Efficient user equipment authentication

Abstract

There are provided measures for efficient user equipment authentication Such measures exemplarily comprise, e.g. at a management function entity, receiving, from a target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of a user equipment, checking at least one mobility processing precondition, and transmitting, if said at least one mobility processing precondition is satisfied, towards said target access node, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node.

Description

[0001] EFFICIENT USER. EQUIPMENT AUTHENTICATION

[0002] Field

[0003] Various example embodiments relate to efficient user equipment authentication. More specifically, various example embodiments exemplarily relate to measures (including methods, apparatuses and computer program products) for realizing efficient user equipment authentication.

[0004] Background

[0005] The present specification generally relates to access to 3rdGeneration Partnership Project (3GPP) networks via non-3GPP network entry points, security aspects and efficiency aspects hereof.

[0006] In such context, authentication of communication endpoints such as user equipments seeking for access to the 3GPP network via a non-3GPP network entry point and of non-3GPP network entry points may be signaling intense and time consuming.

[0007] Hence, the problem arises that less signaling intense and time consuming approaches for authentication of user equipments seeking for access to the 3GPP network via a non-3GPP network entry point and of non-3GPP network entry points that do not weaken security are necessary.

[0008] Hence, there is a need to provide for efficient user equipment authentication.

[0009] Summary

[0010] Various example embodiments aim at addressing at least part of the above issues and / or problems and drawbacks.

[0011] Various aspects of example embodiments are set out in the appended claims. According to an exemplary aspect, there is provided a method of a user equipment configured to move from a source access node to a target access node, the method comprising transmitting, towards said target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of said user equipment, and receiving, from said target access node, a response message indicative of mobility processing success, said response message comprising an indication to derive a key for access via said target access node.

[0012] According to an exemplary aspect, there is provided a method of a target access node, the method comprising receiving, from a user equipment, a first registration message demanding mobility processing, said first registration message comprising a temporary identifier of said user equipment, analyzing said temporary identifier of said user equipment for whether said temporary identifier of said user equipment is valid for a network said target access node provides access to, and transmitting, if said temporary identifier of said user equipment is valid for said network said target access node provides access to, towards a management function entity, a second registration message demanding mobility processing, said second registration message comprising said temporary identifier of said user equipment.

[0013] According to an exemplary aspect, there is provided a method of a management function entity, the method comprising receiving, from a target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of a user equipment, checking at least one mobility processing precondition, and transmitting, if said at least one mobility processing precondition is satisfied, towards said target access node, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node. According to an exemplary aspect, there is provided a method of a source access node, the method comprising receiving, from a management function entity, a key request, deriving a key for access via said target access node, and transmitting, towards said management function entity, said key for access via said target access node.

[0014] According to an exemplary aspect, there is provided a method of a user equipment, the method comprising transmitting, towards an access node, a registration message, wherein said registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes.

[0015] According to an exemplary aspect, there is provided a method of an access node, the method comprising receiving, from a user equipment, a first registration message, said first registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and transmitting, towards a management function entity, a second registration message, said second registration message comprising said indication of said user equipment ability for mobility processing in relation to movement between access nodes.

[0016] According to an exemplary aspect, there is provided a method of a management function entity, the method comprising receiving, from an access node, a registration message, said registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and storing information on said user equipment ability for mobility processing in relation to movement between access nodes.

[0017] According to an exemplary aspect, there is provided an apparatus of a user equipment configured to move from a source access node to a target access node, the apparatus comprising transmitting circuitry configured to transmit, towards said target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of said user equipment, and receiving circuitry configured to receive, from said target access node, a response message indicative of mobility processing success, said response message comprising an indication to derive a key for access via said target access node.

[0018] According to an exemplary aspect, there is provided an apparatus of a target access node, the apparatus comprising receiving circuitry configured to receive, from a user equipment, a first registration message demanding mobility processing, said first registration message comprising a temporary identifier of said user equipment, analyzing circuitry configured to analyze said temporary identifier of said user equipment for whether said temporary identifier of said user equipment is valid for a network said target access node provides access to, and transmitting circuitry configured to transmit, if said temporary identifier of said user equipment is valid for said network said target access node provides access to, towards a management function entity, a second registration message demanding mobility processing, said second registration message comprising said temporary identifier of said user equipment.

[0019] According to an exemplary aspect, there is provided an apparatus of a management function entity, the apparatus comprising receiving circuitry configured to receive, from a target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of a user equipment, checking circuitry configured to check at least one mobility processing precondition, and transmitting circuitry configured to transmit, if said at least one mobility processing precondition is satisfied, towards said target access node, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node.

[0020] According to an exemplary aspect, there is provided an apparatus of a source access node, the apparatus comprising receiving circuitry configured to receive, from a management function entity, a key request, deriving circuitry configured to derive a key for access via said target access node, and transmitting circuitry configured to transmit, towards said management function entity, said key for access via said target access node.

[0021] According to an exemplary aspect, there is provided an apparatus of a user equipment, the apparatus comprising transmitting circuitry configured to transmit, towards an access node, a registration message, wherein said registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes.

[0022] According to an exemplary aspect, there is provided an apparatus of an access node, the apparatus comprising receiving circuitry configured to receive, from a user equipment, a first registration message, said first registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and transmitting circuitry configured to transmit, towards a management function entity, a second registration message, said second registration message comprising said indication of said user equipment ability for mobility processing in relation to movement between access nodes.

[0023] According to an exemplary aspect, there is provided an apparatus of a management function entity, the apparatus comprising receiving circuitry configured to receive, from an access node, a registration message, said registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and storing circuitry configured to store information on said user equipment ability for mobility processing in relation to movement between access nodes.

[0024] According to an exemplary aspect, there is provided an apparatus of a user equipment configured to move from a source access node to a target access node, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform transmitting, towards said target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of said user equipment, and receiving, from said target access node, a response message indicative of mobility processing success, said response message comprising an indication to derive a key for access via said target access node.

[0025] According to an exemplary aspect, there is provided an apparatus of a user equipment configured to move from a source access node to a target access node, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform receiving, from a user equipment, a first registration message demanding mobility processing, said first registration message comprising a temporary identifier of said user equipment, analyzing said temporary identifier of said user equipment for whether said temporary identifier of said user equipment is valid for a network said target access node provides access to, and transmitting, if said temporary identifier of said user equipment is valid for said network said target access node provides access to, towards a management function entity, a second registration message demanding mobility processing, said second registration message comprising said temporary identifier of said user equipment.

[0026] According to an exemplary aspect, there is provided an apparatus of a user equipment configured to move from a source access node to a target access node, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform receiving, from a target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of a user equipment, checking at least one mobility processing precondition, and transmitting, if said at least one mobility processing precondition is satisfied, towards said target access node, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node.

[0027] According to an exemplary aspect, there is provided an apparatus of a user equipment configured to move from a source access node to a target access node, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform receiving, from a management function entity, a key request, deriving a key for access via said target access node, and transmitting, towards said management function entity, said key for access via said target access node.

[0028] According to an exemplary aspect, there is provided an apparatus of a user equipment configured to move from a source access node to a target access node, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform transmitting, towards an access node, a registration message, wherein said registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes.

[0029] According to an exemplary aspect, there is provided an apparatus of a user equipment configured to move from a source access node to a target access node, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform receiving, from a user equipment, a first registration message, said first registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and transmitting, towards a management function entity, a second registration message, said second registration message comprising said indication of said user equipment ability for mobility processing in relation to movement between access nodes.

[0030] According to an exemplary aspect, there is provided an apparatus of a user equipment configured to move from a source access node to a target access node, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform receiving, from an access node, a registration message, said registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and storing information on said user equipment ability for mobility processing in relation to movement between access nodes.

[0031] According to an exemplary aspect, there is provided a computer program product comprising computer-executable computer program code which, when the program is run on a computer (e.g. a computer of an apparatus according to any one of the aforementioned apparatus-related exemplary aspects of the present disclosure), is configured to cause the computer to carry out the method according to any one of the aforementioned method- related exemplary aspects of the present disclosure. Such computer program product may comprise (or be embodied) a (tangible) computer-readable (storage) medium or the like on which the computerexecutable computer program code is stored, and / or the program may be directly loadable into an internal memory of the computer or a processor thereof.

[0032] Any one of the above aspects enables time and signaling efficient user equipment authentication to thereby solve at least part of the problems and drawbacks identified in relation to the prior art.

[0033] By way of example embodiments, there is provided efficient user equipment authentication. More specifically, by way of example embodiments, there are provided measures and mechanisms for realizing efficient user equipment authentication.

[0034] Thus, improvement is achieved by methods, apparatuses and computer program products enabling / realizing efficient user equipment authentication.

