[go: up one dir, main page]

WO2024208444A1 - Connexions sécurisées dans un réseau de communication sans fil - Google Patents

Connexions sécurisées dans un réseau de communication sans fil Download PDF

Info

Publication number
WO2024208444A1
WO2024208444A1 PCT/EP2023/083603 EP2023083603W WO2024208444A1 WO 2024208444 A1 WO2024208444 A1 WO 2024208444A1 EP 2023083603 W EP2023083603 W EP 2023083603W WO 2024208444 A1 WO2024208444 A1 WO 2024208444A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
amf
3gpp access
message
network
Prior art date
Application number
PCT/EP2023/083603
Other languages
English (en)
Inventor
Sheeba Backia Mary BASKARAN
Andreas Kunz
Apostolis Salkintzis
Original Assignee
Lenovo (Singapore) Pte. Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Lenovo (Singapore) Pte. Ltd. filed Critical Lenovo (Singapore) Pte. Ltd.
Publication of WO2024208444A1 publication Critical patent/WO2024208444A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/14—Reselecting a network or an air interface

Definitions

  • the subject matter disclosed herein relates generally to the field of implementing secure connections in a wireless communication network.
  • This document defines a user equipment apparatus, a user equipment processor, a network equipment apparatus and a method performed by a user equipment.
  • a wireless communications system may include one or multiple network communication devices, such as base stations, which may support wireless communications for one or multiple user communication devices, which may be otherwise known as user equipment (UE), or other suitable terminology.
  • the wireless communications system may support wireless communications with one or multiple user communication devices by utilizing resources of the wireless communication system (e.g., time resources (e.g., symbols, slots, subframes, frames, or the like) or frequency resources (e.g., subcarriers, carriers, or the like).
  • the wireless communications system may support wireless communications across various radio access technologies including third generation (3G) radio access technology, fourth generation (4G) radio access technology, fifth generation (5G) radio access technology, among other suitable radio access technologies beyond 5G (e.g., sixth generation (6G)).
  • the phrase “based on” shall not be construed as a reference to a closed set of conditions. For example, an example step that is described as “based on condition A” may be based on both a condition A and a condition B without departing from the scope of the present disclosure. In other words, as used herein, the phrase “based on” shall be construed in the same manner as the phrase “based at least in part on. Further, as used herein, including in the claims, a “set” may include one or more elements.
  • a user equipment for wireless communication, the UE comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the UE to: establish a first secure connection with an access and mobility management function, AMF, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, k wir; send, to the AMF over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the AMF via a second non-3GPP access network, wherein the second key is derived using the kAMF; receive, from the AMF, a second message, wherein the second message indicates a request for the UE to derive the second key; and derive the second key from the kAMF in response to the second message.
  • AMF access and mobility management function
  • a network equipment for wireless communication comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the network equipment to: establish a first secure connection with an user equipment, UE, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, kA F; receive, from the UE over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the network equipment via a second non-3GPP access network, wherein the second key is derived using the kAMF; and send, to the UE, a second message, wherein the second message indicates a request for the UE to derive the second key.
  • a method performed by a user equipment, UE comprising: establishing a first secure connection with an access and mobility management function, AMF, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, k.wii sending, to the AMF over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the AMF via a second non- 3GPP access network, wherein the second key is derived using the kAMF; receiving, from the AMF, a second message, wherein the second message indicates a request for the UE to derive the second key; and deriving the second key from the kAMF in response to the second message.
  • Figure 1 illustrates an example of a wireless communications system in accordance with aspects of the present disclosure.
  • Figure 2a illustrates a signalling diagram for untrusted non-3GPP access authentication.
  • Figure 2b illustrates a signalling diagram for untrusted non-3GPP access authentication.
  • Figure 3a illustrates a signalling diagram for trusted non-3GPP access authentication.
  • Figure 3b illustrates a signalling diagram for trusted non-3GPP access authentication.
  • Figure 4a illustrates a signalling diagram for untrusted non-3GPP access authentication, according to one or more embodiments.
  • Figure 4b illustrates a signalling diagram for untrusted non-3GPP access authentication, according to one or more embodiments.
  • Figure 5 is a table of access type distinguishers and values, according to one or more embodiments.
  • Figure 6a illustrates a signalling diagram for trusted non-3GPP access authentication, according to one or more embodiments.
  • Figure 6b illustrates a signalling diagram for trusted non-3GPP access authentication, according to one or more embodiments.
  • Figure 7 is a table of access type distinguishers and values, according to one or more embodiments.
  • Figure 8a illustrates a signalling diagram for trusted non-3GPP access authentication, according to one or more embodiments.
  • Figure 8b illustrates a signalling diagram for trusted non-3GPP access authentication, according to one or more embodiments.
  • Figure 9 is a table of access type distinguishers and values, according to one or more embodiments.
  • Figure 10 illustrates a signalling diagram for non-3GPP access authentication, according to one or more embodiments.
  • Figure 11 is a table of access type distinguishers and values, according to one or more embodiments.
  • Figure 12a illustrates a signalling diagram for trusted non-3GPP access authentication, according to one or more embodiments.
  • Figure 12b illustrates a signalling diagram for trusted non-3GPP access authentication, according to one or more embodiments.
  • Figure 13 is a table of access type distinguishers and values, according to one or more embodiments.
  • Figure 14 illustrates an example of a user equipment (UE) 1400 in accordance with aspects of the present disclosure.
  • Figure 15 illustrates an example of a processor 1500 in accordance with aspects of the present disclosure.
  • Figure 16 illustrates an example of a network equipment (NE) 1600 in accordance with aspects of the present disclosure.
  • Figure 17 illustrates a flowchart of a method performed by a UE in accordance with aspects of the present disclosure.
  • Figure 18 illustrates a flowchart of a method performed by a NE in accordance with aspects of the present disclosure.
  • the 5 th Generation (5G) system non-3GPP access network e.g. access networks other than 3 rd Generation Partnership Project 3 GPP access networks
  • the 5G system non-3GPP access network do not support standardised interfaces between two different non-3GPP access networks (e.g., between gateway functions/interworking functions like trusted network gateway function (TNGF)/ non-3GPP interworking function (N3IWF) in the non-3gpp access network) to allow sharing of security context between the current non-3GPP access network and the target non-3GPP access network for user equipment (UE) mobility security (re-) establishment.
  • TNGF trusted network gateway function
  • N3IWF non-3GPP interworking function
  • Embodiments enable the network equipment (e.g., an access and mobility management function (AMF)) to instruct the user equipment to derive a new (second) key for a secure connection with second non-3GPP access network (i.e., rekey/refresh the non- 3GPP access keys).
  • AMF access and mobility management function
  • Embodiments enable use of an existing security context available in the user equipment and network equipment to re-key/refresh the non-3GPP access network connection during UE mobility registration (mobility registration update) scenarios without the network equipment performing primary full authentication.
  • Embodiments enable use of an existing security context available in the user equipment and network equipment to re-key/refresh the non-3GPP access network connection during UE mobility security re-establishment procedures without the network equipment performing primary full authentication.
  • FIG. 1 illustrates an example of a wireless communications system 100 in accordance with aspects of the present disclosure.
  • the wireless communications system 100 may include one or more NE 102, one or more UE 104, and a core network (CN) 106.
  • the wireless communications system 100 may support various radio access technologies.
  • the wireless communications system 100 may be a 4G network, such as an LTE network or an LTE- Advanced (LTE-A) network.
  • the wireless communications system 100 may be a NR network, such as a 5G network, a 5G- Advanced (5G-A) network, or a 5G ultrawideband (5G-UWB) network.
  • the wireless communications system 100 may be a combination of a 4G network and a 5G network, or other suitable radio access technology including Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20.
