Apparatus, computer program and method

Abstract

APPARATUS, COMPUTER PROGRAM AND METHOD A user equipment comprising: means for receiving an indication and a unique identifier sent from a source base station for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; means for determining the security key using the unique identifier (Figure 5)

Description

[0001] APPARATUS, COMPUTER PROGRAM AND METHOD

[0002] TECHNICAL FIELD

[0003] Various example embodiments relate generally to security key generation. Some examples relate to Non-Terrestrial Networks (NTNs).

[0004] BACKGROUND

[0005] In some NTN environments, a User Equipment (UE) may undergo a handover (HO) procedure from one NTN cell to another NTN cell. In some cases, both cells may have the same Physical Cell Identity.

[0006] BRIEF DESCRIPTION

[0007] According to an aspect of the invention, there is provided a user equipment comprising means for receiving an indication and a unique identifier sent from a source base station for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; means for determining the security key using the unique identifier.

[0008] According to some examples, the indication and the unique identifier are received while the user equipment is in a connected radio resource control mode.

[0009] According to some examples, the indication and the unique identifier are received in a radio resource control, RRC, message from the source base station.

[0010] According to some examples, the indication and the unique identifier are sent from the source base station to the target base station, wherein the indication and the unique identifier are received from the target base station. According to some examples, the user equipment comprises: means for receiving a handover command message sent from the target base station via the source base station, the handover command message comprising the indication, the unique identifier and Next Hop Chaining Counter, NCC, information, where the indication, the unique identifier and the NCC information are included as plain text in the handover command message and the rest of the handover command message is protected by the security key.

[0011] According to some examples, the source base station and the target base station have a same Physical Cell Identity, PCI.

[0012] According to some examples, the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key.

[0013] According to an aspect of the invention, there is provided a method comprising: receiving, an indication and a unique identifier sent from a source base station for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; determining the security key using the unique identifier.

[0014] According to some examples, the indication and the unique identifier are received while the user equipment is in a connected radio resource control mode.

[0015] According to some examples, the indication and the unique identifier are received in a radio resource control, RRC, message from the source base station.

[0016] According to some examples, the indication and the unique identifier are sent from the source base station to the target base station, wherein the indication and the unique identifier are received from the target base station. According to some examples, the method comprises: receiving a handover command message sent from the target base station via the source base station, the handover command message comprising the indication, the unique identifier and Next Hop Chaining Counter, NCC, information, where the indication, the unique identifier and the NCC information are included as plain text in the handover command message and the rest of the handover command message is protected by the security key.

[0017] According to some examples, the source base station and the target base station have a same Physical Cell Identity, PCI.

[0018] According to some examples, the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key.

[0019] According to an aspect of the invention, there is provided a computer program product embodied on a distribution medium readable by a computer and comprising program instructions which, when loaded into an apparatus, execute a method comprising: receiving, an indication and a unique identifier sent from a source base station for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; determining the security key using the unique identifier.

[0020] According to an aspect of the invention, there is provided an apparatus comprising at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to perform: receiving, an indication and a unique identifier sent from a source base station for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; determining the security key using the unique identifier.

[0021] According to an aspect of the invention, there is provided an apparatus comprising: means for sending an indication and a unique identifier to a user equipment for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station.

[0022] According to some examples, the indication and the unique identifier are sent while the user equipment is in a connected radio resource control mode.

[0023] According to some examples, the apparatus comprises: means for determining the security key for the handover using the unique identifier.

[0024] According to some examples, the indication and the unique identifier are sent to the user equipment in a radio resource control message.

[0025] According to some examples, the apparatus comprises: means for receiving the indication and the unique identifier in a handover request from the source base station; wherein the indication and the unique identifier are sent to the user equipment via the source base station in a handover command message from the apparatus.

[0026] According to some examples, the handover command message comprises: the indication, the unique identifier and Next Hop Chaining Counter, NCC, information, where the indication, the unique identifier and the NCC information are included as plain text in the handover command message and the rest of the handover command message is protected by the security key.

[0027] According to some examples, the apparatus comprises: means for detecting that the NTN handover comprises a handover in which the Physical Cell Identity, PCI, does not change. According to some examples, the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key.

[0028] According to an aspect of the invention, there is provided a method comprising: sending an indication and a unique identifier to a user equipment for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station.

[0029] According to some examples, the indication and the unique identifier are sent while the user equipment is in a connected radio resource control mode.

[0030] According to some examples, the apparatus comprises: means for determining the security key for the handover using the unique identifier.

[0031] According to some examples, the indication and the unique identifier are sent to the user equipment in a radio resource control message.

[0032] According to some examples, the method comprises: receiving the indication and the unique identifier in a handover request from the source base station; wherein the indication and the unique identifier are sent to the user equipment via the source base station in a handover command message from the apparatus.

[0033] According to some examples, the handover command message comprises: the indication, the unique identifier and Next Hop Chaining Counter, NCC, information, where the indication, the unique identifier and the NCC information are included as plain text in the handover command message and the rest of the handover command message is protected by the security key.

[0034] According to some examples, the method comprises: detecting that the NTN handover comprises a handover in which the Physical Cell Identity, PCI, does not change.

[0035] According to some examples, the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key. According to an aspect of the invention, there is provided a computer program product embodied on a distribution medium readable by a computer and comprising program instructions which, when loaded into an apparatus, execute a method comprising: sending an indication and a unique identifier to a user equipment for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station.

[0036] According to an aspect of the invention, there is provided an apparatus comprising at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to perform: sending an indication and a unique identifier to a user equipment for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station.

[0037] According to an aspect of the invention there is provided a user equipment comprising: means for receiving an indication and a unique identifier sent from a network entity for a non-terrestrial network, NTN, handover of the user equipment, wherein the indication indicates that the network entity has used the unique identifier to determine a security key for the handover, wherein the security key is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; means for determining the security key using the unique identifier. According to some examples, the indication and the unique identifier are received while the user equipment is in a connected radio resource control mode.

[0038] According to some examples, the indication and the unique identifier are received in a radio resource control message from the source base station.

[0039] According to some examples, the indication and the unique identifier are sent from the network entity to the source base station in an NG Application Protocol, NGAP, message, wherein the indication and the unique identifier are received from the source base station in a radio resource control RRC, message.

[0040] According to some examples, the source base station and the target base station have a same Physical Cell Identity, PCI.

[0041] According to some examples, wherein the notification comprises a bit mask and wherein the user equipment comprises: means for decoding the bit mask to determine that the network entity has used the unique identifier to determine a security key for the handover.

[0042] According to some examples, the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key.

[0043] According to an aspect of the invention, there is provided a method comprising: receiving an indication and a unique identifier sent from a network entity for a non-terrestrial network, NTN, handover of the user equipment, wherein the indication indicates that the network entity has used the unique identifier to determine a security key for the handover, wherein the security key is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; means for determining the security key using the unique identifier.

[0044] According to some examples, the indication and the unique identifier are received while the user equipment is in a connected radio resource control mode.

[0045] According to some examples, the indication and the unique identifier are received in a radio resource control message from the source base station. According to some examples, the indication and the unique identifier are sent from the network entity to the source base station in an NG Application Protocol, NGAP, message, wherein the indication and the unique identifier are received from the source base station in a radio resource control RRC, message.

