Efficient primary authentication method

Abstract

A disclosure of the present specification provides a method by which an AAnF performs communication. The method comprises the steps of: receiving a first request for an AKMA application key from a first AF; on the basis of the first request, generating a first AKMA application key from an AKMA anchor key; determining the valid time of the first AKMA application key; receiving a second request for the AKMA application key from a second AF; on the basis of the second request, generating a second AKMA application key from the AKMA anchor key; and determining the valid time of the second AKMA application key, wherein the valid time of the first AKMA application key and the valid time of the second AKMA application key expire simultaneously.

Description

Efficient first-factor authentication method

[0001] This specification relates to mobile communications.

[0002] 3GPP (3rd Generation Partnership Project) LTE (Long-Term Evolution) is a technology designed to enable high-speed packet communications. Numerous approaches have been proposed to achieve LTE's goals of reducing costs for users and operators, improving service quality, expanding coverage, and increasing system capacity. 3GPP LTE's high-level requirements include reduced cost per bit, improved service availability, flexible use of frequency bands, a simple architecture, open interfaces, and adequate power consumption for terminals.

[0003] The International Telecommunication Union (ITU) and 3GPP have begun work on developing requirements and specifications for new radio (NR) systems. 3GPP must identify and develop the technical components necessary to successfully standardize NR in a timely manner, meeting both urgent market needs and the longer-term requirements outlined by the ITU-R (ITU radio communication sector) International Mobile Telecommunications (IMT)-2020 process. NR must also be able to utilize any spectrum band up to at least 100 GHz, ensuring that it remains available for wireless communications well into the future.

[0004] NR aims to be a single technology framework that addresses all deployment scenarios, usage scenarios, and requirements, including enhanced mobile broadband (eMBB), massive machine type communications (mMTC), and ultra-reliable and low latency communications (URLLC). NR must be inherently forward-compatible.

[0005] A method is required to prevent repetitive primary authentication.

[0006] Ensure that multiple AKMA application keys expire at the same time.

[0007] Figure 1 illustrates an example of a communication system to which the implementation of this specification is applied.

[0008] Figure 2 illustrates an example of a wireless device to which the implementation of the present specification is applied.

[0009] Figure 3 shows an example of a UE to which the implementation of this specification is applied.

[0010] Figure 4 is a structural diagram of a next-generation mobile communications network.

[0011] Figure 5 shows an example of a 5G system structure to which the implementation of this specification is applied.

[0012] Figure 6 shows an example of the start of primary authentication.

[0013] Figure 7 illustrates an example of a primary authentication procedure triggered by a home network.

[0014] Figure 8 shows an example of an AKMA key hierarchy.

[0015] Fig. 9 is K AKMA From K AF Shows an example of creation.

[0016] Figure 10 illustrates an example of a 5G system architecture involving multiple AFs.

[0017] Figures 11 and 12 are K according to an embodiment of the present specification. AF and K AF An example of creating an expiration time is shown.

[0018] Figure 13 illustrates an example of using a global synchronization timer according to an embodiment of the present specification.

[0019] Figure 14 illustrates an example of using a global synchronization timer according to an embodiment of the present specification.

[0020] Figure 15 illustrates the AAnF procedure for the disclosure of this specification.

[0021] The following techniques, devices, and systems can be applied to various wireless multiple access systems. Examples of multiple access systems include code division multiple access (CDMA) systems, frequency division multiple access (FDMA) systems, time division multiple access (TDMA) systems, orthogonal frequency division multiple access (OFDMA) systems, single carrier frequency division multiple access (SC-FDMA) systems, and multicarrier frequency division multiple access (MC-FDMA) systems. CDMA can be implemented via wireless technologies such as universal terrestrial radio access (UTRA) or CDMA2000. TDMA can be implemented via wireless technologies such as global system for mobile communications (GSM), general packet radio service (GPRS), or enhanced data rates for GSM evolution (EDGE). OFDMA can be implemented using wireless technologies such as IEEE (Institute of Electrical and Electronics Engineers) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, or E-UTRA (evolved UTRA). UTRA is part of UMTS (universal mobile telecommunications system). 3GPP (3rd generation partnership project) LTE (long-term evolution) is part of E-UMTS (evolved UMTS) that uses E-UTRA.3GPP LTE uses OFDMA in the downlink (DL) and SC-FDMA in the uplink (UL). Evolution of 3GPP LTE includes LTE-A (advanced), LTE-A Pro, and / or 5G NR (new radio).

[0022] For convenience of explanation, the implementation of this specification is primarily described in relation to a 3GPP-based wireless communication system. However, the technical features of this specification are not limited thereto. For example, the following detailed description is provided based on a mobile communication system corresponding to a 3GPP-based wireless communication system. However, aspects of this specification that are not limited to a 3GPP-based wireless communication system can be applied to other mobile communication systems.

[0023] For terms and technologies used in this specification that are not specifically described, reference may be made to wireless communication standard documents published prior to this specification.

[0024] As used herein, "A or B" can mean "only A," "only B," or "both A and B." Alternatively, as used herein, "A or B" can be interpreted as "A and / or B." For example, as used herein, "A, B or C" can mean "only A," "only B," "only C," or "any combination of A, B and C."

[0025] As used herein, a slash ( / ) or a comma can mean "and / or." For example, "A / B" can mean "A and / or B." Accordingly, "A / B" can mean "only A," "only B," or "both A and B." For example, "A, B, C" can mean "A, B, or C."

[0026] In this specification, “at least one of A and B” may mean “only A,” “only B,” or “both A and B.” Additionally, in this specification, the expressions “at least one of A or B” or “at least one of A and / or B” may be interpreted identically to “at least one of A and B.”

[0027] Additionally, in this specification, “at least one of A, B and C” can mean “only A”, “only B”, “only C”, or “any combination of A, B and C”. Additionally, “at least one of A, B or C” or “at least one of A, B and / or C” can mean “at least one of A, B and C”.

[0028] Additionally, parentheses used herein may mean "for example." Specifically, when indicated as "control information (PDCCH)", "PDCCH" may be proposed as an example of "control information." In other words, "control information" in this specification is not limited to "PDCCH," and "PDCCH" may be proposed as an example of "control information." Furthermore, even when indicated as "control information (i.e., PDCCH)", "PDCCH" may be proposed as an example of "control information."

[0029] Technical features individually described in a single drawing in this specification may be implemented individually or simultaneously.

[0030] Although not limited thereto, the various descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed herein may be applied to various fields requiring wireless communication and / or connectivity between devices (e.g., 5G).

[0031] Hereinafter, the present specification will be described in more detail with reference to the drawings. In the following drawings and / or description, the same reference numbers may refer to the same or corresponding hardware blocks, software blocks, and / or functional blocks, unless otherwise indicated.

[0032] Figure 1 illustrates an example of a communication system to which the implementation of this specification is applied.

[0033] The 5G usage scenario shown in FIG. 1 is only an example, and the technical features of this specification can be applied to other 5G usage scenarios not shown in FIG. 1.

[0034] The three main requirement categories for 5G are (1) enhanced mobile broadband (eMBB), (2) massive machine type communication (mMTC), and (3) ultra-reliable and low latency communications (URLLC).

[0035] Referring to FIG. 1, a communication system (1) includes wireless devices (100a to 100f), a base station (BS; 200), and a network (300). FIG. 1 illustrates a 5G network as an example of a network of the communication system (1), but the implementation of the present disclosure is not limited to a 5G system and can be applied to future communication systems beyond the 5G system.

[0036] The base station (200) and the network (300) may be implemented as wireless devices, and a particular wireless device may operate as a base station / network node in relation to other wireless devices.

[0037] Wireless devices (100a to 100f) refer to devices that perform communication using radio access technology (RAT) (e.g., 5G NR or LTE) and may also be referred to as communication / wireless / 5G devices. Wireless devices (100a to 100f) may include, but are not limited to, robots (100a), vehicles (100b-1 and 100b-2), extended reality (XR) devices (100c), portable devices (100d), home appliances (100e), IoT devices (100f), and artificial intelligence (AI) devices / servers (400). For example, vehicles may include vehicles having wireless communication capabilities, autonomous vehicles, and vehicles capable of performing vehicle-to-vehicle communication. Vehicles may include unmanned aerial vehicles (UAVs) (e.g., drones). XR devices may include AR / VR / mixed reality (MR) devices, and may be implemented in the form of head-mounted devices (HMDs) and heads-up displays (HUDs) mounted on vehicles, televisions, smartphones, computers, wearable devices, home appliances, digital signs, vehicles, robots, etc. Portable devices may include smartphones, smart pads, wearable devices (e.g., smart watches or smart glasses), and computers (e.g., laptops). Home appliances may include TVs, refrigerators, and washing machines. IoT devices may include sensors and smart meters.

