Device for notifying length of message authentication code

Abstract

A network device of the present invention includes, in a message to be transmitted from the network device to a terminal device, data indicating the number of bits of a message authentication code to which the network device corresponds, and transmits the data to the terminal device.

Description

Device for reporting the length of a message authentication code

[0001] The present disclosure relates to a technique for extending the message authentication code length in the 3GPP (Third Generation Partnership Project) specifications and sharing support for longer message authentication codes (MAC) between a terminal device (UE) and a network (NW). This application claims priority to Japanese Patent Application No. 2023-184322, filed on October 26, 2023, the contents of which are incorporated herein by reference.

[0002] A terminal device UE (User Equipment) is a mobile communication terminal used by a user, such as a smartphone. When terminal devices UE communicate with each other, they communicate via a mobile communication network such as 5G. This mobile communication network will be referred to as a "network NW" hereinafter.

[0003] When a terminal device UE and a network NW communicate wirelessly, each encrypts and transmits a message. The message is then decrypted on the receiving side. The algorithm used to encrypt a message is called an "encryption algorithm." Furthermore, there is a risk that a third party may tamper with the message during wireless communication. Therefore, the transmitting side creates a code for tampering detection and attaches the code to the message before transmitting. The algorithm used to create the code for tampering detection is called a "tampering detection algorithm." Conventionally, in order to prove that a transmitted message has not been tampered with during transmission, the transmitting side calculates a message authentication code (MAC) and attaches the calculated message authentication code to the message before transmitting it.

[0004] 3GPP (registered trademark) TS33.4013GPP (registered trademark) TS33.501

[0005] Conventionally, a 32-bit message authentication code (MAC) has been used. However, in order to provide sufficient security against tampering, there has been a recent trend to increase the length of the message authentication code (hereinafter referred to as "MAC length"). However, conventional specifications do not define MAC length negotiation between a terminal device (UE) and a network (NW). For example, if the MAC length is extended to 128 bits on the transmitting side, there is a problem in that the receiving side cannot determine how many bits of MAC to calculate.

[0006] The present disclosure aims to realize, as an example, a method for confirming that a MAC longer than the current 32 bits is supported between a terminal device UE and a network NW.

[0007] The present inventors discovered that data indicating how many bits of a message authentication code the network device supports can be included in a message sent from a network device to a terminal device, and have completed the present disclosure.

[0008] (1) A network device that includes data indicating the number of bits of a message authentication code that the network device supports in a message sent from the network device to the terminal device and transmits the message to the terminal device. (2) The network device of (1) above that includes data indicating the number of bits of the message authentication code that the network device supports in an ABBA (Anti-Bidding Down Between Architectures) parameter in the message sent from the network device to the terminal device. (3) The network device of (2) above that also specifies an algorithm for the message authentication code using the ABBA parameter. (4) A terminal device that receives a message sent from a network device that includes data indicating the number of bits of a message authentication code that the network device supports, and notifies the network device of the security capabilities of the terminal device using a tamper detection algorithm different from the tamper detection algorithm selected by the network device. (5) A terminal device that includes, in a Globally Unique Temporary UE Identity (GUTI) in an initial connection message sent to a network device, data indicating how many bits of message authentication code the previously connected Access and Mobility Management Function (AMF) supported. (6) A terminal device that includes, in Network Slice Selection Assistance Information (NSSAI) in a message sent to a base station, data indicating how many bits of message authentication code the terminal device requests to use. (7) A network device according to (1), that includes, in a System Information Block (SIB) in a message sent from a network device to a terminal device, data indicating how many bits of message authentication code the network device supports.(8) A terminal device that rejects an access stratum security mode command when the MAC (Message Authentication Code) length of a tampering detection algorithm that it supports does not match the MAC length of the tampering detection algorithm presented in the access stratum security mode command message received from a base station. (9) A terminal device that, when presenting its security functions to an AMF (Access and Mobility Management Function), separately presents the tampering detection algorithm that it supports and the MAC (Message Authentication Code) length that it supports. (10) A terminal device that receives a message transmitted from the network device of (7), and ranks the received multiple system information blocks SIBs according to whether or not they support a 128-bit MAC (Message Authentication Code), and selects a network node to connect to based on received signal strength and tampering detection strength.

[0009] According to the present disclosure, a network device notifies a terminal device of the number of bits of a message authentication code that the network device supports, which allows, for example, negotiation between the network device and the terminal device regarding the length of the message authentication code to be used.

[0010] 10 is a first diagram showing the use of the tampering detection algorithm NIA to detect message tampering. FIG. 11 is a second diagram showing the use of the tampering detection algorithm NIA to detect message tampering. FIG. 12 is a diagram (first half) showing procedures of authentication, key agreement, and NAS SMC between a terminal device UE and a network NW. FIG. 13 is a diagram (second half) showing procedures of authentication, key agreement, and NAS SMC between a terminal device UE and a network NW. FIG. 14 is a diagram showing an example of a man-in-the-middle attacker tampering with messages. FIG. 15 is a diagram showing a procedure for selecting a network slice instance. FIG. 16 is a diagram showing a procedure for selecting a cell. FIG. 17 is a diagram showing a terminal device collecting SIBs of base stations that can be received. FIG. 18 is a diagram showing an example of the result of a terminal device assigning priorities to base stations. FIG. 19 is a diagram showing a terminal device sending an attach request to a cell with the strongest signal strength. FIG. 19 is a diagram showing a cell with priority 1 in a sixth embodiment of the present disclosure. FIG. 19 is a schematic diagram of priority assignment in the sixth embodiment of the present disclosure. FIG. 19 is a diagram showing negotiation of a tampering detection algorithm and a MAC length.

[0011] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. FIGS. 1A and 1B are diagrams illustrating calculation of a message authentication code (MAC) on the transmitting side and the receiving side. The message authentication code (MAC) is defined as MAC-I in the 3GPP (Third Generation Partnership Project) specifications and is used to detect tampering of messages in the Packet Data Convergence Protocol (PDCP) layer. On the transmitting side, the NIA calculates the message authentication code (MAC) using a 128-bit key, a 32-bit count, a 5-bit bearer, a 1-bit direction, and a message as input. In the current specifications, the MAC length is 32 bits. On the transmitting side, the generated message authentication code (MAC) is transmitted along with the message. On the receiving side, the NIA calculates the message authentication code (MAC) using the received message, a 128-bit key, a 32-bit count, a 5-bit bearer, and a 1-bit direction as input. On the receiving side, the received message authentication code (MAC) is compared with the message authentication code (MAC) calculated from the received message, etc. If they match, it can be confirmed that the message has not been tampered with along the way.

