Method, user equipment and satellite for ensuring integrity protection in a multi-satellite asynchronous non-terrestrial communication network

Abstract

A method, User Equipment and a satellite for ensuring integrity protection in a multi-satellite asynchronous non-terrestrial communication network are proposed. The method comprises selecting, by a UE, a NAS COUNT associated with a satellite based on a SAT_ID identifier; computing, by the UE, a MAC-I based on the selected NAS COUNT; sending, by the UE, a protected NAS message comprising the MAC-I to a wireless receiving unit onboard the satellite, and incrementing the NAS COUNT at the UE; estimating, by the a processing unit onboard the satellite, the NAS COUNT; recalculating, by the processing unit, the MAC-I based on the estimated NAS COUNT, and comparing the MAC-I included in the protected NAS message with the recalculated MAC-I. In response to detecting that NAS integrity check failed, triggering a reauthentication request to the UE, and in response to detecting that NAS integrity check was successful, processing the protected NAS message.

Description

[0001] METHOD, USER EQUIPMENT AND SATELLITE FOR ENSURING INTEGRITY PROTECTION IN A MULTI-SATELLITE ASYNCHRONOUS NON-TERRESTRIAL COMMUNICATION NETWORK

[0002] Field of the Invention

[0003] The present invention relates primarily to a method, a User Equipment (UE), and a satellite for ensuring integrity protection of signalling messages exchanged between the UE and a 3GPP wireless communication network. More specifically, the present invention refers to a method, UE, and satellite for enabling NAS integrity check in a multi-satellite asynchronous non-terrestrial network (NTN).

[0004] Background of the Invention

[0005] In a multi-satellite NTN network system with limited feeder link capacity and scarce availability of ground stations, continuous connection between the satellite constellation and a ground station may not be possible. In such a scenario, asynchronous bidirectional data communication can be achieved using a Store and Forward (S&F) mechanism, as disclosed in detail in the International Patent Application WO2023094715. In a 3GPP multi-satellite NTN network system which uses a S&F mechanism, the core network (CN) is responsible for retaining temporary information necessary for registering / deregistering a UE (e.g., IMSI, authentication vectors, subscription profile) in a satellite and forwarding such information to ground, maintaining and synchronizing the complete context of a registered UE in all satellites of the same communication network, storing mobile-originated (MO) packets in a satellite and forwarding them to the ground at the earliest opportunity, and storing mobile-terminated (MT) packets in the ground and forwarding them to at least one of the satellites when the ground station has visibility. Figs. 1A-1 D illustrate a packet exchange between a UE and the CN by employing two different satellites.

[0006] In Fig. 1A the MO packets are stored on SAT#1 during a period of non-availability of a ground station. In Fig. 1 B SAT#1 forwards the MO packets to ground whenever a feeder link can be established. In Fig. 10 the ground station forwards the stored MT packets for a given user to SAT#2. In Fig. 1 D SAT#2 forwards the packets to the UE as soon as it covers the UE’s location.

[0007] The 3GPP TS 33.401 and TS 33.501 describe a NAS integrity check mechanism, which enables a UE and a mobility management unit (e.g., Mobility Management Entity - MME, Access and Mobility Management Function - AMF) of a communication network to figure out if a NAS message is modified or corrupted. When a NAS message needs integrity protection, the sending entity (e.g., the UE or the mobility management unit of the network) generates a Message Authentication Code for integrity (MAC-I) and appends this code into the NAS message. The input parameters for the integrity algorithm are a 128-bit integrity key (KEY), a 32-bit counter (COUNT), a 5-bit bearer (BEARER), 1-bit indicating the direction of the transmission (DIRECTION - 0 for uplink and 1 for downlink), and the message itself. Based on these input parameters, the sender computes the 32-bit MAC-I using an integrity algorithm (e.g., EIA, NIA). Fig. 2 illustrates the input parameters of the integrity algorithm.

[0008] On the other hand, the 3GPP TS 24.301 describes the handling of a security context between a UE and a mobility management unit of the network, referred to as Mobility Management Unit (MMU) hereafter. In a 3GPP network, each UE needs always to be associated with one MMU of the network to receive services (i.e. a 3GPP network may have multiple MMUs but a UE is only registered in one of these MMUs at a given time so that NAS signalling exchange between the UE and the network always occurs between the UE and the specific MMU that the UE is registered in). Thus, in the context of NAS signalling exchange between a UE and its associated MMU, both the UE and the MMU establish each a security context that includes two separate counters NAS COUNT, one related to uplink NAS messages and one related to downlink NAS messages. A NAS COUNT comprises 32 bits, which is formed by a concatenation of an 8-bit field of padding bits, a NAS overflow counter (16 most significant bits), and a NAS sequence number (SON) (8 least significant bits), as illustrated in Fig. 3.

