documents

Non-Patent Documents

[0004]

Non-Patent Document 1

Non-Patent Document 2

Non-Patent Document 3

[0005] To achieve localization or shortening of the NAS signal transmission path, one possible configuration is for the RAN to terminate the NAS signals that perform transport functions, and at the same time, to function as a communication termination that guarantees the confidentiality and integrity protection of the entire NAS signal. However, in that case, there is a problem in that the security guarantee for NAS signals other than those that perform transport functions is not sufficient in the communication between the RAN and the core network. Thus, conventional technology has the problem that it is not possible to achieve localization or shortening of the NAS signal transmission path while ensuring security.

[0006] This invention has been made in view of the above points, and aims to achieve localization or shortening of the transmission path of NAS signals while ensuring security. [Means for solving the problem]

[0007] According to the disclosed technology, in order to establish a secure communication path between other network nodes and a terminal, the species of the other network nodes Separate Based on the information shown, the key to be used by the other network node is determined by type Separate A network node is provided, comprising a control unit that generates a key that is different from the other key, and a transmission unit that sends a message containing the key to the other network node. [Effects of the Invention]

[0008] The disclosed technology provides a method for localizing or shortening the transmission path of NAS signals while ensuring security. [Brief explanation of the drawing]

[0009] [Figure 1] This figure illustrates a wireless communication system according to an embodiment of the present invention. [Figure 2] This figure shows an example of the configuration of a wireless communication system according to an embodiment of the present invention. [Figure 3] This diagram illustrates the conventional NAS signal transmission path. [Figure 4] This diagram illustrates the mechanism for distributing the termination of NAS signals. [Figure 5] This sequence diagram shows an example of the procedure for establishing a PDU session according to Embodiment 1 of the present invention. [Figure 6] This sequence diagram shows an example of the procedure for acquiring location information according to Embodiment 2 of the present invention. [Figure 7] This is a sequence diagram showing an example of the flow of the terminal policy setting procedure according to Embodiment 3 of the present invention. [Figure 8] This figure shows an example of the functional configuration of a base station according to an embodiment of the present invention. [Figure 9] This figure shows an example of the functional configuration of a terminal according to an embodiment of the present invention. [Figure 10] This figure shows an example of the hardware configuration of a base station or terminal according to an embodiment of the present invention. [Figure 11] This figure shows an example of the configuration of a vehicle according to an embodiment of the present invention. [Modes for carrying out the invention]

[0010] Embodiments of the present invention will be described below with reference to the drawings. Note that the embodiments described below are examples, and the embodiments to which the present invention is applied are not limited to those described below.

[0011] In the operation of the wireless communication system according to the embodiment of the present invention, existing technologies may be used as appropriate. The existing technologies include, for example, existing NR or LTE, but are not limited to existing NR or LTE. Further, the term "LTE" used in this specification shall have a broad meaning including LTE-Advanced and subsequent systems (e.g., NR) unless otherwise specified.

[0012] In addition, in the embodiments of the present invention described below, terms such as SS (Synchronization signal), PSS (Primary SS), SSS (Secondary SS), PBCH (Physical broadcast channel), PRACH (Physical random access channel), PDCCH (Physical Downlink Control Channel), PDSCH (Physical Downlink Shared Channel), PUCCH (Physical Uplink Control Channel), PUSCH (Physical Uplink Shared Channel), etc. used in existing LTE are used. This is for convenience of description, and signals, functions, etc. similar to these may be called by other names. Also, the above terms in NR correspond to NR-SS, NR-PSS, NR-SSS, NR-PBCH, NR-PRACH, etc. However, even for signals used in NR, the "NR-" may not necessarily be specified.

[0013] In the embodiments of the present invention, the duplex mode may be a TDD (Time Division Duplex) mode, an FDD (Frequency Division Duplex) mode, or other modes (e.g., Flexible Duplex, etc.).

[0014] Also, in the embodiments of the present invention, when wireless parameters or the like are "configured", it may mean that predetermined values are pre-configured, or it may mean that wireless parameters notified from a base station or a terminal are configured.

[0015] (System Configuration) FIG. 1 is a diagram for explaining a wireless communication system according to an embodiment of the present invention. As shown in FIG. 1, the wireless communication system according to an embodiment of the present invention includes a base station 10 and a terminal 20. Although one base station 10 and one terminal 20 are shown in FIG. 1, this is an example, and there may be a plurality of each.

[0016] The base station 10 is a communication device that provides one or more cells and performs wireless communication with the terminal 20. The physical resources of the wireless signal are defined in the time domain and the frequency domain. The time domain may be defined by the number of OFDM (Orthogonal Frequency Division Multiplexing) symbols, and the frequency domain may be defined by the number of subcarriers or the number of resource blocks. Also, the TTI (Transmission Time Interval) in the time domain may be a slot, or the TTI may be a subframe.

[0017] The base station 10 transmits synchronization signals and system information to the terminal 20. The synchronization signals are, for example, NR-PSS and NR-SSS. The system information is transmitted, for example, via NR-PBCH and is also called broadcast information. The synchronization signals and system information may also be called SSB (SS / PBCH block). As shown in Figure 1, the base station 10 transmits control signals or data to the terminal 20 via DL (Downlink) and receives control signals or data from the terminal 20 via UL (Uplink). Both the base station 10 and the terminal 20 are capable of transmitting and receiving signals using beamforming. Furthermore, both the base station 10 and the terminal 20 are capable of applying MIMO (Multiple Input Multiple Output) communication to DL or UL. In addition, both the base station 10 and the terminal 20 may communicate via secondary cells (SCell) and primary cells (PCell) using CA (Carrier Aggregation). Furthermore, terminal 20 may communicate via the primary cell of base station 10 and the primary secondary cell group cell (PSCell: Primary SCG Cell) of other base stations 10 using DC (Dual Connectivity).

[0018] Terminal 20 is a communication device equipped with wireless communication capabilities, such as a smartphone, mobile phone, tablet, wearable device, or M2M (Machine-to-Machine) communication module. As shown in Figure 1, Terminal 20 receives control signals or data from the base station 10 via DL and transmits control signals or data to the base station 10 via UL, thereby utilizing various communication services provided by the wireless communication system. Terminal 20 also receives various reference signals transmitted from the base station 10 and performs propagation path quality measurements based on the reception results of these reference signals. Terminal 20 may also be referred to as UE and base station 10 as gNB.

[0019] Figure 2 shows an example of the configuration of a wireless communication system according to an embodiment of the present invention. The wireless communication system comprises a RAN 10, a terminal 20, a core network 30, and a DN (Data Network) 40.

[0020] The core network 30 is a network equipped with exchanges, subscriber information management devices, etc. The core network 30 comprises network nodes that implement U-Plane functionality and a group of network nodes that implement C-Plane functionality.

[0021] The U-Plane function is a function that performs the processing of sending and receiving user data. A network node that implements the U-Plane function is, for example, the UPF (User plane function) 380. The UPF 380 is a network node that has functions such as an external PDU (Protocol Data Unit) session point for interconnecting with the DN 40, packet routing and forwarding, and user plane QoS (Quality of Service) handling. The UPF 380 controls the sending and receiving of data between the DN 40 and the terminal 20. The UPF 380 and DN 40 may consist of one or more network slices.

