Method and apparatus for managing security keys during layer1 / layer2 triggered mobility (LTM) in a wireless communication system

Abstract

The disclosure relates to a 5G or 6G communication system for supporting a higher data transmission rate. Embodiments herein provide a method and network apparatuses for managing security keys during LTM in a wireless communication system. The method includes determining by a first network apparatus (301) to execute the LTM to the candidate target cell based on L1 measurement results received from the UE (101). The method includes sending by the first network apparatus (301) the cell switch command to the UE through the MAC CE to indicate the UE (101) to perform horizontal key derivation. The cell switch command includes the NCC value. The method includes generating by the first network apparatus the NG-RAN key from the plurality of key parameters. The method includes sending by the first network apparatus the cell switch notification message to the second network apparatus operating as the target base station through the XnAP signaling. The cell switch notification message includes the NG-RAN key generated by the first network apparatus (301).

Description

METHOD AND APPARATUS FOR MANAGING SECURITY KEYS DURING LAYER1 / LAYER2 TRIGGERED MOBILITY (LTM) IN A WIRELESS COMMUNICATION SYSTEM

[0001] The proposed embodiments relate to a wireless communication, more particularly, to managing security keys during Layer1 / Layer2 Triggered Mobility (LTM) in a wireless communication system.

[0002] 5G mobile communication technologies define broad frequency bands such that high transmission rates and new services are possible, and can be implemented not only in "Sub 6GHz" bands such as 3.5GHz, but also in "Above 6GHz" bands referred to as mmWave including 28GHz and 39GHz. In addition, it has been considered to implement 6G mobile communication technologies (referred to as Beyond 5G systems) in terahertz bands (for example, 95GHz to 3THz bands) in order to accomplish transmission rates fifty times faster than 5G mobile communication technologies and ultra-low latencies one-tenth of 5G mobile communication technologies.

[0003] At the beginning of the development of 5G mobile communication technologies, in order to support services and to satisfy performance requirements in connection with enhanced Mobile BroadBand (eMBB), Ultra Reliable Low Latency Communications (URLLC), and massive Machine-Type Communications (mMTC), there has been ongoing standardization regarding beamforming and massive MIMO for mitigating radio-wave path loss and increasing radio-wave transmission distances in mmWave, supporting numerologies (for example, operating multiple subcarrier spacings) for efficiently utilizing mmWave resources and dynamic operation of slot formats, initial access technologies for supporting multi-beam transmission and broadbands, definition and operation of BWP (BandWidth Part), new channel coding methods such as a LDPC (Low Density Parity Check) code for large amount of data transmission and a polar code for highly reliable transmission of control information, L2 pre-processing, and network slicing for providing a dedicated network specialized to a specific service.

[0004] Currently, there are ongoing discussions regarding improvement and performance enhancement of initial 5G mobile communication technologies in view of services to be supported by 5G mobile communication technologies, and there has been physical layer standardization regarding technologies such as V2X (Vehicle-to-everything) for aiding driving determination by autonomous vehicles based on information regarding positions and states of vehicles transmitted by the vehicles and for enhancing user convenience, NR-U (New Radio Unlicensed) aimed at system operations conforming to various regulation-related requirements in unlicensed bands, NR UE Power Saving, Non-Terrestrial Network (NTN) which is UE-satellite direct communication for providing coverage in an area in which communication with terrestrial networks is unavailable, and positioning.

[0005] Moreover, there has been ongoing standardization in air interface architecture / protocol regarding technologies such as Industrial Internet of Things (IIoT) for supporting new services through interworking and convergence with other industries, IAB (Integrated Access and Backhaul) for providing a node for network service area expansion by supporting a wireless backhaul link and an access link in an integrated manner, mobility enhancement including conditional handover and DAPS (Dual Active Protocol Stack) handover, and two-step random access for simplifying random access procedures (2-step RACH for NR). There also has been ongoing standardization in system architecture / service regarding a 5G baseline architecture (for example, service based architecture or service based interface) for combining Network Functions Virtualization (NFV) and Software-Defined Networking (SDN) technologies, and Mobile Edge Computing (MEC) for receiving services based on UE positions.

[0006] As 5G mobile communication systems are commercialized, connected devices that have been exponentially increasing will be connected to communication networks, and it is accordingly expected that enhanced functions and performances of 5G mobile communication systems and integrated operations of connected devices will be necessary. To this end, new research is scheduled in connection with eXtended Reality (XR) for efficiently supporting AR (Augmented Reality), VR (Virtual Reality), MR (Mixed Reality) and the like, 5G performance improvement and complexity reduction by utilizing Artificial Intelligence (AI) and Machine Learning (ML), AI service support, metaverse service support, and drone communication.

[0007] Furthermore, such development of 5G mobile communication systems will serve as a basis for developing not only new waveforms for providing coverage in terahertz bands of 6G mobile communication technologies, multi-antenna transmission technologies such as Full Dimensional MIMO (FD-MIMO), array antennas and large-scale antennas, metamaterial-based lenses and antennas for improving coverage of terahertz band signals, high-dimensional space multiplexing technology using OAM (Orbital Angular Momentum), and RIS (Reconfigurable Intelligent Surface), but also full-duplex technology for increasing frequency efficiency of 6G mobile communication technologies and improving system networks, AI-based communication technology for implementing system optimization by utilizing satellites and AI (Artificial Intelligence) from the design stage and internalizing end-to-end AI support functions, and next-generation distributed computing technology for implementing services at levels of complexity exceeding the limit of UE operation capability by utilizing ultra-high-performance communication and computing resources.

[0008] In modern cellular networks, secure handover procedures maintains seamless connectivity and minimizing latency during cell switching operations. Layer 1 / Layer 2 Triggered Mobility (LTM) represents an advancement in cellular handover procedures designed to achieve these goals. In the standard LTM procedure, a gNodeB (gNB) receives Layer 1 (L1) measurement reports from a User Equipment (UE) and uses these reports to initiate a cell switch via Medium Access Control - Control Element (MAC CE) signaling. This cell switch command references a previously prepared LTM candidate configuration provided to the UE through Radio Resource Control (RRC) signaling.

[0009] The existing LTM process involves repeating early synchronization, cell switch execution, and cell switch completion steps without releasing other candidate configurations after each switch. However, this established mechanism faces significant challenges when extended to an Inter-Central Unit (Inter-CU) scenario, which are currently under discussion in 3GPP Release 19.

[0010] A difference between intra-CU and inter-CU LTM implementations is the handling of security key updates and distribution. According to 3GPP Technical Specification (TS) 33501, handover key chaining follows specific protocols with three primary mechanisms for key generation during mobility: horizontal key derivation (when NG RAN is derived from the currently active KgNB), vertical key derivation (when NG RAN is derived from the NH parameter), and new initial KgNB generation (when KAMF changes).

[0011] An established Layer 3 (L3) based handover approach transmits a Handover Command message from the gNB to the UE using RRC signaling, benefiting from existing AS security protection mechanisms. In contrast, LTM transmits a Cell switch command via Layer 1 / Layer 2 (L1 / L2) signaling through the MAC CE, which lacks equivalent security protection. This security gap creates a vulnerability where security parameters, such as the Next Hop Chaining Counter (NCC), included in the cell switch command can be modified or replayed by malicious actors. Such interference is likely to result in security key mismatches between network elements, ultimately causing handover failures.

[0012] Additionally, the mechanism for distributing security keys to candidate target gNBs in inter-CU LTM scenarios remains unaddressed in current specifications. The existing key management mechanisms defined for L3-based handovers are not directly applicable to L1 / L2 triggered mobility scenarios like inter-CU LTM. Consequently, there is a need to address these disadvantages, issues, and shortcomings, or at least provide a useful alternative.

[0013] One specific challenge in the LTM cell switching is the lack of security context information within the LTM Cell Switch Command. Since this command is delivered via L1 / L2 signaling without the AS-level security protection, it does not carry essential parameters such as the NCC or a Key Set Change Indicator. As a result, the UE cannot determine whether to derive the new security key from the currently active KgNB (horizontal key derivation) or from a fresh and unused NH parameter (vertical key derivation). This uncertainty can lead to mismatched key derivation between the UE and the gNB, causing security context desynchronization. Thus, it is desired to address the above-mentioned disadvantages, issues, or other shortcomings or at least provide a useful alternative.

[0014] Embodiments of the present disclosure is to provide an apparatus and method for effectively providing a service in a wireless communication system.

[0015] In an embodiment, a method performed by a first network apparatus in a wireless communication system is provided. The method includes: receiving, from a terminal, a layer 1 (L1) measurement result; deciding to execute a layer1 / layer2 triggered mobility (LTM) to a second network apparatus; generating a next generation radio access network (NG-RAN) key based on a plurality of key parameters; and sending, to the terminal, via medium access control (MAC) control element (CE), a cell switch command that includes the NCC value associated with the NG-RAN key.

[0016] In an embodiment, a method performed by a terminal in a wireless communication system is provided. The method includes: sending, to a first network apparatus, a layer 1 (L1) measurement result; receiving, from the first network apparatus, via medium access control (MAC) control element (CE), a cell switch command that includes a next hop chaining counter (NCC) value; and generating a next generation radio access network (NG-RAN) key based on the NCC value.

[0017] In an embodiment, a first network apparatus in a wireless communication system is provided. The base station includes at least one transceiver; at least one processor communicatively coupled to the at least one transceiver; and at least one memory, communicatively coupled to the at least one processor, storing instructions executable by the at least one processor individually or in any combination to cause the first network apparatus to receive, from a terminal, a layer 1 (L1) measurement result, decide to execute a layer1 / layer2 triggered mobility (LTM) to a second network apparatus, generate a next generation radio access network (NG-RAN) key based on a plurality of key parameters, and send, to the terminal, via medium access control (MAC) control element (CE), a cell switch command that includes the NCC value associated with the NG-RAN key.

