Secure physical channel scrambling

Abstract

Various example embodiments relate to devices, methods, apparatuses and computer readable mediums for secure physical channel scrambling. An example apparatus for a terminal device may comprise at least one processor and at least one memory. The at least one memory stores instructions that, when executed by the at least one processor, cause the terminal device at least to derive a scrambling key from secret information available at the terminal device and a network device serving the terminal device, use the scrambling key as an input to generate an initialization value for a scrambling sequence, generate the scrambling sequence based on the initialization value, and use the scrambling sequence to scramble information to be transmitted on a physical uplink channel to the network device, or to descramble information received on a physical downlink channel from the network device.

Description

SECURE PHYSICAL CHANNEL SCRAMBLINGTECHNICAL FIELD

[0001] Various example embodiments described herein generally relate to communication technologies, and more particularly, to devices, methods, apparatuses and computer readable mediums for secure physical channel scrambling.BACKGROUND

[0002] Certain abbreviations that may be found in the description and / or in the figures are herewith defined as follows:AES Advanced Encryption StandardAKA Authentication and Key AgreementAMF Access and Mobility Management FunctionAS Access StratumCRC Cyclic Redundancy CheckC-RNTI Cell Radio Network Temporary IdentifierDCI Downlink Control InformationFBS Fake Base StationHFN Hyper Frame NumberKDF Key Derivation FunctionMAC Medium Access ControlMAC-I Message Authentication Code - IntegrityNAS Non Access StratumPDCCH Physical Downlink Control ChannelPDCP Packet Data Convergence ProtocolPDSCH Physical Downlink Shared ChannelPUCCH Physical Uplink Control ChannelPUSCH Physical Uplink Shared ChannelRRC Radio Resource ControlSFN System Frame NumberUCI Uplink Control Information

[0003] In LTE and 5G, the security architecture includes Non Access Stratum (NAS) security for protection of NAS signaling and data between user equipment (UE) and the core network, and Access Stratum (AS) security for protection of radio resource control (RRC) signaling and user plane (UP) data between UE and the radio access network (RAN). The AS security, including RRC and UP integrity and confidentiality mechanisms, is applied at the Packet Data Convergence Protocol (PDCP) layer, while the layers below PDCP, i.e. the Radio Link Control (RLC) layer, the Medium Access Control (MAC) layer and the physical (PHY) layer, are not protected.SUMMARY

[0004] A brief summary of exemplary embodiments is provided below to provide basic understanding of some aspects of various embodiments. It should be noted that this summary is not intended to identify key features of essential elements or define scopes of the embodiments, and its sole purpose is to introduce some concepts in a simplified form as a preamble for a more detailed description provided below.

[0005] In a first aspect, an example embodiment of an apparatus for a terminal device is provided. The apparatus may comprise at least one processor and at least one memory. The at least one memory stores instructions that, when executed by the at least one processor, cause the terminal device at least to derive a scrambling key from secret information available at the terminal device and a network device serving the terminal device, use the scrambling key as an input to generate an initialization value for a scrambling sequence, generate the scrambling sequence based on the initialization value, and use the scrambling sequence to scramble information to be transmitted on a physical uplink channel to the network device,or to descramble information received on a physical downlink channel from the network device.

[0006] In a second aspect, an example embodiment of an apparatus for a network device is provided. The apparatus may comprise at least one processor and at least one memory. The at least one memory stores instructions that, when executed by the at least one processor, cause the network device at least to derive a scrambling key from secret information available at the network device and a terminal device served by the network device, use the scrambling key as an input to generate an initialization value for a scrambling sequence, generate the scrambling sequence based on the initialization value, and use the scrambling sequence to scramble information to be transmitted on a physical downlink channel to the terminal device, or to descramble information received on a physical uplink channel from the terminal device.

[0007] Example embodiments of methods, apparatuses and computer readable mediums for secure physical channel scrambling are also provided. Such example embodiments generally correspond to the above example embodiments of the terminal device and the network device, and a repetitive description thereof is omitted here for convenience.

[0008] Other features and advantages of the example embodiments of the present disclosure will also be apparent from the following description of specific embodiments when read in conjunction with the accompanying drawings, which illustrate, by way of example, the principles of example embodiments of the present disclosure.BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Some example embodiments will now be described, by way of non-limiting examples, with reference to the accompanying drawings.

[0010] Fig. 1 is a message flow chart illustrating an example process for overall security establishment.

[0011] Fig. 2 is a message flow chart illustrating an example process for ASsecurity establishment.

[0012] Fig. 3 is a message flow chart illustrating a process according to an example embodiment of the present disclosure.

[0013] Fig. 4 is a schematic block diagram illustrating an apparatus according to an example embodiment of the present disclosure.

[0014] Fig. 5 is a schematic block diagram illustrating an apparatus according to an example embodiment of the present disclosure.

[0015] Fig. 6 is a message flow chart illustrating a process according to an example embodiment of the present disclosure.

[0016] Fig. 7 is a message flow chart illustrating a process according to an example embodiment of the present disclosure.

[0017] Fig. 8 is a schematic block diagram illustrating an apparatus according to an example embodiment of the present disclosure.

[0018] Fig. 9 is a schematic block diagram illustrating an apparatus according to an example embodiment of the present disclosure.

[0019] Fig. 10 is a schematic block diagram illustrating devices in a communication system according to an example embodiment of the present disclosure.

[0020] Throughout the drawings, same or similar reference numbers indicate same or similar elements. A repetitive description on the same elements would be omitted.DETAILED DESCRIPTION

[0021] Herein below, some example embodiments are described in detail with reference to the accompanying drawings. The following description includes specific details for the purpose of providing a thorough understanding of various concepts. However, it will be apparent to those skilled in the art that these concepts may be practiced without these specific details. In some instances, well known circuits, techniques and components are shown in block diagram form to avoid obscuring the described concepts and features.

[0022] As mentioned above, the radio interface between UE and RAN is protected by applying security mechanisms at the PDCP layer, and the layers below PDCP are not protected. However, more and more attacks against the radio interface have been disclosed that exploit the lack of protection on the lower layers, either passively by reading the control information exchanged on the low layers between UE and network and abusing it to leverage further attacks, or even modifying it for malicious purposes.

[0023] In particular, many attacks build on the ability to monitor traffic for specific UEs while they camp on a specific cell. As an example, attackers can carry out a probing attack, where they send characteristic traffic, such as a series of (silent) short message service (SMS) messages with specific sizes and timing to a known victim phone number. By tracking the traffic of all the UEs that can be observed in a cell, even though the traffic is encrypted, it is possible to find out whether one of the UEs in the cell receives the series of SMS, and which UE receives it. This breaks subscriber location privacy, one of the dedicated security properties that the mobile networks are expected to provide. The attack has been demonstrated in 4G, and is applicable also in 5G.

[0024] Another example is a stealthy “International Mobile Subscriber Identity (IMSI) catching” attack in LTE, which does not require to setup a fake base station (FBS). Attackers observe traffic of a UE when the UE performs a service request, e.g. a registration request, and perform by emitting suitable signals a targeted modification (“overshadowing”) of the NAS message received by the network. This will lead to the network not being able to validate the temporary identity the UE is using, leading to an identity request and identity response that reveals the identity to the attackers’ sniffer. This attack works in 4G. In 5G, it can be prevented by use of the specified encryption scheme for the subscriber identifier. However, in practice many 5G deployments today are using the “null scheme” here, that does not encrypt the subscription identifier, so the attack is applicable.

