Security update during cell switch

Abstract

The present disclosure is related to security update during cell switch in wireless communications. According to an embodiment of the present disclosure, a method performed by a user equipment (UE) configured to operate in a wireless communication system comprises: applying a configuration for a first cell group and a configuration for a second cell group; receiving a cell switch configuration related to the first cell group comprising one or more candidate configurations; receiving a cell switch command; triggering a cell switch on the first cell group based on the cell switch command, wherein the cell switch is related to a candidate configuration among the one or more candidate configurations; performing a security update for the first cell group based on the cell switch being triggered on the first cell group; and performing a security update for the second cell group based on the security update for the first cell group being performed.

Description

SECURITY UPDATE DURING CELL SWITCH

[0001] The present disclosure is related to security update during cell switch in wireless communications.

[0002] 3rd Generation Partnership Project (3GPP) Long-Term Evolution (LTE) is a technology for enabling high-speed packet communications. Many schemes have been proposed for the LTE objective including those that aim to reduce user and provider costs, improve service quality, and expand and improve coverage and system capacity. The 3GPP LTE requires reduced cost per bit, increased service availability, flexible use of a frequency band, a simple structure, an open interface, and adequate power consumption of a terminal as an upper-level requirement.

[0003] Work has started in International Telecommunication Union (ITU) and 3GPP to develop requirements and specifications for New Radio (NR) systems. 3GPP has to identify and develop the technology components needed for successfully standardizing the new RAT timely satisfying both the urgent market needs, and the more long-term requirements set forth by the ITU Radio communication sector (ITU-R) International Mobile Telecommunications (IMT)-2020 process. Further, the NR should be able to use any spectrum band ranging at least up to 100 GHz that may be made available for wireless communications even in a more distant future.

[0004] The NR targets a single technical framework addressing all usage scenarios, requirements and deployment scenarios including enhanced Mobile BroadBand (eMBB), massive Machine Type Communications (mMTC), Ultra-Reliable and Low Latency Communications (URLLC), etc. The NR shall be inherently forward compatible.

[0005] In communication systems, Access Stratum (AS) security mechanisms are employed to ensure secure communication between a user equipment (UE) and a network. The AS security is responsible for protecting Radio Resource Control (RRC) signaling messages and user plane data that are exchanged over the radio interface.

[0006] AS security is typically established after the completion of Non-Access Stratum (NAS) security procedures and is activated during the establishment of an RRC connection. AS security may comprise two primary functions: integrity protection of RRC signaling messages and ciphering of both RRC signaling messages and user plane data. Integrity protection is applied to prevent modification or tampering of signaling messages, while ciphering is applied to protect the confidentiality of both signaling and user data.

[0007] To enable AS security, a set of security keys is derived from a root key, which is initially established during authentication and NAS security setup. From the root key, specific AS keys are generated for integrity protection and ciphering. These keys are associated with security algorithms that are selected by the network. The network provides the UE with security configuration information, including the selected integrity and ciphering algorithms, and indicates the activation of AS security.

[0008] Once AS security is activated, all subsequent RRC signaling messages are integrity protected and ciphered, as applicable, and user plane data packets are ciphered prior to transmission. Furthermore, AS security procedures also support re-keying and security key updates, for example during handover or mobility events, to maintain the robustness of secure communication throughout the UE's connectivity with the network.

[0009] An aspect of the present disclosure is to provide method and apparatus for security update during cell switch in a wireless communication system.

[0010] According to an embodiment of the present disclosure, a method performed by a user equipment (UE) configured to operate in a wireless communication system comprises: applying a configuration for a first cell group and a configuration for a second cell group; receiving a cell switch configuration related to the first cell group comprising one or more candidate configurations; receiving a cell switch command; triggering a cell switch on the first cell group based on the cell switch command, wherein the cell switch is related to a candidate configuration among the one or more candidate configurations; performing a security update for the first cell group based on the cell switch being triggered on the first cell group; and performing a security update for the second cell group based on the security update for the first cell group being performed.

[0011] According to an embodiment of the present disclosure, a method performed by a network node configured to operate in a wireless communication system comprises: transmitting a configuration for a first cell group and a configuration for a second cell group; transmitting a cell switch configuration related to the first cell group comprising one or more candidate configurations; and transmitting a cell switch command, wherein a cell switch is triggered on the first cell group based on the cell switch command, wherein the cell switch is related to a candidate configuration among the one or more candidate configurations, wherein a security update for the first cell group is performed based on the cell switch being triggered on the first cell group, and wherein a security update for the second cell group is performed based on the security update for the first cell group being performed.

[0012] According to various embodiments, apparatuses to implement the above methods are provided.

[0013] The present disclosure may have various advantageous effects.

[0014] For example, in the case of MCG LTM cell switch with keeping the existing SN connection, the UE may perform the SN security update based on the updated MN security key and the counter value (e.g., sk-Counter) if the MN security is updated due to the MCG LTM cell switch. By doing so, a redundant / un-necessary security update can be prevented and the re-use of security key that were used in the past can be prevented.

[0015] Advantageous effects which can be obtained through specific embodiments of the present disclosure are not limited to the advantageous effects listed above. For example, there may be a variety of technical effects that a person having ordinary skill in the related art can understand and / or derive from the present disclosure. Accordingly, the specific effects of the present disclosure are not limited to those explicitly described herein, but may include various effects that may be understood or derived from the technical features of the present disclosure.

[0016] FIG. 1 shows an example of a communication system to which implementations of the present disclosure is applied.

[0017] FIG. 2 shows an example of wireless devices to which implementations of the present disclosure is applied.

[0018] FIG. 3 shows an example of UE to which implementations of the present disclosure is applied.

[0019] FIGs. 4 and 5 show an example of protocol stacks in a 3GPP based wireless communication system to which implementations of the present disclosure is applied.

[0020] FIG. 6 shows a frame structure in a 3GPP based wireless communication system to which implementations of the present disclosure is applied.

[0021] FIG. 7 shows a data flow example in the 3GPP NR system to which implementations of the present disclosure is applied.

[0022] FIG. 8 shows an example of overall architecture of RAN.

[0023] FIG. 9 shows an example of a signalling procedure for LTM according to an embodiment of the present disclosure.

[0024] FIGs. 10a to 10d show an example of a subsequent intra-CU MCG LTM cell switch after inter-CU MCG LTM cell switch when the SN connection is maintained.

[0025] FIG. 11 shows an example of a method performed by a UE for security update during cell switch according to an embodiment of the present disclosure.

[0026] FIG. 12 shows an example of a signal flow between UE and network node for security update during cell switch according to an embodiment of the present disclosure.

[0027] FIG. 13 shows a first example of a security update during cell switch according to an embodiment of the present disclosure.

[0028] FIG. 14 shows a second example of a security update during cell switch according to an embodiment of the present disclosure.

[0029] FIG. 15 shows a third example of a security update during cell switch according to an embodiment of the present disclosure.

[0030] The following techniques, apparatuses, and systems may be applied to a variety of wireless multiple access systems. Examples of the multiple access systems include a Code Division Multiple Access (CDMA) system, a Frequency Division Multiple Access (FDMA) system, a Time Division Multiple Access (TDMA) system, an Orthogonal Frequency Division Multiple Access (OFDMA) system, a Single Carrier Frequency Division Multiple Access (SC-FDMA) system, and a Multi Carrier Frequency Division Multiple Access (MC-FDMA) system. CDMA may be embodied through radio technology such as Universal Terrestrial Radio Access (UTRA) or CDMA2000. TDMA may be embodied through radio technology such as Global System for Mobile communications (GSM), General Packet Radio Service (GPRS), or Enhanced Data rates for GSM Evolution (EDGE). OFDMA may be embodied through radio technology such as Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, or Evolved UTRA (E-UTRA). UTRA is a part of a Universal Mobile Telecommunications System (UMTS). 3rd Generation Partnership Project (3GPP) Long-Term Evolution (LTE) is a part of Evolved UMTS (E-UMTS) using E-UTRA. 3GPP LTE employs OFDMA in downlink (DL) and SC-FDMA in uplink (UL). Evolution of 3GPP LTE includes LTE-Advanced (LTE-A), LTE-A Pro, and / or 5G New Radio (NR).

[0031] For convenience of description, implementations of the present disclosure are mainly described in regards to a 3GPP based wireless communication system. However, the technical features of the present disclosure are not limited thereto. For example, although the following detailed description is given based on a mobile communication system corresponding to a 3GPP based wireless communication system, aspects of the present disclosure that are not limited to 3GPP based wireless communication system are applicable to other mobile communication systems.

[0032] For terms and technologies which are not specifically described among the terms of and technologies employed in the present disclosure, the wireless communication standard documents published before the present disclosure may be referenced.

[0033] In the present disclosure, "A or B" may mean "only A", "only B", or "both A and B". In other words, "A or B" in the present disclosure may be interpreted as "A and / or B". For example, "A, B or C" in the present disclosure may mean "only A", "only B", "only C", or "any combination of A, B and C".

[0034] In the present disclosure, slash ( / ) or comma (,) may mean "and / or". For example, "A / B" may mean "A and / or B". Accordingly, "A / B" may mean "only A", "only B", or "both A and B". For example, "A, B, C" may mean "A, B or C".

[0035] In the present disclosure, "at least one of A and B" may mean "only A", "only B" or "both A and B". In addition, the expression "at least one of A or B" or "at least one of A and / or B" in the present disclosure may be interpreted as same as "at least one of A and B".

[0036] In addition, in the present disclosure, "at least one of A, B and C" may mean "only A", "only B", "only C", or "any combination of A, B and C". In addition, "at least one of A, B or C" or "at least one of A, B and / or C" may mean "at least one of A, B and C".

[0037] Also, parentheses used in the present disclosure may mean "for example". In detail, when it is shown as "control information (PDCCH)", "PDCCH" may be proposed as an example of "control information". In other words, "control information" in the present disclosure is not limited to "PDCCH", and "PDCCH" may be proposed as an example of "control information". In addition, even when shown as "control information (i.e., PDCCH)", "PDCCH" may be proposed as an example of "control information".

[0038] Technical features that are separately described in one drawing in the present disclosure may be implemented separately or simultaneously.

[0039] Although not limited thereto, various descriptions, functions, procedures, suggestions, methods and / or operational flowcharts of the present disclosure disclosed herein can be applied to various fields requiring wireless communication and / or connection (e.g., 5G) between devices.

[0040] Hereinafter, the present disclosure will be described in more detail with reference to drawings. The same reference numerals in the following drawings and / or descriptions may refer to the same and / or corresponding hardware blocks, software blocks, and / or functional blocks unless otherwise indicated.

[0041] FIG. 1 shows an example of a communication system to which implementations of the present disclosure is applied.

[0042] The 5G usage scenarios shown in FIG. 1 are only exemplary, and the technical features of the present disclosure can be applied to other 5G usage scenarios which are not shown in FIG. 1.

[0043] Three main requirement categories for 5G include (1) a category of enhanced Mobile BroadBand (eMBB), (2) a category of massive Machine Type Communication (mMTC), and (3) a category of Ultra-Reliable and Low Latency Communications (URLLC).

[0044] Referring to FIG. 1, the communication system 1 includes wireless devices 100a to 100f, Base Stations (BSs) 200, and a network 300. Although FIG. 1 illustrates a 5G network as an example of the network of the communication system 1, the implementations of the present disclosure are not limited to the 5G system, and can be applied to the future communication system beyond the 5G system.

[0045] The BSs 200 and the network 300 may be implemented as wireless devices and a specific wireless device may operate as a BS / network node with respect to other wireless devices.

[0046] The wireless devices 100a to 100f represent devices performing communication using Radio Access Technology (RAT) (e.g., 5G NR or LTE) and may be referred to as communication / radio / 5G devices. The wireless devices 100a to 100f may include, without being limited to, a robot 100a, vehicles 100b-1 and 100b-2, an eXtended Reality (XR) device 100c, a hand-held device 100d, a home appliance 100e, an Internet-of-Things (IoT) device 100f, and an Artificial Intelligence (AI) device / server 400. For example, the vehicles may include a vehicle having a wireless communication function, an autonomous driving vehicle, and a vehicle capable of performing communication between vehicles. The vehicles may include an Unmanned Aerial Vehicle (UAV) (e.g., a drone). The XR device may include an Augmented Reality (AR) / Virtual Reality (VR) / Mixed Reality (MR) device and may be implemented in the form of a Head-Mounted Device (HMD), a Head-Up Display (HUD) mounted in a vehicle, a television, a smartphone, a computer, a wearable device, a home appliance device, a digital signage, a vehicle, a robot, etc. The hand-held device may include a smartphone, a smartpad, a wearable device (e.g., a smartwatch or a smartglasses), and a computer (e.g., a notebook). The home appliance may include a TV, a refrigerator, and a washing machine. The IoT device may include a sensor and a smartmeter.

[0047] In the present disclosure, the wireless devices 100a to 100f may be called User Equipments (UEs). A UE may include, for example, a cellular phone, a smartphone, a laptop computer, a digital broadcast terminal, a Personal Digital Assistant (PDA), a Portable Multimedia Player (PMP), a navigation system, a slate Personal Computer (PC), a tablet PC, an ultrabook, a vehicle, a vehicle having an autonomous traveling function, a connected car, an UAV, an AI module, a robot, an AR device, a VR device, an MR device, a hologram device, a public safety device, an MTC device, an IoT device, a medical device, a FinTech device (or a financial device), a security device, a weather / environment device, a device related to a 5G service, or a device related to a fourth industrial revolution field.

[0048] The wireless devices 100a to 100f may be connected to the network 300 via the BSs 200. An AI technology may be applied to the wireless devices 100a to 100f and the wireless devices 100a to 100f may be connected to the AI server 400 via the network 300. The network 300 may be configured using a 3G network, a 4G (e.g., LTE) network, a 5G (e.g., NR) network, and a beyond-5G network. Although the wireless devices 100a to 100f may communicate with each other through the BSs 200 / network 300, the wireless devices 100a to 100f may perform direct communication (e.g., sidelink communication) with each other without passing through the BSs 200 / network 300. For example, the vehicles 100b-1 and 100b-2 may perform direct communication (e.g., Vehicle-to-Vehicle (V2V) / Vehicle-to-everything (V2X) communication). The IoT device (e.g., a sensor) may perform direct communication with other IoT devices (e.g., sensors) or other wireless devices 100a to 100f.

[0049] Wireless communication / connections 150a, 150b and 150c may be established between the wireless devices 100a to 100f and / or between wireless device 100a to 100f and BS 200 and / or between BSs 200. Herein, the wireless communication / connections may be established through various RATs (e.g., 5G NR) such as uplink / downlink communication 150a, sidelink communication (or Device-to-Device (D2D) communication) 150b, inter-base station communication 150c (e.g., relay, Integrated Access and Backhaul (IAB)), etc. The wireless devices 100a to 100f and the BSs 200 / the wireless devices 100a to 100f may transmit / receive radio signals to / from each other through the wireless communication / connections 150a, 150b and 150c. For example, the wireless communication / connections 150a, 150b and 150c may transmit / receive signals through various physical channels. To this end, at least a part of various configuration information configuring processes, various signal processing processes (e.g., channel encoding / decoding, modulation / demodulation, and resource mapping / de-mapping), and resource allocating processes, for transmitting / receiving radio signals, may be performed based on the various proposals of the present disclosure.

[0050] NR supports multiples numerologies (and / or multiple Sub-Carrier Spacings (SCS)) to support various 5G services. For example, if SCS is 15 kHz, wide area can be supported in traditional cellular bands, and if SCS is 30 kHz / 60 kHz, dense-urban, lower latency, and wider carrier bandwidth can be supported. If SCS is 60 kHz or higher, bandwidths greater than 24.25 GHz can be supported to overcome phase noise.

[0051] The NR frequency band may be defined as two types of frequency range, i.e., Frequency Range 1 (FR1) and Frequency Range 2 (FR2). The numerical value of the frequency range may be changed. For example, the frequency ranges of the two types (FR1 and FR2) may be as shown in Table 1 below. For ease of explanation, in the frequency ranges used in the NR system, FR1 may mean "sub 6 GHz range", FR2 may mean "above 6 GHz range," and may be referred to as millimeter Wave (mmW).

[0052] Frequency Range designationCorresponding frequency rangeSubcarrier SpacingFR1450MHz - 6000MHz15, 30, 60kHzFR224250MHz - 52600MHz60, 120, 240kHz

[0053] As mentioned above, the numerical value of the frequency range of the NR system may be changed. For example, FR1 may include a frequency band of 410MHz to 7125MHz as shown in Table 2 below. That is, FR1 may include a frequency band of 6GHz (or 5850, 5900, 5925 MHz, etc.) or more. For example, a frequency band of 6 GHz (or 5850, 5900, 5925 MHz, etc.) or more included in FR1 may include an unlicensed band. Unlicensed bands may be used for a variety of purposes, for example for communication for vehicles (e.g., autonomous driving).

[0054] Frequency Range designationCorresponding frequency rangeSubcarrier SpacingFR1410MHz - 7125MHz15, 30, 60kHzFR224250MHz - 52600MHz60, 120, 240kHz

[0055] Here, the radio communication technologies implemented in the wireless devices in the present disclosure may include NarrowBand IoT (NB-IoT) technology for low-power communication as well as LTE, NR and 6G. For example, NB-IoT technology may be an example of Low Power Wide Area Network (LPWAN) technology, may be implemented in specifications such as LTE Cat NB1 and / or LTE Cat NB2, and may not be limited to the above-mentioned names. Additionally and / or alternatively, the radio communication technologies implemented in the wireless devices in the present disclosure may communicate based on LTE-M technology. For example, LTE-M technology may be an example of LPWAN technology and be called by various names such as enhanced MTC (eMTC). For example, LTE-M technology may be implemented in at least one of the various specifications, such as 1) LTE Cat 0, 2) LTE Cat M1, 3) LTE Cat M2, 4) LTE non-bandwidth limited (non-BL), 5) LTE-MTC, 6) LTE Machine Type Communication, and / or 7) LTE M, and may not be limited to the above-mentioned names. Additionally and / or alternatively, the radio communication technologies implemented in the wireless devices in the present disclosure may include at least one of ZigBee, Bluetooth, and / or LPWAN which take into account low-power communication, and may not be limited to the above-mentioned names. For example, ZigBee technology may generate Personal Area Networks (PANs) associated with small / low-power digital communication based on various specifications such as IEEE 802.15.4 and may be called various names.FIG. 2 shows an example of wireless devices to which implementations of the present disclosure is applied.

[0056] In FIG. 2, The first wireless device 100 and / or the second wireless device 200 may be implemented in various forms according to use cases / services. For example, {the first wireless device 100 and the second wireless device 200} may correspond to at least one of {the wireless device 100a to 100f and the BS 200}, {the wireless device 100a to 100f and the wireless device 100a to 100f} and / or {the BS 200 and the BS 200} of FIG. 1. The first wireless device 100 and / or the second wireless device 200 may be configured by various elements, devices / parts, and / or modules.

[0057] The first wireless device 100 may include at least one transceiver, such as a transceiver 106, at least one processing chip, such as a processing chip 101, and / or one or more antennas 108.

[0058] The processing chip 101 may include at least one processor, such a processor 102, and at least one memory, such as a memory 104. Additional and / or alternatively, the memory 104 may be placed outside of the processing chip 101.