[0022] The C-Plane function group is a set of functions that execute a series of control processes for establishing communication and other purposes. The network node group that implements the C-Plane function group includes, for example, CAMF (Compact Access and Mobility Management Function) 310, UDM (Unified Data Management) 320, NEF (Network Exposure Function) 330, NRF (Network Repository Function) 340, AUSF (Authentication Server Function) 350, PCF (Policy Control Function) 360, SMF (Session Management Function) 370, AF (Application Function) 390, and LMF (Location Management Function) 391.

[0023] CAMF310 is an AF (Access and Mobility Management Function) that omits some of the functions of a conventional AMF. A conventional AMF is a network node that has functions such as terminating the RAN interface, terminating the NAS (Non-Access Stratum) which handles transport functions, registration management, connection management, reachability management, and mobility management. In contrast, CAMF310 is a network node that omits functions such as terminating the RAN interface and terminating the NAS which handles transport functions, and is a network node that has functions such as registration management, connection management, reachability management, and mobility management.

[0024] NRF340 is a network node with the ability to discover Network Function (NF) instances that provide services. UDM320 is a network node that manages subscriber data and authentication data. UDM320 includes User Data Repository (UDR)321, which holds the said data, and Front End (FE)322. FE322 processes subscriber information.

[0025] The SMF370 is a network node with functions such as session management, IP (Internet Protocol) address assignment and management for terminal 20, DHCP (Dynamic Host Configuration Protocol) functionality, ARP (Address Resolution Protocol) proxy, and roaming functionality. The NEF330 is a network node with the function of notifying other NFs (Network Functions) of their capabilities and events.

[0026] PCF360 is a network node that has the function of controlling the network's policies. PCF360 may include UE-PCF361. UE-PCF361 is a network node that has the function of controlling the policies of terminal 20.

[0027] The AF (Application Function) 390 is a network node that has the function of controlling application servers.

[0028] LMF391 is a network node that has the function of managing the adjustment and scheduling of resources necessary for measuring the location of terminals 20 that are registered with or accessing the core network 30.

[0029] AMF310 and RAN10 are connected in a way that allows communication as an N2 link. UPF380 and RAN10 are connected in a way that allows communication as an N3 link. UPF380 and SMF370 are connected in a way that allows communication as an N4 link. UPF380 and DN40 are connected in a way that allows communication as an N6 link.

[0030] (Previous problems) Next, let's discuss the conventional problems. Traditionally, AMF has functioned as the termination of NAS signals with guaranteed confidentiality and integrity protection.

[0031] Figure 3 is a diagram illustrating the conventional NAS signal transmission path. NFa, shown in Figure 3, corresponds to the AMF. NFa functions as the termination of the NAS-a signal in communication with the terminal. Each network node other than NFa (NFb, NFc, or NFx) enables communication of NAS-b, NAS-c, or NAS-x signals with the terminal, respectively, on the layer established by the NAS-a signal.

[0032] To achieve localization or shortening of the NAS signal transmission path, for example, a configuration could be considered in which the RAN, which handles transport functions, terminates the NAS signals and simultaneously functions as a communication termination that guarantees the confidentiality and integrity protection of the entire NAS signal. However, in that case, there is a problem in that the security guarantee for NAS signals other than those handling transport functions is insufficient in the communication between the RAN and the core network.

[0033] Therefore, Non-Patent Document 3 discloses a configuration in which each NF that terminates various NAS signals from a terminal functions as a communication termination that guarantees the confidentiality and integrity protection of the NAS signals.

[0034] Figure 4 illustrates the mechanism for distributing the termination of NAS signals. Each network node (NFa, NFb, NFc, or NFx) functions as a communication termination point, guaranteeing the confidentiality and integrity protection of the NAS-a, NAS-b, NAS-c, or NAS-x signals. In this configuration, the confidentiality and integrity protection of the NAS-a, NAS-b, NAS-c, or NAS-x signals are achieved individually between the terminal and NFa, between the terminal and NFb, between the terminal and NFc, or between the terminal and NFx.

[0035] However, to date, no specific methods for realizing the configuration shown in Figure 4 have been considered.

[0036] (Summary of this embodiment) To address the conventional problems described above, this embodiment describes an example in which each network node functions as the termination of an individual NAS signal.

[0037] For example, CAMF310 (the first network node) which manages Kamf, uses a calculation algorithm previously shared with terminal 20 to derive the key (Knfy_a) to be used by NF-Y (the second network node) of network slice A from Kamf. This calculation algorithm may include network slice names (e.g., network slice A or network slice B), NF type names (e.g., NF-Y or NF-Z), etc., as input parameters in order to make the key values ​​different in order to minimize the damage if the key is leaked. In other words, CAMF310 generates keys (Knfy_a) such that they have different values ​​for each network slice name or NF type name.

[0038] Alternatively, instead of, or in addition to, a network slice, information specifying DN40 (for example, DNN (Data Network Name)) may be used as an input parameter.

[0039] CAMF310 distributes each key and information indicating the terminal's security capabilities, which was previously obtained from terminal 20, to each NF-Y. CAMF310 may also distribute information indicating the terminal's security capabilities based on a request from an NF-Y (i.e., a request to obtain security information).

[0040] Each NF-Y initiates a security mode instruction procedure on terminal 20 and establishes a confidential and integrity-protected communication channel between itself and terminal 20. At this time, before a confidential and integrity-protected communication channel is established between itself and terminal 20, each NF-Y uses a confidential and integrity-protected communication channel between terminal 20 and CAMF310, for example, during the security mode instruction procedure.

[0041] Next, the operation of the communication system according to this embodiment will be described. Below, specific examples, from Example 1 to Example 3, will be described.

[0042] (Example 1) This embodiment describes an example in which the SMF370 establishes a PDU session with terminal 20.

[0043] Figure 5 is a sequence diagram showing an example of the flow of the PDU session establishment procedure according to Embodiment 1 of the present invention. Terminal 20 is assumed to have completed the initial registration procedure.

[0044] CAMF310 stores information indicating the security capabilities of terminal 20, as well as the key Kamf. Furthermore, communication between terminal 20 and CAMF310 is confidential and its integrity is protected.

[0045] Terminal 20 sends a message to RAN10 indicating a PDU session establishment request in order to establish a PDU session on the network slice S-NSSAI=A (step S101). Here, the message terminating in RAN10 that contains the PDU session establishment request includes information indicating whether or not a security establishment request is made (e.g., "Security establishment request made") and information specifying the network slice name (e.g., "S-NSSAI=A").

[0046] RAN10 refers to information indicating whether a security establishment request is present (e.g., "Security establishment request present") and forwards a message indicating a PDU session establishment request to CAMF310 (step S102). The message terminating at CAMF310, which contains a PDU session establishment request, includes information indicating whether a security establishment request is present (e.g., "Security establishment request present") and information specifying the network slice name (e.g., "S-NSSAI=A").

[0047] CAMF310 generates the key Ksmf_a from key Kamf for SMF370 to contain the network slice specified by the network slice name information (e.g., "S-NSSAI=A"). Here, the input to the key derivation function includes information indicating the type of network node (e.g., "NF type=SMF") and information specifying the network slice (e.g., "S-NSSAI=A").