[0009] The NAS SON which is part of the NAS COUNT shall be exchanged between the UE and the MMU as part of the NAS signalling. The values of both NAS COUNT (uplink and downlink) are stored in the UE and in the MMU. After each new or retransmitted outbound protected NAS message, the sender needs to increment the NAS COUNT number by one, except for the initial NAS messages if the lower layers indicated the failure to establish the RRC connection. If the results are zero due to a wrap-around, the NAS overflow counter should be incremented by one. The receiving side must estimate the NAS COUNT used by the sender. If the estimated NAS sequence number wraps around, the NAS overflow counter should be incremented by one. The same algorithm and key will be used to generate a MAC-I, in case the receiver stores a different value for the NAS COUNT, the generated MAC-I will differ from the one in the message, and then the NAS integrity authentication will fail.

[0010] In the context of a multi-satellite NTN S&F network system where the MMU associated with a UE is partly deployed onboard satellites (hereinafter referred to as MMU-SAT) and partly deployed in ground (hereinafter referred to as MMU-GND). For example, as an architecture as the described in the EP24383201. In such systems, ensuring synchronization of the NAS counters between the UE and each of the MMU-SAT instances onboard the different satellites of the constellation using the current integrity mechanism provided by 3GPP is a cause for service performance degradation. This occurs given that this synchronisation between MMU-SAT instances takes time. As a result, the UE cannot be served by satellites until synchronisation is not completed after every interaction of the UE with one MMU-SAT instance. It is important to note here that from the perspective of the UE, a single logical MMU is seen all the time in the service area that the UE is camping, irrespective of the passing satellite, given that the 3GPP system uses earth-fixed tracking areas.

[0011] Fig. 4 illustrates the limitation of the state of the art. Fig. 4A shows a scenario where a UE sends a NAS integrity protected message to SAT#1 , which includes an instance of the MMU that is serving the Tracking Area where the UE is located, and therefore the UE needs to get registered into that MMU to receive service and exchange NAS signalling. When exchanging NAS messages, both the MMU onboard the satellite and the UE will increment the uplink NAS COUNT by 1 . However, in case SAT#1 is not able to notify a ground station of such change or a SAT#2 is not able to retrieve this change from ground before serving the UE, the scenario illustrated by Fig. 4B will be observed. In this scenario, the uplink NAS COUNT stored on the MMU instance onboard SAT#2, which corresponds to the same logic MMU as the MMU instance on SAT#1 , serving the same tracking area does not match the current uplink NAS COUNT stored in the UE. Therefore, the NAS integrity check will fail, as the sender and receiver will generate different MAC-I due to different COUNT input values, and the MMU will request the reauthentication of the UE to create a new security context. The lack of synchronization of multiple UEs across the multiple MMU instances in the network results in a high number of unnecessary re-authentication procedures and may lead to network overload, which can result in various problems, including decreased performance, higher latency, and service interruptions. Description of the Invention

[0012] The present invention overcomes the limitations of the state of the art by introducing a novel MMU implementation, where each satellite, particularly each MMU-SAT is linked to a SATJD, enabling a UE to maintain different NAS counters for each satellite based on the SATJD, and thus avoiding synchronization problems the S&F procedure might trigger. Additionally, the invention also provides a new NAS COUNT structure that provides enhanced security by encoding the SATJD as part of the NAS COUNT. The new NAS COUNT structure is compatible with the procedures already established in the 3GPP specifications.

[0013] Embodiments of the present invention, provide, according to a first aspect, a method for ensuring integrity protection in a multi-satellite asynchronous NTN (e.g. a 3GPP wireless communication network). The method comprises selecting, by a User Equipment (UE) a NAS COUNT associated with a satellite based on a SATJD identifier; computing, by the UE, a Message Authentication Code for integrity (MAC-I) based on the selected NAS COUNT; sending, by the UE, a protected NAS message comprising the MAC-I to a wireless receiving unit onboard the satellite, and incrementing the NAS COUNT at the UE; estimating, by a processing unit onboard the satellite, the NAS COUNT used by the UE; recalculating, by the processing unit, the MAC-I based on the estimated NAS COUNT; comparing, by the processing unit, the MAC-I comprised in the protected NAS message with the recalculated MAC-I; and in response to detecting that NAS integrity check failed, triggering a re-authentication request to the UE and in response to detecting that NAS integrity check was successful, processing the protected NAS message.