[0025] There are many more attacks that build on being able to monitor the traffic of a victim UE. In lab setups, such attacks are typically performed by use of a relayfake base station (FBS), where the victim UE is the only UE camping on the cell of the FBS, making it easier to monitor the UE’s traffic. The need to establish the FBS and trick the UE into using it however makes it quite difficult to attack a victim UE in a real network at arbitrary places in the field. A sniffer is much more practical in the field, and does not reveal its presence by emitting radio signals, much in contrast to the FBS.

[0026] For being able to monitor traffic flows of a UE, which is a requirement in all these attacks, the attackers need to understand which radio resources are assigned to the UE. This is indicated to the UE by the base station via Downlink Control Information (DCI) sent over the Physical Downlink Control Channel (PDCCH). Protecting the DCI or the PDCCH channel can prevent the traffic monitoring and thus the attacks. It will be particularly effective in busy cells with many UEs connected at the same time.

[0027] There are also other attacks exploiting unprotected lower layer information, e.g. the MAC control elements (CEs) exchanged between MAC entities of UEs and the base station. Subscriber location tracking is one possible impact of such attacks. It is assumed that in 6G, some procedures currently handled by the RRC layer will be moved to the MAC layer. It will increase the potential impact of attacks against MAC CEs.

[0028] The above attack examples show that lack of lower layer protection has significant negative impacts, with a trend to even increase towards 6G. An effective measure against the attacks is to protect the traffic from being monitored by the attackers. In LTE and 5G, all physical layer transmissions, including physical downlink control channel (PDCCH), physical downlink shared channel (PDSCH), physical uplink control channel (PUCCH) and physical uplink shared channel (PUSCH), are scrambled with a pseudo-random sequence, also referred to as a scrambling sequence, which appears random but is known to the transmitter and the receiver. A bit sequence to be transmitted on one of the physical channels is XORed with the pseudo-random sequence so that transmission of the scrambled bit sequence appears as random noise to other UEs or cells that are not interestedin this particular transmission. The pseudo-random sequence is generated using pseudo-random sequence generation algorithms, and the actual sequence that the algorithm produces is a function of both the algorithm and an initialization value (seed value). The transmitter and the receiver of the scrambled bit sequence have to know what algorithm and what initialization value are used to generate the pseudo-random sequence.

[0029] In 4G LTE, PDCCH scrambling is carried out with a known scrambling sequence generator that is initialized by a cell identity (ID) and the slot number in which the control channel is to be transmitted. The cell-specific scrambling sequence is solely intended to randomize the control-channel induced interference, but it provides no security protection because the cell ID and the slot number are commonly known quantities in the cell.

[0030] In 5G NR, PDCCH scrambling is carried out as blow:5(0 = (b(0 + c( ) mod 2 (1) where b(i) is a block ofbits to be transmitted on PDCCH, c(i) is the scrambling sequence, and 5(0 is the scrambled sequence. The scrambling sequence generator is initialized withCinit = (nRNTi■ 216mod 231(2) where nRNTIis the UE-specific C-RNTI if it was used for scheduling the PDCCH, or otherwise zero, and nIDis a UE-specific scrambling ID configured via RRC signalling in a PDCCH configuration parameter pdcch-DMRS-ScramblinglD if it is configured to the UE, or otherwise the cell ID as in LTE. The move to UE- specific scrambling rather than cell-specific scrambling is intended to decouple the control channel transmission from the transmitting cell, so that at least it would not prevent moving the UE from one cell to another without the UE actually needing to know. As a by-product the NR PDCCH scrambling is slightly more secure than LTE PDCCH scrambling that is not secure at all. However, the scrambling ID, i.e. the parameter pdcch-DMRS-ScramblinglD, is only 16 bits long and it may be provided via an RRC message in the clear, making it vulnerable to interception ordetermination via brute-force means.

[0031] Physical channel scrambling as described above is not intended to provide confidentiality on the radio interface between UE and RAN. Instead, true encryption is applied on the PDCP layer. Fig. 1 illustrates an overall process 100 for NAS and AS security establishment triggered, as an example, by a NAS register request sent by the UE. Referring to Fig. 1, UE 10 receives system information broadcast from a base station 20 at 110. The system information may be carried in a master information block (MIB) and one or more system information blocks (SIBs). With the system information, the UE 10 initiates a random access (RA) procedure by sending a RA preamble (Msg 1) to the base station 20 at 112. The UE 10 receives a random access response (RAR) (Msg 2) from the base station 20 at 114, sends an RRC setup request (Msg 3) to the base station 20 at 116, and receives an RRC setup message (Msg 4) from the base station 20 at 118. The RRC setup message includes essential configuration information for the UE 10 to access network resources. Here a 4-step RA procedure is illustrated as an example, it would be appreciated that a 2-step RA procedure is also applicable to establish RRC connection between the UE 10 and the base station 20.

[0032] Once the RRC connection is established, the UE 10 sends an RRC setup complete message to the base station 20 at 120. The RRC setup complete message includes a piggybacked NAS message, i.e. registration request. The base station 20 transmits the registration request, as an initial UE message, to a core network (CN) device 30, e.g. an access and mobility management function (AMF), at 122.

[0033] When the CN device 30 receives the registration request, it performs an authentication and key agreement (AKA) and NAS security setup procedure with the UE 10 at 124. The AKA and NAS security setup procedure would invoke RRC information transfer 126 between the UE 10 and the base station 20, and it includes several roundtrips of information transfer between the UE 10 and the CN device 30 via the base station 20. For instance, the AKA and NAS security setup procedure may include a UE identity request and response procedure, an authentication request and response procedure, and a NAS security mode command procedure.After the AKA and NAS security setup procedure, keys for NAS integrity and encryption (also known as ciphering) KNASint, KNASCHC are generated at the CN device 30 (e.g. AMF) and the UE 10, and NAS security is activated.

[0034] The CN device 30 sends an initial context setup request to the base station 20 at 128 to trigger an initial context setup procedure. The initial context setup request may include a key for the base station 20, i.e. KSNB, which is derived at the CN device 30 (e.g. AMF). In response to the initial context setup request, the base station 20 and the UE 10 perform an RRC security mode procedure at 130 to establish RRC security, and an RRC reconfiguration procedure at 132 to establish radio bearers (RBs) and activate user plane (UP) security, which will be discussed in detail below. When the initial UE context is established successfully, the base station 20 sends an initial context setup response to the CN device 30 at 134.

[0035] Fig. 2 is a message flow chart illustrating an example process 200 for AS security establishment, which includes, as mentioned above, the RRC security mode procedure and the RRC reconfiguration procedure. Referring to Fig. 2, after the AKA and NAS security setup procedure at 124 (Fig. 1), the UE 10 and the CN device 30 (e.g. AMF) derives the key of the base station 20, i.e. KSNB, at 210 and 212, respectively. AKA is used to derive common keys at UE and network. After the AKA has been completed successfully, the core network and the UE derive a set of keys, including KSNB, used to establish AS security. The CN device 30 sends the key KSNB in the initial context setup request to the base station 20 at 128.

[0036] When the base station 20 receives the key KSNB, it selects RRC and UP encryption and integrity algorithms, derives RRC encryption and integrity keys KRRCCIIC, KRRCmt, and start RRC integrity protection at 214. The base station 20 sends information of the selected RRC and UP encryption and integrity algorithms, together with a message authentication code for integrity (MAC-I), in an RRC security mode command to the UE 10 at 216. The RRC security mode command is integrity protected with the RRC integrity key KRRCint- After sending the RRC security mode command, the base station 20 starts RRC downlink ciphering based on the RRC encryption key KRRCCIIC at 218.