  • IEEE Institute of Electrical and Electronics Engineers
  • Wi-Fi Wi-Fi
  • WiMAX IEEE 802.16
  • IEEE 802.20 The wireless communications system 100 may support radio access technologies beyond 5G, for example, 6G. Additionally, the wireless communications system 100 may support technologies, such as time division multiple access (TDMA), frequency division multiple access (FDMA), or code division multiple access (CDMA), etc.
  • TDMA time division multiple access
  • FDMA frequency division multiple access
  • CDMA code division multiple access
  • the one or more NE 102 may be dispersed throughout a geographic region to form the wireless communications system 100.
  • One or more of the NE 102 described herein may be or include or may be referred to as a network node, a base station, a network element, a network function, a network entity, a radio access network (RAN), a NodeB, an eNodeB (eNB), a next-generation NodeB (gNB), or other suitable terminology.
  • An NE 102 and a UE 104 may communicate via a communication link, which may be a wireless or wired connection.
  • an NE 102 and a UE 104 may perform wireless communication (e.g., receive signaling, transmit signaling) over a Uu interface.
  • An NE 102 may provide a geographic coverage area for which the NE 102 may support services for one or more UEs 104 within the geographic coverage area.
  • an NE 102 and a UE 104 may support wireless communication of signals related to services (e.g., voice, video, packet data, messaging, broadcast, etc.) according to one or multiple radio access technologies.
  • an NE 102 may be moveable, for example, a satellite associated with a non-terrestrial network (NTN).
  • NTN non-terrestrial network
  • different geographic coverage areas associated with the same or different radio access technologies may overlap, but the different geographic coverage areas may be associated with different NE 102.
  • the one or more UE 104 may be dispersed throughout a geographic region of the wireless communications system 100.
  • a UE 104 may include or may be referred to as a remote unit, a mobile device, a wireless device, a remote device, a subscriber device, a transmitter device, a receiver device, or some other suitable terminology.
  • the UE 104 may be referred to as a unit, a station, a terminal, or a client, among other examples.
  • the UE 104 may be referred to as an Internet-of-Things (loT) device, an Internet-of-Everything (loE) device, or machine-type communication (MTC) device, among other examples.
  • LoT Internet-of-Things
  • LoE Internet-of-Everything
  • MTC machine-type communication
  • a UE 104 may be able to support wireless communication directly with other UEs 104 over a communication link.
  • a UE 104 may support wireless communication directly with another UE 104 over a device-to-device (D2D) communication link.
  • D2D device-to-device
  • the communication link may be referred to as a sidelink.
  • a UE 104 may support wireless communication directly with another UE 104 over a PC5 interface.
  • An NE 102 may support communications with the CN 106, or with another NE 102, or both.
  • an NE 102 may interface with other NE 102 or the CN 106 through one or more backhaul links (e.g., SI, N2, N2, or network interface).
  • the NE 102 may communicate with each other directly.
  • the NE 102 may communicate with each other or indirectly (e.g., via the CN 106.
  • one or more NE 102 may include subcomponents, such as an access network entity, which may be an example of an access node controller (ANC).
  • An ANC may communicate with the one or more UEs 104 through one or more other access network transmission entities, which may be referred to as a radio heads, smart radio heads, or transmission-reception points (TRPs).
  • TRPs transmission-reception points
  • the CN 106 may support user authentication, access authorization, tracking, connectivity, and other access, routing, or mobility functions.
  • the CN 106 may be an evolved packet core (EPC), or a 5G core (5GC), which may include a control plane entity that manages access and mobility (e.g., a mobility management entity (MME), an access and mobility management functions (AMF)) and a user plane entity that routes packets or interconnects to external networks (e.g., a serving gateway (S-GW), a Packet Data Network (PDN) gateway (P-GW), or a user plane function (UPF)).
  • EPC evolved packet core
  • 5GC 5G core
  • MME mobility management entity
  • AMF access and mobility management functions
  • S-GW serving gateway
  • PDN gateway Packet Data Network gateway
  • UPF user plane function
  • control plane entity may manage non-access stratum (NAS) functions, such as mobility, authentication, and bearer management (e.g., data bearers, signal bearers, etc.) for the one or more UEs 104 served by the one or more NE 102 associated with the CN 106.
  • NAS non-access stratum
  • the CN 106 may communicate with a packet data network over one or more backhaul links (e.g., via an SI, N2, N2, or another network interface).
  • the packet data network may include an application server.
  • one or more UEs 104 may communicate with the application server.
  • a UE 104 may establish a session (e.g., a protocol data unit (PDU) session, or the like) with the CN 106 via an NE 102.
  • the CN 106 may route traffic (e.g., control information, data, and the like) between the UE 104 and the application server using the established session (e.g., the established PDU session).
  • the PDU session may be an example of a logical connection between the UE 104 and the CN 106 (e.g., one or more network functions of the CN 106).
  • the NEs 102 and the UEs 104 may use resources of the wireless communications system 100 (e.g., time resources (e.g., symbols, slots, subframes, frames, or the like) or frequency resources (e.g., subcarriers, carriers)) to perform various operations (e.g., wireless communications).
  • the NEs 102 and the UEs 104 may support different resource structures.
  • the NEs 102 and the UEs 104 may support different frame structures.
  • the NEs 102 and the UEs 104 may support a single frame structure.
  • the NEs 102 and the UEs 104 may support various frame structures (i.e., multiple frame structures).
  • the NEs 102 and the UEs 104 may support various frame structures based on one or more numerologies.
  • One or more numerologies may be supported in the wireless communications system 100, and a numerology may include a subcarrier spacing and a cyclic prefix.
  • a second numerology may be associated with a second subcarrier spacing (e.g., 30 kHz) and a normal cyclic prefix.
  • a time interval of a resource may be organized according to frames (also referred to as radio frames).
  • Each frame may have a duration, for example, a 10 millisecond (ms) duration.
  • each frame may include multiple subframes.
  • each frame may include 10 subframes, and each subframe may have a duration, for example, a 1 ms duration.
  • each frame may have the same duration.
  • each subframe of a frame may have the same duration.
  • a time interval of a resource may be organized according to slots.
  • a subframe may include a number (e.g., quantity) of slots.
  • the number of slots in each subframe may also depend on the one or more numerologies supported in the wireless communications system 100.
  • Each slot may include a number (e.g., quantity) of symbols (e.g., OFDM symbols).
  • the number (e.g., quantity) of slots for a subframe may depend on a numerology.
  • a slot For a normal cyclic prefix, a slot may include 14 symbols.
  • a slot For an extended cyclic prefix (e.g., applicable for 60 kHz subcarrier spacing), a slot may include 12 symbols.
  • a first subcarrier spacing e.g. 15 kHz
  • an electromagnetic (EM) spectrum may be split, based on frequency or wavelength, into various classes, frequency bands, frequency channels, etc.
  • the wireless communications system 100 may support one or multiple operating frequency bands, such as frequency range designations FR1 (410 MHz - 7.125 GHz), FR2 (24.25 GHz - 52.6 GHz), FR3 (7.125 GHz - 24.25 GHz), FR4 (52.6 GHz - 114.25 GHz), FR4a or FR4-1 (52.6 GHz - 71 GHz), and FR5 (114.25 GHz - 300 GHz).
  • FR1 410 MHz - 7.125 GHz
  • FR2 24.25 GHz - 52.6 GHz
  • FR3 7.125 GHz - 24.25 GHz
  • FR4 (52.6 GHz - 114.25 GHz
  • FR4a or FR4-1 52.6 GHz - 71 GHz
  • FR5 114.25 GHz - 300 GHz
  • the NEs 102 and the UEs 104 may perform wireless communications over one or more of the operating frequency bands.
  • FR1 may be used by the NEs 102 and the UEs 104, among other equipment or devices for cellular communications traffic (e.g., control information, data).
  • FR2 may be used by the NEs 102 and the UEs 104, among other equipment or devices for short-range, high data rate capabilities.