[0035] Brief description of the drawings

[0036] In the following, the present disclosure will be described in greater detail by way of non-limiting examples with reference to the accompanying drawings, in which

[0037] Fig. 1 is a block diagram illustrating an apparatus according to example embodiments,

[0038] Fig. 2 is a block diagram illustrating an apparatus according to example embodiments,

[0039] Fig. 3 is a block diagram illustrating an apparatus according to example embodiments, Fig. 4 is a block diagram illustrating an apparatus according to example embodiments,

[0040] Fig. 5 is a block diagram illustrating an apparatus according to example embodiments,

[0041] Fig. 6 is a block diagram illustrating an apparatus according to example embodiments,

[0042] Fig. 7 is a block diagram illustrating an apparatus according to example embodiments,

[0043] Fig. 8 is a block diagram illustrating an apparatus according to example embodiments,

[0044] Fig. 9 is a block diagram illustrating an apparatus according to example embodiments,

[0045] Fig. 10 is a block diagram illustrating an apparatus according to example embodiments,

[0046] Fig. 11 is a block diagram illustrating an apparatus according to example embodiments,

[0047] Fig. 12 is a block diagram illustrating an apparatus according to example embodiments,

[0048] Fig. 13 is a block diagram illustrating an apparatus according to example embodiments,

[0049] Fig. 14 is a block diagram illustrating an apparatus according to example embodiments, Fig. 15 is a block diagram illustrating an apparatus according to example embodiments,

[0050] Fig. 16 is a block diagram illustrating an apparatus according to example embodiments,

[0051] Fig. 17 is a schematic diagram of a procedure according to example embodiments,

[0052] Fig. 18 is a schematic diagram of a procedure according to example embodiments,

[0053] Fig. 19 is a schematic diagram of a procedure according to example embodiments,

[0054] Fig. 20 is a schematic diagram of a procedure according to example embodiments,

[0055] Fig. 21 is a schematic diagram of a procedure according to example embodiments,

[0056] Fig. 22 is a schematic diagram of a procedure according to example embodiments,

[0057] Fig. 23 is a schematic diagram of a procedure according to example embodiments,

[0058] Fig. 24 shows a schematic diagram of signaling sequences,

[0059] Fig. 25 shows a schematic diagram of an example of a system environment with signaling variants according to example embodiments, Fig. 26 shows a schematic diagram of an example of a system environment with signaling variants according to example embodiments,

[0060] Fig. 27 shows a schematic diagram of signaling sequences according to example embodiments,

[0061] Fig. 28 shows a schematic diagram of signaling sequences according to example embodiments,

[0062] Figs. 29 (A) to (C) are block diagrams schematically illustrating key derivation according to example embodiments,

[0063] Fig. 30 shows a schematic diagram of signaling sequences,

[0064] Fig. 31 shows a schematic diagram of an example of a system environment with signaling variants according to example embodiments,

[0065] Fig. 32 shows a schematic diagram of an example of a system environment with signaling variants according to example embodiments,

[0066] Fig. 33 shows a schematic diagram of signaling sequences according to example embodiments,

[0067] Fig. 34 shows a schematic diagram of signaling sequences according to example embodiments,

[0068] Figs. 35, 36(A), 36(B) are block diagrams schematically illustrating key derivation according to example embodiments, and

[0069] Fig. 37 is a block diagram alternatively illustrating apparatuses according to example embodiments.

[0070] Detailed description The present disclosure is described herein with reference to particular nonlimiting examples and to what are presently considered to be conceivable embodiments. A person skilled in the art will appreciate that the disclosure is by no means limited to these examples, and may be more broadly applied.

[0071] It is to be noted that the following description of the present disclosure and its embodiments mainly refers to specifications being used as non-limiting examples for certain exemplary network configurations and deployments. Namely, the present disclosure and its embodiments are mainly described in relation to 3GPP specifications being used as non-limiting examples for certain exemplary network configurations and deployments. As such, the description of example embodiments given herein specifically refers to terminology which is directly related thereto. Such terminology is only used in the context of the presented non-limiting examples, and does naturally not limit the disclosure in any way. Rather, any other communication or communication related system deployment, etc. may also be utilized as long as compliant with the features described herein.

[0072] Hereinafter, various embodiments and implementations of the present disclosure and its aspects or embodiments are described using several variants and / or alternatives. It is generally noted that, according to certain needs and constraints, all of the described variants and / or alternatives may be provided alone or in any conceivable combination (also including combinations of individual features of the various variants and / or alternatives).

[0073] As used herein, "at least one of the following:" and "at least one of" and similar wording, where the list of two or more elements are joined by "and" or "or", mean at least any one of the elements, or at least any two or more of the elements, or at least all the elements. According to example embodiments, in general terms, there are provided measures and mechanisms for (enabling / realizing) efficient user equipment authentication.

[0074] A first variant of example embodiments is exemplified below.

[0075] Wireless local area network (WLAN) user equipment (UE) that do not support 5thGeneration Core (5GC) non-access stratum (NAS) (N5CW devices) may register via trusted non-3GPP access to the 5GC. Those N5CW (Non-5G- Capable over WLAN) devices are able to authenticate to the network with 3GPP credentials and register with the help of an interworking function (trusted WLAN interworking function (TWIF)) that provides the 5GC NAS protocol stack towards the access and mobility management function (AMF).

[0076] With respect to authentication for devices that do not support 5GC NAS over WLAN access, a N5CW device is capable to register to 5GC with 3GPP credentials and to establish 5GC connectivity via a trusted WLAN access network utilizing stored 3GPP credentials. The TWIF provides interworking functionality that enables connectivity with 5GC and implements the NAS protocol stack and exchanges NAS messages with the AMF on behalf of the N5CW device. A single EAP-AKA' authentication procedure is executed for connecting the N5CW device both to the trusted WLAN access network and to the 5G core network.

[0077] Fig. 24 shows a schematic diagram of signaling sequences, and in particular illustrates an exemplary authentication procedure for N5CW devices.

[0078] In step 0 of Fig. 24, the N5CW device selects a public land mobile network (PLMN) and a trusted WLAN that supports "5G connectivity-without-NAS" to this PLMN by using a procedure specified in TS 23.501, "Access Network selection for devices that do not support 5GC NAS over WLAN".

[0079] Steps 1 to 10 of Fig. 24 illustrate an initial registration to 5GC. In step 1 of Fig. 24, the N5CW device associates with the trusted WLAN network and the EAP-AKA' authentication procedure is initiated.

[0080] In step 2 of Fig. 24, the N5CW device shall provide its network access identity (NAI). A trusted WLAN access point (TWAP) selects a TWIF, e.g. based on the received realm, and sends an AAA request to the selected TWIF.

[0081] If the N5CW device registers to 5GC over 3GPP access for the first time when the above procedure is initiated, then the NAI shall include the subscription concealed identifier (SUCI).

[0082] If the N5CW device has registered to 5GC over 3GPP access when the above procedure is initiated, then the NAI comprises the 5G globally unique temporary identifier (5G-GUTI) assigned to the N5CW device over 3GPP access. This enables the TWIF in step 4a below to select the same AMF as the one serving the N5CW device over 3GPP access.

[0083] In step 3 of Fig. 24, the TWIF shall create a 5GC Registration Request message on behalf of the N5CW device. The TWIF shall use default values to populate the parameters in the Registration Request message, which are the same for all N5CW device that do not support 5G NAS. The Registration type indicates "Initial Registration".

[0084] In step 4 of Fig. 24, the TWIF shall select an AMF (e.g. by using the 5G-GUTI in the NAI, if provided by the N5CW device) and shall send an N2 message to the AMF comprising the Registration Request, the User Location and an Access Network (AN) Type.

[0085] In step 5 of Fig. 24, in case the AMF triggers an authentication procedure, it sends a request to authentication server function (AUSF) by sending Nausf_UEAuthentication_Authenticate Request message. The Nausf_UEAuthentication_Authenticate Request message contains SUCI or SUPI (in case of a valid 5G-GUTI is received by the AMF). The request message contains also an indication that the request is from a N5CW device.

[0086] In step 6 of Fig. 24, the AUSF shall send Nudm_UEAuthentication_Get Request to the UDM comprising SUCI or subscription permanent identifier (SUPI) and the N5CW indication.

[0087] In step 7 of Fig. 24, upon reception of the Nudm_UEAuthentication_Get Request, the UDM shall invoke subscription identifier de-concealing function (SIDF) if a SUCI is received. SIDF shall de-conceal SUCI to gain SUPI before UDM can process the request. The UDM may select an authentication method based on the "realm" part of the SUPI, the N5CW device indicator, a combination of the "realm" part and the N5CW device indicator, or the UDM local policy.

[0088] In step 8 of Fig. 24, the EAP-AKA' procedure will be trigged to perform mutual authentication between the N5CW device and the home network.

[0089] EAP-AKA' takes place between the N5CW device and AUSF. Over the N2 interface, the EAP messages are encapsulated within NAS Authentication messages. The EAP-AKA' messages exchanged between the N5CW Device and the TWIF shall be encapsulated into the layer-2 packets, e.g. into IEEE 802.3 / 802. lx packets, into IEEE 802.11 / 802. lx packets, into PPP packets, etc.

[0090] In step 9 of Fig. 24, the NAS security context is not required in this scenario. The AMF shall derive a KTWIF key from the received KAMF key. NAS security between AMF and TWIF is established similar to unauthenticated emergency calls, i.e. with NULL encryption and NULL integrity protection.

[0091] In step 10a of Fig. 24, the AMF shall send NAS Security Mode Command to the TWIF. The NAS Security Mode Command shall contain the EAP-Success message and the NULL security algorithms. In step 10b of Fig. 24, the TWIF shall not forward the EAP-Success to the N5CW directly; instead, it shall store the EAP-Success message and wait for KTWIF.

[0092] In step 10c of Fig. 24, the TWIF shall send the NAS Security Mode Complete message to the AMF.

[0093] In step 11 of Fig. 24, the AMF sends an N2 Initial Context Setup Request and provides the KTWIF key to TWIF.

[0094] In step 12 of Fig. 24, the TWIF shall derive a TNAP key, KTNAP, from the KTNGF key as specified in TS 33.501 and send the TNAP key and the EAP-Success message to the Trusted WLAN Access Point, which forwards the EAP-Success to the N5CW device. The TNAP key corresponds to the PMK (Pairwise Master Key) which is used to secure the WLAN air-interface communication according to IEEE 802.11. A layer-2 or layer-3 connection is established between the Trusted WLAN Access Point and the TWIF for transporting all user-plane traffic of the N5CW device to TWIF. This connection is later bound to an N3 connection that is created for this N5CW device.