[0037] Upon receiving the RRC security mode command, the UE 10 shall derive the RRC integrity key KRRCint based on KSNB and the indicated RRC integrity algorithm and verify that the integrity of the received RRC security mode command is correct by checking the MAC-I. If the verification is successful, the UE 10 shall derive the RRC encryption key KRRCCIIC based on KSNB and the indicated RRC encryption algorithm, and start RRC integrity protection and RRC downlink deciphering at 220. Then the UE 10 sends an RRC security mode complete message including MAC-I to the base station 20 at 222. After sending the RRC security mode complete message, the UE 10 starts RRC uplink ciphering at 224. Once receiving the RRC security mode complete message, the base station 20 starts RRC uplink deciphering at 226.

[0038] After the RRC security has been established in the RRC security mode procedure, an RRC connection reconfiguration procedure, as a part of data radio bearer (DRB) addition procedure, is performed to establish additional DRBs and enable AS UP integrity protection and ciphering activation for those DRBs that require it. Concretely, the base station 20 sends an RRC connection reconfiguration message to the UE 10 at 228, containing indications for activation of UP integrity protection and ciphering for each DRB. If UP integrity protection is activated for DRBs as indicated in the RRC connection reconfiguration message, at 230, the base station 20 generates UP integrity key Kupint based on KSNB and starts uplink UP integrity verification and downlink UP integrity protection. If UP ciphering is activated for the DRBs, the base station 20 also generates UP encryption key Kupenc based on KSNB and starts uplink UP deciphering and downlink UP ciphering at 230.

[0039] If UP integrity protection is activated for DRBs as indicated in the RRC connection reconfiguration message, at 232, the UE 10 generates UP integrity key Kupint based on KSNB and starts uplink UP integrity protection and downlink UP integrity verification. If UP ciphering is activated for the DRBs, the UE 10 also generates UP encryption key Kupenc based on KSNB and starts uplink UP ciphering and downlink UP deciphering at 232. Then the UE 10 sends an RRC connection reconfiguration complete message to the base station 20 at 234.

[0040] It would be noted that the RRC setup message and potential RRC reconfiguration messages transmitted before the RRC security mode procedure are not protected. The PDCCH configuration is usually provided to the UE 10 at that time. In this case, the scrambling ID is transmitted in the clear before the NAS and AS security activation, so it can be intercepted by attackers. If the UE 10 transitions from the RRC connected state to an RRC idle state, KSNB and all keys derived from it, such as KRRCmt, KRRCCIIC, Kupint, Kupenc, are discarded. So again, the next RRC setup message is unprotected. The UE 10 sends at least one NAS message, e.g. the NAS registration request or a NAS service request, to the core network, and the core network sends a new KSNB to the base station 20. The RRC security mode procedure and the RRC reconfiguration procedure are performed again to activate AS security, based on the new KSNB.

[0041] In some implementations, the same scrambling ID is configured for all UEs in a cell, so attackers can simply obtain it by attaching to the cell with an own “custom-UE”, implemented in a way that it allows access to the received scrambling ID. If different, unpredictable scrambling IDs are used for different UEs in the cell and if the scrambling IDs are not transmitted in the clear, attackers may still brute-force a scrambling ID because the currently-used scrambling ID is only 16 bits long. The attackers can observe assignment of C-RNTIs to UEs in the random access (RA) procedure. To brute-force a scrambling ID for a UE with a known C-RNTI, the attackers may decode a downlink control information (DCI) on PDCCH for this UE with the known C-RNTI and all 216possible scrambling ID values. The DCI contains cyclic redundancy check (CRC) bits appended to the payload, which allows the attackers to detect immediately when they hit the right scrambling ID value. The effort for this seems non-negligible, but it needs to be done only once, as the scrambling ID is usually not changed while the UE is connected.

[0042] It is important to note that it suffices for the attackers to buffer a transmitted PDCCH once, and run through all the hypotheses with the pre-information they can obtain to be the typical configuration, until they succeed, after which they cancontinue decoding and using the future PDCCH transmissions with ease. The attackers with a C-RNTI of a potential victim UE would go through the following steps:• Learning the cell’s control channel configuration: o PDCCH resources and PDCCH candidates are typically shared by all the users in the cell. It may suffice for the attackers to attach to the cell and record what the network provided as control channel configuration. o The network typically configures all UEs of similar type with the same transmission configuration impacting the DCI construction. It may suffice for the attackers to attach to the cell and record the physical layer configuration impacting the DCI construction.• After the learning phase, the attackers know how to receive the PDCCH, decode the DCI and interpret the DCI contents, but they still need to figure out the scrambling: o The attackers can observe and store one set of PDCCH resources and process it, going through the stored samples again and again trying all the possible scrambling ID values. With the learned DCI construction, the attackers simply proceed to try to decode the set of PDCCH candidates with one possible scrambling ID value, and, if there is no CRC match with the victim’s C-RNTI , proceed to the next possible scrambling ID value to try with. If there is a CRC match with the victim’s C-RNTI, the attackers can assume that they have used the right scrambling ID and can proceed to interpret the DCI content.• At this point, the attackers have the victim’s C-RNTI, PDCCH resource configuration, PDCCH candidate configuration, DCI configuration and scrambling ID, and they can start to monitor the PDCCH activity with the ability to detect, decode and interpret the DCIs transmitted to the victim.

[0043] To sum up, even after the PDCP ciphering and integrity protection is started, the PDCCH transmissions are lacking protection. Many of the UE-specific configuration parameters related to PDCCH reception in a cell are effectively thesame for all the UEs, and thus easily learnable to attackers. In LTE, PDCCH scrambling is only for interference randomization and the initialization values for the scrambling sequence to be used in a given cell are public. In 5G, somewhat by coincidence the PDCCH scrambling initialization may be based on UE-specific configuration, but the scrambling ID may typically be provided from the network to the UE via an unprotected RRC message before RRC security activation, is only of 16 bits, and is time-invariant, so it can be sniffed or brute-forced by attackers.

[0044] Example embodiments of the present disclosure propose a mechanism to protect lower layer information during transmission over the air, which uses secret information available at UE and a base station serving the UE to generate an initialization value for physical channel scrambling sequence generation. The secret information is unpredictable and long enough to be resistant against bruteforce attacks, making it unfeasible for attackers to understand the transmitted information on the fly and leverage it subsequently for attacks. Only the legal receiver in possession of the secret information will be able to descramble the received information correctly. In an example embodiment, the secret information may be used to derive a scrambling key, which may be used directly to initialize the scrambling sequence generator, or used together with time-varying input to initialize the scrambling sequence generator. An alternative wording for the scrambling key throughout the present description is an encryption key, distinguishing from conventional scrambling applied to all uplink / downlink transmissions for the purpose of interference reduction or user / cell identification. The purpose of the present scrambling / encryption is to improve the security of transmitted information against malicious devices / users. It would be more difficult for the attackers to figure out the time-varying scrambling sequence and decode the transmission over the air. In addition to PDCCH, the mechanism can also be applied to other physical channel(s) or physical control channel(s) such as physical downlink shared channel (PDSCH), physical uplink control channel (PUCCH), and physical uplink shared channel (PUS CH) to protect lower layer information including but not limited to uplink control information (UCI) carried on thePUCCH and MAC CEs. It would not cause significant changes to current radio transmission and does not require significant additional efforts.

[0045] Fig. 3 is a message flow chart illustrating a process 300 for physical channel scrambling according to an example embodiment of the present disclosure. The process 300 may be performed at the UE 10, the base station 20 and the CN device 30 (e.g. AMF).