[0014] Embodiments of the present invention, also provide, according to a second aspect, a UE for ensuring integrity protection in a multi-satellite asynchronous NTN. The UE comprises a memory unit for storing a plurality of NAS counters, where each NAS counter is associated with a satellite of a constellation of satellites serving the NTN based on a SATJD identifier; a processing unit; and a transmitting unit. The processing unit is configured to select a NAS COUNT associated with a satellite from the stored plurality of NAS counters; compute a Message Authentication Code for integrity, MAC-I, based on the selected NAS COUNT; and increment the NAS COUNT. The transmitting unit is configured to send a protected NAS message comprising the generated MAC-I to a wireless receiving unit onboard the satellite. Yet, embodiments of the present invention, also provide, according to a third aspect, a satellite for ensuring integrity protection in a multi-satellite asynchronous NTN. The satellite comprises a memory unit for storing a SATJD identifier; a wireless receiving unit to receive a protected NAS message from a UE, where the protected NAS message comprises a MAC-I that is computed using a NAS COUNT used by the UE; and a processing unit to estimate the NAS COUNT used by the UE; recalculate the MAC-I based on the estimated NAS COUNT; compare the MAC-I comprised in the protected NAS message with the recalculated MAC-I; and in response to detecting that NAS integrity check failed, triggering a re-authentication request to the UE, and in response to detecting that NAS integrity check was successful, processing the protected NAS message.

[0015] In some embodiments, the UE further stores a list of SATJDs corresponding to satellites the UE is permitted to connect to.

[0016] In some embodiments, each SATJD uniquely identifies a MMU onboard the satellite.

[0017] In some embodiments, the UE interacts with multiple MMUs onboard different satellites as a single logical MMU in a service area where the UE is located.

[0018] In some embodiments, a separate pair of NAS COUNT values is used for each MMU, one related to uplink NAS messages and one related to downlink NAS messages.

[0019] In some embodiments, the selected NAS COUNT used for computing the MAC-I is encoded with a SATJD value.

[0020] Brief of the

[0021] The previous and other advantages and features will be more fully understood from the following detailed description of embodiments, with reference to the attached figures, which must be considered in an illustrative and non-limiting manner, in which:

[0022] Fig. 1 - Packet exchange between a UE and the core network with two satellites.

[0023] Fig. 2- Input parameters of the NAS integrity algorithm.

[0024] Fig. 3 - NAS COUNT. Fig. 4 - Limitation of the state of the art.

[0025] Fig. 5 - MMU implementation according to the invention.

[0026] Fig. 6 - NAS COUNT structure according to the invention.

[0027] Detailed Description of the Invention and of Preferred Embodiments

[0028] The present invention avoids the problems presented in the state of the art by using a parameter available for 3GPP 4G / 5G NTN communication networks called SATJD, which can be, but not limited to, broadcast by the satellite through the System Information Blocks (SIBs) via RRC signalling or via NAS signalling messages. The SATJD uniquely identifies each satellite in the constellation serving the communication network.

[0029] In a preferred embodiment of the present invention, the corresponding MMU-SAT instance of each satellite is linked to its SATJD, as illustrated in Fig. 5, which allows the UE to keep separate pairs of NAS COUNT values to be used for each MMU-SAT instance of the same logical MMU, in contrast to conventional approaches that use a single pair of NAS COUNT values for the whole logical MMU.

[0030] An alternative embodiment of the invention introduces the SATJD as a new parameter into the NAS COUNT, as defined in 3GPP TS 24.301. This allows the separate pairs of NAS COUNTS for each MMU-SAT to be encoded with different SATJD values. This implementation provides enhanced security, while still enabling the UE to keep separate pairs of NAS COUNT values for each of the MMU-SAT instances. Fig. 6 illustrates an exemplary NAS COUNT structure according to the invention, where the 8-bit field previously used for the padding bits can be used to carry the SATJD.

[0031] Alternatively, the SATJD can comprise any number of bits according to the specific requirement of the implementation. For example, the SATJD could comprise less than 8 bits and be used alongside a number of padding bits or another parameter.