[0095] In step 13 of Fig. 24, the TWIF shall send N2 Initial Context Setup Response message to the AMF.

[0096] 3GPP Rel-19 entails new SID studies for 5G wireless wireline convergence (5WWC) about trusted non-3GPP gateway function (TNGF) and non-3GPP access interworking function (N3IWF) mobility scenarios without full authentication. Cable operators clearly want improvement in the signaling where attach time can be reduced. Currently in Rel-18, when a user equipment (UE) moves and attaches to a new TNGF, full primary authentication is performed even in case the UE provide 5G-GUTI and the AMF also has a security context for the same. Performing the full primary authentication leads to delay in connection time.

[0097] Hence, in brief, according to example embodiments, the signaling is optimized where full authentication can be avoided.

[0098] Namely, in case of TNGF mobility, a UE moved to a target TNGF by providing the 5G-GUTI in a registration message with a registration type as TNGF mobility or Mobility registration. According to example embodiments, the TNGF checks if 5G-GUTI belongs to the same PLMN which TNGF supports.

[0099] If the new TNGF supports the UE services like slicing, etc., then, according to example embodiments, the AMF continues without full authentication and registration.

[0100] According to example embodiments, the AMF could also derive a new key KTNGF ' and provide the key to the target TNGF.

[0101] According to example embodiments, the UE generates a similar key when SUCCESS is received from the AMF.

[0102] According to example embodiments, the Keys can be generated either in the AMF or in the source TNGF.

[0103] Example embodiments are specified below in more detail.

[0104] Fig. 1 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be a terminal 10 such as a mobile communication endpoint (i.e., a user equipment configured to move from a source access node to a target access node) comprising a transmitting circuitry 11 and a receiving circuitry 12. The transmitting circuitry 11 transmits, towards said target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of said user equipment. The receiving circuitry 12 receives, from said target access node, a response message indicative of mobility processing success, said response message comprising an indication to derive a key for access via said target access node. Fig. 17 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Fig. 1 may perform the method of Fig. 17 but is not limited to this method. The method of Fig. 17 may be performed by the apparatus of Fig. 1 but is not limited to being performed by this apparatus.

[0105] As shown in Fig. 17, a procedure according to example embodiments comprises an operation of transmitting (S171), towards said target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of said user equipment, and an operation of receiving (S172), from said target access node, a response message indicative of mobility processing success, said response message comprising an indication to derive a key for access via said target access node.

[0106] Fig. 2 is a block diagram illustrating an apparatus according to example embodiments. In particular, Fig. 2 illustrates a variation of the apparatus shown in Fig. 1. The apparatus according to Fig. 2 may thus further comprise a deriving circuitry 21.

[0107] In an embodiment at least some of the functionalities of the apparatus shown in Fig. 1 (or 2) may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

[0108] According to further example embodiments, said temporary identifier of said user equipment is a 5G globally unique temporary identifier of said user equipment. According to further example embodiments, said registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes.

[0109] The user equipment ability for mobility processing in relation to movement between access nodes includes the user equipment's ability to disconnect from one access node and connect to another access node without performing full authentication.

[0110] According to a variation of the procedure shown in Fig. 17, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of deriving said key for access via said target access node.

[0111] Fig. 3 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be an access node 30 such as a (target) trusted non-3GPP gateway function entity comprising a receiving circuitry 31, an analyzing circuitry 32, and a transmitting circuitry 33. The receiving circuitry 31 receives, from a user equipment, a first registration message demanding mobility processing, said first registration message comprising a temporary identifier of said user equipment. The analyzing circuitry 32 analyzes said temporary identifier of said user equipment for whether said temporary identifier of said user equipment is valid for a network said target access node provides access to. The transmitting circuitry 33 transmits, if said temporary identifier of said user equipment is valid for said network said target access node provides access to, towards a management function entity, a second registration message demanding mobility processing, said second registration message comprising said temporary identifier of said user equipment. Fig. 18 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Fig. 3 may perform the method of Fig. 18 but is not limited to this method. The method of Fig. 18 may be performed by the apparatus of Fig. 3 but is not limited to being performed by this apparatus.

[0112] As shown in Fig. 18, a procedure according to example embodiments comprises an operation of receiving (S181), from a user equipment, a first registration message demanding mobility processing, said first registration message comprising a temporary identifier of said user equipment, an operation of analyzing (S182) said temporary identifier of said user equipment for whether said temporary identifier of said user equipment is valid for a network said target access node provides access to, and an operation of transmitting (S183), if said temporary identifier of said user equipment is valid for said network said target access node provides access to, towards a management function entity, a second registration message demanding mobility processing, said second registration message comprising said temporary identifier of said user equipment.

[0113] In an embodiment at least some of the functionalities of the apparatus shown in Fig. 3 may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

[0114] According to further example embodiments, said temporary identifier of said user equipment is a 5G globally unique temporary identifier of said user equipment.

[0115] According to further example embodiments, said first registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and / or said second registration message comprises said indication of said user equipment ability for mobility processing in relation to movement between access nodes, and / or said second registration message comprises an indication of a target access node ability for mobility processing in relation to movement between access nodes. The target access node ability for mobility processing in relation to movement between access nodes includes the target access node's ability to handle, without performing full authentication, a connection (attempt), to the target access node, of a user equipment having disconnected from another access node.

[0116] Alternatively, or in addition (in particular alternatively to that said second registration message comprises an indication of a target access node ability for mobility processing in relation to movement between access nodes), according to a variation of the procedure shown in Fig. 18, an exemplary method according to example embodiments may further comprise an operation of transmitting, if said temporary identifier of said mobile communication endpoint is valid for said network said target access node provides access to, towards said management function entity, an information message, said information message including said indication of said target access node ability for mobility processing in relation to movement between access nodes.

[0117] According to a variation of the procedure shown in Fig. 18, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of receiving, from said management function entity, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node and comprising said key for access via said target access node, and an operation of transmitting, towards said user equipment, a second response message indicative of mobility processing success, said second response message comprising said indication to derive said key for access via said target access node.

[0118] Fig. 4 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be a network node 40 such as an access and mobility management function entity comprising a receiving circuitry 41, a checking circuitry 42, and a transmitting circuitry 43. The receiving circuitry 41 receives, from a target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of a user equipment. The checking circuitry 42 checks at least one mobility processing precondition. The transmitting circuitry 43 transmits, if said at least one mobility processing precondition is satisfied, towards said target access node, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node. Fig. 19 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Fig. 4 may perform the method of Fig. 19 but is not limited to this method. The method of Fig. 19 may be performed by the apparatus of Fig. 4 but is not limited to being performed by this apparatus.

[0119] As shown in Fig. 19, a procedure according to example embodiments comprises an operation of receiving (S191), from a target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of a user equipment, an operation of checking (S192) at least one mobility processing precondition, and an operation of transmitting (S193), if said at least one mobility processing precondition is satisfied, towards said target access node, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node.

[0120] Fig. 5 is a block diagram illustrating an apparatus according to example embodiments. In particular, Fig. 5 illustrates a variation of the apparatus shown in Fig. 4. The apparatus according to Fig. 5 may thus further comprise a deriving circuitry 51.

[0121] In an embodiment at least some of the functionalities of the apparatus shown in Fig. 4 (or 5) may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

[0122] According to further example embodiments, said temporary identifier of said user equipment is a 5G globally unique temporary identifier of said user equipment.

[0123] According to further example embodiments, said registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and / or said registration message comprises an indication of a target access node ability for mobility processing in relation to movement between access nodes.

[0124] Alternatively, or in addition (in particular alternatively to that said registration message comprises an indication of a target access node ability for mobility processing in relation to movement between access nodes), according to a variation of the procedure shown in Fig. 19, an exemplary method according to example embodiments may further comprise an operation of receiving, from said target access node, an information message, said information message including said indication of said target access node ability for mobility processing in relation to movement between access nodes.

[0125] According to further example embodiments, said at least one mobility processing precondition comprises said user equipment ability for mobility processing in relation to movement between access nodes, and / or said at least one mobility processing precondition comprises said target access node ability for mobility processing in relation to movement between access nodes.

[0126] According to further example embodiments, said first response message comprises said key for access via said target access node. According to a variation of the procedure shown in Fig. 19, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of deriving, if said at least one mobility processing precondition is satisfied, said key for access via said target access node.

[0127] According to a variation of the procedure shown in Fig. 19, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of transmitting, if said at least one mobility processing precondition is satisfied, towards a source access node, a key request, and an operation of receiving, from said source access node, said key for access via said target access node.

[0128] Fig. 6 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be an access node 60 such as a (source) trusted non-3GPP gateway function entity comprising a receiving circuitry 61, a deriving circuitry 62, and a transmitting circuitry 63. The receiving circuitry 61 receives, from a management function entity, a key request. The deriving circuitry 62 derives a key for access via said target access node. The transmitting circuitry 63 transmits, towards said management function entity, said key for access via said target access node. Fig. 20 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Fig. 6 may perform the method of Fig. 20 but is not limited to this method. The method of Fig. 20 may be performed by the apparatus of Fig. 6 but is not limited to being performed by this apparatus.

[0129] As shown in Fig. 20, a procedure according to example embodiments comprises an operation of receiving (S201), from a management function entity, a key request, an operation of deriving (S202) a key for access via said target access node, and an operation of transmitting (S203), towards said management function entity, said key for access via said target access node.