[0012] 2 and 3 are a series of diagrams illustrating authentication, key agreement, and NAS (Non-Access-Stratum) SMC (Security Mode Command) procedures between a terminal device UE and a network NW in the prior art and an embodiment of the present disclosure. When the terminal device UE is powered on, a random access procedure is performed in step S1, and then an RRC connection procedure is performed in step S2. After this, initial connection and authentication are performed.

[0013] In step S3, the terminal device UE sends an initial connection message to the base station gNB. The initial connection message includes the security capabilities of the terminal device UE and a Globally Unique Temporary UE Identity (GUTI) or a Subscription Concealed Identifier (SUCI). In step S4, the base station gNB forwards the initial connection message to the Access and Mobility Management Function (AMF) / Security Anchor Functionality (SEAF) of the core network. In step S5, if the initial connection message includes a SUCI or Subscription Permanent Identifier (SUPI), that is, if the terminal device UE has not yet been authenticated, the AMF / SEAF starts an authentication procedure with the Unified Data Management (UDM) / Authentication Server Function (AUSF) / Authentication Credentials Repository Function (ARPF).

[0014] In step S6, the SEAF sends a Nausf_UEAuthentication_Authenticate Request message to the AUSF. This message includes SUCI or SUPI. In step S7, the AUSF checks whether the SEAF that sent the request message is allowed to use the service network name. In step S7, the AUSF temporarily stores the received service network name and sends a Nudm_UEAuthentication_Get Request message including SUCI or SUPI and the service network name to the UDM / ARPF / SIDF (Subscription Identifier De-concealing function).

[0015] In step S7, when the UDM receives the Nudm_UEAuthentication_Get Request message, if SUCI is received, it calls the SIDF to decrypt the SUCI and obtain the SUPI. In step S7, based on the SUPI, the UDM / ARPF selects whether to use EAP (Extensible Authentication Protocol)-AKA (Authentication and Key Agreement)' or 5G-AKA. In step S7, the UDM / ARPF generates an authentication vector (AV) consisting of (RAND, AUTN, XRES, CK (Cipher Key)', IK (Integrity Key)') and sends the authentication vector AV to the AUSF together with the Nudm_UEAuthentication_Get Response.

[0016] If the authentication method is set to 5G-AKA, the AUSF sends a message including an AKA Challenge message to the SEAF in step S8. At this time, the AKA-Challenge message also includes an expected response. The SEAF forwards this to the base station gNB in ​​step S10. The message sent to the base station gNB in ​​step S10 includes an Authentication Request message, which is a NAS (Non-Access-Stratum) message. This Authentication Request message sent in steps S10 and S12 includes an ngKSI (5G system key configuration identifier) ​​and an ABBA (Anti-Bidding Down Between Architectures) parameter set to 0x0000 according to TS 33.501. The base station gNB receives the AKA-Challenge message from the SEAF (step S11).

[0017] In step S12, the base station gNB forwards the received message to the terminal device UE. In step S13, the terminal device UE calculates a response from the received message and checks whether the AUTN (authentication token) is correct. If the AUTN is correct, in step S14, the terminal device UE sends a message as a response, which the base station gNB receives in step S15 and forwards to the SEAF in step S16.

[0018] If EAP-AKA' is selected as the authentication method, the SEAF transfers the response received in step S16 to the AUSF in step S18. On the other hand, if 5G-AKA is selected as the authentication method, in step S17, the SEAF compares the response from the terminal device UE with the hash value of the expected response received from the AUSF in step S8, and if they match, transfers the expected response to the AUSF in step S18. In step S19, the AUSF compares the response from the terminal device UE with the expected response. If they match, it sends the anchor key KSEAF and SUPI to the SEAF in the Nausf_UEAuthentication_Authenticate Response in step S20.

[0019] In step S21, the SEAF verifies that the AUSF has successfully authenticated the terminal apparatus UE. If the terminal apparatus UE is successfully authenticated, in step S22, the AMF sends an authentication success message to the terminal apparatus UE. In step S21, the AMF creates a NAS message called Security Mode Command. This message includes the security capabilities of the terminal apparatus UE, the tamper detection and encryption algorithm selected by the AMF, and optionally the ABBA parameters and ngKSI. In step S22, the AMF sends the NAS message to the base station gNB, which receives the message in step S23 and forwards the NAS message to the terminal apparatus UE in step S24.

[0020] In step S25, the terminal apparatus UE verifies the message using a tampering detection function and verifies that the security capabilities of the terminal apparatus UE have not been tampered with. If everything is fine, the terminal apparatus UE sends a Security Mode Complete message to the AMF via the base station gNB (steps S26 and S27). This Security Mode Complete message includes the security capabilities of the terminal apparatus UE and the requested NSSAI (Network Slice Selection Assistance Information).

[0021] In step S28, the AMF confirms that the received message can be correctly decoded and has not been tampered with, and in step S29, sends a registration accept message to the base station gNB. This registration accept message includes the allowed NSSAI, the new GUTI assigned to the terminal apparatus UE, and functions supported by the network. A notification related to the registration accept message is sent to the terminal apparatus UE, and a response by the terminal apparatus UE is sent to the AMF via the base station gNB (steps S30 to S34). The authentication, key agreement, and NAS SMC procedures in the prior art and embodiments of the present disclosure have been described above.

[0022] The present disclosure uses a conventional message to notify a terminal device UE from the network NW side that the network NW side supports a 128-bit tamper detection algorithm. [First embodiment] Notification of 128-bit MAC support using ABBA parameter The message transmitted from the SEAF to the base station gNB in ​​step S10 of FIG. 2 includes an ABBA parameter. This ABBA parameter is used to notify the terminal device UE that the network NW side supports a 128-bit tamper detection algorithm. For example, this is realized as follows using 4 bits of the ABBA parameter. 0001: RAN (Radio Access Network) is capable of supporting 128-bit MAC 0010: AMF is capable of supporting 128-bit MAC

[0023] By setting this ABBA parameter, the terminal device UE is notified that the RAN or AMF is capable of supporting 128-bit MAC. Therefore, the terminal device UE can use the ABBA parameter in step S25 of the procedure of Figure 3 as follows: 1. If the ABBA parameter is set to 0010 and the terminal device UE is capable of supporting 128-bit MAC, the terminal device UE can check whether the network NW has selected a 128-bit tamper detection algorithm. a. If a 128-bit tamper detection algorithm is selected, the terminal device UE accepts the message and sends a Security Mode Complete message protected by the selected algorithm. b. If a 128-bit tamper detection algorithm is not selected, the terminal device UE rejects the NAS Security Mode Command sent in step S24 and sets a bit in the rejection message indicating that it desires to use the 128-bit tamper detection algorithm.

[0024] However, even when it is called a "128-bit MAC security algorithm," there are multiple types of "128-bit MAC security algorithms." If the terminal device UE and the network do not support the same type of 128-bit MAC security algorithm, the AMF may select a 32-bit tamper detection algorithm, which may be rejected by the terminal device UE. Therefore, the following method is used to solve this problem.