[0046] Referring to Fig. 3, the UE 10 may derive the key of the base station 20, i.e. KgNB, at 210, and the CN device 30 (e.g. AMF) may derive the key KSNB at 212. As discussed above, the UE 10 and the CN device 30 may derive the key KSNB after they successfully perform the AKA and NAS security setup procedure (124 in Fig. 1). The CN device 30 may send the key KSNB in an initial context setup request to the base station 20 at 128. Then the UE 10 and the base station 20 may derive from KgNB other keys for AS security establishment, e.g. RRC integrity and encryption keys KRRCmt, KRRCenc and UP integrity and encryption keys Kupint, Kupenc- For instance, as discussed above with respect to Fig. 2, when the base station 20 receives the key KSNB, it may select RRC and UP encryption and integrity algorithms and indicate the selected algorithms in an RRC security mode command to the UE 10. The base station 20 and the UE 10 derive the other keys for AS security establishment based on KSNB and the selected algorithms. Now, encryption on the physical channel(s) may be started and any messages transmitted thereafter on the physical channel(s) may be encrypted. In an example embodiment, the base station 20 may also indicate, explicitly or implicitly, in the RRC security mode command (216 in Fig. 2) that secure (encrypted) scrambling on physical channel(s) can start. Then the UE 10 and the base station 20 can perform following steps for protection of information transmitted on the physical channels.

[0047] The UE 10 may derive a scrambling key KSCR from secret information available at the UE 10 and the base station 20 at 310, and the base station 20 may derive the scrambling key KSCR from the secret information available at the UE 10 and the base station 20 at 312. The UE 10 and the base station 20 can independently derive the scrambling key KSCR from the same secret information available at boththe UE 10 and the base station 20. In an example embodiment, the base station key KgNB may be used as the secret information to derive the scrambling key KSCR- An algorithm may be pre-defined / pre-configured at the UE 10 and the base station 20 to derive the scrambling key KSCR using the base station key KSNB. But it would be appreciated that other keys available at the UE 10 and the base station 20, such as KRRCmt, KRRCCIIC, Kupint, Kupenc, and other secret information available at the UE 10 and the base station 20 that is unpredictable and long enough to be resistant against brute-force attacks may also be used to derive the scrambling key KSCR.

[0048] Fig. 4 illustrates an apparatus 400 for deriving the scrambling key KSCR according to an example embodiment of the present disclosure. The apparatus 400 may be implemented at each of the UE 10 and the base station 20. Referring to Fig. 4, the apparatus 400 may include a key derivation function (KDF) 410. The KDF 410 receives the secret information as input and it runs an algorithm such as but not limited to HMAC-SHA-256 to generate the scrambling key KSCR- Optionally, the apparatus 400 may further include a truncation function 420. The truncation function 420 receives the scrambling key KSCR from the KDF 410 and truncates it to a desirable length. For example, the scrambling key KSCR generated at the KDF 410 may have a length of 256 bits, and the truncation function 420 may truncate it to a length of 128 bits. In another example embodiment, the truncation function 420 may be omitted.

[0049] In an example embodiment, the KDF 410 may also receive additional information as input to derive the scrambling key KSCR- For instance, a unique constant, such as an algorithm type distinguisher indicating that the algorithm is used to derive the scrambling key, may be used along with the above-mentioned secret information to derive the scrambling key KSCR- It can ensure that the derived scrambling key KSCR would not by coincidence be identical to other keys. It would be appreciated that other unique constants available at the UE 10 and the base station 20 may also be used. For instance, if more than one physical channel needs to be securely scrambled, a channel number, index or identity may be used as the unique constant to derive a dedicated scrambling key KSCR for each physicalchannel.

[0050] Referring back to Fig. 3, the UE 10 may use the scrambling key KSCR as input to generate an initialization value for a scrambling sequence at 314, and the base station 20 may use the scrambling key KSCR as input to generate the initialization value at 316. An algorithm may be pre-defined / pre-configured at the UE 10 and the base station 20 to generate the initialization value using the scrambling key KSCR as input.

[0051] Fig. 5 illustrates an apparatus 500 for generating the initialization value for the scrambling sequence according to an example embodiment of the present disclosure. The apparatus 500 may be implemented at each of the UE 10 and the base station 20. Referring to Fig. 5, the apparatus 500 may include an algorithm unit 510. The algorithm unit 510 may receive the scrambling key KSCR as input, and it runs an algorithm to generate the initialization value based on the received scrambling key KSCR- For instance, the algorithm unit 510 may generate the initialization value as below:mod 231(3) where cinitrepresents the initialization value. In the example, the initialization value cinithas a length of 31 bits, which is compatible with current scrambling sequence generation (see Equations 1-2). However, the initialization value cinitbased on the scrambling key KSCR is more resistant against brute-force attacks, compared with the current initialization value generated based on the UE-specific C-RNTI and the scrambling ID (Equation 2). As discussed above, the UE-specific C-RNTI can be observed by the attackers, and the scrambling ID is only 16-bits long and is time-invariant. The attackers can try all the possible scrambling ID values (216values) to decode a set of PDCCH candidates, until they hit the right scrambling ID value. In the example embodiment, however, the 31 -bits long initialization value cinitis generated based on the scrambling key KSCR, making it unfeasible for attackers to brute-force the initialization value cinitby trying all possible values. It would be appreciated that the initialization value cinitis not limited to the 31 -bits length, but longer or shorter initialization value cinitis alsoapplicable. For instance, 6G or 5G enhancement may consider using longer initialization value cinit.

[0052] In an example embodiment, the algorithm unit 510 may apply a ciphering algorithm such as the advanced encryption standard (AES) algorithm to generate multiple initialization value cinit. For instance, the ciphering algorithm may encrypt multiple numbers using the scrambling key KSCR, and the encryption of the n-th number would be used as the n-th initialization value. In another example, the ciphering algorithm may encrypt a constant using the scrambling key KSCR to obtain a first initialization value, encrypt the first initialization value to obtain a second initialization value, and so forth. The multiple numbers or the constant may be pre-defined / pre-configured at the UE 10 and the base station 20. The generated multiple initialization values may be used to generate multiple scrambling sequences, and each scrambling sequence may be used to scramble a sequence of bits to be transmitted on a physical channel as discussed above with respect to Equation 1.

[0053] In an example embodiment, the algorithm unit 510 may generate the initialization value cinitthat varies over the time. For instance, in addition to the scrambling key KSCR, the algorithm unit 510 may receive a time-varying variable as input. The time-varying variable is known to and aligned between the UE 10 and the base station 20. In an example, the time-varying variable may be determined by concatenating a hyper frame number (HFN) and a system frame number (SFN) in which the physical channel carrying the scrambled information would be transmitted. Since resources for physical channel transmissions are scheduled by the base station 20 for the UE 10, the HFN and the SFN are aligned between the UE 10 and the base station 20. The algorithm unit 510 may encrypt the time-varying variable using the scrambling key KSCR to generate the initialization value cinit. The HFN may have a 10-bits length, and the SFN may have a 16-bits length, which provide 226different initialization values cinit, which can ensure that the scrambling sequence would not repeat within more than 3 hours. In another example, the time-varying variable may be determined by concatenatinga counter of times the HFN has wrapped around since its first usage as input to generate the initialization value, the HFN and the SFN. The counter may have a length of 2 bits, 4 bits or more bits. The concatenation of the counter, the HFN and the SFN will result in more different initialization values cinit, making it more unfeasible to brute-force the initialization value cinitby trying all possible values because the initialization value cinitvaries over the time.

[0054] Referring back to Fig. 3, when the initialization value cinitis generated at the UE 10 and the base station 20, the UE 10 and the base station 20 may generate the scrambling sequence based on the initialization value at 318, 320, respectively. In an example embodiment, the UE 10 and the base station 20 may generate the scrambling sequence in a similar manner as the current scrambling sequence generation, of which details are omitted here.