[0130] In an embodiment at least some of the functionalities of the apparatus shown in Fig. 6 may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

[0131] Example embodiments outlined and specified above are explained below in more specific terms.

[0132] Fig. 25 shows a schematic diagram of an example of a system environment with signaling variants according to example embodiments, and in particular illustrates a mobility architecture for 5G core network (CN) with trusted non- 3GPP access in a more simple architectural overview.

[0133] Fig. 26 shows a schematic diagram of an example of a system environment with signaling variants according to example embodiments, and in particular illustrates a mobility architecture for 5G core network (CN) with trusted non- 3GPP access (Source TNAN and Target TNAN) in a more detailed architectural overview.

[0134] Fig. 27 shows a schematic diagram of signaling sequences according to example embodiments, and in particular illustrates a first variant of a mobility procedure for TNGF.

[0135] In a step 1 of Fig. 27, the UE is connected to a source TNGF, and authentication procedures may be same as specified in TS 33.501.

[0136] In a step 2 of Fig. 27, according to example embodiments, the UE moved from source TNGF to a target TNGF by providing the 5G-GUTI in registration message with registration type as "TNGF mobility (new value introduced for TNGF specific)" or "Mobility registration". Support of inter-TNGF mobility from UE is sent in NAS or AN parameter to target trusted non-3GPP access network (TNAN). The TNGF will check if 5G-GUTI belongs to the same PLMN which TNGF supports. If yes, then it proceeds with step 3, otherwise full authentication will be performed (TS 33.501).

[0137] As another option, target TNGF may ask only for 5G-GUTI instead of registration messages because of mobility supported by UE and target TNGF.

[0138] In a step 3 of Fig. 27, according to example embodiments, the N2 message registration request with mobility request with 5G-GUTI is received and the registration type is "TNGF mobility or mobility registration", as described in step 2. TNGF also comprises its capability if it supports mobility or not.

[0139] In a step 4 of Fig. 27, according to example embodiments, if the new (target) TNGF and UE supports mobility feature as described above and the UE services like slicing, etc., then the AMF continues as below without full authentication and registration. AMF could also derive new key KTNGF ' and provide it to the target TNGF.

[0140] In a step 5 of Fig. 27, according to example embodiments, the N2 message is sent to target TNGF comprising mobility success, derive new key indication with newly generated key KTNGF ' . The same NAS message is forwarded in AAA message to TNAP towards UE.

[0141] In a step 6 of Fig. 27, according to example embodiments, the UE will also derive new KTNGF ' keys.

[0142] Hence, summarizing, the AMF derives / generates the new key KTNGF ' , provides it to the TNGF, and triggers indication for the UE such that the UE derives this new key KTNGF ' independently. As a result, both the UE as well as the TNGF have the new key KTNGF ' available, such that the UE and the TNGF can use the new key KTNGF ' for four way handshake, e.g. to encrypt the traffic between UE and TNGF.

[0143] Fig. 28 shows a schematic diagram of signaling sequences according to example embodiments, and in particular illustrates a second variant of a mobility procedure for TNGF.

[0144] In a step 1 of Fig. 28, the UE is connected to source TNGF, and authentication procedures may be same as specified in TS 33.501. Note that TNGF could have assigned new TNGF UE ID. This ID is known at TNGF and AMF level also.

[0145] In a step 2 of Fig. 28, according to example embodiments, the UE moved to a target TNGF by providing the 5G-GUTI in registration message with registration type as "TNGF mobility (new value introduced for TNGF specific)" or "Mobility registration". Support of inter-TNGF mobility from UE is sent in AN parameter to target TNAN. The TNGF will check if 5G-GUTI belongs to the same PLMN which TNGF supports. If yes, then it proceeds with step 3, otherwise full authentication will be performed (TS 33.501).

[0146] In a step 3 of Fig. 28, according to example embodiments, the N2 message registration request with mobility request with 5G-GUTI is received and the registration type is "TNGF mobility or mobility registration", as described in step 2.

[0147] In a step 4 of Fig. 28, according to example embodiments, if the new (target) TNGF supports the UE services like slicing, etc., then the AMF continues as below without full authentication and registration. AMF could request source TNGF for Target TNGF key generation with TNGF UE ID (known to identify UE in source TNGF). Source TNGF generates and provides new key KTNGF ' to AMF.

[0148] In a step 5 of Fig. 28, according to example embodiments, the N2 message is sent to target TNGF with Target TNGF address and mobility success with newly generated key KTNGF ' . The same NAS message is forwarded in AAA message to TNAP towards UE.

[0149] In a step 6 of Fig. 28, according to example embodiments, the UE will also derive new KTNGF ' keys.

[0150] Hence, summarizing, the AMF fetches the new key KTNGF ' , provides it to the TNGF, and triggers indication for the UE such that the UE derives this new key KTNGF ' independently.

[0151] As a result, both the UE as well as the TNGF have the new key KTNGF ' available, such that the UE and the TNGF can use the new key KTNGF ' for four way handshake, e.g. to encrypt the traffic between UE and TNGF.

[0152] Figs. 29 (A) to (C) are block diagrams schematically illustrating key derivation according to example embodiments.

[0153] In particular, Fig. 29(A) illustrates key derivation of target TNGF from AMF key with TNGF ID according to example embodiments.

[0154] When deriving the keys KTNGF ' , from KAMF and the uplink NAS COUNT in the UE and the AMF, the following parameters shall be used to form the input S to the KDF.

[0155] FC = OxWX

[0156] PO = Uplink NAS COUNT

[0157] LO = length of uplink NAS COUNT (i.e. 0x00 0x04)

[0158] Pl = TNGF ID

[0159] LI = length of TNGF ID (i.e. 0x00 0x06)

[0160] The input key KEY shall be the 256-bit KAMF. This function according to example embodiments may be applied when cryptographically protected 5G radio bearers are established and when a key change on-the-fly is performed.

[0161] Further, Fig. 29(B) illustrates key derivation of target TNGF from AMF key without TNGF ID according to example embodiments.

[0162] KAMF to KTNGF ' derivation function reuse existing procedure from TS 33.501.

[0163] When deriving the keys KTNGF ' from KAMF and the uplink NAS COUNT in the UE and the AMF, the following parameters shall be used to form the input S to the KDF.

[0164] FC = OxWX

[0165] P0 = Uplink NAS COUNT

[0166] L0 = length of uplink NAS COUNT (i.e. 0x00 0x04)

[0167] The input key KEY shall be the 256-bit KAMF.

[0168] This function according to example embodiments may be applied when cryptographically protected 5G radio bearers are established and when a key change on-the-fly is performed.

[0169] Further, Fig. 29(C) illustrates key derivation of target TNGF from source TNGF according to example embodiments, in particular KTNGF to KTNGF' derivation in mobility.

[0170] As one option according to example embodiments, derivation of KTNGF' from KTNGF during mobility shall use the following input parameters.

[0171] FC = OxWY

[0172] Pl = NAS COUNT,

[0173] LI = length of NAS COUNT (i.e. 0x00 0x04)

[0174] The input key source TNGF KEY shall be KTNGF. When KTNGF' is derived with COUNT shall be the uplink NAS COUNT of the Non- 3GPP access.

[0175] As another option according to example embodiments, derivation of KTNGF' from KTNGF during mobility shall use the following input parameters.

[0176] FC = OxWY

[0177] Pl = Constant value

[0178] LI = length of Constant value (i.e. 0x00 0x04)

[0179] The input key source TNGF KEY shall be KTNGF.

[0180] When KTNGF' is derived with Agreed constant value.

[0181] A second variant of example embodiments is exemplified below.

[0182] Security for non-3GPP access to the 5G Core network is achieved by a procedure using IKEv2 as defined in RFC 7296 to set up one or more IPsec ESP security associations. The role of IKE initiator (or client) is taken by the UE, and the role of IKE responder (or server) is taken by the N3IWF.

[0183] During this procedure, the AMF delivers a key KNSIWF to the N3IWF. The AMF derives the key KNSIWF from the key KAMF. The key KNSIWF is then used by UE and N3IWF to complete authentication within IKEv2.

[0184] In relation to security for trusted non-3GPP access to 5G Core network, it is noted that trusted and untrusted non-3GPP access networks are internet protocol (IP) access networks that use access technology whose specification is out of the scope of 3GPP.

[0185] Whether a non-3GPP IP access network is trusted or untrusted is not a characteristic of the access network. In non-roaming scenario, it is the home public land mobile network (HPLMN) operator's decision, whether a non-3GPP IP access network is used as trusted or untrusted non-3GPP access network.

[0186] When one or more of the security feature groups provided by the non-3GPP access network are considered not sufficiently secure by the home operator, the non-3GPP access may be identified as an untrusted non-3GPP access for that operator.

[0187] However, this policy decision may additionally be based on reasons not related to security feature groups.

[0188] In roaming scenario, the unified data management (UDM) in HPLMN makes the final decision of whether a non-3GPP IP access network is used as trusted or untrusted non-3GPP access network based on the identities of the access network and the visited network. The UDM may take the visited public land mobile network's (VPLMN) policy and capability returned from the AMF or roaming agreement into account.

[0189] For supporting multiple data networks (DN), the same trust relationship shall apply to all the DNs the UE connects to from a certain non-3GPP access network, i.e. it shall not be possible to access one DN using the non-3GPP access network as trusted, while access to another packet data network (PDN) using the same non-3GPP access network as untrusted.

[0190] In relation to determining trust relationship in the UE, there are various possibilities to determine the trust relationship in the UE as it is described in TS 23.501.