[0059] The processor 102 may control the memory 104 and / or the transceiver 106 and may be adapted to implement the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts described in the present disclosure. For example, the processor 102 may process information within the memory 104 to generate first information / signals and then transmit radio signals including the first information / signals through the transceiver 106. The processor 102 may receive radio signals including second information / signals through the transceiver 106 and then store information obtained by processing the second information / signals in the memory 104.

[0060] The memory 104 may be operably connectable to the processor 102. The memory 104 may store various types of information and / or instructions. The memory 104 may store a firmware and / or a software code 105 which implements codes, commands, and / or a set of commands that, when executed by the processor 102, perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure. For example, the firmware and / or the software code 105 may implement instructions that, when executed by the processor 102, perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure. For example, the firmware and / or the software code 105 may control the processor 102 to perform one or more protocols. For example, the firmware and / or the software code 105 may control the processor 102 to perform one or more layers of the radio interface protocol.

[0061] Herein, the processor 102 and the memory 104 may be a part of a communication modem / circuit / chip designed to implement RAT (e.g., LTE or NR). The transceiver 106 may be connected to the processor 102 and transmit and / or receive radio signals through one or more antennas 108. Each of the transceiver 106 may include a transmitter and / or a receiver. The transceiver 106 may be interchangeably used with Radio Frequency (RF) unit(s). In the present disclosure, the first wireless device 100 may represent a communication modem / circuit / chip.

[0062] The second wireless device 200 may include at least one transceiver, such as a transceiver 206, at least one processing chip, such as a processing chip 201, and / or one or more antennas 208.

[0063] The processing chip 201 may include at least one processor, such a processor 202, and at least one memory, such as a memory 204. Additional and / or alternatively, the memory 204 may be placed outside of the processing chip 201.

[0064] The processor 202 may control the memory 204 and / or the transceiver 206 and may be adapted to implement the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts described in the present disclosure. For example, the processor 202 may process information within the memory 204 to generate third information / signals and then transmit radio signals including the third information / signals through the transceiver 206. The processor 202 may receive radio signals including fourth information / signals through the transceiver 106 and then store information obtained by processing the fourth information / signals in the memory 204.

[0065] The memory 204 may be operably connectable to the processor 202. The memory 204 may store various types of information and / or instructions. The memory 204 may store a firmware and / or a software code 205 which implements codes, commands, and / or a set of commands that, when executed by the processor 202, perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure. For example, the firmware and / or the software code 205 may implement instructions that, when executed by the processor 202, perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure. For example, the firmware and / or the software code 205 may control the processor 202 to perform one or more protocols. For example, the firmware and / or the software code 205 may control the processor 202 to perform one or more layers of the radio interface protocol.

[0066] Herein, the processor 202 and the memory 204 may be a part of a communication modem / circuit / chip designed to implement RAT (e.g., LTE or NR). The transceiver 206 may be connected to the processor 202 and transmit and / or receive radio signals through one or more antennas 208. Each of the transceiver 206 may include a transmitter and / or a receiver. The transceiver 206 may be interchangeably used with RF unit. In the present disclosure, the second wireless device 200 may represent a communication modem / circuit / chip.

[0067] Hereinafter, hardware elements of the wireless devices 100 and 200 will be described more specifically. One or more protocol layers may be implemented by, without being limited to, one or more processors 102 and 202. For example, the one or more processors 102 and 202 may implement one or more layers (e.g., functional layers such as Physical (PHY) layer, Media Access Control (MAC) layer, Radio Link Control (RLC) layer, Packet Data Convergence Protocol (PDCP) layer, Radio Resource Control (RRC) layer, and Service Data Adaptation Protocol (SDAP) layer). The one or more processors 102 and 202 may generate one or more Protocol Data Units (PDUs), one or more Service Data Unit (SDUs), messages, control information, data, or information according to the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure. The one or more processors 102 and 202 may generate signals (e.g., baseband signals) including PDUs, SDUs, messages, control information, data, or information according to the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure and provide the generated signals to the one or more transceivers 106 and 206. The one or more processors 102 and 202 may receive the signals (e.g., baseband signals) from the one or more transceivers 106 and 206 and acquire the PDUs, SDUs, messages, control information, data, or information according to the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure.

[0068] The one or more processors 102 and 202 may be referred to as controllers, microcontrollers, microprocessors, or microcomputers. The one or more processors 102 and 202 may be implemented by hardware, firmware, software, or a combination thereof. As an example, one or more Application Specific Integrated Circuits (ASICs), one or more Digital Signal Processors (DSPs), one or more Digital Signal Processing Devices (DSPDs), one or more Programmable Logic Devices (PLDs), or one or more Field Programmable Gate Arrays (FPGAs) may be included in the one or more processors 102 and 202. For example, the one or more processors 102 and 202 may be configured by a set of a communication control processor, an Application Processor (AP), an Electronic Control Unit (ECU), a Central Processing Unit (CPU), a Graphic Processing Unit (GPU), and a memory control processor.

[0069] The one or more memories 104 and 204 may be connected to the one or more processors 102 and 202 and store various types of data, signals, messages, information, programs, code, instructions, and / or commands. The one or more memories 104 and 204 may be configured by Random Access Memory (RAM), Dynamic RAM (DRAM), Read-Only Memory (ROM), electrically Erasable Programmable Read-Only Memory (EPROM), flash memory, volatile memory, non-volatile memory, hard drive, register, cash memory, computer-readable storage medium, and / or combinations thereof. The one or more memories 104 and 204 may be located at the interior and / or exterior of the one or more processors 102 and 202. The one or more memories 104 and 204 may be connected to the one or more processors 102 and 202 through various technologies such as wired or wireless connection.

[0070] The one or more transceivers 106 and 206 may transmit user data, control information, and / or radio signals / channels, mentioned in the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure, to one or more other devices. The one or more transceivers 106 and 206 may receive user data, control information, and / or radio signals / channels, mentioned in the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure, from one or more other devices. For example, the one or more transceivers 106 and 206 may be connected to the one or more processors 102 and 202 and transmit and receive radio signals. For example, the one or more processors 102 and 202 may perform control so that the one or more transceivers 106 and 206 may transmit user data, control information, or radio signals to one or more other devices. The one or more processors 102 and 202 may perform control so that the one or more transceivers 106 and 206 may receive user data, control information, or radio signals from one or more other devices.

[0071] The one or more transceivers 106 and 206 may be connected to the one or more antennas 108 and 208. Additionally and / or alternatively, the one or more transceivers 106 and 206 may include one or more antennas 108 and 208. The one or more transceivers 106 and 206 may be adapted to transmit and receive user data, control information, and / or radio signals / channels, mentioned in the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure, through the one or more antennas 108 and 208. In the present disclosure, the one or more antennas 108 and 208 may be a plurality of physical antennas or a plurality of logical antennas (e.g., antenna ports).

[0072] The one or more transceivers 106 and 206 may convert received user data, control information, radio signals / channels, etc., from RF band signals into baseband signals in order to process received user data, control information, radio signals / channels, etc., using the one or more processors 102 and 202. The one or more transceivers 106 and 206 may convert the user data, control information, radio signals / channels, etc., processed using the one or more processors 102 and 202 from the base band signals into the RF band signals. To this end, the one or more transceivers 106 and 206 may include (analog) oscillators and / or filters. For example, the one or more transceivers 106 and 206 can up-convert OFDM baseband signals to OFDM signals by their (analog) oscillators and / or filters under the control of the one or more processors 102 and 202 and transmit the up-converted OFDM signals at the carrier frequency. The one or more transceivers 106 and 206 may receive OFDM signals at a carrier frequency and down-convert the OFDM signals into OFDM baseband signals by their (analog) oscillators and / or filters under the control of the one or more processors 102 and 202.

[0073] Although not shown in FIG. 2, the wireless devices 100 and 200 may further include additional components. The additional components 140 may be variously configured according to types of the wireless devices 100 and 200. For example, the additional components 140 may include at least one of a power unit / battery, an Input / Output (I / O) device (e.g., audio I / O port, video I / O port), a driving device, and a computing device. The additional components 140 may be coupled to the one or more processors 102 and 202 via various technologies, such as a wired or wireless connection.

[0074] In the implementations of the present disclosure, a UE may operate as a transmitting device in Uplink (UL) and as a receiving device in Downlink (DL). In the implementations of the present disclosure, a BS may operate as a receiving device in UL and as a transmitting device in DL. Hereinafter, for convenience of description, it is mainly assumed that the first wireless device 100 acts as the UE, and the second wireless device 200 acts as the BS. For example, the processor(s) 102 connected to, mounted on or launched in the first wireless device 100 may be adapted to perform the UE behavior according to an implementation of the present disclosure or control the transceiver(s) 106 to perform the UE behavior according to an implementation of the present disclosure. The processor(s) 202 connected to, mounted on or launched in the second wireless device 200 may be adapted to perform the BS behavior according to an implementation of the present disclosure or control the transceiver(s) 206 to perform the BS behavior according to an implementation of the present disclosure.

[0075] In the present disclosure, a BS is also referred to as a node B (NB), an eNode B (eNB), or a gNB.

[0076] FIG. 3 shows an example of UE to which implementations of the present disclosure is applied.

[0077] Referring to FIG. 3, a UE 100 may correspond to the first wireless device 100 of FIG. 2.

[0078] A UE 100 includes a processor 102, a memory 104, a transceiver 106, one or more antennas 108, a power management module 141, a battery 142, a display 143, a keypad 144, a Subscriber Identification Module (SIM) card 145, a speaker 146, and a microphone 147.

[0079] The processor 102 may be adapted to implement the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure. The processor 102 may be adapted to control one or more other components of the UE 100 to implement the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure. Layers of the radio interface protocol may be implemented in the processor 102. The processor 102 may include ASIC, other chipset, logic circuit and / or data processing device. The processor 102 may be an application processor. The processor 102 may include at least one of DSP, CPU, GPU, a modem (modulator and demodulator). An example of the processor 102 may be found in SNAPDRAGONTMseries of processors made by Qualcomm®, EXYNOSTMseries of processors made by Samsung®, A series of processors made by Apple®, HELIOTMseries of processors made by MediaTek®, ATOMTMseries of processors made by Intel®or a corresponding next generation processor.

[0080] The memory 104 is operatively coupled with the processor 102 and stores a variety of information to operate the processor 102. The memory 104 may include ROM, RAM, flash memory, memory card, storage medium and / or other storage device. When the embodiments are implemented in software, the techniques described herein can be implemented with modules (e.g., procedures, functions, etc.) that perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed in the present disclosure. The modules can be stored in the memory 104 and executed by the processor 102. The memory 104 can be implemented within the processor 102 or external to the processor 102 in which case those can be communicatively coupled to the processor 102 via various means as is known in the art.

[0081] The transceiver 106 is operatively coupled with the processor 102, and transmits and / or receives a radio signal. The transceiver 106 includes a transmitter and a receiver. The transceiver 106 may include baseband circuitry to process radio frequency signals. The transceiver 106 controls the one or more antennas 108 to transmit and / or receive a radio signal.

[0082] The power management module 141 manages power for the processor 102 and / or the transceiver 106. The battery 142 supplies power to the power management module 141.

[0083] The display 143 outputs results processed by the processor 102. The keypad 144 receives inputs to be used by the processor 102. The keypad 144 may be shown on the display 143.

[0084] The SIM card 145 is an　integrated circuit　that is intended to　securely store the　International Mobile Subscriber Identity　(IMSI) number and its related　key, which are used to identify and authenticate subscribers on　mobile telephony　devices (such as　mobile phones　and　computers). It is also possible to store contact information on many SIM cards.

[0085] The speaker 146 outputs sound-related results processed by the processor 102. The microphone 147 receives sound-related inputs to be used by the processor 102.

[0086] FIGs. 4 and 5 show an example of protocol stacks in a 3GPP based wireless communication system to which implementations of the present disclosure is applied.

[0087] In particular, FIG. 4 illustrates an example of a radio interface user plane protocol stack between a UE and a BS and FIG. 5 illustrates an example of a radio interface control plane protocol stack between a UE and a BS. The control plane refers to a path through which control messages used to manage call by a UE and a network are transported. The user plane refers to a path through which data generated in an application layer, for example, voice data or Internet packet data are transported. Referring to FIG. 4, the user plane protocol stack may be divided into Layer 1 (L1, for example PHY layer) and Layer 2 (L2, for example MAC / RLC / PDCP layer). Referring to FIG. 5, the control plane protocol stack may be divided into Layer 1 (L1, for example PHY layer), Layer 2 (L2, for example MAC / RLC / PDCP layer), Layer 3 (L3, for example an RRC layer), and a non-access stratum (NAS) layer. Layer 1, Layer 2 and Layer 3 are referred to as an access stratum (AS).

[0088] In the 3GPP LTE system, the Layer 2 is split into the following sublayers: MAC, RLC, and PDCP. In the 3GPP NR system, the Layer 2 is split into the following sublayers: MAC, RLC, PDCP and SDAP. The PHY layer offers to the MAC sublayer transport channels, the MAC sublayer offers to the RLC sublayer logical channels, the RLC sublayer offers to the PDCP sublayer RLC channels, the PDCP sublayer offers to the SDAP sublayer radio bearers. The SDAP sublayer offers to 5G core network quality of service (QoS) flows.

[0089] In the 3GPP NR system, the main services and functions of the MAC sublayer include: mapping between logical channels and transport channels; multiplexing / de-multiplexing of MAC SDUs belonging to one or different logical channels into / from transport blocks (TB) delivered to / from the physical layer on transport channels; scheduling information reporting; error correction through hybrid automatic repeat request (HARQ) (one HARQ entity per cell in case of carrier aggregation (CA)); priority handling between UEs by means of dynamic scheduling; priority handling between logical channels of one UE by means of logical channel prioritization; padding. A single MAC entity may support multiple numerologies, transmission timings and cells. Mapping restrictions in logical channel prioritization control which numerology(ies), cell(s), and transmission timing(s) a logical channel can use.

[0090] Different kinds of data transfer services are offered by MAC. To accommodate different kinds of data transfer services, multiple types of logical channels are defined, i.e., each supporting transfer of a particular type of information. Each logical channel type is defined by what type of information is transferred. Logical channels are classified into two groups: control channels and traffic channels. Control channels are used for the transfer of control plane information only, and traffic channels are used for the transfer of user plane information only. Broadcast control channel (BCCH) is a downlink logical channel for broadcasting system control information, paging control channel (PCCH) is a downlink logical channel that transfers paging information, system information change notifications and indications of ongoing public warning service (PWS) broadcasts, common control channel (CCCH) is a logical channel for transmitting control information between UEs and network and used for UEs having no RRC connection with the network, and dedicated control channel (DCCH) is a point-to-point bi-directional logical channel that transmits dedicated control information between a UE and the network and used by UEs having an RRC connection. Dedicated traffic channel (DTCH) is a point-to-point logical channel, dedicated to one UE, for the transfer of user information. A DTCH can exist in both uplink and downlink. In downlink, the following connections between logical channels and transport channels exist: BCCH can be mapped to broadcast channel (BCH); BCCH can be mapped to downlink shared channel (DL-SCH); PCCH can be mapped to paging channel (PCH); CCCH can be mapped to DL-SCH; DCCH can be mapped to DL-SCH; and DTCH can be mapped to DL-SCH. In uplink, the following connections between logical channels and transport channels exist: CCCH can be mapped to uplink shared channel (UL-SCH); DCCH can be mapped to UL-SCH; and DTCH can be mapped to UL-SCH.

[0091] The RLC sublayer supports three transmission modes: transparent mode (TM), unacknowledged mode (UM), and acknowledged node (AM). The RLC configuration is per logical channel with no dependency on numerologies and / or transmission durations. In the 3GPP NR system, the main services and functions of the RLC sublayer depend on the transmission mode and include: transfer of upper layer PDUs; sequence numbering independent of the one in PDCP (UM and AM); error correction through ARQ (AM only); segmentation (AM and UM) and re-segmentation (AM only) of RLC SDUs; reassembly of SDU (AM and UM); duplicate detection (AM only); RLC SDU discard (AM and UM); RLC re-establishment; protocol error detection (AM only).

[0092] In the 3GPP NR system, the main services and functions of the PDCP sublayer for the user plane include: sequence numbering; header compression and decompression using robust header compression (ROHC); transfer of user data; reordering and duplicate detection; in-order delivery; PDCP PDU routing (in case of split bearers); retransmission of PDCP SDUs; ciphering, deciphering and integrity protection; PDCP SDU discard; PDCP re-establishment and data recovery for RLC AM; PDCP status reporting for RLC AM; duplication of PDCP PDUs and duplicate discard indication to lower layers. The main services and functions of the PDCP sublayer for the control plane include: sequence numbering; ciphering, deciphering and integrity protection; transfer of control plane data; reordering and duplicate detection; in-order delivery; duplication of PDCP PDUs and duplicate discard indication to lower layers.

[0093] In the 3GPP NR system, the main services and functions of SDAP include: mapping between a QoS flow and a data radio bearer; marking QoS flow ID (QFI) in both DL and UL packets. A single protocol entity of SDAP is configured for each individual PDU session.

[0094] In the 3GPP NR system, the main services and functions of the RRC sublayer include: broadcast of system information related to AS and NAS; paging initiated by 5GC or RAN; establishment, maintenance and release of an RRC connection between the UE and RAN; security functions including key management; establishment, configuration, maintenance and release of signalling radio bearers (SRBs) and data radio bearers (DRBs); mobility functions (including: handover and context transfer, UE cell selection and reselection and control of cell selection and reselection, inter-RAT mobility); QoS management functions; UE measurement reporting and control of the reporting; detection of and recovery from radio link failure; NAS message transfer to / from NAS from / to UE.

[0095] FIG. 6 shows a frame structure in a 3GPP based wireless communication system to which implementations of the present disclosure is applied.

[0096] The frame structure shown in FIG. 6 is purely exemplary and the number of subframes, the number of slots, and / or the number of symbols in a frame may be variously changed. In the 3GPP based wireless communication system, OFDM numerologies (e.g., subcarrier spacing (SCS), transmission time interval (TTI) duration) may be differently configured between a plurality of cells aggregated for one UE. For example, if a UE is configured with different SCSs for cells aggregated for the cell, an (absolute time) duration of a time resource (e.g., a subframe, a slot, or a TTI) including the same number of symbols may be different among the aggregated cells. Herein, symbols may include OFDM symbols (or CP-OFDM symbols), SC-FDMA symbols (or discrete Fourier transform-spread-OFDM (DFT-s-OFDM) symbols).

[0097] Referring to FIG. 6, downlink and uplink transmissions are organized into frames. Each frame has Tf= 10ms duration. Each frame is divided into two half-frames, where each of the half-frames has 5ms duration. Each half-frame consists of 5 subframes, where the duration Tsfper subframe is 1ms. Each subframe is divided into slots and the number of slots in a subframe depends on a subcarrier spacing. Each slot includes 14 or 12 OFDM symbols based on a cyclic prefix (CP). In a normal CP, each slot includes 14 OFDM symbols and, in an extended CP, each slot includes 12 OFDM symbols. The numerology is based on exponentially scalable subcarrier spacing βf = 2u*15 kHz.

[0098] Table 3 shows the number of OFDM symbols per slot Nslotsymb, the number of slots per frameNframe,uslot, and the number of slots per subframe Nsubframe,uslotfor the normal CP, according to the subcarrier spacing βf = 2u*15 kHz.