  • FR1 may be associated with one or multiple numerologies (e.g., at least three numerologies).
  • FR2 may be associated with one or multiple numerologies (e.g., at least 2 numerologies).
  • Figure 2a illustrates a signalling diagram, indicated generally by reference numeral 200, for untrusted non-3GPP access authentication.
  • the signalling diagram 200 comprises a UE 210, an untrusted non-3GPP access network 220, a N3IWF 230, an AMF 240 and an AUSF 250.
  • the signalling diagram 200 illustrates a first part of a process which may be performed when a UE 210 disconnects from a first N3IWF 230 and reconnects to the first N3IWF 230.
  • the signalling diagram 200 illustrates a first part of a process that may be performed when the UE 210 disconnects from a first N3IWF 230 and connects to a second N3IWF 230.
  • the authentication for untrusted non-3GPP Access may be described as follows.
  • the UE 210 is authenticated to 5G network via an untrusted non-3GPP access network 220. It uses a vendor-specific Extensible Authentication Protocol (EAP) method called “EAP-5G", utilizing the "Expanded” EAP type and the existing 3GPP Vendor-Id, registered with Internet Assigned Numbers Authority (IANA) under the SMI Private Enterprise Code registry.
  • EAP-5G vendor-specific Extensible Authentication Protocol
  • the "EAP-5G” method is used between the UE 210 and the N3IWF 230 and is utilized for encapsulating NAS messages. If the UE 210 is authenticated by the 3 GPP home network, any of the authentication methods as described in clause 6.1.3 of TS 33.501 VI 8.3.0 can be used.
  • the method is executed between the UE 210 and AUSF 250 as shown in Figure 2a and Figure 2b
  • the UE 210 shall be authenticated by reusing the existing UE NAS security context in AMF 240.
  • the signalling diagram 200 comprises the following steps:
  • the UE 210 connects to an untrusted non-3GPP access network 220.
  • the UE 210 decides to attach to 5GC network
  • the UE 210 selects an N3IWF 230 in a 5GPLMN, as described in 3GPP TS 23.501 V18.3.0 [2] clause 6.3.6.
  • the UE 210 proceeds with the establishment of an IPsec Security Association (SA) with the selected N3IWF 230 by initiating an Internet Key Exchange (IKE) initial exchange according to IKE protocol version 2 (IKEv2) RFC 7296.
  • IKE Internet Key Exchange
  • the UE 210 shall initiate an IKE AUTH exchange by sending an IKE AUTH request message.
  • the AUTH payload is not included in the IKE AUTH request message, which indicates that the IKE AUTH exchange shall use EAP signalling (in this case EAP-5G signalling).
  • EAP signalling in this case EAP-5G signalling.
  • the UE 210 shall set the ID type as ID KEY-ID in this message and set its value equal to any random number.
  • the UE 210 shall not use its Global Unique Temporary Identifier (GUTI)/ Subscription Concealed Identifier (SUCI)/ Subscription Permanent Identifier (SUPI) as the Id in this step.
  • GUI Global Unique Temporary Identifier
  • SUCI Subscription Concealed Identifier
  • SUPI Subscription Permanent Identifier
  • the N3IWF 230 responds with an IKE AUTH response message which includes the N3IWF 230 identity, the AUTH payload to protect the previous message it sent to the UE 210 (in the IKE SA INIT exchange) and an EAP-Request/5G- Start packet.
  • the EAP-Request/5G- Start packet informs the UE 210 to initiate an EAP-5G session, i.e. to start sending non-access stratum (NAS) messages encapsulated within EAP- 5G packets.
  • NAS non-access stratum
  • the N3IWF 230 shall also include the CERT pay load including N3IWF 230 certificate.
  • the UE 210 shall validate the N3IWF 230 certificate and shall confirm that the N3IWF identity matches the N3IWF 230 selected by the UE 230. An absence of the certificate from the N3IWF 230 if the UE 210 had requested the certificate or unsuccessful identity confirmation shall result in a connection failure.
  • the UE 210 shall send an IKE AUTH request which includes an EAP-Response/5G-NAS packet that contains a Registration Request message containing UE 210 security capabilities and the SUCI. If UE 210 is already with the 5GC over 3GPP access and there is an available security context, the UE 210 shall integrity protect the Registration Request message and shall send the 5G-GUTI instead of SUCI.
  • the N3IWF 230 shall refrain from sending an EAP-Identity request.
  • the UE 210 may ignore an EAP Identity request or respond with the SUCI it sent in the Registration Request. If the UE 210 has registered to the same AMF 240 through 3GPP access, and if this is the first time that the UE 210 connects to the 5GC through non-3GPP access, the value of corresponding uplink non-access stratum count (UL NAS COUNT) used for integrity protection is 0; else it can use the existing non-3GPP specific UL NAS COUNT for integrity protection.
  • UL NAS COUNT uplink non-access stratum count
  • the N3IWF 230 does not send an EAP-Identity request because the UE 210 includes its identity in the IKE AUTH request in message 275. This is in line with IKEv2 RFC 7296, clause 3.16.
  • the N3IWF 230 shall select an AMF 240 as specified in TS 23.501 V18.3.0, clause 6.5.3.
  • the N3IWF 230 forwards the Registration Request received from the UE 210 to the AMF 240.
  • step 277 if the AMF 240 receives a 5G-GUTI and the Registration is integrity protected, it may use the security context to verify the integrity protection as described in TS 33.501 V18.3.0 clause 6.4.6. If the UE 210 has registered to the same AMF 240 through 3GPP access, and if this is the first time that the AMF 240 receives UE’s 210 NAS signalling through non-3GPP access, the value of corresponding UL NAS COUNT used for integrity verification is 0; else it can use the existing non-3GPP specific UL NAS COUNT for integrity verification. If integrity is verified successfully, it indicates that UE 210 is authenticated by AMF 240.
  • step 278 to step 281 may be skipped. If integrity is verified successfully and no newer security context has been activated over the 3GPP access, then step 278 to step 281 may be skipped. If integrity is verified successfully and a newer security context has been activated over the 3 GPP access then authentication may be skipped but the AMF 240 shall activate the newer context with a NAS Spica Mobility Core Solution (SMC) procedure as described in step 278 and onwards. Otherwise, the AMF 240 shall authenticate the UE 210.
  • SMC NAS Spica Mobility Core Solution
  • the AMF 240 decides to authenticate the UE 210, it shall use one of the methods from TS 33.501 V18.3.0 clause 6.1.3. In this case, the AMF 240 shall send a key request to the authentication and key management function (AUSF) 250.
  • the AUSF 250 may initiate an authentication procedure as specified in TS 33.501 VI 8.3.0 clause 6.1.3.
  • the authentication packets are encapsulated within NAS authentication messages and the NAS authentication messages are carried in N2 signalling between the AMF 240 and N3IWF 230, and then are encapsulated within EAP-5G/5G- NAS packets between the N3IWF 230 and the UE 210.
  • the AUSF 250 shall send the anchor key ksEAF derived from kAusF to the security anchor function (SEAF).
  • SEAF shall derive the k.wn from ksEAF and send it to the AMF 240 which is used by the AMF 240 to derive NAS security keys.
  • AKA EAP-authentication and key agreement
  • the AUSF 250 shall include the EAP-Success.
  • the UE 210 also derives the anchor key ksEAF and from that key it derives the kAMF followed by NAS security keys.
  • the NAS COUNTs associated with NAS connection identifier "0x02" are set at the UE 210 and AMF 240.
  • the AMF 240 shall send a Security Mode Command (SMC) to the UE 210 in order to activate NAS security associated with NAS connection identifier "0x02". This message is first sent to N3IWF 230 (within an N2 message). If EAP-AKA' is used for authentication, the AMF 240 shall encapsulate the EAP-Success received from AUSF 250 within the SMC message.