[0048] CAMF310 forwards a message indicating a PDU session establishment request to SMF370 (step S103). Here, the message terminating at SMF370, which includes a PDU session establishment request, includes information indicating the security capabilities of terminal 20, the key Ksmf_a, information indicating whether a security establishment request is made (e.g., "Security establishment request made"), and information specifying the network slice name (e.g., "S-NSSAI=A").

[0049] The SMF370 generates the privacy key Ksmf_a_nas_enc and the integrity protection key Ksmf_a_nas_int from the key Ksmf_a. Then, the SMF370 sends a message indicating the security mode to terminal 20 via CAMF310 (step S104).

[0050] Terminal 20 generates the privacy key Ksmf_a_nas_enc and the integrity protection key Ksmf_a_nas_int using a pre-shared computation algorithm.

[0051] Next, terminal 20 sends a message to SMF370 via CAMF310 indicating the completion of security mode (step S105). Here, the message between terminal 20 and RAN10 indicating the completion of security mode includes information indicating the completion of security mode. In addition, the messages between RAN10 and CAMF310 and between CAMF310 and SMF370 include information indicating the RAN side termination point.

[0052] SMF370 sends a message indicating acceptance of PDU session establishment to RAN10 (RAN side termination point) instead of via CAMF310 (step S106).

[0053] Subsequent communication between terminal 20 and SMF370 does not go through CAMF310.

[0054] In this embodiment, when the SMF370 establishes a PDU session with the terminal 20, it functions as a communication termination that guarantees the confidentiality and integrity protection of the NAS signal. This makes it possible to localize or shorten the transmission path of the NAS signal while ensuring security.

[0055] (Example 2) In this embodiment, an example is described in which the LMF391 communicates with the terminal 20 to obtain location information.

[0056] Figure 6 is a sequence diagram showing an example of the procedure for acquiring location information according to Embodiment 2 of the present invention. Terminal 20 is assumed to have completed the initial registration procedure.

[0057] CAMF310 stores information indicating the security capabilities of terminal 20, as well as the key Kamf. Furthermore, communication between terminal 20 and CAMF310 is confidential and its integrity is protected.

[0058] LMF391, which accommodates the network slice S-NSSAI=B, sends a message to CAMF310 indicating a request for security information (step S201). Here, the message indicating a request for security information includes information specifying the network slice (for example, "S-NSSAI=B").

[0059] CAMF310 generates the key Klmf_b from key Kamf for LMF391 to accommodate a specified network slice (e.g., "S-NSSAI=B"). Here, information indicating the type of network node (e.g., "NF type=LMF") and information specifying the network slice (e.g., "S-NSSAI=B") are included as inputs to the key derivation function.

[0060] CAMF310 sends a message to LMF391 indicating a response to the acquisition of security information (step S202). Here, the message indicating a response to the acquisition of security information includes information indicating the security capabilities of terminal 20 and the key Klmf_b.

[0061] The LMF391 generates the privacy key Klmf_b_nas_enc and the integrity protection key Klmf_b_nas_int from the key Klmf_b. Then, the LMF391 sends a message indicating the security mode to terminal 20 via CAMF310 (step S203).

[0062] Terminal 20 generates the privacy key Klmf_b_nas_enc and the integrity protection key Klmf_b_nas_int using a pre-shared computation algorithm.

[0063] Next, terminal 20 sends a message to LMF391 via CAMF310 indicating the completion of security mode (step S204). Here, the message between terminal 20 and RAN10 indicating the completion of security mode includes information indicating the completion of security mode. In addition, the messages between RAN10 and CAMF310 and between CAMF310 and LMF391 include information indicating the RAN side termination point.

[0064] LMF391 sends a message indicating DL position acquisition to RAN10 (RAN side termination point) instead of via CAMF310 (step S205).

[0065] Subsequent communication between terminal 20 and LMF391 does not go through CAMF310.

[0066] According to this embodiment, when the LMF391 communicates information related to the location of terminal 20 with terminal 20, it functions as a communication termination that guarantees the confidentiality and integrity protection of the NAS signal. This makes it possible to localize or shorten the transmission path of the NAS signal while ensuring security.

[0067] (Example 3) This embodiment describes an example in which the UE-PCF361 communicates with terminal 20 to set terminal policies.

[0068] Figure 7 is a sequence diagram showing an example of the flow of the terminal policy setting procedure according to Embodiment 3 of the present invention. Terminal 20 is assumed to have completed the initial registration procedure.

[0069] CAMF310 stores information indicating the security capabilities of terminal 20, as well as the key Kamf. Furthermore, communication between terminal 20 and CAMF310 is confidential and its integrity is protected.

[0070] The UE-PCF361, which accommodates the S-NSSAI=C network slice, sends a message to the CAMF310 indicating a request for security information (step S301). Here, the message indicating a request for security information includes information specifying the network slice (for example, "S-NSSAI=C").

[0071] CAMF310 generates the key Kuepcf_c from key Kamf for UE-PCF361 to accommodate a specified network slice (e.g., "S-NSSAI=C"). Here, information indicating the type of network node (e.g., "NF type=UE-PCF") and information specifying the network slice (e.g., "S-NSSAI=C") are included as inputs to the key derivation function.

[0072] CAMF310 sends a message to UE-PCF361 indicating a response to the acquisition of security information (step S302). Here, the message indicating the response to the acquisition of security information includes information indicating the security capabilities of terminal 20 and the key Kuepcf_c.

[0073] The UE-PCF361 generates the privacy key Kuepcf_c_nas_enc and the integrity protection key Kuepcf_c_nas_int from the key Kuepcf_c. Then, the UE-PCF361 sends a message indicating the security mode to terminal 20 via CAMF310 (step S303).

[0074] Terminal 20 generates the privacy key Kuepcf_c_nas_enc and the integrity protection key Kuepcf_c_nas_int using a pre-shared computation algorithm.

[0075] Next, terminal 20 sends a message to UE-PCF361 via CAMF310 indicating the completion of security mode (step S304). Here, the message between terminal 20 and RAN10 indicating the completion of security mode includes information indicating the completion of security mode. In addition, the messages between RAN10 and CAMF310 and between CAMF310 and UE-PCF361 include information indicating the RAN side termination point.

[0076] UE-PCF361 sends a message indicating the terminal policy container to RAN10 (RAN-side termination point) instead of via CAMF310 (step S305).

[0077] Subsequent communication between terminal 20 and UE-PCF361 does not go through CAMF310.

[0078] According to this embodiment, when the UE-PCF361 communicates information related to the policy control of terminal 20 with terminal 20, it functions as a communication termination that guarantees the confidentiality and integrity protection of the NAS signal. This makes it possible to localize or shorten the transmission path of the NAS signal while ensuring security.

[0079] According to this embodiment, each network node functions as the termination point for individual NAS signals. This makes it possible to localize or shorten the transmission path of NAS signals while ensuring security.

[0080] (Device configuration) Next, we will describe an example of the functional configuration of the base station 10, terminal 20, and various network nodes that perform the processes and operations described above. The base station 10, terminal 20, and various network nodes include the functions to implement the embodiments described above. However, the base station 10, terminal 20, and various network nodes may each have only some of the functions in the embodiments.