[0046] According to some examples, the source base station and the target base station have a same Physical Cell Identity, PCI.

[0047] According to some examples, wherein the notification comprises a bit mask and the method comprises: decoding the bit mask to determine that the network entity has used the unique identifier to determine a security key for the handover.

[0048] According to some examples, the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key.

[0049] According to an aspect of the invention, there is provided a computer program product embodied on a distribution medium readable by a computer and comprising program instructions which, when loaded into an apparatus, execute a method comprising: receiving an indication and a unique identifier sent from a network entity for a non-terrestrial network, NTN, handover of the user equipment, wherein the indication indicates that the network entity has used the unique identifier to determine a security key for the handover, wherein the security key is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; means for determining the security key using the unique identifier.

[0050] According to an aspect of the invention, there is provided an apparatus comprising at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to perform: receiving an indication and a unique identifier sent from a network entity for a non-terrestrial network, NTN, handover of the user equipment, wherein the indication indicates that the network entity has used the unique identifier to determine a security key for the handover, wherein the security key is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; means for determining the security key using the unique identifier.

[0051] According to an aspect of the invention there is provided an apparatus comprising: means for receiving a message from a source base station for a nonterrestrial network, NTN, handover of a user equipment, the message indicating that the source base station and a target base station have the same Physical Cell Identity, PCI; means for determining a security key for the handover using a unique identifier, wherein the security key is used for protecting data packets sent between a cell of the target base station :and the user equipment, and wherein the unique identifier comprising at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; means for sending, to the source base station, an indication that the unique identifier was used to determine the security key and the target base station identifier or the identifier of the satellite of the target base station or any other unique identifier.

[0052] According to some examples, the source base station and the target base station have a same Physical Cell Identity, PCI.

[0053] According to some examples, the indication that the unique identifier was used to determine the security key and the target base station identifier or the identifier of the satellite of the target base station is sent to the source base station in an NG Application Protocol. NGAP, message.

[0054] According to some examples, the apparatus comprises an Access and Mobility Management Function, AMF.

[0055] According to some examples, the notification comprises a bit mask.

[0056] According to some examples, the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key.

[0057] According to an aspect of the invention, there is provided a method comprising: receiving a message from a source base station for a non-terrestrial network, NTN, handover of a user equipment, the message indicating that the source base station and a target base station have the same Physical Cell Identity, PCI; determining a security key for the handover using a unique identifier, wherein the security key is used for protecting data packets sent between a cell of the target base station :and the user equipment, and wherein the unique identifier comprising at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; sending, to the source base station, an indication that the unique identifier was used to determine the security key and the target base station identifier or the identifier of the satellite of the target base station or any other unique identifier.

[0058] According to some examples, the source base station and the target base station have a same Physical Cell Identity, PCI.

[0059] According to some examples, the indication that the unique identifier was used to determine the security key and the target base station identifier or the identifier of the satellite of the target base station is sent to the source base station in an NG Application Protocol. NGAP, message.

[0060] According to some examples, the apparatus comprises an Access and Mobility Management Function, AMF.

[0061] According to some examples, the notification comprises a bit mask.

[0062] According to some examples, the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key.

[0063] According to an aspect of the invention, there is provided a computer program product embodied on a distribution medium readable by a computer and comprising program instructions which, when loaded into an apparatus, execute a method comprising: receiving a message from a source base station for a non-ter- restrial network, NTN, handover of a user equipment, the message indicating that the source base station and a target base station have the same Physical Cell Identity, PCI; determining a security key for the handover using a unique identifier, wherein the security key is used for protecting data packets sent between a cell of the target base station :and the user equipment, and wherein the unique identifier comprising at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; sending, to the source base station, an indication that the unique identifier was used to determine the security key and the target base station identifier or the identifier of the satellite of the target base station or any other unique identifier.

[0064] According to an aspect of the invention, there is provided an apparatus comprising at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to perform: receiving a message from a source base station for a non-terrestrial network, NTN, handover of a user equipment, the message indicating that the source base station and a target base station have the same Physical Cell Identity, PCI; determining a security key for the handover using a unique identifier, wherein the security key is used for protecting data packets sent between a cell of the target base station :and the user equipment, and wherein the unique identifier comprising at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; sending, to the source base station, an indication that the unique identifier was used to determine the security key and the target base station identifier or the identifier of the satellite of the target base station or any other unique identifier.

[0065] According to an aspect of the invention there is provided an apparatus comprising: means for determining that a target base station for a non-terrestrial network, NTN, handover of a user equipment has the same Physical Cell Identity as the apparatus; means for sending a message to a network entity to indicate that the NTN handover of the user equipment is required and that the target base station has the same PCI as the apparatus; means for receiving, from the network entity, a unique identifier and an indication that a unique identifier was used to determine a security key, wherein the security key is used for protecting data packets sent between a cell of the target base station and the user equipment, and wherein the unique identifier comprises at least one of: a target base station, an identifier of the satellite of the target base station, or any other unique identifier of the target base station; means for sending the indication and the unique identifier to the user equipment.

[0066] According to some examples, the indication and the unique identifier are sent to the user equipment while the user equipment is in a connected radio resource control mode. According to some examples, the indication and the unique identifier are sent to the user in a radio resource control message.

[0067] According to some examples, the apparatus comprises: means for receiving Next Hop Chaining Counter, NCC information from the network entity; wherein the indication and the unique identifier are sent to the user equipment with the NCC information.

[0068] According to some examples, the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key.

[0069] According to an aspect of the invention, there is provided a method comprising: determining that a target base station for a non-terrestrial network, NTN, handover of a user equipment has the same Physical Cell Identity as an apparatus performing the method; sending a message to a network entity to indicate that the NTN handover of the user equipment is required and that the target base station has the same PCI as the apparatus; receiving, from the network entity, a unique identifier and an indication that a unique identifier was used to determine a security key, wherein the security key is used for protecting data packets sent between a cell of the target base station and the user equipment, and wherein the unique identifier comprises at least one of: a target base station, an identifier of the satellite of the target base station, or any other unique identifier of the target base station; sending the indication and the unique identifier to the user equipment.

[0070] According to some examples, the indication and the unique identifier are sent to the user equipment while the user equipment is in a connected radio resource control mode.

[0071] According to some examples, the indication and the unique identifier are sent to the user in a radio resource control message.

[0072] According to some examples, the apparatus comprises: receiving Next Hop Chaining Counter, NCC information from the network entity; wherein the indication and the unique identifier are sent to the user equipment with the NCC information.

[0073] According to some examples, the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key. According to an aspect of the invention, there is provided a computer program product embodied on a distribution medium readable by a computer and comprising program instructions which, when loaded into an apparatus, execute a method comprising: determining that a target base station for a non-terrestrial network, NTN, handover of a user equipment has the same Physical Cell Identity as an apparatus performing the method; sending a message to a network entity to indicate that the NTN handover of the user equipment is required and that the target base station has the same PCI as the apparatus; receiving, from the network entity, a unique identifier and an indication that a unique identifier was used to determine a security key, wherein the security key is used for protecting data packets sent between a cell of the target base station and the user equipment, and wherein the unique identifier comprises at least one of: a target base station, an identifier of the satellite of the target base station, or any other unique identifier of the target base station; sending the indication and the unique identifier to the user equipment.