[0025] (Method 1) By adding a new field to the NAS Security Mode Command to indicate "128-bit MAC compatible algorithm selection error," the terminal UE is notified that there is no 128-bit tamper detection algorithm supported by both the AMF and the terminal UE. If this bit is set, the terminal UE accepts the 32-bit tamper detection algorithm selected by the AMF. (Method 2) Logic based on the UE security capabilities sent by the terminal UE in steps S3 and S4 is added to the SEAF. If the terminal UE indicates that it supports 128-bit MAC, the SEAF checks whether the network supports the same type of algorithm, and if so, sets the ABBA parameter as described above to indicate that the AMF or RAN supports 128-bit MAC. However, if there is no common algorithm, the SEAF does not set the ABBA parameter, thereby indicating that it cannot select a 128-bit tamper detection algorithm. If the ABBA parameter is not set, the terminal UE accepts the 32-bit tamper detection algorithm.

[0026] In this embodiment, it is important that the terminal device UE confirms that the security functions it transmitted in step S3 match the security functions it received in step S12, thereby preventing attacks by a man-in-the-middle (MIM) located between the terminal device UE and the network NW (hereinafter referred to as a "man-in-the-middle attack").

[0027] [Second embodiment] Method of specifying a 128-bit tamper detection algorithm using an ABBA parameter In addition to the first embodiment, it is also possible for the SEAF to select the type of algorithm and notify the terminal device UE using the ABBA parameter. This will be explained using Figures 2 and 3. The SEAF receives the security capabilities of the terminal device UE in the message of step S4, and in step S5, the SEAF checks whether the security capabilities of the terminal device UE include a 128-bit tamper detection algorithm. If the terminal device UE can use a 128-bit tamper detection algorithm, the SEAF selects the 128-bit tamper detection algorithm with the highest priority from the 128-bit tamper detection algorithm supported by the terminal device UE (it is also possible to select a RAN security algorithm in the same way).

[0028] After the selection by SEAF is completed, SEAF specifies the selected algorithm in the ABBA parameter. For example, it is possible to specify the algorithm as shown in Table 1 using the first byte. The second byte is set as shown in Table 2.

[0029] The SEAF operates as in Method 3 or Method 4 below. (Method 3) The SEAF is configured with a prioritized list of algorithms for the AS and NAS, and uses the same logic that the base station gNB and AMF use to select an appropriate algorithm. In this case, the SEAF needs to notify the base station gNB and AMF of the algorithm it has selected, which can be explicitly notified by a new message called "Algorithm Selected by SEAF." Alternatively, the base station gNB and AMF can be configured to check the ABBA parameters and set the selected algorithm. (Method 4) The SEAF sends an "Algorithm Selection Request" including the security capabilities of the terminal device UE to the AMF and base station gNB, and sets the corresponding bits of the ABBA parameters based on the responses of the AMF and base station gNB.

[0030] Since the ABBA parameters are independent of the selected algorithm, they can be used to select a 256-bit algorithm even if a vulnerability is found in the 128-bit algorithm. Also, if the terminal device UE does not support the 256-bit algorithm, the ABBA parameters are not set, so it is possible to connect legacy terminal devices UE to the network.

[0031] If the ABBA parameter is set, the 128-bit MAC-compatible terminal device UE verifies in step S25 that the message received in step S24 indicates the same algorithm. If the same algorithm is not indicated, the terminal device UE rejects the SMC (Security Mode Command) using an SMC rejection message due to an algorithm mismatch. This allows the AMF to know the reason why the terminal device UE rejected the NAS Security Mode Command sent in step S24.

[0032] [Third Embodiment] Exchanging UE Security Capabilities If an attacker exists between a terminal device UE and a network NW, even if both the terminal device UE and the network NW support a 128-bit tampering detection algorithm, an attack is possible in which the attacker tampers with messages to select a weaker algorithm. An example of an attacker tampering with messages will be described using FIG. 4. FIG. 4 shows the same flow as FIG. 2 and FIG. 3, but only shows NAS messages between the terminal device UE and the AMF, and shows a procedure in which a Man-in-the-middle (MITM) (short for Att) tampers with messages. Tampered messages have "'" added.

[0033] The terminal device UE is unauthenticated and sends a registration request or initial NAS message in message M1, which includes UE security capabilities and other elements. The attacker Att deletes all UE security capabilities except those that can be attacked. For example, if the terminal device UE sends in message M1 that it supports the tamper detection algorithms 128-NIA1, 128-NIA2, 128-NIA3, 128-NIA4, 128-NIA5, and 128-NIA6, the attacker Att tampers with message M1 to make it appear as if it supports only the attackable algorithms. For example, if 128-NIA2 is attackable, the attacker Att tampers with the message M1 to make it appear as if it supports only this tamper detection algorithm. The attacker Att then sends the tampered message 1' to the AMF.

[0034] The AMF responds with a normal authentication request message M2, which the attacker forwards to the terminal UE without modifying it. The terminal UE processes the authentication request message, verifies its validity, and if valid, creates an authentication response message M3, which the attacker forwards to the AMF without modifying it.

[0035] The AMF then selects an algorithm based on the UE security capabilities received in message M1' modified by the attacker, and sends a Security Mode Command message M4 to the terminal device UE protected by the tamper detection algorithm selected by the attacker Att. Because the SMC message includes the UE security capabilities received in message M1', the attacker obtains message M4, replaces the UE security capabilities with those of message M1, and verifies that the MAC matches the message. The modified message is sent to the terminal device UE as message M4'.

[0036] When the terminal UE receives message M4', it verifies that the UE security capabilities are correct and the MAC, and if correct, uses the selected encryption and tamper detection algorithm. The terminal UE then creates a Security Mode Complete message M5, encrypts it with the selected algorithm, and protects it with the tamper detection algorithm.

[0037] The attacker checks message M5 to see if it contains UE security capabilities. If it does, the attacker modifies the UE security capabilities again, encrypts the message, and ensures that the MAC matches the message. The attacker sends message M5' to the AMF, and the AMF considers that the NAS SMC is completed, and the authentication of the terminal device UE is completed.

[0038] The above attack by the attacker Att can be solved by the following steps: 1) securely notifying the terminal device UE that a 128-bit tamper detection algorithm is available in the core network, and 2) notifying the AMF of security capabilities without using the selected algorithm, so that the AMF can verify that the message has not been tampered with by the man-in-the-middle attacker (Att).