[0081] <Base station 10 and network node> Figure 8 shows an example of the functional configuration of the base station 10. As shown in Figure 8, the base station 10 has a transmitting unit 110, a receiving unit 120, a setting unit 130, and a control unit 140. The functional configuration shown in Figure 8 is merely an example. The functional classifications and names of the functional units can be anything as long as they can perform the operations according to the embodiment of the present invention. Network nodes may have the same functional configuration as the base station 10. Furthermore, network nodes having multiple different functions on the system architecture may be composed of multiple network nodes separated by function.

[0082] The transmitting unit 110 includes the function of generating a signal to be transmitted to the terminal 20 or other network nodes and transmitting the signal by wire or wireless. The receiving unit 120 includes the function of receiving various signals transmitted from the terminal 20 or other network nodes and obtaining information from the received signals, for example, information from a higher layer.

[0083] The configuration unit 130 stores pre-configured configuration information and various configuration information to be transmitted to the terminal 20 in a storage device, and reads it from the storage device as needed. The contents of the configuration information include, for example, settings related to communication using NTN.

[0084] As described in the embodiment, the control unit 140 performs processing related to communication using NTN. The control unit 140 also performs processing related to communication with the terminal 20. Furthermore, the control unit 140 performs processing related to verifying the geographical location of the terminal 20. The signal transmission function in the control unit 140 may be included in the transmission unit 110, and the signal reception function in the control unit 140 may be included in the reception unit 120.

[0085] <Terminal 20> Figure 9 is a diagram showing an example of the functional configuration of terminal 20. As shown in Figure 9, terminal 20 has a transmitting unit 210, a receiving unit 220, a setting unit 230, and a control unit 240. The functional configuration shown in Figure 9 is merely an example. The functional classifications and names of the functional units can be anything as long as they can perform the operations according to the embodiment of the present invention. The USIM inserted into terminal 20 may also have a transmitting unit 210, a receiving unit 220, a setting unit 230, and a control unit 240, similar to terminal 20.

[0086] The transmitting unit 210 creates a transmission signal from the transmission data and transmits the transmission signal wirelessly. The receiving unit 220 wirelessly receives various signals and acquires signals from higher layers from the received physical layer signals. The receiving unit 220 also has the function of receiving NR-PSS, NR-SSS, NR-PBCH, DL / UL control signals or reference signals transmitted from network nodes.

[0087] The configuration unit 230 stores various configuration information received from network nodes by the receiving unit 220 in its storage device and reads it from the storage device as needed. The configuration unit 230 also stores pre-configured configuration information.

[0088] The network node or communication system of this embodiment may be configured as one of the network node or communication systems described in the following sections. Furthermore, the following communication methods may be implemented.

[0089] <Configuration of this embodiment> (Section 1) A control unit generates a key to be used by the other network node, which has a different value for each type or network slice, based on information indicating the type of the other network node or the network slice to which the other network node belongs, in order to establish a secure communication path between the other network node and the terminal. The system includes a transmitting unit that transmits a message containing the key to the other network node. Network node. (Section 2) A receiving unit that receives messages from other network nodes containing keys for establishing a secure communication path with the terminal, A control unit that generates a key for concealment and a key for integrity protection based on the aforementioned key, The system includes a transmitting unit that uses a secure communication path between the other network node and the terminal to send a message to the terminal indicating that it is in security mode. Network node. (Section 3) A communication system including a first network node and a second network node, The first network node is, A control unit generates a key to be used at the second network node, which has a different value for each type or network slice, based on information indicating the type of the second network node or the network slice to which the second network node belongs, in order to establish a secure communication path between the second network node and the terminal. The system includes a transmitting unit that transmits a message containing the key to the second network node, The second network node is, A receiving unit that receives a message containing the key from the first network node, A control unit that generates a key for concealment and a key for integrity protection based on the aforementioned key, The system includes a transmitting unit that transmits a message indicating security mode to the terminal using a secure communication path between the first network node and the terminal. Communication system. (Section 4) In order to establish a secure communication path between other network nodes and a terminal, the steps include generating a key to be used by the other network node, which will have a different value for each type or network slice, based on information indicating the type of the other network node or the network slice to which the other network node belongs, The step of sending a message containing the key to the other network node, The communication method used by network nodes. (Section 5) The steps include receiving a message from another network node containing a key to establish a secure communication channel with the terminal, The steps include generating a key for confidentiality and a key for integrity protection based on the aforementioned key, The process includes the step of using a secure communication path between the other network node and the terminal to send a message to the terminal indicating that it is in security mode. The communication method used by network nodes. (Section 6) A communication method performed by a communication system including a first network node and a second network node, The first network node is, In order to establish a secure communication path between the second network node and the terminal, a key to be used by the second network node is generated such that it has a different value for each type or network slice, based on information indicating the type of the second network node or the network slice to which the second network node belongs. A message containing the aforementioned key is sent to the second network node. The second network node is, A message containing the aforementioned key is received from the first network node. Based on the aforementioned key, a key for concealment and a key for integrity protection are generated. Using the secure communication path between the first network node and the terminal, a message indicating security mode is sent to the terminal. Communication method.

[0090] In any of the above configurations, a technology is provided that enables the localization or shortening of the NAS signal transmission path while ensuring security. According to paragraph 1, in order to establish a secure communication path between other network nodes and a terminal, a message containing a key to be used by the other network node can be sent to the other network node, which is generated to have a different value for each type or network slice based on information indicating the type of the other network node or the network slice to which the other network node belongs. According to paragraph 2, based on the key, a key for concealment and a key for integrity protection can be generated, and a message indicating the security mode can be sent to the terminal using the secure communication path between the other network node and the terminal.

[0091] (Hardware configuration) The block diagrams (Figures 8 and 9) used in the description of the above embodiments show functional units. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method of realizing each functional block is not particularly limited. That is, each functional block may be realized using one device that is physically or logically coupled, or it may be realized using two or more physically or logically separated devices that are directly or indirectly connected (for example, using wired or wireless connections). A functional block may be realized by combining the above one device or the above multiple devices with software.

[0092] Functions include, but are not limited to, judgment, decision, judgment, calculation, calculation, processing, derivation, investigation, exploration, confirmation, reception, transmission, output, access, resolution, selection, selection, establishment, comparison, assumption, expectation, assumption, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating (mapping), and assigning. For example, a functional block (configuration part) that enables transmission is called a transmitting unit or transmitter. As mentioned above, the method of implementation is not particularly limited.

[0093] For example, the network node, terminal 20, etc. in one embodiment of the present disclosure may function as a computer that processes the wireless communication method of the present disclosure. Figure 10 is a diagram showing an example of the hardware configuration of a base station 10 and a terminal 20 according to one embodiment of the present disclosure. The network node may have the same hardware configuration as the base station 10. The USIM may have the same hardware configuration as the terminal 20. The base station 10 and terminal 20 described above may be physically configured as a computer device including a processor 1001, a storage device 1002, an auxiliary storage device 1003, a communication device 1004, an input device 1005, an output device 1006, a bus 1007, etc.

[0094] In the following explanation, the term "device" can be replaced with "circuit," "device," "unit," etc. The hardware configuration of the base station 10 and terminal 20 may include one or more of the devices shown in the figure, or it may be configured to omit some of the devices.