[0038] In this specification, wireless devices (100a to 100f) may be referred to as user equipment (UE). The UE may include, for example, a mobile phone, a smartphone, a laptop computer, a digital broadcasting terminal, a personal digital assistant (PDA), a portable multimedia player (PMP), a navigation system, a slate PC, a tablet PC, an ultrabook, a vehicle, a vehicle with autonomous driving functions, a connected car, a UAV, an AI module, a robot, an AR device, a VR device, an MR device, a holographic device, a public safety device, an MTC device, an IoT device, a medical device, a fintech device (or a financial device), a security device, a weather / environmental device, a 5G service-related device, or a 4th industrial revolution-related device.

[0039] For example, a UAV may be an aircraft that is unmanned and navigated by radio control signals.

[0040] For example, a VR device may include a device for implementing objects or backgrounds in a virtual environment. For example, an AR device may include a device that implements objects or backgrounds in a virtual world by connecting them to objects or backgrounds in the real world. For example, an MR device may include a device that implements objects or backgrounds in a virtual world by merging them with objects or backgrounds in the real world. For example, a holographic device may include a device that implements 360-degree stereoscopic images by recording and reproducing three-dimensional information using the light interference phenomenon that occurs when two laser lights, called holograms, meet.

[0041] For example, a public safety device may include an image relay device or imaging device that can be worn on the user's body.

[0042] For example, MTC devices and IoT devices may be devices that do not require direct human intervention or manipulation. Examples include smart meters, vending machines, thermometers, smart light bulbs, door locks, or various sensors.

[0043] For example, a medical device may be a device used for the purpose of diagnosing, treating, alleviating, curing, or preventing a disease. For example, a medical device may be a device used for diagnosing, treating, alleviating, or correcting an injury or damage. For example, a medical device may be a device used for the purpose of examining, replacing, or modifying a structure or function. For example, a medical device may be a device used for the purpose of regulating pregnancy. For example, a medical device may include a therapeutic device, a driving device, an (in vitro) diagnostic device, a hearing aid, or a surgical device.

[0044] For example, a security device may be a device installed to prevent potential hazards and maintain safety. For example, a security device may be a camera, closed-circuit television (CCTV), recorder, or black box.

[0045] For example, a fintech device may be a device capable of providing financial services, such as mobile payments. For example, a fintech device may include a payment device or a point-of-sale system.

[0046] For example, a weather / environment device may include a device that monitors or predicts the weather / environment.

[0047] Wireless devices (100a to 100f) can be connected to a network (300) via a base station (200). AI technology can be applied to the wireless devices (100a to 100f), and the wireless devices (100a to 100f) can be connected to an AI server (400) via the network (300). The network (300) can be configured using a 3G network, a 4G (e.g., LTE) network, a 5G (e.g., NR) network, and a network after 5G. The wireless devices (100a to 100f) can communicate with each other via the base station (200) / network (300), but can also communicate directly (e.g., sidelink communication) without going through the base station (200) / network (300). For example, vehicles (100b-1, 100b-2) can communicate directly (e.g., vehicle-to-vehicle (V2V) / vehicle-to-everything (V2X) communication). Additionally, IoT devices (e.g., sensors) can communicate directly with other IoT devices (e.g., sensors) or other wireless devices (100a to 100f).

[0048] Wireless communication / connection (150a, 150b, 150c) can be established between wireless devices (100a to 100f) and / or between wireless devices (100a to 100f) and a base station (200) and / or between base stations (200). Here, the wireless communication / connection can be established through various RATs (e.g., 5G NR), such as uplink / downlink communication (150a), sidelink communication (150b) (or, device-to-device (D2D) communication), and base station-to-base station communication (150c) (e.g., relay, integrated access and backhaul (IAB)). Through the wireless communication / connection (150a, 150b, 150c), the wireless devices (100a to 100f) and the base station (200) can transmit / receive wireless signals to / from each other. For example, wireless communication / connection (150a, 150b, 150c) can transmit / receive signals through various physical channels. To this end, at least some of the various configuration information setting processes for transmitting / receiving wireless signals, various signal processing processes (e.g., channel encoding / decoding, modulation / demodulation, resource mapping / demapping, etc.), and resource allocation processes can be performed based on various proposals of the present specification.

[0049] AI is the study of artificial intelligence or the methodologies for creating it, while machine learning (ML) defines various problems in the field of AI and studies the methodologies for solving them. Machine learning is also defined as an algorithm that improves performance on a task through consistent experience.

[0050] A robot can be defined as a machine that automatically processes or operates a given task based on its own capabilities. Specifically, a robot capable of perceiving its environment, making decisions, and performing actions on its own can be called an intelligent robot. Robots can be categorized into industrial, medical, household, and military applications based on their intended use or field. Robots are equipped with a drive unit, including an actuator or motor, enabling them to perform various physical actions, such as moving robot joints. Furthermore, mobile robots include wheels, brakes, and propellers in their drive unit, enabling them to drive on the ground or fly in the air.

[0051] Autonomous driving refers to the technology of driving on one's own, while autonomous vehicles refer to vehicles that drive without, or with minimal, user intervention. For example, autonomous driving can include technologies such as lane keeping, automatic speed control like adaptive cruise control, autonomous driving along a set route, and autonomous driving based on a set destination. Vehicles encompass all types of vehicles: those with internal combustion engines, hybrid vehicles with both internal combustion engines and electric motors, and electric vehicles with only electric motors. These vehicles can include not only cars but also trains and motorcycles. Autonomous vehicles can be viewed as robots with autonomous driving capabilities.

[0052] Extended reality is a general term for VR, AR, and MR. VR technology provides real-world objects and backgrounds as CG images only, AR technology provides virtual CG images over images of real objects, and MR technology is a CG technology that mixes and combines virtual objects with the real world. MR technology is similar to AR in that it displays real and virtual objects together. However, there is a difference: while AR uses virtual objects to complement real objects, MR uses virtual and real objects equally.

[0053] NR supports multiple numerologies, or subcarrier spacing (SCS), to support diverse 5G services. For example, an SCS of 15 kHz supports wide areas in traditional cellular bands; an SCS of 30 kHz / 60 kHz supports dense urban areas, lower latency, and wider carrier bandwidth; and an SCS of 60 kHz or higher supports bandwidths greater than 24.25 GHz to overcome phase noise.

[0054] The NR frequency band can be defined by two types of frequency ranges (FR1 and FR2). The numerical values ​​of the frequency ranges can be changed. For example, the two types of frequency ranges (FR1 and FR2) can be as shown in Table 1 below. For convenience of explanation, among the frequency ranges used in NR systems, FR1 can mean the "sub-6GHz range," and FR2 can mean the "above 6GHz range," which can be referred to as millimeter wave (mmW).

[0055] Frequency Range DefinitionFrequency RangeSubcarrier SpacingFR1450MHz - 6000MHz15, 30, 60kHzFR224250MHz - 52600MHz60, 120, 240kHz

[0056] As described above, the numerical value of the frequency range of the NR system can be changed. For example, FR1 may include a band from 410 MHz to 7125 MHz, as shown in Table 2 below. That is, FR1 may include frequency bands above 6 GHz (or 5850, 5900, 5925 MHz, etc.). For example, the frequency bands above 6 GHz (or 5850, 5900, 5925 MHz, etc.) included within FR1 may include unlicensed bands. Unlicensed bands can be used for various purposes, such as for communications for vehicles (e.g., autonomous driving).

[0057] Frequency Range DefinitionFrequency RangeSubcarrier SpacingFR1410MHz - 7125MHz15, 30, 60kHzFR224250MHz - 52600MHz60, 120, 240kHz

[0058] Here, the wireless communication technology implemented in the wireless device of the present specification may include not only LTE, NR, and 6G, but also narrowband IoT (NB-IoT) for low-power communication. For example, NB-IoT technology may be an example of LPWAN (low power wide area network) technology and may be implemented with standards such as LTE Cat NB1 and / or LTE Cat NB2, and is not limited to the above-described names. Additionally or alternatively, the wireless communication technology implemented in the wireless device of the present specification may perform communication based on LTE-M technology. For example, LTE-M technology may be an example of LPWAN technology and may be called by various names such as eMTC (enhanced MTC). For example, LTE-M technology can be implemented by at least one of various standards such as 1) LTE CAT 0, 2) LTE Cat M1, 3) LTE Cat M2, 4) LTE non-BL (non-bandwidth limited), 5) LTE-MTC, 6) LTE MTC, and / or 7) LTE M, and is not limited to the above-described names. Additionally or alternatively, the wireless communication technology implemented in the wireless device of the present specification can include at least one of ZigBee, Bluetooth, and / or LPWAN considering low-power communication, and is not limited to the above-described names. For example, ZigBee technology can create PAN (personal area networks) related to small / low-power digital communication based on various standards such as IEEE 802.15.4, and can be called by various names.

[0059] Figure 2 illustrates an example of a wireless device to which the implementation of the present specification is applied.

[0060] In FIG. 2, the first wireless device (100) and / or the second wireless device (200) may be implemented in various forms depending on the use case / service. For example, {the first wireless device (100) and the second wireless device (200)} may correspond to at least one of {the wireless devices (100a to 100f) and the base station (200)}, {the wireless devices (100a to 100f) and the wireless devices (100a to 100f)}, and / or {the base station (200) and the base station (200)} of FIG. 1. The first wireless device (100) and / or the second wireless device (200) may be configured by various components, devices / parts, and / or modules.