[0039] Specifically, the procedure is as follows: Step 1: During the authentication process, the SEAF uses the ABBA parameter to indicate that the core network supports 128-bit MAC or to indicate the algorithms supported by the core network. The SEAF includes the ABBA parameter in message M2 of FIG. 4. Step 2: During Security Mode Complete, the terminal device UE verifies that the message has not been tampered with and verifies the received UE security capabilities. Furthermore, the terminal device UE adds a MAC of the UE security capabilities using a different tamper detection algorithm in addition to the selected tamper detection algorithm. Here, the "algorithm different from the selected tamper detection algorithm" must be an algorithm supported by both the terminal device UE and the network, and can be, for example, Key Derivation Function (KDF) or HMAC-SHA-256.

[0040] When the terminal device UE generates a MAC using KDF, K NASint_256 Using this as the key, the MAC for the Initial NAS message can be calculated as follows: UE_Capabilities_Hash = KDF(K NASint_256 , Initial NAS message) Similarly, the MAC for UE Security Capabilities can be calculated as follows: UE_Capabilities_Hash = KDF(K NASint_256 , UE Security Capabilities) The terminal device UE includes this in a Security Mode Complete message and sends it to the AMF.

[0041] Step 3: The AMF receives the Security Mode Complete message and calculates the MAC for the UE security function. If the results match, the AMF can determine that the correct algorithm has been selected. If the results do not match, the AMF reconfigures the NAS security protocol using the newly selected algorithm and sends a NAS Security Mode Command to the UE again, and repeats the above process from step 1.

[0042] The key used for MAC calculation may be any key that can be used by the AMF and the terminal device UE, and the following may be assumed: K, which is the root key of the AMF ＡＭＦ -K ＮＡＳＩｎｔ and K. ＮＡＳＥｎｃ Any of these keys may be input to the hash function as long as the terminal device UE and the AMF use the same key. This embodiment can prevent attacks that force a 32-bit MAC to be selected as follows: Since the ABBA parameters are used as input for key derivation, if an attacker tampers with the ABBA parameters, the generated K ＡＭＦ changes. ＡＭＦ With input K ｇＮＢ , K. ＮＡＳｉｎｔ , K. ＮＡＳｅｎｃ Since keys such as ABBA are generated, tampering with the ABBA parameters will result in different keys being generated between the terminal device UE and the AMF, causing a connection establishment failure. In addition to the 32-bit MAC assigned in the conventional technology, if the terminal device UE supports 128-bit MAC, an additional MAC is assigned. The AMF can determine whether the terminal device UE supports 128-bit MAC by checking the additional MAC. The AMF verifies the two MACs and successfully terminates the NAS Security Mode Command only if both verifications are successful. If either one fails, the connection can be terminated or the NAS Security Mode Command can be re-executed. In this way, if a man-in-the-middle attacker tampers with a message, it can be detected and the attack can be prevented.

[0043] [Fourth embodiment] Method for selecting 128-bit MAC when returning from idle state When authentication of the terminal apparatus UE is completed, a 5G GUTI is assigned to the terminal apparatus UE by the AMF. In TS23.501, the 5G GUTI is <guami><5G-TMSI> is defined as <5G-TMSI>, and GUAMI (Globally Unique AMF ID) is defined as follows: <guami> :＝ <mcc> <mnc><AMF Region ID> <AMF Set ID> <AMF Pointer>

[0044] This GUAMI is used when the authenticated terminal device UE continues the session using the previous set of keys when reconnecting to the network. In FIG. 2, the terminal device UE includes a 5G GUTI in the message of step S3. The GUAMI portion of the 5G GUTI is used by the base station gNB to identify the set of AMFs. However, if the base station gNB is not connected to the target AMF (for example, if the AMF does not serve the specific area where the terminal device UE is currently located), the base station gNB selects another AMF that obtains the security context from the previous AMF.

[0045] Here, the base station gNB cannot determine whether the terminal device UE was previously using a 128-bit tamper detection algorithm (and therefore needs to preferentially connect to an AMF that supports 128-bit MAC), or whether the terminal device UE was using a 32-bit tamper detection algorithm (whether it can connect to an AMF that only supports 32-bit MAC).

[0046] In order for the base station gNB to determine this, it can be realized by including the 128-bit MAC support function of the AMF in the GUAMI part of the GUTI. For example, a field indicating the 128-bit MAC support function is added to extend the GUAMI as follows: <guami> ：= <mcc> <mnc><AMF region ID> <AMF set ID> <AMF pointer> <128-bit MAC capable> The base station gNB checks GUAMI and selects an AMF that supports 128-bit MAC based on whether the previous AMF supports 128-bit MAC.

[0047] or <guami>Another method is to classify the <AMF Set ID> into 32-bit MAC-compatible AMF and 128-bit MAC-compatible AMF for each operator without changing the field. The operator places the 128-bit MAC-compatible AMF in a specific set and sets the set ID value in the base station gNB, so that the base station gNB can select an AMF based on the AMF Set ID value even if the region ID is different. By applying this to the entire network, once a terminal device UE is connected to an environment that supports 128-bit MAC, it will always be connected to an AMF that supports 128-bit MAC.

[0048] [Fifth Embodiment] Requesting a 128-bit MAC Using NSSAI A method can be considered in which the base station gNB is notified of the use of a 128-bit tamper detection algorithm using network slice selection assistance information (NSSAI). The NSSAI is included in the message transmitted in step S3 of FIG. 2, and the NSSAI is composed of up to eight S-NSSAIs. Each S-NSSAI is defined as a combination of an SST (Slice / Service Type) and an SD (Slice Differentiator). The currently defined SST values ​​are as shown in Table 3. The first 127 of the SSTs are defined by 3GPP (registered trademark), and the remaining 128 values ​​can be independently set by operators. The SD value can also be independently set by operators. Currently defined slices are related to the type of service provided by the network, and do not define information about security or algorithms.

[0049] However, since slice information is used to select an appropriate AMF, a problem occurs when only some AMFs in the network support the 128-bit tamper detection algorithm. For example, if a terminal device UE capable of supporting 128-bit MAC requests SST4, the terminal device UE cannot use the 128-bit tamper detection algorithm if the AMF processing SST4 does not support 128-bit MAC. This problem can be solved by defining a new slice. An example is shown below. Table 4 shows a 128-bit MAC as an example, but any MAC other than 128-bit MAC can also be supported.

[0050] A terminal device UE capable of supporting 128-bit MAC can notify the network NW that it prioritizes the use of the 128-bit tamper detection algorithm by including this NSSAI in the connection request. This allows the base station gNB to select an appropriate AMF that supports 128-bit MAC based on the slice information. Although the connection request may be modified by a man-in-the-middle attacker, including the slice information in Security Mode Complete together with the security function of the terminal device UE makes it possible to detect tampering using MAC, thereby avoiding the problem of modification by a man-in-the-middle attacker.

[0051] This embodiment also has the advantage that the home network can confirm the need for a 128-bit MAC. Figure 5 shows the network slice instance selection procedure. This procedure is usually initiated by the first AMF as part of the registration procedure. The terminal device UE sends the requested NSSAI in both the RRC setup complete and the NAS registration request. The base station gNB uses this information for AMF selection and provisional processing before obtaining the allowed NSSAI.