[0018] In an embodiment, a terminal in a wireless communication system is provided. The base station includes at least one transceiver; at least one processor communicatively coupled to the at least one transceiver; and at least one memory, communicatively coupled to the at least one processor, storing instructions executable by the at least one processor individually or in any combination to cause the terminal to send, to a first network apparatus, a layer 1 (L1) measurement result, receive, from the first network apparatus, via medium access control (MAC) control element (CE), a cell switch command that includes a next hop chaining counter (NCC) value, and generate a next generation radio access network (NG-RAN) key based on the NCC value.

[0019] In an aspect, the objectives are achieved by providing a method for managing security keys during LTM in the wireless communication system. The method includes determining by a first network apparatus to execute the LTM to a candidate target cell based on Layer 1 measurement results received from the UE during LTM preparation phase. Further the method includes generating by the first network apparatus a new NG-RAN key from a plurality of key parameters and a Next Hop Chaining Counter (NCC) value. The cell switch command includes the NCC value. Further the method includes generating by the first network apparatus a NG-RAN key from a plurality of key parameter. Further the method includes sending by the first network apparatus, a LTM configuration(s) to a second network apparatus operating as a target base station via an XnAP signaling, wherein the LTM configuration(s) includes the NG-RAN key and the used NCC value generated by the first network apparatus. Further, the method includes sending by the first network apparatus, a cell switch command to the UE through Medium Access Control Control Element (MAC CE) to indicate the UE to perform key derivation, wherein the cell switch command includes the Next hop Chaining Counter (NCC) value utilized for the derivation of NG-RAN key during LTM execution phase.

[0020] In an embodiment, the method includes a plurality of key parameters includes a target Physical Cell Identifier (PCI), a Downlink Absolute Radio Frequency Channel Number (ARFCN-DL), an E-UTRA ARFCN-DL (EARFCN-DL) of the target cell, and a currently active KgNB in case of the horizontal key derivation, an unused Next Hop (NH) in the case of a vertical key derivation.

[0021] In an embodiment, the method includes determining, by the first network apparatus, to update the candidate target cell based with the new NG-RAN key.

[0022] In an embodiment, the method includes the cell switch command further includes at least one of a Physical Cell Identifier (PCI) of the target cell, the ARFCN-DL and configuration parameters of the candidate target cell.

[0023] In an embodiment, the method includes incorporating the NCC value within the Cell Switch Command. Additionally, the NCC value is used by the UE to derive a consequent NG-RAN security key when transitioning to another candidate second network apparatus or when reverting to the same cell.

[0024] In an embodiment, the method includes forwarding by the first network apparatus, a NG-RAN key, NCC pair to the second network apparatus in at least one of the LTM configuration update message, cell switch notification message or a new XnAP signaling message.

[0025] In another aspect, the objectives are achieved by providing a method for managing security keys during the LTM in the wireless communication system. The method includes receiving by the UE the cell switch command from the first network apparatus through the MAC CE. The command includes the NCC value. The method includes generating by the UE the NG-RAN security key based on the NCC value and utilizing the target PCI, the target ARFCN-DL or EARFCN-DL and the currently active KgNB key through horizontal key derivation. The method includes utilizing by the UE the generated NG-RAN security key to access the candidate second network apparatus.

[0026] In an embodiment, the method includes the UE to utilize the received NCC value to derive the consequent NG-RAN security key, even in scenarios where the current NCC value in use differs from the received NCC value.

[0027] In an embodiment, the method includes the UE using the received NCC value to first generate the NH key, which is then used to derive the NG-RAN security key.

[0028] In another aspect, the objectives are achieved by providing a method for managing security keys during the LTM in the wireless communication system. Further, the method includes receiving by the second network apparatus the cell switch notification message from the first network apparatus through the XnAP signaling. The message includes the NG-RAN security key and the NCC value. The method includes utilizing by the second network apparatus the received NG-RAN key directly as the KgNB key for communication with the UE. The method includes associating by the second network apparatus the NCC value with the KgNB key.

[0029] In another aspect, the objectives are achieved by providing the first network apparatus for managing security keys during the LTM in the wireless communication system. Further, the method includes a memory, a processor and a security key controller, coupled to the memory and the processor. The security controller determines whether to execute the LTM procedure to a candidate target cell based on the L1 measurement results received from the UE. The security controller generate a new NG-RAN key from a plurality of key parameters and a Next Hop Chaining Counter (NCC) value. The security controller send a LTM configuration(s) to a second network apparatus operating as a target base station via an XnAP signaling. The LTM configuration(s) includes the NG-RAN key and the used NCC value generated by the first network apparatus. The security controller sends send a cell switch command to the UE through Medium Access Control Control Element (MAC CE) to indicate the UE to perform key derivation, wherein the cell switch command includes the Next hop Chaining Counter (NCC) value utilized for the derivation of NG-RAN key during LTM execution phase.

[0030] In another aspect, the objectives are achieved by the UE for managing security keys during the LTM in the wireless communication system The UE includes the memory, the processor, and the security key controller coupled to the memory and the processor. The Security Key Controller is responsible for handling key management operations such as key derivation, synchronization, and secure key updates during LTM procedures. Further, the security controller receives the Cell Switch command from the first network apparatus through the MAC CE. The command includes the NCC value. The security controller generates the NG-RAN security key utilizing the target PCI, the target ARFCN-DL or EARFCN-DL and the currently active KgNB key through horizontal key derivation. The security controller utilizes the generated NG-RAN security key to access the candidate second network apparatus.

[0031] In another aspect, the objectives are achieved by the second network apparatus for managing security keys during the LTM in the wireless communication system. The second network apparatus includes the memory, the processor; and the security key controller, coupled to the memory and the processor. The security key controller receives the cell switch notification message from the first network apparatus through the XnAP signaling. The message includes the NG-RAN security key and the NCC value. The second network apparatus utilizes the received NG-RAN key directly as the KgNB key for communication with the UE. Further, the security Key Controller associates the NCCvalue with the KgNB key to enable tracking and management of security contexts during mobility procedures.

[0032] These and other aspects of the embodiments will be better understood with the following description and drawings. The descriptions, while indicating preferred embodiments and specific details, are for illustration and not limitation. Many changes and modifications can be made within the scope of these embodiments.

[0033] The principal object of the invention herein is to develop a method and network apparatuses for managing security keys during the LTM in the wireless communication system.

[0034] Yet another object of the invention is to provide a mechanism for early key derivation at the source gNB when the LTM handover trigger decision is made. This ensures that security-related processing begins immediately upon the mobility trigger.

[0035] Yet another object of the invention is to provide a procedure for secure key distribution between the source and the target gNBs (Central Units CUs) where the derived security key is transmitted only to the target CU during the LTM execution phase using a Cell Switch Notification message.

[0036] Yet another object of the invention is to update the NCC to the UE using the MAC CE in the Cell Switch Command.

[0037] Yet another object of the invention is for the MAC CE in the Cell Switch Command to be used to provide the updated NCC to the UE by the source gNB between subsequent LTM mobility procedures for security key handling.

[0038] Yet another object of the invention is to provide resolving desynchronization issues when performing the LTM cell switch.

[0039] The features, aspects, and advantages of the present embodiments are illustrated in the accompanying drawings, where like reference letters indicate corresponding parts across various figures. The embodiments will be better understood from the following description and drawings.

[0040] FIG. 1 is a sequence diagram that illustrates a signaling procedure for the LTM for the intra-CU according to prior art.

[0041] FIG. 2 is a schematic diagram that illustrates key chaining during handover according to the prior art.

[0042] FIG. 3A is a block diagram that illustrates a first network apparatus for managing security keys during LTM in the wireless communication system according to embodiments as disclosed herein.

[0043] FIG. 3B is a block diagram that illustrates the second network apparatus for managing security keys during LTM in the wireless communication system according to embodiments as disclosed herein.

[0044] FIG. 3C is a block diagram that illustrates the first network apparatus for managing security keys during LTM in the wireless communication system according to embodiments as disclosed herein.

[0045] FIG. 4A is a flowchart that illustrates a method for managing security keys during LTM by the first network apparatus in the wireless communication system according to embodiments as disclosed herein.

[0046] FIG. 4B is a flowchart that illustrates the method for managing security keys during LTM by the first network apparatus in the wireless communication system according to embodiments as disclosed herein.

[0047] FIG. 4C is a flowchart that illustrates the method for managing security keys during LTM by the second network apparatus in the wireless communication system according to embodiments as disclosed herein.

[0048] FIG. 4D is a flowchart that illustrates the method for managing security keys during LTM by the UE in the wireless communication system according to embodiments as disclosed herein.

[0049] FIG. 5 is a sequence diagram that illustrates the signaling procedure for the inter-gNB LTM scenario involving an Xn interface according to embodiments as disclosed herein.

[0050] FIG. 6A is a sequence diagram that illustrates an inter-gNB-CU LTM procedure between the UE and the plurality of gNBs in the wireless communication system according to embodiments as disclosed herein.

[0051] FIG. 6B is a sequence diagram that illustrates an inter-gNB-CU LTM procedure between the UE and the plurality of gNBs in the wireless communication system according to embodiments as disclosed herein.

[0052] FIG. 6C is a sequence diagram that illustrates an inter-gNB-CU LTM procedure between the UE and the plurality of gNBs in the wireless communication system according to embodiments as disclosed herein.

[0053] FIG. 7 is a sequence diagram that illustrates events during LTM cell switch.

[0054] The embodiments herein and the various features and advantageous details thereof are explained more fully with reference to the non-limiting embodiments that are illustrated in the accompanying drawings and detailed in the following description. Descriptions of well-known components and processing techniques are omitted so as to not unnecessarily obscure the embodiments herein. Also, the various embodiments described herein are not necessarily mutually exclusive, as some embodiments can be combined with one or more other embodiments to form new embodiments. The term "or" as used herein, refers to a non-exclusive or, unless otherwise indicated. The examples used herein are intended merely to facilitate an understanding of ways in which the embodiments herein can be practiced and to further enable those skilled in the art to practice the embodiments herein. Accordingly, the examples are not be construed as limiting the scope of the embodiments herein.