[0191] For example, the non-3GPP access networks, which are trusted, can be preconfigured in the UE. If the universal subscriber identity module (USIM) supports non-3GPP access networks service, the home network operator may configure in the USIM a list of trusted non-3GPP access networks. In case of pre-configured information in the UE, the list of trusted non-3GPP access networks pre-configured by the home network operator in the USIM shall take precedence over information pre-configured in the ME.

[0192] In relation to security procedures covering authentication for untrusted non- 3GPP access, brief specification how a UE is authenticated to 5G network via an untrusted non-3GPP access network is given. It uses a vendor-specific EAP method called "EAP-5G", utilizing the "Expanded" EAP type and the existing 3GPP Vendor-Id, registered with IANA under the SMI Private Enterprise Code registry. The "EAP-5G" method is used between the UE and the N3IWF and is utilized for encapsulating NAS messages. If the UE needs to be authenticated by the 3GPP home network, multiple authentication methods can be used. The method is executed between the UE and AUSF as shown below.

[0193] When possible, the UE shall be authenticated by reusing the existing UE NAS security context in AMF.

[0194] Fig. 30 shows a schematic diagram of signaling sequences, and in particular illustrates authentication for untrusted non-3GPP access.

[0195] In a step 1 of Fig. 30, the UE connects to an untrusted non-3GPP access network with procedures outside the scope of 3GPP. When the UE decides to attach to 5GC network, the UE selects an N3IWF in a 5G PLMN, as described in TS 23.501.

[0196] In a step 2 of Fig. 30, the UE proceeds with the establishment of an IPsec Security Association (SA) with the selected N3IWF by initiating an IKE initial exchange according to RFC 7296. After step 2, all subsequent IKE messages are encrypted and integrity protected by using the IKE SA established in this step.

[0197] In a step 3 of Fig. 30, the UE shall initiate an IKE_AUTH exchange by sending an IKE_AUTH request message. The AUTH payload is not included in the IKE_AUTH request message, which indicates that the IKE_AUTH exchange shall use EAP signaling (in this case EAP-5G signaling). As per the RFC 7296, in the IDi the UE shall set the ID type as ID_KEY-ID in this message and set its value equal to any random number. The UE shall not use its GUTI / SUCI / SUPI as the Id in this step. If the UE is provisioned with the N3IWF root certificate, it shall include the CERTREQ payload within the IKE_AUTH request message to request N3IWF's certificate.

[0198] In a step 4 of Fig. 30, the N3IWF responds with an IKE_AUTH response message which comprises the N3IWF identity, the AUTH payload to protect the previous message it sent to the UE (in the IKE_SA_INIT exchange) and an EAP- Req uest / 5G- Start packet. The EAP-Request / 5G-Start packet informs the UE to initiate an EAP-5G session, i.e. to start sending NAS messages encapsulated within EAP-5G packets. If the UE has sent a CERTREQ payload in step 3, the N3IWF shall also include the CERT payload including N3IWF certificate.

[0199] In a step 5 of Fig. 30, the UE shall validate the N3IWF certificate and shall confirm that the N3IWF identity matches the N3IWF selected by the UE. An absence of the certificate from the N3IWF if the UE had requested the certificate or unsuccessful identity confirmation shall result in a connection failure. The UE shall send an IKE_AUTH request which comprises an EAP- Response / 5G-NAS packet that contains a Registration Request message containing UE security capabilities and the SUCI. If UE is already with the 5GC over 3GPP access and there is an available security context, the UE shall integrity protect the Registration Request message and shall send the 5G- GUTI instead of SUCI. The N3IWF shall refrain from sending an EAP-Identity request. The UE may ignore an EAP Identity request or respond with the SUCI it sent in the Registration Request. If the UE has registered to the same AMF through 3GPP access, and if this is the first time that the UE connects to the 5GC through non-3GPP access, the value of corresponding UL NAS COUNT used for integrity protection is 0; else it can use the existing non-3GPP specific UL NAS COUNT for integrity protection It is noted that the N3IWF does not send an EAP-Identity request because the UE comprises its identity in the IKE_AUTH request in message 5. This is in line with RFC 7296.

[0200] In a step 6 of Fig. 30, the N3IWF shall select an AMF as specified in TS 23.501. The N3IWF forwards the Registration Request received from the UE to the AMF.

[0201] In a step 7 of Fig. 30, if the AMF receives a 5G-GUTI and the Registration is integrity protected, it may use the security context to verify the integrity protection. If the UE has registered to the same AMF through 3GPP access, and if this is the first time that the AMF receives UE's NAS signaling through non-3GPP access, the value of corresponding UL NAS COUNT used for integrity verification is 0; else it can use the existing non-3GPP specific UL NAS COUNT for integrity verification. If integrity is verified successfully, it indicates that UE is authenticated by AMF. If integrity is verified successfully and no newer security context has been activated over the 3GPP access, then step 8 to step 11 may be skipped. If integrity is verified successfully and a newer security context has been activated over the 3GPP access then authentication may be skipped but the AMF shall activate the newer context with a NAS SMC procedure as described in step 8 and onwards. Otherwise, the AMF shall authenticate the UE.

[0202] If the AMF decides to authenticate the UE, the AMF shall send a key request to the AUSF. The AUSF may initiate an authentication procedure. Between AMF and UE, the authentication packets are encapsulated within NAS authentication messages and the NAS authentication messages are carried in N2 signaling between the AMF and N3IWF, and then are encapsulated within EAP-5G / 5G-NAS packets between the N3IWF and the UE.

[0203] In the final authentication message from the home network, the AUSF shall send the anchor key KSEAF derived from KAUSF to the security anchor function (SEAF). The SEAF shall derive the KAMF from KSEAF and send it to the AMF, which is used by the AMF to derive NAS security keys. If EAP-AKA' is used for authentication, then the AUSF shall include the EAP-Success. The UE also derives the anchor key KSEAF and from that key it derives the KAMF followed by NAS security keys. The NAS COUNTS associated with NAS connection identifier "0x02" are set at the UE and AMF.

[0204] In a step 8 of Fig. 30, the AMF shall send a Security Mode Command (SMC) to the UE in order to activate NAS security associated with NAS connection identifier "0x02". This message is first sent to N3IWF (within an N2 message). If EAP-AKA' is used for authentication, the AMF shall encapsulate the EAP- Success received from AUSF within the SMC message.

[0205] In a step 9 of Fig. 30, the N3IWF shall forward the NAS SMC to UE within an EAP-Request / 5G-NAS packet.

[0206] In a step 10 of Fig. 30, the UE completes the authentication (if initiated in step 7) and creates a NAS security context or activates another one based on the received ngKSI in the NAS SMC. UE shall respond to the NAS SMC it received from the AMF based on the selected algorithms and parameters. The UE shall encapsulate the NAS SMC Complete in the EAP-5G Response.

[0207] In a step 11 of Fig. 30, the N3IWF shall forward the NAS packet containing NAS SMC Complete to the AMF over the N2 interface.

[0208] In a step 12 of Fig. 30, the AMF upon reception of the NAS SMC Complete from the UE or upon success of integrity protection verification, initiates the NGAP procedure to set up the AN context. AMF shall compute the N3IWF key, KNSIWF, using the uplink NAS COUNT associated with NAS connection identifier "0x02" for the establishment of the IPsec SA between the UE and the N3IWF and shall include it in the NGAP Initial Context Setup Request sent to the N3IWF. In a step 13 of Fig. 30, the N3IWF sends an EAP-Success / EAP-5G to the UE upon reception of the NGAP Initial Context Setup Request containing the N3IWF key, KNSIWF. This completes the EAP-5G session and no further EAP- 5G packets are exchanged. If the N3IWF does not receive the KNSIWF from AMF, the N3IWF shall respond with an EAP-Failure

[0209] In a step 14 of Fig. 30, the IPsec SA is established between the UE and N3IWF by using the N3IWF key KNSIWF that was created in the UE using the uplink NAS COUNT associated with NAS connection identifier "0x02" and was received by N3IWF from the AMF in step 12.

[0210] In a step 15 of Fig. 30, upon successful establishment of the IPsec SA between the UE and the N3IWF, the N3IWF shall send the NGAP Initial Context Setup Response message to the AMF.

[0211] In a step 16 of Fig. 30, when NGAP Initial Context Setup Response for the UE is received by the AMF, AMF shall send the NAS Registration Accept message for the UE over the N2 towards the N3IWF.

[0212] In a step 17 of Fig. 30, upon receiving the NAS Registration Accept message from the AMF, the N3IWF shall forward it to the UE over the established IPsec SA. All further NAS messages between the UE and the N3IWF shall be sent over the established IPsec SA.

[0213] Currently in 3GPP Rel-18, when a UE moves and attaches to new (target) N3IWF, full primary authentication is performed even if UE provide 5G-GUTI and AMF also has a security context for the same. 3GPP Rel-19 entails new SID studies for 5G wireless wireline convergence (5WWC), with the objective that in UE N3IWF mobility scenarios where UE disconnect from an N3IWF and connect to a new N3IWF, core network can avoid the full primary authentication. Cable operators clearly want improvement in the signaling where attach time can be reduced.

[0214] Performing the full primary authentication leads to delay in connection time.

[0215] Hence, in brief, according to example embodiments, the signaling is optimized where full authentication can be avoided.

[0216] Namely, in case of N3IWF mobility, a UE moves from source N3IWF to a target N3IWF by providing the 5G-GUTI in registration message with registration type as N3IWF mobility or Mobility registration.

[0217] According to example embodiments, the N3IWF will check if 5G-GUTI belongs to the same PLMN which N3IWF supports.

[0218] If the new N3IWF supports the UE services like slicing, etc., and support mobility feature, then, according to example embodiments, the AMF continues without full authentication and registration.