[0055] Then the UE 10 and the base station 20 can use the scrambling sequence to scramble information to be transmitted on a physical channel or descramble information received on a physical channel. For instance, the base station 20 may use the scrambling sequence to scramble information to be transmitted on a physical downlink channel such as PDCCH or PDSCH at 322, and transmit the scrambled information on the physical downlink channel to the UE 10 at 324. Upon receiving the physical downlink channel, the UE 10 can use the scrambling sequence to descramble the scrambled information at 326. Additionally or alternatively, the UE may use the scrambling sequence to scramble information to be transmitted on a physical uplink channel such as PUCCH or PUSCH at 328, and transmit the scrambled information on the physical uplink channel to the base station 20 at 330. Upon receiving the physical uplink channel, the base station 20 can use the scrambling sequence to descramble the scrambled information at 332.

[0056] In the process 300, secret information, which is unpredictable and long enough to be resistant against brute-force attacks, is applied to generate the initialization value for the scrambling sequence, making it unfeasible for attackers to understand the transmitted information on the fly and abuse it to leverage further attacks. The process 300 can be used to protect low layer information including butnot limited to DCI on the PDCCH, UCI on the PUCCH, and MAC CEs.

[0057] In an example embodiment, the UE 10 and the base station 20 may renew (i.e. re-key, re-derive, or change) the scrambling key KSCR- Fig. 6 illustrates a process 600 for renewing the scrambling key KSCR according to an example embodiment of the present disclosure. The process 600 may be performed at the UE 10 and the base station 20.

[0058] Referring to Fig. 6, at 610, the UE 10 and the base station 20 may perform an RRC connection establishment procedure, an RRC connection reestablishment procedure, an RRC connection resume procedure, or a handover procedure. For instance, when the UE 10 goes into the RRC connected state again after having been idle or inactive, or when the UE 10 moves to another cell, the above procedures may be selectively performed. It would be appreciated that the another cell the UE 10 moves to may be supported by the base station 20 or by another (new) base station. If the UE 10 moves to a cell supported by another base station, the steps relating to the base station 20 shown in Fig. 6 would be performed at the another base station.

[0059] After the step 610, new KSNB and keys derived from KSNB (i.e., new secret information) are taken in use at the UE 10 and the base station 20. Then the UE 10 and the base station 20 may use the new KSNB or keys derived from KSNB as secret information to renew the scrambling key KSCR at 612, 614 respectively. It would be appreciated that, if the UE 10 moves to a cell supported by another base station, the step 614 of renewing the scrambling key KSCR may comprise generating an initial scrambling key KSCR at the another base station, e.g. by steps discussed above with reference to Fig. 3. The UE 10 and the base station 20 may use the new scrambling key KSCR to generate the scrambling sequence and scramble transmissions on the physical channels. Any information that the attackers may have concluded about the scrambling sequence generated with the previous KSCR is no longer applicable to transmissions scrambled with the new KSCR.

[0060] In an example embodiment, the UE 10 and the base station 20 may refresh the scrambling key KSCR time to time while the secret information for deriving theinitial scrambling key KSCR is not changed. For instance, the scrambling key KSCR may be refreshed without changing other keys for protection of the radio interface between the UE 10 and the base station 20, such as the keys KSNB, KRRCint, KRRCCIIC, Kupint, Kupenc- Fig. 7 illustrates a process 700 for refreshing the scrambling key KSCR according to an example embodiment of the present disclosure. The process 700 may be performed at the UE 10 and the base station 20.

[0061] Referring to Fig. 7, in Option 1, the base station 20 may send an indication to refresh the scrambling key KSCR to the UE 10 at 710. Along with the indication, the base station 20 may send a one-time parameter for refreshing the scrambling key KSCR to the UE 10. For instance, the one-time parameter may be a random number. Upon receiving the indication and the one-time parameter, the UE 10 may refresh the scrambling key KSCR at 720. For instance, the UE 10 may use the secret information (e.g. KSNB or keys derived from it, such as KRRCint, KRRCCIIC, Kupint, Kupenc) or the current KSCR, and the one-time parameter as input for a key derivation function (e.g. the KDF 410 in the apparatus 400) to obtain a new KSCR- The base station 20 may refresh the scrambling key KSCR in a similar manner at 722, after it transmits the indication and the one-time parameter to the UE 10 at 710.

[0062] In an example embodiment, the base station 20 may further transmit an indication of when to use the refreshed scrambling key KSCR to the UE 10 at 710. For instance, it may indicate a hyper frame number, a system frame number, a subframe number, a slot number or s symbol number from which the refreshed scrambling key KSCR will be taken in use. Then the UE 10 and the base station 20 can refresh the scrambling key KSCR at the indicated time.

[0063] In Option 2, the base station 20 may directly transmit a new scrambling key KSCR to the UE 10 at 712. For instance, the base station 20 may transmit the new scrambling key KSCR in an encrypted RRC message to the UE 10. Then the UE 10 and the base station 20 may refresh the old KSCR using the new KSCR at 720, 722, respectively.

[0064] In Option 3, the UE 10 and the base station 20 each may detect whether a predefined event is triggered or not at 714. For instance, the UE 10 and the basestation 20 may detect whether the hyper frame number or the system frame number has increased a certain number of times since the last refreshing, whether the hyper frame number or the system frame number reaches one of a predefined set of values, or whether the hyper frame number or the system frame number has wrapped around since the last refreshing. If the event is detected, the UE 10 and the base station 20 may refresh the scrambling key KSCR at 720, 722, respectively. In an example, the UE 10 and the base station 20 may use a concatenation of the hyper frame number and the system frame number that trigger the refreshing as the above-mentioned one-time parameter to refresh scrambling key KSCR.

[0065] In the process 700, the scrambling key KSCR may be refreshed without changing other keys, and any information that the attackers may have concluded about the scrambling sequence generated with the previous KSCR is no longer applicable to transmissions scrambled with the refreshed KSCR- It further enhances security of the radio interface between the UE 10 and the base station 20.

[0066] Fig. 8 is a schematic block diagram illustrating an apparatus 800 according to an example embodiment of the present disclosure. The apparatus 800 may be implemented to comprise or to form at least a part of a terminal device such as the UE 10 discussed above to perform at least a part of operations related to the UE 10. Since the operations related to the UE 10 have been discussed above with reference to Figs. 1-7, the blocks of the apparatus 800 will be described briefly here and details thereof may refer to the above description.

[0067] Referring to Fig. 8, the apparatus 800 may include a first means 810 for deriving a scrambling key from secret information available at the terminal device and a network device serving the terminal device, a second means 820 for using the scrambling key as an input to generate an initialization value for a scrambling sequence, a third means 830 for generating the scrambling sequence based on the initialization value, and a fourth means 840 for using the scrambling sequence to scramble information to be transmitted on a physical uplink channel to the network device, or to descramble information received on a physical downlink channel from the network device.

[0068] In an example embodiment, the secret information available at the terminal device and the network device may comprise at least one of the following: a key of the network device; a key for radio resource control integrity protection; a key for radio resource control encryption; a key for user plane integrity protection; and a key for user plane encryption.

[0069] In an example embodiment, the apparatus 800 may further include a fifth means (not shown) for renewing the scrambling key from new secret information available at the terminal device and the network device after a radio resource control establishment procedure, a radio resource control reestablishment procedure, a radio resource control resume procedure, or a handover procedure.