[0061] The first wireless device (100) may include at least one transceiver, such as a transceiver (106), at least one processing chip, such as a processing chip (101), and / or one or more antennas (108).

[0062] The processing chip (101) may include at least one processor, such as a processor (102), and at least one memory, such as a memory (104). Additionally and / or alternatively, the memory (104) may be located external to the processing chip (101).

[0063] The processor (102) may control the memory (104) and / or the transceiver (106) and may be configured to implement the descriptions, functions, procedures, proposals, methods, and / or operational flowcharts disclosed herein. For example, the processor (102) may process information in the memory (104) to generate first information / signal and transmit a wireless signal including the first information / signal via the transceiver (106). The processor (102) may receive a wireless signal including second information / signal via the transceiver (106) and store information obtained by processing the second information / signal in the memory (104).

[0064] A memory (104) may be operatively connected to the processor (102). The memory (104) may store various types of information and / or instructions. The memory (104) may store firmware and / or software code (105) that implements code, instructions and / or sets of instructions that, when executed by the processor (102), perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed herein. For example, the firmware and / or software code (105) may implement instructions that, when executed by the processor (102), perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed herein. For example, the firmware and / or software code (105) may control the processor (102) to perform one or more protocols. For example, the firmware and / or software code (105) may control the processor (102) to perform one or more air interface protocol layers.

[0065] Here, the processor (102) and memory (104) may be part of a communication modem / circuit / chip designed to implement a RAT (e.g., LTE or NR). A transceiver (106) may be connected to the processor (102) and may transmit and / or receive wireless signals via one or more antennas (108). Each transceiver (106) may include a transmitter and / or a receiver. The transceiver (106) may be used interchangeably with an RF (radio frequency) unit. In the present specification, the first wireless device (100) may represent a communication modem / circuit / chip.

[0066] The second wireless device (200) may include at least one transceiver, such as a transceiver (206), at least one processing chip, such as a processing chip (201), and / or one or more antennas (208).

[0067] The processing chip (201) may include at least one processor, such as a processor (202), and at least one memory, such as a memory (204). Additionally and / or alternatively, the memory (204) may be located external to the processing chip (201).

[0068] The processor (202) may control the memory (204) and / or the transceiver (206) and may be configured to implement the descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed herein. For example, the processor (202) may process information in the memory (204) to generate third information / signal and transmit a wireless signal including the third information / signal via the transceiver (206). The processor (202) may receive a wireless signal including fourth information / signal via the transceiver (206) and store information obtained by processing the fourth information / signal in the memory (204).

[0069] A memory (204) may be operatively connected to the processor (202). The memory (204) may store various types of information and / or instructions. The memory (204) may store firmware and / or software code (205) that implements instruction codes, commands and / or sets of instructions that, when executed by the processor (202), perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed herein. For example, the firmware and / or software code (205) may implement instructions that, when executed by the processor (202), perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed herein. For example, the firmware and / or software code (205) may control the processor (202) to perform one or more protocols. For example, the firmware and / or software code (205) may control the processor (202) to perform one or more air interface protocol layers.

[0070] Here, the processor (202) and memory (204) may be part of a communication modem / circuit / chip designed to implement a RAT (e.g., LTE or NR). A transceiver (206) may be connected to the processor (202) and may transmit and / or receive wireless signals via one or more antennas (208). Each transceiver (206) may include a transmitter and / or a receiver. The transceiver (206) may be used interchangeably with the RF unit. In the present specification, the second wireless device (200) may represent a communication modem / circuit / chip.

[0071] Hereinafter, hardware elements of the wireless device (100, 200) will be described in more detail. Although not limited thereto, one or more protocol layers may be implemented by one or more processors (102, 202). For example, one or more processors (102, 202) may implement one or more layers (e.g., functional layers such as a physical (PHY) layer, a media access control (MAC) layer, a radio link control (RLC) layer, a packet data convergence protocol (PDCP) layer, a radio resource control (RRC) layer, and a service data adaptation protocol (SDAP) layer). One or more processors (102, 202) may generate one or more protocol data units (PDUs), one or more service data units (SDUs), messages, control information, data, or information according to the descriptions, functions, procedures, proposals, methods, and / or operational flowcharts disclosed herein. One or more processors (102, 202) can generate signals (e.g., baseband signals) including PDUs, SDUs, messages, control information, data or information according to the descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed herein and provide the signals to one or more transceivers (106, 206). One or more processors (102, 202) can receive signals (e.g., baseband signals) from one or more transceivers (106, 206) and obtain PDUs, SDUs, messages, control information, data or information according to the descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed herein.

[0072] The one or more processors (102, 202) may be referred to as a controller, a microcontroller, a microprocessor, and / or a microcomputer. The one or more processors (102, 202) may be implemented by hardware, firmware, software, and / or a combination thereof. For example, one or more application specific integrated circuits (ASICs), one or more digital signal processors (DSPs), one or more digital signal processing devices (DSPDs), one or more programmable logic devices (PLDs), and / or one or more field programmable gate arrays (FPGAs) may be included in the one or more processors (102, 202). For example, the one or more processors (102, 202) may be configured by a set of a communication control processor, an application processor (AP), an electronic control unit (ECU), a central processing unit (CPU), a graphic processing unit (GPU), and a memory control processor.

[0073] One or more memories (104, 204) may be coupled to one or more processors (102, 202) and may store various forms of data, signals, messages, information, programs, codes, instructions, and / or commands. The one or more memories (104, 204) may be configured as random access memory (RAM), dynamic RAM (DRAM), read-only memory (ROM), erasable programmable ROM (EPROM), flash memory, volatile memory, nonvolatile memory, hard drive, register, cache memory, computer-readable storage media, and / or combinations thereof. The one or more memories (104, 204) may be located internally and / or externally to the one or more processors (102, 202). Additionally, the one or more memories (104, 204) may be coupled to the one or more processors (102, 202) via various technologies, such as wired or wireless connections.

[0074] One or more transceivers (106, 206) can transmit user data, control information, wireless signals / channels, etc., referred to in the descriptions, functions, procedures, proposals, methods, and / or flowcharts disclosed herein to one or more other devices. One or more transceivers (106, 206) can receive user data, control information, wireless signals / channels, etc., referred to in the descriptions, functions, procedures, proposals, methods, and / or flowcharts disclosed herein from one or more other devices. For example, one or more transceivers (106, 206) can be coupled to one or more processors (102, 202) and can transmit and receive wireless signals. For example, one or more processors (102, 202) can control one or more transceivers (106, 206) to transmit user data, control information, wireless signals, etc., to one or more other devices. Additionally, one or more processors (102, 202) may control one or more transceivers (106, 206) to receive user data, control information, wireless signals, etc. from one or more other devices.

[0075] One or more transceivers (106, 206) may be coupled to one or more antennas (108, 208). Additionally and / or alternatively, one or more transceivers (106, 206) may include one or more antennas (108, 208). One or more transceivers (106, 206) may be configured to transmit and receive user data, control information, wireless signals / channels, etc., as described in the descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed herein via one or more antennas (108, 208). In the present specification, one or more antennas (108, 208) may be multiple physical antennas or multiple logical antennas (e.g., antenna ports).

[0076] One or more transceivers (106, 206) may convert received user data, control information, wireless signals / channels, etc. from RF band signals to baseband signals in order to process the received user data, control information, wireless signals / channels, etc. using one or more processors (102, 202). One or more transceivers (106, 206) may convert processed user data, control information, wireless signals / channels, etc. from baseband signals to RF band signals using one or more processors (102, 202). For this purpose, one or more transceivers (106, 206) may include an (analog) oscillator and / or a filter. For example, one or more transceivers (106, 206) may up-convert an OFDM baseband signal to an OFDM signal via an (analog) oscillator and / or filter under the control of one or more processors (102, 202) and transmit the up-converted OFDM signal at a carrier frequency. One or more transceivers (106, 206) may receive an OFDM signal at a carrier frequency and down-convert the OFDM signal to an OFDM baseband signal via an (analog) oscillator and / or filter under the control of one or more processors (102, 202).

[0077] Although not illustrated in FIG. 2, the wireless device (100, 200) may further include additional components. The additional components (140) may be configured in various ways depending on the type of the wireless device (100, 200). For example, the additional components (140) may include at least one of a power unit / battery, an input / output (I / O) device (e.g., an audio I / O port, a video I / O port), a driving device, and a computing device. The additional components (140) may be connected to one or more processors (102, 202) via various technologies, such as a wired or wireless connection.

[0078] In the implementation of the present specification, a UE can operate as a transmitter in the uplink (UL) and as a receiver in the downlink (DL). In the implementation of the present specification, a base station can operate as a receiver in the UL and as a transmitter in the DL. For the sake of convenience of description, it is mainly assumed below that the first wireless device (100) operates as a UE and the second wireless device (200) operates as a base station. For example, a processor (102) connected to, mounted on, or released in the first wireless device (100) can be configured to perform UE operations according to the implementation of the present specification or to control a transceiver (106) to perform UE operations according to the implementation of the present specification. A processor (202) connected to, mounted on, or released in the second wireless device (200) can be configured to perform base station operations according to the implementation of the present specification or to control a transceiver (206) to perform base station operations according to the implementation of the present specification.