[0074] According to an aspect of the invention, there is provided an apparatus comprising at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to perform: determining that a target base station for a non-terrestrial network, NTN, handover of a user equipment has the same Physical Cell Identity as an apparatus performing the method; sending a message to a network entity to indicate that the NTN handover of the user equipment is required and that the target base station has the same PCI as the apparatus; receiving, from the network entity, a unique identifier and an indication that a unique identifier was used to determine a security key, wherein the security key is used for protecting data packets sent between a cell of the target base station and the user equipment, and wherein the unique identifier comprises at least one of: a target base station, an identifier of the satellite of the target base station, or any other unique identifier of the target base station; sending the indication and the unique identifier to the user equipment.

[0075] Some embodiments of the invention are defined in the dependent claims.

[0076] LIST OF THE DRAWINGS In the following, the invention will be described in greater detail with reference to the embodiments and the accompanying drawings, in which

[0077] Fig. 1 shows an example of a communication network to which examples disclosed herein may be applied;

[0078] Fig. 2 shows an example of a Conditional HO (CHO) procedure;

[0079] Fig. 3 shows an example NTN regenerative payload;

[0080] Fig. 4 shows an example scenario where a security key for a HO may be determined incorrectly;

[0081] Fig. 5 shows a method for providing information such that a secuirty key for a HO can be determined correctly;

[0082] Fig. 6 shows a second method for providing information such that a secuirty key for a HO can be determined correctly;

[0083] Fig. 7 shows a third method for providing information such that a secuirty key for a HO can be determined correctly;

[0084] Fig. 8 shows an example of a method;

[0085] Fig. 9 shows an example of a method;

[0086] Fig. 10 shows an example of a method;

[0087] Fig. 11 shows an example of a method;

[0088] Fig. 12 shows an example of a method;

[0089] Fig. 13 shows an example of an apparatus.

[0090] DESCRIPTION OF EMBODIMENTS

[0091] The following embodiments are exemplary. Although the specification may refer to “an”, “one”, or “some” embodiment(s) in several locations of the text, this does not necessarily mean that each reference is made to the same embodiment's), or that a particular feature only applies to a single embodiment. Single features of different embodiments may also be combined to provide other embodiments. Further, when a particular feature, structure, or characteristic is described in connection of an embodiment, it is within the knowledge of one skilled in the art to apply such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described. It shall be understood that although the terms “first,” “second” and the like may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another.

[0092] For the purposes of the present disclosure, the phrases “at least one of A or B”, “at least one of A and B”, and “A and / or B” means (A), (B), or (A and B). For the purposes of the present disclosure, the phrase “A, B, and / or C” means (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C).

[0093] Embodiments described may be implemented in a communication network, such as any of the following radio access technologies (RATs): Worldwide Interoperability for Micro-wave Access (WiMAX), Global System for Mobile communications (GSM, 2G), GSM EDGE radio access Network (GERAN), General Packet Radio Service (GRPS), Universal Mobile Telecommunication System (UMTS, 3G) based on basic wideband-code division multiple access (W-CDMA), high-speed packet access (HSPA), Long Term Evolution (LTE), LTE-Advanced, and enhanced LTE (eLTE), 5G (also called NR), or any future RAT such as 6G. Moreover, communication within the communication network may utilize any proper wireless communication technology, comprising but not limited to: Code Division Multiple Access (CDMA), Frequency Division Multiple Access (FDMA), Time Division Multiple Access (TDMA), Frequency Division Duplex (FDD), Time Division Duplex (TDD), Multiple-Input Multiple-Output (M1M0), Orthogonal Frequency Division Multiple (OFDM), and / or Discrete Fourier Transform spread OFDM (DFT-s-OFDM).

[0094] As used herein, the term “network device” or “network node” refers to a node in a communication network via which user equipment may access the network and / or which is capable of controlling radio communication and managing radio resources within a cell. The network node or network device may be referred to as a base station (BS), an access point (AP) or an access node. The network device may be, depending on the applied technology, for example, a node B (NodeB or NB), an evolved NodeB (eNodeB or eNB), an NR NB (also referred to as a gNB), a Remote Radio Unit (RRU), a radio head (RH), a remote radio head (RRH), a relay, an Integrated Access and Backhaul (1AB) node, a low power node, a non-terrestrial network (NTN) or non-ground network device such as a satellite network device, a low earth orbit (LEO) satellite and a geosynchronous earth orbit (GEO) satellite, or an aircraft network device. Moreover, in connection of split radio access network (RAN), the network device may refer to a centralised unit (CU) of a base station and / or a distributed unit (DU) of a base station. An interface between CU and DU may be referred to as an Fl interface in NR. In the split RAN architecture, node operations may be carried out, at least partly, in the central / centralized unit, CU, (e.g. server, host or node) operationally coupled to the DU, (e.g. a radio head / node). One CU may control one or more DUs, acting at least as transmit / receive (Tx / Rx) nodes. In some embodiments, the DUs may comprise e.g. a radio link control (RLC), medium access control (MAC) layer and a physical (PHY) layer, whereas the CU may comprise the layers above RLC layer, such as a packet data convergence protocol (PDCP) layer, a radio resource control (RRC) and an internet protocol (IP) layers. Other functional splits are possible too. In practice, any processing task may be performed in either the CU or the DU and the boundary where the responsibility is shifted between the CU and the DU may depend on the applied implementation.

[0095] The term “terminal device” refers to any end device that may be capable of wireless communication. By way of example, a terminal device may be referred to as a communication device, user equipment (UE), a Subscriber Station (SS), or a Mobile Station (MS). The terminal device may include a mobile phone, a cellular phone, a smart phone, voice over IP (VoIP) phones, wireless local loop phones a tablet, a wearable terminal device, a personal digital assistant (PDA), portable computers, desktop computer, image capture terminal devices such as digital cameras, gaming terminal devices, music storage and playback appliances, vehicle-mounted wireless terminal devices, USB dongles, an Internet of Things (loT) device, a watch or other wearable, a head-mounted display (HMD), a vehicle, a drone, a medical device and applications (e.g., remote surgery), an industrial device and applications (e.g., a robot and / or other wireless devices operating in an industrial and / or an automated processing chain contexts), a consumer electronics device, a device operating on commercial and / or industrial wireless networks, and the like.

[0096] A term “resource”, as used herein, may refer to radio resources in time domain, in frequency domain, in space domain, and / or in code domain. Some examples of resources include e.g. a physical resource block (PRB), a radio frame, a subframe, a time slot, a subband, a frequency region, a sub-carrier, a beam, etc. The term “transmission” and / or “reception” may refer to wirelessly transmitting and / or receiving via a wireless propagation channel on radio resources.