[0055] As is traditional in the field, embodiments are described and illustrated in terms of blocks that carry out a described function or functions.　These blocks, which referred to herein as managers, units, modules, hardware components or the like, are physically implemented by analog and / or digital circuits such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits and the like, and optionally be driven by firmware and software. The circuits, for example, be embodied in one or more semiconductor chips, or on substrate supports such as printed circuit boards and the like.　The circuits constituting a block be implemented by dedicated hardware, or by a processor (e.g., one or more programmed microprocessors and associated circuitry), or by a combination of dedicated hardware to perform some functions of the block and a processor to perform other functions of the block. Each block of the embodiments be physically separated into two or more interacting and discrete blocks without departing from the scope of the proposed method.　Likewise, the blocks of the embodiments be physically combined into more complex blocks without departing from the scope of the proposed method.

[0056] The accompanying drawings facilitate understanding of various technical features. The embodiments are not limited by these drawings and extend to any alterations, equivalents, and substitutes. Terms like first, second, etc., are used for distinction and do not limit the elements.

[0057] In an embodiment, the key distribution and synchronization in the LTM involves the use of the NCC value received in a HANDOVER REQUEST message. The NCC value indicates that a candidate gNB is to provide the NCC to the UE (101). Upon receiving the NCC, the UE (101) utilizes the corresponding NG-RAN key (also referred to NG-RAN security key and / or KNG-RAN*) and derives a following NH key based on the NCC, followed by derivation of the NG-RAN key. This process is performed when the UE (101) transitions to another candidate target gNB (306) (the target gNB is interchangeably referred to as the second network apparatus) or switches back to the same cell.

[0058] In another embodiment, the received NCC value also indicates the execution of a horizontal key derivation procedure, which is triggered when the target gNB (306) transitions to another candidate target gNB (306) and / or the UE reselects the original serving cell.

[0059] In an embodiment, the NCC value received in the Cell Switch command indicates to the UE (101) to utilize the associated NG-RAN key and / or to use the NCC value for deriving the following NH key, followed by derivation of the NG-RAN key when the UE (101) switches to another candidate target gNB (306) and / or switches back to the same cell. In one aspect, the source gNB transmits the NCC value in the Cell Switch command to instruct the UE (101) to perform horizontal key derivation.

[0060] In an embodiment, the candidate target gNB (306) stores the NCC value and the corresponding NG-RAN key temporarily until the UE (101) context release. In another embodiment, the candidate target gNB (306) stores the NCC value and corresponding NG-RAN key temporarily until a new primary authentication is triggered, i.e., KgNB is derived from NH parameter (204a-204c).

[0061] If the gNB (102) consists of a gNB Central Unit (gNB-CU) and one or more gNB Distributed Units (gNB-DU(s)), then the source gNB-CU (602) provides the NCC and / or a Next Generation Key Set Identifier (ngKSI) and / or other security-related parameters to the candidate gNB-DUs through a F1 interface and / or via XnAP signaling (if the candidate gNB-DU is connected to another gNB-CU and the source gNB-CU (602) and other gNB-CUs are connected via XnAP signaling) and the F1 interfaces.

[0062] In an embodiment, the received NCC and / or ngKSI and / or other security-related parameters from the gNB-CU are stored and / or handled along or as part of the LTM configuration of the UE (101).

[0063] In another embodiment, the gNB-DU includes the NCC and / or ngKSI and / or other security-related parameters in the cell switch command and provides it to the UE.

[0064] In an embodiment, the gNB-CU includes the generated NG-RAN key in the XnAP signaling (for example, in the CELL SWITCH NOTIFICATION message and / or a new XnAP message to the target gNB (306) through the XnAP signaling) and provides it to the target gNB-CU(s). On receiving the NG-RAN key, the gNB uses it to generate further keys for AS signaling protection (and also for UP protection if activated) between the gNB (102) and the UE (101).

[0065] In an embodiment, the gNB-CU never uses the unused NH for the LTM. Even if there is an unused NH value available in the source gNB (301) (the term source gNB is interchangeably mentioned as first network apparatus), the source gNB (301) shall derive NG-RAN key from the current KgNB (this is referred to as a horizontal key derivation) and not use the unused NH available (no vertical key derivation).

[0066] If an Access Stratum key (AS key) refresh and / or AS key rekeying is performed, then the gNB-CU (which is a candidate of the LTM configuration of the UE (101)) provides the new NCC value to the gNB-DU, and the gNB-DU rewrites the stored NCC value with the new NCC value in the LTM configuration and also provides the new NCC value to the other candidate gNB-CU(s) via an XnAP signaling message. Upon receiving the new NCC value via an XnAP signaling message, the gNB-CU provides the new NCC value to the gNB-DU, and the gNB-DU rewrites the stored NCC value in the LTM configuration.

[0067] In an embodiment, the gNB (gNB-DU) does not include the NCC value in the Cell switch command.

[0068] In the L3-based handover, the handover command message is transmitted from the gNB (102) to the UE (101) carried in the RRC signaling, which is protected using the AS security. For the LTM, the Cell switch command is transmitted from the gNB (102) to the UE (101) carried in the L1 / L2 signaling (i.e., MAC CE). Due to the lack of security protection for the L1 / L2 signaling, if the security parameter (e.g., NCC) is included in the Cell switch command carried in MAC CE, it can be modified or replayed by an attacker. Consequently, the security key mismatch occurs and further causes the handover failure. Further, the distribution of the AS key to the candidate target gNBs (306) needs to be addressed. To address the aforementioned security issue, there remains a need for methods for key synchronization in L1 / L2 handover scenarios.

[0069] FIG. 1 is the sequence diagram that illustrates the signaling procedure for the LTM for the intra-CU according to prior art.

[0070] At step S1, the UE (101) in the RRC_CONNECTED state sends a measurement report to the gNB (102).

[0071] Upon receiving the measurement report at step S2, the gNB (102) performs LTM candidate preparation and transmits an RRC reconfiguration message, including the LTM candidate configuration, to the UE (101).

[0072] In response, at step S3, the UE (101) sends an RRC reconfiguration complete message to the gNB (102), confirming receipt of the LTM candidate configuration.

[0073] An early synchronization phase initiates at step S4, which includes sub-steps S4a and S4b. During step S4a, the UE (101) performs DL synchronization with LTM candidate cells. At step S4b, the UE (101) performs UL synchronization with the LTM candidate cells.

[0074] Following synchronization at step S5, the UE (101) sends an L1 measurement report to the gNB (102).

[0075] Based on the L1 measurement report at step S6, the gNB (102) makes an LTM decision and sends an LTM Cell switch command through the MAC CE to the UE (101).

[0076] Upon receiving the cell switch command at step S7, the UE (101) detaches from the source cell, applies the target configuration, and performs a RACH procedure with the target cell.

[0077] Once the RACH procedure is completed at step S8, the LTM cell switch completion is confirmed between the UE (101) and the gNB (102).

[0078] FIG. 2 is a schematic diagram illustrating the key chaining during handover according to the prior art. The figure represents the hierarchical relationship between different security keys used during the handover process. The key chaining mechanism includes horizontal key derivation, where NG RAN is derived from the currently active KgNB (203a-203i), and vertical key derivation, where NG RAN is derived from the NH parameter (204a-204c). Additionally, the key chaining illustrates the scenario where a new initial KgNB (203a-203i) is used when KAMF (201) is changed.

[0079] The existing system for key synchronization in cellular networks is not well-suited for LTM, particularly in inter-CU scenarios. Existing signaling methods, such as those relying on L1 / L2 MAC CE messages, lack AS security protection, making them susceptible to modification or replay attacks that can cause key mismatches and handover failures. Existing key distribution methods do not provide a secure mechanism to deliver AS keys to candidate target gNBs (306) during inter-CU LTM, leading to potential security vulnerabilities.

[0080] Standardized procedures for synchronizing keys between a source gNB-CUs (602) and a target gNB-CUs (604) and their associated gNB-DUs are lacking in the existing system, resulting in inconsistencies in security parameter handling. Furthermore, the existing key derivation techniques, including those based on unused NH values, are not optimized for the speed required in LTM scenarios. These limitations highlight the need for a secure key synchronization method tailored specifically for LTM in inter-CU environments.

[0081] In order to address the above-mentioned issue of key mismatches and enhance key synchronization during LTM, the source gNB (301) may compute the NG-RAN key using either the currently active KgNB (i.e., horizontal key derivation) or, if available, a fresh and unused pair of {NH, NCC} (i.e., vertical key derivation). The key derivation may be based on the target PCI and its frequency (ARFCN-DL / EARFCN-DL), as described in Annex A.11 / A.12 of TS 33.501. Once derived, the source gNB (301) forwards the (NG-RAN key, NCC) pair to the target gNB (306) in the CELL SWITCH NOTIFICATION message. The target gNB (306) may then use the received NG-RAN key directly as KgNB for secure communication with the UE (101) and associate the NCC value with the KgNB.

[0082] Further, upon receiving the fresh pair of (NCC, NH) from the AMF, the gNB may send the NCCLTMvalue and a keySetChangeIndicator to the UE (101) in a protected RRC message. This message may be a new RRC message (e.g., RRC LTM Security Context) or embedded within the existing RRCRelease message containing suspendConfig information. If a New Security Context Indicator (NSCI) is also received with the fresh pair from the AMF, the gNB sets the keySetChangeIndicator to true, otherwise, it is set to false. The UE (101) stores the received NCCLTMand the keySetChangeIndicator values for ensuing key synchronization decisions.

[0083] FIG. 3A is the block diagram that illustrates the first network apparatus (301) for managing security keys during LTM in the wireless communication system, according to embodiments as disclosed herein.