[0079] In this specification, a base station may be referred to as a Node B, an eNode B (eNB), or a gNB.

[0080] Figure 3 shows an example of a UE to which the implementation of this specification is applied.

[0081] Figure 3 shows an example of a UE to which the implementation of this specification is applied.

[0082] Referring to FIG. 3, the UE (100) can correspond to the first wireless device (100) of FIG. 2.

[0083] The UE (100) includes a processor (102), memory (104), a transceiver (106), one or more antennas (108), a power management module (141), a battery (142), a display (143), a keypad (144), a SIM (Subscriber Identification Module) card (145), a speaker (146), and a microphone (147).

[0084] The processor (102) may be configured to implement the descriptions, functions, procedures, proposals, methods and / or flowcharts disclosed herein. The processor (102) may be configured to control one or more other components of the UE (100) to implement the descriptions, functions, procedures, proposals, methods and / or flowcharts disclosed herein. A layer of a radio interface protocol may be implemented in the processor (102). The processor (102) may include an ASIC, other chipsets, logic circuits and / or data processing devices. The processor (102) may be an application processor. The processor (102) may include at least one of a DSP, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), and a modem (modulator and demodulator). An example of the processor (102) is the SNAPDRAGON manufactured by Qualcomm®. TM Series processors, EXYNOS made by Samsung® TM Series processors, A-series processors made by Apple®, HELIO made by MediaTek® TM ATOM series processors made by Intel® TM It can be found in the series processors or the corresponding next-generation processors.

[0085] Memory (104) is operatively coupled to the processor (102) and stores various information for operating the processor (102). Memory (104) may include ROM, RAM, flash memory, memory cards, storage media, and / or other storage devices. When the implementation is implemented in software, the techniques described herein may be implemented using modules (e.g., procedures, functions, etc.) that perform the descriptions, functions, procedures, suggestions, methods, and / or operational flowcharts disclosed herein. The modules may be stored in memory (104) and executed by the processor (102). Memory (104) may be implemented within the processor (102) or external to the processor (102), in which case it may be communicatively coupled to the processor (102) via various methods known in the art.

[0086] A transceiver (106) is operably coupled to the processor (102) and transmits and / or receives a radio signal. The transceiver (106) includes a transmitter and a receiver. The transceiver (106) may include a baseband circuit for processing a radio frequency signal. The transceiver (106) controls one or more antennas (108) to transmit and / or receive a radio signal.

[0087] The power management module (141) manages the power of the processor (102) and / or the transceiver (106). The battery (142) supplies power to the power management module (141).

[0088] The display (143) outputs the results processed by the processor (102). The keypad (144) receives input to be used by the processor (102). The keypad (144) can be displayed on the display (143).

[0089] A SIM card (145) is an integrated circuit that securely stores an International Mobile Subscriber Identity (IMSI) and associated keys, and is used to identify and authenticate subscribers in mobile devices such as mobile phones and computers. Additionally, many SIM cards can store contact information.

[0090] The speaker (146) outputs sound-related results processed by the processor (102). The microphone (147) receives sound-related input to be used by the processor (102).

[0091] Figure 4 is a structural diagram of a next-generation mobile communications network.

[0092] 5GC (5G Core) may include various components, and in FIG. 5, some of them include AMF (Access and Mobility Management Function) (410), SMF (Session Management Function) (420), PCF (Policy Control Function) (430), UPF (User Plane Function) (440), AF (Application Function) (450), UDM (Unified Data Management) (460), and N3IWF (Non-3GPP (3rd Generation Partnership Project) Inter Working Function) (490).

[0093] The UE (100) is connected to a data network via UPF (440) through a Next Generation Radio Access Network (NG-RAN) including a gNB (20).

[0094] The UE (100) can also receive data services via untrusted non-3GPP access, such as a Wireless Local Area Network (WLAN). To connect the non-3GPP access to the core network, an N3IWF (490) may be deployed.

[0095] The illustrated N3IWF (490) performs the function of managing interworking between non-3GPP access and 5G system. When UE (100) is connected to non-3GPP access (e.g., WiFi, referred to as IEEE 801.11), UE (100) can be connected to 5G system through N3IWF (490). N3IWF (490) performs control signaling with AMF (410) and is connected to UPF (440) through N3 interface for data transmission.

[0096] The illustrated AMF (410) can manage access and mobility in a 5G system. The AMF (410) can perform functions to manage Non-Access Stratum (NAS) security. The AMF (410) can perform functions to handle mobility in the idle state.

[0097] The illustrated UPF (440) is a type of gateway through which user data is transmitted and received. The UPF node (440) can perform all or part of the user plane functions of the S-GW (Serving Gateway) and P-GW (Packet Data Network Gateway) of 4th generation mobile communications.

[0098] The UPF (440) acts as a boundary point between the next generation radio access network (NG-RAN) and the core network, and is an element that maintains a data path between the gNB (20) and the SMF (420). In addition, when the UE (100) moves across the area served by the gNB (20), the UPF (440) acts as a mobility anchor point. The UPF (440) can perform a function of handling PDUs. For mobility within the NG-RAN (Next Generation-Radio Access Network defined after 3GPP Release-15), the UPF can route packets. Additionally, the UPF (440) may also function as an anchor point for mobility with other 3GPP networks (RANs defined before 3GPP Release-15, e.g., UTRAN, E-UTRAN (Evolved-UMTS (Universal Mobile Telecommunications System) Terrestrial Radio Access Network)) or GERAN (GSM (Global System for Mobile Communication) / EDGE (Enhanced Data rates for Global Evolution) Radio Access Network). The UPF (440) may correspond to a termination point of a data interface toward a data network.

[0099] The illustrated PCF (430) is a node that controls the business operator's policy.

[0100] The illustrated AF (450) is a server for providing various services to the UE (100).

[0101] The illustrated UDM (460) is a type of server that manages subscriber information, such as the HSS (Home Subscriber Server) of 4th generation mobile communications. The UDM (460) stores and manages the subscriber information in a Unified Data Repository (UDR).

[0102] The illustrated SMF (420) can perform the function of allocating an IP (Internet Protocol) address of the UE. In addition, the SMF (420) can control a PDU (protocol data unit) session.

[0103] For reference, the drawing symbols for AMF (410), SMF (420), PCF (430), UPF (440), AF (450), UDM (460), N3IWF (490), gNB (20), or UE (100) may be omitted below.

[0104] 5G mobile communications support multiple numerologies, or subcarrier spacing (SCS), to support diverse 5G services. For example, a 15 kHz SCS supports wide areas in traditional cellular bands. A 30 kHz / 60 kHz SCS supports dense urban environments, lower latency, and wider carrier bandwidth. An SCS of 60 kHz or higher supports bandwidths greater than 24.25 GHz to overcome phase noise.

[0105] Figure 5 shows an example of a 5G system structure to which the implementation of this specification is applied.

[0106] The 5G system (5GS; 5G system) structure consists of the following network functions (NF; Network Function).

[0107] - AUSF (Authentication Server Function)

[0108] - AMF (Access and Mobility Management Function)

[0109] - DN (Data Network), 예를 들어 운영자 서비스, 인터넷 접속 또는 타사 서비스

[0110] - USDF (Unstructured Data Storage Function)

[0111] - NEF (Network Exposure Function)

[0112] - I-NEF (Intermediate NEF)

[0113] - NRF (Network Repository Function)

[0114] - NSSF (Network Slice Selection Function)

[0115] - PCF (Policy Control Function)

[0116] - SMF (Session Management Function)

[0117] - UDM (Unified Data Management)

[0118] - UDR (Unified Data Repository)

[0119] - UPF (User Plane Function)

[0120] - UCMF (UE radio Capability Management Function)

[0121] - AF (Application Function)

[0122] - UE (User Equipment)

[0123] - (R)AN ((Radio) Access Network)

[0124] - 5G-EIR (5G-Equipment Identity Register)

[0125] - NWDAF (Network Data Analytics Function)

[0126] - CHF (CHarging Function)

[0127] Additionally, the following network features may be considered:

[0128] - N3IWF (Non-3GPP InterWorking Function)

[0129] - TNGF (Trusted Non-3GPP Gateway Function)

[0130] - W-AGF (Wireline Access Gateway Function)

[0131] Figure 5 illustrates the 5G system architecture for a non-roaming case using a reference point representation showing how various network functions interact with each other.

[0132] For clarity of the point-to-point diagram in Figure 5, UDSF, NEF, and NRF are not illustrated. However, all network functions shown can interact with UDSF, UDR, NEF, and NRF as needed.

[0133] For clarity, the connection between UDR and other NFs (e.g., PCF) is not shown in Fig. 4. For clarity, the connection between NWDAF and other NFs (e.g., PCF) is not shown in Fig. 4.

[0134] The 5G system architecture includes the following benchmarks:

[0135] - N1: Reference point between UE and AMF.