[0099] uNslotsymbNframe,uslotNsubframe,uslot01410111420221440431480841416016

[0100] Table 4 shows the number of OFDM symbols per slot Nslotsymb, the number of slots per frameNframe,uslot, and the number of slots per subframe Nsubframe,uslotfor the extended CP, according to the subcarrier spacing βf = 2u*15 kHz.

[0101] uNslotsymbNframe,uslotNsubframe,uslot212404

[0102] A slot includes plural symbols (e.g., 14 or 12 symbols) in the time domain. For each numerology (e.g., subcarrier spacing) and carrier, a resource grid ofNsize,ugrid,x*NRBscsubcarriers andNsubframe,usymbOFDM symbols is defined, starting at common resource block (CRB)Nstart,ugridindicated by higher-layer signalling (e.g., RRC signalling), whereNsize,ugrid,xis the number of resource blocks (RBs) in the resource grid and the subscript x is DL for downlink and UL for uplink.NRBscis the number of subcarriers per RB. In the 3GPP based wireless communication system,NRBscis 12 generally. There is one resource grid for a given antenna portp, subcarrier spacing configurationu, and transmission direction (DL or UL). The carrier bandwidthNsize,ugridfor subcarrier spacing configurationuis given by the higher-layer parameter (e.g., RRC parameter). Each element in the resource grid for the antenna portpand the subcarrier spacing configurationuis referred to as a resource element (RE) and one complex symbol may be mapped to each RE. Each RE in the resource grid is uniquely identified by an indexkin the frequency domain and an indexlrepresenting a symbol location relative to a reference point in the time domain. In the 3GPP based wireless communication system, an RB is defined by 12 consecutive subcarriers in the frequency domain. As shown in FIG. 6, as SCS doubles, the slot length and symbol length are halved. For example, when SCS is 15kHz, the slot length is 1ms, which is the same as the subframe length. When SCS is 30kHz, the slot length is 0.5ms (=500us), and the symbol length is half of that when the SCS is 15kHz. When SCS is 60kHz, the slot length is 0.25ms (=250us), and the symbol length is half of that when the SCS is 30kHz. When SCS is 120kHz, the slot length is 0.125ms (=125us), and the symbol length is half of that when the SCS is 60kHz. When SCS is 240kHz, the slot length is 0.0625ms (=62.5us), and the symbol length is half of that when the SCS is 120kHz.

[0103] In the 3GPP NR system, RBs are classified into CRBs and physical resource blocks (PRBs). CRBs are numbered from 0 and upwards in the frequency domain for subcarrier spacing configurationu. The center of subcarrier 0 of CRB 0 for subcarrier spacing configurationucoincides with 'point A' which serves as a common reference point for resource block grids. In the 3GPP NR system, PRBs are defined within a bandwidth part (BWP) and numbered from 0 toNsizeBWP,i-1, where i is the number of the bandwidth part. The relation between the physical resource block nPRBin the bandwidth part i and the common resource block nCRBis as follows: nPRB= nCRB+NsizeBWP,i, whereNsizeBWP,iis the common resource block where bandwidth part starts relative to CRB 0. The BWP includes a plurality of consecutive RBs. A carrier may include a maximum of N (e.g., 5) BWPs. A UE may be configured with one or more BWPs on a given component carrier. Only one BWP among BWPs configured to the UE can active at a time. The active BWP defines the UE's operating bandwidth within the cell's operating bandwidth.

[0104] In the present disclosure, the term "cell" may refer to a geographic area to which one or more nodes provide a communication system, or refer to radio resources. A "cell" as a geographic area may be understood as coverage within which a node can provide service using a carrier and a "cell" as radio resources (e.g., time-frequency resources) is associated with bandwidth which is a frequency range configured by the carrier. The "cell" associated with the radio resources is defined by a combination of downlink resources and uplink resources, for example, a combination of a DL component carrier (CC) and a UL CC. The cell may be configured by downlink resources only, or may be configured by downlink resources and uplink resources. Since DL coverage, which is a range within which the node is capable of transmitting a valid signal, and UL coverage, which is a range within which the node is capable of receiving the valid signal from the UE, depends upon a carrier carrying the signal, the coverage of the node may be associated with coverage of the "cell" of radio resources used by the node. Accordingly, the term "cell" may be used to represent service coverage of the node sometimes, radio resources at other times, or a range that signals using the radio resources can reach with valid strength at other times.

[0105] In CA, two or more CCs are aggregated. A UE may simultaneously receive or transmit on one or multiple CCs depending on its capabilities. CA is supported for both contiguous and non-contiguous CCs. When CA is configured, the UE only has one RRC connection with the network. At RRC connection establishment / re-establishment / handover, one serving cell provides the NAS mobility information, and at RRC connection re-establishment / handover, one serving cell provides the security input. This cell is referred to as the primary cell (PCell). The PCell is a cell, operating on the primary frequency, in which the UE either performs the initial connection establishment procedure or initiates the connection re-establishment procedure. Depending on UE capabilities, secondary cells (SCells) can be configured to form together with the PCell a set of serving cells. An SCell is a cell providing additional radio resources on top of special cell (SpCell). The configured set of serving cells for a UE therefore always consists of one PCell and one or more SCells. For dual connectivity (DC) operation, the term SpCell refers to the PCell of the master cell group (MCG) or the primary SCell (PSCell) of the secondary cell group (SCG). An SpCell supports PUCCH transmission and contention-based random access, and is always activated. The MCG is a group of serving cells associated with a master node, comprised of the SpCell (PCell) and optionally one or more SCells. The SCG is the subset of serving cells associated with a secondary node, comprised of the PSCell and zero or more SCells, for a UE configured with DC. For a UE in RRC_CONNECTED not configured with CA / DC, there is only one serving cell comprised of the PCell. For a UE in RRC_CONNECTED configured with CA / DC, the term "serving cells" is used to denote the set of cells comprised of the SpCell(s) and all SCells. In DC, two MAC entities are configured in a UE: one for the MCG and one for the SCG.

[0106] FIG. 7 shows a data flow example in the 3GPP NR system to which implementations of the present disclosure is applied.

[0107] Referring to FIG. 7, "RB" denotes a radio bearer, and "H" denotes a header. Radio bearers are categorized into two groups: DRBs for user plane data and SRBs for control plane data. The MAC PDU is transmitted / received using radio resources through the PHY layer to / from an external device. The MAC PDU arrives to the PHY layer in the form of a transport block.

[0108] In the PHY layer, the uplink transport channels UL-SCH and random access channel (RACH) are mapped to their physical channels physical uplink shared channel (PUSCH) and physical random access channel (PRACH), respectively, and the downlink transport channels DL-SCH, BCH and PCH are mapped to physical downlink shared channel (PDSCH), physical broadcast channel (PBCH) and PDSCH, respectively. In the PHY layer, uplink control information (UCI) is mapped to physical uplink control channel (PUCCH), and downlink control information (DCI) is mapped to physical downlink control channel (PDCCH). A MAC PDU related to UL-SCH is transmitted by a UE via a PUSCH based on an UL grant, and a MAC PDU related to DL-SCH is transmitted by a BS via a PDSCH based on a DL assignment.

[0109] FIG. 8 shows an example of overall architecture of RAN.

[0110] Referring to FIG. 8, the radio access network (RAN) consists of a set of gNBs connected to the 5GC through the NG interface.

[0111] A gNB can support FDD mode, TDD mode or dual mode operation.

[0112] gNBs can be interconnected through the Xn interface.

[0113] A gNB may consist of a gNB-CU and one or more gNB-DU(s). A gNB-CU and a gNB-DU is connected via F1 interface.

[0114] One gNB-DU is connected to only one gNB-CU.

[0115] In case of network sharing with multiple cell ID broadcast, each Cell Identity associated with a subset of PLMNs corresponds to a gNB-DU and the gNB-CU it is connected to, i.e. the corresponding gNB-DUs share the same physical layer cell resources.

[0116] For resiliency, a gNB-DU may be connected to multiple gNB-CUs by appropriate implementation.

[0117] NG, Xn and F1 are logical interfaces.

[0118] For RAN, the NG and Xn-C interfaces for a gNB consisting of a gNB-CU and gNB-DUs, terminate in the gNB-CU. For EN-DC, the S1-U and X2-C interfaces for a gNB consisting of a gNB-CU and gNB-DUs, terminate in the gNB-CU. The gNB-CU and connected gNB-DUs are only visible to other gNBs and the 5GC as a gNB.

[0119] The node hosting user plane part of NR PDCP (e.g. gNB-CU, gNB-CU-UP, and for EN-DC, MeNB or SgNB depending on the bearer split) shall perform user inactivity monitoring and further informs its inactivity or (re)activation to the node having C-plane connection towards the core network (e.g. over E1, X2). The node hosting NR RLC (e.g., gNB-DU) may perform user inactivity monitoring and further inform its inactivity or (re)activation to the node hosting control plane, e.g., gNB-CU or gNB-CU-CP.

[0120] UL PDCP configuration (i.e., how the UE uses the UL at the assisting node) is indicated via X2-C (for EN-DC), Xn-C (for RAN) and F1-C. Radio Link Outage / Resume for DL and / or UL is indicated via X2-U (for EN-DC), Xn-U (for RAN) and F1-U.

[0121] The RAN is layered into a Radio Network Layer (RNL) and a Transport Network Layer (TNL).

[0122] The RAN architecture, i.e., the RAN logical nodes and interfaces between them, is defined as part of the RNL.

[0123] For each RAN interface (NG, Xn, F1) the related TNL protocol and the functionality are specified. The TNL provides services for user plane transport, signalling transport.

[0124] In NG-Flex configuration, each RAN node is connected to all AMFs of AMF Sets within an AMF Region supporting at least one slice also supported by the RAN node.

[0125] The RAN supports Multi-Radio Dual Connectivity (MR-DC) operation. In MR-DC, a multiple Rx / Tx capable UE may be configured to utilize resources provided by two different nodes connected via non-ideal backhaul, one providing NR access and the other one providing either E-UTRA or NR access. One node acts as the MN and the other as the SN. The MN and SN are connected via a network interface and at least the MN is connected to the core network.

[0126] The MN and / or the SN can be operated with shared spectrum channel access.

[0127] The MN may be associated with a master cell group (MCG) which is a group of serving cells comprising of the SpCell (PCell) and optionally one or more SCells.

[0128] The SN may be associated with a secondary cell group (SCG) which is a group of serving cells comprising of the SpCell (PSCell) and optionally one or more SCells.

[0129] In MR-DC, UE may be configured with MCG and SCG.

[0130] MR-DC is designed based on the assumption of non-ideal backhaul between the different nodes but can also be used in case of ideal backhaul.

[0131] All MR-DC normative text and procedures in this version of the specification show the aggregated node case.

[0132] Hereinafter, details regarding AS security will be described.

[0133] AS security comprises of the integrity protection and ciphering of RRC signalling (SRBs) and user data (DRBs).

[0134] RRC handles the configuration of the AS security parameters which are part of the AS configuration: the integrity protection algorithm, the ciphering algorithm, if integrity protection and / or ciphering is enabled for a DRB and two parameters, namely thekeySetChangeIndicatorand thenextHopChainingCount, which are used by the UE to determine the AS security keys upon reconfiguration with sync (with key change), connection re-establishment and / or connection resume.

[0135] The integrity protection algorithm is common for SRB1, SRB2, SRB3 (if configured), SRB4 (if configured), SRB5 (if configured) and DRBs configured with integrity protection, with the samekeyToUsevalue. The ciphering algorithm is common for SRB1, SRB2, SRB3 (if configured), SRB4 (if configured), SRB5 (if configured) and DRBs configured with the samekeyToUsevalue. Neither integrity protection nor ciphering applies for SRB0.

[0136] All DRBs related to the same PDU session have the same enable / disable setting for ciphering and the same enable / disable setting for integrity protection.

[0137] RRC integrity protection and ciphering are always activated together, i.e. in one message / procedure. RRC integrity protection and ciphering for SRBs are never de-activated. However, it is possible to switch to a 'NULL' ciphering algorithm (nea0).

[0138] The 'NULL' integrity protection algorithm (nia0) is used only for SRBs and for the UE in limited service mode, and when used for SRBs, integrity protection is disabled for DRBs. In case the 'NULL' integrity protection algorithm is used, 'NULL' ciphering algorithm is also used.

[0139] Lower layers discard RRC messages for which the integrity protection check has failed and indicate the integrity protection verification check failure to RRC.

[0140] The AS applies four different security keys: one for the integrity protection of RRC signalling (KRRCint), one for the ciphering of RRC signalling (KRRCenc), one for integrity protection of user data (KUPint) and one for the ciphering of user data (KUPenc). All four AS keys are derived from the KgNBkey. The KgNBkey is based on the KAMFkey, which is handled by upper layers.

[0141] The integrity protection and ciphering algorithms can only be changed with reconfiguration with sync. The AS keys (KgNB, KRRCint, KRRCenc, KUPintand KUPenc) change upon reconfiguration with sync (ifmasterKeyUpdateis included), and upon connection re-establishment and connection resume.

[0142] For each radio bearer an independent counter (COUNT) is maintained for each direction. For each radio bearer, theCOUNTis used as input for ciphering and integrity protection.

[0143] It is not allowed to use the sameCOUNTvalue more than once for a given security key. The network is responsible for avoiding reuse of theCOUNTwith the same RB identity and with the same key, e.g. due to the transfer of large volumes of data, release and establishment of new RBs, and multiple termination point changes for RLC-UM bearers and multiple termination point changes for RLC-AM bearer with SN terminated PDCP re-establishment (COUNT reset) due to SN only full configuration whilst the key stream inputs (i.e. bearer ID, security key) at MN have not been updated. In order to avoid such re-use, the network may e.g. use different RB identities for RB establishments, change the AS security key, or an RRC_CONNECTED to RRC_IDLE / RRC_INACTIVE and then to RRC_CONNECTED transition.

[0144] In order to limit the signalling overhead, individual messages / packets include a short sequence number (PDCP SN). In addition, an overflow counter mechanism is used: the hyper frame number (HFN). The HFN needs to be synchronized between the UE and the network.

[0145] For each SRB, the value provided by RRC to lower layers to derive the 5-bit BEARER parameter used as input for ciphering and for integrity protection is the value of the correspondingsrb-Identitywith the MSBs padded with zeroes.

[0146] For a UE provided with ansk-counter,keyToUseindicates whether the UE uses the master key (KgNB) or the secondary key (S-KeNBor S-KgNB) for a particular DRB. The secondary key is derived from the master key andsk-Counter. Whenever there is a need to refresh the secondary key, e.g. upon change of MN with KgNBchange or to avoid COUNT reuse, the security key update is used. When the UE is in NR-DC, the network may provide a UE configured with an SCG with one or a list ofsk-Counter(s)even when no DRB is setup using the secondary key (S-KgNB) in order to allow the configuration of SRB3. The network can also provide the UE with one or a list ofsk-Counter(s), even if no SCG is configured, when using SN terminated MCG bearers.

[0147] The UE shall may perform the AS security key update procedure according to the followings:

[0148] 1> if UE is connected to E-UTRA / EPC or E-UTRA / 5GC:

[0149] 2> upon reception ofsk-Counter:

[0150] 3> update the S-KgNBkey based on the KeNBkey and using the receivedsk-Countervalue for NGEN-DC;

[0151] 3> derive the KRRCencand KUpenckeys for EN-DC, or for NGEN-DC;

[0152] 3> derive the KRRCintand KUpintkeys for EN-DC or for NGEN-DC.

[0153] 1> else if this procedure was initiated due to reception of themasterKeyUpdate:

[0154] 2> if thenas-Containeris included in the receivedmasterKeyUpdate:

[0155] 3> forward thenas-Containerto the upper layers;

[0156] 2> if thekeySetChangeIndicatoris set totrue:

[0157] 3> derive or update the KgNBkey based on the KAMFkey;

[0158] 2> else:

[0159] 3> derive or update the KgNBkey based on the current KgNBkey or the NH, using thenextHopChainingCountvalue indicated in the receivedmasterKeyUpdate;

[0160] 2> store thenextHopChainingCountvalue;

[0161] 2> derive the keys associated with the KgNBkey as follows:

[0162] 3> if thesecurityAlgorithmConfigis included inSecurityConfig:

[0163] 4> derive the KRRCencand KUpenckeys associated with thecipheringAlgorithmindicated in thesecurityAlgorithmConfig;

[0164] 4> derive the KRRCintand KUpintkeys associated with theintegrityProtAlgorithmindicated in thesecurityAlgorithmConfig;

[0165] 3> else:

[0166] 4> derive the KRRCencand KUpenckeys associated with the currentcipheringAlgorithm;

[0167] 4> derive the KRRCintand KUpintkeys associated with the currentintegrityProtAlgorithm.

[0168] Ciphering and integrity protection are optional to configure for the DRBs.

[0169] 1> else if this procedure was initiated due to reception of thesk-Counter(UE is in NE-DC, or NR-DC, or is configured with SN terminated bearer(s)) or if the procedure was initiated due to selection of ansk-Counter(UE is in NR-DC):

[0170] 2> derive or update the secondary key (S-KgNBor S-KeNB) based on the KgNB key and using the received or selectedsk-Countervalue;

[0171] 2> derive the KRRCenckey and the KUpenckey using the ciphering algorithms indicated in theRadioBearerConfigassociated with the secondary key (S-KgNBor S-KeNB) as indicated bykeyToUse;

[0172] 2> derive the KRRCintkey and the KUpintkey using the integrity protection algorithms indicated in theRadioBearerConfigassociated with the secondary key (S-KgNBor S-KeNB) as indicated bykeyToUse;

[0173] If the UE has no radio bearer configured withkeyToUseset tosecondaryand receives thesk-Counteror ansk-Counteris selected for subsequent CPAC or LTM without anyRadioBearerConfigwithkeyToUseset tosecondary, the UE does not consider it as an invalid reconfiguration.

[0174] Hereinafter, a description will be given of measurements on reference signals (RSs).

[0175] The UE may receive RSs through a plurality of beams from the serving cell and / or neighbor cell(s), where each of the RSs is received through a corresponding beam. There may be RSs of multiple types - for example, RSs of a first type (e.g., synchronization signal (SS) / physical broadcast channel (PBCH) block (SSB)), and / or RSs of a second type (e.g., channel state information (CSI) - RS). That is, there may be multiple RS types comprising the first type and the second type, where RS of the first type may be SSB, and RS of the second type may be CSI-RS.

[0176] Each RS may be transmitted / received on a corresponding RS resource. For example, RS of the first type (e.g., SSB) may be transmitted / received on a resource related to the RS of the first type (e.g., SSB resource), and RS of the second type (e.g., CSI-RS) may be transmitted / received on a resource related to the RS of the second type (e.g., CSI-RS resource).

[0177] The UE may perform measurements on the RSs received through the plurality of beams from the serving cell and / or the neighbor cells, and obtain measurement results for the RSs. For example, the UE may transmit measurement report comprising the measurement results to network. For another example, the UE may perform a mobility to a target cell among the neighbor cell(s) based on the measurement results.

[0178] Further, in order to support beam management in both downlink and / or uplink transmissions, the concept of a transmission configuration indicator (TCI) has been introduced. A TCI generally represents an index associated with a specific transmission beam and / or a set of RSs, such as SSB or CSI-RS. The network may configure one or more TCI states for UE, where each TCI state corresponds to a beam identified by a RS resource.

[0179] The network may inform the UE of applicable TCI states through RRC signaling, while dynamic indication of a selected TCI state can be performed using MAC CE and / or DCI. By activating a particular TCI state, the network specifies which transmission beam is to be used for physical signals and / or data (e.g., DMRS, PTRS, PDSCH, PUSCH). Consequently, the TCI mechanism enables efficient beam correspondence between control signaling and data transmissions.