  • SMC Security Mode Command
  • the N3IWF 230 shall forward the NAS SMC to UE 210 within an EAP-Request/5G-NAS packet.
  • Figure 2b illustrates a signalling diagram, indicated generally by reference numeral 205, for untrusted non-3GPP access authentication.
  • the signalling diagram 205 comprises a UE 210, an untrusted non-3GPP access network 220, a N3IWF 230, an AMF 240 and an AUSF 250.
  • the signalling diagram 205 illustrates a process that follows on from the first part of the process illustrated in signalling diagram 200 in Figure 2a.
  • the signalling diagram 205 illustrates a second part of a process which may be performed when a UE 210 disconnects from a first N3IWF 230 and reconnects to the first N3IWF 230.
  • the signalling diagram 205 illustrates a second part of a process that may be performed when the UE 210 disconnects from a first N3IWF 230 and connects to a second N3IWF 230.
  • the signalling diagram 205 comprises the following steps.
  • step 280 the UE 210 completes the authentication (if initiated in step 277 in Figure 2a) and creates a NAS security context or activates another one based on the received key set identifier (ngKSI) in the NAS SMC.
  • UE 210 shall respond to the NAS SMC it received from the AMF 240 based on the selected algorithms and parameters as described in TS 33.501 V18.3.0 in clause 6.7.2.
  • the UE 210 shall encapsulate the NAS SMC Complete in the EAP-5G Response.
  • step 281 the N3IWF 230 shall forward the NAS packet containing NAS SMC Complete to the AMF 240 over the N2 interface.
  • step 282 the AMF 240 upon reception of the NAS SMC Complete from the UE 210 or upon success of integrity protection verification, initiates the next generation application protocol (NGAP) procedure to set up the AN context.
  • AMF 240 shall compute the N3IWF key, k ⁇ 3i ⁇ vr, using the uplink NAS COUNT associated with NAS connection identifier "0x02" as defined in TS 33.501 V18.3.0 Annex A.9 for the establishment of the IPsec security association (SA) between the UE 210 and the N3IWF 230 and shall include it in the NGAP Initial Context Setup Request sent to the N3IWF 230.
  • SA IPsec security association
  • N3IWF 230 sends an EAP-Success/EAP-5G to the UE 210 upon reception of the NGAP Initial Context Setup Request containing the N3IWF key, k ⁇ 3i ⁇ i . This completes the EAP-5G session and no further EAP-5G packets are exchanged. If the N3IWF 230 does not receive the k ⁇ 3i ⁇ vi from AMF 240, the N3IWF 230 shall respond with an EAP-Failure.
  • step 284 the IPsec SA is established between the UE 210 and N3IWF 230 by using the N3IWF key k ⁇ 3i ⁇ vi that was created in the UE 210 using the uplink NAS COUNT associated with NAS connection identifier "0x02" as defined in TS 33.501 V18.3.0 Annex A.9 and was received by N3IWF 230 from the AMF 240 in step 282.
  • step 285 upon successful establishment of the IPsec SA between the UE 210 and the N3IWF 230, the N3IWF 230 shall send the NGAP Initial Context Setup Response message to the AMF 240.
  • the AMF 240 may determine whether the N3IWF 230 is appropriate for the slice selected as defined in clause 4.12.2.2 of TS 23.502 VI 8.3.0. If it is compatible with the selected N3IWF 230, then proceed with step 286 and step 287. Otherwise, the AMF 240 shall proceed with step 288 to step 290, and step 286 to 287 are skipped.
  • the AMF 240 is not able to provide new non-3gpp access keys to the N3IWF 230 (e.g. k ⁇ 2i ⁇ vi ) without performing a full primary authentication run.
  • the UE 210 on mobility may connect with the same AMF 240 via different target N3IWF 230, but the current authentication procedure does not allow the AMF 240 to reuse UE NAS security context to refresh or rekey the N3IWF keys for the UE 210 and N3IWF 230 non-3gpp access connection.
  • Figure 3a illustrates a signalling diagram, indicated generally by reference numeral 300, for trusted non-3GPP access authentication.
  • the signalling diagram 300 may represent registration ⁇ Authentication and packet data unit (PDU) Session establishment for trusted non-3GPP access.
  • PDU packet data unit
  • the signalling diagram 300 comprises a UE 310, an trusted non-3GPP access network (TNAN) 320, an AMF 340 and an AUSF 350.
  • the TNAN 320 comprises a trusted non-3GPP access point (TNAP) 322 and a trusted non-3GPP gateway function (TNGF) 324.
  • TNAP trusted non-3GPP access point
  • TNGF trusted non-3GPP gateway function
  • the signalling diagram 300 illustrates a first part of a process which may be performed when a UE 310 disconnects from a first TNGF 324 and reconnects to the first TNGF 324.
  • the signalling diagram 300 illustrates a first part of a process that may be performed when the UE 310 disconnects from a first TNGF 324 and connects to a second TNGF 324.
  • the signalling diagram 300 comprises the following steps. [0088] In step 0, the UE 310 selects a public land mobile network (PLMN) and a trusted non-3GPP access network (TNAN) 320 for connecting to this PLMN by using the Trusted Non-3GPP Access Network selection procedure specified in TS 23.501 V18.3.0, clause 6.3.12. During this procedure, the UE 210 discovers the PLMNs with which the TNAN 320 supports trusted connectivity (e.g. “5G connectivity”).
  • PLMN public land mobile network
  • TNAN trusted non-3GPP access network
  • step 371 a layer-2 (L2) connection is established between the UE 310 and the TNAP 322.
  • L2 layer-2
  • this step corresponds to an 802.11 Association.
  • PPP point-to-point protocol
  • this step corresponds to a PPP link control protocol (LCP) negotiation.
  • LCP link control protocol
  • this step may not be required.
  • EAP messages shall be encapsulated into layer-2 packets, e.g. into IEEE 802.3/802. lx packets, into IEEE 802.11/802. lx packets, into PPP packets, etc.
  • the UE 310 provides a network access identifier (NAI) that triggers the TNAP 322 to send a authentication, authorisation and accounting (AAA) request to a TNGF 324. Between the TNAP 322 and TNGF 324, the EAP packets are encapsulated into AAA messages.
  • NAI network access identifier
  • AAA authentication, authorisation and accounting
  • step 372 the UE 310 sends a L2 message to the TNAP 322 which may include EAP - Req/Identity.
  • step 373 the UE 310 sends a L2 message to the TNAP 322 which may include EAP Res/Identity and/or username@realm.
  • the EAP-5G packets shall not be encapsulated into IKEv2 packets.
  • the UE 310 shall also include a UE Id in the AN parameter, e.g. a 5G-GUTI if available from a prior registration to the same PLMN.
  • a krNGF as specified in clause TS 33.501 VI 8.3.0 Annex A.9 (equivalent to kviwi ) is created in the UE 310 and in the AMF 340 after the successful authentication.
  • the k rx ⁇ ;i is transferred from the AMF 340 to TNGF 324 in step 380a (within the N2 Initial Context Setup Request).
  • the TNGF 324 shall send to UE 310 an EAP-Request/5G-Notification packet containing the “TNGF Contact Info”, which includes the IP address of TNGF 324. After receiving an EAP-Response/5G-Notification packet from the UE, the TNGF shall send message lOd containing the EAP-Success packet.
  • the UE 310 sends an L2 message to the TNAP 322 which may include (EAP-Res/5G-NAS/!sip!AN-Params(S-NSSAI or ⁇ 5G-GUTI,..],NAS- PDU(Reg.Req).
  • the TNAP 322 sends a AAA message to the TNGF 324 which may include (EAP-Res/5G-NAS/AN-Params(Single - Network Slice Selection Assistance Information (S-NSSAI) or 5G GUH,...), NAS-PDU(Reg. Request).
  • step 376b the TNGF 324 sends an N2 message to the AMF 340 which may include a (Registration Request).