[0095] Each function in the base station 10 and terminal 20 is realized by loading predetermined software (programs) onto hardware such as the processor 1001 and storage device 1002, which allows the processor 1001 to perform calculations, control communication by the communication device 1004, and control at least one of the reading and writing of data in the storage device 1002 and auxiliary storage device 1003.

[0096] The processor 1001 controls the entire computer, for example, by running an operating system. The processor 1001 may consist of a central processing unit (CPU) that includes interfaces with peripheral devices, control devices, arithmetic units, registers, etc. For example, the control unit 140, control unit 240, etc., described above may be implemented by the processor 1001.

[0097] Furthermore, the processor 1001 reads programs (program code), software modules, or data from at least one of the auxiliary storage device 1003 and the communication device 1004 into the storage device 1002, and executes various processes accordingly. The program used is one that causes a computer to execute at least a part of the operations described in the above embodiment. For example, the control unit 140 of the base station 10 shown in Figure 8 may be implemented by a control program stored in the storage device 1002 and operated by the processor 1001. Also, for example, the control unit 240 of the terminal 20 shown in Figure 9 may be implemented by a control program stored in the storage device 1002 and operated by the processor 1001. Although the above-described processes have been explained as being executed by one processor 1001, they may be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 may be implemented by one or more chips. The program may be transmitted from the network via a telecommunications line.

[0098] The storage device 1002 is a computer-readable recording medium and may consist of at least one of the following: ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), RAM (Random Access Memory), etc. The storage device 1002 may also be called a register, cache, main memory, etc. The storage device 1002 can store executable programs (program code), software modules, etc., for implementing a communication method according to one embodiment of this disclosure.

[0099] The auxiliary storage device 1003 is a computer-readable recording medium and may consist of at least one of the following: an optical disc such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (e.g., a compact disc, a digital multipurpose disc, a Blu-ray® disc), a smart card, flash memory (e.g., a card, a stick, a key drive), a floppy® disk, a magnetic strip, etc. The above-mentioned storage medium may also be a database, server, or other suitable medium that includes at least one of the storage device 1002 and the auxiliary storage device 1003.

[0100] The communication device 1004 is hardware (transceiver / receiver device) for communicating between computers via at least one of a wired network and a wireless network, and is also referred to as a network device, network controller, network card, communication module, etc. The communication device 1004 may include high-frequency switches, duplexers, filters, frequency synthesizers, etc., to implement at least one of frequency division duplex (FDD) and time division duplex (TDD). For example, the transmit / receive antenna, amplifier section, transmit / receive section, transmission path interface, etc., may be implemented by the communication device 1004. The transmit / receive section may be implemented with physically or logically separated transmitting and receiving sections.

[0101] The input device 1005 is an input device that accepts input from an external source (e.g., a keyboard, mouse, microphone, switch, button, sensor, etc.). The output device 1006 is an output device that outputs to an external source (e.g., a display, speaker, LED lamp, etc.). The input device 1005 and the output device 1006 may be configured as an integrated unit (e.g., a touch panel).

[0102] Furthermore, each device, such as the processor 1001 and the storage device 1002, is connected by a bus 1007 for communicating information. The bus 1007 may be configured using a single bus, or different buses may be configured for each device.

[0103] Furthermore, the base station 10 and terminal 20 may be configured to include hardware such as a microprocessor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), and an FPGA (Field Programmable Gate Array), and some or all of each functional block may be realized by such hardware. For example, the processor 1001 may be implemented using at least one of these hardware components.

[0104] Figure 11 shows an example of the configuration of vehicle 2001. As shown in Figure 11, vehicle 2001 comprises a drive unit 2002, a steering unit 2003, an accelerator pedal 2004, a brake pedal 2005, a shift lever 2006, front wheels 2007, rear wheels 2008, an axle 2009, an electronic control unit 2010, various sensors 2021-2029, an information service unit 2012, and a communication module 2013. Each aspect / embodiment described in this disclosure may be applied to a communication device mounted on vehicle 2001, for example, to the communication module 2013.

[0105] The drive unit 2002 consists of, for example, an engine, a motor, or a hybrid of an engine and a motor. The steering unit 2003 includes at least a steering wheel (also called a handle) and is configured to steer at least one of the front wheels and the rear wheels based on the operation of the steering wheel, which is operated by the user.

[0106] The electronic control unit 2010 consists of a microprocessor 2031, memory (ROM, RAM) 2032, and communication ports (IO ports) 2033. Signals from various sensors 2021 to 2029 installed in the vehicle 2001 are input to the electronic control unit 2010. The electronic control unit 2010 may also be called an ECU (Electronic Control Unit).

[0107] Signals from various sensors 2021-2029 include current signals from current sensor 2021 which senses motor current, front and rear wheel rotation speed signals obtained by rotation speed sensor 2022, front and rear wheel air pressure signals obtained by air pressure sensor 2023, vehicle speed signals obtained by vehicle speed sensor 2024, acceleration signals obtained by acceleration sensor 2025, accelerator pedal depression signals obtained by accelerator pedal sensor 2029, brake pedal depression signals obtained by brake pedal sensor 2026, shift lever operation signals obtained by shift lever sensor 2027, and detection signals obtained by object detection sensor 2028 for detecting obstacles, vehicles, pedestrians, etc.

[0108] The Information Services Unit 2012 consists of various devices for providing (outputting) various types of information such as driving information, traffic information, and entertainment information, including a car navigation system, audio system, speakers, television, and radio, and one or more ECUs that control these devices. The Information Services Unit 2012 uses information acquired from external devices via a communication module 2013, etc., to provide various multimedia information and multimedia services to the occupants of the vehicle 2001.

[0109] Information Services Section 2012 may include input devices that accept input from external sources (e.g., keyboards, mice, microphones, switches, buttons, sensors, touch panels, etc.) and output devices that perform output to external sources (e.g., displays, speakers, LED lamps, touch panels, etc.).

[0110] The driver assistance system unit 2030 consists of various devices that provide functions to prevent accidents or reduce the driver's workload, such as millimeter-wave radar, LiDAR (Light Detection and Ranging), cameras, positioning locators (e.g., GNSS), map information (e.g., high-definition (HD) maps, autonomous vehicle (AV) maps, etc.), gyro systems (e.g., IMU (Inertial Measurement Unit), INS (Inertial Navigation System), etc.), AI (Artificial Intelligence) chips, and AI processors, as well as one or more ECUs that control these devices. The driver assistance system unit 2030 also sends and receives various information via the communication module 2013 to realize driver assistance functions or autonomous driving functions.

[0111] The communication module 2013 can communicate with the microprocessor 2031 and components of the vehicle 2001 via its communication port. For example, the communication module 2013 sends and receives data via its communication port 2033 to the drive unit 2002, steering unit 2003, accelerator pedal 2004, brake pedal 2005, shift lever 2006, front wheels 2007, rear wheels 2008, axle 2009, the microprocessor 2031 and memory (ROM, RAM) 2032 in the electronic control unit 2010, and sensors 2021-29 provided in the vehicle 2001.

[0112] The communication module 2013 is a communication device that can be controlled by the microprocessor 2031 of the electronic control unit 2010 and can communicate with external devices. For example, it can send and receive various types of information to and from external devices via wireless communication. The communication module 2013 may be located either inside or outside the electronic control unit 2010. The external device may be, for example, a base station or a mobile station.