[0084] The first network apparatus (301) includes various hardware and software components that facilitate communication between user equipment and network infrastructure. Examples of the first network apparatus (301) can include, but is not limited to Base Stations (such as macro cells, small cells, femtocells, pico cells) for wireless communication, Antennas and RF Units (e.g., MIMO, beam forming) to enhance signal coverage and data throughput, Core Network Equipment (e.g., MMEs, S-GWs, P-GWs in 4G; AMFs, UPFs in 5G) for data routing, mobility, and session control, Network Function Virtualization (NFV) and Software-Defined Networking (SDN) for dynamic resource allocation and scalability, Edge Computing Nodes (e.g., MEC servers) for low-latency processing, Backhaul and Transport Equipment (e.g., fiber-optic links, microwave relays, Ethernet switches) to connect base stations to the core network, Network Management Systems (NMS) and Operation Support Systems (OSS) for network configuration, fault management, and optimization, Radio Network Controllers (RNCs) in 3G, Distributed Units (DUs), and Centralized Units (CUs) in 5G, Network Slicing Components for virtualized resource allocation, Security elements (e.g., Firewalls, IDS, AAA Servers) for secure communication.

[0085] Examples of the wireless communication network system include, but are not limited to, Cellular Networks (such as 2G, 3G, 4G, 5G, Beyond 5G (B5G) / 6G, or advanced cellular networks), Local Area Networks (LANs) (such as Wi-Fi, Li-Fi, etc.), Personal Area Networks (PANs) (such as Bluetooth, Zigbee, Z-Wave, etc.), Wide Area Networks (WANs) (such as Satellite Communication Networks, Long Range Wide Area Network, Narrowband IoT, Low-bandwidth communication for IoT, etc.), Metropolitan Area Networks (MANs), Machine-to-Machine (M2M), Ad Hoc and Mesh Networks, Emerging and Advanced Networks.Examples of the UE can include, but are not limited to, Consumer Electronics (such as Mobile Phones and Smartphones), Tablets, Wearable Devices, Computing Devices (such as Laptops, Notebooks, Desktops, Workstations, etc.), IoT Devices, Automotive Systems (such as connected cars, Autonomous Vehicles, Vehicle-to-Everything (V2X) communication devices, etc.), Enterprise Devices such as robotics, Specialized Equipment (such as Medical Devices, Public Safety Devices, etc.), Media Devices (such as Gaming Consoles, Streaming Devices, etc.).

[0086] In an embodiment, the first network apparatus (301) includes a processor (302), a I / O interface (303), a memory (304), and an EPSFB inactivity timer optimization controller (305). The first network apparatus (301) connects with the security key controller (305). Further, the processor (302) of the network apparatus communicates with the memory (304), the I / O interface (303), and the security key controller (305). The processor (302) is configured to execute instructions stored in the memory (304) and to perform various processes. The processor (302) can include one or a plurality of processors, can be a general-purpose processor such as a central processing unit (CPU), an application processor (AP), or the like, a graphics-only processing unit such as a graphics processing unit (GPU), a visual processing unit (VPU), and / or an Artificial Intelligence (AI) dedicated processor such as a neural processing unit (NPU).

[0087] Further, the memory (304) of the first network apparatus (301) includes storage locations to be addressable through the processor (302). The memory (304) is not limited to a volatile memory and / or a non-volatile memory. Further, the memory (304) can include one or more computer-readable storage media. The memory (304) can include non-volatile storage elements. For example, non-volatile storage elements can include magnetic hard disks, optical disks, floppy disks, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories. Further, the I / O interface (303) transmits the information between the memory (304), electronic device, and external peripheral devices.

[0088] The security key controller (305) is coupled to the memory (304) and the processor (302). This coupling allows for data transfer and communication between the components, ensuring that the security key controller (305) can access and process security parameters in real-time during handover procedures. The security key controller (305) is an innovative integrated circuit that is implemented in the gNodeB Central Unit . In an embodiment, the structure of such innovative integrated circuit includes a multi-core architecture that enables secure key derivation and distribution for inter-CU LTM scenarios. Each core is optimized for specific tasks, such as horizontal key derivation, NCC management, and XnAP signaling for key distribution, etc. The integrated circuit for security key management in the LTM is made of a combination of analog and digital components designed to optimize the security and performance of the key synchronization mechanism. The analog components include a secure random number generator and a high-speed cryptographic accelerator to ensure robust key generation and processing. The digital components consist of a secure microcontroller unit (MCU) and a cryptographic processing unit (CPU) that work in tandem to securely generate, store, and distribute NG-RAN keys and associated security parameters based on LTM candidate configurations.

[0089] The security key controller (305) determines to execute the LTM to the candidate target cell based on Layer 1 (L1) measurement results received from the UE. The security key controller (305) sends the cell switch command to the UE through MAC CE to indicate the UE to perform horizontal key derivation. The cell switch command includes the NCC value. Further, the security key controller (305) generates the NG-RAN key from the plurality of key parameters. The NG-RAN key is derived using a secure cryptographic algorithm that ensures the integrity and confidentiality of the key parameters. Additionally, the security key controller (305) sends the cell switch notification message to the second network apparatus operating as a target base station through the XnAP signaling. The cell switch notification message includes the NG-RAN key generated by the first network apparatus, ensuring that the target base station can authenticate and establish secure communication with the UE.

[0090] Further, the security key controller (305) utilizes the plurality of key parameters. The plurality of key parameters includes at least one of the target Physical Cell Identifier (PCI), the ARFCN-DL, the EARFCN-DL of the target cell, and the currently active KgNB (203a-203i) in case of the horizontal key derivation, the unused NH in the case of a vertical key derivation. These parameters are used for identifying the target cell and ensuring seamless handover. The security key controller (305) employs advanced algorithms to combine these parameters and generate a robust NG-RAN key that can withstand potential security threats.

[0091] Further, the security key controller (305) determines by the first network apparatus to update the candidate target cell based with the new NG-RAN key.

[0092] Further, the security key controller (305) is used to determine whether to execute the LTM based on the evaluation of the signal strength measurements received in the L1 measurement results. The evaluation includes comparing the signal strength measurements against the predefined threshold. The predefined threshold is set based on historical data and network performance metrics to ensure optimal handover decisions. The security key controller (305) also considers factors such as signal-to-noise ratio (SNR) and interference levels to make a comprehensive assessment of the target cell's suitability.

[0093] Further, the security key controller (305) is adapted to process L1 measurement results. The L1 measurement results are triggered based on early synchronization with one or more candidate target cells. This early synchronization allows the security key controller (305) to gather real-time data on the signal quality and stability of the candidate cells. The processing of L1 measurement results involves filtering out noise and anomalies to ensure reliable data for handover decisions.

[0094] Further, the security key controller (305) is adapted to include in the Cell Switch command at least one of the PCI of the target cell, the ARFCN-DL, and one or more configuration parameters associated with the candidate target cell. These configuration parameters may include cell-specific settings such as transmission power, frequency bands, and modulation schemes. By including these parameters in the Cell Switch command, the security key controller (305) ensures that the UE can seamlessly transition to the target cell with minimal disruption to ongoing communication sessions.

[0095] Further, the security key controller (305) is arranged such that the NCC value included in the Cell Switch command indicates to the UE (101) to utilize the associated NG-RAN security key for securing communications with the target cell. Additionally, the NCC value enables the UE (101) to derive the followed NG-RAN security key when the UE (101) switches to another candidate second network apparatus (306) or returns to the same cell, thereby supporting both forward and reverse mobility scenarios with maintained security continuity. This mechanism ensures that the UE (101) can maintain secure communication channels regardless of its movement within the network, enhancing overall network security and user experience.

[0096] Further, the security key controller (305) forwards the NG-RAN key and NCC pair to the second network apparatus in the cell switch notification message. This message is transmitted using secure signaling protocols to prevent interception or tampering. The second network apparatus uses the NG-RAN key and NCC pair to authenticate the UE and establish a secure communication link, ensuring that the handover process is both seamless and secure.

[0097] Further, the security key controller (305) utilizes the plurality of key parameters. The plurality of key parameters includes at least one of the target PCI, the ARFCN-DL, the EARFCN-DL of the target cell, the currently active KgNB (203a-203i) in the case of the horizontal key derivation, and the unused NH in the case of vertical key derivation. These parameters are dynamically updated based on network conditions and UE behavior to ensure optimal key generation. The security key controller (305) employs machine learning algorithms to predict the best key parameters for each handover scenario, enhancing the security of the key derivation process.

[0098] Further, the security key controller (305) is to determine whether to execute the LTM based on the evaluation of signal strength measurements received in the L1 measurement results. The evaluation includes comparing the signal strength measurements against the predefined threshold. The security key controller (305) also considers additional metrics such as cell load, user density, and historical handover success rates to make a well-informed decision. This comprehensive evaluation process ensures that the LTM is executed only when the target cell can provide a better communication experience for the UE.

[0099] Further, the security key controller (305) is used to process the L1 measurement results. The L1 measurement results are triggered based on early synchronization with one or more candidate target cells. The processing involves advanced signal processing techniques to extract meaningful data from the raw measurements. The security key controller (305) uses this data to predict the future performance of the candidate cells, enabling proactive handover decisions that minimize communication disruptions.

[0100] Further, the security key controller (305) in the first network apparatus (301) operates such that the NCC value included in the Cell Switch command instructs the UE (101) to utilize the associated NG-RAN security key for securing communications with the target cell. Moreover, the NCC value enables the UE (101) to derive following NG-RAN security keys when switching to another candidate second network apparatus or returning to the same cell, thereby maintaining security continuity across mobility scenarios.

[0101] Further, the security key controller (305) in the first network apparatus (301) is adapted to forward the NG-RAN security key and the corresponding NCC value to the second network apparatus within the Cell Switch Notification message. This message is transmitted using secure signaling protocols for timely delivery. The second network apparatus uses the received NG-RAN security key and NCC value to authenticate the UE and establish a secure communication link, ensuring that the handover process is both seamless and secure.

[0102] FIG. 3B is the block diagram that illustrates the second network apparatus for managing security keys during LTM in the wireless communication system, according to embodiments as disclosed herein.

[0103] In an embodiment, the second network apparatus (306) includes a processor (307), a I / O interface (308), a memory (309), and an security key controller (310). The second network apparatus (306) connects with the security key controller (310). Further, the processor (307) of the second network apparatus (310) communicates with the memory (309), the I / O interface (308), and the security key controller (310). The processor (307) is configured to execute instructions stored in the memory (309) and to perform various processes. The processor (307) can include one or a plurality of processors, can be a general-purpose processor such as a central processing unit (CPU), an application processor (AP), or the like, a graphics-only processing unit such as a graphics processing unit (GPU), a visual processing unit (VPU), and / or an Artificial Intelligence (AI) dedicated processor such as a neural processing unit (NPU).