[0180] In the present disclosure, the terms "RS (e.g., SSB / CSI-RS)", "RS resource", "beam" and "TCI (or, TCI state)" can be used inter-changeably.

[0181] Hereinafter, a description will be given of mobility.

[0182] The mobility may comprise PCell change, PSCell change (or, secondary node (SN) change), and / or PSCell addition (or, SN addition).

[0183] In the present disclosure, the term "handover (HO)" may mean PCell change, or may be a broad concept that includes not only PCell change but also PSCell change / addition.

[0184] In the present disclosure, the terms "handover" and "mobility" can be used interchangeably.

[0185] In the present disclosure, the description regarding handover can also be applied to other mobility procedures (e.g., PSCell change / addition).

[0186] For example, there may be a mobility called L1 / L2-triggered mobility (LTM)(or, cell switch). LTM is a procedure in which a gNB receives L1 or L3 measurement report(s) from a UE, and on their basis the gNB may change UE serving cell by a cell switch command signalled via a MAC CE. The cell switch command indicates an LTM candidate configuration that the gNB previously prepared and provided to the UE through RRC signalling. Then the UE switches to the target configuration according to the cell switch command. The LTM procedure can be used to reduce the mobility latency.

[0187] When configured by the network, it is possible to activate TCI states of one or multiple cells that are different from the current serving cell. For instance, the TCI states of the LTM candidate cells can be activated in advance before any of those cells become the serving cell. This allows the UE to be DL synchronized with those cells, thereby facilitating a faster cell switch to one of those cells when cell switch is triggered. All the activated TCI states except those received in the cell switch command are deactivated upon LTM cell switch execution.

[0188] When configured by the network, it is possible to initiate UL TA acquisition (called early TA) procedure of one or multiple cells that are different from the current serving cells. If the cell has the same NTA as the current serving cells or NTA=0, early TA acquisition procedure is not required. The network may request the UE to perform early TA acquisition of a candidate cell before a cell switch. The early TA acquisition procedure is triggered by PDCCH order or realized through UE-based TA measurement as configured by RRC. In the former case, the gNB / gNB-DU to which the candidate cell belongs calculates the TA value and sends it to the gNB / gNB-DU to which the serving cell belongs via gNB-CU. The serving cell sends the TA value in the LTM cell switch command MAC CE when triggering LTM cell switch. In the latter case, the UE performs TA measurement for the candidate cells after being configured by RRC but the exact time the UE performs TA measurement is up to UE implementation. The UE applies the TA value measured by itself and performs RACH-less LTM upon receiving the cell switch command, if it does not include any valid TA value. The network may also send a TA value in the LTM cell switch command MAC CE without early TA acquisition.

[0189] When two TAG IDs are configured for an LTM candidate cell, the gNB-DU to which the LTM candidate cell belongs assigns the same TAG ID pointer value for each TRP to be used by the UEs.

[0190] Depending on the availability of a valid TA value, the UE performs either a RACH-less LTM or RACH-based LTM cell switch. If the valid TA value is provided in the cell switch command, the UE applies the TA value as instructed by the network. In the case where UE-based TA measurement is configured, but no valid TA value is provided in the cell switch command, the UE applies the valid TA value by itself if available. The UE performs RACH-less LTM cell switch upon receiving the cell switch command whenever a valid TA value is available. If no valid TA value is available, the UE performs RACH-based LTM cell switch.

[0191] Regardless of whether the UE is configured for UE-based TA measurement for a certain candidate cell, it will still follow the PDCCH order, which includes performing a random access procedure towards one or more candidate cells.

[0192] This also applies to the candidate cells for which the UE is capable of deriving TA values by itself. Additionally, regardless of whether the UE has already performed a random access procedure towards the candidate cells, it will still follow the UE-based measurement configuration if configured by the network.

[0193] For RACH-less LTM, the UE accesses the target cell using either a configured grant or a dynamic grant. The configured grant is provided in the LTM candidate configuration, and the UE selects the configured grant occasion associated with the beam indicated in the cell switch command. Upon initiation of LTM cell switch to the target cell, the UE starts to monitor PDCCH on the target cell for dynamic scheduling. Before RACH-less LTM procedure completion, the UE shall not trigger random access procedure if it does not have a valid PUCCH resource for triggered SRs.

[0194] The following principles apply to LTM:

[0195] - Security keys are maintained upon an LTM cell switch;

[0196] - Subsequent LTM is supported.

[0197] LTM supports both intra-gNB-DU and inter-gNB-DU mobility within the same gNB-CU. LTM supports both intra-frequency and inter-frequency mobility, including mobility to inter-frequency cell that is not a current serving cell.

[0198] LTM is supported only for licensed spectrum. The following scenarios are supported:

[0199] - PCell change in non-CA scenario and non-DC scenario;

[0200] - PCell and SCell(s) change in CA scenario;

[0201] - Dual connectivity scenario: including PCell and MCG SCell(s) change and intra-SN PSCell and SCG SCell(s) change without MN involvement. LTM for simultaneous PCell and PSCell change is not supported.

[0202] While the UE has stored LTM candidate configurations the UE can also execute any L3 handover except for DAPS handover. In the RRC message which the UE applies for any L3 handover (except DAPS), LTM candidate configurations can be added / modified / released by the target cell.

[0203] Cell switch command is conveyed in a MAC CE, which contains the necessary information to perform the LTM cell switch.

[0204] The overall procedure for LTM is shown in FIG. 9 below. Subsequent LTM is done by repeating the early synchronization, LTM cell switch execution, and LTM cell switch completion steps without the need to release, reconfigure or add other LTM candidate configurations after each LTM cell switch completion.　The general procedure over the air interface may also be applicable to SCG LTM.

[0205] FIG. 9 shows an example of a signalling procedure for LTM according to an embodiment of the present disclosure.

[0206] Referring to FIG. 9, in step S901, the UE may send aMeasurementReportmessage to the gNB. The gNB decides to configure LTM and initiates LTM preparation.

[0207] In step S903, the gNB may transmit anRRCReconfigurationmessage to the UE including the LTM candidate cell configurations of one or multiple candidate cells. TheRRCReconfigurationmessage comprise an LTM configuration / cell switch configuration (e.g.,LTM-Config) comprising a list of LTM candidate configurations (e.g.,ltm-CandidateToAddModList). That is, the network configures the UE with one or more LTM candidate configurations within theLTM-ConfigIE.

[0208] In NR-DC, the UE may receive two independentltm-Config,or anltm-Configassociated with the MCG and anltm-ConfigNRDC:

[0209] - anltm-Configassociated with the MCG that is included within anRRCReconfigurationmessage received via SRB1; and

[0210] - ether: i) anltm-Configassociated with the SCG that is included within anRRCReconfigurationmessage either received via SRB3, or, alternatively, embedded in anRRCReconfigurationmessage received via SRB1; or ii) anltm-ConfigNRDCthat is included within anRRCReconfigurationmessage received via SRB1.

[0211] The IEs in the LTM configuration / cell switch configuration (e.g.,LTM-Config) are shown in table 5:

[0212] LTM-Config-r18 ::= SEQUENCE {ltm-ReferenceConfiguration-r18 SetupRelease {ReferenceConfiguration-r18} OPTIONAL, -- Cond NR-DCltm-CandidateToReleaseList-r18 SEQUENCE (SIZE (1..maxNrofLTM-Configs-r18)) OF LTM-CandidateId-r18 OPTIONAL, -- Need Nltm-CandidateToAddModList-r18 SEQUENCE (SIZE (1..maxNrofLTM-Configs-r18)) OF LTM-Candidate-r18 OPTIONAL, -- Need Nltm-ServingCellNoResetID-r18 INTEGER (1..maxNrofLTM-Configs-plus1-r18) OPTIONAL, -- Need Nltm-CSI-ResourceConfigToAddModList-r18 SEQUENCE (SIZE (1..maxNrofLTM-CSI-ResourceConfigurations-r18)) OF LTM-CSI-ResourceConfig-r18OPTIONAL, -- Need Nltm-CSI-ResourceConfigToReleaseList-r18 SEQUENCE (SIZE (1..maxNrofLTM-CSI-ResourceConfigurations-r18)) OF LTM-CSI-ResourceConfigId-r18OPTIONAL, -- Need NattemptLTM-Switch-r18 ENUMERATED {true} OPTIONAL, -- Cond LTM-MCGltm-ServingCellUE-MeasuredTA-ID-r18 INTEGER (1..maxNrofLTM-Configs-plus1-r18) OPTIONAL, -- Need N...,[[ltm-ServingCellExecutionCondition-r19 SetupRelease {LTM-ExecutionConditionList-r19} OPTIONAL -- Need M]]}

[0213] In table 5:-ltm-ReferenceConfiguration: LTM reference configuration used to provide a configuration that is common, within the same cell group, to all configured non-complete LTM candidate configurations;

[0214] -ltm-CandidateToAddModList: a list of LTM candidate configurations (e.g.,LTM-Candidate(s)) related to candidate SpCells to be added or modified for LTM;

[0215] -ltm-CandidateToReleaseList: a list of LTM candidate configuration IDs (e.g.,LTM-CandidateId(s)) related to candidate SpCells to be removed;

[0216] -ltm-ServingCellNoResetID: serving cell ID based on which the UE determines whether a L2 reset is needed or not upon an LTM cell switch procedure;

[0217] -ltm-ServingCellUE-MeasuredTA-ID: serving cell ID based on which the UE determines whether UE-based TA measurements are needed or not; and

[0218] -ltm-ServingCellExecutionCondition: This field can only be included within anltm-Configassociated with the MCG.

[0219] The IEs in the LTM configuration / cell switch configuration for NR-DC (e.g.,LTM-ConfigNRDC) are shown in table 6:

[0220] LTM-ConfigNRDC-r19 ::= SEQUENCE {ltm-ConfigurationSCG-r19 SetupRelease {LTM-Config-r18} OPTIONAL, -- Need M...}

[0221] In table 6:-ltm-ConfigurationSCG: the network does not configure this field in anRRCReconfigurationmessage within anLTM-ConfigIE andConditionalReconfigurationIE. The network does not configure this field in anRRCReconfigurationmessage contained innr-SCGor transmitted on SRB3.

[0222] The LTM candidate configuration / candidate configuration / candidate cell configuration (e.g.,LTE-Candidate) may be related to a candidate (target) cell. The IEs in the LTM candidate configuration / candidate configuration / candidate cell configuration (e.g.,LTE-Candidate) are shown in table 7:

[0223] LTM-Candidate-r18 ::= SEQUENCE {ltm-CandidateId-r18 LTM-CandidateId-r18,ltm-CandidatePCI-r18 PhysCellId OPTIONAL, -- Need Mltm-SSB-Config-r18 LTM-SSB-Config-r18 OPTIONAL, -- Need Mltm-CandidateConfig-r18 OCTET STRING (CONTAINING RRCReconfiguration) OPTIONAL, -- Need Mltm-ConfigComplete-r18 ENUMERATED {true} OPTIONAL, -- Need Rltm-EarlyUL-SyncConfig-r18 OCTET STRING (CONTAINING EarlyUL-SyncConfig-r18) OPTIONAL, -- Need Rltm-EarlyUL-SyncConfigSUL-r18 OCTET STRING (CONTAINING EarlyUL-SyncConfig-r18) OPTIONAL, -- Need Rltm-TCI-Info-r18 LTM-TCI-Info-r18 OPTIONAL, -- Need Mltm-NoResetID-r18 INTEGER (1..maxNrofLTM-Configs-plus1-r18) OPTIONAL, -- Need Mltm-UE-MeasuredTA-ID-r18 INTEGER (1..maxNrofLTM-Configs-plus1-r18) OPTIONAL, -- Need M...,[[ltm-ExecutionCondition-r19 SetupRelease {LTM-ExecutionConditionList-r19} OPTIONAL, -- Need Mltm-NZP-CSI-RS-ResourceToAddModList-r19 SEQUENCE (SIZE (1..maxNrofNZP-CSI-RS-Resources)) OF NZP-CSI-RS-ResourceOPTIONAL, -- Need Nltm-NZP-CSI-RS-ResourceToReleaseList-r19 SEQUENCE (SIZE (1..maxNrofNZP-CSI-RS-Resources)) OF NZP-CSI-RS-ResourceIdOPTIONAL, -- Need Nltm-NZP-CSI-RS-ResourceSetToAddModList-r19 SEQUENCE (SIZE (1..maxNrofNZP-CSI-RS-ResourceSets)) OF NZP-CSI-RS-ResourceSetOPTIONAL, -- Need Nltm-NZP-CSI-RS-ResourceSetToReleaseList-r19 SEQUENCE (SIZE (1..maxNrofNZP-CSI-RS-ResourceSets)) OF NZP-CSI-RS-ResourceSetIdOPTIONAL, -- Need Nltm-CSI-ReportConfigToAddModList-r19 SEQUENCE (SIZE (1..maxNrofLTM-CSI-ReportConfigurations-r18)) OF LTM-CSI-ReportConfig-r18OPTIONAL, -- Need Nltm-CSI-ReportConfigToReleaseList-r19 SEQUENCE (SIZE (1..maxNrofLTM-CSI-ReportConfigurations-r18)) OF LTM-CSI-ReportConfigId-r18OPTIONAL -- Need Nltm-CSI-IM-ResourceSetToAddModList-r19 SEQUENCE (SIZE (1..maxNrofLTM-CSI-ReportConfigurations-r18)) OF CSI-IM-ResourceSetOPTIONAL, -- Need Nltm-CSI-IM-ResourceSetToReleaseList-r19 SEQUENCE (SIZE (1..maxNrofLTM-CSI-ReportConfigurations-r18)) OF CSI-IM-ResourceSetIdOPTIONAL -- Need N]]}LTM-SSB-Config-r18 ::= SEQUENCE {ssb-Frequency-r18 ARFCN-ValueNR,subcarrierSpacing-r18 SubcarrierSpacing,ssb-Periodicity-r18 ENUMERATED {ms5, ms10, ms20, ms40, ms80, ms160, spare2, spare1} OPTIONAL, -- Need Rssb-PositionsInBurst-r18 CHOICE {shortBitmap BIT STRING (SIZE (4)),mediumBitmap BIT STRING (SIZE (8)),longBitmap BIT STRING (SIZE (64))} OPTIONAL, -- Need Rss-PBCH-BlockPower-r18 INTEGER (-60..50) OPTIONAL, -- Need R...}

[0224] In table 7:-ltm-CandidateId: an ID used to identify an LTM candidate configuration;

[0225] -ltm-CandidateConfig: a configuration of the related candidate cell for LTM, comprisingRRCReconfigurationmessage to be applied when LTM / cell switch is executed;

[0226] -ltm-ConfigComplete: if included in theLTM-Candidate, the UE may consider that the relatedltm-CandidateConfigis a complete configuration of the related candidate cell for LTM;

[0227] -ltm-NoResetID: if this field is equal toltm-ServingCellNoResetID, UE may determine that L2 reset is needed upon an LTM cell switch procedure;

[0228] -ltm-UE-MeasuredTA-ID: if this field is equal toltm-ServingCellNoResetID, UE may determine that the UE-based TA measurements are needed;

[0229] -ltmExecutionCondition: this field can only be included within anltm-Configassociated with the MCG;

[0230] -ltm-NZP-CSI-RS-ResourceToAddModList: pool of CSI-RS resources sets which can be referred to inNZP-CSI-RS-ResourceSet;

[0231] -ltm-NZP-CSI-RS-ResourceSetToAddModList: pool of CSI-RS resource set which can be referred to inLTM-CSI-RS-ResourceConfig; and

[0232] -ltm-CSI-ReportConfigToAddModList: configured CSI report settings for LTM.

[0233] The IELTM-ExecutionConditionListmay be used to configure LTM cell switch conditions, and comprises IEs as shown in table 8:

[0234] LTM-ExecutionConditionList-r19 ::= SEQUENCE (SIZE (1..maxNrofLTM-Configs-r18)) OF LTM-ExecutionCondition-r19LTM-ExecutionCondition-r19 ::= SEQUENCE {ltm-CandidateId-r19 LTM-CandidateId-r18,executionCondition-r19 CHOICE {l1-Conditions-r19 LTM-CSI-ReportConfigId-r18,l3-Conditions-r19 SEQUENCE (SIZE (1..2)) OF MeasId} OPTIONAL, -- Need R...}

[0235] The IELTM-CSI-ReportConfigIdis used to identify anLTM-CSI-ReportConfig. The IELTM-CSI-ReportConfigis used to configure gNB-scheduled measurement report on the cell in which theLTM-CSI-ReportConfigis included when the fieldltm-ReportConfigTypeis configured asperiodic / semi-persistentOnPUCCH / semi-persistentOnPUSCH / aperiodic.

[0236] The IELTM-CSI-ReportConfigis also used to configure event-triggered measurement report when the fieldltm-ReportConfigTypeis configured aseventTriggered, within which the criteria for triggering measurement report by MAC CE.

[0237] - Event LTM2: Beam of SpCell becomes worse than absolute threshold;

[0238] - Event LTM3: Beam of candidate cell becomes amount of offset better than the beam of SpCell;

[0239] - Event LTM4: Beam of candidate cell becomes better than absolute threshold;

[0240] - Event LTM5: Beam of SpCell becomes worse than absolute threshold1 AND Beam of candidate cell becomes better than another absolute threshold2.