[0052] The AMF obtains the slice permitted by the user's contract and, in cooperation with the Network Slice Selection Function (NSSF), selects an appropriate network slice instance based on the permitted S-NSSAI, PLMN ID (Public Land Mobile Network ID), etc. At this time, a change to another AMF may occur if necessary. For example, if the AMF determines that an AMF capable of supporting 128-bit MAC is required, the AMF can initiate a change to another AMF.

[0053] A registration request including a requested NSSAI and a network slicing ID is sent from the terminal device UE to the AMF (step S101). As shown in FIG. 5, the AMF sends a slice information request to the UDM to check the slices permitted by the contract (step S102). The UDM returns a slice information response indicating the slices permitted by the contract (step S103). This function can be used by a home network to control the use of a 128-bit tamper detection algorithm. For example, if a visited network charges an additional fee for using the 128-bit tamper detection algorithm, the home network can deny a roaming terminal device UE from using a 128-bit MAC slice. In addition, if an operator provides a 128-bit MAC for a fee, the AMF may direct the terminal device UE to a 32-bit MAC slice if the subscriber does not pay the fee.

[0054] Since a registration request from a terminal device UE can only include eight slices, if the terminal device UE acquires a 128-bit MAC slice or a 32-bit MAC slice and wants to gain access to five or more slices, it cannot transmit a request including that information. To solve this problem, the introduction of a virtual 128-bit MAC slice is being considered. If the terminal device UE wants to use 128-bit MAC security with the slice requested in the NSSAI, it can notify the network side by requesting this virtual slice. In other words, a terminal device UE requesting a 128-bit MAC indicates a "virtual 128-bit MAC slice" in addition to a normal slice. In this case, the slice table becomes as shown in Table 5. This allows the base station gNB to determine whether a 128-bit MAC is requested by simply checking one slice identifier. The AMF sends a slice selection request to the NSSF (step S104), and the NSSF sends a slice selection response to the received slice selection request to the AMF (step S105). After security processing and authentication processing are performed between the ASF and the terminal device UE (step S106), the AMF sends a registration accept message to the terminal device UE (step S107). The registration accept message includes, for example, information on the allowed NSSAI, the configured NSSAI, the network slicing ID, and the NSSAI inclusion mode.

[0055] Sixth Embodiment: Method for Notifying 128-bit MAC Support Status Using SIB (System Information Block) Two methods are proposed for notifying a terminal device UE that a RAN supports 128-bit MAC. The first method modifies the system information block (SIB) to add an indicator indicating whether each cell supports 128-bit MAC. The second method uses the PLMN ID, which is a value in the SIB, and a list of PLMNs that support 128-bit MAC to find a match. In either method, optimal cell selection is achieved by checking 128-bit MAC support in addition to other factors evaluated in conventional methods.

[0056] When selecting a cell, the terminal device UE acquires Master Information Block (MIB), SIB1, and SIB2. The MIB is used by the terminal device UE to find the associated SIB. The SIB is system information of the cell acquired by the terminal device UE when selecting a cell, and 24 types are defined (5G is SIB1 to SIB24), and SIB1 and SIB2 are used when selecting a cell. SIB1 is ultimately used for cell selection, cell access, and SI (System Information) scheduling.

[0057] SIB1 includes cell access-related information, i.e., cell selection information and scheduling information. This embodiment applies to SIB1. The cell access-related information includes a PLMN ID list, PLMN ID, TA code, cell ID, and cell status. The cell selection information includes a minimum reception level. The scheduling information includes SI message type and periodicity, SIB mapping information, and the SI window length required for the terminal device UE to identify other SIBs (SIBs 2 to 9 for LTE, or SIBs 2 to 24 for NR). It is assumed that "Operator-controlled PLMN Selector with Access Technology" is used for PLMN selection. This method is defined in TS 23.122 and is performed using information stored locally in the mobile equipment (ME) and the USIM. Furthermore, the PLMN ID consists of a Mobile Country Code (MCC) and a Mobile Network Code (MNC). Similarly, the IMSI consists of a PLMN ID and a subscriber identifier within the PLMN. The PLMN ID in the IMSI is called the Home PLMN ID or HPLMN ID.

[0058] The mobile device ME contains a list of "equivalent PLMNs" that are known to be equivalent to other PLMNs. This list is updated after each round of the location update procedure, routing area update procedure, GPRS (General Packet Radio Service) attach procedure, tracking area update procedure, EPS (Evolved Packet System) attach procedure, and registration procedure. Therefore, this list may be modified by the mobile network operator to which the terminal device UE is currently connected. This list allows the mobile device ME to identify and connect to equivalent PLMN IDs. This information is also used to identify cells with stronger reception and to identify the same PLMN in other wireless communications such as GSM, UMTS, LTE, and NR. Furthermore, the USIM may contain a list of "equivalent home PLMNs." This list is used to identify PLMNs that the mobile device ME can access and that can be treated similarly to the home PLMN ID. The mobile device ME selects the home PLMN in preference to other PLMN IDs. The mobile equipment ME will use this file whenever it is available, and will treat the order of the PLMN IDs listed as a priority.

[0059] The USIM file may also specify a combination of PLMN ID and radio access technology, which is used by the operator to specify which PLMN ID and radio access combination should be preferred by the mobile equipment ME. TS 23.122 defines the automatic network selection mode procedure as shown in Table 6.

[0060] In this embodiment, a new priority is added based on whether a cell or network supports 128-bit MAC. Cell selection is typically divided into two steps (steps S210 and S211) as shown in FIG. 6: 1) PLMN ID selection; and 2) selection of the cell with the strongest reception strength within that PLMN ID. 1. In FIG. 7, the terminal device UE collects all SIBs of base stations gNBs that can be received. Similar collection is also possible for radio accesses that can be received (gNB for NR, eNB for LTE, NodeB for UMTS, etc.). After receiving the SIBs, the terminal device UE performs the following comparisons for each SIB: ・Whether the PLMN ID corresponds to the PLMN ID of its own IMSI. ・If not, whether the PLMN ID is an "equivalent home PLMN ID." ・Whether it is included in the list of allowed PLMN IDs.

[0061] 2. Depending on the PLMN ID indicated in the SIB, the terminal device UE assigns priorities to these base stations gNB. The highest priority is given to those corresponding to the LPMN with a contract or an equivalent HLPMN, and the terminal device UE compares the signal strength and assigns priorities according to the signal strength. The results of the priority assignment are shown in Table 7 and Figure 8. Here, assume that operator 1 is the home PLMN. The terminal device UE sorts the received SIBs 1) according to an ordered list of preferred PLMN IDs retrieved from the terminal device UE storage, and 2) within the same PLMN ID, according to signal strength.