[0219] According to example embodiments, the AMF can also derive a new key KN3IWF ' and provide it to the target N3IWF.

[0220] According to example embodiments, the UE generates a similar key when SUCCESS is received from AMF.

[0221] Example embodiments are specified below in more detail.

[0222] Fig. 7 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be a terminal 70 such as a mobile communication endpoint (i.e., a user equipment configured to move from a source access node to a target access node) comprising a transmitting circuitry 71 and a receiving circuitry 72. The transmitting circuitry 71 transmits, towards said target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of said user equipment. The receiving circuitry 72 receives, from said target access node, a response message indicative of mobility processing success, said response message comprising an indication to derive a key for access via said target access node. Fig. 17 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Fig. 7 may perform the method of Fig. 17 but is not limited to this method. The method of Fig. 17 may be performed by the apparatus of Fig. 7 but is not limited to being performed by this apparatus.

[0223] As shown in Fig. 17, a procedure according to example embodiments comprises an operation of transmitting (S171), towards said target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of said user equipment, and an operation of receiving (S172), from said target access node, a response message indicative of mobility processing success, said response message comprising an indication to derive a key for access via said target access node.

[0224] Fig. 8 is a block diagram illustrating an apparatus according to example embodiments. In particular, Fig. 7 illustrates a variation of the apparatus shown in Fig. 8. The apparatus according to Fig. 8 may thus further comprise a deriving circuitry 81.

[0225] In an embodiment at least some of the functionalities of the apparatus shown in Fig. 7 (or 8) may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

[0226] According to further example embodiments, said temporary identifier of said user equipment is a 5G globally unique temporary identifier of said user equipment. According to further example embodiments, said registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes.

[0227] According to a variation of the procedure shown in Fig. 17, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of deriving said key for access via said target access node.

[0228] Fig. 9 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be an access node 90 such as a (target) non-3GPP access interworking function entity comprising a receiving circuitry 91, an analyzing circuitry 92, and a transmitting circuitry 93. The receiving circuitry 91 receives, from a user equipment, a first registration message demanding mobility processing, said first registration message comprising a temporary identifier of said user equipment. The analyzing circuitry 92 analyzes said temporary identifier of said user equipment for whether said temporary identifier of said user equipment is valid for a network said target access node provides access to. The transmitting circuitry 93 transmits, if said temporary identifier of said user equipment is valid for said network said target access node provides access to, towards a management function entity, a second registration message demanding mobility processing, said second registration message comprising said temporary identifier of said user equipment. Fig. 18 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Fig. 9 may perform the method of Fig. 18 but is not limited to this method. The method of Fig. 18 may be performed by the apparatus of Fig. 9 but is not limited to being performed by this apparatus.

[0229] As shown in Fig. 18, a procedure according to example embodiments comprises an operation of receiving (S181), from a user equipment, a first registration message demanding mobility processing, said first registration message comprising a temporary identifier of said user equipment, an operation of analyzing (S182) said temporary identifier of said user equipment for whether said temporary identifier of said user equipment is valid for a network said target access node provides access to, and an operation of transmitting (S183), if said temporary identifier of said user equipment is valid for said network said target access node provides access to, towards a management function entity, a second registration message demanding mobility processing, said second registration message comprising said temporary identifier of said user equipment.

[0230] In an embodiment at least some of the functionalities of the apparatus shown in Fig. 9 may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

[0231] According to further example embodiments, said temporary identifier of said user equipment is a 5G globally unique temporary identifier of said user equipment.

[0232] According to further example embodiments, said first registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and / or said second registration message comprises said indication of said user equipment ability for mobility processing in relation to movement between access nodes, and / or said second registration message comprises an indication of a target access node ability for mobility processing in relation to movement between access nodes.

[0233] Alternatively, or in addition (in particular alternatively to that said second registration message comprises an indication of a target access node ability for mobility processing in relation to movement between access nodes), according to a variation of the procedure shown in Fig. 18, an exemplary method according to example embodiments may further comprise an operation of transmitting, if said specific temporary identifier of said mobile communication endpoint is valid for said network said target access node provides access to, towards said management function entity, an information message, said information message including said indication of said target access node ability for mobility processing in relation to movement between access nodes.

[0234] According to a variation of the procedure shown in Fig. 18, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of receiving, from said management function entity, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node, and an operation of transmitting, towards said user equipment, a second response message indicative of mobility processing success, said second response message comprising said indication to derive said key for access via said target access node.

[0235] According to a variation of the procedure shown in Fig. 18, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of receiving, from said management function entity, a third response message, said third response message comprising said key for access via said target access node, and an operation of transmitting, towards said user equipment, a fourth response message indicative of mobility processing success, said fourth response message comprising said indication to derive said key for access via said target access node.

[0236] Fig. 10 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be a network node 100 such as an access and mobility management function entity comprising a receiving circuitry 101, a checking circuitry 102, and a transmitting circuitry 103. The receiving circuitry 101 receives, from a target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of a user equipment. The checking circuitry 102 checks at least one mobility processing precondition. The transmitting circuitry 103 transmits, if said at least one mobility processing precondition is satisfied, towards said target access node, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node. Fig. 19 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Fig. 10 may perform the method of Fig. 19 but is not limited to this method. The method of Fig. 19 may be performed by the apparatus of Fig. 10 but is not limited to being performed by this apparatus.

[0237] As shown in Fig. 19, a procedure according to example embodiments comprises an operation of receiving (S191), from a target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of a user equipment, an operation of checking (S192) at least one mobility processing precondition, and an operation of transmitting (S193), if said at least one mobility processing precondition is satisfied, towards said target access node, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node.

[0238] Fig. 11 is a block diagram illustrating an apparatus according to example embodiments. In particular, Fig. 11 illustrates a variation of the apparatus shown in Fig. 10. The apparatus according to Fig. 11 may thus further comprise a deriving circuitry 111.

[0239] In an embodiment at least some of the functionalities of the apparatus shown in Fig. 10 (or 11) may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

[0240] According to further example embodiments, said temporary identifier of said user equipment is a 5G globally unique temporary identifier of said user equipment.

[0241] According to further example embodiments, said registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and / or said registration message comprises an indication of a target access node ability for mobility processing in relation to movement between access nodes.

[0242] Alternatively, or in addition (in particular alternatively to that said registration message comprises an indication of a target access node ability for mobility processing in relation to movement between access nodes), according to a variation of the procedure shown in Fig. 19, an exemplary method according to example embodiments may further comprise an operation of receiving, from said target access node, an information message, said information message including said indication of said target access node ability for mobility processing in relation to movement between access nodes.

[0243] According to further example embodiments, said at least one mobility processing precondition comprises said user equipment ability for mobility processing in relation to movement between access nodes, and / or said at least one mobility processing precondition comprises said target access node ability for mobility processing in relation to movement between access nodes.

[0244] According to a variation of the procedure shown in Fig. 19, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of deriving, if said at least one mobility processing precondition is satisfied, said key for access via said target access node.

[0245] According to a variation of the procedure shown in Fig. 19, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of transmitting, if said at least one mobility processing precondition is satisfied, towards said target access node, a second response message, said second response message comprising said key for access via said target access node.

[0246] Fig. 12 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be a terminal 10 such as a mobile communication endpoint (i.e., a user equipment) comprising a transmitting circuitry 121. The transmitting circuitry 11 transmits, towards an access node, a registration message. The registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes. Fig. 21 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Fig. 12 may perform the method of Fig. 21 but is not limited to this method. The method of Fig. 21 may be performed by the apparatus of Fig. 12 but is not limited to being performed by this apparatus.

[0247] As shown in Fig. 21, a procedure according to example embodiments comprises an operation of transmitting (S211), towards an access node, a registration message. The registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes.

[0248] Fig. 13 is a block diagram illustrating an apparatus according to example embodiments. In particular, Fig. 13 illustrates a variation of the apparatus shown in Fig. 12. The apparatus according to Fig. 13 may thus further comprise a receiving circuitry 131 and / or a storing circuitry 132. In an embodiment at least some of the functionalities of the apparatus shown in Fig. 12 (or 13) may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

[0249] According to a variation of the procedure shown in Fig. 21, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of receiving information on target access node candidates for movement between access nodes, and an operation of storing said information on said target access node candidates for movement between access nodes.

[0250] Fig. 14 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be an access node 140 such as a non-3GPP access interworking function entity comprising a receiving circuitry 141 and a transmitting circuitry 142. The receiving circuitry 141 receives, from a user equipment, a first registration message, said first registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes. The transmitting circuitry 142 transmits, towards a management function entity, a second registration message, said second registration message comprising said indication of said user equipment ability for mobility processing in relation to movement between access nodes. Fig. 22 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Fig. 14 may perform the method of Fig. 22 but is not limited to this method. The method of Fig. 22 may be performed by the apparatus of Fig. 14 but is not limited to being performed by this apparatus.

[0251] As shown in Fig. 22, a procedure according to example embodiments comprises an operation of receiving (S221), from a user equipment, a first registration message, said first registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and an operation of transmitting (S222), towards a management function entity, a second registration message, said second registration message comprising said indication of said user equipment ability for mobility processing in relation to movement between access nodes.

[0252] In an embodiment at least some of the functionalities of the apparatus shown in Fig. 14 may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

[0253] Fig. 15 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be a network node 150 such as an access and mobility management function entity comprising a receiving circuitry 151 and a storing circuitry 152. The receiving circuitry 151 receives, from an access node, a registration message, said registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes. The storing circuitry 152 stores information on said user equipment ability for mobility processing in relation to movement between access nodes. Fig. 23 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Fig. 15 may perform the method of Fig. 23 but is not limited to this method. The method of Fig. 23 may be performed by the apparatus of Fig. 15 but is not limited to being performed by this apparatus.