[0097] Fig. 1 illustrates an example of a communication network to which examples disclosed herein may be applied. The communication network or a cellular communication network may comprise a network node 110 providing one or more cells, such as cell 100, and a network node 112 providing one or more other cells, such as cell 102. Each cell may be, e.g., a macro cell, a micro cell, femto, or a pico cell, for example. The cell may define a coverage area or a service area of the corresponding access node.

[0098] The network node 110 may provide a user equipment (UE) 120 (one or more UEs) with wireless access to the communication network. The wireless access may comprise downlink (DL) communication from the network node to the UE 120 and uplink (UL) communication from the UE 120 to the network node. Examples of uplink channels comprise physical uplink control channel (PUCCH) for transmitting control information and physical uplink shared channel (PUSCH) for transmitting data towards the network. Examples of downlink channels comprise physical downlink control channel (PDCCH) for transmitting control information and physical downlink shared channel (PDSCH) for transmitting data towards the user equipment.

[0099] There may be a plurality of UEs 120, 122 in the system. Each of them may be served by the same or by different network nodes 110, 112. UE may be configured with dual connectivity (DC), wherein the UE, e.g. UE 120, may be connected to multiple network nodes 110, 112. The UEs 120, 122 may communicate with each other, in case device-to-device (D2D) communication interface is established between them via a so-called sidelink (SL). Such D2D communications may be referred to as machine-to-machine, peer-to-peer (P2P) communications, or ve- hicle-to-vehicle (V2V), for example.

[0100] In the case of multiple network nodes in the communication network, the network nodes may be connected to each other via an interface. LTE specifications call such an interface as X2 interface. An interface between an LTE node and a 5G node, or between two 5G nodes may be called Xn interface.

[0101] The network nodes 110 and 112 may be further connected via another interface to a core network 116 of the communication network. The LTE specifications specify the core network as an evolved packet core (EPC), and the core network may comprise e.g. a mobility management entity (MME) and a gateway node. The MME may handle mobility of terminal devices in a tracking area encompassing a plurality of cells and handle signalling connections between the terminal devices and the core network. The gateway node may handle data routing in the core network and to / from the terminal devices. The 5G specifications specify the core network as a 5G core (5GC). The 5G core may comprise e.g. an access and mobility management function (AMF) and a user plane function / gateway (UPF) and other functions. The AMF may handle termination of non-access stratum (NAS) signalling, NAS ciphering & integrity protection, registration management, connection management, mobility management, access authentication and authorization, security context management. The UPF node may support packet routing and forwarding, packet inspection and quality of service (QoS) handling, for example.

[0102] Conditional handover (CHO) is described in 3GPP ReL 16, with the CHO procedure being a way to improve mobility robustness. CHO is further developed in ReL 17 and will continue to evolve in future 3GPP releases. In the case of CHO, the RAN network may prepare multiple target cells, where each conditional handover reconfiguration is associated with a CHO execution condition that is evaluated by the UE. The CHO execution condition refers to a measurement ID (associating a measurement object with a reporting configuration) and is configured by a source gNB. The reporting configuration defines the measurement event (A3 or A5), which triggers the CHO execution. Whenever a CHO execution condition is met, the corresponding target configuration is selected, and handover is executed towards the selected target cell.

[0103] CHO may also take place with dual connectivity, in order to further increase mobility robustness and achieve a smooth handover. In reference to this, mention is made to Primary Secondary Cells (PSCells), Primary Cells (PCells), and Secondary Cells (SCells). The following will outline features of PSCells in relation to 5G New Radio, using terminology found therein. However, it is understood that the presently described principles are not limited to such terminology and may be applied to other systems having a similar architecture. For example, in multi-radio- dual connectivity (MR-DC), a Primary Cell (PCell) may be a Long Term Evolution (LTE) cell (e.g., Evolved-Universal Terrestrial Radio Access-New Radio-dual connectivity (EN-DC)).

[0104] PSCells are a type of cell currently defined in 5G New Radio, along with Primary Cells (PCells), Secondary Cells (SCells) and Special Cells (SpCells). A PCell may be used as part of an initial access between a UE and an access network and is considered to be a main cell in a master cell group (MCG). A PSCell may be comprised as part of a secondary cell group (SCG). The SpCells and SCells may be in at least one of the MCG and the SCG.

[0105] The cells may be controlled by network nodes. There are two different types of network nodes in 5G New Radio: Master nodes (which provide a control plane connection to a core network); and Secondary Nodes (which do not have control plane connections to the core network). The Master and Secondary nodes may both provide user plane (e.g., data) connections to the core network. The Master node may control the PCell. In addition to the PCell, the Master node may control at least one PSCell, although this is not always the case. The Secondary node may control at least one PSCell.

[0106] The signalling procedure for CHO is shown in Figure 2, with reference to the network schematically illustrated in Figure 1.

[0107] A UE 120 is served by a source cell 100 with gNB 110 providing access to the source cell 100. In step 1, the UE 120 sends a measurement report to the serving network gNB 110 to initiate the CHO preparation of target cell 102 served by the gNB 112. In step 2, the source gNB 110 sends a CHO request to the target gNB 112. In step 3, target gNB 112 sends a CHO Acknowledge message to gNB 110 to acknowledge the CHO request from source cell 100 to target 102. The source cell 100 prepares the target cell 102 and sends to the UE 120 the CHO configuration, along with the CHO execution condition with RRCReconfiguration message in step 4.

[0108] In step 5, once the CHO execution condition against target cell 102 is met, the UE 120 detaches from source gNB 110: i.e.; stops transmission / reception to / from source cell 100. In step 6, the UE 120 initiates the random access procedure towards target cell 102 by sending a PRACH Preamble message to the gNB 112 serving the target cell 102. gNB 112 responds in step 7 by sending a RACH Response message back to the gNB 110 serving the source cell 100. In step 8, the UE 120 sends the RRC Reconfiguration Complete message to the gNB 112 in the target cell 102. Once the random access procedure is completed successfully, target cell 102 notifies source cell 100 about successful completion of the handover procedure by sending a Handover Success message from source gNB 110 to target gNB 112 in step 9.

[0109] In step 10, upon receiving the handover success indication from target gNB 112, source gNB 110 initiates data forwarding to target gNB112 serving target cell 102. Once the data forwarding and path switch procedure is completed with the new data path from the UE 120 to the core network 116, the UE 120 will continue its data transmission / reception with the network.

[0110] Some examples provide enhancements to the security framework for RRC_CONNECTED state UEs connected to NTN regenerative earth fixed cells (EFC) in unchanged PCI deployment.

[0111] An example of typical NTN regenerative payload with a gNB onboard a satellite scenario is shown in Fig. 3. An NG-RAN network may be provided for UE 320a and UE 320b. In some examples, UE 320a and 320b may be the same UE being handed over between base station 312 and base station 310. These base stations may each comprise a gNB. Base stations 310 and 312 may have connectivity over an Xn interface. The Xn interface may comprise an inter satellite link (ISL). Base stations 310 and 312 may respectively interact via NTN gateways 318a and 318b over an NG over Satellite Radio Interface with Core Network (CN) nodes 320a and 320b . CN node 320a may interact with Data Network 322a over an N6 interface, and CN node 320b may interact with Data Network 322b over an N6 interface. When handing over between base station 310 and base station 312, the PCI may remain unchanged.