[0032] While there are several ways to implement the present invention according to the NAS integrity check mechanism defined by the 3GPP specifications, a preferred implementation of the proposed method comprises the selection, by a UE, of a NAS COUNT associated with a given satellite in the constellation based on a SATJD identifier provided by the communication network and stored in the UE. The UE computes a MAC-I based on the selected NAS COUNT. Also, in some embodiments, the UE can also compute other possible input parameters, such as an integrity key, a bearer, and the direction of the transmission. This process generates a different MAC-I per satellite due to the selection of a NAS COUNT based on a different SATJD. Then the UE sends the outbound protected NAS message comprising the computed MAC-I. After each new or retransmitted outbound protected NAS message, the UE increments the corresponding NAS COUNT by a given number, preferably by one.

[0033] At the receiving side, a wireless receiving unit onboard the satellite receives the protected NAS message and estimates the NAS COUNT used by the UE. For example, when a NAS message is received, the receiving side retrieves the NAS SON included in the message and compares it with the locally stored uplink NAS SON. If the received NAS SON is greater than or equal to the local value, the NAS COUNT can be estimated by combining the current overflow counter value with the received NAS SON. If the received NAS SON is smaller than the local value, this may indicate that the sender’s counter has wrapped around, in which case the overflow counter is incremented by one before combining it with the received NAS SON to form the estimated NAS COUNT. Once the NAS COUNT is estimated, the receiving side uses it together with the same parameters and integrity algorithm used by the sender to generate a recalculated the MAC-I. The recalculated MAC-I is compared against the MAC-I value comprised in the received message. In response to detecting that the NAS integrity check failed, the wireless receiving unit triggers the MMU to send a re-authentication request to the UE, and in response to detecting that NAS integrity check was successful, the wireless receiving unit further processes the NAS message.

[0034] In this way, the selection of a NAS COUNT based on a SATJD allows the NAS COUNT to only be used at most once between the UE and satellite, ensuring synchronization of the NAS counters across a multi-satellite NTN S&F network, avoiding unnecessary re-authentication procedures, and network overload.

[0035] Alternatively, the selected NAS COUNT used by the UE as an input for computing the MAC-I can have the novel structure illustrated in Fig. 6, comprising a SATJD, a NAS overflow counter, and a NAS SON. Advantageously, the present invention allows the new NAS COUNT structure to be handled according to the 3GPP specifications. An example of a UE configured to perform the proposed method can be described as a UE comprising means for storing the NAS counters (e.g., a memory unit) for each satellite in the constellation serving the communication network. In some implementations, the UE can maintain a list of SATJDs corresponding to satellites the UE is permitted to connect to. This relationship can be stored using various data structures, for example, but not limited to, in the format of a hash table in a memory unit comprised in the UE. In one embodiment, the hash table can store the NAS counters based on unique keys for each satellite according to the transmission direction, based on a combination of the SATJD and the transmission direction bit (DIRECTION). In another embodiment, the UE can store two tables, one for uplink and another one for downlink, where the SATJD uniquely identifies the counter of a satellite.

[0036] The UE further comprises a processing unit configured to select a NAS COUNT stored in the memory unit related to a given satellite in the constellation based on a SATJD identifier. The processing unit is further configured to increment the NAS COUNT after each new or retransmitted outbound protected NAS message and to compute a MAC-I based on the selected NAS COUNT and other possible input parameters such as an integrity key, a bearer, the direction of the transmission. Additionally, the UE also comprises a transmitting unit configured to send the outbound protected NAS message comprising the computed MAC-I.

[0037] An example of a satellite configured to perform the method for ensuring integrity protection according to the present invention can be described as a satellite in which part of the MMU is implemented onboard but works as a single logical MMU with the part of the MMU residing in the ground. The satellite further comprises a memory unit for storing a SATJD, preferably assigned by the satellite operator, wherein the SATJD is functionally associated with the MMU onboard the satellite.

[0038] The satellite also comprises a wireless receiving unit for receiving a protected NAS message from a UE, and a processing unit to estimate the NAS COUNT used by the UE, recalculate the MAC-I based on the estimated NAS COUNT, and compare the MAC-I comprised in the protected NAS message with the recalculated MAC-I. Upon detecting that NAS integrity check failed, triggering a re-authentication request to the UE. Alternatively, in response to detecting that NAS integrity check was successful, processing the NAS message. In the drawings and description, there have been disclosed exemplary embodiments. However, many variations and modifications can be made to these embodiments in light of teachings of the present invention. Accordingly, although specific terms are employed, they are used in a generic and descriptive sense only and not for purposes of limitation. The scope of the present invention is defined in the following set of claims.