[0254] As shown in Fig. 23, a procedure according to example embodiments comprises an operation of receiving (S231), from an access node, a registration message, said registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and an operation of storing (S232) information on said user equipment ability for mobility processing in relation to movement between access nodes.

[0255] Fig. 16 is a block diagram illustrating an apparatus according to example embodiments. In particular, Fig. 16 illustrates a variation of the apparatus shown in Fig. 15. The apparatus according to Fig. 16 may thus further comprise a transmitting circuitry 161.

[0256] In an embodiment at least some of the functionalities of the apparatus shown in Fig. 15 (or 16) may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

[0257] According to a variation of the procedure shown in Fig. 23, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of transmitting information on target access node candidates for movement between access nodes.

[0258] Example embodiments outlined and specified above are explained below in more specific terms.

[0259] Fig. 31 shows a schematic diagram of an example of a system environment with signaling variants according to example embodiments, and in particular illustrates a mobility architecture for 5G Core Network with untrusted non- 3GPP access in a more simple architectural overview.

[0260] Fig. 32 shows a schematic diagram of an example of a system environment with signaling variants according to example embodiments, and in particular illustrates a mobility architecture for 5G Core Network with untrusted non- 3GPP access (source N3IWF and Target N3IWF) in a more detailed architectural overview.

[0261] Fig. 33 shows a schematic diagram of signaling sequences according to example embodiments, and in particular illustrates a first time registration procedure for N3IWF.

[0262] As illustrated in Fig. 33, according to example embodiments, the UE sends the indication that it supports N3IWF mobility in NAS PDU payload to N3IWF.

[0263] According to example embodiments, the same indication is also forwarded in NAS payload by N3IWF to the AMF.

[0264] According to example embodiments, the AMF stores the UE capability information that UE supports N3IWF mobility.

[0265] Optionally, according to example embodiments, the AMF also sends a list of target N3IWF IP addresses towards the UE, and the UE stores such list for future mobility purposes.

[0266] Fig. 34 shows a schematic diagram of signaling sequences according to example embodiments, and in particular illustrates a mobility procedure for N3IWF.

[0267] As illustrated in Fig. 34, according to example embodiments, the UE is in mobility case, as initial registration message, in NAS PDU, the UE supporting N3IWF mobility indication is sent in NAS PDU along with 5G-GUTI.

[0268] According to example embodiments, the target N3IWF will also indicate to the AMF that it supports mobility.

[0269] If UE and N3IWF do not support mobility, then, according to example embodiments, the AMF performs the full authentication corresponding to the old behavior like 3GPP Release-18. Otherwise, according to example embodiments, the AMF generates the new key KNSIWF'.

[0270] It is noted that a registration request message is only integrity protected with existing uplink NAS count and NAS count should not be set to zero.

[0271] According to example embodiments, the AMF responds in a NAS SMC message (to ensure that UE starts ciphering also) after successful completion of this procedure.

[0272] According to example embodiments, the UE could receive this indication of new N3IWF key refresh indication in either SMC messages or later in EAP success message. AMF will generate new Key KNSIWF' and provision it in target N3IWF in initial context setup request message. UE as well refreshes the new N3IWF key.

[0273] Hence, summarizing, the AMF derives / generates the new key KNSIWF', provides it to the N3IWF, and triggers indication for the UE such that the UE derives this new key KNSIWF' independently.

[0274] As a result, both the UE as well as the N3IWF have the new key KNSIWF' available, such that the UE and the N3IWF can use the new key KNSIWF' for four way handshake, e.g. to encrypt the traffic between UE and N3IWDF.

[0275] Figs. 35, 36(A), 36(B) are block diagrams schematically illustrating key derivation according to example embodiments, and in particular illustrate three alternative variants of key derivation / refreshing of target N3IWF from AMF key during mobility of UE between two N3IWFs.

[0276] Namely, as illustrated in Fig. 35, (new) mobility key KNSIWF may be derived / generated utilizing an existing procedure of TS 33.501, using NAS count and access type distinguisher. Further, as illustrated in Fig. 36(A), the Uplink NAS COUNT and an N3IWF type distinguisher (values could be IPv4 or IPv6 or IPv4v6 or FQDN) can be used to generate mobility key KNSIWF'.

[0277] Further, as illustrated in Fig. 36(B), the COUNT or RAND and an Access type distinguisher can be used to generate mobility key KNSIWF'.

[0278] The above-described procedures and functions may be implemented by respective functional elements, processors, or the like, as described below.

[0279] In the foregoing exemplary description of the network entity, only the units that are relevant for understanding the principles of the disclosure have been described using functional blocks. The network entity may comprise further units that are necessary for its respective operation. However, a description of these units is omitted in this specification. The arrangement of the functional blocks of the devices is not construed to limit the disclosure, and the functions may be performed by one block or further split into sub-blocks.

[0280] When in the foregoing description it is stated that the apparatus, i.e. network node or entity (or some other means) is configured to perform some function, this is to be construed to be equivalent to a description stating that a (i.e. at least one) processor or corresponding circuitry, potentially in cooperation with computer program code stored in the memory of the respective apparatus, is configured to cause the apparatus to perform at least the thus mentioned function. Also, such function is to be construed to be equivalently implementable by specifically configured circuitry or means for performing the respective function (i.e. the expression "unit configured to" is construed to be equivalent to an expression such as "means for").

[0281] In Fig. 37, an alternative illustration of apparatuses according to example embodiments is depicted. As indicated in Fig. 37, according to example embodiments, the apparatus (network node or entity) 370' (corresponding to the any of network nodes or entities 10, 30, 40, 60, 70, 90, 100, 120, 140, 150 exemplified above) comprises a processor 371, a memory 372 and an interface 373, which are connected by a bus 374 or the like. The apparatus 370' may be connected with one or more another apparatus 376 (being e.g. any other of the network nodes or entities 10, 30, 40, 60, 70, 90, 100, 120, 140, 150 exemplified above) via link 375.

[0282] The processor 371 and / or the interface 372 may also include a modem or the like to facilitate communication over a (hardwire or wireless) link, respectively. The interface 372 may include a suitable transceiver coupled to one or more antennas or communication means for (hardwire or wireless) communications with the linked or connected device(s), respectively. The interface 372 is generally configured to communicate with at least one other apparatus, i.e. the interface thereof.

[0283] The memory 373 may store respective programs assumed to include program instructions or computer program code that, when executed by the respective processor, enables the respective electronic device or apparatus to operate in accordance with the example embodiments.

[0284] In general terms, the respective devices / apparatuses (and / or parts thereof) may represent means for performing respective operations and / or exhibiting respective functionalities, and / or the respective devices (and / or parts thereof) may have functions for performing respective operations and / or exhibiting respective functionalities.

[0285] When in the subsequent description it is stated that the processor (or some other means) is configured to perform some function, this is to be construed to be equivalent to a description stating that at least one processor, potentially in cooperation with computer program code stored in the memory of the respective apparatus, is configured to cause the apparatus to perform at least the thus mentioned function. Also, such function is to be construed to be equivalently implementable by specifically configured means for performing the respective function (i.e. the expression "processor configured to [cause the apparatus to] perform xxx-ing" is construed to be equivalent to an expression such as "means for xxx-ing").

[0286] According to example embodiments, an apparatus representing the network node or entity 10, 30, 40, 60, 70, 90, 100, 120, 140, 150 exemplified above comprises at least one processor 371, at least one memory 372 including computer program code, and at least one interface 373 configured for communication with at least another apparatus. The processor (i.e. the at least one processor 371, with the at least one memory 372 and the computer program code) is configured to perform any of the corresponding steps (corresponding to the respective network node or entity 10, 30, 40, 60, 70, 90, 100, 120, 140, 150 exemplified above) of the corresponding methods described above with reference to any of Figs. 17 to 23.

[0287] As an example, according to example embodiments, an apparatus representing the network node or entity 10 (e.g. of a user equipment configured to move from a source access node to a target access node) comprises at least one processor 371, at least one memory 372 including computer program code, and at least one interface 373 configured for communication with at least another apparatus. The processor (i.e. the at least one processor 371, with the at least one memory 372 and the computer program code) is configured to perform transmitting, towards said target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of said user equipment (thus the apparatus comprising corresponding means for transmitting), and to perform receiving, from said target access node, a response message indicative of mobility processing success, said response message comprising an indication to derive a key for access via said target access node (thus the apparatus comprising corresponding means for receiving).

[0288] Similar principles of implementation utilizing the at least one processor 371, the at least one memory 372 including computer program code, and the at least one interface 373 configured for communication with at least another apparatus, shall equally apply to the network node or entity 30, 40, 60, 70, 90, 100, 120, 140, 150 exemplified above.

[0289] For further details regarding the operability / functionality of the individual apparatuses, reference is made to the above description in connection with any one of Figs. 1 to 36, respectively.