[0112] To achieve different service scenarios (such as those listed in 3GPP TS 22.261, e.g., users in residential homes, in vehicles, in high-speed trains or onboard airplanes etc.), and to achieve the targeted service performances in terms of data rate and / or reliability; a UE may access the network in single connectivity mode or in dual connectivity mode if configured by the network to access two different networks with overlapping radio coverage. 3GPP TR 38.821 has listed some multi-connectivity use-cases that may be relevant for NTN.

[0113] In Rel-18 NTN, it was agreed to support unchanged PCI for NTN transparent architecture scenarios, with the motivation to avoid HO during satellite switch; for scenarios involving hard switch with no overlapping coverage.

[0114] For the NTN Regenerative payload scenario as shown in Fig. 3, with each satellite 310 and 312 connected to its neighbor via Xn interface link over 1SL; mobility resulting from satellite movement or UE movement shall result in an Xn HO.

[0115] For the Xn HO, the security key computation is currently as follows:

[0116] • The source gNB shall compute key KNG-RAN* from target cell PCI, target cell Absolute Radio Frequency Channel Number - Down Link (ARFCN-DL) and either using current active KgNB (in the case of Horizontal key derivation) or using the Next Hop (NH) (in the case of vertical key derivation).

[0117] • The source gNB shall forward {KNG-RAN*, Next Hop Chaining Counter (NCC)} pair to the target gNB. And the target gNB directly uses the received KNG-RAN*, as KgNB to be used with the UE.

[0118] • The target gNB associates the NCC value received from source gNB with the KgNB and includes the NCC into the prepared HO command message, which is forwarded to the UE via source gNB in a transparent container.

[0119] • After UE connects to the target, the target initiates the PATH SWITCH REQUEST towards the AMF; the AMF shall increment its locally kept NCC value by one and compute a new NH from its stored data using the function defined in Annex A.10 of 3GPP TS33.501.

[0120] • The AMF shall use the KAMF from the currently active 5G NAS security context for the computation of the new fresh NH.

[0121] • The AMF shall include the newly computed {NH, NCC) pair in the Path Switch Request Ack; the target gNB stores the received {NH, NCC) value for subsequent HO.

[0122] However, in PCI unchanged NTN Regenerative EFC scenario for both single and dual connectivity, the above methods does not work, as explained in Fig. 4. In NTN regenerative EFC deployments with PCI unchanged, the UE may not be aware of the security key derivation principle used at the radio access network i.e. UE would be unaware if the network has used an enhanced method for security key derivation for e.g. mobility between NTN-NTN with EFC and unchanged PCI or the legacy security key derivation method if the mobility for e.g. is between NTN-Terrestrial Network (TN) where the target cell is TN and would have a fixed PCI.

[0123] Without UE being informed about the security key derivation principle and the necessary additional input parameter(s) being used by the network to derive the new target cell security key, the UE may attempt generating the key that may not be consistent with the radio access network, which may result in HO procedure failure.

[0124] A security key for a handover may be used to protect data packets sent between a target cell and a user equipment. The security key may be used to derive at least one RRC key and / or at least one user plane (UP) key.

[0125] FIG. 4 captures the scenario associated with this problem.

[0126] At 401, UE 420 is an RRC_CONNECTED and a Connection Management connected (CM-CONNECTED) state.

[0127] At 403, user data is sent from UPF to the last serving base station 412 for UE 420. The last serving base station may comprise a gNB. The last serving base station may be onboard a satellite, e.g., a Non-Geostationary Satellite Orbit (NGSO) satellite. At 405 user data is sent from base station 412 to UE 420. Xn connectivity is assumed between consecutive base stations 412 and 410 in the satellite orbit, as shown at 407.

[0128] At 409, at time T, base station 412 serves the cell. At 411, at time T+Tl, base station 2 serves the cell. At 413, a decision to perform a CHO is made by base station 412. The serving base station (serving node) is aware that the PCI of the target cell will be the same, as shown at 415. At 417, base station 412 generates a secuirty key for the target cell using additional parameters, as the target PCI is unchanged.

[0129] At 419, base station 412 sends a handover request with Access Stratum (AS) security key info, including key KNG_RAN* and NCC. At 421, base station 410 performs admission control and base station 410 then sends, at 423, an acknowledgement to the request sent at 419, the acknowledgment including a HO command (cmd) with target cell security key and target cell configuration.

[0130] At 425, an RRC reconfiguration message is sent from base station 412 to UE 410. The message may include the HO cmd and the target cell configuration.

[0131] At 427, UE 420 is not aware of the method used by the RAN for security key derivation of the target cell. The UE may use a legacy security key derivation method based on PCI, without including the additional parameters included by base station 412 due to the unchanged PCI. At 429, UE 420 indicates to base station 412 that RRC reconfiguration is complete. At 431, due to lack of synchronization in secuirty key generation between UE 420 and base station 412, the HO procedure may fail.

[0132] Examples described herein provide an indication to a UE which can assist the UE to determine to use a correct method for key derivation.

[0133] A first example is shown in Fig. 5. In an HO between two NTN Regenerative payload satellites with EFC and unchanged PCI deployment, Xn connectivity between the satellites is assumed; further, in this scenario, the source satellite node shall be aware that the PCI shall be unchanged after satellite switch. Furthermore, the serving network shall also be aware of the UE’s capability to access NTN network and the supported features.

[0134] In the first example, given that the serving satellite node knows that the scenario is unchanged PCI, after satellite switch, it uses an enhanced method to generate security key of the target cell and includes the KNG-RAN* in the HO Request message. The target node associates the received KNG-RAN* with the NCC received in HO Request and stores the KNG-RAN* and uses it as KgNB to communicate with the UE when it connects to the target cell. The target includes the NCC received in HO Request in the HO command that the target prepares. The HO Request Ack shall include the HO command and the prepared target cell configuration, which is signalled to the UE via RRCReconfigurationRequest message transparently by the serving node. The RRCReconfigurationRequest message includes KEY_GENERAT1ON_OPT1ON flag and the unique identifier used by the source node to generate the target cell security key. As used herein, the KEY_GENERATION_OPTION flag may be considered to comprise an indicate of how the source base station has determined a secuirty key. The flag may indicate, a unique identifier of the target base station was used to generate the secuirty key. The unique identifier of the target base station may comprise at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station. The UE shall use the ‘KEY_GENERAT10N_0PT10N flag’ and the received unique identifier (target satellite gNB Id or satellite Id or any other unique identifier) to generate the new security key.

[0135] A second example is shown in Fig. 6. This example differs from the example of Figure 5 in that the serving satellite node includes the KEY_GENERA- T10N_0PT10N flag and the unique identifier used by the source node to generate the target cell security key (KNG-RAN*) in the HO Request message. The target satellite node prepares the HO command by including the NCC, KEY_GENERA- T10N_0PT10N flag and the unique identifier received in the HO Request message. Then according to a first option, NCC and KEY_GENERAT10N_0PT10N flag is alone included as plain text (as it is not sensitive information) and rest of the HO request message can be protected with new key KNG-RAN* and UE can generate the new key using plain text content. In a second option all HO command messages are integrity protected from the target Satellite and UE could use those new parameters to generate the new key and will verify the integrity protection of the message

[0136] In the second example of Fig. 6, the serving node may not include the KEY_GENERAT1ON_OPT1ON flag and the unique identifier used by the source node to generate the target cell security key in the RRC Reconfiguration message.