  • step 377b the TNAP 322 and TNGF 324 exchange AAA messages which may include (EAP-REQ/RES/5G-NAS/NAS-PDU(Identity Req/Res)).
  • step 378a the AMF 340 sends a Nausf_UEAuthentication Authenticate Request to the AUSF 350 which may include a SUPI or a SUCI.
  • step 378c the AUSF 350 sends a Nausf_UEAuthentication Authenticate Response to the AMF 340 which may include the SEAF key and/or a EAP - Success indication.
  • the TNGF 324 sends a AAA message to the TNAP 322 which may include (EAP-REQ/5G-NAS/NAS-PDU[SMC Request(EAP-SUCCESS)],).
  • the TNAP 322 sends an L2 message to the UE 310 which may include (EAP-REQ/5G-NAS/NAS- PDU[SMC Request (EAP-SUCCESS)],TNGF Address)).
  • the AMF 340 may send an N2 message to the TNGF 324 which may include an Initial Ctx Setup Request and/or a k r ⁇ ;r .
  • the UE 310 may send an L2 message to the TNAP 322 which may include (EAP-Res/5G-Notification/).
  • the TNAP 322 may send a AAA message to the TNGF 324 which may include (EAP-Res/5G-Notification/).
  • step 380d the TNGF 324 sends the TNAP 322 a AAA message which may include TNAP key and/or EAP - Success indication.
  • Figure 3b illustrates a signalling diagram, indicated generally by reference numeral 305, for trusted non-3GPP access authentication.
  • the signalling diagram 305 may represent registration ⁇ Authentication and packet data unit (PDU) Session establishment for trusted non-3GPP access.
  • PDU packet data unit
  • the signalling diagram 305 comprises a UE 310, an trusted non-3GPP access network (TNAN) 320, an AMF 340 and an AUSF 350.
  • the TNAN 320 comprises a trusted non-3GPP access point (TNAP) 322 and a trusted non-3GPP gateway function (TNGF) 324.
  • the signalling diagram 305 illustrates a process that follows on from the first part of the process illustrated in signalling diagram 300 in Figure 3a.
  • the signalling diagram 305 illustrates a second part of a process which may be performed when a UE 310 disconnects from a first TNGF 324 and reconnects to the first TNGF 324.
  • the signalling diagram 305 illustrates a second part of a process that may be performed when the UE 310 disconnects from a first TNGF 324 and connects to a second TNGF 324.
  • the signalling diagram 305 comprises the following steps.
  • the common TNAP key (TNAP) is used by the UE 310 and TNAP 322 to derive security keys according to the applied non-3GPP technology and to establish a security association to protect all subsequent traffic.
  • the KTNAP is the Pairwise Master Key (PMK) and a 4- way handshake is executed (see IEEE 802.11) which establishes a security context between the wireless local area network (WLAN) access point (AP) and the UE 310 that is used to protect unicast and multicast traffic over the air. All messages between UE 310 and TNAP 322 are encrypted and integrity protected from this step onwards.
  • PMK Pairwise Master Key
  • the AMF is able to rekey/refresh the non-3GPP access keys.
  • the AMF is able to rekey/refresh a TNGF key in case of trusted non-3GPP access connection.
  • the AMF is able to rekey/refresh a new N3IWF key in case of untrusted non- 3 GPP access connection.
  • the AMF is able to rekey/refresh TWIF keys in case of trusted WLAN access.
  • the AMF is able to rekey/refresh W-AGF keys in case of 5G-RG) to provide the fresh/new non-3GPP access key (Ktngf*/Kn3iwf*/Ktwif*/Kwagf*) to the target 3GPP access node (i.e., target TNGF/N3IWF/WLAN-AP/ W-5GAN) and to indicate the UE about the required non-3GPP access key refresh/re-keying to make the UE/N5CW device/5G-RG device to derive the same keys as network to re-establish the security connection over the target non-3GPP access network.
  • target 3GPP access node i.e., target TNGF/N3IWF/WLAN-AP/ W-5GAN
  • Figure 4a illustrates a signalling diagram, indicated generally by reference numeral 400, for untrusted non-3GPP access authentication, according to one or more embodiments.
  • the signalling diagram 400 comprises a UE 410, a trusted non-3GPP access network (TN AN) 420, an AMF 440 and an AUSF 450.
  • the TN AN 420 comprises a trusted non-3GPP access point (TNAP) 422 and a trusted non-3GPP gateway function (TNGF) 424.
  • the signalling diagram 400 illustrates a first part of a process which may be performed when a UE 410 disconnects from a first TNGF 424 and reconnects to the first TNGF 424.
  • the signalling diagram 400 illustrates a first part of a process that may be performed when the UE 410 disconnects from a first TNGF 424 and connects to a second TNGF 424.
  • the signalling diagram 400 describes how the UE security context available in UE 410/AMF 440 can be used to re-key/refresh the non-3GPP access network connection during UE mobility registration (mobility registration update) scenario without performing primary full authentication.
  • the signalling diagram 400 describes how the UE 410 is notified about the non-3GPP access network rekey ing/refresh (happened at the network) to make the UE 410 to refresh/re-key the non-3GPP access keys similar to the network to reestablish security over the new target non-3GPP access network connection.
  • the signalling diagram 400 can be reused to re- key/refresh N3IWF keys between UE 410 and N3IWF, when the UE 410 on mobility connects to untrusted non-3GPP access network (i.e., new target AP and a new N3IWF).
  • untrusted non-3GPP access network i.e., new target AP and a new N3IWF.
  • the signalling diagram 400 illustrates N3IWF rekeying/refresh during UE mobility Scenario (Registration/authentication/PDU session establishment/modifi cation) for untrusted Non-3GPP Access.
  • the signalling diagram 400 comprises the following steps.
  • step 471 the UE 410 connects to an untrusted non-3GPP access network 420.
  • the UE 410 decides to attach to 5G Core (5GC) network
  • the UE 410 selects an N3IWF in a 5G public land mobile network (PLMN), as described in TS 23.501 V18.3.0 clause 6.3.6.
  • PLMN 5G public land mobile network
  • the UE 410 proceeds with the establishment of an IPsec Security Association (SA) with the selected N3IWF by initiating an IKE initial exchange according to RFC 7296. After step 472 all subsequent IKE messages are encrypted and integrity protected by using the IKE SA established in this step.
  • SA IPsec Security Association
  • UE 410 shall initiate an IKE AUTH exchange by sending an IKE AUTH request message.
  • the AUTH payload is not included in the IKE AUTH request message, which indicates that the IKE AUTH exchange shall use EAP signalling (in this case EAP-5G signalling).
  • EAP signalling in this case EAP-5G signalling.
  • the UE 410 shall set the ID type as ID KEY-ID in this message and set its value equal to any random number.
  • the UE 410 shall not use its GUH/SUCI/SUPI as the Id in this step. If the UE 410 is provisioned with the N3IWF root certificate, it shall include the CERTREQ payload within the IKE AUTH request message to request N3IWF’s certificate.
  • the N3IWF responds with an IKE AUTH response message which includes the N3IWF identity, the AUTH payload to protect the previous message it sent to the UE 410 (in the IKE SA INIT exchange) and an EAP-Request/5G- Start packet.
  • the EAP-Request/5G- Start packet informs the UE 410 to initiate an EAP-5G session, i.e. to start sending NAS messages encapsulated within EAP-5G packets. If the UE 410 has sent a CERTREQ payload in step 473, the N3IWF shall also include the CERT payload including N3IWF certificate.
  • the UE 410 shall validate the N3IWF certificate and shall confirm that the N3IWF identity matches the N3IWF selected by the UE 410. An absence of the certificate from the N3IWF if the UE 410 had requested the certificate or unsuccessful identity confirmation shall result in a connection failure.
  • the UE 410 shall send an IKE AUTH request which includes an EAP-Response/5G-NAS packet that contains a Registration Request message containing UE security capabilities, UE non-3GPP access key refresh capabilities and the SUCI.