[0241] The IEs in theLTM-CSI-ReportConfigare shown in table 9:

[0242] LTM-CSI-ReportConfig-r18 ::= SEQUENCE {ltm-CSI-ReportConfigId-r18 LTM-CSI-ReportConfigId-r18,ltm-ResourcesForChannelMeasurement-r18 LTM-CSI-ResourceConfigId-r18,ltm-ReportConfigType-r18 CHOICE {periodic-r18 SEQUENCE {reportSlotConfig-r18 CSI-ReportPeriodicityAndOffset,pucch-CSI-ResourceList-r18 SEQUENCE (SIZE (1..maxNrofBWPs)) OF PUCCH-CSI-Resource},semiPersistentOnPUCCH-r18 SEQUENCE {reportSlotConfig-r18 CSI-ReportPeriodicityAndOffset,pucch-CSI-ResourceList-r18 SEQUENCE (SIZE (1..maxNrofBWPs)) OF PUCCH-CSI-Resource},semiPersistentOnPUSCH-r18 SEQUENCE {reportSlotConfig-r18 CSI-ReportPeriodicityAndOffset,reportSlotOffsetList-r18 SEQUENCE (SIZE (1.. maxNrofUL-Allocations-r16)) OF INTEGER (0..128),reportSlotOffsetListDCI-0-2-r18 SEQUENCE (SIZE (1.. maxNrofUL-Allocations-r16)) OF INTEGER (0..128),reportSlotOffsetListDCI-0-1-r18 SEQUENCE (SIZE (1.. maxNrofUL-Allocations-r16)) OF INTEGER (0..128),p0alpha P0-PUSCH-AlphaSetId},aperiodic-r18 SEQUENCE {reportSlotOffsetList-r18 SEQUENCE (SIZE (1.. maxNrofUL-Allocations-r16)) OF INTEGER (0..128),reportSlotOffsetListDCI-0-2-r18 SEQUENCE (SIZE (1.. maxNrofUL-Allocations-r16)) OF INTEGER (0..128),reportSlotOffsetListDCI-0-1-r18 SEQUENCE (SIZE (1.. maxNrofUL-Allocations-r16)) OF INTEGER (0..128)},...,eventTriggered-r19 SEQUENCE {eventId-r19 CHOICE {eventLTM2-r19 SEQUENCE {ltm2-Threshold-r19 MeasTriggerQuantity,hysteresis-r19 Hysteresis,timeToTrigger-r19 TimeToTrigger,...},eventLTM3-r19 SEQUENCE {ltm3-Offset-r19 MeasTriggerQuantityOffset,hysteresis-r19 Hysteresis,timeToTrigger-r19 TimeToTrigger,...},eventLTM4-r19 SEQUENCE {ltm4-Threshold-r19 MeasTriggerQuantity,hysteresis-r19 Hysteresis,timeToTrigger-r19 TimeToTrigger,...},eventLTM5-r19 SEQUENCE {ltm5-Threshold1-r19 MeasTriggerQuantity,ltm5-Threshold2-r19 MeasTriggerQuantity,hysteresis-r19 Hysteresis,timeToTrigger-r19 TimeToTrigger,...},...},ltm-CandidateReportConfigList-r19 SEQUENCE (SIZE (1.. maxNrofLTM-Configs-r18)) OF LTM-CandidateReportConfig-r19OPTIONAL, -- Need Rltm-EventTriggeredReportContent-r19 LTM-EventTriggeredReportContent-r19,reportOnLeave-r19 ENUMERATED {enabled} OPTIONAL, -- Need Rltm-EventTriggeredPeriodicReport-r19 LTM-EventTriggeredPeriodicReport-r19 OPTIONAL, -- Need S...}},ltm-ReportContent-r18 LTM-ReportContent-r18,...,[[ltm-ReportContent-v19xy LTM-ReportContent-v19xy OPTIONAL, -- Need Rltm-ResourceForInterferenceMeasurements-r19 LTM-CSI-ResourceConfigId-r18 OPTIONAL, -- Need R]]}LTM-ReportContent-r18 ::= SEQUENCE {nrOfReportedCells-r18 ENUMERATED {n1,n2,n3,n4},nrOfReportedRS-PerCell-r18 ENUMERATED {n1,n2,n3,n4},spCellInclusion-r18 ENUMERATED {true} OPTIONAL -- Need R}LTM-EventTriggeredPeriodicReport-r19 ::= SEQUENCE {reportInterval-r19 ReportInterval-r19,reportAmount-r19 ENUMERATED {r2, r4, r8, r16, r32, r64, infinity, spare1},...}LTM-EventTriggeredReportContent-r19 ::= SEQUENCE {maxNumberOfReportedBeams-r19 INTEGER (1..16),allowReportAnyBeam-r19 ENUMERATED {enabled} OPTIONAL, -- Need RreportCurrentBeam-r19 ENUMERATED {enabled} OPTIONAL, -- Need R...}LTM-CandidateReportConfig-r19 ::= SEQUENCE {ltm-CandidateReportConfigId-r19 LTM-CandidateId-r18,candidateSpecificOffset-r19 MeasTriggerQuantityOffset OPTIONAL, -- Cond notEventLTM2...}LTM-ReportContent-v19xy ::= SEQUENCE {reportQuantity-r19 ENUMERATED {cri-RSRP, ssb-index-RSRP, cri-RI-PMI-CQI, value1},...}

[0243] In table 9:-eventId: Type of LTM event for triggering event-triggered measurement report;

[0244] -hysteresis: Hysteresis when evaluating the entering / leaving conditions for an LTM event;

[0245] -ltm-CandidateReportConfigList: List of report configurations for LTM candidate IDs;

[0246] -ltm-EventTriggeredPeriodicReport: This field indicates when an LTM event is triggered, whether the event-triggered measurement report is sent periodically. When the field is absent, the event-triggered measurement report is sent once;

[0247] -ltm-ReportConfigType: This field specifies how the UE shall report the measurement results for LTM either by gNB-scheduled measurement report or by event-triggered measurement report by MAC CE. The UE shall ignore this field is LTM-CSI-ReportConfig is configured with an LTM-Candidate IE.

[0248] -ltm-ReportContent: This field defines the content of the LTM L1 measurement report. The UE shall ignore this field is LTM-CSI-ReportConfig is configured with an LTM-Candidate IE;

[0249] -ltm-ResourcesForChannelMeasurement: This field indicates the index of SSB or CSI-RS in the field LTM-CSI-ResourceConfig;

[0250] -ltm2-Threshold, ltm4-Threshold, ltm5-Threshold1, ltm5-Threshold2: Thresholds defined in the entering / leaving conditions for different LTM events;

[0251] -ltm3-Offset: Offset for the entering / leaving condition for event LTM3. The actual value is field value * 0.5 dB;

[0252] -reportOnLeave: Indicates whether the event-triggered measurement report by MAC CE shall be triggered when leaving condition is satisfied;

[0253] -reportSlotConfig: Periodicity and slot offset;

[0254] -reportSlotOffsetList, reportSlotOffsetListDCI-0-1, reportSlotOffsetListDCI-0-2: Timing offset Y for semi persistent reporting using PUSCH and aperiodic reporting;

[0255] -nrOfReportedCells: This field defines how many cells are reported within a single L1 measurement report instance;

[0256] -nrOfReportedRS-PerCell: This field defines how many RSs per cell are reported within a single L1 measurement report instance;

[0257] -spCellInclusion: This field indicates whether the UE shall include a L1 measurement report associated to the current SpCell. This field can only be configured if the current SpCell is configured as an SpCell of an LTM candidate configuration and the LTM-CSI-ResourceConfig IE associated to the LTM-CSI-ReportConfig IE includes resources for the current SpCell;

[0258] -reportQuantity: Indicates the report quantity for the CSI report;

[0259] -allowReportAnyBeam: Indicates whether the UE can report the measurement results for the beams not satisfying the conditions of the events at least for the time durating configured by timeToTrigger;

[0260] -maxNumberOfReportedBeams: This field defines maximum number of beams whose measurements can be reported in the event-triggered measurement report by MAC CE;

[0261] -reportCurrentBeam: Indicates whether the UE is required to report the measurement result of the current beam;

[0262] -reportInterval: This field defines the periodicity of the event-triggered periodic measurement report;

[0263] -reportAmount: Number of measurement reports needs to be transmitted after the event is triggered. Value 'r2' means the report is sent twice, 'r3' means the report is sent three times, and so on;

[0264] -ltm-CandidateReportConfigId: LTM candidate cell ID for which the UE is required to measure reference signal and perform LTM event evaluation;

[0265] -candidateSpecificOffset, candidateSpecificOffsetS: Offset for event condition that is applicable for all the reference signals belonging to the candidate cell with the candidate cell ID ltm-CandidateReportConfigId. If the field is absent, the value '0dB' is applied.

[0266] In step S905, the UE may store the LTM configuration / cell switch configuration comprising the list of LTM candidate configurations, and transmit anRRCReconfigurationCompletemessage to the gNB.

[0267] In case the UE receives two independentltm-Config,or anltm-Configassociated with the MCG and anltm-ConfigNRDC:

[0268] - the UE maintains independently the twoltm-Config,or theltm-Configand theltm-ConfigNRDC;

[0269] - the UE maintains two independentVarLTM-ServingCellNoResetID, one associated with eachltm-Config,or one associated with theltm-Configand one associated with theltm-ConfigNRDC;

[0270] - the UE maintains two independentVarLTM-ServingCellUE-MeasuredTA-ID, one associated with eachltm-Config,or one associated with theltm-Configand one associated with theltm-ConfigNRDC;

[0271] - the UE independently performs all the LTM configuration and / or execution procedures for eachltm-Config,or anltm-Configand anltm-ConfigNRDC,and the associatedVarLTM-ServingCellNoResetID, andVarLTM-ServingCellUE-MeasuredTA-IDunless explicitly stated otherwise.

[0272] The UE shall perform the following actions based on the receivedLTM-ConfigIE:

[0273] 1> if the receivedLTM-Configincludesltm-ServingCellNoResetID:

[0274] 2> if the currentVarLTM-ServingCellNoResetIDincludes anltm-ServingCellNoResetID:

[0275] 3> replace theltm-ServingCellNoResetIDvalue withinVarLTM-ServingCellNoResetIDwith the receivedltm-ServingCellNoResetID;

[0276] 2> else:

[0277] 3> store the receivedltm-ServingCellNoResetIDinVarLTM-ServingCellNoResetID;

[0278] 1> if the receivedLTM-Configincludesltm-ServingCellUE-MeasuredTA-ID:

[0279] 2> if the currentVarLTM-ServingCellUE-MeasuredTA-IDincludes anltm-ServingCellUE-MeasuredTA-ID:

[0280] 3> replace theltm-ServingCellUE-MeasuredTA-IDvalue withinVarLTM-ServingCellUE-MeasuredTA-IDwith the receivedltm-ServingCellUE-MeasuredTA-ID;

[0281] 2> else:

[0282] 3> store the receivedltm-ServingCellUE-MeasuredTA-IDinVarLTM-ServingCellUE-MeasuredTA-ID;

[0283] 1> if the receivedLTM-Configincludes theltm-CandidateToReleaseList:

[0284] 2> perform the LTM candidate configuration release;

[0285] 1> if the receivedLTM-Configincludes theltm-CandidateToAddModList:

[0286] 2> perform the LTM candidate configuration addition or modification;

[0287] 1> reconfigure the UE according to all other fields of the receivedLTM-ConfigIE.

[0288] 1> if the receivedLTM-Configincludes the fieldltm-ServingCellExecutionCondition:

[0289] 2> if LTM conditions evaluation was done based on L1 measurements:

[0290] 3> inform lower layers to stop the LTM conditions evaluation, if any, for all the LTM candidate configurations;

[0291] 2> else:

[0292] 3> stop the LTM conditions evaluation, if any, for all the LTM candidate configurations;

[0293] 2> if the fieldl3-Conditionsis included withinltm-ServingCellExecutionCondition:

[0294] 3> perform the LTM cell switch conditions evaluation based on L3 measurements according to the receivedltm-ServingCellExecutionCondition;

[0295] 2> else if the fieldl1-Conditionsis included withinltm-ServingCellExecutionCondition:

[0296] 3> inform lower layers to initiate the LTM cell switch conditions evaluation based on L1 measurements according to the received fieldltm-ServingCellExecutionCondition.

[0297] To perform the LTM candidate configuration release, The UE shall:

[0298] 1> for eachltm-CandidateIdvalue included in theltm-CandidateToReleaseListthat is part of the current UE configuration:

[0299] 2> remove the correspondingLTM-Candidate.

[0300] To perform the LTM candidate configuration addition or modification, the UE shall:

[0301] 1> for eachltm-CandidateIdvalueincluded in theltm-CandidateToAddModList:

[0302] 2> if the current UE configuration contains anLTM-Candidatewith theltm-CandidateIdvalue:

[0303] 3> reconfigure the correspondingLTM-Candidatein accordance with the receivedLTM-Candidate;

[0304] 2> else:

[0305] 3> add the receivedLTM-Candidate;

[0306] 2> if theLTM-Candidatewith the receivedltm-CandidateIdvalue includesltm-UE-MeasuredTA-ID:

[0307] 3> if the value ofltm-UE-MeasuredTA-IDis equal to the value ofltm-ServingCellUE-MeasuredTA-IDwithinVarLTM-ServingCellUE-MeasuredTA-ID:

[0308] 4> inform lower layers that the UE is configured with UE-based TA measurements for thisLTM-Candidate;

[0309] 3> else:

[0310] 4> inform lower layers that the UE is not configured with UE-based TA measurements for thisLTM-Candidate;

[0311] 2> else:

[0312] 3> inform lower layers that the UE is not configured with UE-based TA measurements for thisLTM-Candidate.

[0313] In step S907, the UE may perform DL / UL synchronization with the LTM candidate cell(s) before receiving the cell switch command.

[0314] In some implementations, the UE may perform DL synchronization with the LTM candidate cell(s) before receiving the cell switch command. The UE may activate and deactivate TCI states of LTM candidate cell(s), as triggered by the gNB.

[0315] In some implementations, the UE may perform UL synchronization with LTM candidate cell(s) before receiving the cell switch command, by using UE-based timing advance (TA) measurement, if configured, and / or by transmitting a preamble towards the candidate cell, as triggered by the gNB. When UE-based TA measurement is configured, UE acquires the TA value(s) of the candidate cell(s) by measurement. UE performs early TA acquisition with the candidate cell(s) as requested by the network before receiving the cell switch command. This is done via CFRA triggered by a PDCCH order from the source cell, following which the UE sends preamble towards the indicated candidate cell. In order to minimize the data interruption of the source cell due to CFRA towards the candidate cell(s), the UE does not receive random access response from the network for the purpose of TA value acquisition and the TA value of the candidate cell is indicated in the cell switch command. The UE does not maintain the TA timer for the candidate cell and relies on network implementation to guarantee the TA validity.

[0316] In step S909, the UE may perform L1 measurements on the configured LTM candidate cell(s) and transmit L1 measurement reports to the gNB. L1 measurement should be performed as long as RRC reconfiguration (step S903) is applicable. The UE can also perform L3 measurement reporting to the gNB, including beam level measurement results on cell(s) which are configured as LTM candidate cell(s) according to the received network configuration.

[0317] In step S911, the gNB may decide to execute cell switch to a target cell and transmit an LTM cell switch command MAC CE triggering cell switch by including a target configuration ID which indicates the index of the candidate configuration of the target cell (e.g.,ltm-CandidateId), a beam indicated with a TCI state or beams indicated with DL and UL TCI states, and a timing advance command for the target cell, if available. The UE switches to the target cell and applies the candidate configuration (e.g.,ltm-CandidateConfig) indicated by the target configuration ID.

[0318] Upon the indication by lower layers that an LTM cell switch procedure is triggered, or upon performing LTM cell switch following cell selection performed while timer T311 was running, or upon the fulfilment of LTM cell switch execution conditions, the UE shall perform the LTM cell switch execution procedure according to the followings:

[0319] 1> if this procedure is triggered due to fulfilment of LTM cell switch execution conditions:

[0320] 2> if more than one LTM candidate configuration has triggered this procedure:

[0321] 3> select one of the LTM candidate configurations as the selected cell for the LTM cell switch execution execution;

[0322] 2> if UE is performing an LTM conditions evaluation based on L1 measurements:

[0323] 3> inform lower layers to stop the LTM conditions evaluation, if any, for all the LTM candidate configurations;

[0324] 2> else:

[0325] 3> stop the LTM conditions evaluation, if any, for all the LTM candidate configurations;

[0326] 1> if the LTM cell switch is triggered on the MCG; or

[0327] 1> if the LTM cell switch is triggered on the SCG and the LTM candidate configuration to be applied is configured vialtm-ConfigNRDC:

[0328] 2> release / clear all current dedicated and common radio configurations which have neither been received via SRB1 withinmrdc-SecondaryCellGroup, nor via SRB3 except for the following:

[0329] - the radio bearer configuration (configured viaRadioBearerConfig)

[0330] - thelogicalChannelIdentityandlogicalChannelIdentityExtof RLC bearers configured inRLC-BearerConfigand the associated RLC entities, their state variables, buffers, and timers, except for triggering the associated RLC entities to reset the variable RETX_COUNT its initial value;

[0331] - thebh-LogicalChannelIdentityof BH RLC channels configured inBH-RLC-ChannelConfigand the associated RLC entities, their state variables, buffers, and timers, except for triggering the associated RLC entities to reset the variable RETX_COUNT its initial value;

[0332] - theltm-Configandltm-ConfigNRDC(if configured);

[0333] - the MCG C-RNTI;

[0334] - the AS security configurations associated with the master key;

[0335] - the logged measurement configuration;

[0336] 1> if the LTM cell switch is triggered on the SCG:

[0337] 2> release / clear all current dedicated and common radio configurations which have been received either via SRB1 withinmrdc-SecondaryCellGroup, or via SRB3 except for the following:

[0338] - the radio bearer configuration (configured viaRadioBearerConfigIE)

[0339] - thelogicalChannelIdentityandlogicalChannelIdentityExtof RLC bearers configured inRLC-BearerConfigand the associated RLC entities, their state variables, buffers, and timers, except for triggering the associated RLC entities to reset the variable RETX_COUNT its initial value;

[0340] - thebh-LogicalChannelIdentityof BH RLC channels configured inBH-RLC-ChannelConfigand the associated RLC entities, their state variables, buffers, and timers, except for triggering the associated RLC entities to reset the variable RETX_COUNT its initial value;

[0341] - the UE variablesVarLTM-ServingCellNoResetIDandVarLTM-ServingCellUE-MeasuredTA-ID;

[0342] - theltm-Config;

[0343] - the AS security configurations associated with the secondary key;

[0344] 1> for each SRB / DRB in the current UE configuration:

[0345] 2> if the LTM cell switch is triggered on the MCG and the SRB / DRB using the master key; or

[0346] 2> if the LTM cell switch is triggered on the SCG and the SRB / DRB using the secondary key:

[0347] 3> keep the associated PDCP and SDAP entities, their state variables, buffers and timers;

[0348] 3> release all fields related to the SRB / DRB configuration except forsrb-Identityanddrb-Identity;

[0349] For all radio bearers and RLC bearers included in the LTM candidate configuration to be applied at an LTM cell switch execution (i.e., as derived from the LTM reference configuration and the LTM candidate configuration), even if those radio bearers and RLC bearers were configured before the LTM cell switch execution, the network includes fields as specified for the initial setup of radio bearers and RLC bearers and sets the values previously stored by the UE for the fields that cannot be modified according to presence conditions or field descriptions.