[0290] For the purpose of the present disclosure as described herein above, it should be noted that

[0291] - method steps likely to be implemented as software code portions and being run using a processor at a network server or network entity (as examples of devices, apparatuses and / or modules thereof, or as examples of entities including apparatuses and / or modules therefore), are software code independent and can be specified using any known or future developed programming language as long as the functionality defined by the method steps is preserved;

[0292] - generally, any method step is suitable to be implemented as software or by hardware without changing the idea of the embodiments and its modification in terms of the functionality implemented;

[0293] - method steps and / or devices, units or means likely to be implemented as hardware components at the above-defined apparatuses, or any module(s) thereof, (e.g., devices carrying out the functions of the apparatuses according to the embodiments as described above) are hardware independent and can be implemented using any known or future developed hardware technology or any hybrids of these, such as MOS (Metal Oxide Semiconductor), CMOS (Complementary MOS), BiMOS (Bipolar MOS), BiCMOS (Bipolar CMOS), ECL (Emitter Coupled Logic), TTL (Transistor-Transistor Logic), etc., using for example ASIC (Application Specific IC (Integrated Circuit)) components, FPGA (Field-programmable Gate Arrays) components, CPLD (Complex Programmable Logic Device) components or DSP (Digital Signal Processor) components; - devices, units or means (e.g. the above-defined network entity or network register, or any one of their respective units / means) can be implemented as individual devices, units or means, but this does not exclude that they are implemented in a distributed fashion throughout the system, as long as the functionality of the device, unit or means is preserved;

[0294] - an apparatus like the user equipment and the network entity / network register may be represented by a semiconductor chip, a chipset, or a (hardware) module comprising such chip or chipset; this, however, does not exclude the possibility that a functionality of an apparatus or module, instead of being hardware implemented, be implemented as software in a (software) module such as a computer program or a computer program product comprising executable software code portions for execution / being run on a processor;

[0295] - a device may be regarded as an apparatus or as an assembly of more than one apparatus, whether functionally in cooperation with each other or functionally independently of each other but in a same device housing, for example.

[0296] In general, it is to be noted that respective functional blocks or elements according to above-described aspects can be implemented by any known means, either in hardware and / or software, respectively, if it is only adapted to perform the described functions of the respective parts. The mentioned method steps can be realized in individual functional blocks or by individual devices, or one or more of the method steps can be realized in a single functional block or by a single device.

[0297] Generally, any method step is suitable to be implemented as software or by hardware without changing the idea of the present disclosure. Devices and means can be implemented as individual devices, but this does not exclude that they are implemented in a distributed fashion throughout the system, as long as the functionality of the device is preserved. Such and similar principles are to be considered as known to a skilled person. Software in the sense of the present description comprises software code as such comprising code means or portions or a computer program or a computer program product for performing the respective functions, as well as software (or a computer program or a computer program product) embodied on a tangible medium such as a computer-readable (storage) medium having stored thereon a respective data structure or code means / portions or embodied in a signal or in a chip, potentially during processing thereof.

[0298] The present disclosure also covers any conceivable combination of method steps and operations described above, and any conceivable combination of nodes, apparatuses, modules or elements described above, as long as the above-described concepts of methodology and structural arrangement are applicable.

[0299] In view of the above, there are provided measures for efficient user equipment authentication. Such measures exemplarily comprise, e.g. at a management function entity, receiving, from a target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of a user equipment, checking at least one mobility processing precondition, and transmitting, if said at least one mobility processing precondition is satisfied, towards said target access node, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node.

[0300] Even though the disclosure is described above with reference to the examples according to the accompanying drawings, it is to be understood that the disclosure is not restricted thereto. Rather, it is apparent to those skilled in the art that the present disclosure can be modified in many ways without departing from the scope of the inventive idea as disclosed herein.

[0301] List of acronyms and abbreviations 3GPP 3rd Generation Partnership Project

[0302] 5GC 5th Generation core

[0303] 5G-GUTI 5G globally unique temporary identifier

[0304] 5WWC 5G wireless wireline convergence

[0305] AMF access and mobility management function

[0306] AN access network

[0307] AUSF authentication server function

[0308] CN core network

[0309] DN data network

[0310] HPLMN home public land mobile network

[0311] IP internet protocol

[0312] N3IWF non-3GPP access interworking function

[0313] N5CW non-5G-capable over WLAN

[0314] NAI network access identity

[0315] NAS non-access stratum

[0316] PDN packet data network

[0317] PLMN public land mobile network

[0318] PMK pairwise master key

[0319] SA security association

[0320] SEAF security anchor function

[0321] SIDF subscription identifier de-concealing function

[0322] SMC security mode command

[0323] SUCI subscription concealed identifier

[0324] SUPI subscription permanent identifier

[0325] TNAN trusted non-3GPP access network

[0326] TNGF trusted non-3GPP gateway function

[0327] TWAP trusted WLAN access point

[0328] TWIF trusted WLAN interworking function

[0329] UDM unified data management

[0330] UE user equipment

[0331] USIM universal subscriber identity module

[0332] VPLMN visited public land mobile network WLAN wireless local area network

Claims

Claims1. An apparatus of a user equipment configured to move from a source access node to a target access node, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : transmitting, towards said target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of said user equipment, and receiving, from said target access node, a response message indicative of mobility processing success, said response message comprising an indication to derive a key for access via said target access node.

2. The apparatus according to claim 1, wherein said temporary identifier of said user equipment is a 5G globally unique temporary identifier of said user equipment.

3. The apparatus according to claim 1 or 2, wherein said registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes.

4. The apparatus according to any of claims 1 to 3, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : deriving said key for access via said target access node.

5. An apparatus of a target access node, the apparatus comprising at least one processor, at least one memory including computer program code, andat least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving, from a user equipment, a first registration message demanding mobility processing, said first registration message comprising a temporary identifier of said user equipment, analyzing said temporary identifier of said user equipment for whether said temporary identifier of said user equipment is valid for a network said target access node provides access to, and transmitting, if said temporary identifier of said user equipment is valid for said network said target access node provides access to, towards a management function entity, a second registration message demanding mobility processing, said second registration message comprising said temporary identifier of said user equipment.

6. The apparatus according to claim 5, wherein said temporary identifier of said user equipment is a 5G globally unique temporary identifier of said user equipment.

7. The apparatus according to claim 5 or 6, wherein said first registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and / or said second registration message comprises said indication of said user equipment ability for mobility processing in relation to movement between access nodes, and / or said second registration message comprises an indication of a target access node ability for mobility processing in relation to movement between access nodes, and / or the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform transmitting, if said temporary identifier of said mobile communicationendpoint is valid for said network said target access node provides access to, towards said management function entity, an information message, said information message including said indication of said target access node ability for mobility processing in relation to movement between access nodes.

8. The apparatus according to any of claims 5 to 7, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving, from said management function entity, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node and comprising said key for access via said target access node, and transmitting, towards said user equipment, a second response message indicative of mobility processing success, said second response message comprising said indication to derive said key for access via said target access node.

9. The apparatus according to any of claims 5 to 7, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving, from said management function entity, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node, and transmitting, towards said user equipment, a second response message indicative of mobility processing success, said second response message comprising said indication to derive said key for access via said target access node.

10. The apparatus according to claim 9, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform :receiving, from said management function entity, a third response message, said third response message comprising said key for access via said target access node, and transmitting, towards said user equipment, a fourth response message indicative of mobility processing success, said fourth response message comprising said indication to derive said key for access via said target access node.

11. An apparatus of a management function entity, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving, from a target access node, a registration message demanding mobility processing, said registration message comprising a temporary identifier of a user equipment, checking at least one mobility processing precondition, and transmitting, if said at least one mobility processing precondition is satisfied, towards said target access node, a first response message indicative of mobility processing success, said first response message comprising an indication to derive a key for access via said target access node.

12. The apparatus according to claim 11, wherein said temporary identifier of said user equipment is a 5G globally unique temporary identifier of said user equipment.

13. The apparatus according to claim 11 or 12, wherein said registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and / orsaid registration message comprises an indication of a target access node ability for mobility processing in relation to movement between access nodes, and / or the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform receiving, from said target access node, an information message, said information message including said indication of said target access node ability for mobility processing in relation to movement between access nodes.

14. The apparatus according to claim 13, wherein said at least one mobility processing precondition comprises said user equipment ability for mobility processing in relation to movement between access nodes, and / or said at least one mobility processing precondition comprises said target access node ability for mobility processing in relation to movement between access nodes.

15. The apparatus according to any of claims 11 to 14, wherein said first response message comprises said key for access via said target access node.

16. The apparatus according to any of claims 11 to 15, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : deriving, if said at least one mobility processing precondition is satisfied, said key for access via said target access node.

17. The apparatus according to any of claims 11 to 15, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : transmitting, if said at least one mobility processing precondition is satisfied, towards a source access node, a key request, andreceiving, from said source access node, said key for access via said target access node.

18. The apparatus according to any of claims 11 to 16, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : transmitting, if said at least one mobility processing precondition is satisfied, towards said target access node, a second response message, said second response message comprising said key for access via said target access node.

19. An apparatus of a source access node, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving, from a management function entity, a key request, deriving a key for access via said target access node, and transmitting, towards said management function entity, said key for access via said target access node.

20. An apparatus of a user equipment, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : transmitting, towards an access node, a registration message, wherein said registration message comprises an indication of a user equipment ability for mobility processing in relation to movement between access nodes.

21. The apparatus according to claim 20, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving information on target access node candidates for movement between access nodes, and storing said information on said target access node candidates for movement between access nodes.

22. An apparatus of an access node, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving, from a user equipment, a first registration message, said first registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and transmitting, towards a management function entity, a second registration message, said second registration message comprising said indication of said user equipment ability for mobility processing in relation to movement between access nodes.

23. An apparatus of a management function entity, the apparatus comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform :receiving, from an access node, a registration message, said registration message comprising an indication of a user equipment ability for mobility processing in relation to movement between access nodes, and storing information on said user equipment ability for mobility processing in relation to movement between access nodes.

24. The apparatus according to claim 23, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : transmitting information on target access node candidates for movement between access nodes.

Images