  • the UE 410 shall integrity protect the Registration Request message and shall send the 5G-GUTI instead of SUCI.
  • the N3IWF shall refrain from sending an EAP-Identity request.
  • the UE 410 may ignore an EAP Identity request or respond with the SUCI it sent in the Registration Request. If the UE 410 has registered to the same AMF 440 through 3 GPP access, and if this is the first time that the UE 410 connects to the 5GC through non-3GPP access, the value of corresponding uplink non access stratum count (UL NAS COUNT) used for integrity protection is 0; else it can use the existing non-3GPP specific UL NAS COUNT for integrity protection.
  • UL NAS COUNT uplink non access stratum count
  • UE non-3GPP access key refresh capabilities indicate the UE 410 support for one or more the key-refresh (or re-key): TNGF key refresh, N3IWF key refresh etc.,
  • the N3IWF does not send an EAP-Identity request because the UE 410 includes its identity in the IKE AUTH request in message 5. This is in line with RFC 7296, clause 3.16.
  • the N3IWF shall select an AMF 440 as specified in TS 23.501 V18.3.0, clause 6.5.3.
  • the N3IWF forwards the Registration Request received from the UE 410 to the AMF 440.
  • the Registration Request message containing UE security capabilities, UE non-3GPP access key refresh capabilities and the SUCI.
  • step 477a if the AMF 440 receives a 5G-GUTI and the Registration is integrity protected, it may use the security context to verify the integrity protection (including the integrity protection of UE security capabilities, UE non-3GPP access key refresh capabilities received in Registration Request message) as described in TS 23.501 V18.3.0, clause 6.4.6. If the UE 410 has registered to the same AMF 440 through 3GPP access, and if this is the first time that the AMF 440 receives UE’s NAS signalling through non-3GPP access, the value of corresponding UL NAS COUNT used for integrity verification is 0; else it can use the existing non-3GPP specific UL NAS COUNT for integrity verification.
  • the integrity protection including the integrity protection of UE security capabilities, UE non-3GPP access key refresh capabilities received in Registration Request message
  • step 478 to step 481 may be skipped. If integrity is verified successfully and a newer security context has been activated over the 3 GPP access then authentication may be skipped but the AMF 440 shall activate the newer context with a NAS SMC procedure as described in step 478 and onwards. Otherwise, the AMF 440 may authenticate the UE 410. [0136] If the AMF 440 decides to authenticate the UE 410, it shall use one of the methods from TS 23.501 V18.3.0 clause 6.1.3.
  • the AMF 440 shall send a key request to the AUSF 450.
  • the AUSF 450 may initiate an authentication procedure as specified in TS 23.501 V18.3.0, clause 6.1.3.
  • the authentication packets are encapsulated within NAS authentication messages and the NAS authentication messages are carried in N2 signalling between the AMF 440 and N3IWF, and then are encapsulated within EAP-5G/5G-NAS packets between the N3IWF and the UE 410.
  • the AUSF 450 shall send the anchor key ksEAF derived from kAusF to the SEAF.
  • the SEAF shall derive the k wn from ksEAF and send it to the AMF 440 which is used by the AMF 440 to derive NAS security keys.
  • EAP-AKA' is used for authentication as described in TS 23.501 V18.3.0, clause 6.1.3.1, then the AUSF 450 shall include the EAP-Success.
  • the UE 410 also derives the anchor key ksEAF and from that key it derives the kA F followed by NAS security keys.
  • the NAS COUNTs associated with NAS connection identifier "0x02" are set at the UE 410 and AMF 440.
  • step 477b alternatively, if UE 410 non-3GPP access key refresh capabilities are indicated/provided by the UE 410, the AMF 440 may determine to skip primary full authentication based on local policy and performs the following to re-key/refresh Non- 3 GPP access network keys:
  • the AMF 440 based on 5G-GUTI fetches the UE context and latest k wn and derives a fresh N3IWF key, kN3iwF.
  • a fresh N3IWF key is derived using the following inputs but the access type distinguisher can use value related to the ‘N3IWF refresh/rekey’.
  • a ‘N3IWF refresh/rekey’ process is as follows.
  • Freshness parameter (e.g., A Count/random number/Nonce)
  • P2 and L2 may be used in additional inputs for ‘N3IWF refresh/rekey’.
  • Figure 5 is a table, indicated generally by reference numeral 500, of access type distinguishers and values, according to one or more embodiments.
  • the value of a “3GPP access” access type distinguisher is 0x01. In some embodiments, the value of a “non-3GPP access” access type distinguisher is 0x02. In some embodiments, the value of a “non-3GPP access key refresh/rekey” access type distinguisher is 0x03. In some embodiments, the value of a “N3IWF refresh/rekey” access type distinguisher is 0x03 or 0x04. In some embodiments, the value of a “TNGF refresh/rekey” access type distinguisher is 0x03 or 0x05. In some embodiments, the value of a “WAGF refresh/rekey” access type distinguisher is 0x03 or 0x05. In some embodiments, the value of a “TWIF refresh/rekey” access type distinguisher is 0x03 or 0x07.
  • the access type distinguisher shall be set to the value for 3 GPP (0x01) when deriving k g NB.
  • the access type distinguisher shall be set (initially) to the value for non- 3GPP (0x02) when deriving kwuwr, kwAGF, krwiF
  • the input key KEY shall be the 256-bit kwa.
  • This function is applied when cryptographically protected 5G radio bearers are established and when a key change on-the-fly is performed.
  • the AMF 440 may send a Security Mode Command (SMC) to the UE 410 in order to activate NAS security associated with NAS connection identifier “0x02”. This message is first sent to N3IWF (within an N2 message). If EAP-AKA’ is used for authentication, the AMF 440 shall encapsulate the EAP-Success received from AUSF 450 within the SMC message.
  • SMC Security Mode Command
  • the AMF 450 may indicate (in this step or in a later step 482) N3IWF key refresh indication/non-3GPP access key refresh indication, freshness parameter (if used in N3IWF key refresh) in this message to inform/notify the UE 410 to perform N3IWF key refresh (same as the network) to reestablish the security for the new 3GPP-access network (through which the UE 410 connects to the network).
  • the N3IWF shall forward the NAS SMC to UE 410 within an EAP- Request/5G-NAS packet (along with the N3IWF key refresh indication/non-3GPP access key refresh indication, freshness parameter if received from AMF 440 in step 478).
  • step 480 the UE 410 completes the authentication (if initiated in step 477) and creates a NAS security context or alternatively activates another one based on the received ngKSI in the NAS SMC.
  • the UE 410 shall respond to the NAS SMC it received from the AMF 440 based on the selected algorithms and parameters as described in TS 23.501 V18.3.0, clause 6.7.2.
  • the UE 410 shall encapsulate the NAS SMC Complete in the EAP-5G Response.
  • Figure 4b illustrates a signalling diagram, indicated generally by reference numeral 405, for untrusted non-3GPP access authentication, according to one or more embodiments.
  • the signalling diagram 405 comprises a UE 410, a trusted non-3GPP access network (TN AN) 420, an AMF 440 and an AUSF 450.
  • the TN AN 420 comprises a trusted non-3GPP access point (TNAP) 422 and a trusted non-3GPP gateway function (TNGF) 424.
  • the signalling diagram 405 illustrates a process that follows on from the first part of the process illustrated in signalling diagram 400 in Figure 4a.
  • the signalling diagram 405 illustrates a second part of a process which may be performed when a UE 410 disconnects from a first TNGF 424 and reconnects to the first TNGF 424.
  • the signalling diagram 405 illustrates a first part of a process that may be performed when the UE 410 disconnects from a first TNGF 424 and connects to a second TNGF 424.
  • the signalling diagram 405 comprises the following steps.