[0136] - N2: Reference point between (R)AN and AMF.

[0137] - N3: Reference point between (R)AN and UPF.

[0138] - N4: Reference point between SMF and UPF.

[0139] - N6: Reference point between UPF and data network.

[0140] - N9: Reference point between two UPFs.

[0141] The following benchmarks illustrate the interactions that exist between NF services in NF.

[0142] - N5: Reference point between PCF and AF.

[0143] - N7: Reference point between SMF and PCF.

[0144] - N8: Reference point between UDM and AMF.

[0145] - N10: Reference point between UDM and SMF.

[0146] - N11: Reference point between AMF and SMF.

[0147] - N12: Reference point between AMF and AUSF.

[0148] - N13: Reference point between UDM and AUSF.

[0149] - N14: Reference point between two AMFs.

[0150] - N15: Reference point between PCF and AMF for non-roaming scenarios, and reference point between PCF and AMF of visited network for roaming scenarios.

[0151] - N16: Reference point between two SMFs (in case of roaming, between the SMF of the visited network and the SMF of the home network)

[0152] - N22: Reference point between AMF and NSSF.

[0153] In some cases, two NFs may need to be interconnected to serve a UE.

[0154] <Primary Authentication>

[0155] The purpose of the primary authentication and key agreement procedure may be to enable mutual authentication between the UE and the network and to provide key material that can be used between the UE and the serving network in subsequent security procedures. The key material generated by the primary authentication and key agreement procedure may be an anchor key, K, provided by the AUSF of the home network to the SEAF of the serving network. SEAF can be created.

[0156] Keys for one or more security contexts can be used without the need to run a new authentication. SEAF As a concrete example, authentication running over a 3GPP access network may provide keys that establish security between a UE and an N3IWF used for untrusted non-3GPP access.

[0157] Anchor Key K SEAF is K AUSF It is derived from an intermediate key called K AUSF can be established between UE and HN as a result of the first authentication procedure. K AUSF may be securely stored in the AUSF, depending on the home operator's policy for the use of that key, for example, in the control plane solution for Steering of Roaming or UE parameter update procedures, or if AKMA is supported by the HPLMN.

[0158] Figure 6 shows an example of the start of primary authentication.

[0159] SEAF may initiate authentication with the UE during any procedure for establishing a signaling connection with the UE, depending on SEAF policy. The UE may be required to use SUCI or 5G-GUTI for registration requests.

[0160] SEAF may need to call the Nausf_UEAuthentication service by sending a Nausf_UEAuthentication_Authenticate request message to AUSF whenever SEAF wants to initiate authentication.

[0161] The Nausf_UEAuthentication_Authenticate request message may contain one of the following:

[0162] - SUCI, or

[0163] - SUPI

[0164] If SEAF re-authenticates a UE with a valid 5G-GUTI, it may include SUPI in the Nausf_UEAuthentication_Authenticate request message. Otherwise, SUCI is included in the Nausf_UEAuthentication_Authenticate request. The SUPI / SUCI structure may be part of the three-step protocol design.

[0165] The Nausf_UEAuthentication_Authenticate request may additionally include:

[0166] - Defined service network name.

[0167] The Nausf_UEAuthentication_Authenticate request may additionally include:

[0168] - Displays defined disaster roaming services.

[0169] Upon receiving a Nausf_UEAuthentication_Authenticate request message, the AUSF may compare the serving network name with the expected serving network name to determine if the SEAF requesting the serving network is authorized to use the serving network name in the Nausf_UEAuthentication_Authenticate request. The AUSF may need to temporarily store the received serving network name. If the serving network is not authorized to use the serving network name, the AUSF may respond with "Unauthorized Serving Network" in the Nausf_UEAuthentication_Authenticate response.

[0170] In case of disaster roaming, AUSF checks the local configuration and if allowed, AUSF can send Nudm_UEAuthentication_Get request to UDM.

[0171] The Nudm_UEAuthentication_Get request sent from AUSF to UDM may contain the following information:

[0172] - SUCI or SUPI;

[0173] - Service providing network name

[0174] - Indicates Disaster Roaming Service when received from SEAF;

[0175] Upon receiving a Nudm_UEAuthentication_Get request, the UDM may need to call SIDF when the SUCI is received. SIDF may need to unhide the SUCI to obtain the SUPI before the UDM can process the request.

[0176] Based on SUPI, UDM / ARPF may need to select an authentication method.

[0177] Note 3: The Nudm_UEAuthentication_Get response, which is a response to the Nudm_UEAuthentication_Get request, and the Nausf_UEAuthentication_Authenticate response message, which is a response to the Nausf_UEAuthentication_Authenticate request message, can be described as part of the authentication procedure of FIG. 7.

[0178] In case of disaster roaming, UDM checks the local configuration and if allowed, UDM can proceed with the selected authentication method.

[0179] Figure 7 illustrates an example of a primary authentication procedure triggered by a home network.

[0180] Support for home network triggered authentication may be optional for both HN and SN. If both networks (HN and SN) support home network triggered primary authentication, the following may apply.

[0181] UDM can initiate primary authentication based on a procedure initiated by the UE (e.g. UE registration in 5GC) or a procedure directed towards the UE (e.g. SoR / UPU) or an event from another NF, taking into account local policies as well.

[0182] 0a.[Optional] UDM can be pre-configured with operator authentication policies to determine when to trigger the primary authentication procedure.

[0183] 0b. The UE can register with the network. As part of the registration, the serving AMF may register the UE with the UDM via Nudm_UECM_Registration. The UDM may need to create an implicit subscription to the serving AMF to notify the AMF of potential re-authentication later.

[0184] 1. A prerequisite for initiating the home network trigger primary authentication may be that the UDM already has information about the AMF serving the UE. Otherwise, the UDM may not be able to connect to the AMF in subsequent steps.

[0185] The UDM can make its own decisions based on events (e.g., SoR / UPU or AAnF requests) or authentication policies and perform home network-triggered primary authentication as described in the following steps. AAnF may consider sending a Nudm_UECM_AuthTrigger request to the UDM for primary authentication using the UDM service based on certain factors.

[0186] Based on the received events and local operator authentication policy, if there is no primary authentication in progress for the UE and the UDM decides to trigger primary authentication, the UDM can determine the serving AMF / SEAF of the target UE.

[0187] If different AMFs are registered with the UDM for different accesses and a defined procedure is supported, the UDM may need to select one AMF to perform reauthentication. The AMF selection criteria may vary depending on the local UDM authentication policy.

[0188] Note 1: The reasons why the UDM determines that a UE must be authenticated may vary. For example, the UDM may decide to initiate primary authentication when the AMF registers the UE during the registration procedure during mobility from the EPC, when the SoR / UPU counter is about to wrap around, when required based on authentication policies, or at the request of the AAnF. The UDM behavior may be determined by operator policy considering the support of specific features of the PLMN. For example, if the PLMN does not support the SoR / UPU feature, SoR / UPU counter wraparound will not occur, and primary authentication may not be required in this case.

[0189] 2. UDM can send a notification message to AMF / SEAF along with the UE's SUPI.

[0190] 3. After receiving the notification message from the UDM, the AMF / SEAF may decide whether to initiate the primary authentication procedure based on its own local authentication policy and may decide to initiate the primary authentication procedure based on the UE state (e.g., if the UE is in handover, if some steps similar to the network-triggered service request can be reused, or if the UE was already being authenticated by the AMF before receiving the authentication notification from the UDM). If the AMF / SEAF cannot perform the primary authentication as described in step 4, the AMF / SEAF may send an authentication response message with the cause of the failure to the UDM, otherwise it may approve the request. If the AMF / SEAF approves the request but cannot initiate the primary authentication for the UE (e.g., if the UE is unreachable), the AMF / SEAF may set an authentication pending flag in the UE context.

[0191] When the UE reconnects to the same AMF or becomes available, the AMF checks the authentication pending flag and performs re-authentication if necessary. Upon completion of UE re-authentication, the AMF can reset the authentication pending flag. For example, in a mobility scenario, when a UE connects to a new AMF, the new AMF can retrieve the UE context from the previous AMF, check if authentication is pending for the UE, and then perform re-authentication. If a failure is received from the AMF, the UDM can check if another AMF is available through another connection. If available, the UDM can select another AMF and send the authentication request.

[0192] 4. AMF / SEAF may initiate the primary certification process as defined.

[0193] UDM may execute other procedures (e.g. SoR / UPU) depending on what triggered the (re)authentication procedure in step 1.

[0194] Figure 8 shows an example of an AKMA key hierarchy.

[0195] A key hierarchy may contain the following keys: K AUSF , K AKMA , K AF. K AUSF

[0196] K AUSF can be generated by AUSF as specified in section 6.1 of TS 33.501 v18.2.0.

[0197] K AUSF can be generated through successful 5G primary certification.

[0198] The key for AAnF is K AKMA It could be.

[0199] K AKMA ME (Mobile Equipment) and AUSF are K AUSFIt may be a key derived from. The ME may be a device (or terminal) capable of performing a communication protocol function.