[0070] In an example embodiment, the apparatus 800 may further include a sixth means (not shown) for refreshing the scrambling key without changing other keys for protection of a radio interface between the terminal device and the network device.

[0071] In an example embodiment, the apparatus 800 may further include a seventh means (not shown) for receiving from the network device an indication to refresh the scrambling key and a one-time parameter to be used for refreshing the scrambling key. The sixth means may be configured to refresh the scrambling key in response to the indication and by using the one-time parameter.

[0072] In an example embodiment, the seventh means may be configured to receive from the network device the indication to refresh the scrambling key, the one-time parameter to be used for refreshing the scrambling key, and an indication when to use the refreshed scrambling key.

[0073] In an example embodiment, the apparatus 800 may further include an eighth means (not shown) for receiving from the network device a new scrambling key for generating the initialization value of the scrambling sequence. The sixth means may be configured to refresh the scrambling key by using the received new scrambling key.

[0074] In an example embodiment, the second means 820 may be configured to generate the initialization value by encrypting a time-varying variable with thescrambling key.

[0075] In an example embodiment, the second means 820 may be configured to generate the initialization value by encrypting with the scrambling key a timevarying variable obtained by concatenating a hyper frame number and a system frame number in which the scrambled information is to be transmitted.

[0076] In an example embodiment, the second means 820 may be configured to generate the initialization value by encrypting with the scrambling key a timevarying variable obtained by concatenating a counter of times the hyper frame number has wrapped around since its first usage as input to generate the initialization value, the hyper frame number, and the system frame number.

[0077] In an example embodiment, the sixth means may be configured to refresh the scrambling key in response to at least one of the following events: the hyper frame number or the system frame number has increased a certain number of times since the last refreshing; the hyper frame number or the system frame number reaches one of a predefined set of values; or the hyper frame number or the system frame number has wrapped around since the last refreshing.

[0078] In an example embodiment, the second means 820 may be configured to apply a ciphering algorithm to generate multiple initialization values for multiple scrambling sequence blocks.

[0079] Fig. 9 is a schematic block diagram illustrating an apparatus 900 according to an example embodiment of the present disclosure. The apparatus 900 may be implemented to comprise or to form at least a part of a network device such as the base station 20 discussed above to perform at least a part of operations related to the base station 20. Since the operations related to the base station 20 have been discussed above with reference to Figs. 1-7, the blocks of the apparatus 900 will be described briefly here and details thereof may refer to the above description.

[0080] Referring to Fig. 9, the apparatus 900 may include a first means 910 for deriving a scrambling key from secret information available at the network device and a terminal device served by the network device, a second means 920 for using the scrambling key as an input to generate an initialization value for a scramblingsequence, a third means 930 for generating the scrambling sequence based on the initialization value, and a fourth means 940 for using the scrambling sequence to scramble information to be transmitted on a physical downlink channel to the terminal device, or to descramble information received on a physical uplink channel from the terminal device.

[0081] In an example embodiment, the secret information available at the network device and the terminal device may comprise at least one of the following: a key of the network device; a key for radio resource control integrity protection; a key for radio resource control encryption; a key for user plane integrity protection; and a key for user plane encryption.

[0082] In an example embodiment, the apparatus 900 may further include a fifth means (not shown) for renewing the scrambling key from new secret information available at the network device and the terminal device after a radio resource control establishment procedure, a radio resource control reestablishment procedure, a radio resource control resume procedure, or a handover procedure.

[0083] In an example embodiment, the apparatus 900 may further include a sixth means (not shown) for refreshing the scrambling key without changing other keys for protection of a radio interface between the network device and the terminal device.

[0084] In an example embodiment, the apparatus 900 may further include a seventh means (not shown) for transmitting to the terminal device an indication to refresh the scrambling key and a one-time parameter to be used for refreshing the scrambling key. The sixth means may be configured to refresh the scrambling key by using the one-time parameter.

[0085] In an example embodiment, the seventh means may be configured to transmit to the terminal device the indication to refresh the scrambling key, the one-time parameter to be used for refreshing the scrambling key, and an indication when to use the refreshed scrambling key.

[0086] In an example embodiment, the apparatus 900 may further include an eighth means (not shown) for transmitting to the terminal device a new scramblingkey for generating the initialization value of the scrambling sequence. The sixth means may be configured to refresh the scrambling key by using the received new scrambling key.

[0087] In an example embodiment, the second means 920 may be configured to generate the initialization value by encrypting a time-varying variable with the scrambling key.

[0088] In an example embodiment, the second means 920 may be configured to generate the initialization value by encrypting with the scrambling key a timevarying variable obtained by concatenating a hyper frame number and a system frame number in which the scrambled information is to be transmitted.

[0089] In an example embodiment, the second means 920 may be configured to generate the initialization value by encrypting with the scrambling key a timevarying variable obtained by concatenating a counter of times the hyper frame number has wrapped around since its first usage as input to generate the initialization value, the hyper frame number, and the system frame number.

[0090] In an example embodiment, the sixth means may be configured to refresh the scrambling key in response to at least one of the following events: the hyper frame number or the system frame number has increased a certain number of times since the last refreshing; the hyper frame number or the system frame number reaches one of a predefined set of values; or the hyper frame number or the system frame number has wrapped around since the last refreshing.

[0091] In an example embodiment, the second means 920 may be configured to apply a ciphering algorithm to generate multiple initialization values for multiple scrambling sequence blocks.

[0092] Fig. 10 is a schematic block diagram illustrating devices in a communication system 1000 according to an example embodiment of the present disclosure. As shown in Fig. 10, the communication system 1000 may include a terminal device 1010, a radio access network (RAN) device 1020, and a core network (CN) device 1030. In an example embodiment, the terminal device 1010 may be implemented as the UE 10 discussed above, the RAN device 1020 may beimplemented as the base station 20 discussed above, and the CN device 1030 may be implemented as the CN device 30 (e.g. AMF) discussed above.

[0093] Referring to Fig. 10, the terminal device 1010 may comprise one or more processors 1011, one or more memories 1012 and one or more transceivers 1013 interconnected through one or more buses 1014. The one or more buses 1014 may be address, data, or control buses, and may include any interconnection mechanism such as series of lines on a motherboard or integrated circuit, fiber, optics or other optical communication equipment, and the like. Each of the one or more transceivers 1013 may comprise a receiver and a transmitter, which are connected to one or more antennas 1016. The terminal device 1010 may wirelessly communicate with the RAN device 1020 through the one or more antennas 1016. The one or more memories 1012 may include instructions 1015 which, when executed by the one or more processors 1011, may cause the terminal device 1010 to perform operations and procedures relating to the UE 10 as described above.

[0094] The RAN device 1020 may comprise one or more processors 1021, one or more memories 1022, one or more transceivers 1023 and one or more network interfaces 1027 interconnected through one or more buses 1024. The one or more buses 1024 may be address, data, or control buses, and may include any interconnection mechanism such as a series of lines on a motherboard or integrated circuit, fiber, optics or other optical communication equipment, and the like. Each of the one or more transceivers 1023 may comprise a receiver and a transmitter, which are connected to one or more antennas 1026. The RAN device 1020 may operate as a base station for the terminal device 1010 and wirelessly communicate with terminal device 1010 through the one or more antennas 1026. The one or more network interfaces 1027 may provide wired or wireless communication links through which the RAN device 1020 may communicate with other network devices, entities, elements or functions. For example, the RAN device 1020 may communicate with the CN device 1030 via backhaul connections 1028. The one or more memories 1022 may include instructions 1025 which, when executed by the one or more processors 1021, may cause the RAN device 1020 to performoperations and procedures relating to the base station 20 as described above.