[0113] The communication module 2013 may transmit at least one of the following to an external device via wireless communication: signals from the various sensors 2021-2029 input to the electronic control unit 2010, information obtained based on said signals, and information based on input from an external source (user) obtained via the information service unit 2012. The electronic control unit 2010, the various sensors 2021-2029, the information service unit 2012, etc., may also be called input units that accept input. For example, the PUSCH transmitted by the communication module 2013 may include information based on the above input.

[0114] The communication module 2013 receives various information (traffic information, signal information, vehicle-to-vehicle information, etc.) transmitted from an external device and displays it on the information service unit 2012 installed in the vehicle 2001. The information service unit 2012 may also be called an output unit, which outputs information (for example, it outputs information to devices such as displays and speakers based on the PDSCH (or data / information decoded from the PDSCH) received by the communication module 2013).

[0115] Furthermore, the communication module 2013 stores various information received from external devices in memory 2032, which is available to the microprocessor 2031. Based on the information stored in memory 2032, the microprocessor 2031 may control the drive unit 2002, steering unit 2003, accelerator pedal 2004, brake pedal 2005, shift lever 2006, front wheels 2007, rear wheels 2008, axles 2009, sensors 2021-2029, etc., which are provided in the vehicle 2001.

[0116] (Supplement to the embodiment) While embodiments of the present invention have been described above, the disclosed invention is not limited to such embodiments, and those skilled in the art will understand various modifications, alterations, alternatives, substitutions, etc. Specific numerical examples have been used to facilitate understanding of the invention, but unless otherwise specified, these numerical values ​​are merely examples, and any appropriate values ​​may be used. The division of items in the above description is not essential to the present invention, and matters described in two or more items may be combined as needed, and matters described in one item may be applied to matters described in another item (as long as they do not contradict each other). The boundaries of functional units or processing units in the functional block diagram do not necessarily correspond to the boundaries of physical parts. The operation of multiple functional units may be physically performed by one part, or the operation of one functional unit may be physically performed by multiple parts. Regarding the processing procedures described in the embodiments, the order of processing may be changed as long as it does not contradict each other. For the convenience of explaining the processing, the base station 10 and terminal 20 have been described using functional block diagrams, but such devices may be implemented in hardware, software, or a combination thereof. The software operated by the processor of the base station 10 according to an embodiment of the present invention and the software operated by the processor of the terminal 20 according to an embodiment of the present invention may be stored in random access memory (RAM), flash memory, read-only memory (ROM), EPROM, EEPROM, registers, hard disk (HDD), removable disk, CD-ROM, database, server, or any other suitable storage medium.

[0117] Furthermore, the notification of information is not limited to the embodiments / models described herein and may be carried out by other methods. For example, the notification of information may be carried out by physical layer signaling (e.g., DCI (Downlink Control Information), UCI (Uplink Control Information)), upper layer signaling (e.g., RRC (Radio Resource Control) signaling, MAC (Medium Access Control) signaling), broadcast information (MIB (Master Information Block), SIB (System Information Block)), other signals, or combinations thereof. Also, RRC signaling may be called RRC messages, and may be, for example, RRC Connection Setup messages, RRC Connection Reconfiguration messages, etc.

[0118] Each aspect / embodiment described in this disclosure includes LTE (Long Term Evolution), LTE-A (LTE-Advanced), SUPER 3G, IMT-Advanced, 4G (4th generation mobile communication system), 5G (5th generation mobile communication system), 6th generation mobile communication system (6G), xth generation mobile communication system (xG) (xG (where x is, for example, an integer or decimal)), FRA (Future Radio Access), NR (new Radio), New radio access (NX), Future generation radio access (FX), W-CDMA (registered trademark), GSM (registered trademark), CDMA2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), and IEEE This may apply to at least one system utilizing 802.20, UWB (Ultra-WideBand), Bluetooth®, or other appropriate systems, and to next-generation systems extended, modified, created, or defined based thereon. It may also apply to a combination of multiple systems (for example, a combination of at least one of LTE and LTE-A with 5G).

[0119] The processing procedures, sequences, flowcharts, etc., of each aspect / embodiment described herein may be reordered, provided they are consistent with each other. For example, the methods described herein present various step elements in an exemplary order and are not limited to that specific order.

[0120] In this specification, specific operations performed by the base station 10 may, in some cases, be performed by its upper node. In a network consisting of one or more network nodes having a base station 10, it is clear that various operations performed for communication with the terminal 20 can be performed by the base station 10 and at least one of the other network nodes (for example, an MME or S-GW, but not limited to these). Although the above example illustrates the case where there is one other network node besides the base station 10, the other network node may be a combination of multiple other network nodes (for example, an MME and an S-GW).

[0121] The information or signals described in this disclosure may be output from a higher layer (or lower layer) to a lower layer (or higher layer). They may also be input and output via multiple network nodes.

[0122] Input and output information may be stored in a specific location (e.g., memory) or managed using a management table. Input and output information may be overwritten, updated, or appended to. Output information may be deleted. Input information may be transmitted to other devices.

[0123] The determination in this disclosure may be made by a value represented by one bit (0 or 1), by a boolean value (true or false), or by a numerical comparison (for example, a comparison with a predetermined value).

[0124] Software should be broadly interpreted to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, execution threads, procedures, functions, and so on, whether they are called software, firmware, middleware, microcode, hardware description languages, or by any other name.

[0125] Furthermore, software, instructions, information, etc., may be transmitted and received via a transmission medium. For example, if software is transmitted from a website, server, or other remote source using at least one of wired technology (such as coaxial cable, fiber optic cable, twisted pair, or digital subscriber line (DSL)) and wireless technology (such as infrared or microwave), then at least one of these wired and wireless technologies is included in the definition of a transmission medium.

[0126] The information, signals, etc. described in this disclosure may be represented using any of the various different techniques. For example, the data, instructions, commands, information, signals, bits, symbols, chips, etc. that may be referred to throughout the above description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or photons, or any combination thereof.

[0127] In addition, terms used in this disclosure and terms necessary for understanding this disclosure may be replaced with terms having the same or similar meanings. For example, at least one of the channel and symbol may be a signal (signaling). Also, a signal may be a message. Furthermore, a component carrier (CC) may be called a carrier frequency, cell, frequency carrier, etc.

[0128] The terms “system” and “network” as used in this disclosure are interchangeable.

[0129] Furthermore, the information, parameters, etc., described in this disclosure may be expressed using absolute values, relative values ​​from a given value, or corresponding other information. For example, wireless resources may be indicated by an index.

[0130] The names used for the parameters described above are not restrictive in any way. Furthermore, the formulas and other expressions using these parameters may differ from those expressly disclosed in this disclosure. Various channels (e.g., PUCCH, PDCCH, etc.) and information elements can be identified by any suitable name, and therefore, the various names assigned to these various channels and information elements are not restrictive in any way.

[0131] In this disclosure, terms such as "Base Station (BS)", "wireless base station", "base station", "fixed station", "NodeB", "eNodeB (eNB)", "gNodeB (gNB)", "access point", "transmission point", "reception point", "transmission / reception point", "cell", "sector", "cell group", "carrier", and "component carrier" may be used interchangeably. Base stations may also be referred to by terms such as macrocell, small cell, femtocell, and picocell.