[0062] 3. According to instructions received from different base stations gNB, the terminal device UE sends an attach request to the cell with the strongest signal strength. In the example of Table 7, based on the signal strength, as shown in FIG. 9, the terminal device UE selects to attach to cell 2 of operator 1 and sends an attach request.

[0063] In this embodiment, an extended SIB1 is applied, and information provided to the terminal device UE is added to the conventional network selection mode. This allows the terminal device UE to select whether the base station gNB supports 32-bit MAC or 128-bit MAC. A new item (1-bit flag) is added to SIB1 to indicate whether the base station gNB supports a 128-bit tamper detection algorithm. It is also possible to add an item indicating the maximum length supported by the base station gNB (for example, 1: 32 bits, 2: 64 bits, 3: 128 bits). Alternatively, each bit can indicate the supported algorithm or algorithm strength, and the corresponding bit can be set to 1 to indicate the algorithm supported by the base station gNB. In either method, by extending SIB1, the supported MAC length can be notified to the terminal device UE.

[0064] The following is an example in which the terminal device UE of this embodiment preferentially selects a base station gNB that supports 128-bit MAC. 1. The terminal device UE collects receivable SIBs from the base station gNB. Receivable radio access (gNB for NR, eNB for LTE, NodeB for UMTS, etc.) can also be collected in the same way. After receiving the SIB, the terminal device UE performs the following comparisons for each SIB: ・Whether the PLMN ID corresponds to the PLMN ID of its own IMSI ・If not, whether the PLMN ID is an "equivalent home PLMN ID" ・Whether it is included in the list of allowed PLMN IDs When checking the PLMN ID, it also checks whether the corresponding base station supports 128-bit MAC. This indicates priority to each base station.

[0065] 2. Based on the support status of 128-bit MAC indicated in the SIB, the terminal device UE deletes all cells that do not support 128-bit MAC. Next, it assigns a priority to the base station gNB of the contracted carrier and compares the signal strength for each received SIB. An example of the result is shown in Table 8.

[0066] Although Table 8 shows only 128-bit MAC, any MAC length can be supported. The terminal device UE sorts the received SIBs according to 1) the order of preferred PLMN IDs retrieved from the terminal device UE's internal storage, 2) signal strength, and 3) whether or not the 128-bit MAC is supported. In Table 8, Cell 1 of Operator 1 is set to priority 1. Next, cells that do not support 128-bit MAC are removed. Cell 2 of Operator 2 in row 4 may have a different PLMN ID than the terminal device UE because its PLMN ID is from a different operator, but it may have the same PLMN ID subset or may not be a prohibited PLMN ID. Because it supports 128-bit MAC, it remains an available base station and is prioritized over base stations that do not support 128-bit MAC. Figure 10 shows Cell 1 of Operator 1 with priority 1.

[0067] This embodiment is effective for operators who gradually update their base stations gNBs. This eliminates the need to upgrade all base stations gNBs, allowing 128-bit MAC-compatible base stations gNBs to be deployed throughout the country, which is more efficient. In addition, the terminal device UE can search for a base station gNB that supports 128-bit MAC and connect to a network that supports the security functions supported by the terminal device UE. Since the base station gNB is expected to continue to support the 32-bit tamper detection algorithm, legacy terminal devices UE or terminal devices UE that do not support 128-bit MAC can continue to be used, and there is no adverse effect from this embodiment.

[0068] In this embodiment, the terminal device UE is notified of its support for 128-bit MAC by changing the cell selection method. However, as an alternative, this can be achieved by adding a PLMN ID that supports 128-bit MAC, independent of other PLMN IDs. This allows the terminal device UE to search only for PLMN IDs that support 128-bit MAC as needed. If a receivable PLMN ID is not found, the terminal device UE selects a PLMN ID according to the prioritization criteria defined in TS 23.122. The operator creates a list of PLMN IDs that support 128-bit MAC in a file on the subscriber's Universal Subscriber Identity Module (USIM). Specifically, with the transition to 128-bit MAC, the operator uses a PLMN ID list to notify each base station that it supports 128-bit MAC. The terminal device UE uses this list to prioritize PLMN IDs.

[0069] The list of Home PLMN IDs or equivalent Home PLMN IDs will be called "File 1". A new file (hereinafter referred to as "File 2") containing a list of PLMN IDs corresponding to the 128-bit MAC is created. This File 2 is provisioned on the USIM by the contracted operator and is updated periodically. When performing cell selection, the terminal device UE performs the following steps:

[0070] 1. The terminal device UE reads File 1 and File 2 from the USIM. 2. The terminal device UE receives the SIB broadcast and creates a list of "available PLMN IDs." 3. The terminal device UE selects "available PLMN IDs" from the list of home PLMN IDs or equivalent home PLMN IDs (File 1), as defined in the prior art. 4. The terminal device UE checks whether each PLMN ID in the available PLMN ID list is included in the 128-bit MAC-compatible PLMN ID list (File 2). 5. The terminal device UE prioritizes PLMN IDs in the "available PLMN ID" list depending on whether the PLMN IDs support 128-bit MAC. 6. After creating the prioritized PLMN ID list, the terminal device UE selects a cell to connect to based on the highest-priority PLMN ID and the cell's signal strength. Figure 11 shows the flow of operations. Figure 11 shows a schematic diagram of priority assignment in the sixth embodiment of the present disclosure.

[0071] The following example shows how this method works: (1) The terminal device UE receives a list of PLMN IDs from the base station gNB and creates a list of available PLMN IDs. Assume that the created list of available PLMN IDs is as follows: 1.440 15 2.440 16 3.440 27 4.440 29 5.440 43 6.440 48 7.440 49 8.440 51 9.440 52 10.440 79 In this example, it is assumed that the home PLMN ID of the terminal device UE is 440 43 and the equivalent home PLMN IDs are 440 15, 440 16, 440 43, 440 48, 440 49, 440 51, and 440 52. For convenience, this list is arranged in MNC (Mobile Network Code) order, but this need not be the case in an actual implementation.

[0072] (2) In step 2, the terminal device UE filters the "available PLMN ID" list based on whether it is a home PLMN ID or not, based on the input of file 1 (step S301). If the home PLMN ID is present in the list (YES in S301), the terminal device UE proceeds to step (2-a). (2-a) The terminal device UE uses file 2, which is a list of PLMN IDs that support 128-bit MAC, and if the found home PLMN ID (440 43) supports 128-bit MAC (YES in S302), assigns priority 1 to this PLMN ID. File 2 indicating that the home PLMN supports 128-bit MAC is as follows: 1. 440 43 2. 440 48 3. 440 49 4. 440 51 PLMN ID 440 43 is assigned priority 1 and written to a file or a list in memory. If the home PLMN is not found in file 2 (NO in S302), assign priority 3 to the file in the same list / memory.