[0104] Further, the memory (309) of the second network apparatus (306) includes storage locations to be addressable through the processor (307). The memory (309) is not limited to a volatile memory and / or a non-volatile memory. Further, the memory (309) can include one or more computer-readable storage media. The memory (309) can include non-volatile storage elements. For example, non-volatile storage elements can include magnetic hard disks, optical disks, floppy disks, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories. Further, the I / O interface (308) transmits the information between the memory (304), electronic device, and external peripheral devices.

[0105] The security key controller (310) is coupled to the memory (309) and the processor (302). This coupling allows for data transfer and communication between the components, ensuring that the security key controller (310) can access and process security parameters in real-time during handover procedures. The security key controller (310) is an innovative integrated circuit that is implemented in the gNodeB Central Unit (301). In an embodiment, the structure of such innovative integrated circuit includes a multi-core architecture that enables secure key derivation and distribution for inter-CU LTM scenarios. Each core is optimized for specific tasks, such as horizontal key derivation, NCC management, and XnAP signaling for key distribution, etc. The integrated circuit for security key management in the LTM is made of a combination of analog and digital components designed to optimize the security and performance of the key synchronization mechanism. The analog components include a secure random number generator and a high-speed cryptographic accelerator to ensure robust key generation and processing. The digital components consist of a secure microcontroller unit (MCU) and a cryptographic processing unit (CPU) that work in tandem to securely generate, store, and distribute NG-RAN keys and associated security parameters based on LTM candidate configurations.

[0106] Further the security key controller receives the cell switch notification message from the first network apparatus through the XnAP signaling. The message includes the NG-RAN security key and the NCC value. Further, the security key controller (310) utilizes the received NG-RAN key directly as the KgNB (203a-203i) key for communication with the UE. Further, the security key controller (310) associates the NCC value with the KgNB (203a-203i) key. The security key controller (310) processes the NG-RAN security key to ensure it is compatible with the encryption algorithms used by the UE (101). This involves verifying the integrity of the key and performing any necessary transformations to match the security protocols of the network. The NCC value is used to maintain synchronization between the network apparatuses, ensuring that the security context is preserved during handovers and minimizing the risk of security breaches.

[0107] The security key controller (310) in the second network apparatus (306) receives the Cell Switch Notification message from the first network apparatus (301) through the XnAP signaling. The message includes a NG-RAN security key and the NCC value. The security key controller (310) utilizes the received NG-RAN security key as the KgNB (203a-203i) key to secure communication with the UE (101). Additionally, the security key controller (310) associates the NCC value with the KgNB (203a-203i) key, thereby enabling the tracking of key usage and supporting continuity in key derivation during subsequent mobility events. The security key controller (310) employs advanced cryptographic techniques to ensure the NG-RAN security key is robust against potential attacks. It also monitors the NCC value to detect any anomalies that could indicate unauthorized access or tampering. By maintaining a detailed log of key usage, the security key controller (310) can provide valuable insights for network security audits and facilitate rapid response to any security incidents.

[0108] FIG. 3C is the block diagram that illustrates the UE apparatus for managing security keys during LTM in the wireless communication system, according to embodiments as disclosed herein.

[0109] Examples of the UE (101) can include, but are not limited to, Consumer Electronics (such as Mobile Phones and Smartphones), Tablets, Wearable Devices, Television, Computing Devices (such as Laptops, Notebooks, Desktops, Workstations, etc.), IoT Devices, Automotive Systems (such as connected cars, Autonomous Vehicles, Vehicle-to-Everything (V2X) communication devices, etc.), Enterprise Devices such as robotics, Specialized Equipment (such as Medical Devices, Public Safety Devices, etc.), Media Devices (such as Gaming Consoles, Streaming Devices, etc.).

[0110] Examples of the wireless communication network system include, but are not limited to, Cellular Networks (such as 2G, 3G, 4G, 5G, Beyond 5G (B5G) / 6G, or advanced cellular networks), Local Area Networks (LANs) (such as Wi-Fi, Li-Fi, etc.), Personal Area Networks (PANs) (such as Bluetooth, Zigbee, Z-Wave, etc.), Wide Area Networks (WANs) (such as Satellite Communication Networks, Long Range Wide Area Network, Narrowband IoT, Low-bandwidth communication for IoT, etc.), Metropolitan Area Networks (MANs), Machine-to-Machine (M2M), Ad Hoc and Mesh Networks, Emerging and Advanced Networks. Examples of the UE can include, but are not limited to, Consumer Electronics (such as Mobile Phones and Smartphones), Tablets, Wearable Devices, Computing Devices (such as Laptops, Notebooks, Desktops, Workstations, etc.), IoT Devices, Automotive Systems (such as connected cars, Autonomous Vehicles, Vehicle-to-Everything (V2X) communication devices, etc.), Enterprise Devices such as robotics, Specialized Equipment (such as Medical Devices, Public Safety Devices, etc.), Media Devices (such as Gaming Consoles, Streaming Devices, etc.).

[0111] The UE (101) includes the processor (312), the memory (314), the I / O interface (303) and the security key controller (315). For example, the UE (101) can include, but not limited to a mobile phone, a smart phone, tablets, laptops, Internet of Things (IoT) devices. Further, the processor (312) of the UE (101) communicates with the memory (314), the I / O interface (303) and the security key controller (315). The processor (312) is configured to execute instructions stored in the memory (314) and to perform various processes. The processor (312) can include one or a plurality of processors, can be a general-purpose processor, such as a central processing unit (CPU), an application processor (AP), or the like, a graphics-only processing unit such as a graphics processing unit (GPU), a visual processing unit (VPU), and / or an Artificial intelligence (AI) dedicated processor such as a neural processing unit (NPU).

[0112] Further, the memory (314) of the UE (101) includes storage locations to be addressable through the processor (312). The memory (314) is not limited to a volatile memory and / or a non-volatile memory. Further, the memory (314) can include one or more computer-readable storage media. The memory (314) can include non-volatile storage elements. For example, non-volatile storage elements can include magnetic hard discs, optical discs, floppy discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories.

[0113] The I / O interface (303) transmits the information between the memory (314) and external peripheral devices. The peripheral devices are the input-output devices associated with the UE (101). The I / O interface (303) receives several information from the UE (101).

[0114] The security key controller (315) is coupled to the memory (103) and the processor (312). This coupling allows for data transfer and communication between the components, ensuring that the security key controller (315) can access and process connection data in real-time. The security key controller (315) is an innovative integrated circuit that is implemented in the UE (101). In an embodiment, the structure of such innovative integrated circuit includes a multi-core architecture that enables dynamic management of NG-RAN security key derivation in the cellular communication system. Each core is optimized for specific tasks, such as Cell Switch command processing, Next hop Chaining Counter (NCC) value handling, and horizontal key derivation procedures, etc. The innovative integrated circuit for the management of NG-RAN security key generation in the cellular communication system is made of a combination of analog and digital components designed to optimize the power consumption and performance of the security key derivation mechanism. The analog components include a low-noise amplifier and a high-precision analog-to-digital converter to for signal processing. The digital components consist of a microcontroller unit (MCU) and a digital signal processor (DSP) that work in tandem to dynamically generate NG-RAN security keys utilizing target Physical Cell Identifier (PCI), target ARFCN-DL or EARFCN-DL and currently active KgNB (203a-203i)key through horizontal key derivation based on received NCC values from Cell Switch commands.

[0115] The security key controller (315) receives the Cell Switch command from the first network apparatus (301) through the MAC CE. The command includes the NCC value. The security key controller (315) in the UE (101) generates the NG-RAN security key utilizing the target PCI, the target ARFCN-DL or EARFCN-DL, and the currently active KgNB (203a-203i) key through horizontal key derivation. The target PCI is a unique identifier for the target cell, while the ARFCN-DL or EARFCN-DL represents the downlink frequency channel number for the target cell. The currently active KgNB key is a security key used for encryption and integrity protection in the current network. The security key controller (315) in the UE (101) utilizes the generated NG-RAN security key to access the candidate second network apparatus (306). This process ensures that the UE can securely transition between cells while maintaining the integrity and confidentiality of the communication.

[0116] The security key controller (315) utilizes the received NCC value to derive the following NG-RAN key even when a current NCC in use differs from the received NCC value. The NCC value is a network configuration parameter that influences the key generation process. By using the received NCC value, the security key controller can ensure that the derived NG-RAN security key is compatible with the target network's security requirements. This capability maintains secure communication during handovers, especially in scenarios where the UE moves between cells with different NCC values. The security key controller (315) utilizes the received NCC value to generate the NH key and then generate the NG-RAN security key. The NH key is an intermediate key derived from the NCC value, which is then used to generate the final NG-RAN security key, ensuring a robust and secure key derivation process.

[0117] Further, the security key controller (311) receives the Cell Switch command from the first network apparatus (301) through the MAC CE. The command includes the NCC value. In response to the received command, the security key controller (311) generates the NG-RAN security key by performing horizontal key derivation using at least one of the target PCI, the target ARFCN-DL or the EARFCN-DL, and the currently active KgNB (203a-203i) key. Horizontal key derivation involves using parameters from the target cell and the current security context to generate a new security key. The security key controller (311) then utilizes the generated NG-RAN security key to facilitate secure access to the candidate second network apparatus (306). This ensures that the UE can authenticate and establish a secure connection with the new network apparatus. Furthermore, the security key controller (311) is adapted to derive the following NG-RAN security key using the received NCC value even if it differs from the currently active NCC, thereby enabling key continuity across varying mobility scenarios. This feature is essential for seamless handovers and maintaining security across different network configurations. In another embodiment, the security key controller (311) uses the received NCC value to generate the NH key, which is then used to derive the NG-RAN security key. This method provides an additional layer of security by using an intermediate key in the key derivation process, enhancing the overall security of the communication.