[0350] 1> apply the default L1 parameter values as specified in corresponding physical layer specifications except for the parameters for which values are provided in SIB1;

[0351] 1> use the default values for timers T310, T311 and constants N310, N311 associated with the cell group(s) for which theRRCReconfigurationmessage is applied due to the triggered LTM cell switch procedure, where T310, N310, and N311 are for both MCG and SCG, and T311 is only for the MCG;

[0352] 1> apply the default MAC Cell Group configuration for the cell group(s) for which theRRCReconfigurationmessage is applied due to the triggered LTM cell switch procedure;

[0353] 1> for eachsrb-Identityin the current UE configuration:

[0354] 2> apply the default SRB configuration for the corresponding SRB;

[0355] 1> else if theLTM-CandidateIE inltm-Configorltm-ConfigNRDCindicated by lower layers or for the selected cell does not contain the fieldltm-NoResetIDand if the UE does not have any value stored ofltm-ServingCellNoResetIDwithinVarLTM-ServingCellNoResetID; or

[0356] 1> if the value of fieldltm-NoResetIDcontained within theLTM-CandidateIE inltm-Configorltm-ConfigNRDCindicated by lower layers or for the selected cell is not equal to the value ofltm-ServingCellNoResetIDwithinVarLTM-ServingCellNoResetID:

[0357] 2> for eachlogicalChannelIdentityandlogicalChannelIdentityExtthat is part of the current UE configuration for the cell group for which the LTM cell switch procedure is triggered:

[0358] 3> ifservedRadioBeareris set todrb-Identity:

[0359] 4> after the end of this procedure, re-establish the corresponding RLC entity, after applying the LTM configuration inltm-CandidateConfigwithin theLTM-CandidateIE inltm-Configorltm-ConfigNRDC;

[0360] 2> for eachbh-LogicalChannelIdentitythat is part of the current UE configuration for the cell group for which the LTM cell switch procedure is triggered:

[0361] 3> after the end of this procedure, re-establish the corresponding RLC entity, after applying the LTM configuration inltm-CandidateConfigwithin the LTM-Candidate IE inltm-Configorltm-ConfigNRDC;

[0362] 2> for eachdrb-Identityvalue that is part of the current UE configuration:

[0363] 3> if this DRB is an AM DRB:

[0364] 4> after the end of this procedure, trigger the PDCP entity of this DRB to perform data recovery, after applying the LTM configuration inltm-CandidateConfigwithinLTM-CandidateIE inltm-Configorltm-ConfigNRDC;

[0365] 2> if the value of fieldltm-NoResetIDcontained within theLTM-CandidateIE inltm-Configorltm-ConfigNRDCindicated by lower layers or for the selected cell is not equal to the value ofltm-ServingCellNoResetIDwithinVarLTM-ServingCellNoResetID:

[0366] 3> replace the value ofltm-ServingCellNoResetIDinVarLTM-ServingCellNoResetIDwith the value ofltm-NoResetIDin theLTM-Candidateinltm-Configorltm-ConfigNRDCindicated by lower layers or for the selected cell;

[0367] 1> if theLTM-CandidateIE inltm-Configorltm-ConfigNRDCindicated by lower layers or for the selected cell contains the fieldltm-UE-MeasuredTA-ID:

[0368] 2> if the value ofltm-UE-MeasuredTA-IDis not equal to the value ofltm-ServingCellUE-MeasuredTA-IDwithinVarLTM-ServingCellUE-MeasuredTA-ID:

[0369] 3> replace the value ofltm-ServingCellUE-MeasuredTA-IDinVarLTM-ServingCellUE-MeasuredTA-IDwith the value received withinltm-UE-MeasuredTA-ID;

[0370] 3> for eachLTM-CandidateIE inltm-Configorltm-ConfigNRDCthat includes theLTM-CandidateIE indicated by lower layers or for the selected cell:

[0371] 4> if the value ofltm-UE-MeasuredTA-IDwithinLTM-CandidateIE is equal to the value ofltm-ServingCellUE-MeasuredTA-IDwithinVarLTM-ServingCellUE-MeasuredTA-ID:

[0372] 5> inform lower layers that the UE is configured with UE-based TA measurements for theLTM-Candidate;

[0373] 4> else:

[0374] 5> inform lower layers that the UE is not configured with UE-based TA measurements for theLTM-Candidate;

[0375] The UE is not expected to perform UE-based TA measurements for an SpCell.

[0376] 1> else if theLTM-CandidateIE inltm-Configorltm-ConfigNRDCindicated by lower layers or for the selected cell does not contain the fieldltm-UE-MeasuredTA-ID:

[0377] 2> inform lower layers that the UE is not configured with UE-based TA measurements for theLTM-Candidate.

[0378] 1> ifltm-ConfigCompleteis not included within theLTM-CandidateIE inltm-Configorltm-ConfigNRDCindicated by lower layers or for the selected cell:

[0379] 2> considerltm-ReferenceConfigurationinltm-Configorltm-ConfigNRDC, associated with the cell group for which the LTM cell switch procedure is triggered, to be the current UE configuration for the fields and configurations to be released by the actions above in this procedure;

[0380] 2> ifmeasConfigis included withinltm-ReferenceConfigurationinltm-Configorltm-ConfigNRDC;

[0381] 3> perform the measurement configuration procedure by considering themeasConfigwithinltm-ReferenceConfigurationinltm-Configorltm-ConfigNRDCas the receivedmeasConfig:

[0382] When the UE considers the reference configuration to be the current UE configuration, the UE should store fields and configurations that are part of the reference configuration but should not execute any actions or procedures triggered by the reception of anRRCReconfigurationmessage, unless specified otherwise in this clause.

[0383] 1> if the LTM cell switch is triggered by an indication from lower layers:

[0384] 2> apply theRRCReconfigurationmessage inltm-CandidateConfigwithinLTM-CandidateIE inltm-Configorltm-ConfigNRDCidentified by the LTM candidate configuration identity received from lower layers;

[0385] 1> else (LTM cell switch triggered upon cell selection performed while timer T311 was running or upon the fulfilment of LTM cell switch execution conditions):

[0386] 2> apply theRRCReconfigurationmessage inltm-CandidateConfigwithinLTM-CandidateIE inltm-Configrelated to the LTM candidate configuration identity for the selected cell;

[0387] 1> release the radio bearer(s) and the logical channel(s) that were part of the UE configuration before of this LTM cell switch procedure but not part of the LTM candidate configuration either indicated by lower layers or for the selected cell, or the LTM reference configuration (in case the LTM candidate configuration does not includeltm-ConfigComplete).

[0388] 1> ifltm-ExecutionConditionis configured within theLTM-CandidateIE for the selected LTM candidate configuration:

[0389] 2> if the fieldl3-Conditionsis included withinltm-ExecutionCondition:

[0390] 3> perform the LTM cell switch conditions evaluation based on L3 measurements according to the receivedltm-ExecutionConditiononce this procedure is completed;

[0391] 2> else if the fieldl1-Conditionsis included withinltm-ExecutionCondition:

[0392] 3> inform lower layers to initiate the LTM cell switch conditions evaluation based on L1 measurements according to the received fieldltm-ExecutionConditiononce this procedure is completed.

[0393] Whenltm-ConfigCompleteis not included for an LTM candidate configuration, before an LTM cell switch is triggered a UE implementation may generate and store anRRCReconfigurationmessage by applying the received LTM candidate configuration on top of the LTM reference configuration, and the storedRRCReconfigurationmessage is applied when the LTM cell switch is triggered. It is up to the UE to ensure that the RRC reconfiguration applied at the time of LTM cell switch is in accordance with the latest LTM reference configuration and LTM candidate configuration.

[0394] The UE shall perform the LTM cell switch conditions evaluation based on L3 measurements according to the followings:

[0395] 1> for each entry within theLTM-ExecutionConditionListwhich has thel3-Conditionsconfigured:

[0396] 2> for eachmeasIdindicated in thel3-Conditionswhich has a correspondingmeasIdin theVarMeasConfigassociated with the MCGmeasConfig:

[0397] 3> if thecondEventIdrelated to thismeasIdis associated withcondEventA3orcondEventA5, and if the entry condition(s) applicable for this event is fulfilled for theltm-CandidatePCIandltm-SSB-Configrelated to theltm-CandidateIdfor all measurements after layer 3 filtering taken during the correspondingtimeToTriggerdefined for this event:

[0398] 4> consider the event associated to thismeasIdto be fulfilled for theltm-CandidateIdassociated to themeasId;

[0399] That is, according to various embodiments, the mobility execution condition may be fulfilled (or, satisfied / met) when an entry condition (or, entering condition) for the mobility execution condition is fulfilled for at least a time-to-trigger (TTT) for the mobility execution condition. The entry condition / entering condition may mean that the mobility execution condition is initially met. Once the entry condition is met, the mobility execution condition will be considered to be met if the entry condition is met for time duration TTT continuously.

[0400] 3> if thecondEventIdrelated to thismeasIdis associated withcondEventA3orcondEventA5, and if the leaving condition(s) applicable for this event is fulfilled for theltm-CandidatePCIandltm-SSB-Configrelated to theltm-CandidateIdfor all measurements after layer 3 filtering taken during the correspondingtimeToTriggerdefined for this event:

[0401] 4> consider the event associated to thismeasIdto be not fulfilled for theltm-CandidateIdassociated to themeasId;

[0402] 1> if event(s) associated with allmeasId(s)for anltm-CandidateIdwithin theLTM-ExecutionConditionListIE are fulfilled:

[0403] 2> perform the LTM cell switch procedure for the LTM candidate configuration associated to theltm-CandidateId.

[0404] In step S913, the UE may perform the random access procedure towards the target cell, if UE does not have valid TA of the target cell. If UE has valid TA of the target cell, the UE may skip the random access procedure towards the target cell (i.e., RACH-less LTM).

[0405] When performing the random access procedure / RACH procedure: i) the UE may perform a contention-free random access (CFRA) if CFRA resources / dedicated RACH configuration is available to the UE; and ii) the UE may perform a contention-based random access (CBRA) if CFRA resources / dedicated RACH configuration is not available to the UE.

[0406] For the CBRA, the UE may transmit a random access preamble in uplink, to a RAN node. The UE may transmit a message 1 (MSG1) comprising the random access preamble to the RAN node. The random access preamble may be associated with a random access - radio resource temporary identifier (RA-RNTI). The random access preamble may be selected based on the selected RACH resources, and transmitted through a time / frequency resources identified by the selected RACH resources.

[0407] For the CFRA, the UE may transmit a dedicated random access preamble in uplink, to a RAN node. The UE may transmit an MSG1 comprising the dedicated random access preamble to the RAN node. The dedicated random access preamble may be associated with a RA-RNTI. The dedicated random access preamble may be selected based on the CFRA resources / dedicated RACH configuration, and transmitted through a time / frequency resources identified by the CFRA resources / dedicated RACH configuration.

[0408] In step S915, the UE may complete the LTM cell switch procedure by sendingRRCReconfigurationCompletemessage to target cell. If the UE has performed a RA procedure in step S913, the UE considers that LTM cell switch execution is successfully completed when the random access procedure is successfully completed. For RACH-less LTM, the UE considers that LTM cell switch execution is successfully completed when the UE determines that the network has successfully received its first UL data.

[0409] The steps S907 to S915 can be performed multiple times for subsequent LTM cell switch executions using the LTM candidate configuration(s) provided in step S903.

[0410] The procedure over the air interface described in FIG. 9 is applicable to both intra-gNB-DU LTM and inter-gNB-DU LTM.

[0411] In the present disclosure, subsequent mobility (e.g., subsequent LTM / CLTM) is described. The subsequent mobility may refer to a mobility that is done by repeating a mobility execution / completion after each mobility execution / completion based on a corresponding candidate configuration without releasing other candidate configurations. That is, the subsequent mobility may refer to a mobility that is performed without reconfiguration and / or re-initialization on the mobility preparation from a network after a previous mobility. For example, when a UE has received a plurality of candidate configurations, after the UE performs a mobility based on a corresponding candidate configuration, the UE does not release other candidate configurations, and may perform a subsequent mobility based on a corresponding candidate configuration among the already received plurality of candidate configurations without reconfiguration and / or re-initialization on the mobility preparation from the network (or, without receiving new candidate configurations from the network). This results in a reduction of the signalling overhead and / or interrupting time for mobility.

[0412] Meanwhile, in dual-connectivity (DC), the UE may connect to two nodes (i.e., each of which can be either eNB or gNB, where the node may comprise a base station) at the same time. One node may be master node (MN), and the other node may be secondary node (SN). The MN may provide / configure a master cell group (MCG) to the UE and the SN may provide / configure a secondary cell group (SCG) to the UE. If MN security update is performed with keeping the SN connection (i.e., SCG), then the SN security should be updated subsequently based on the updated MN security key. This is because the SN security is derived based on the MN security key. In the present disclosure, 'MCG security' may have the same meaning of 'MN security' and 'SCG security' may have the same meaning of 'SN security'.

[0413] In legacy, the network may send to the UE the MNRRCReconfigurationmessage including the new MN security configuration and the single counter value (i.e.,sk-Counter) for updating the SN security if the MN security update is needed due to, e.g., MN handover while the SN connection is maintained before / after MN handover. To this end, the SNRRCReconfigurationmessage includingsk-Countermay be embedded in the MNRRCReconfigurationmessage. Upon receiving theRRCReconfigurationmessage, the UE may update the MN security based on the new MN security configuration (i.e., new KgNB). Subsequently, the UE may update the SN security based on the new KgNB andsk-Counter(i.e., new S- KgNB). To sum up, the SN security key update may be based only on the provision ofsk-Counterin the case of MN handover with keeping the existing SN connection. This implies that the UE does not need to differentiate whether the MN security is updated or not for the SN security update.

[0414] In wireless communications, an inter-CU scenario for LTM may be supported. For example, when DC is configured, the inter-CU scenario for LTM may be supported for a case where CU is acting as MN and SN is unchanged or SN is released (i.e., inter-CU MCG LTM while the SN connection is maintained is supported).

[0415] In the present disclosure, it is noted that:

[0416] - For the SN key update in inter-CU MN LTM with DC, the UE may apply (legacy) RRC reconfiguration with sync procedure.

[0417] This means that the legacy SN security update procedure may be re-used for the case where CU is acting as MN and SN is unchanged (or SN is released). The legacy SN security update procedure may be performed ifsk-Counteris included in theRRCReconfigurationmessage.

[0418] For LTM cell switch, one or more candidate cell configurations (e.g.,LTM-Candidate / (RRCReconfigurationin)LTM-CandidateConfig) may be provided to the UE in advance / beforehand. Upon receiving an LTM cell switch command (CSC) MAC CE from the network, the UE may perform / execute the LTM cell switch toward the candidate cell indicated by the LTM CSC MAC CE, i.e., the UE may first apply the stored candidate cell configuration and subsequently the UE may access the candidate cell based on the stored candidate cell configuration and the LTM CSC MAC CE. In order to update the SN security with legacy RRC reconfiguration with sync procedure in the case of inter-CU MCG LTM while the SN connection is maintained, the pre-configured candidate cell configuration of MCG LTM target cell should include the single counter value for updating SN security (i.e.,sk-Counter).

[0419] In the present disclosure, it is noted that:

[0420] - inter-CU LTM may also support mixture of subsequent inter-CU LTM and subsequent intra-CU LTM after an inter-CU or intra-CU LTM switch.

[0421] Based on the above, the following scenarios as shown in FIGs. 10a to 10d may occur.

[0422] FIGs. 10a to 10d show an example of a subsequent intra-CU MCG LTM cell switch after inter-CU MCG LTM cell switch when the SN connection is maintained.

[0423] In FIGs. 10a to 10d, a subsequent intra-CU MCG LTM cell switch may be performed after inter-CU MCG LTM cell switch in case where the SN connection via a specific cell is maintained.

[0424] Referring to FIG. 10a, in scene#0, the UE may be configured with DC, where Cell#0 belonging to CU#0 is PCell and Cell#5 belonging to CU#5 is PSCell. The MN security key and the SN security key may be KgNB#0 and S-KgNB#0, respectively. Cell#1 and Cell#2 belonging to CU#1 may be configured with candidate cells for MCG LTM cell switch with keeping the SN connection via the current PSCell (i.e., Cell#5).

[0425] Referring to FIG. 10b, in scene#1, inter-CU MCG LTM cell switch with keeping the existing SN connection may be performed, i.e., PCell change from Cell#0 to Cell#1. Due to PCell change, the MN security may be updated, i.e., the MN key is updated from KgNB#0 to KgNB#1. Subsequently, the SN security may be updated based on KgNB#1 andsk-Counterincluded in the candidate cell configuration for Cell#1, wheresk-Countervalue is 1. Consequently, the SN security kay may be updated to S-KgNB#1.

[0426] Referring to FIG. 10c, in scene#2, intra-CU MCG LTM cell switch with keeping the existing SN connection may be performed, i.e., PCell change from Cell#1 to Cell#2. Since CU for MCG (i.e., MN) is not changed due to PCell change, the MN security update may not be performed, i.e., the MN key is maintained as KgNB#1. On the other hand, for the SN key, the SN security update may be performed because the candidate cell configuration for Cell#2 includessk-Counter. Consequently, the SN key may be updated to S-KgNB#2 based on KgNB#1 andsk-Countervalue 2. Since the MN security is not updated, the SN security update may be redundant and unnecessary, which can result in data interruption at SCG due to the random access procedure for SN security update.

[0427] Referring to FIG. 10d, in scene#3, intra-CU MCG LTM cell switch with keeping the existing SN connection may be performed, i.e., PCell change from Cell#2 to Cell#1. Since CU for MCG (i.e., MN) is not changed due to PCell change, the MN security update may not be performed, i.e., the MN key is maintained as KgNB#1. On the other hand, for the SN key, the SN security update may be performed because the candidate cell configuration for Cell#1 includessk-Counter. Consequently, the SN key may be updated to S-KgNB#1 based on KgNB#1 andsk-Countervalue 1. Here, the SN key that were used in the past (i.e. S-KgNB#1) may be re-used, which violates the security requirement that the security key that were used in the past should not be re-used. This violation can incur a severe security related problem, e.g., leakage of the SN key may occur due to repetitive intra-CU MCG LTM cell switches with keeping the existing SN connection.

[0428] Therefore, the present disclosure provides various embodiments for security update during cell switch.

[0429] FIG. 11 shows an example of a method performed by a UE for security update during cell switch according to an embodiment of the present disclosure.

[0430] Referring to FIG. 11, in step S1101, the UE may apply a configuration for a first cell group and a configuration for a second cell group.

[0431] In step S1103, the UE may receive a cell switch configuration related to the first cell group (e.g.,LTM-Config)comprising one or more candidate configurations (e.g.,LTM-Candidate);

[0432] In step S1105, the UE may receive a cell switch command (e.g., LTM Cell Switch Command MAC CE);

[0433] In step S1107, the UE may trigger a cell switch on the first cell group based on the cell switch command. The cell switch may be related to a candidate configuration among the one or more candidate configurations.

[0434] In step S1109 the UE may perform a security update for the first cell group based on the cell switch being triggered on the first cell group.

[0435] In step S1111, the UE may perform a security update for the second cell group based on the security update for the first cell group being performed.

[0436] According to various embodiments, the UE may perform the security update for the first cell group based on: a first identifier for whether a security change is needed or not upon cell switch included in the candidate configuration, and a second identifier for whether a security change is needed or not upon cell switch included in a current serving cell configuration.

[0437] According to various embodiments, the UE may perform the security update for the first cell group based on the first identifier being not equal to the second identifier.

[0438] According to various embodiments, the security update for the first cell group may not be performed based on the first identifier being equal to the second identifier.

[0439] According to various embodiments, the first identifier and the second identifier may comprise a radio resource control (RRC) identifier represented by an integer value.

[0440] According to various embodiments, the security update for the second cell group may not be performed based on the security update for the first cell group being not performed.

[0441] According to various embodiments, the UE may perform the security update for the first cell group based on the cell switch being performed between different central units (CUs).

[0442] According to various embodiments, to perform of the security update for the second cell group, the UE may obtain an updated security key for the first cell group based on the security update for the first cell group. The UE may perform the security update for the second cell group based on the updated security key for the first cell group, and a counter value related to the security update for the second cell group.

[0443] According to various embodiments, the counter value may be included in the candidate cell configuration.

[0444] According to various embodiments, the candidate configuration may comprise a list of counter values related to the security update for the second cell group. The cell switch command may comprise an indication of the counter value in the list of counter values.

[0445] According to various embodiments, the counter value may be included in the cell switch command.

[0446] According to various embodiments, the cell switch command may comprise information related to an identifier of the candidate configuration.

[0447] According to various embodiments, the UE may evaluate execution conditions for the one or more candidate configurations based on receiving the cell switch command. The candidate configuration may be a candidate configuration for which one or more execution conditions are satisfied among the one or more candidate configurations.

[0448] According to various embodiments, the first cell group may comprise a master cell group (MCG), and the second cell group may comprise a secondary cell group (SCG).

[0449] FIG. 12 shows an example of a signal flow between UE and network node for security update during cell switch according to an embodiment of the present disclosure.

[0450] Referring to FIG. 12, in step S1201, the network node may transmit a configuration for a first cell group and a configuration for a second cell group.