[0132] A base station can house one or more (e.g., three) cells. If a base station houses multiple cells, the entire coverage area of ​​the base station can be divided into several smaller areas, each of which may also be provided with communication services by a base station subsystem (e.g., a Remote Radio Head (RRH)). The terms “cell” or “sector” refer to part or all of the coverage area of ​​at least one of the base station and / or base station subsystems that provide communication services in that coverage.

[0133] In this disclosure, the transmission of information by a base station to a terminal may be interpreted as the base station instructing the terminal to perform information-based control or operation.

[0134] In this disclosure, terms such as "Mobile Station (MS)," "user terminal," "User Equipment (UE)," and "terminal" may be used interchangeably.

[0135] A mobile station may also be referred to by those skilled in the art as a subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, or several other appropriate terms.

[0136] At least one of the base station and the mobile station may be called a transmitting device, a receiving device, a communication device, etc. At least one of the base station and the mobile station may also be a device mounted on a mobile body, the mobile body itself, etc. The mobile body refers to a movable object, and its speed of movement is arbitrary. This also includes the case when the mobile body is stationary. The mobile body includes, but is not limited to, vehicles, transport vehicles, automobiles, motorcycles, bicycles, connected cars, excavators, bulldozers, wheel loaders, dump trucks, forklifts, trains, buses, handcarts, rickshaws, ships and other watercraft, airplanes, rockets, satellites, drones (registered trademark), multicopters, quadcopters, balloons, and items mounted on them. The mobile body may also be a mobile body that moves autonomously based on operation commands. It may be a vehicle (e.g., a car, an airplane, etc.), an unmanned mobile body (e.g., a drone, an autonomous vehicle, etc.), or a robot (manned or unmanned). Furthermore, at least one of the base station and the mobile station may include devices that do not necessarily move during communication operations. For example, at least one of the base station and the mobile station may be an IoT (Internet of Things) device such as a sensor.

[0137] Furthermore, the term "base station" in this disclosure may be interpreted as "user terminal." For example, the various aspects / embodiments of this disclosure may be applied to a configuration in which communication between a base station and a user terminal is replaced with communication between multiple terminals 20 (which may be called, for example, D2D (Device-to-Device), V2X (Vehicle-to-Everything), etc.). In this case, the terminals 20 may have the functions that the base station 10 has. Also, terms such as "uplink" and "downlink" may be interpreted as terms corresponding to terminal-to-terminal communication (for example, "side"). For example, uplink channel, downlink channel, etc., may be interpreted as side channel.

[0138] Similarly, the term "user terminal" in this disclosure may be replaced with "base station." In this case, the base station may be configured to have the same functions as the user terminal described above.

[0139] As used in this disclosure, the terms “determining” and “determining” may encompass a wide variety of actions. “Determining” may include, for example, judging, calculating, computing, processing, deriving, investigating, looking up, searching, inquiry (e.g., searching in a table, database, or other data structure), and ascertaining. “Determining” may also include, for example, receiving (e.g., receiving information), transmitting (e.g., sending information), input, output, and accessing (e.g., accessing data in memory). Furthermore, "judgment" and "decision" can include considering something as having been "judged" or "decided" after resolving, selecting, choosing, establishing, comparing, etc. In other words, "judgment" and "decision" can include considering something as having been "judged" or "decided" after some action. Also, "judgment (decision)" can be reinterpreted as "assuming," "expecting," or "considering."

[0140] The terms “connected,” “coupled,” or any variation thereof, mean any direct or indirect connection or coupling between two or more elements, and may include the presence of one or more intermediate elements between two elements that are “connected” or “coupled” with each other. The coupling or connection between elements may be physical, logical, or a combination thereof. For example, “connection” may be reinterpreted as “access.” As used in this disclosure, two elements may be considered to be “connected” or “coupled” with each other using at least one of one or more wires, cables, and printed electrical connections, and, in some non-limiting and non-exclusive examples, electromagnetic energy having wavelengths in the radio frequency domain, microwave domain, and optical (both visible and invisible) domain.

[0141] The reference signal can also be abbreviated as RS (Reference Signal), and may be called a pilot depending on the applicable standard.

[0142] In this disclosure, the phrase "based on" does not mean "based solely on" unless otherwise specified. In other words, the phrase "based on" means both "based solely on" and "based at least on."

[0143] Any reference to elements using the designations “first,” “second,” etc., as used in this disclosure does not generally limit the quantity or order of those elements. These designations may be used in this disclosure as a convenient way to distinguish between two or more elements. Accordingly, references to the first and second elements do not imply that only two elements may be employed, or that the first element must precede the second element in any way.

[0144] In the configuration of each of the above devices, "means" may be replaced with "part," "circuit," "device," etc.

[0145] Where the terms “include,” “including,” and variations thereof are used in this disclosure, these terms are intended to be inclusive, as is the term “comprising.” Furthermore, the term “or” as used in this disclosure is not intended to mean exclusive OR.

[0146] A wireless frame may consist of one or more frames in the time domain. Each of these frames in the time domain may be called a subframe. A subframe may further consist of one or more slots in the time domain. A subframe may have a fixed time length (e.g., 1 ms) that is independent of numerology.

[0147] Numerical logic may be communication parameters applied to at least one of the transmission and reception of a signal or channel. Numerical logic may include, for example, at least one of the following: subcarrier spacing (SCS), bandwidth, symbol length, cyclic prefix length, transmission time interval (TTI), number of symbols per TTI, radio frame configuration, specific filtering processes performed by the transceiver in the frequency domain, and specific windowing processes performed by the transceiver in the time domain.

[0148] A slot may consist of one or more symbols in the time domain (such as OFDM (Orthogonal Frequency Division Multiplexing) symbols, SC-FDMA (Single Carrier Frequency Division Multiple Access) symbols, etc.). A slot may also be a time unit based on neurology.

[0149] A slot may include multiple minislots. Each minislot may consist of one or more symbols in the time domain. Minislots may also be called subslots. Minislots may consist of fewer symbols than a slot. A PDSCH (or PUSCH) transmitted in a time unit larger than a minislot may be called PDSCH (or PUSCH) mapping type A. A PDSCH (or PUSCH) transmitted using a minislot may be called PDSCH (or PUSCH) mapping type B.

[0150] Wireless frames, subframes, slots, minislots, and symbols all represent units of time when transmitting a signal. Different names may be used for each of these terms.

[0151] For example, one subframe may be called a Transmission Time Interval (TTI), multiple consecutive subframes may be called a TTI, or one slot or one mini-slot may be called a TTI. In other words, at least one of a subframe and a TTI may be a subframe (1 ms) in existing LTE, a period shorter than 1 ms (e.g., 1-13 symbols), or a period longer than 1 ms. Note that the unit representing the TTI may be called a slot, mini-slot, etc., instead of a subframe.

[0152] Here, TTI refers to, for example, the smallest unit of time for scheduling in wireless communication. For example, in an LTE system, the base station schedules each terminal 20 to allocate wireless resources (such as the frequency bandwidth and transmission power available to each terminal 20) in TTI units. However, the definition of TTI is not limited to this.