[0118] FIG. 4A is the flowchart that illustrates the method for managing security keys during LTM by the first network apparatus (301) in the wireless communication system according to embodiments as disclosed herein.

[0119] At step 401a determining to initiate the LTM to the candidate target cell by the first network apparatus (301) based on the L1 measurement results received from the UE 101. The L1 measurement results include parameters such as signal strength, signal quality, and interference levels, which are used for making an informed decision about the handover. The first network apparatus (301) may also consider historical data and predictive analytics to enhance the LTM initiation decision.

[0120] At step 402a generating the new NG-RAN key from the plurality of key parameters and the Next Hop Chaining Counter (NCC) value by the first network apparatus (301). The plurality of key parameters including at least one of the PCI, the ARFCN-DL, the EARFCN-DL, and the currently active KgNB (203a-203i) key. The generation process involves cryptographic algorithms that ensure the security and integrity of the key. The first network apparatus (301) may use advanced encryption standards (AES) or other secure hashing algorithms to derive the NG-RAN security key, ensuring robust protection against potential security threats.

[0121] At step 403a sending the LTM configuration(s) to the second network apparatus (306) operating as a target gNB by the first network apparatus (301) via the XnAP signaling. The LTM configuration(s) includes the NG-RAN key and the used NCC value generated by the first network apparatus (301). The XnAP signaling protocol ensures that the configuration is transmitted securely, facilitating a smooth Layer1 / Layer2 Triggered Mobility transition for the UE (101). The LTM configuration(s) may also include additional context information such as the UE's current state and capabilities to assist the target gNB in optimizing the LTM process.

[0122] At step 404a sending the Cell Switch command to the UE (101) through the MAC CE to perform horizontal key derivation by the first network apparatus (301). The Cell Switch command includes the NCC value utilized for the derivation of NG-RAN key during LTM execution phase.

[0123] FIG. 4B is the flowchart that illustrates the method for managing security keys during LTM by the first network apparatus (301) in the wireless communication system according to embodiments as disclosed herein.

[0124] At step 401b determining to initiate the LTM to the candidate target cell by the first network apparatus (301) based on the L1 measurement results received from the UE 101. The L1 measurement results include parameters such as signal strength, signal quality, and interference levels, which are used for making an informed decision about the handover. The first network apparatus (301) may also consider historical data and predictive analytics to enhance the LTM initiation decision.

[0125] At step 402b sending the Cell Switch command to the UE (101) through the MAC CE by the first network apparatus (301). The Cell Switch command includes the NCC value and instructs the UE (101) to perform horizontal key derivation. The MAC CE ensures that the command is delivered with low latency and high reliability, which is essential for maintaining seamless connectivity during the handover process. Additionally, the command may include timing advance information to synchronize the UE (101) with the target cell.

[0126] At step 403b generating the new NG-RAN key from the plurality of key parameters by the first network apparatus (301).

[0127] At step 404b sending the cell Switch notification message to the second network apparatus (306) by the first network apparatus (301) through the XnAP signaling. The notification message includes the NG-RAN security key and the associated NCC value. The XnAP signaling protocol ensures that the message is transmitted securely, facilitating a smooth transition for the UE (101). The message may also include additional context information such as the UE's current state and capabilities to assist the second network apparatus (306) in optimizing the handover process.

[0128] FIG. 4C is the flowchart that illustrates the method for managing security keys during LTM by the second network apparatus (306) in the wireless communication system according to embodiments as disclosed herein.

[0129] At step 405 receiving a Cell Switch notification message from a first network apparatus (301) by the second network apparatus (306) via XnAP signaling. The Cell Switch notification message includes a NG-RAN security key and the associated NCC value. The second network apparatus (306) verifies the integrity and authenticity of the received message using cryptographic checksums and digital signatures, ensuring that the key exchange process is secure and tamper-proof.

[0130] At step 406 utilizing the received NG-RAN security key directly as the KgNB (203a-203i) key by the second network apparatus (306) for establishing secure communication with the UE (101). The second network apparatus (306) may employ additional security measures such as key confirmation protocols to ensure that both the network and the UE (101) are using the correct security key. This step prevents unauthorized access and ensuring the confidentiality of the communication.

[0131] At step 407 associating the received NCC value with the KgNB (203a-203i) key by the second network apparatus (306) to ensure continuity in the key management and enable derivation of following NG-RAN security keys during future mobility events. The association process involves updating the key management database and ensuring that the NCC value is correctly mapped to the corresponding security key. This step is essential for maintaining a consistent and secure key management framework across multiple handovers and mobility events.

[0132] FIG. 4D is the flowchart that illustrates the method for managing security keys during LTM by the UE (101) in the wireless communication system according to embodiments as disclosed herein.

[0133] At step 408 receiving the cell switch command from the first network apparatus (301) (the term first network apparatus (301)' is interchangeably mentioned as source gNB (301) by the UE (101) through the MAC CE. The Cell Switch command includes the NCC value. The UE (101) processes the received command and extracts the NCC value, which is used as a reference for the subsequent key derivation process. The MAC CE ensures that the command is received with minimal delay, which is used for maintaining seamless connectivity during the handover.

[0134] At step 409 generating the NG-RAN security key by the UE (101) using horizontal key derivation. The derivation utilizes the target PCI, the ARFCN-DL or EARFCN-DL, and the currently active KgNB key. The UE (101) employs cryptographic algorithms to derive the new security key, ensuring that the key is unique and secure. The horizontal key derivation process is computationally lightweight, minimizing the impact on the UE's (101) performance and battery life.

[0135] At step 410 utilizing the generated NG-RAN security key by the UE (101) to access the candidate second network apparatus (306), thereby ensuring secure and seamless mobility. The UE (101) establishes a secure communication channel with the second network apparatus (306) using the newly derived security key. This step is maintains the confidentiality and integrity of the communication, preventing unauthorized access, and ensuring a smooth transition during the handover process.

[0136] FIG. 5 is a sequence diagram illustrating the signaling procedure for the inter-gNB LTM scenario involving the Xn interface in accordance with an embodiment of the present invention. This embodiment employs a horizontal key derivation method to derive the key for the target cell, referred to as NG-RAN key, from the currently active KgNB. Consequently, the NCC remains unchanged across subsequent derivations and may not be required for key derivation in this LTM scenario.

[0137] At step S1, the UE (101) transmits a 'MeasurementReport' message to the source gNB (301), indicating the Layer 3 measurement results. The source gNB (301) determines to initiate the inter-gNB LTM configuration at step S2. At step S3, the source gNB (301) sends a 'HANDOVER REQUEST' message to each candidate target gNB (306) to request the LTM configurations. This message includes an LTM indicator and may contain fields such as the target cell ID, NCC, ngKSI, UE's C-RNTI, and DL carrier frequency.

[0138] In an embodiment, the inclusion of the NCC value indicates to the target gNB (306) whether the UE (101) should reuse an existing NG-RAN security key or re-derive a new NG-RAN security key based on whether vertical key generation or AS key changes are applied. The NCC value thereby enables the UE (101) to derive the appropriate key either through continuation of the existing NH chain or by performing horizontal key derivation.

[0139] The candidate target gNB (306) may perform admission control at step S4. At step S5, the candidate target gNB (306) responds with a 'HANDOVER REQUEST ACKNOWLEDGE' message, including the LTM configuration for the candidate cell. The source gNB (301) then sends an 'RRCReconfiguration' message to the UE (101) at step S6, delivering the received LTM configurations. The UE (101) stores these configurations and responds with an 'RRCReconfigurationComplete' message at step S7.

[0140] Early timing synchronization with the candidate target cell(s) may be performed at step S8. At step S9, the candidate target gNB (306) provides Timing Advance (TA) information and related parameters to the source gNB (301) through the XnAP signaling. The UE (101) reports the L1 measurement result to the source gNB (301) at step S10.

[0141] Based on the measurements, the source gNB (301) decides to switch the UE (101) to a selected candidate target cell at step S11. In an embodiment, the source gNB (301) selects the target cell from among the candidates and proceeds with the LTM procedure accordingly. At step S12, the source gNB (301) sends the 'Cell Switch' command to the UE (101) through the MAC CE. Upon receiving this command, the UE (101) performs horizontal key derivation using the target cell's PCI, DL frequency (ARFCN-DL / EARFCN-DL), and the active KgNB (203a-203i) to generate the NG-RAN key.

[0142] In an embodiment, the 'Cell Switch' command message includes the NCC value currently used at the source gNB (301). If the UE (101) receives the NCC value in the 'Cell Switch' command, it may use this value to identify the corresponding NG-RAN key or to derive the consequent NG-RAN key when switching to another candidate target gNB (306) or returning to the same cell. Even if the UE (101) has a different NCC value active, it uses the received NCC to generate the NH and then derive NG-RAN key accordingly. In another embodiment, the inclusion of the NCC in the 'Cell Switch' command serves as an indicator for the UE (101) to perform horizontal key derivation.

[0143] At step S13, the source gNB (301) sends a 'CELL SWITCH NOTIFICATION' and / or a new XnAP message to the selected target gNB (306) through the XnAP signaling. In one embodiment, the source gNB (301) generates the NG-RAN key using the target PCI and the ARFCN-DL / EARFCN-DL along with either the currently active KgNB (203a-203i) (horizontal key derivation) or the previously unused NH (vertical key derivation) and includes the generated key in the XnAP message. The source gNB (301) may forward the {NG-RAN key, NCC} pair to the target gNB (306).

[0144] In an embodiment, the target gNB (306) temporarily stores the received NCC and corresponding NG-RAN key until either the UE (101) context is released or a new primary authentication is triggered, where the new KgNB is derived from an NH parameter.

[0145] In an embodiment, the source gNB (301) generates the NG-RAN key from the target cell's PCI, its frequency (ARFCN-DL / EARFCN-DL), and either from the currently active KgNB (203a-203i) (for horizontal key derivation) or from the NH (for vertical key derivation). The source gNB (301) performs vertical key derivation when it has an unused {NH, NCC} pair available and if the NCCLTMand the 'keySetChangeIndicator' are successfully provided to the UE.The horizontal key derivation is performed if the unused NCCLTMvalue is not successfully provided to the UE.