[0073] (3) In the next step 3, the terminal apparatus UE returns to the list of available PLMN IDs and selects PLMN IDs included in the equivalent home PLMN ID list available in file 1 (step S303). In this example, the selection results are 440 15, 440 16, 440 43, 440 48, 440 49, 440 51, and 440 52. For each PLMN ID included in the "available PLMN IDs" and file 1 (YES in S303), the terminal apparatus UE executes step (3-a).

[0074] (3-a) The terminal device UE uses file 2 in the same way as in step 2 to check whether the PLMN ID supports 128-bit MAC (step S304). If it supports 128-bit MAC (YES in S304), priority 2 is assigned, and the PLMN ID is written to memory together with the priority. For example, priority 2 is assigned to the following PLMN IDs: 440 48 440 49 440 51 If the PLMN ID is not listed in file 2 (NO in S304), priority 4 is assigned. For example, priority 4 is assigned to the following PLMN IDs: 440 15 440 16 440 51

[0075] (4) If the terminal device UE does not find the home PLMN ID or any PLMN ID included in the equivalent home PLMN ID list (NO in S303), the terminal device UE selects a PLMN ID from the "Available PLMN IDs". In the prior art, the terminal device UE checks whether there is an "Operator Controlled PLMN Selector with Access Technology" file on the SIM card and checks whether each PLMN ID is included in that file.

[0076] The terminal device UE assigns a priority to each PLMN ID using the same logic as (2-a) and (3-a), that is, assigning a priority of 5 to a PLMN ID listed in the 128-bit MAC compatible PLMN ID list and a priority of 6 to a PLMN ID not listed in the list. However, this logic is applied only when the terminal device UE finds a PLMN ID included in the "Operator Controlled PLMN Selector with Access Technology" file.

[0077] If no home PLMN ID is found in step 3, the terminal device UE may have multiple PLMN IDs with priority 3 or 4. For example, the terminal device UE may find four PLMN IDs with priority 3 and three PLMN IDs with priority 4. In this case, the terminal device UE can determine the PLMN to connect to using the same logic as a terminal device UE that does not support 128-bit MAC. Since the order of PLMN IDs in the equivalent home PLMN ID list (file 1) indicates the priority, the terminal device UE attempts to connect to the PLMN listed in file 1 with the highest priority of priority 3, and if unsuccessful, moves on to the next PLMN.

[0078] A similar logic can be applied in step 4, where for a list of PLMN IDs with priority 5, the terminal device UE first tries to connect to the PLMN with the highest priority in the "Operator Controlled PLMN Selector with Access Technology" file, or if not included in the list, the terminal device UE randomly selects one and tries to connect to it.

[0079] The advantage of this approach is that an operator can provision the USIM with an "Operator Controlled PLMN Selector with Access Technology" and an "equivalent home PLMN" list that are optimal for terminal equipment UEs that do not support 128-bit MAC. By adding a PLMN ID file that supports 128-bit MAC, an operator can change the priority for the terminal equipment UE to select a PLMN ID. For example, suppose an operator configures an equivalent home PLMN ID list as shown in Table 9. Table 10 shows PLMN IDs compatible with 128-bit MAC, with the display order indicating the priority.

[0080] In this case, a terminal device UE that does not support 128-bit MAC attempts to connect to PLMN IDs in the order of the equivalent home PLMN ID list, and a terminal device UE that supports 128-bit MAC prioritizes PLMN IDs as shown in Table 11.

[0081] In Table 11, PLMN IDs that support 128-bit MAC (43, 48, 49, 51) are assigned priority 3 and are listed in the order of their appearance in the equivalent home PLMN list, while PLMN IDs that only support 32-bit MAC are assigned priority 4 and are also listed in the order of their appearance in the equivalent home PLMN list (52, 15, 16). The same logic applies in roaming scenarios, where an "Operator Controlled list with Access Technologies" is used instead of the equivalent home PLMN ID list. There is no change to the 128-bit MAC capable PLMN IDs.

[0082] Finally, it is possible that no base station supporting 128-bit MAC can be found, such as in the case of Table 12. Table 11 uses 128-bit MAC as an example, but is applicable to any MAC length. In the case of Table 12, fallback occurs, and the priority is updated according to the order of prioritized PLMN IDs retrieved from the storage in the terminal device UE, and then updated according to signal strength. Also, if an operator adds a base station that supports 128-bit MAC but does not assign an independent PLMN ID (when a single PLMN ID contains a mixture of base stations (gNBs) that support 32-bit MAC and 128-bit MAC), it becomes difficult to distinguish between them. Even in such cases, this can be addressed by extending the SIB (e-SIB) and adding a PLMN ID file that supports 128-bit MAC, and can be applied according to the operator's deployment plan.

[0083] In the case of roaming, the terminal device UE has a list of forbidden PLMN IDs, and the terminal device UE records the PLMN ID when a connection attempt is rejected. In this case, the target PLMN ID is added to the "forbidden PLMN ID" list. Similarly, in a roaming scenario, the terminal device UE can record which PLMN IDs are 128-bit MAC compatible and stores these PLMN IDs in its memory as a "128-bit MAC compatible PLMN ID" list. The terminal device UE erases this list at appropriate times, such as after a certain period of time has elapsed, after being powered off, or after reconnecting to the home PLMN.

[0084] [Seventh embodiment] Selection by terminal apparatus UE During the security activation process of the terminal apparatus UE, the base station gNB transmits an AS Security Mode Command indicating the security algorithm used between the terminal apparatus UE and the base station gNB. When the terminal apparatus UE receives the Security Mode Command message, it verifies the MAC-I. If the verification is successful, the terminal apparatus UE decrypts the message.

[0085] The terminal device UE checks whether the algorithm indicated in the SMC (Security Mode Command) is a 128-bit tamper detection algorithm. If the terminal device UE supports the 128-bit tamper detection algorithm but the algorithm indicated in the SMC is a 32-bit MAC, the terminal device UE rejects the AS SMC and restarts the process. The terminal device UE notifies the base station gNB of the reason for the rejection by transmitting an error code indicating "algorithm mismatch" or "128-bit tamper detection algorithm required." After receiving the error code, if the base station gNB can select the 128-bit tamper detection algorithm, it transmits a new AS SMC message.

[0086] In the first and second embodiments, it has been described that the terminal device UE may receive a notification indicating that the RAN supports a 128-bit tamper detection algorithm. Even if the terminal device UE receives a notification indicating that the RAN supports a 128-bit tamper detection algorithm, if the AS SMC specifies a 32-bit tamper detection algorithm, it is desirable for the terminal device UE to reject the AS SMC. In this case, the terminal device UE has been notified by the ABBA parameter that the network device supports a 128-bit tamper detection algorithm, and a mismatch occurs with the 32-bit tamper detection algorithm selected by the RAN.