[0153] TTI may be a transmission time unit for channel-encoded data packets (transport blocks), code blocks, code words, etc., or it may be a processing unit for scheduling, link adaptation, etc. Given a TTI, the actual time interval (e.g., number of symbols) to which the transport block, code block, code word, etc. are mapped may be shorter than the given TTI.

[0154] Furthermore, if one slot or one mini-slot is referred to as TTI, then one or more TTIs (i.e., one or more slots or one or more mini-slots) may constitute the minimum time unit of scheduling. In addition, the number of slots (number of mini-slots) that constitute the minimum time unit of scheduling may be controlled.

[0155] A TTI with a time length of 1ms may also be called a normal TTI, long TTI, normal subframe, long subframe, slot, etc. A TTI shorter than a normal TTI may also be called a shortened TTI, short TTI, partial or fractional TTI, shortened subframe, short subframe, mini slot, sub slot, slot, etc.

[0156] Furthermore, long TTIs (e.g., normal TTIs, subframes, etc.) may be interpreted as TTIs with a time length exceeding 1 ms, and short TTIs (e.g., shortened TTIs, etc.) may be interpreted as TTIs with a TTI length less than that of a long TTI but 1 ms or more.

[0157] A resource block (RB) is a resource allocation unit in the time domain and frequency domain, and in the frequency domain, it may contain one or more consecutive subcarriers. The number of subcarriers in an RB may be the same regardless of the neurology, for example, 12. The number of subcarriers in an RB may be determined based on the neurology.

[0158] Furthermore, the time domain of the RB may contain one or more symbols and may be the length of one slot, one minislot, one subframe, or one TTI. Each TTI, subframe, etc., may consist of one or more resource blocks.

[0159] One or more RBs may also be called a Physical RB (PRB), Sub-Carrier Group (SCG), Resource Element Group (REG), PRB pair, RB pair, etc.

[0160] Furthermore, a resource block may consist of one or more resource elements (REs). For example, one RE may be a radio resource area comprising one subcarrier and one symbol.

[0161] A Bandwidth Part (BWP), also known as a partial bandwidth, may represent a subset of consecutive common resource blocks (RBs) for a particular neurology system in a given carrier. These common RBs may be identified by an index of the RBs relative to a common reference point of the carrier. A Bandwidth Part (PRB) may be defined and numbered within a given BWP.

[0162] A BWP may include a BWP for UL (Ultraviolet Link) and a BWP for DL ​​(Download Link). One or more BWPs may be set for a terminal 20 within a single carrier.

[0163] At least one of the configured BWPs may be active, and terminal 20 does not need to be expected to send or receive a predetermined signal / channel outside of the active BWP. In this disclosure, terms such as "cell" and "carrier" may be read as "BWP".

[0164] The structures described above, such as wireless frames, subframes, slots, minislots, and symbols, are merely illustrative. For example, the number of subframes included in a wireless frame, the number of slots per subframe or wireless frame, the number of minislots included in a slot, the number of symbols and RBs included in a slot or minislot, the number of subcarriers included in an RB, and the number of symbols, symbol length, and cyclic prefix (CP) length within a TTI can be varied in various ways.

[0165] In this disclosure, if articles are added through translation, such as a, an, and the in English, this disclosure may include the fact that the noun following these articles is plural.

[0166] In this disclosure, the term "A and B are different" may mean "A and B are different from each other." The term may also mean "A and B are each different from C." Terms such as "separate" and "combine" may be interpreted similarly to "different."

[0167] Each aspect / embodiment described herein may be used individually, in combination, or switched between as needed during implementation. Furthermore, notification of specific information (e.g., notification that "X is") is not limited to explicit notification, but may also be implicit (e.g., by not providing such notification).

[0168] Although the present disclosure has been described in detail above, it will be clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the intent and scope of the present disclosure as defined by the claims. Therefore, the descriptions in the present disclosure are illustrative and not intended to be restrictive in any way. [Explanation of Symbols]

[0169] 10 Base station (RAN) 11 satellites 110 Transmitter 120 Receiver 130 Setting section 140 Control Unit 20 devices 30 Core Network 40 DN 210 Transmitter 220 Receiver 230 Setting section 240 Control Unit 310 CAMF 320 UDM 330 NEF 340 NRF 350 AUSF 360 PCF 361 UE-PCF 370 SMF 380 UPF 390 AF 391 LMF 1001 Processor 1002 Storage device 1003 Auxiliary storage device 1004 Communication device 1005 Input device 1006 Output device 2001 Vehicle 2002 Drive Unit 2003 Steering Department 2004 Accelerator pedal 2005 Brake pedal 2006 Shift Lever 2007 Front Wheel 2008 Rear wheel 2009 Axle 2010 Electronic Control Unit 2012 Information Services Department 2013 Communication Module 2021 Current Sensor 2022 Rotation speed sensor 2023 Pneumatic Sensor 2024 Vehicle Speed ​​Sensor 2025 Accelerometer 2026 Brake Pedal Sensor 2027 Shift lever sensor 2028 Object Detection Sensor 2029 Accelerator pedal sensor 2030 Driver Support Systems Department 2031 Microprocessor 2032 memory (ROM, RAM) 2033 Communication port (I / O port)

Claims

1. A control unit that generates keys to be used by other network nodes, based on information indicating the type of other network node, such that each key has a different value, in order to establish a secure communication path between other network nodes and a terminal. The system includes a transmitting unit that transmits a message containing the key to the other network node. Network node.

2. A receiving unit that receives messages from other network nodes containing keys for establishing a secure communication path with the terminal, A control unit that generates a key for concealment and a key for integrity protection based on the aforementioned key, The system includes a transmitting unit that uses a secure communication path between the other network node and the terminal to send a message to the terminal indicating that it is in security mode. Network node.

3. A communication system including a first network node and a second network node, The first network node is, A control unit that generates keys to be used at the second network node, based on information indicating the type of the second network node, such that the keys have different values ​​for each type, in order to establish a secure communication path between the second network node and the terminal. The system includes a transmitting unit that transmits a message containing the key to the second network node, The second network node is, A receiving unit that receives a message containing the key from the first network node, A control unit that generates a key for concealment and a key for integrity protection based on the aforementioned key, The system includes a transmitting unit that transmits a message indicating security mode to the terminal using a secure communication path between the first network node and the terminal. Communication system.

4. In order to establish a secure communication path between other network nodes and a terminal, the steps include generating keys to be used by the other network nodes, based on information indicating the type of the other network node, such that each key has a different value; The step of sending a message containing the key to the other network node, The communication method used by network nodes.

5. The steps include receiving a message from another network node containing a key to establish a secure communication channel with the terminal, The steps include generating a key for confidentiality and a key for integrity protection based on the aforementioned key, The process includes the step of using a secure communication path between the other network node and the terminal to send a message to the terminal indicating that it is in security mode. The communication method used by network nodes.

6. A communication method performed by a communication system including a first network node and a second network node, The first network node is, In order to establish a secure communication path between the second network node and the terminal, based on information indicating the type of the second network node, a key to be used by the second network node is generated such that it has a different value for each type. A message containing the aforementioned key is sent to the second network node. The second network node is, A message containing the aforementioned key is received from the first network node. Based on the aforementioned key, a key for concealment and a key for integrity protection are generated. Using the secure communication path between the first network node and the terminal, a message indicating security mode is sent to the terminal. Communication method.

Images