[0146] In an embodiment, the source gNB (301) includes the generated NG-RAN key in the XnAP message and may forward the [NG-RAN key, NCC] pair to the target gNB (306).

[0147] At step S14, the UE (101) initiates access to the target gNB (306) as specified in 3GPP TS 38300. Upon receiving the forwarded NG-RAN key from the source gNB (301), the target gNB (306) directly uses this key as KgNB for secure communication with the UE. The received NCC is associated with the KgNB by the target gNB (306) as applicable.

[0148] In step S15, the UE (101) sends the 'RRCReconfigurationComplete' message to the target gNB (306).

[0149] At step S16, a 'HANDOVER SUCCESS' message is sent by the target gNB (306) to the source gNB (301) to indicate the successful UE access and completion of the handover procedure.

[0150] Step S17 involves the source gNB (301) sending a 'SN STATUS TRANSFER' message to the target gNB (306) to facilitate late data forwarding, as described in step 7 of the Intra-AMF / UPF Handover procedure in TS 38300.

[0151] Further late data forwarding may be initiated as early as step 12 when the source gNB (301) sends the cell Switch command to the UE (101).

[0152] In step S18, the target gNB (306) sends a 'PATH SWITCH REQUEST' message to the 5GC (AMF) to trigger the downlink data path switch and establish a new NG-C interface instance with the target gNB (306).

[0153] The 5GC (AMF) responds with the 'PATH SWITCH REQUEST ACKNOWLEDGE' message to the target gNB (306) at step S19.

[0154] Upon receiving the acknowledgment from the 5GC, the target gNB (306) may send a 'UE CONTEXT RELEASE' message to the source gNB (301) at step S20, indicating that the handover has completed successfully. The source gNB (301) can then release radio and control-plane resources related to the UE (101) context. Any in-progress data forwarding can continue as needed.

[0155] FIG. 6A, FIG. 6B, and FIG. 6C illustrate the sequence diagram for the Inter-gNB-CU LTM procedure between the UE (101) and the plurality of gNBs in the wireless communication system. At step S1, the UE (101) may transmit the 'MeasurementReport' message, including Layer 3 measurement results, to a source gNB-DU (601). The source gNB-DU (601) forwards the received 'MeasurementReport' to a source gNB-CU (602) using an 'UL RRC MESSAGE TRANSFER' message.

[0156] The source gNB-CU (602) may determine to initiate the inter-gNB LTM configuration procedure based on the received measurements at step S2. At step S3, the source gNB-CU (602) transmits the 'HANDOVER REQUEST' message to one or more candidate gNB-CUs corresponding to the candidate cells, including an LTM indicator and LTM-related information. In one embodiment, the 'HANDOVER REQUEST' includes at least one of the target cell ID, the NCC, a C-RNTI of the UE (101) in the source gNB (301), and a DL carrier frequency. The NCC included in the 'HANDOVER REQUEST' indicates the target gNB (306) to use the corresponding NG-RAN key or to derive consequent NG-RAN keys during horizontal mobility scenarios or when reverting to the same cell.

[0157] Each candidate gNB-CU may transmit a 'UE CONTEXT SETUP REQUEST' message to its associated candidate gNB-DU(s) at step S4, optionally including the NCC index to request LTM configuration. In an embodiment, the candidate gNB-CU includes the NCC index in the 'UE CONTEXT SETUP REQUEST' message. If the candidate gNB-DU accepts the LTM configuration, it may respond with the 'UE CONTEXT SETUP RESPONSE' message at step S5, including lower-layer RRC configuration information corresponding to the accepted candidate target cell.

[0158] The candidate gNB-CU (604) transmits the 'HANDOVER REQUEST ACKNOWLEDGE' message to the source gNB-CU (602) for each candidate cell at step S6, including the accepted LTM configuration. At step S7, the source gNB-CU (602) transmits a 'UE CONTEXT MODIFICATION REQUEST' message to the source gNB-DU, including the LTM configuration information for one or more accepted candidate target cells and optionally including the NCC index. In one embodiment, the NCC index is conveyed to the UE (101) through the Cell Switch Command.

[0159] The source gNB-DU (601) responds with the 'UE CONTEXT MODIFICATION RESPONSE' message at step S8. At step S9, the source gNB-CU (602) transmits a 'DL RRC MESSAGE TRANSFER' message to the source gNB-DU (601), including the 'RRCReconfiguration' message that includes the LTM configuration. The source gNB-DU (601) forwards the 'RRCReconfiguration' message to the UE at step S10. The UE (101) responds with the 'RRCReconfigurationComplete' message to the source gNB-DU (601) at step S11. The source gNB-DU (601) forwards the 'RRCReconfigurationComplete' message to the source gNB-CU (602) through an 'UL RRC MESSAGE TRANSFER' message at step S12.

[0160] Early synchronization to one or more candidate target cells may be performed by the UE (101) at step S13, as specified in the 3GPP TS 38300. Each candidate gNB-DU transmits a 'DU-CU TA INFORMATION TRANSFER' message to its respective candidate gNB-CU at step S14, including the TA value, associated CFRA resources, and the candidate cell ID. The candidate gNB-CU forwards the received TA and CFRA resource information to the source gNB-CU (602) through the XnAP signaling at step S15. The source gNB-CU (602) forwards the TA and CFRA resource information to the source gNB-DU (601) through the 'CU-DU TA INFORMATION TRANSFER' message at step S16.

[0161] The UE (101) transmits Layer 1 measurement results to the source gNB-DU at step S17. Based on the Layer 1 measurements, the source gNB-DU (601) may decide to execute a local traffic mobility switch to the candidate target cell at step S18. The source gNB-DU (601) transmits the Cell Switch Command to the UE (101) through the MAC CE at step S19, including the NCC index for horizontal key derivation and for deriving or associating NG-RAN key values. The source gNB-DU (601) transmits the 'DU-CU CELL SWITCH NOTIFICATION' message to the source gNB-CU at step S20, indicating initiation of the Cell Switch Command to the UE and including the target cell ID, the TCI state ID, and the NCC index.

[0162] The source gNB-CU (602) forwards the target cell ID and TCI state ID to the target gNB-CU (604) through the XnAP signaling message, such as the 'CELL SWITCH NOTIFICATION' at step S21. In one embodiment, the source gNB-CU (602) includes the derived NG-RAN key in the message. The target gNB (306) may temporarily store the {NCC, NG-RAN key} pair until UE (101) context release or a new primary authentication (i.e., KgNB derivation from NH) is triggered. The target gNB-CU (604) forwards the target cell ID and the TCI state ID to a target gNB-DU (603) through the 'CU-DU CELL SWITCH NOTIFICATION' message at step S22.

[0163] The target gNB-DU (603) detects the UE (101) access at step S23. The target gNB-DU (603) transmits an 'ACCESS SUCCESS' message to the target gNB-CU (604) at step S24, including the target cell ID. The UE (101) transmits the 'RRCReconfigurationComplete' message to the target gNB-DU at step S25. The target gNB-DU (603) forwards the 'RRCReconfigurationComplete' message to the target gNB-CU (604) through an 'UL RRC MESSAGE TRANSFER' message at step S26. The target gNB-CU (604) transmits a 'HANDOVER SUCCESS' message to the source gNB-CU (602) at step S27, indicating that the UE (101) has successfully accessed the target cell.

[0164] The source gNB-CU (602) transmits an 'SN STATUS TRANSFER' message to the target gNB-CU (604) at step S28 for late data forwarding, in accordance with principles discussed in step S7 of the Intra-AMF / UPF Handover. Further late data forwarding may be initiated as soon as the source gNB-CU (602) receives the 'DU-CU CELL SWITCH NOTIFICATION' from the source gNB-DU (601), as discussed in step S20. The target gNB-CU (604) transmits a 'PATH SWITCH REQUEST' message to the 5GC (AMF) at step S29 to request a switch of the downlink data path toward the target gNB-CU (604) and establish a new NG-C interface. The 5GC (503) (AMF) responds with the 'PATH SWITCH REQUEST ACKNOWLEDGE' message to the target gNB-CU at step S30.

[0165] In response to the acknowledgment, the target gNB-CU (604) transmits a 'UE CONTEXT RELEASE' message to the source gNB-CU (602) at step S31, indicating successful handover. The source gNB (301) releases radio and control plane resources associated with the UE (101) context while any ongoing data forwarding may continue. The source gNB-CU (602) transmits a 'UE CONTEXT RELEASE COMMAND' to the source gNB-DU (601) at step S32 to release source cell resources. The source gNB-DU (601) responds with a 'UE CONTEXT RELEASE COMPLETE' message at step S33.

[0166] In one embodiment, when the 'UE CONTEXT RELEASE' message is received at step S20 and step S31 respectively, the UE (101) and the source gNB (301) maintain the current KAMF (201) and the corresponding ngKSI with reference to FIG. 5 and FIG. 6. Key derivation is performed at the source gNB (301) when the decision to trigger the LTM is made. Once the LTM execution phase begins, the source gNB (301) generates the new NG-RAN key security key and initiates key distribution to the target gNB (306). The derived key is transmitted exclusively to the target CU using the cell switch notification message, ensuring secure and direct delivery during the execution phase of the mobility procedure. Further, the updated NCC value is provided to the UE (101) by the source gNB (301) using the MAC CE embedded within the Cell Switch Command. This enables the UE (101) to manage the NG-RAN security keys securely across subsequent LTM mobility events, thereby ensuring continuity and integrity of the security context during inter-cell transitions.

[0167] FIG. 7 is the sequence diagram that illustrates events during LTM cell switch.

[0168] At steps S1 and S2, the UE (101) sends the 'MeasurementReport message' (L3 measurement result) to the source gNB. The source gNB determines to initiate inter-gNB LTM configuration.