Claims

CLAIMS1. A method for ensuring integrity protection in a multi-satellite asynchronous non-terrestrial communication network, the method comprising: selecting, by a User Equipment, UE, a NAS COUNT associated with a satellite based on a SATJD identifier; computing, by the UE, a Message Authentication Code for integrity, MAC-I, based on the selected NAS COUNT; sending, by the UE, a protected NAS message comprising the MAC-I to a wireless receiving unit onboard the satellite, and incrementing the NAS COUNT at the UE; estimating, by a processing unit onboard the satellite, the NAS COUNT used by the UE; recalculating, by the processing unit, the MAC-I based on the estimated NAS COUNT; comparing, by the processing unit, the MAC-I comprised in the protected NAS message with the recalculated MAC-I; and in response to detecting that NAS integrity check failed, triggering a re-authentication request to the UE and in response to detecting that NAS integrity check was successful, processing the protected NAS message.

2. The method of claim 1 , wherein each SATJD uniquely identifies a Mobility Management Unit onboard the satellite.

3. The method of any one of the previous claims, wherein the UE interacts with multiple Mobility Management Units onboard different satellites as a single logical Mobility Management Unit in a service area where the UE is located.

4. The method of any one of the previous claims, wherein a separate pair of NAS COUNT values is used for each Mobility Management Unit one related to uplink NAS messages and one related to downlink NAS messages.

5. The method of any one of the previous claims, wherein the selected NAS COUNT used for computing the MAC-I is encoded with a SATJD value.

6. The method of any one of the previous claims, wherein the UE further stores a list of SATJDs corresponding to satellites the UE is permitted to connect to.

7. A User Equipment for ensuring integrity protection in a multi-satellite asynchronous nonterrestrial communication network, comprising: a memory unit configured to store a plurality of NAS counters, each NAS counter being associated with a satellite of a constellation of satellites serving the asynchronous non-terrestrial communication network based on a SATJD identifier; a processing unit; and a transmitting unit, wherein the processing unit is configured to: select a NAS COUNT associated with a satellite from the stored plurality of NAS counters; compute a Message Authentication Code for integrity, MAC-I, based on the selectedNAS COUNT; and increment the NAS COUNT; and wherein the transmitting unit is configured to send a protected NAS message comprising the generated MAC-I to a wireless receiving unit onboard the satellite.

8. The User Equipment of claim 7, wherein it is further configured to interact with multiple Mobility Management Units onboard different satellites as a single logical Mobility Management Unit in a service area where the User Equipment is located.

9. The User Equipment of claim 7 or 8, wherein a separate pair of NAS COUNT values is used for each Mobility Management Unit one related to uplink NAS messages and one related to downlink NAS messages.

10. The User Equipment of any one of the previous claims 7-9, wherein the selected NAS COUNT used for computing the MAC-I is encoded with a SATJD value.11 . The User Equipment of any one of the previous claims 7- 10, wherein it is further configured to store a list of SATJDs corresponding to satellites the User Equipment is permitted to connect to.

12. A satellite for ensuring integrity protection in a multi-satellite asynchronous non-terrestrial communication network, comprising: a memory unit configured to store a SATJD identifier;a wireless receiving unit configured to receive a protected NAS message from a User Equipment, UE, the protected NAS message comprising a Message Authentication Code for integrity, MAC-I, that is computed using a NAS COUNT used by the UE; and a processing unit configured to: estimate the NAS COUNT used by the UE; recalculate the MAC-I based on the estimated NAS COUNT; compare the MAC-I comprised in the protected NAS message with the recalculated MAC-I; and in response to detecting that NAS integrity check failed, triggering a re-authentication request to the UE and in response to detecting that NAS integrity check was successful, processing the protected NAS message.

13. The satellite of claim 12, wherein the SATJD uniquely identifies a Mobility Management Unit onboard the satellite.

14. The satellite of claim 13, wherein the Mobility Management Unit is configured to operate as part of a single logical Mobility Management Unit across multiple satellites of a constellation of satellites serving the asynchronous non-terrestrial communication network.

15. The satellite of any one of the previous claims 12- 14, wherein the NAS COUNT used for computing the MAC-I is encoded with a SATJD value.

Images