[0200] The key for AF is K AF It could be.

[0201] K AF ME and AAnF are K AKMA It may be a key derived from .

[0202] Figure 9 is K AKMA From K AF Shows an example of creation.

[0203] Figure 9 illustrates the procedure for an AF to request an application function-specific AKMA key from an AAnF when the AF is inside the operator's network.

[0204] Before initiating communication between a UE and an AKMA AF, the UE and the AKMA AF may need to know whether AKMA is being used. This may be implicit in specific applications of the UE and the AKMA AF, or the AKMA AF may notify the UE.

[0205] 1. Before starting communication with AKMA application function, UE must AUSF From AKMA anchor key (K AKMA ) and A-KID may need to be generated. When the UE initiates communication with the AKMA AF, it may include the derived A-KID in the Application Session Establishment Request message. The UE may send the K-KID before or after the message. AF You can get it.

[0206] 2. If there is no active context associated with A-KID in AF, AF selects AAnF and sends Naanf_AKMA_ApplicationKey_Get request including A-KID to AAnF to get KID for UE. AFcan request. AF can also include its identity (AF_ID) in the request.

[0207] AF_ID may consist of the AF's FQDN and the Ua* security protocol identifier. The latter parameter may identify the security protocol that the AF will use for the UE.

[0208] AAnF can determine whether it can provide services to AF based on configured local policies or available authentication information (e.g., OAuth2.0 tokens) in signaling. If successful, the next step can be executed. Otherwise, AAnF can reject the process.

[0209] AAnF is a UE specific K identified by A-KID. AKMA Based on the presence of the key, it can be verified whether the subscriber is authorized to use AKMA.

[0210] K AKMA If exists in AAnF, AAnF can proceed to step 3.

[0211] K AKMA If it does not exist in AAnF, AAnF can continue to step 4 with an error response.

[0212] 3. After receiving the request from the AF, if the AAnF determines that this particular AF requires GPSI based on its local policy, the AAnF can send a Nudm_SDM_Get request to the UDM to retrieve the GPSI of the UE. If the particular AF does not require GPSI, the AAnF can proceed to step 5.

[0213] 4. The UDM may respond with the UE's GPSI. The AAnF may store the received GPSI as part of the UE's AKMA context.

[0214] 5. AAnF is still K AF If there is no K AKMAFrom AKMA Application Key (K AF ) can be obtained.

[0215] 6. AAnF is SUPI, K AF and K AF You can send a Naanf_AKMA_ApplicationKey_Get response to AF with an expiration time.

[0216] AAnF may decide whether to transmit SUPI or GPSI based on local policy.

[0217] 7. The AF may send an Application Session Establishment Response to the UE. If the information in step 4 indicates that the AKMA key request failed, the AF may reject the Application Session Establishment request, including the reason for the failure. The UE may then trigger a new Application Session Establishment request to the AKMA AF using the latest A-KID.

[0218] Home network triggered authentication is a technology currently under discussion. Home network triggered authentication re-performs primary authentication between the terminal and the network, as needed, after the primary authentication between the terminal and the network.

[0219] Home network triggered authentication may be performed to prevent the maximum number of counters for Steering of Roaming (SOR) or UE Parameter Update (UPU) from being exceeded (counter wrap-around). For example, home network triggered authentication may be performed to prevent SoR counter wrap-around.

[0220] Home network triggered authentication may be performed due to the terminal registration procedure that occurs during mobility from EPS to 5GS of the terminal.

[0221] K in Authentication and Key Management for Applications (AKMA) AF When the key validity period expires, home network triggered authentication can be performed.

[0222] Home network triggered authentication is caused by SoR counter wrap around, UPU counter wrap around, UE mobility-induced terminal registration procedure and / or K AF May include expiration of validity period.

[0223] AKMA Application Key (K AF ) can be a key for AF.

[0224] The 5G system's security root key may be newly generated when the primary authentication is re-performed. Therefore, a new K in the SoR, UPU counter, or AKMA that is dependent on the root key may be generated. AKMA It is expected that security will be improved as it is newly formed.

[0225] AKMA can support service of application sessions by utilizing 5GS security keys.

[0226] K generated upon successful first authentication of the terminal AUSF Based on this, the network (AUSF) and the terminal can use the root key K to generate future application keys. AKMA can be created.

[0227] At this time K AKMA An A-KID that can refer to can also be created.

[0228] K generated from AUSF AKMA can be passed on to AAnF.

[0229] Meanwhile, the terminal is K AKMA From K AF can be created in advance. The terminal can request the AF to create an application session including the A-KID.

[0230] Then, AF can verify the A-KID included in the creation request for the application session and confirm the existence of a corresponding security context.

[0231] If a corresponding security context does not exist, AF sends a new K to AAnF. AF You can request the creation of a new K. Then, AAnF will create a new K AF to K AKMA It can be generated based on the above new K AFThe expiration time can be set. AAnF responds to the above request by sending the new K AF New K set with AF The expiration time can be transmitted to AF.

[0232] The connection between the above two technologies is when Home Network Triggered Authentication is performed due to the expiration of AKMA's KAF validity period.

[0233] If multiple AFs are deployed to support AKMA within a 5G system, multiple K AF can be generated at similar times. In this case, as time passes, the above multiple K for one terminal AF As the expiration dates are similar, AAnF can perform multiple recertification requests with UDM.

[0234] If multiple reauthentication requests are made within a short period of time, repeated primary authentication may occur. This repeated primary authentication can lead to inefficiencies.

[0235] Additionally, if the number of terminals managed by a UDM is large, frequent first-pass authentication can overload the UDM or AMF, potentially impacting terminal services.

[0236] To address these issues, this specification proposes a method for efficiently processing multiple primary authentication requests (re-authentication requests). As the proposed method is implemented, the load on the UDM and AMF can be reduced.

[0237] Multiple K in AAnF AF can be generated. At this time, AAnF has multiple K AF K to time out (expire validity period) at the same time AFYou can set the expiration time value. In this case, multiple K AF can expire at the same time. AAnF can have multiple K expiring at the same time. AF A re-authentication request (authentication trigger request) can be sent to UDM only once.

[0238] Figure 10 illustrates an example of a 5G system architecture involving multiple AFs.

[0239] Figure 10 shows an example of a 5G system structure that can use multiple AFs for a terminal capable of AKMA service.

[0240] Within a 5G system, AAnF can act as an anchoring node for AF #1, AF #2, AF #3, AF #4, and AF #5.

[0241] AF #5 in Figure 10 may be deployed outside the 5GS network via NEF.

[0242] The terminal can create separate sessions with all AFs. Each of the multiple sessions has a K associated with it. AF can be generated. That is, multiple K AF can be generated. Multiple K generated AF can be managed by AAnF.

[0243] Figures 11 and 12 are K according to an embodiment of the present specification. AF and K AF An example of creating an expiration time is shown.

[0244] In Figures 11 and 12, one AF is shown, but there may be multiple AFs. The generated AKMA application key (K AF ) is n, n AFs may have requested AAnF for AKMA application keys. That is, multiple AFs may each request AAnF for AKMA application keys, and based on this, multiple K AFcan be generated. K AF There may be only 1 AF involved.

[0245] 0. AKMA-related settings may be applied according to the operator's policy.

[0246] 1. During primary authentication, AUSF may request the UDM for the information and method required for authentication (Nudm_UEAuthentication_Get Request). The request may include SUPI and / or SUCI.

[0247] 2. When UDM responds to AUSF, UE sends AKMA anchor keys (K AKMA ) may be sent to the AUSF in a response (Nudm_UEAuthentication_Get Response) containing information on whether an AKMA Ind should be generated. If the response includes an AKMA Ind, the response may also include a RID.

[0248] Based on the request, the UDM can send a response (Nudm_UEAuthentication_Get Response) containing the information and method required for authentication to the AUSF. The response can include an Authentication Vector (AV), an AKMA Ind (AKMA Indication), and a Routing ID (RID). The AV can be data containing security-related parameters required when performing the authentication procedure. The AKMA Ind can be an indication indicating whether the terminal is capable of performing AKMA. When the terminal / serving AMF, etc. need to signal one of multiple UDMs, the appropriate UDM can be found based on the RID.

[0249] 3. If the first authentication is successfully completed and AUSF has received AKMA Ind from UDM, AUSF will AUSFSave and AKMA Anchor Key (K AKMA ) and A-KID can be generated. AUSF is K AKMA to K AUSF can be generated from.

[0250] 4. After the AKMA (Authentication and Key Management for Applications) key is generated, AUSF can select AAnF through the “AAnF Search and Select” function. Then, AUSF can select AAnF by entering the generated A-KID, K AKMA And the AKMA anchor key registration request (Naanf_AKMA_AnchorKey_Register Request) including the SUPI of the terminal can be sent to the selected AAnF.

[0251] 5. AAnF can respond to AUSF. The response is an action (K AF It may contain information indicating that registration has been completed.

[0252] 6. UE is K AKMA And A-KID can be generated before starting AKMA application. And, UE can transmit the generated A-KID when requesting application service to AF. UE can K AF can be created before or after sending the above request.