[0137] A third example is shown in Fig. 7. This example is for an N2 HO, rather than an Xn HO as in Fig. 5 and 6. The serving NTN satellite node may include “UNCHANGED_PC1_NTN_EFC_SCENAR1O” flag in NGAP to AMF: Handover Required message. The AMF may use “UNCHANGED_PC1_NTN_EFC_SCENAR1O” flag to prepare the new security key for the target satellite node either using enhanced security key generation method or the legacy security key generation method. The AMF may then include “KEY_GENERAT1ON_OPT1ON” flag, along with NH and NCC in the NGAP: Handover Request message sent to the target satellite node. The AMF can include the “KEY_GENERAT1ON_OPT1ON” flag in the NGAP: Handover Command message sent to the serving node, which carries the HO command. The “KEY_GENERATION_OPTION” flag indicates the security key computation method used by the AMF to generate the new security key. The serving node includes the “KEY_GENERAT1ON_OPT1ON” flag received in the NGAP: Handover Command message into the RRCReconfigurationRequest message. The UE can then use the “KEY_GENERAT1ON_OPT1ON” flag to apply the appropriate key generation method. In some examples, the “KEY_GENERAT1ON_OPT1ON” may be a bit mask if the AMF uses an additional unique parameter for new key computation; such that the UE decodes the bitmask and apply appropriate unique identifier to generate the new security key.

[0138] Each of the above three examples is discussed in detail below, with reference to the corresponding figure.

[0139] Fig. 5 shows a first method for an Xn HO. At 501 of Fig. 5, UE 520 is in an RRC connected state and in a CM CONNECTED state.

[0140] At 503 and 505, user data may be sent bidirectionally between UE 520 and UPF 516b via source base station 512. Source base station 512 may comprise a gNB. The base station may be located on an NGSO satellite.

[0141] At 507, there is Xn connectivity between the consecutive base stations in the satellite orbit.

[0142] At 509, source base station 512 configures the UE measurement procedures and the UE reports according to the measurement configuration. At 511, the source base station 512 decides to handover UE 520 to target base station 510, based on Measurement Report and Radio Resource Management (RRM) information.

[0143] At 513, serving base station 512 requests CHO for one or more candidate cells belonging to one or more candidate gNBs, including base station 510.

[0144] At 515, serving base station 512 knows that it is an Earth Fixed Cell and so the PCI is same for the target base station 510. Target base station 510 may comprise a gNB. Target base station 510 may be located on an NGSO satellite. At 519, a CHO request message is sent for each candidate cell, with one cell being the cell of base station 510. AS security key information, KNG-RAN* and NCC is sent to base station 510.

[0145] At 521, Admission Control may be performed by the target base station 510. Slice-aware admission control may also be performed if slice information is sent to the target base station 510. If the data sessions (e.g., PDU sessions) are associated with non-supported slices, the target base station 510 can reject such PDU Sessions.

[0146] At 523, target base station prepares the handover (e.g., with L1 / L2) and sends a handover request acknowledgement message (HANDOVER REQUEST ACKNOWLEDGE) to the source base station, which may include a transparent container to be sent to the UE as an RRC message to perform the handover.

[0147] At 525, source base station 512 reconfigures UE 520 with the prepared target cells configuration using an RRC reconfiguration message (RRCRe- configurationRequest). In the message, source base station includes the KEY_GENERAT1ON_OPT1ON and a unique identifier that the source node has used to generate the new target cell security key (e.g. gNBJD, SATELLITE ID, an identifier of the target base station, any other unique identifier of the target base station).

[0148] At 527, UE 520 may use the KEY_GENERAT1ON_OPT1ON flag to derive the new key using the included unique identifier in the RRC reconfiguration message of 525.

[0149] At 529, UE 520 sends an RRCReconfigurationComplete message to source base station 512.

[0150] At 531, UE 520 maintains connection with the source base station after receiving CHO configuration and starts evaluating the CHO execution conditions for the candidate cell(s). At 533 and 535, if at least one CHO candidate cell satisfies the corresponding CHO execution condition, UE 520 detaches from the source base station 512, applies the stored corresponding configuration for that selected candidate cell, synchronizes to that candidate cell and completes the RRC handover procedure by sending RRCReconfigurationComplete message to the target base station at 539. UE 520 may release stored CHO configurations after successful completion of RRC handover procedure.

[0151] 541 to 549 are similar to steps described in Figure 9.2.3.2.1-1 of 3GPP TS 38.300 clause 9.2.3.2.1. At 541, a HO success indication is sent from target base station 510 to source base station 512. DL data is sent from AMF 516a to source base station 512 at 543. At 545, a path switch request is sent from target base station 510 to AMF 516a, and a response is sent at 547. DL data may be sent from AMF 516a to target base station 510 at 549.

[0152] Fig. 6 shows a second method for an Xn HO. At 601 of Fig. 6, UE 620 is in an RRC connected state and in a CM CONNECTED state.

[0153] At 603 and 605, user data may be sent bidirectionally between UE 620 and UPF 616b via source base station 612. Source base station 612 may comprise a gNB. The base station may be located on an NGSO satellite.

[0154] At 607, there is Xn connectivity between the consecutive base stations in the satellite orbit.

[0155] At 609, source base station 612 configures the UE measurement procedures and the UE reports according to the measurement configuration. At 611, the source base station 612 decides to handover UE 620 to target base station 610, based on Measurement Report and Radio Resource Management (RRM) information.

[0156] At 613, serving base station 612 requests CHO for one or more candidate cells belonging to one or more candidate gNBs, including base station 610.

[0157] At 615, serving base station 612 detects the scenario to be NTN EFC Unchanged PCI. As such, at 617, serving base station 612 uses enhanced key computation method to compute target cell key. At 619, the serving base station includes, in the handover request sent to target base station 610, ‘KEY_GENERAT1ON_OP- T1ON’ flag and the ‘Unique Identifier’ it has used as additional input parameter to compute the target cell’s new security key.

[0158] At 621, Admission Control may be performed by the target base station 610. Slice-aware admission control may also be performed if slice information is sent to the target base station 610. If the data sessions (e.g., PDU sessions) are associated with non-supported slices, the target base station 610 can reject such PDU Sessions.

[0159] At 623, the target base station 610 prepares the HO Command by encapsulating the received ‘KEY_GENERAT1ON_OPT1ON’ flag and the ‘Unique Identifier’ in the HO Command. The HO command is sent to source base station 612 in a handover request acknowledgement message at 625. At 627, an RRC reconfiguration message including the HO Command is sent from source base station 612 to UE 620. UE 620 indicates to source base station 612 that the RRC reconfiguration is complete at 629.

[0160] At 631, UE 620 maintains connection with the source base station after receiving CHO configuration and starts evaluating the CHO execution conditions for the candidate cell(s). At 633, UE 620 determines that CHO execution condition^) is met.