  • step 481 the N3IWF shall forward the NAS packet containing NAS SMC Complete to the AMF 440 over the N2 interface.
  • step 482 the AMF 440 upon reception of the NAS SMC Complete from the UE 410 or upon success of integrity protection verification, initiates the NGAP procedure to set up the AN context.
  • AMF 440 shall compute the fresh N3IWF key (if not done in step 477b), kN3iwF (kN3iwF* for the UE 410 mobility case), using the uplink NAS COUNT associated with NAS connection identifier “0x02” or for mobility case with Non 3GPP access key refresh/rekey (or) N3IWF refresh/rekey identifier “0x03 or 0x04” (as defined in step 477b) for the establishment of the Ipsec SA between the UE 410 and the (new) N3IWF and shall include it in the NGAP Initial Context Setup Request sent to the N3IWF with N3IWF key refresh indication/non-3GPP access key refresh indication, freshness parameter (if used in N3IWF key refresh) in this
  • the N3IWF sends an EAP-Success/EAP-5G along with N3IWF key refresh indication/non-3GPP access key refresh indication, freshness parameter (if received in step 482) to the UE 410 upon reception of the NGAP Initial Context Setup Request containing the N3IWF key, k ⁇ 3i ⁇ vi; This completes the EAP-5G session and no further EAP-5G packets are exchanged. If the N3IWF does not receive the k ⁇ 3i ⁇ vi from AMF 440, the N3IWF shall respond with an EAP-Failure.
  • step 484 the UE 410 on receiving the N3IWF key refresh indication/non- 3GPP access key refresh indication, determines to perform the N3IWF key refresh similar to the network.
  • the UE 410 derives a fresh N3IWF key as described in ‘N3IWF refresh/rekey’ process (in step 477b) similar to the network.
  • the freshness parameter if received from the TNGF 424), it can also be used as an additional input to the fresh N3IWF key (kN3iwF*) derivation.
  • step 495a the Ipsec SA is established between the UE 410 and N3IWF by using the N3IWF key KN3IWF that was created in the UE 410 using the uplink NAS COUNT associated with NAS connection identifier “0x02” as defined in TS 33.501 VI 8.3.0 Annex A.9 and was received by N3IWF from the AMF 440 in step 482.
  • the Ipsec SA is established between the UE 410 and new N3IWF by using the fresh N3IWF key KN3IWF* that was created in the UE 410 using the uplink NAS COUNT associated with NAS connection identifier"
  • N3IWF refresh/rekey identifier “0x03 or 0x04” as defined in figure 5 and was received by N3IWF from the AMF 440 in step 482.
  • step 485b upon successful establishment of the Ipsec SA between the UE 410 and the N3IWF, the N3IWF shall send the NGAP Initial Context Setup Response message to the AMF 440 which includes 5G-GUTI, Non-3GPP access UE mobility switch successful indication and current AP Identifier (for latest UE location information).
  • step 484a the AMF 440 may determine whether the N3IWF is appropriate for the slice selected as defined in clause 4.12.2.2 of TS 23.502 VI 8.3.0. If it is compatible with the selected N3IWF, then proceed with step 485a-b (NAS registration accept case a). Otherwise, the AMF 440 shall proceed with alternative step 485a-b(NAS registration reject case b).
  • step 487a comprises: when NGAP Initial Context Setup Response for the UE 410 is received by the AMF 440, AMF 440 shall send the NAS Registration Accept message for the UE 410 over the N2 towards the N3IWF.
  • Step 487b comprises: upon receiving the NAS Registration Accept message from the AMF 440, the N3IWF shall forward it to the UE 410 over the established Ipsec SA. All further NAS messages between the UE 410 and the N3IWF shall be sent over the established Ipsec SA.
  • step 487a comprises: I AMF 440 may trigger the UE policy update procedure and update the UE policy as defined in step 485 and step 486 in clause 4.12.2.2 of TS 23.502 V18.3.0.
  • Step 487b comprises: the AMF 440 shall send a Registration Reject message via N3IWF to the UE 410 as defined in step 17 in clause 4.12.2.2 of TS 23.502V18.3.0.
  • the Registration Reject message is ciphered and integrity protected, and a new 5G-GUTI is provided to the UE 410.
  • the UE 410 shall decipher and verify the integrity of the Registration Reject message. If verification is successful, then the UE 410 proceeds with step 488 in clause 4.12.2.2 of TS 23.502 VI 8.3.0, and sends an integrity protected Registration request message to the AMF 440 via a new selected N3IWF.
  • Figure 6a illustrates a signalling diagram, indicated generally by reference numeral 600, for trusted non-3GPP access authentication, according to one or more embodiments.
  • the signalling diagram 600 comprises a UE 610, a trusted non-3GPP access network (TN AN) 620, an AMF 640 and an AUSF 650.
  • the TN AN 620 comprises a trusted non-3GPP access point (TNAP) 622 and a trusted non-3GPP gateway function (TNGF) 624.
  • TNAP trusted non-3GPP access point
  • TNGF trusted non-3GPP gateway function
  • the signalling diagram 600 illustrates a first part of a process which may be performed when a UE 610 disconnects from a first TNGF 624 and reconnects to the first TNGF 624.
  • the signalling diagram 600 illustrates a first part of a process that may be performed when the UE 610 disconnects from a first TNGF 624 and connects to a second TNGF 624.
  • the signalling diagram 600 illustrates TNGF 624 rekeying/refresh during UE mobility Scenario (Registration/authentication/PDU session establishment/modification) - Trusted Non-3GPP Access.
  • the authentication procedure in signalling diagram 600 shows the TNGF 624 rekeying/refresh aspects where the UE 610 during mobility is connecting to a trusted non-3GPP access network (i.e., new target TNAP 622 and a new TNGF 624).
  • a trusted non-3GPP access network i.e., new target TNAP 622 and a new TNGF 624.
  • the signalling diagram 600 comprises the following steps.
  • the UE 610 selects a PLMN and a TNAN 620 for connecting to this PLMN by using the Trusted Non-3GPP Access Network selection procedure specified in TS 23.501 V18.3.0, clause 6.3.12. During this procedure, the UE 610 discovers the PLMNs with which the TNAN 620 supports trusted connectivity (e.g., "5G connectivity").
  • trusted connectivity e.g., "5G connectivity"
  • step 671 a layer-2 connection is established between the UE 610 and the TNAP 622.
  • this step corresponds to an IEEE 802.11] Association.
  • this step corresponds to a PPP LCP negotiation. In other types of non-3GPP access (e.g. Ethernet), this step may not be required.
  • EAP messages shall be encapsulated into layer-2 packets, e.g. into IEEE 802.3/802. lx packets, into IEEE 802.11/802. lx packets, into PPP packets, etc.
  • the UE 610 provides a NAI that triggers the TNAP to send a AAA request to a TNGF. Between the TNAP and TNGF the EAP packets are encapsulated into AAA messages.
  • an EAP-5G procedure is executed as specified in TS 23.501 V18.3.0, clause 7.2.1 with the following modifications.
  • the EAP-5G packets shall not be encapsulated into IKEv2 packets.
  • the UE 610 shall also include a UE Id in the AN parameter, e.g. a 5G-GUH if available from a prior registration to the same PLMN.
  • the UE 610 shall includes Registration Request message containing UE security capabilities, UE non-3GPP access key refresh capabilities and the SUCI.
  • UE non-3GPP access key refresh capabilities indicate the UE 610 support for one or more the key-refresh (or re-key): TNGF key refresh, N3IWF key refresh etc.,
  • a krNGF as specified in clause TS 33.501 VI 8.3.0 Annex A.9 (equivalent to k ⁇ 3i ⁇ vi ) is created in the UE 610 and in the AMF 640 after the successful authentication (if performed).
  • the kr ⁇ ;i is transferred from the AMF 640 to TNGF 624 in step 680a (within the N2 Initial Context Setup Request).