[0087] Another case in which the terminal device UE rejects AS SMC is when a 128-bit tamper detection algorithm is specified in the NAS SMC, but the base station gNB selects a 32-bit tamper detection algorithm. If there is a difference in the security level of the tamper detection algorithm, the terminal device UE rejects AS SMC due to a "128-bit compatible tamper detection algorithm selection error". Then, AS SMC is performed again.

[0088] As in the first embodiment, the base station gNB can indicate to the terminal device UE that there is a mismatch in support for the 128-bit tamper detection algorithm between the terminal device UE and the base station gNB. The base station gNB executes the following method 5.

[0089] (Method 5) By adding a new field to the AS Security Mode Command to indicate a "128-bit compatible tamper detection algorithm selection error," the base station gNB notifies the terminal device UE that there is no 128-bit tamper detection algorithm supported by both the base station gNB and the terminal device UE. If the bit in this field is set, the terminal device UE accepts the 32-bit tamper detection algorithm selected by the base station gNB.

[0090] Alternatively, the terminal device UE may resend the attach request, and the network NW may re-perform authentication and key agreement, in which case new NAS SMC and AS SMC are generated. It may also be possible to send an attach request to a specific PLMN ID to check whether the target PLMN ID supports the required algorithm. Furthermore, it may be possible to keep a list of PLMN IDs that do not support the 128-bit tamper detection algorithm as a file and lower the priority of those PLMN IDs.

[0091] Eighth Embodiment: Independent Selection of Tamper Detection Algorithm and MAC Length In the prior art, the terminal device UE and the network NW select the tamper detection algorithm to be used for AS and NAS security through negotiation. Since the available algorithm options (i.e., NIA1, NIA2, NIA3) all generate a 32-bit MAC, the selection of the tamper detection algorithm also determines the MAC length to be used.

[0092] Figure 12 shows the negotiation of the tamper detection algorithm and the MAC length. The left side of Figure 12 shows the negotiation when the integrity protection algorithm and the MAC length are combined, while the right side shows the negotiation when the integrity protection algorithm and the MAC length are separated. As shown on the right side of Figure 12, if the tamper detection algorithm can generate MACs of different lengths, it becomes possible to select the algorithm to be used and the MAC length. In the following, it is assumed that the tamper detection algorithm can support multiple MAC lengths based on input parameters.

[0093] The terminal apparatus UE indicates the supported MAC length in addition to the supported tamper detection algorithm. The terminal apparatus UE uses the Initial NAS message to transmit UE security capabilities to the AMF and notify the supported encryption algorithm. At this time, as shown in Table 13, a 4-bit MACL (MAC length) parameter is included. By setting the MAC parameter to a value other than 0000, the terminal apparatus UE indicates to the AMF that it supports a MAC longer than 32 bits.

[0094] Table 13 shows the cases where the MAC length is 32 bits, 64 bits, 96 bits, and 128 bits, and other parameters are reserved for extension. Therefore, MACs longer than 128 bits can be supported according to future needs. The AMF determines the NAS SMC according to the received UE security capabilities. If the MAC parameter is not received or the received parameter value is 0000, the NAS SMC procedure is performed as in the prior art. If the AMF receives a MAC value other than 0000, that is, if the terminal device UE supports MACs longer than 32 bits, the NAS SMC procedure is performed as follows.

[0095] In step S21 of Figure 3, the AMF creates a Security Mode Command message containing the following information: UE security capabilities (including supported algorithms and MAC length) Tamper detection and encryption algorithms selected by the AMF for NAS protection MAC length selected by the AMF (shall be encoded in the same way as the MACL parameter, e.g., using 0001 for a 64-bit MAC) Other (may not be included) ABBA parameters ngKSI in the NAS message

[0096] The NAS SMC message is protected according to the selected tamper detection algorithm and MAC length. For example, if both the UE and the AMF support 64-bit MAC, the NAS SMC message is also protected with 64-bit MAC. The base station gNB receives the message and forwards the NAS message in the message of step S24. In step S25, the terminal device UE verifies the message. In particular, the terminal device UE detects tampering of the message and verifies that the UE security functions have not been tampered with. If the verification is successful, the UE sends a Security Mode Complete message (steps S26 and S27) to the AMF via the gNB.

[0097] This disclosure enables the terminal device UE and the network NW to share support for longer message authentication codes, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "Develop resilient infrastructure, promote sustainable industrialization and foster innovation."

[0098] According to the present disclosure, a network device notifies a terminal device of the number of bits of a message authentication code that the network device supports, which allows, for example, negotiation between the network device and the terminal device regarding the length of the message authentication code to be used.

[0099] 210 Selecting a PLMN ID 220 Selecting a cell within the selected PLMN ID< / guami> < / mnc> < / mcc> < / guami> < / mnc> < / mcc> < / guami> < / guami>

Claims

1. A network device that includes data indicating how many bits of a message authentication code the network device supports in a message sent from the network device to a terminal device and transmits the data to the terminal device.

2. The network device according to claim 1, wherein an ABBA (Anti-Bidding down Between Architectures) parameter in the message transmitted from the network device to the terminal device includes data indicating how many bits of the message authentication code the network device supports.

3. The network device according to claim 2, wherein the ABBA parameters also specify an algorithm for the message authentication code.

4. A terminal device that receives a message sent from a network device, the message including data indicating how many bits of a message authentication code the network device supports, and notifies the network device of the security capabilities of the terminal device using a tamper detection algorithm different from the tamper detection algorithm selected by the network device.

5. A terminal device that includes data indicating how many bits of a message authentication code the previously connected AMF (Access and Mobility Management Function) supports in the GUTI (Globally Unique Temporary UE Identity) in an initial connection message sent to a network device.

6. A terminal device that includes data indicating how many bits of a message authentication code the terminal device requests to use in network slice selection assistance information (NSSAI) in a message sent to a base station.

7. The network device according to claim 1, wherein data indicating how many bits of a message authentication code the network device supports is included in a system information block (SIB) in a message transmitted from the network device to a terminal device.

8. A terminal device that rejects an access stratum security mode command when the MAC length of a tamper detection algorithm that it supports does not match the MAC length of the tamper detection algorithm presented in the access stratum security mode command (AS Security Mode Command) message received from a base station.

9. A terminal device that, when presenting its security functions to an AMF (Access and Mobility Management Function), separately presents the tamper detection algorithm it supports and the length of the MAC (Message Authentication Code) it supports.

10. A terminal device that receives a message transmitted from the network device described in claim 7, which ranks the received multiple system information blocks SIB according to whether or not they support a 128-bit MAC (Message Authentication Code), and selects a network node to connect to based on received signal strength and tamper detection strength.

Images