[0095] The CN device 1030 may comprise one or more processors 1031, one or more memories 1032, and one or more network interfaces 1037 interconnected through one or more buses 1034. The one or more buses 1034 may be address, data, or control buses, and may include any interconnection mechanism such as a series of lines on a motherboard or integrated circuit, fiber, optics or other optical communication equipment, and the like. The CN device 1030 may operate as a core network function node and wired or wirelessly communicate with the radio access network device 1020 through one or more links. The one or more network interfaces 1037 may provide wired or wireless communication links through which the CN device 1030 may communicate with other network devices, entities, elements or functions. The one or more memories 1032 may include instructions 1035 which, when executed by the one or more processors 1031, may cause the CN device 1030 to perform operations and procedures relating to the CN device 30 (e.g. AMF) as described above.

[0096] The one or more processors 1011, 1021 and 1031 discussed above may be of any appropriate type that is suitable for the local technical network, and may include one or more of general purpose processors, special purpose processor, microprocessors, a digital signal processor (DSP), one or more processors in a processor based multi-core processor architecture, as well as dedicated processors such as those developed based on Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuit (ASIC). The one or more processors 1011, 1021 and 1031 may be configured to control other elements of the terminal / RAN / CN devices and operate in cooperation with them to implement the procedures discussed above.

[0097] The one or more memories 1012, 1022 and 1032 may include at least one storage medium in various forms, such as a transitory memory and / or a non- transitory memory. The transitory memory may include, but not limited to, for example, a random access memory (RAM) or a cache. The non-transitory memory may include, but not limited to, for example, a read only memory (ROM), a harddisk, a flash memory, and the like. The term “non-transitory,” as used herein, is a limitation of the medium itself (i.e., tangible, not a signal) as opposed to a limitation on data storage persistency (e.g., RAM vs. ROM). Further, the one or more memories 1012, 1022 and 1032 may include but not limited to an electric, a magnetic, an optical, an electromagnetic, an infrared, or a semiconductor system, apparatus, or device or any combination of the above.

[0098] It would be understood that blocks in the drawings may be implemented in various manners, including software, hardware, firmware, or any combination thereof. In some embodiments, one or more blocks may be implemented using software and / or firmware, for example, machine-executable instructions stored in the storage medium. In addition to or instead of machine-executable instructions, parts or all of the blocks in the drawings may be implemented, at least in part, by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field- Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application-Specific Standard Products (ASSPs), System-on-Chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

[0099] Some exemplary embodiments further provide program instruction or instructions which, when executed by one or more processors, may cause a device or apparatus to perform the procedures described above. The program instruction for carrying out procedures of the exemplary embodiments may be written in any combination of one or more programming languages. The program instruction may be provided to one or more processors or controllers of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the program instruction, when executed by the processor or controller, cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program instruction may execute entirely on a machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

[0100] Some exemplary embodiments further provide a computer programproduct or a computer readable medium having the program instruction or instructions stored therein. The computer readable medium may be any tangible medium that may contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine readable medium may be a machine readable signal medium or a machine readable storage medium. A machine readable medium may include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine readable storage medium would include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0101] As used herein, “at least one of the following: ” and “at least one of ” and similar wording, where the list of two or more elements are joined by “and” or “or”, mean at least any one of the elements, or at least any two or more of the elements, or all the elements.

[0102] Further, while operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while several specific implementation details are contained in the above discussions, these should not be construed as limitations on the scope of the present disclosure, but rather as descriptions of features that may be specific to particular embodiments. Certain features that are described in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment may also be implemented inmultiple embodiments separately or in any suitable sub-combination.

[0103] Although the subject matter has been described in a language that is specific to structural features and / or method actions, it is to be understood the subject matter defined in the appended claims is not limited to the specific features or actions described above. On the contrary, the above-described specific features and actions are disclosed as an example of implementing the claims.

Claims

CLAIMS:

1. An apparatus for a terminal device, comprising: at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the terminal device at least to perform: deriving a scrambling key from secret information available at the terminal device and a network device serving the terminal device; using the scrambling key as an input to generate an initialization value for a scrambling sequence; generating the scrambling sequence based on the initialization value; and using the scrambling sequence to scramble information to be transmitted on a physical uplink channel to the network device, or to descramble information received on a physical downlink channel from the network device.

2. The apparatus of claim 1, wherein the secret information available at the terminal device and the network device comprises at least one of the following: a key of the network device; a key for radio resource control integrity protection; a key for radio resource control encryption; a key for user plane integrity protection; and a key for user plane encryption.

3. The apparatus of claim 1 or 2, wherein the apparatus is configured to perform: renewing the scrambling key from new secret information available at the terminal device and the network device, after a radio resource control establishment procedure, a radio resource control reestablishment procedure, a radio resource control resume procedure, or a handover procedure.

4. The apparatus of any of claims 1-3, wherein the apparatus is configured to perform: refreshing the scrambling key without changing other keys for protection of a radio interface between the terminal device and the network device.

5. The apparatus of claim 4, wherein the apparatus is configured to perform: receiving, from the network device, an indication to refresh the scrambling key and optionally a one-time parameter to be used for refreshing the scrambling key; and refreshing the scrambling key in response to the indication and optionally by using the one-time parameter.

6. The apparatus of claim 5, wherein the apparatus is configured to perform: receiving, from the network device, the indication to refresh the scrambling key, the one-time parameter to be used for refreshing the scrambling key, and an indication when to use the refreshed scrambling key.

7. The apparatus of claim 4, wherein the apparatus is configured to perform: receiving, from the network device, a new scrambling key for generating the initialization value of the scrambling sequence.

8. The apparatus of any of claims 1-7, wherein the apparatus is configured to perform: generating the initialization value by encrypting a time-varying variable with the scrambling key.

9. The apparatus of claim 8, wherein the apparatus is configured to perform: generating the initialization value by encrypting with the scrambling key a time-varying variable obtained by concatenating a hyper frame number and a system frame number in which the scrambled information is to be transmitted.

10. The apparatus of claim 9, wherein the apparatus is configured to perform: generating the initialization value by encrypting with the scrambling key a time-varying variable obtained by concatenating a counter of times the hyper frame number has wrapped around since its first usage as input to generate the initialization value, the hyper frame number, and the system frame number.

11. The apparatus of claim 4 or 9, wherein the apparatus is configured to perform:refreshing the scrambling key in response to at least one of the following events: the hyper frame number or the system frame number has increased a certain number of times since the last refreshing; the hyper frame number or the system frame number reaches one of a predefined set of values; or the hyper frame number or the system frame number has wrapped around since the last refreshing.

12. The apparatus of any of claims 1-11, wherein the apparatus is configured to perform: applying a ciphering algorithm to generate multiple initialization values for multiple scrambling sequences.

13. An apparatus for a network device, comprising: at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the network device at least to perform: deriving a scrambling key from secret information available at the network device and a terminal device served by the network device; using the scrambling key as an input to generate an initialization value for a scrambling sequence; generating the scrambling sequence based on the initialization value; andusing the scrambling sequence to scramble information to be transmitted on a physical downlink channel to the terminal device, or to descramble information received on a physical uplink channel from the terminal device.

14. The apparatus of claim 13, wherein the secret information available at the network device and the terminal device comprises at least one of the following: a key of the network device; a key for radio resource control integrity protection; a key for radio resource control encryption; a key for user plane integrity protection; and a key for user plane encryption.

15. The apparatus of claim 13 or 14, wherein the apparatus is configured to perform: renewing the scrambling key from new secret information available at the network device and the terminal device, after a radio resource control establishment procedure, a radio resource control reestablishment procedure, a radio resource control resume procedure, or a handover procedure.