[0161] At 635, upon decoding the HO Command, UE 620 may use the ‘KEY_GEN- ERAT1ON_OPT1ON’ flag to decide on the security key generation method to be used; if the ‘Unique Identifier’ is included in the RRCReconfigurationRequest message, then the UE can use it as additional unique parameter to generate the new security key.

[0162] At 637, UE 620 detaches from the source base station 612, applies the stored corresponding configuration for that selected candidate cell, synchronizes to that candidate cell and completes the RRC handover procedure by sending RRCReconfigurationComplete message to the target base station at 641. UE 620 may release stored CHO configurations after successful completion of RRC handover procedure.

[0163] 643 to 651 are similar to steps described in Figure 9.2.3.2.1-1 of 3GPP TS 38.300 clause 9.2.3.2.1. At 643, a HO success indication is sent from target base station 610 to source base station 612. DL data is sent from AMF 616a to source base station 612 at 643. At 645, a path switch request is sent from target base station 610 to AMF 616a, and a response is sent at 647. DL data may be sent from AMF 616a to target base station 610 at 649.

[0164] Fig. 7 shows a method for an N2 HO. UE 720 may be in an RRC CONNECTED and CM CONNECTED state before 703. At 703 and 705, user data may be sent bidirectionally between UE 720 and UPF 716b via source base station 712. Source base station 712 may comprise a gNB. The base station may be located on an NGSO satellite. Target base station 710 may comprise a gNB. The base station may be located on an NGSO satellite

[0165] At 751, mobility control information for UE 720 is provided by AMF 716a to target base station 712 and source base station 710. Measurement reports are made between source base station 710 and UE 720 at 753, and based on the reports source base station 710 may make a HO decision at 755.

[0166] At 757, serving base station 710 detects an NTN EFC Unchanged PCI deployment scenario

[0167] At 759, serving base station 710 may include 'UN- CHANGED_PC1_NTN_EFC_SCENAR1O’ flag in an NGAP message to AMF 716a (e.g., in an NGAP: Handover Required message).

[0168] At 761, AMF 716a may use an enhanced key generation method for Unchanged PCI to generate a new security key for the HO.

[0169] At 763, AMF 716a sends an HO request to target base station 712. The HO request may comprise an NGAP message. The request may include NH information and NCC information.

[0170] At 765, base station 710 performs Admission Control may be performed by the target base station 510. Slice-aware admission control may also be performed if slice information is sent to the target base station 510. If the data sessions (e.g., PDU sessions) are associated with non-supported slices, the target base station 510 can reject such PDU Sessions.

[0171] At 767, target base station 712 sends a HO request acknowledgement to AMF 716a. The acknowledgement may comprise an N GAP message. The acknowledgement may include a HO Command an NCC information. The HO Command may include a ‘KEY_GENERAT1ON_OPT1ON’ flag.

[0172] At 769, the HO Command may be sent from AMF 716a to source base station 710. The command may be sent as an NGAP message, and may include at least one of NCC information and the KEY_GE N E RATI ON_O PTION flag.

[0173] At 771, source base station 710 shall include the KEY_GENERAT1ON_OP- T1ON flag in RRCReconfigurationRequest message to UE 720, if it was present in NGAP: Handover Command message.

[0174] At 773, UE 720 may use the ‘KEY_GENERAT1ON_OPT1ON’ flag in RRCRe- configurationRequest message to apply an appropriate key generation method. In some examples, the ‘KEY_GENERAT1ON_OPT1ON’ flag may be a bitmask which indicates which unique identifier the AMF has used as additional input parameter to generate the new key.

[0175] At 775, UE 720 performs a RACH procedure to target base station 710. At 777, UE 720 indicates to the target base station that RRC reconfiguration is complete.

[0176] Target base station 710 notifies the source base station 712 of the HO using an NGAP message at 779. A request to switch path may be sent from source base station 712 to target base station 710 at 781. Path switching is then performed at 783 between AMF 716a and UPF 716b. An End Marker may be sent from UPF 716b to target base station 712 and source base station 710 at 785. At 787, user data may be sent bidirectionally between UE 720 and UPF 716b via base station 712. An acknowledgement to the request sent at 781 may be sent at 789. AMF 716a may instruct source base station 712 to release the UE context for UE 720 at 791 and 793.

[0177] Fig. 8 shows an example method. The method may be performed by a UE, such as UE 420, 520 or 620, for example.

[0178] At 800, the method comprises receiving an indication and a unique identifier sent from a source base station for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station.

[0179] At 802, the method comprises determining the security key using the unique identifier.

[0180] Fig. 9 shows an example method. The method may be performed by a base station, such as base station 412, 512 or 612, for example. At 900, the method comprises sending an indication and a unique identifier to a user equipment for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station.

[0181] Fig. 10 shows an example method. The method may be performed by a UE, such as UE 720, for example.

[0182] At 1000, the method comprises receiving an indication and a unique identifier sent from a network entity for a non-terrestrial network, NTN, handover of the user equipment, wherein the indication indicates that the network entity has used the unique identifier to determine a security key for the handover, wherein the security key is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station.

[0183] At 1002, the method comprises determining the security key using the unique identifier.

[0184] Fig. 11 shows an example method. The method may be performed by a network entity, such as AMF 716a, for example.

[0185] At 1100, the method comprises receiving a message from a source base station for a non-terrestrial network, NTN, handover of a user equipment, the message indicating that the source base station and a target base station have the same Physical Cell Identity, PCI.

[0186] At 1102, the method comprises determining a security key for the handover using a unique identifier, wherein the security key is used for protecting data packets sent between a cell of the target base station :and the user equipment, and wherein the unique identifier comprising at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station. At 1104, the method comprises sending, to the source base station, an indication that the unique identifier was used to determine the security key and the target base station identifier or the identifier of the satellite of the target base station or any other unique identifier.

[0187] Fig. 12 shows an example method. The method may be performed by a base station, such as base station 712, for example.

[0188] Fig. 13 shows, by way of example, a block diagram of an apparatus 10. The apparatus 10 comprises, for example, at least one processor 12 and at least one memory 14 storing instructions 15 that, when executed by the at least one processor, cause the apparatus 10 at least to perform the method or methods as disclosed herein, and any of the embodiments thereof. In an example, the at least one memory and the instructions (e.g. a computer program code, software), are configured, with the at least one processor, to cause the apparatus 10 to perform the method or methods as disclosed herein, and any of the embodiments thereof.

[0189] A processor 12 may comprise circuitry, or be constituted as circuitry or circuitries, the circuitry or circuitries being configured to perform phases of methods in accordance with example embodiments described herein. As used in this application, the term “circuitry” may refer to one or more or all of the following: (a) hardware-only circuit implementations, such as implementations in only analog and / or digital circuitry, and (b) combinations of hardware circuits and software, such as, as applicable: (i) a combination of analog and / or digital hardware circuit's) with software / firmware and (ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as a user equipment, to perform various functions) and (c) hardware circuit(s) and or processor(s), such as a microprocessor's) or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation. This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in server, a cellular network device, or other computing or network device.