[0451] In step S1203, the network node may transmit a cell switch configuration related to the first cell group comprising one or more candidate configurations.

[0452] In step S1205, the network node may transmit a cell switch command,

[0453] In step S1207, the UE may trigger a cell switch on the first cell group based on the cell switch command. The cell switch may be related to a candidate configuration among the one or more candidate configurations.

[0454] In step S1209 the UE may perform a security update for the first cell group based on the cell switch being triggered on the first cell group.

[0455] In step S1211, the UE may perform a security update for the second cell group based on the security update for the first cell group being performed.

[0456] Hereinafter, detailed embodiments regarding security update during cell switch will be described.

[0457] According to implementations of the present disclosure, in the case of MCG LTM cell switch with keeping the existing SN connection, the UE may perform the SN security update based on the updated MN security key and the counter value (e.g.,sk-Counter) if the MN security is updated due to the MCG LTM cell switch.

[0458] The LTM procedure (or, cell switch procedure) may comprise at least one of mobility preparation, early synchronization, mobility command or mobility execution.

[0459] Mobility preparation

[0460] The UE may be configured with MCG mobility configuration of one or more candidate cells (e.g.,LTM-Config / LTM-ConfigNRDC)before a mobility execution toward a candidate cell (e.g., LTM preparation), where a mobility configuration for a candidate cell (e.g.,LTM-Candidate)may include one or more execution conditions (e.g.,LTM-ExecutionCondition / LTM-ExecutionConditionList) for conditional mobility toward the candidate cell.

[0461] The network may provide a (pre-)configuration for mobility (e.g.,LTM-Config / LTM-ConfigNRDC), where the (pre-)configuration may comprise at least one of:

[0462] - one or more candidate cell configurations (e.g.,LTM-Candidate / LTM-Candidate / (RRCReconfigurationin)LTM-CandidateConfig): A candidate cell configuration may be separately provided as reference and delta configurations;

[0463] - information for reference signals related to each candidate cell;

[0464] - one or more UL / DL beam information for each candidate cell: For example, the one or more UL / DL beam information for each candidate cell may comprise at least one of a list of DL TCI configurations, a list of UL TCI configurations, or a list of joint TCI configurations;

[0465] - configuration for UE-based TA measurement;

[0466] - one or more report conditions for requesting cell switch information of each candidate cell: For example, a report condition may not be provided for some candidate cells. For example, a report condition for a candidate cell may be set to be satisfied before an execution condition for the candidate cell is met;

[0467] - one or more execution conditions for conditional mobility execution toward each candidate cell (e.g.,LTM-ExecutionCondition / LTM-ExecutionConditionList): For example, an execution condition may not be provided for some candidate cells. For example, an execution condition may be associated with one or more UL / DL beams;

[0468] - configuration for indicating the initiation of conditional LTM (CLTM) execution: For example, this configuration may comprise one or more RA preambles; or

[0469] - an integer value for the current serving cell, where the value may be used for MCG security update.

[0470] Each candidate cell configuration (e.g.,LTM-Candidate / LTM-Candidate / (RRCReconfigurationin)LTM-CandidateConfig) may include the security update information. For example, the security update information may comprise MCG security update related information and / or SCG security update related information. The MCG security update related information may comprise at least one of MCG security key update related information (e.g., list of multiple next hop chaining counter (NCC) values), or indication indicating MCG security update (e.g., an integer value (e.g., RRC ID)). The SCG security update related information may comprise SCG security key update related information (e.g., singlesk-Countervalue or a list of multiplesk-Countervalues).

[0471] The UE may transmit acknowledge to the network as a response of receiving the (pre-)configuration, e.g.,RRCReconfigurationCompletemessage.

[0472] Early synchronization

[0473] Between the mobility preparation and the mobility command, the UE may acquire the information of DL / UL synchronization toward one or more candidate cells.

[0474] For example, for DL synchronization with one or more candidate cells, the network may provide one or more DL beams via candidate cell TCI states activation / deactivation MAC CE. The MAC CE may indicate one or more DL TCIs from CLTM configuration. For example, the network may provide one or more DL beams via mobility command such as LTM cell switch command MAC CE and / or CLTM cell switch command MAC CE. The CLTM cell switch command MAC CE may be the LTM cell switch command MAC CE including an indicator for conditional LTM (CLTM).

[0475] For example, for DL synchronization with one or more candidate cells, the UE may activate DL / UL beams based on the network indication (e.g., Candidate Cell TCI States Activation / Deactivation MAC CE, CLTM command).

[0476] For example, for UL synchronization with one or more candidate cells, the network may trigger the random access (RA) procedure to a candidate cell. In this case, the UE may transmit the RA preamble to the candidate cell indicated by the network. The information of UL synchronization with the candidate cell can be provided to the UE by random access response (RAR) from the serving cell, RAR from the candidate cell, or CLTM command from the network (e.g., the serving cell).

[0477] For example, for UL synchronization with one or more candidate cells, the UE may acquire the information of UL synchronization with one or more candidate cells based on the configuration for UE-based TA measurement. For example, if the identifier of UE-based TA measurement for the current serving cell and that for a candidate cell is same, the UE may calculate the TA of the candidate cell based on reception (RX) timing difference between the current serving cell and the candidate cell.

[0478] Mobility command

[0479] The network may transmit to the UE a mobility command for cell switch (e.g., LTM cell switch command MAC CE / CLTM cell switch command MAC CE) for MCG toward a candidate cell, where the mobility command may indicate either the cell switch toward the candidate cell is initiated or the evaluation of execution condition(s) for the cell switch is initiated.

[0480] For example, the mobility command may comprise conditional mobility (e.g., CLTM) information.

[0481] The conditional mobility information may comprise an indicator indicating whether the mobility command (e.g., LTM (cell switch) command) is for CLTM or LTM execution. 1 bit flag may be used for the indicator.

[0482] The conditional mobility information may comprise execution condition related information (e.g.,LTM-ExecutionCondition / LTM-ExecutionConditionList). The execution condition related information may comprise an identifier of execution condition included in the LTM (pre-)configuration, and / or execution condition.

[0483] The execution condition may comprise at least one of:

[0484] - information of conditional event and / or an indicator indicating conditional event: For example, the conditional event may comprise at least one of event 1 that candidate becomes amount of offset better than PCell / PSCell, event 2 that candidate becomes better than absolute threshold, or event 3 that PCell / PSCell becomes worse than absolute threshold1 AND Conditional reconfiguration candidate becomes better than another absolute threshold2. The indicator indicating conditional event may be implemented as bitmap (e.g., 01 for Event 1, 10 for Event 2, and so forth). Alternatively, the indicator indicating conditional event may be implemented as an identifier of a report configuration including the conditional event.

[0485] - Offset, threshold values;

[0486] - entry condition;

[0487] - leave condition; or

[0488] - time to trigger (TTT): time during which specific criteria for the conditional event needs to be met in order to execute the conditional LTM.

[0489] For example, the mobility command may comprise candidate cell identifiers (target cell info) for one or more candidate cells. The candidate cell identifiers may comprise at least one of candidate cell ID, physical cell ID, or candidate cell configuration ID (e.g.,LTM-CandidateId).

[0490] For example, the mobility command may comprise TA information for one or more candidate cells. The TA information may comprise at least one of absolute TA value, TA difference with the source cell, indicator indicating whether the target TA is same as the source cell TA, or indicator indicating there is no target TA known to the network.

[0491] For example, the mobility command may comprise beam indication(s) for one or more candidate cells. The beam indication(s) may comprise at least one of TCI state ID, SSB index or CSI-RS index.

[0492] For example, the mobility command may comprise contention free random access (CFRA) resource information for one or more candidate cells. The CFRA resource information may comprise at least one of RA preamble, SSB index, PRACH mask index, SUL indicator or MSG1 repetition number.

[0493] For example, the mobility command may comprise security update information. The security update information may comprise at least one of MCG security update related information, indication indicating MCG security update, or SCG security update related information.

[0494] The MCG security update related information may comprise at least one of an identifier indicating an NCC value in the list of multiple NCC values included in the (pre-)configuration, or a single NCC value.

[0495] The indication indicating MCG security update may comprise 1-bit flag. For example, MCG security may be updated during the cell switch if flag is true (e.g., 1). For example, MCG security may not be updated during the cell switch if flag is false (e.g., 0).

[0496] The SCG security update related information may comprise at least one of an identifier indicating ansk-Countervalue in the list of multiplesk-Countervalues included in the (pre-)configuration, or singlesk-Countervalue.

[0497] Mobility execution

[0498] If the mobility command indicates that the cell switch for MCG toward the candidate cell is initiated, then the UE may initiate the cell switch procedure based on the candidate cell configuration (e.g.,LTM-Candidate / (RRCReconfigurationin)LTM-CandidateConfig) indicated by the mobility command and / or the information in the mobility command. If the mobility command indicates that the evaluation of execution condition(s) for the cell switch is initiated (i.e., conditional mobility), then the UE may initiate the evaluation of execution condition(s) for the candidate cell indicated by the mobility command. When an execution condition is satisfied, the UE may initiate the cell switch procedure based on the candidate cell configuration indicated by the mobility command and / or the information in the mobility command.

[0499] Security update during cell switch (e.g., steps S1109 to S1111, and / or steps S1209 to S1211) may be performed based on the candidate cell configuration (e.g.,LTM-Candidate / (RRCReconfigurationin)LTM-CandidateConfig) and / or the mobility command. In the case of MCG LTM cell switch with keeping the existing SN connection, the SN security update may be performed based on the updated MN security key and the counter value (e.g., sk-Counter) if the MN security is updated due to the MCG LTM cell switch.

[0500] FIG. 13 shows a first example of a security update during cell switch according to an embodiment of the present disclosure.

[0501] In FIG. 13, an integer value (e.g., RRC ID) may be configured with / in each candidate cell configuration (e.g.,LTM-Candidate / (RRCReconfigurationin)LTM-CandidateConfig), and an integer value (e.g., RRC ID) may be configured with / in the current serving cell (i.e., PCell) (or the current serving cell configuration).

[0502] According to various embodiments, the RRC ID configured in candidate cell configuration may be denoted as "ltm-NoSecurityChangeID", and the RRC ID configured in the current serving cell configuration may be denoted as "LTM-ServingCellNoSecurityChange".

[0503] Referring to FIG. 13, in step S1301, the UE may determine whether the RRC ID of the current serving cell (configuration) and the RRC ID of the candidate cell (configuration) indicated by the mobility command are identical or different.

[0504] If the RRC ID of the current serving cell (configuration) and the RRC ID of the candidate cell (configuration) indicated by the mobility command are identical, in step S1303, the UE may skip performing the MN security update during the cell switch, and in step S1305, the UE may skip performing the SN security update. That is, the MN security update may not be performed during the cell switch, and consequently, the SN security update may not be performed. In this case, the UE may ignore the information for MN / SN security update provided by the candidate cell configuration and / or the mobility command.

[0505] On the other hand, if the RRC ID of the current serving cell (configuration) and the RRC ID of the candidate cell (configuration) indicated by the mobility command are different, in step S1307, the UE may perform the MN security update during the cell switch, and in step S1309, the UE may perform the SN security update based on the updated MN security key and / or sk-Counter value. That is, the MN security update may be performed during the cell switch, and consequently, the SN security update may be performed based on the updated MN security key and / or sk-Counter value.

[0506] For example, for MN security update, the list of multiple NCC values may be configured in the candidate cell configuration, and the mobility command may indicate an identifier indicating an NCC value in the list of multiple NCC values. In this case, the MN security update may be performed based on the NCC value indicated by the identifier.

[0507] For example, for MN security update, the NCC value may be included in the mobility command. In this case, the MN security update may be performed based on the NCC value indicated by the mobility command.

[0508] For example, for MN security update, the list of multiple NCC values may be configured in the candidate cell configuration. In this case, the MN security update may be performed based on the NCC value that was not used in the past.

[0509] For example, for SN security update, the sk-Counter value may be included in the candidate cell configuration. In this case, the SN security update may be performed based on the sk-Counter value included in the candidate cell configuration and / or the updated MN key.

[0510] For example, for SN security update, the list of multiple sk-Counter values may be configured in the candidate cell configuration and the mobility command may indicate an identifier indicating an sk-Counter value in the list of multiple sk-Counter values. In this case, the SN security update may be performed based on the sk-Counter value indicated by the identifier and / or the updated MN key.

[0511] For example, for SN security update, the list of multiple sk-Counter values may be configured in the candidate cell configuration. In this case, the SN security update may be performed based on the sk-Counter value that was not used in the past and / or the updated MN key.

[0512] For example, for SN security update, the sk-Counter may be included in the mobility command. In this case, the SN security update may be performed based on the sk-Counter value indicated by the mobility command and / or the updated MN key.

[0513] FIG. 14 shows a second example of a security update during cell switch according to an embodiment of the present disclosure.

[0514] In FIG. 14, the mobility command may include the flag indicating whether to perform MN security update during the cell switch.

[0515] Referring to FIG. 14, in step S1401, the UE may determine whether the flag included in the mobility command indicates that MN security update is not performed during the cell switch, or is performed during the cell switch.

[0516] If the flag indicates that MN security update is not performed during the cell switch (e.g., flag is false or 0), in step S1403, the UE may skip performing the MN security update during the cell switch, and in step S1405, the UE may skip performing the SN security update. That is, the MN security update may not be performed during the cell switch, and consequently, the SN security update may not be performed. In this case, the UE may ignore the information for MN / SN security update provided by the candidate cell configuration and / or the mobility command.

[0517] On the other hand, If the flag indicates that MN security update is performed during the cell switch (e.g., flag is true or 1), in step S1407, the UE may perform the MN security update during the cell switch, and in step S1409, the UE may perform the SN security update based on the updated MN security key and / or sk-Counter value. That is, the MN security update may be performed during the cell switch, and consequently, the SN security update may be performed based on the updated MN security key and / or sk-Counter value.

[0518] For example, for MN security update, the list of multiple NCC values may be configured in the candidate cell configuration, and the mobility command may indicate an identifier indicating an NCC value in the list of multiple NCC values. In this case, the MN security update may be performed based on the NCC value indicated by the identifier.

[0519] For example, for MN security update, the NCC value may be included in the mobility command. In this case, the MN security update may be performed based on the NCC value indicated by the mobility command.

[0520] For example, for MN security update, the list of multiple NCC values may be configured in the candidate cell configuration. In this case, the MN security update may be performed based on the NCC value that was not used in the past.

[0521] For example, for SN security update, the sk-Counter value may be included in the candidate cell configuration. In this case, the SN security update may be performed based on the sk-Counter value included in the candidate cell configuration and / or the updated MN key.

[0522] For example, for SN security update, the list of multiple sk-Counter values may be configured in the candidate cell configuration and the mobility command may indicate an identifier indicating an sk-Counter value in the list of multiple sk-Counter values. In this case, the SN security update may be performed based on the sk-Counter value indicated by the identifier and / or the updated MN key.

[0523] For example, for SN security update, the list of multiple sk-Counter values may be configured in the candidate cell configuration. In this case, the SN security update may be performed based on the sk-Counter value that was not used in the past and / or the updated MN key.

[0524] For example, for SN security update, the sk-Counter may be included in the mobility command. In this case, the SN security update may be performed based on the sk-Counter value indicated by the mobility command and / or the updated MN key.

[0525] FIG. 15 shows a third example of a security update during cell switch according to an embodiment of the present disclosure.

[0526] Referring to FIG. 15, in step S1501, the UE may determine whether the mobility command includes information related to MN security update. The information related to MN security update may comprise at least one of an identifier indicating an NCC value in the list of multiple NCC values included in the candidate cell configuration, or a single NCC value.

[0527] If the mobility command does not include the information related to MN security update, in step S1503, the UE may skip performing the MN security update during the cell switch, and in step S1505, the UE may skip performing the SN security update. That is, the MN security update may not be performed during the cell switch, and consequently, the SN security update may not be performed. In this case, the UE may ignore the information for SN security update provided by the candidate cell configuration and / or the mobility command.

[0528] On the other hand, if the mobility command includes the information related to MN security update, in step S1507, the UE may perform the MN security update during the cell switch, and in step S1509, the UE may perform the SN security update based on the updated MN security key and / or sk-Counter value. That is, the MN security update may be performed during the cell switch, and consequently, the SN security update may be performed based on the updated MN security key and / or sk-Counter value.

[0529] For example, for MN security update, the list of multiple NCC values may be configured in the candidate cell configuration, and the mobility command may indicate an identifier indicating an NCC value in the list of multiple NCC values. In this case, the MN security update may be performed based on the NCC value indicated by the identifier.

[0530] For example, for MN security update, the NCC value may be included in the mobility command. In this case, the MN security update may be performed based on the NCC value indicated by the mobility command.

[0531] For example, for MN security update, the list of multiple NCC values may be configured in the candidate cell configuration. In this case, the MN security update may be performed based on the NCC value that was not used in the past.

[0532] For example, for SN security update, the sk-Counter value may be included in the candidate cell configuration. In this case, the SN security update may be performed based on the sk-Counter value included in the candidate cell configuration and / or the updated MN key.

[0533] For example, for SN security update, the list of multiple sk-Counter values may be configured in the candidate cell configuration and the mobility command may indicate an identifier indicating an sk-Counter value in the list of multiple sk-Counter values. In this case, the SN security update may be performed based on the sk-Counter value indicated by the identifier and / or the updated MN key.

[0534] For example, for SN security update, the list of multiple sk-Counter values may be configured in the candidate cell configuration. In this case, the SN security update may be performed based on the sk-Counter value that was not used in the past and / or the updated MN key.

[0535] For example, for SN security update, the sk-Counter may be included in the mobility command. In this case, the SN security update may be performed based on the sk-Counter value indicated by the mobility command and / or the updated MN key.

[0536] If the UE transmits an indication of the initiation of CLTM execution to one of current serving cells (e.g., the source cell, a serving cell belonging to the CG associated with the source cell, or a serving cell belonging to other CG (i.e., not associated with the source cell)), the cell receiving the indication of CLTM execution initiation may transfer the indication to the target cell. In this case, the target cell may recognize the UE arrival due to CLTM execution based on the indication transferred from the cell receiving the indication of CLTM execution initiation.

[0537] The UE may determine whether to perform the random access procedure to the candidate cell based on whether the UE has the information of uplink synchronization to the candidate cell. For example, the UE may skip the random access procedure if the valid information of uplink synchronization (e.g., TA value) to the candidate cell has been acquired. If the random access procedure is skipped during the cell switch, the UE may send theRRCReconfigurationCompletemessage as the first uplink transmission to the candidate cell indicated by the mobility command. If the random access procedure is performed during the cell switch, the UE may send the RA preamble as the first uplink transmission to the candidate cell indicated by the mobility command. The UE may send theRRCReconfigurationCompletemessage to the candidate cell after the random access procedure is successfully completed. TheRRCReconfigurationCompletemessage may include the information (e.g., either sk-Counter or identifier indicating an sk-Counter value in the list of multiple sk-Counter values included in the candidate cell configuration) used for SCG security update during the cell switch.

[0538] In the present disclosure, in case the UE receives two independentltm-Config,or anltm-Configassociated with the MCG and anltm-ConfigNRDC:

[0539] - the UE maintains two independentVarLTM-ServingCellNoSecurityChange, one associated with theltm-Configand one associated with theltm-ConfigNRDC(if both are configured);

[0540] - the UE independently performs all the procedures in clause 5.3.5.18 for eachltm-Config,or anltm-Configand anltm-ConfigNRDC,and the associatedVarLTM-ServingCellNoResetID,VarLTM-ServingCellUE-MeasuredTA-ID, andVarLTM-ServingCellNoSecurityChangeunless explicitly stated otherwise.