16. The apparatus of any of claims 13-15, wherein the apparatus is configured to perform: refreshing the scrambling key without changing other keys for protection of a radio interface between the network device and the terminal device.

17. The apparatus of claim 16, wherein the apparatus is configured to perform: transmitting, to the terminal device, an indication to refresh the scrambling key and optionally a one-time parameter to be used for refreshing the scrambling key; and refreshing the scrambling key, optionally by using the one-time parameter.

18. The apparatus of claim 17, wherein the apparatus is configured to perform: transmitting, to the terminal device, the indication to refresh the scrambling key, the one-time parameter to be used for refreshing the scrambling key, and an indication when to use the refreshed scrambling key.

19. The apparatus of claim 17, wherein the apparatus is configured to perform: transmitting, to the terminal device, a new scrambling key for generating the initialization value of the scrambling sequence.

20. The apparatus of any of claims 13-19, wherein the apparatus is configured to perform: generating the initialization value by encrypting a time-varying variable with the scrambling key.

21. The apparatus of claim 20, wherein the apparatus is configured to perform: generating the initialization value by encrypting with the scrambling key atime-varying variable obtained by concatenating a hyper frame number and a system frame number in which the scrambled information is to be transmitted.

22. The apparatus of claim 21, wherein the apparatus is configured to perform: generating the initialization value by encrypting with the scrambling key a time-varying variable obtained by concatenating a counter of times the hyper frame number has wrapped around since its first usage as input to generate the initialization value, the hyper frame number, and the system frame number.

23. The apparatus of claim 16 or 21, wherein the apparatus is configured to perform: refreshing the scrambling key in response to at least one of the following events: the hyper frame number or the system frame number has increased a certain number of times since the last refreshing; the hyper frame number or the system frame number reaches one of a predefined set of values; or the hyper frame number or the system frame number has wrapped around since the last refreshing.

24. The apparatus of any of claims 13-23, wherein the apparatus is configured to perform: applying a ciphering algorithm to generate multiple initialization values formultiple scrambling sequences.

25. A method performed by an apparatus for a terminal device, comprising: deriving a scrambling key from secret information available at the terminal device and a network device serving the terminal device; using the scrambling key as an input to generate an initialization value for a scrambling sequence; generating the scrambling sequence based on the initialization value; and using the scrambling sequence to scramble information to be transmitted on a physical uplink channel to the network device, or to descramble information received on a physical downlink channel from the network device.

26. The method of claim 25, wherein the secret information available at the terminal device and the network device comprises at least one of the following: a key of the network device; a key for radio resource control integrity protection; a key for radio resource control encryption; a key for user plane integrity protection; and a key for user plane encryption.

27. The method of claim 25 or 26, comprising: renewing the scrambling key from new secret information available at the terminal device and the network device, after a radio resource controlestablishment procedure, a radio resource control reestablishment procedure, a radio resource control resume procedure, or a handover procedure.

28. The method of any of claim 25-27, comprising: refreshing the scrambling key without changing other keys for protection of a radio interface between the terminal device and the network device.

29. The method of claim 28, comprising: receiving, from the network device, an indication to refresh the scrambling key and optionally a one-time parameter to be used for refreshing the scrambling key; and refreshing the scrambling key in response to the indication and optionally by using the one-time parameter.

30. The method of claim 29, comprising: receiving, from the network device, the indication to refresh the scrambling key, the one-time parameter to be used for refreshing the scrambling key, and an indication when to use the refreshed scrambling key.

31. The method of claim 28, comprising: receiving, from the network device, a new scrambling key for generating the initialization value of the scrambling sequence.

32. The method of any of claims 25-31, comprising: generating the initialization value by encrypting a time-varying variable with the scrambling key.

33. The method of claim 32, comprising: generating the initialization value by encrypting with the scrambling key a time-varying variable obtained by concatenating a hyper frame number and a system frame number in which the scrambled information is to be transmitted.

34. The method of claim 33, comprising: generating the initialization value by encrypting with the scrambling key a time-varying variable obtained by concatenating a counter of times the hyper frame number has wrapped around since its first usage as input to generate the initialization value, the hyper frame number, and the system frame number.

35. The method of claim 28 or 33, comprising: refreshing the scrambling key in response to at least one of the following events: the hyper frame number or the system frame number has increased a certain number of times since the last refreshing; the hyper frame number or the system frame number reaches one of a predefined set of values; or the hyper frame number or the system frame number has wrapped aroundsince the last refreshing.

36. The method of any of claims 25-35, comprising: applying a ciphering algorithm to generate multiple initialization values for multiple scrambling sequences.

37. A method performed by an apparatus for a network device, comprising: deriving a scrambling key from secret information available at the network device and a terminal device served by the network device; using the scrambling key as an input to generate an initialization value for a scrambling sequence; generating the scrambling sequence based on the initialization value; and using the scrambling sequence to scramble information to be transmitted on a physical downlink channel to the terminal device, or to descramble information received on a physical uplink channel from the terminal device.

38. The method of claim 37, wherein the secret information available at the network device and the terminal device comprises at least one of the following: a key of the network device; a key for radio resource control integrity protection; a key for radio resource control encryption; a key for user plane integrity protection; and a key for user plane encryption.

39. The method of claim 37 or 38, comprising: renewing the scrambling key from new secret information available at the network device and the terminal device, after a radio resource control establishment procedure, a radio resource control reestablishment procedure, a radio resource control resume procedure, or a handover procedure.

40. The method of any of claims 37-39, comprising: refreshing the scrambling key without changing other keys for protection of a radio interface between the network device and the terminal device.

41. The method of claim 40, comprising: transmitting, to the terminal device, an indication to refresh the scrambling key and optionally a one-time parameter to be used for refreshing the scrambling key; and refreshing the scrambling key, optionally by using the one-time parameter.

42. The method of claim 41, comprising: transmitting, to the terminal device, the indication to refresh the scrambling key, the one-time parameter to be used for refreshing the scrambling key, and an indication when to use the refreshed scrambling key.

43. The method of claim 41, comprising:transmitting, to the terminal device, a new scrambling key for generating the initialization value of the scrambling sequence.

44. The method of any of claims 37-43, comprising: generating the initialization value by encrypting a time-varying variable with the scrambling key.

45. The method of claim 44, comprising: generating the initialization value by encrypting with the scrambling key a time-varying variable obtained by concatenating a hyper frame number and a system frame number in which the scrambled information is to be transmitted.

46. The method of claim 45, comprising: generating the initialization value by encrypting with the scrambling key a time-varying variable obtained by concatenating a counter of times the hyper frame number has wrapped around since its first usage as input to generate the initialization value, the hyper frame number, and the system frame number.

47. The method of claim 40 or 45, comprising: refreshing the scrambling key in response to at least one of the following events: the hyper frame number or the system frame number has increased a certain number of times since the last refreshing;the hyper frame number or the system frame number reaches one of a predefined set of values; or the hyper frame number or the system frame number has wrapped around since the last refreshing.

48. The apparatus of any of claims 37-47, comprising: applying a ciphering algorithm to generate multiple initialization values for multiple scrambling sequences.

49. An apparatus for a terminal device, comprising means for performing the method of any of claims 25 to 36.

50. An apparatus for a network device, comprising means for performing the method of any of claims 37 to 48.

51. A computer readable medium comprising program instructions that, when executed by an apparatus for a terminal device, cause the terminal device to at least perform the method of any of claims 25 to 36.

52. A computer readable medium comprising program instructions that, when executed by an apparatus for a network device, cause the network device to at least perform the method of any of claims 37 to 48.

Images