[0253] 7. If AF does not have a context related to the received A-KID, AF sends A-KID to AAnF while K AF can be requested. The request may include AF_ID.

[0254] An AAnF can receive a request for an AKMA application key including a first A-KID from an AF (e.g., a first AF). An AAnF can receive a request for an AKMA application key including a second A-KID from another AF (e.g., a second AF). An AKMA anchor key (K) associated with the first A-KID AKMA ) is an AKMA anchor key (K) associated with the second A-KID. AKMA ) may be the same.

[0255] AAnF may perform the following procedures if it can provide services to AF, and may discontinue the procedures if it cannot.

[0256] AAnF is the K associated with the received A-KID. AKMA You can verify that the terminal can use AKMA by checking if it exists.

[0257] If K matches AAnF (related to the received A-KD) AKMA If so, the procedure can continue to step 8.

[0258] K matching AAnF (related to the received A-KD) AKMA If not, AAnF can skip step 8 and send an error response to AF in response to AF's request (step 9).

[0259] 8. AAnF is K AF If you don't have K AF can be generated. AAnF is K AKMA From K AF can be generated. AAnF is K AF You can determine the validity / expiration time.

[0260] AAnF can receive a request for an AKMA application key from an AF (e.g., a first AF). AAnF can receive a request for an AKMA application key from another AF (e.g., a second AF). Accordingly, AAnF can receive multiple AKMA application keys (K AF ) can be generated. AAnF can generate multiple K AF You can determine the validity / expiration time.

[0261] 9. AAnF gives SUPI to AF, generated K AF and K AF You can send the validity / expiration time.

[0262] AAnF is K AF You can determine the validity / expiration time.

[0263] AAnF is K AF The validity / expiration time of i) the first embodiment using the global synchronization time or ii) the previously created K AF It can be determined according to the second embodiment utilizing the life time of. The first and second embodiments will be described later. In the first and second embodiments described later, a plurality of K AF is one (identical) K AKMA It may have been generated from.

[0264] i. First embodiment: AAnF can start a global synchronization timer according to a value set in advance in step 0. The global synchronization timer can also be started in advance. AAnF K AF When creating, K is set to expire at the time of global synchronization timer expiration. AF To cause a timeout, AAnF is K AF You can set the validity / expiration time.

[0265] ii. Second embodiment: The first K created previously AF The validity / expiration time of the first K already generated for the terminal can be utilized. AF If there is, the above 1 K AF New 2nd K at the same time as the expiration date AF AAnF is the second K to cause a timeout. AF You can determine (set) the validity / expiration time of the K. If multiple K have already been created, AF If there is, there are multiple K AF Which K among them AF It doesn't matter if you use the expiration time of the first K created. AF Subsequent K depending on the expiration time AF Because the expiration time of the fields has also been set.

[0266] AAnF is K AF You may refer to the information provided by AF when determining the validity / expiration time.

[0267] For example, in step 7, AF gives K to AAnF AF While requesting, AF said K AF Information such as minimum time information and / or expected expiration time that should be used may be transmitted to AAnF. AAnF may take this information into consideration when sending K AF You can determine the validity / expiration time of K AF The validity / expiration time of may be greater than the minimum time above. For example, AF may send K to AAnF. AF When requesting, the minimum time information (3 hours) is transmitted, and AAnF is K AF The validity / expiration time can be set to 3 hours or more.

[0268] Alternatively, depending on the service level agreement between the AF / Application service provider and the 5GC / Operator, information such as the minimum period information or expected expiration time required by each AF may be pre-configured in the AAnF. In this case, the AAnF may consider the pre-configured information and configure K AF You can determine the expiration time.

[0269] AF is K AF If you notify AAnF that you want to use it for a minimum period of time (e.g., at least 5 hours), AAnF will notify K AF The expiration time can be set to exceed the minimum period (e.g., 5 hours).

[0270] If a global synchronization timer (first embodiment) is used for this, K AF The expiration time can be set to be greater than the global sync timer. For example, if the AF requests a K AF If the minimum period is 5 hours and the global sync timer is 3 hours, AAnF is K AF The expiration time can be set to 6 hours, which is the global sync timer cycle twice.

[0271] Similarly, the previous K AF Even when utilizing the expiration time, you can set the expiration time to match after several cycles.

[0272] 10. AF can notify UE that application session creation is complete.

[0273] An application session is created, and the UE and the application can communicate through the created session.

[0274] 11. K AF When the validity period expires (the expiration time arrives), the operator policy may determine whether to perform primary authentication.

[0275] Multiple K AF When the validity time of AAnF expires simultaneously, AAnF can send an authentication trigger request for primary authentication to UDM. UDM can then decide whether to trigger primary authentication. If UDM decides to trigger primary authentication, UDM can notify AMF. AMF can decide whether to perform primary authentication.

[0276] The first and second embodiments described above in step 9 are described below.

[0277] 1. First Example

[0278] Figure 13 illustrates an example of using a global synchronization timer according to an embodiment of the present specification.

[0279] By using the global synchronization timer, all K generated during the global synchronization timer period AF A method can be proposed to ensure that the validity period (expiration time) of the two ends at the same point in time (a method to make the expiration time the same).

[0280] AAnF can know information about the global synchronization timer (e.g. when it expires).

[0281] During the period from when the global synchronization timer starts to when it expires (the timer running period), AAnF is K AF can be created.

[0282] K generated during the above timer operation period AF The validity / expiration time is K when the above global synchronization timer expires. AFThe validity / expiration time can be set to expire.

[0283] All multiple K generated during the above timer operation period AF The validity / expiration time of the AAnF may expire at the same time. In this case, depending on the operator's policy, the AAnF may send a trigger request (authentication trigger request) for Home Network Triggered Authentication to the UDM to perform Home Network Triggered Authentication.

[0284] All multiple K generated during the above timer operation period AF If the validity / expiration time of each K is set to expire at the same time, AF The life time duration (the period from creation to expiration) may vary depending on the creation time.

[0285] K generated during the above timer operation period AF The validity / expiration time of may not expire at the time when the timer operation expires, but may expire at the time when the next (or nth next) timer operation period expires. That is, K generated during the timer operation period AF The validity / expiration time of can be set to expire at the time when the currently running timer and one of multiple timers running in the future expire.

[0286] When AF requests AKMA application key from AAnF (step 7 of Figs. 11 and 12), AF sends K AF You may have set special validity / expiration times for .

[0287] AF may be operated by telecommunications service providers / external service providers, etc. In this case, the service operator (telecommunications service provider / external service provider, etc.) may operate AF as desired. AFThe validity / expiration time of the AKMA application key may be pre-configured. Based on this, when the AF requests the AKMA application key from the AAnF (step 7 of FIGS. 11 and 12), the AF sends the K AF You may have set special validity / expiration times for .

[0288] That is, AF can send AAnF an AKMA application key request containing specific information (e.g., required validity time). Then, based on the specific information, AAnF can send K AF The validity / expiration time can be set to expire when the next global sync timer that is run expires instead of the currently running global sync timer.

[0289] The global synchronization timer can be run repeatedly. That is, when the global synchronization timer expires, it can be run again.

[0290] A global synchronization timer can be driven by AAnF.

[0291] In this regard, K to be generated AF The expiration time of the global synchronization timer, which serves as the basis for the expiration of the validity / expiration time, can be the expiration time of the currently running timer or the expiration time of a timer that will be run again in the future.

[0292] 2. Second Example

[0293] Figure 14 illustrates an example of using a global synchronization timer according to an embodiment of the present specification.

[0294] The first generated K AF Multiple K generated thereafter depending on the validity / expiration time AF The value of the validity / expiration time can be determined.

[0295] Pre-generated K AF If exists, AAnF generates K AFThe validity / expiration time of the pre-generated K AF It can be set to expire at the same time as the validity / expiration time.

[0296] The first K generated AF (K AF #1) The validity / expiration time can be set according to the operator's settings. After this, the generated K AF The validity / expiration time of the above K AF It can be set to expire at the same time as the valid / expiration time of #1.

[0297] As a result, all the multiple K AF When the validity time expires at the same time, according to the operator's policy, AAnF can send a trigger request (authentication trigger request) for Home Network Triggered Authentication to UDM to perform Home Network Triggered Authentication.

[0298] After that another K AF The same procedure is repeated by generating K AF Validity / expiration times can be set.

[0299] The following actions can be taken to utilize the global synchronization timer:

[0300] - The first network control node (e.g. AAnF) can perform a global synchronization timer according to pre-configuration information.

[0301] - The value of the above global synchronization timer can be determined according to operator policy.

[0302] - The above global synchronization timer can be executed repeatedly and periodically.

[0303] - The first network control node (e.g. AAnF) generates all K AFEnsure that the global synchronization timer's validity / expiration time is the same for K AF You can set the validity / expiration time.

[0304] - The second network control node (eg AF) can pass the information to the first network control node (eg AAnF) to set a special validity / expiration time.

[0305] K already created AF The following actions can be taken to utilize the validity / expiration time:

[0306] - The first network control node (e.g. AAnF) generates all K AF K generated previously AF New K to expire at the same time as the validity / expiration time AF You can set the validity / expiration time.