[0541] The UE shall perform the following actions based on the receivedLTM-ConfigIE:

[0542] 1> if the receivedLTM-Configincludesltm-ServingCellNoSecurityChangeID:

[0543] 2> if the currentVarLTM-ServingCellNoSecurityChangeincludes anltm-ServingCellNoSecurityChangeID:

[0544] 3> replace theltm-ServingCellNoSecurityChangeIDvalue withinVarLTM-ServingCellNoSecurityChangewith the receivedltm-ServingCellNoSecurityChangeID;

[0545] 2> else:

[0546] 3> store the receivedltm-ServingCellNoSecurityChangeIDinVarLTM-ServingCellNoSecurityChange.

[0547] TheLTM-Configmay includeltm-ServingCellNoSecurityChangeID, and theLTM-Candidatemay includeltm-NoSecurityChangeID. If the network configuresltm-NoSecurityChangeIDfor one LTM candidate configuration, the network configures also for all LTM candidate configurations withinltm-CandidateToAddModListinLTM-Configand ensures that the UE has stored a value forltm-ServingCellNoSecurityChangeIDwithinVarLTM-ServingCellNoSecurityChangeID.

[0548] Theltm-ServingCellNoSecurityChangeIDmay be an ID associated with the serving cell based on which the UE determines whether a security change is needed or not upon an LTM cell switch procedure. Theltm-NoSecurityChangeIDmay be an ID associated with the candidate cell based on which the UE determines whether a security change is needed or not upon an LTM cell switch procedure. The UE may determine whether a security change is needed or not upon an LTM cell switch procedure, based on theltm-ServingCellNoSecurityChangeIDand / or theltm-NoSecurityChangeID.

[0549] TheLTM-ConfigNRDCmay compriseLTM-Config, and further compriseltm-SK-CounterConfigToAddModList. Theltm-SK-CounterConfigToAddModListmay be a list ofSK-CounterConfigLTM. TheSK-CounterConfigLTMmay comprise at least one ofltm-NoSecurityChangeID, orsk-CounterList. Thesk-CounterListmay be a list ofsk-Counter.

[0550] Thesk-Countermay be a counter used upon initial configuration of S-KgNB or S-KeNB, as well as upon refresh of S-KgNB or S-KeNB. This field is always included either upon initial configuration of an NR SCG or upon configuration of the first RB withkeyToUseset tosecondary, whichever happens first. This field is absent if there is neither any NR SCG nor any RB withkeyToUseset tosecondary, or if theRRCReconfigurationmessage is contained incondRRCReconfigfor subsequent CPAC.

[0551] During the LTM cell switch execution procedure, the UE shall:

[0552] 1> if the fieldltm-NoSecurityChangeIDis configured for theLTM-CandidateIE inltm-Configorltm-ConfigNRDCindicated by lower layers and if the UE does not have any value stored ofltm-ServingCellNoSecurityChangeIDwithinVarLTM-ServingCellNoSecurityChangeID; or

[0553] 1> if the value of fieldltm-NoSecurityChangeIDcontained within theLTM-CandidateIE inltm-Configorltm-ConfigNRDCindicated by lower layers or for the selected cell is not equal to the value ofltm-ServingCellNoSecurityChangeIDwithinVarLTM-ServingCellNoSecurityChangeID:

[0554] 2> if the LTM cell switch is triggered on the MCG:

[0555] 3> update the master security key by performing the AS security key update procedure;

[0556] 3> if theLTM-CandidateIE indicated by lower layers does not include anmrdc-SecondaryCellGroupConfigset torelease:

[0557] 4> update the secondary key by performing security key update procedure;

[0558] 2> else if the LTM cell switch is triggered on the SCG:

[0559] 3> consider the firstsk-Countervalue in theltm-SK-Counterswithin theVarLTM-ServingCellNoSecurityChangeIDaccording to the fieldltm-NoSecurityChangeIDas the selectedsk-Countervalue, and update the secondary key by performing security key update procedure;

[0560] 3> remove the selectedsk-Countervalue from theltm-SK-Counterswithin theVarLTM-ServingCellNoSecurityChangeID;

[0561] 2> at the end of the procedure, for eachdrb-Identityvalue that is part of the current UE configuration:

[0562] 3> if the PDCP entity of this DRB is not configured withcipheringDisabled:

[0563] 4> configure the PDCP entity with the ciphering algorithm and KUPenckey associated with the master key (KgNB) or secondary key (S-KgNB), as indicated inkeyToUse, i.e. the ciphering configuration shall be applied to all subsequent PDCP PDUs received and sent by the UE;

[0564] 3> if the PDCP entity of this DRB is configured withintegrityProtection:

[0565] 4> configure the PDCP entity with the integrity protection algorithms according tosecurityConfigand apply the KUPintkey associated with the master key (KeNB / KgNB) or the secondary key (S-KgNB) as indicated inkeyToUse;

[0566] 3> ifdrb-ContinueROHCis included inpdcp-Config:

[0567] 4> indicate to lower layer thatdrb-ContinueROHCis configured;

[0568] 3> ifdrb-ContinueEHC-DLis included inpdcp-Config:

[0569] 4> indicate to lower layer thatdrb-ContinueEHC-DLis configured;

[0570] 3> ifdrb-ContinueEHC-ULis included inpdcp-Config:

[0571] 4> indicate to lower layer thatdrb-ContinueEHC-ULis configured;

[0572] 3> ifdrb-ContinueUDCis included inpdcp-Config:

[0573] 4> indicate to lower layer thatdrb-ContinueUDCis configured;

[0574] 3> re-establish the PDCP entity of this DRB;

[0575] 3> re-establish the corresponding RLC entity;

[0576] 2> at the end of the procedure, for eachsrb-Identityvalue that is part of the current UE configuration:

[0577] 3> configure the PDCP entity to apply the integrity protection algorithm and KRRCintkey associated with the master key (KgNB) or the secondary key (S-KgNB), as indicated inkeyToUse, i.e. the integrity protection configuration shall be applied to all subsequent messages received and sent by the UE, including the message used to indicate the successful completion of the procedure;

[0578] 3> configure the PDCP entity to apply the ciphering algorithm and KRRCenckey associated with the master key (KgNB) or the secondary key (S-KgNB) as indicated inkeyToUse, i.e. the ciphering configuration shall be applied to all subsequent messages received and sent by the UE, including the message used to indicate the successful completion of the procedure;

[0579] 3> re-establish the PDCP entity of this SRB;

[0580] 3> re-establish the corresponding RLC entity;

[0581] 2> if the value of fieldltm-NoSecurityChangeIDcontained within theLTM-CandidateIE inltm-Configorltm-ConfigNRDCindicated by lower layers or for the selected cell is not equal to the value ofltm-ServingCellNoSecurityChangeIDwithinVarLTM-ServingCellNoSecurityChangeID:

[0582] 3> replace the value ofltm-ServingCellNoSecurityChangeIDinVarLTM-ServingCellNoSecurityChangeIDwith the value ofltm-NoSecurityChangeIDin theLTM-Candidateinltm-Configorltm-ConfigNRDCindicated by lower layers or for the selected cell;

[0583] The UE shall perform the LTM sk-Counter configuration addition / modification procedure according to the followings:

[0584] 1> for eachltm-NoSecurityChangeIDreceived inltm-SK-CounterConfigToAddModList:

[0585] 2> if an entry with the matchingltm-NoSecurityChangeIDexists in theltm-SK-Counterswithin theVarLTM-ServingCellNoSecurityChange:

[0586] 3> replace thesk-CounterListwithin theVarLTM-ServingCellNoSecurityChangewith thesk-CounterListaccording to the receivedltm-NoSecurityChangeID;

[0587] 2> else:

[0588] 3> add a new entry for thisltm-NoSecurityChangeIDwithin theVarLTM-ServingCellNoSecurityChange.

[0589] The UE shall perform the AS Security key update procedure according to the followings:

[0590] 1> if this procedure was initiated due to an LTM cell switch execution procedure which requires a master security key refresh:

[0591] 3> derive or update the KgNBkey based on the current KgNBkey or the NH, using the NCC parameter value indicated by lower layer;

[0592] 2> store the NCC value indicated by lower layers innextHopChainingCount;

[0593] 2> derive the keys associated with the KgNBkey as follows:

[0594] 3> derive the KRRCencand KUpenckeys associated with the currentcipheringAlgorithm;

[0595] 3> derive the KRRCintand KUpintkeys associated with the currentintegrityProtAlgorithm.

[0596] According to various embodiments, the UE may configure a first cell group (CG) and a second CG. The UE may receive a mobility configuration for the first CG. The configuration may include the information of one or more candidate cells. Each candidate cell may belong to a different CU. The UE may receive a mobility command for cell switch toward a candidate cell of the first CG. The UE may determine whether to perform security update for the second CG based on the information indicating whether the security for the first CG is updated due to the cell switch. The UE may apply the updated security to the second CG if the security update for the first CG is performed.

[0597] According to various embodiments, the UE may initiate the cell switch to the candidate cell if the mobility command does not include the information of conditional mobility.

[0598] According to various embodiments, the UE may initiate the evaluation of conditional mobility to the candidate cell if the mobility command includes the information of conditional mobility.

[0599] According to various embodiments, the UE may initiate the cell switch to the candidate cell if a condition for conditional mobility execution is satisfied.

[0600] Furthermore, the method in perspective of the communication device / UE described in the present disclosure (e.g., in FIG. 11) may be performed by the first wireless device 100 shown in FIG. 2 and / or the UE 100 shown in FIG. 3.

[0601] More specifically, the communication device / UE comprises at least one transceiver, at least processor, and at least one computer memory operably connectable to the at least one processor and storing instructions that, based on being executed by the at least one processor, perform operations.

[0602] The operations comprise: applying a configuration for a first cell group and a configuration for a second cell group; receiving a cell switch configuration related to the first cell group comprising one or more candidate configurations; receiving a cell switch command; triggering a cell switch on the first cell group based on the cell switch command, wherein the cell switch is related to a candidate configuration among the one or more candidate configurations; performing a security update for the first cell group based on the cell switch being triggered on the first cell group; and performing a security update for the second cell group based on the security update for the first cell group being performed.

[0603] Furthermore, the method in perspective of the communication device / UE described in the present disclosure (e.g., in FIG. 11) may be performed by a software code 105 stored in the memory 104 included in the first wireless device 100 shown in FIG. 2.

[0604] More specifically, at least one computer readable medium (CRM) stores instructions that, based on being executed by at least one processor, perform operations comprising: applying a configuration for a first cell group and a configuration for a second cell group; receiving a cell switch configuration related to the first cell group comprising one or more candidate configurations; receiving a cell switch command; triggering a cell switch on the first cell group based on the cell switch command, wherein the cell switch is related to a candidate configuration among the one or more candidate configurations; performing a security update for the first cell group based on the cell switch being triggered on the first cell group; and performing a security update for the second cell group based on the security update for the first cell group being performed.

[0605] Furthermore, the method in perspective of the communication device / UE described in the present disclosure (e.g., in FIG. 11) may be performed by control of the processor 102 included in the first wireless device 100 shown in FIG. 2 and / or by control of the processor 102 included in the UE 100 shown in FIG. 3.

[0606] More specifically, an apparatus configured to / adapted to operate in a wireless communication system (e.g., communication device / UE) comprises at least processor, and at least one computer memory operably connectable to the at least one processor. The at least one processor is configured to / adapted to perform operations comprising: applying a configuration for a first cell group and a configuration for a second cell group; receiving a cell switch configuration related to the first cell group comprising one or more candidate configurations; receiving a cell switch command; triggering a cell switch on the first cell group based on the cell switch command, wherein the cell switch is related to a candidate configuration among the one or more candidate configurations; performing a security update for the first cell group based on the cell switch being triggered on the first cell group; and performing a security update for the second cell group based on the security update for the first cell group being performed.

[0607] Furthermore, the method in perspective of a network node described in the present disclosure (e.g., in FIG. 12) may be performed by the second wireless device 200 shown in FIG. 2. The network node may be related to a serving cell.

[0608] More specifically, the network node comprises at least one transceiver, at least processor, and at least one computer memory operably connectable to the at least one processor and storing instructions that, based on being executed by the at least one processor, perform operations.

[0609] The operations comprise: transmitting a configuration for a first cell group and a configuration for a second cell group; transmitting a cell switch configuration related to the first cell group comprising one or more candidate configurations; and transmitting a cell switch command, wherein a cell switch is triggered on the first cell group based on the cell switch command, wherein the cell switch is related to a candidate configuration among the one or more candidate configurations, wherein a security update for the first cell group is performed based on the cell switch being triggered on the first cell group, and wherein a security update for the second cell group is performed based on the security update for the first cell group being performed.

[0610] The present disclosure may have various advantageous effects.

[0611] For example, in the case of MCG LTM cell switch with keeping the existing SN connection, the UE may perform the SN security update based on the updated MN security key and the counter value (e.g., sk-Counter) if the MN security is updated due to the MCG LTM cell switch. By doing so, a redundant / un-necessary security update can be prevented and the re-use of security key that were used in the past can be prevented.

[0612] Advantageous effects which can be obtained through specific embodiments of the present disclosure are not limited to the advantageous effects listed above. For example, there may be a variety of technical effects that a person having ordinary skill in the related art can understand and / or derive from the present disclosure. Accordingly, the specific effects of the present disclosure are not limited to those explicitly described herein, but may include various effects that may be understood or derived from the technical features of the present disclosure.

[0613] Claims in the present disclosure can be combined in a various way. For instance, technical features in method claims of the present disclosure can be combined to be implemented or performed in an apparatus, and technical features in apparatus claims can be combined to be implemented or performed in a method. Further, technical features in method claim(s) and apparatus claim(s) can be combined to be implemented or performed in an apparatus. Further, technical features in method claim(s) and apparatus claim(s) can be combined to be implemented or performed in a method. Other implementations are within the scope of the following claims.

Claims

1.A method comprising:applying a configuration for a first cell group and a configuration for a second cell group;receiving a cell switch configuration related to the first cell group comprising one or more candidate configurations;receiving a cell switch command;triggering a cell switch on the first cell group based on the cell switch command, wherein the cell switch is related to a candidate configuration among the one or more candidate configurations;performing a security update for the first cell group based on the cell switch being triggered on the first cell group; andperforming a security update for the second cell group based on the security update for the first cell group being performed.2.The method of claim 1, wherein the performing of the security update for the first cell group comprises performing the security update for the first cell group based on:a first identifier for whether a security change is needed or not upon cell switch included in the candidate configuration, anda second identifier for whether a security change is needed or not upon cell switch included in a current serving cell configuration.3.The method of claim 2, wherein the performing of the security update for the first cell group comprises performing the security update for the first cell group based on the first identifier being not equal to the second identifier.4.The method of claim 2, wherein the security update for the first cell group is not performed based on the first identifier being equal to the second identifier.5.The method of claim 2, wherein the first identifier and the second identifier comprise a radio resource control (RRC) identifier represented by an integer value.6.The method of claim 1, wherein the security update for the second cell group is not performed based on the security update for the first cell group being not performed.7.The method of claim 1, wherein the performing of the security update for the first cell group comprises performing the security update for the first cell group based on the cell switch being performed between different central units (CUs).8.The method of claim 1, wherein the performing of the security update for the second cell group comprises:obtaining an updated security key for the first cell group based on the security update for the first cell group; andperforming the security update for the second cell group based on the updated security key for the first cell group, and a counter value related to the security update for the second cell group.9.The method of claim 8, wherein the counter value is included in the candidate cell configuration.10.The method of claim 8, wherein the candidate configuration comprises a list of counter values related to the security update for the second cell group, andwherein the cell switch command comprises an indication of the counter value in the list of counter values.11.The method of claim 8, wherein the counter value is included in the cell switch command.12.The method of claim 1, wherein the cell switch command comprises information related to an identifier of the candidate configuration.13.The method of claim 1, further comprising evaluating execution conditions for the one or more candidate configurations based on receiving the cell switch command,wherein the candidate configuration is a candidate configuration for which one or more execution conditions are satisfied among the one or more candidate configurations.14.The method of claim 1, wherein the first cell group comprises a master cell group (MCG), and the second cell group comprises a secondary cell group (SCG).15.The method of claims 1, wherein the method is performed by a user equipment (UE) in communication with at least one of a mobile device, a network, or autonomous vehicles.16.A user equipment (UE) comprising:at least one transceiver;at least one processor; andat least one memory operatively coupled to the at least one processor and storing instructions that, based on being executed by the at least one processor, perform operations comprising:applying a configuration for a first cell group and a configuration for a second cell group;receiving a cell switch configuration related to the first cell group comprising one or more candidate configurations;receiving a cell switch command;triggering a cell switch on the first cell group based on the cell switch command, wherein the cell switch is related to a candidate configuration among the one or more candidate configurations;performing a security update for the first cell group based on the cell switch being triggered on the first cell group; andperforming a security update for the second cell group based on the security update for the first cell group being performed.17.An apparatus comprising:at least processor; andat least one memory operatively coupled to the at least one processor and storing instructions that, based on being executed by the at least one processor, perform operations comprising:applying a configuration for a first cell group and a configuration for a second cell group;receiving a cell switch configuration related to the first cell group comprising one or more candidate configurations;receiving a cell switch command;triggering a cell switch on the first cell group based on the cell switch command, wherein the cell switch is related to a candidate configuration among the one or more candidate configurations;performing a security update for the first cell group based on the cell switch being triggered on the first cell group; andperforming a security update for the second cell group based on the security update for the first cell group being performed.18.A non-transitory computer readable medium (CRM) having stored thereon a program code implementing instructions that, based on being executed by at least one processor, perform operations comprising:applying a configuration for a first cell group and a configuration for a second cell group;receiving a cell switch configuration related to the first cell group comprising one or more candidate configurations;receiving a cell switch command;triggering a cell switch on the first cell group based on the cell switch command, wherein the cell switch is related to a candidate configuration among the one or more candidate configurations;performing a security update for the first cell group based on the cell switch being triggered on the first cell group; andperforming a security update for the second cell group based on the security update for the first cell group being performed.19.A method comprising:transmitting a configuration for a first cell group and a configuration for a second cell group;transmitting a cell switch configuration related to the first cell group comprising one or more candidate configurations; andtransmitting a cell switch command,wherein a cell switch is triggered on the first cell group based on the cell switch command,wherein the cell switch is related to a candidate configuration among the one or more candidate configurations,wherein a security update for the first cell group is performed based on the cell switch being triggered on the first cell group, andwherein a security update for the second cell group is performed based on the security update for the first cell group being performed.20.A network node comprising:at least one transceiver;at least one processor; andat least one memory operatively coupled to the at least one processor and storing instructions that, based on being executed by the at least one processor, perform operations comprising:transmitting a configuration for a first cell group and a configuration for a second cell group;transmitting a cell switch configuration related to the first cell group comprising one or more candidate configurations; andtransmitting a cell switch command,wherein a cell switch is triggered on the first cell group based on the cell switch command,wherein the cell switch is related to a candidate configuration among the one or more candidate configurations,wherein a security update for the first cell group is performed based on the cell switch being triggered on the first cell group, andwherein a security update for the second cell group is performed based on the security update for the first cell group being performed.

Images