[0190] The memory 14 may be implemented using any suitable data storage technology. The memory may comprise a database for storing data. The memory 14 may be at least in part external to apparatus 10 but accessible to apparatus 10.

[0191] The instructions 15 may be comprised in a computer readable medium or a non-transitory computer readable medium. A term non-transitory, as used herein, is a limitation of the medium itself (i.e. tangible, not a signal) as opposed to a limitation on data storage persistency (e.g. random access memory, RAM, vs. read only memory, ROM).

[0192] For example, the apparatus 10 is a terminal device, such as the UE of Fig. 2, 3, 4, 5, 6 or 7. As another example, the apparatus is comprised in such a terminal device, e.g. as a chipset configured to control the terminal device. The apparatus 10 may be caused or configured to perform at least the method of Fig. 8 or 10 and / or any one or more of the embodiments described.

[0193] As another example, the apparatus 10 is a network node, e.g. the network node of Fig. 2, 3, 4, 5, 6 or 7. In another embodiment, the apparatus is comprised in such a network node, e.g. as a chipset configured to control the network node. The apparatus 10 may be caused or configured to perform at least the method of Fig. 9, 11 or 12 and / or any one or more of the embodiments described.

[0194] The apparatus may comprise one or more entities of any of protocol layers, such as a MAC entity, an RRC entity, an RLC entity, a PDCP entity or a PHY entity. In some embodiments, the entity is configured to perform at least the method of Fig. 8 to 12, and / or any one or more of the embodiments described.

[0195] The apparatus 10 comprises a radio interface 16. The radio interface 16 may provide the apparatus 10 with communication capabilities. The radio interface 16 may comprise a receiver configured to receive information in accordance with at least one cellular or non-cellular standard. The radio interface 16 may comprise a transmitter configured to transmit information in accordance with at least one cellular or non-cellular standard. The receiver may comprise more than one receiver. The transmitter may comprise more than one transmitter. The radio interface 16 may comprise a transceiver configured to receive and transmit information in accordance with at least one cellular or non-cellular standard. The transceiver may comprise more than one transceiver.

[0196] The apparatus 10 may comprise a user interface 18 comprising, for example, at least one of a keypad, a microphone, a touch display, a display, a speaker, etc. The user interface 18 may be used to control the apparatus by the user. The user interface 18 may be external to the apparatus 10. For example, the apparatus 10 may be connected to another device, such as a computer, either via wireless or wired connection, and the apparatus 10 is controlled by the user via the computer.

[0197] In an embodiment, at least some of the processes described herein may be carried out by an apparatus comprising means for carrying out at least some of the described processes. Means for performing method steps as disclosed herein may include software and / or hardware components of the apparatus 10. For example, the at least one processor 12, the memory 14, and the computer program code form means for carrying out the method or methods as disclosed herein, and any of the embodiments thereof. As used herein the term “means” is to be construed in singular form, i.e. referring to a single element, or in plural form, i.e. referring to a combination of single elements. Therefore, terminology “means for [performing A, B, C]”, is to be interpreted to cover an apparatus in which there is only one means for performing A, B and C, or where there are separate means for performing A, B and C, or partially or fully overlapping means for performing A, B, C. Further, terminology “means for performing A, means for performing B, means for performing C” is to be interpreted to cover an apparatus in which there is only one means for performing A, B and C, or where there are separate means for performing A, B and C, or partially or fully overlapping means for performing A, B, C.

[0198] Even though the invention has been described above with reference to an example according to the accompanying drawings, it is clear that the invention is not restricted thereto but can be modified in several ways within the scope of the appended claims. Therefore, all words and expressions should be interpreted broadly and they are intended to illustrate, not to restrict, the embodiment. It will be obvious to a person skilled in the art that, as technology advances, the inventive concept can be implemented in various ways. Further, it is clear to a person skilled in the art that the described embodiments may, but are not required to, be combined with other embodiments in various ways.

Claims

We Claim:

1. A user equipment comprising: means for receiving an indication and a unique identifier sent from a source base station for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; means for determining the security key using the unique identifier.

2. The user equipment according to claim 1, wherein the indication and the unique identifier are received while the user equipment is in a connected radio resource control mode.

3. The user equipment according to claim 1 or claim 2, wherein the indication and the unique identifier are received in a radio resource control, RRC, message from the source base station.

4. The user equipment according to claim 1 or claim 2, wherein the indication and the unique identifier are sent from the source base station to the target base station, wherein the indication and the unique identifier are received from the target base station.

5. The user equipment according to claim 4, the user equipment comprising: means for receiving a handover command message sent from the target base station via the source base station, the handover command message comprising the indication, the unique identifier and Next Hop Chaining Counter, NCC,36information, where the indication, the unique identifier and the NCC information are included as plain text in the handover command message and the rest of the handover command message is protected by the security key.

6. The user equipment according to any preceding claim, wherein the source base station and the target base station have a same Physical Cell Identity, PCI.

7. The user equipment according to any preceding claim, wherein the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key.

8. A method comprising: receiving, an indication and a unique identifier sent from a source base station for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station. an identifier of a satellite of the target base station, or any other unique identifier of the target base station; determining the security key using the unique identifier.

9. A computer program comprising instructions stored thereon for performing at least the following: receiving, an indication and a unique identifier sent from a source base station for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets37sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station; determining the security key using the unique identifier.

10. An apparatus comprising: means for sending an indication and a unique identifier to a user equipment for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station.

11. The apparatus according to claim 10, wherein the indication and the unique identifier are sent while the user equipment is in a connected radio resource control mode.

12. The apparatus according to claim 10 or claim 11, wherein the apparatus comprises: means for determining the security key for the handover using the unique identifier.

13. The apparatus according to claim 12, wherein the indication and the unique identifier are sent to the user equipment in a radio resource control message.

14. The apparatus according to claim 10 or claim 11, wherein the apparatus comprises:means for receiving the indication and the unique identifier in a handover request from the source base station; wherein the indication and the unique identifier are sent to the user equipment via the source base station in a handover command message from the apparatus.

15. The apparatus according to claim 14, wherein the handover command message comprises: the indication, the unique identifier and Next Hop Chaining Counter, NCC, information, where the indication, the unique identifier and the NCC information are included as plain text in the handover command message and the rest of the handover command message is protected by the security key.

16. The apparatus according to any of claims 10 to 15, wherein the apparatus comprises: means for detecting that the NTN handover comprises a handover in which the Physical Cell Identity, PCI, does not change.

17. The apparatus according to any of claims 10 to 16, wherein the security key is used for deriving at least one of: at least one radio resource control key; at least one user plane key.

18. A method comprising: sending an indication and a unique identifier to a user equipment for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station.

19. A computer program comprising instructions stored thereon for performing at least the following: sending an indication and a unique identifier to a user equipment for a non-terrestrial network, NTN, handover, wherein the indication indicates that the source base station has used the unique identifier to determine a security key for the handover, wherein the security key Is used for protecting data packets sent between a cell of a target base station and the user equipment, and wherein the unique identifier comprises at least one of: an identifier of the target base station, an identifier of a satellite of the target base station, or any other unique identifier of the target base station.

Images