[0307] - K generated previously in the above procedure AF If there is no , the validity / expiration time can be set according to the value set by the operator.

[0308] The following drawings are intended to illustrate specific examples of the present specification. The names of specific devices and the names of specific signals / messages / fields depicted in the drawings are provided for illustrative purposes only, and the technical features of this specification are not limited to the specific names used in the drawings.

[0309] Figure 15 illustrates the AAnF procedure for the disclosure of this specification.

[0310] 1. AAnF can receive a first request for an AKMA (Authentication and Key Management for Applications) application key from a first AF (Application Function).

[0311] 2. Based on the first request, AAnF can generate a first AKMA application key from the AKMA anchor key.

[0312] 3. AAnF can determine the validity period of the first AKMA application key.

[0313] 4. AAnF may receive a second request for an AKMA application key from a second AF.

[0314] 5. Based on the second request, AAnF can generate a second AKMA application key from the AKMA anchor key.

[0315] 6. AAnF can determine the validity period of the second AKMA application key.

[0316] The validity period of the first AKMA application key and the validity period of the second AKMA application key may expire at the same time.

[0317] Based on the expiration of the validity period of the first AKMA application key and the validity period of the second AKMA application key, AAnF can send an authentication trigger request for primary authentication to UDM (Unified Data Management).

[0318] The step of determining the validity time of the first AKMA application key may be performed such that the validity time of the first AKMA application key and a global synchronization timer expire simultaneously.

[0319] The step of determining the validity time of the second AKMA application key may be performed such that the validity time of the second AKMA application key and the global synchronization timer expire simultaneously.

[0320] The above global synchronization timer can be restarted repeatedly.

[0321] The expiration time of the above global synchronization timer may be the expiration time of a currently running timer or the expiration time of a timer that will be run again in the future.

[0322] The first request may include information about the minimum time required.

[0323] The step of determining the validity time of the first AKMA application key may be performed based on information about the minimum time.

[0324] The step of determining the validity time of the second AKMA application key may be performed such that the validity time of the second AKMA application key and the determined validity time of the first AKMA application key expire simultaneously.

[0325] The step of determining the validity period of the above first AKMA application key may be performed according to the operator's policy.

[0326] AAnF can transmit to the first AF the first AKMA application key and information about the validity period of the first AKMA application key.

[0327] AAnF can transmit to the second AF the second AKMA application key and information about the validity period of the second AKMA application key.

[0328] Hereinafter, a device for performing communication according to some embodiments of the present specification will be described.

[0329] For example, a device may include a processor, a transceiver, and memory.

[0330] For example, a processor may be configured to be operatively coupled with memory and a processor.

[0331] The operations performed by the processor include: receiving a first request for an AKMA application key from a first AF; generating a first AKMA application key from an AKMA anchor key based on the first request; determining an expiration time of the first AKMA application key; receiving a second request for an AKMA application key from a second AF; generating a second AKMA application key from the AKMA anchor key based on the second request; determining an expiration time of the second AKMA application key; and the expiration time of the first AKMA application key and the expiration time of the second AKMA application key may expire simultaneously.

[0332] Below, a processor of a device for providing communication according to some embodiments of the present specification is described.

[0333] The operations performed by the processor include: receiving a first request for an AKMA application key from a first AF; generating a first AKMA application key from an AKMA anchor key based on the first request; determining an expiration time of the first AKMA application key; receiving a second request for an AKMA application key from a second AF; generating a second AKMA application key from the AKMA anchor key based on the second request; determining an expiration time of the second AKMA application key; and the expiration time of the first AKMA application key and the expiration time of the second AKMA application key may expire simultaneously.

[0334] Hereinafter, a non-volatile computer-readable medium storing one or more commands for providing mobile communication according to some embodiments of the present specification is described.

[0335] According to some embodiments of the present disclosure, the technical features of the present disclosure may be implemented directly in hardware, software executed by a processor, or a combination of the two. For example, a method performed by a wireless device in wireless communication may be implemented in hardware, software, firmware, or any combination thereof. For example, the software may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, a hard disk, a removable disk, a CD-ROM, or other storage media.

[0336] Some examples of storage media are coupled to the processor, allowing the processor to read information from the storage media. Alternatively, the storage media may be integrated into the processor. The processor and storage media may reside in an ASIC. In other examples, the processor and storage media may reside as separate components.

[0337] Computer-readable media may include tangible and non-volatile computer-readable storage media.

[0338] For example, nonvolatile computer-readable media may include random access memory (RAM), such as synchronized dynamic random access memory (SDRAM), read-only memory (ROM), non-volatile random access memory (NVRAM), read-only memory (EEPROM), flash memory, magnetic or optical data storage media, or any other media that can be used to store instructions or data structures. Nonvolatile computer-readable media may also include combinations of the above.

[0339] Additionally, the methods described herein can be realized at least in part by a computer-readable communication medium that carries or transmits code in the form of instructions or data structures and that can be accessed, read, and / or executed by a computer.

[0340] According to some embodiments of the present disclosure, a non-transitory computer-readable medium has one or more instructions stored thereon. The one or more stored instructions can be executed by a processor of a base station.

[0341] The stored one or more commands comprise: receiving a first request for an AKMA application key from a first AF; generating a first AKMA application key from an AKMA anchor key based on the first request; determining an expiration time of the first AKMA application key; receiving a second request for an AKMA application key from a second AF; generating a second AKMA application key from the AKMA anchor key based on the second request; determining an expiration time of the second AKMA application key; and wherein the expiration time of the first AKMA application key and the expiration time of the second AKMA application key can expire simultaneously.

[0342] This specification may have various effects.

[0343] For example, the procedure disclosed in this specification can prevent repetitive primary authentication from being performed.

[0344] The effects that can be achieved through specific examples of this specification are not limited to the effects listed above. For example, a person with ordinary skill in the relevant technical field may understand or derive various technical effects from this specification. Accordingly, the specific effects of this specification are not limited to those explicitly described herein, but may include various effects that can be understood or derived from the technical features of this specification.

[0345] The claims set forth in this specification may be combined in various ways. For example, the technical features of the method claims of this specification may be combined to implement a device, and the technical features of the device claims of this specification may be combined to implement a method. Furthermore, the technical features of the method claims and the technical features of the device claims of this specification may be combined to implement a device, and the technical features of the method claims and the technical features of the device claims of this specification may be combined to implement a method. Other implementations are within the scope of the claims.

Claims

1. AANF (AKMA Anchor Function) is a method for performing communication. A step of receiving a first request for an AKMA (Authentication and Key Management for Applications) application key from a first AF (Application Function); A step of generating a first AKMA application key from an AKMA anchor key based on the first request; A step of determining the validity period of the first AKMA application key; A step of receiving a second request for an AKMA application key from a second AF; A step of generating a second AKMA application key from the AKMA anchor key based on the second request; A step of determining the validity period of the second AKMA application key; A method in which the validity period of the first AKMA application key and the validity period of the second AKMA application key expire simultaneously.

2. In paragraph 1, A method further comprising the step of transmitting an authentication trigger request for primary authentication to UDM (Unified Data Management) based on the expiration of the validity time of the first AKMA application key and the validity time of the second AKMA application key.

3. In paragraph 1 or 2, The step of determining the validity time of the first AKMA application key is performed so that the validity time of the first AKMA application key and the global synchronization timer expire simultaneously, The step of determining the validity time of the second AKMA application key is performed such that the validity time of the second AKMA application key and the global synchronization timer expire simultaneously.

4. In paragraph 3, The above global synchronization timer is a timer that is repeatedly restarted, The expiration time of the above global synchronization timer is the expiration time of the currently running timer or the expiration time of a timer that will be run again in the future.

5. In paragraph 3 or 4, The first request above contains information about the minimum time required, The step of determining the validity time of the above first AKMA application key is: a method performed based on information about the minimum time.

6. In paragraph 1 or 2, The step of determining the validity time of the second AKMA application key is performed so that the validity time of the second AKMA application key and the validity time of the determined first AKMA application key expire simultaneously.

7. In paragraph 1 or 2, The step of determining the validity period of the above first AKMA application key is: a method performed according to the operator's policy.

8. In any one of paragraphs 1 to 7, A step of transmitting information about the first AKMA application key and the validity period of the first AKMA application key to the first AF; A method further comprising the step of transmitting to the second AF the second AKMA application key and information about the validity period of the second AKMA application key.

9. As an AAnF (AKMA Anchor Function) that performs communication, Transmitter and receiver; Contains a processor, The operation performed by the processor is at least one NF according to any one of claims 1 to 8.

10. As an apparatus in mobile communication, at least one processor; and At least one memory storing instructions and being operably electrically connected to at least one processor, A device wherein the operation performed based on the command being executed by at least one processor is a method according to any one of claims 1 to 8.

11. A non-volatile computer-readable storage medium that records commands, A non-volatile computer-readable storage medium, wherein the instructions, when executed by one or more processors, cause the one or more processors to perform a method according to any one of claims 1 to 8.

Images