[0169] At step S3, the source gNB sends the 'HANDOVER REQUEST' message to the candidate gNB(s) for each candidate cell to request the LTM configurations, which carries the LTM indicator and other related LTM information.

[0170] At step S4, an admission control may be performed by the target gNB.

[0171] At step S5, the candidate gNB sends the LTM response message (HANDOVER REQUEST ACKNOWLEDGE) including configuration of the LTM candidate cell(s) to the source gNB. The LTM response message is sent for each candidate cell.

[0172] At step S6, the source gNB transmits the RRCReconfiguration message to the UE (101) including the LTM candidate configurations.

[0173] At step S7, the UE (101) then stores the LTM candidate configurations and transmits the RRCReconfigurationComplete message to the gNB.

[0174] At step S8, the early synchronization to the target candidate cell(s) may be performed ( as specified in TS 38.300).

[0175] At step S9, the candidate gNB forwards the TA value and the associated information to source gNB via the XnAP signaling.

[0176] At steps S10 and S11, the UE (101) sends the L1 measurement result to the source gNB. The source gNB decides to execute LTM to the candidate target cell. The source gNB generates the NG-RAN key from target PCI, its frequency ARFCN-DL / EARFCN-DL, and either from currently active KgNB or from the NH (as described in Annex A.11 / A.12 of TS 33.501). The source gNB performs the vertical key derivation in case it has the unused (NH, NCC) pair.

[0177] At step S12, the source gNB sends the Cell Switch command to the UE (101) through the MAC CE. Upon receiving the cell switch command, if the NCC of the current KgNB is less than the stored NCCLTM value, then the UE (101) synchronize the locally kept NH parameter by evaluating the function (defined in Annex A.10 iteratively as specified in TS 33.501) and evaluates the NG-RAN key from the synchronized NH parameter. If the NCCLTM is equal to the NCC value associated with the current KgNB, then the UE (101) uses the active KgNB to derive the NG-RAN key.

[0178] At step S13, the source gNB sends the CELL SWITCH NOTIFICATION message to target gNB (306) via the XnAP signaling. In this notification message the source gNB includes the generated {NG-RAN key, NCC} pair to the target gNB.

[0179] At step S14, the target gNB (306) detects the UE (101) access. Upon receiving the NG-RAN key from the source gNB, the target gNB (306) uses the received NG-RAN key directly as the KgNB to be used with the UE (101). The target gNB (306) associates the NCC value if received from source gNB with the KgNB.

[0180] At step S15, the UE (101) sends the 'RRCReconfigurationComplete' message to the target gNB.

[0181] At step S16, the target gNB (306) sends the 'HANDOVER SUCCESS' message to the source gNB to inform that the UE (101) has successfully accessed the target cell.

[0182] At step S17, the source gNB sends the 'SN STATUS TRANSFER' message for the late data forwarding following the principles described in step 7 of Intra-AMF / UPF Handover (in clause 9.2.3.2.1 in TS 38.300).In an embodiment, X is referred to the Late data forwarding may be initiated as soon as the source gNB (301) sends the Cell Switch command to the UE (101) via the MAC CE when The source gNB (301) sends the 'Cell Switch command' to the UE (101) via the MAC CE.

[0183] At step S18, the target gNB (306) sends the 'PATH SWITCH REQUEST' message to 5GC (AMF) to trigger 5GC to switch the DL data path towards the target gNB (306) and to establish a NG-C interface instance towards the target gNB.

[0184] Further, the 5GC (AMF) confirms the 'PATH SWITCH REQUEST' message with the 'PATH SWITCH REQUEST ACKNOWLEDGE' message to target gNB. Upon reception of a 'NGAP PATH SWITCH REQUEST', the AMF increases it's locally kept NCC value by one and determine a new fresh NH from its stored data using the function (defined in Annex A.10). The AMF shall use the KAMF from the currently active 5G NAS security context for the evaluation of the new fresh NH. The AMF may then send the newly computed (NH, NCC) pair to the target gNB (306) in the NGAP PATH SWITCH REQUEST ACKNOWLEDGE message.

[0185] At steps S19, in case the AMF had activated a new 5G NAS security context with a new KAMF, different from the 5G NAS security context on which the currently active 5G AS security context is based, but has not yet successfully performed a UE Context Modification procedure, the sent 'NGAP PATH SWITCH REQUEST ACKNOWLEDGE' message shall in addition contain a NSCI (New Security Context Indicator). The AMF, in this case, derive a new initial KgNB from the new KAMF and the uplink NAS COUNT in the most recent NAS Security Mode Complete message ( as specified in Annex A.9 of TS 33.501). The AMF associates the derived new initial KgNB with a new NCC value equal to zero. Then, the AMF shall use (the derived new initial KgNB, the new NCC value initialized to zero) pair as the newly computed (NH, NCC) pair to be sent in the NGAP PATH SWITCH REQUEST ACKNOWLEDGE message. The gNB / ng-eNB shall in this case set the value of keySetChangeIndicator field to true in further handovers.

[0186] At step S20, upon reception of the PATH SWITCH REQUEST ACKNOWLEDGE message from the 5GC (AMF), the target gNB (306) shall store the received (NH, NCC) pair for further handovers and remove other existing unused stored (NH, NCC) pairs if any and the target gNB (306) may send the UE CONTEXT RELEASE to inform the source gNB (301) about the success of the handover. The source gNB (301) may then release radio and C-plane related resources associated to the UE context. Any ongoing data forwarding may continue.

[0187] Further, whenever the gNB receives a fresh pair of (NCC, NH) from the AMF, the gNB sends a NCC value of the received fresh pair (NCCLTM) and the 'keySetChangeIndicator' to the UE (101) in a protected RRC message (can be a new RRC message (RRC Security Configuration Request with LTMSecurityContext) or the RRC Reconfiguration Request with LTMSecurityContext) or in the RRCRelease with suspendConfig message). If the gNB received NASI along with the fresh pair of (NCC, NH) from the AMF, then the gNB set the value of keySetChangeIndicator field to true and send it along with the NCCLTM in the RRC message.

[0188] At step S21, the UE (101) stores the received NCCLTM value and the keySetChangeIndicator to generate the appropriate KNG-RAN*for the LTM Cell Switch.

[0189] The description of these embodiments is detailed enough that others can modify or adapt them for various applications without straying from the core concept. These adaptations are intended to fall within the scope of the disclosed embodiments. The terminology used is for descriptive purposes only and not meant to be limiting. While preferred embodiments have been described, those skilled in the art will recognize that modifications can be made within the scope of the described embodiments.

Claims

1.A method performed by a first network apparatus in a wireless communication system, the method comprising:receiving, from a terminal, a layer 1 (L1) measurement result;deciding to execute a layer1 / layer2 triggered mobility (LTM) to a second network apparatus;generating a next generation radio access network (NG-RAN) key based on a plurality of key parameters; andsending, to the terminal, via medium access control (MAC) control element (CE), a cell switch command that includes the NCC value associated with the NG-RAN key.2.The method of claim 1, further comprising:sending, to the second network apparatus, via an Xn application protocol (XnAP) signaling, a cell switch notification including the NG-RAN key and the NCC value.3.The method of claim 1, wherein the plurality of key parameters comprises at least one of a target physical cell identifier (PCI) and an absolute radio frequency channel number (ARFCN) for downlink.4.The method of claim 1, wherein the NG-RAN key is derived from a current KgNBassociated with a horizontal key derivation or from an unused next hop (NH) associated with a vertical key derivation.5.A method performed by a terminal in a wireless communication system, the method comprising:sending, to a first network apparatus, a layer 1 (L1) measurement result;receiving, from the first network apparatus, via medium access control (MAC) control element (CE), a cell switch command that includes a next hop chaining counter (NCC) value; andgenerating a next generation radio access network (NG-RAN) key based on the NCC value.6.The method of claim 5, further comprising:utilizing the NG-RAN key for secure communication with a second network apparatus.7.The method of claim 5, wherein the NG-RAN key is derived from a current KgNBassociated with a horizontal key derivation or from an unused next hop (NH) associated with a vertical key derivation.8.A first network apparatus comprising:at least one transceiver;at least one processor communicatively coupled to the at least one transceiver; andat least one memory, communicatively coupled to the at least one processor, storing instructions executable by the at least one processor individually or in any combination to cause the first network apparatus to:receive, from a terminal, a layer 1 (L1) measurement result,decide to execute a layer1 / layer2 triggered mobility (LTM) to a second network apparatus,generate a next generation radio access network (NG-RAN) key based on a plurality of key parameters, andsend, to the terminal, via medium access control (MAC) control element (CE), a cell switch command that includes the NCC value associated with the NG-RAN key.9.The first network apparatus of claim 8, wherein the instructions executable by the at least one processor individually or in any combination further cause the first network apparatus to send, to the second network apparatus, via an Xn application protocol (XnAP) signaling, a cell switch notification including the NG-RAN key and the NCC value.10.The first network apparatus of claim 8, wherein the plurality of key parameters comprises at least one of a target physical cell identifier (PCI) and an absolute radio frequency channel number (ARFCN) for downlink.11.The first network apparatus of claim 8, wherein the NG-RAN key is derived from a current KgNBassociated with a horizontal key derivation or from an unused next hop (NH) associated with a vertical key derivation.12.A terminal comprising:at least one transceiver;at least one processor communicatively coupled to the at least one transceiver; andat least one memory, communicatively coupled to the at least one processor, storing instructions executable by the at least one processor individually or in any combination to cause the terminal to:send, to a first network apparatus, a layer 1 (L1) measurement result,receive, from the first network apparatus, via medium access control (MAC) control element (CE), a cell switch command that includes a next hop chaining counter (NCC) value, andgenerate a next generation radio access network (NG-RAN) key based on the NCC value.13.The terminal of claim 12, wherein the instructions executable by the at least one processor individually or in any combination further cause the terminal to utilize the NG-RAN key for secure communication with a second network apparatus.14.The terminal of claim 12, wherein the NG-RAN key is derived from a current KgNBassociated with a horizontal key derivation or from an unused next hop (NH) associated with a vertical key derivation.

Images