  • the AMF 640 may determine to skip primary full authentication based on local policy and performs the following to re- key/refresh Non-3GPP access network keys:
  • the AMF 640 based on 5G-GUTI fetches the UE context and latest k.wn and derives a fresh TNGF key (krNGF*).
  • a fresh TNGF key is derived using the following inputs but the access type distinguisher can use value related to the ‘TNGF refresh/rekey’.
  • Uplink NAS COUNT - LO length of uplink NAS COUNT (i.e. 0x00 0x04)
  • Freshness parameter (e.g., A Count/random number/Nonce)
  • Figure 7 is a table, indicated generally by reference numeral 700, of access type distinguishers and values, according to one or more embodiments.
  • the value of a “3GPP access” access type distinguisher is 0x01. In some embodiments, the value of a “non-3GPP access” access type distinguisher is 0x02. In some embodiments, the value of a “non-3GPP access key refresh/rekey” access type distinguisher is 0x03. In some embodiments, the value of a “N3IWF refresh/rekey” access type distinguisher is 0x03 or 0x04. In some embodiments, the value of a “TNGF refresh/rekey” access type distinguisher is 0x03 or 0x05. In some embodiments, the value of a “WAGF refresh/rekey” access type distinguisher is 0x03 or 0x05. In some embodiments, the value of a “TWIF refresh/rekey” access type distinguisher is 0x03 or 0x07.
  • the access type distinguisher shall be set to the value for 3 GPP (0x01) when deriving k g NB.
  • the access type distinguisher shall be set (initially) to the value for non- 3GPP (0x02) when deriving kwuwr, kwAGF, krwiF
  • Figure 6b illustrates a signalling diagram for trusted non-3GPP access authentication, according to one or more embodiments.
  • the signalling diagram 605 comprises a UE 610, a trusted non-3GPP access network (TN AN) 620, an AMF 640 and an AUSF 650.
  • the TN AN 620 comprises a trusted non-3GPP access point (TNAP) 622 and a trusted non-3GPP gateway function (TNGF) 624.
  • TNAP trusted non-3GPP access point
  • TNGF trusted non-3GPP gateway function
  • the signalling diagram 605 illustrates a process that follows on from the first part of the process illustrated in signalling diagram 600 in Figure 6a.
  • the signalling diagram 605 illustrates a second part of a process which may be performed when a UE 610 disconnects from a first TNGF 624 and reconnects to the first TNGF 624.
  • the signalling diagram 605 illustrates a first part of a process that may be performed when the UE 610 disconnects from a first TNGF 624 and connects to a second TNGF 624.
  • the AMF 640 may indicate (in step 680a (SMC) as option 1 or in a later step 681a (N2 Initial Context Setup Request) TNGF key refresh indication/non-3GPP access key refresh indication, freshness parameter (if used in TNGF key refresh) in a N2 message to inform/notify the UE 610 (via TNGF 624) to perform TNGF key refresh (same as the network) to re-establish the security for the new 3GPP-access network (through which the UE 610 connects to the network).
  • SMC System Management Entity
  • the TNAP 622 is a trusted entity.
  • the TNGF 624 shall generate the kr ⁇ . ⁇ p as specified in TS 33.501 V18.3.0 Annex A.22 and transfers it from TNGF 624 to TNAP 622 in step 68 le. (within a AAA message).
  • the TNGF 624 may send along with the TNGF key refresh indication/non-3GPP access key refresh indication, freshness parameter (if received from AMF 640 in previous steps 680a/681a) in step 681b to inform/notify the UE 610 to perform TNGF key refresh (same as the network) to re-establish the security for the new 3GPP-access network (through which the UE connects to the network).
  • step 682b the UE 610 receives IP configuration from the TNAN, e.g. with DHCP.
  • the UE 610 shall initiate an IKE INIT exchange with the TNGF.
  • the UE has received the IP address of TNGF during the EAP-5G signalling in step 9b, subsequently, the UE shall initiate an IKE AUTH exchange and shall include the same UE Id (i.e. SUCI or 5G-GUTI) as in the UE Id provided in step 675.
  • the common KTIPSe is used for mutual authentication.
  • the key KTIPSec is derived as specified in TS 33.501 V18.3.0 Annex A.22.
  • NULL encryption is negotiated as specified in RFC 2410.
  • an IPsec SA is established between the UE 610 and TNGF 624 (i.e. a NWt connection) and it is used to transfer all subsequent NAS messages. This IPsec SA does not apply encryption but only apply integrity protection.
  • step 684a after the NWtp connection is successfully established, the TNGF 624 responds to AMF 640 with an N2 Initial Context Setup Response message which includes 5G-GUTI, Non-3GPP access UE mobility switch successful indication and current AP Identifier (for latest UE location information).
  • N2 Initial Context Setup Response message which includes 5G-GUTI, Non-3GPP access UE mobility switch successful indication and current AP Identifier (for latest UE location information).
  • the AMF 640 may determine whether the TNGF 624 is appropriate for the slice selected as defined in clause 4.12.2.2 of TS 23.502 VI 8.3.0. If it is compatible with the selected TNGF 624, then proceed with steps 685a-b (NAS registration accept case a). Otherwise, the AMF 640 shall proceed with alternative step 685 a-b (NAS registration reject case b).
  • the AMF 640 If the AMF 640 accepts the registration and if the AMF 640 received Non-3GPP access UE mobility switch successful indication and current AP Identifier (for latest UE location information) in step 684b, then the AMF 640 stores the received information as part of the UE context.
  • the UE 610 initiates a PDU session establishment. This is carried out exactly as specified in TS 23.502 V18.3.0 clause 4.12a.5.
  • the TNGF 624 may establish one or more IPSec child SA’s per PDU session.
  • User plane data for the established PDU session is transported between the UE 610 and TNGF 624 inside the established IPSec child SA.
  • NAS registration reject Case b In steps 685a-b, the AMF 640 may trigger the UE policy update procedure and update the UE policy as defined in step 687 and step 688 in clause 4.12a.2.2 of TS 23.502 V18.3.0.
  • the AMF 640 shall send a Registration Reject message via TNGF 624 to the UE 610 as defined in step 689 to step 691 in clause 4.12a.2.2 of TS 23.502 V18.3.0.
  • the Registration Reject message is ciphered and integrity protected, and a new 5G-GUTI is provided to the UE 610.
  • the UE 610 shall decipher and verify the integrity of the Registration Reject message. If verification is successful, then the UE 610 proceeds with step 691 in clause 4.12.2.2 of TS 23.502 VI 8.3.0, and sends an integrity protected Registration request message to the AMF 610 via a new selected TNGF 624.
  • N5CW devices do not support NAS over non-3GPP access
  • the Uplink NAS COUNT shall be set to 0 for krwiF key generation, see clause 7A.2.4.
  • the AUN3 devices do not support NAS over non-3GPP access
  • the Uplink NAS COUNT shall be set to 0 for WAGF key generation, see clause 7B.7.3.
  • Figure 8a illustrates a signalling diagram, indicated generally by reference numeral 800, for trusted non-3GPP access authentication, according to one or more embodiments.
  • the signalling diagram 800 comprises a Non-5G-Capable over WLAN (N5CW) device 810, a trusted WLAN access network 820, an AMF/SEAF 840, an AUSF 850 and a Unified Data Management (UDM) 860.
  • the trusted WLAN access network 820 comprises a trusted WLAN access point 822 and a Trusted WLAN Interworking Function (TWIF) 824.
  • the signalling diagram 800 illustrates a first part of a process which may be performed when a N5CW device 810 disconnects from a first TWIF 824 and reconnects to the first TWIF 824.
  • the signalling diagram 800 illustrates a first part of a process that may be performed when the N5CW device 810 disconnects from a first TWIF 824 and connects to a second TWIF 824.
  • the signalling diagram 800 illustrates TWIF 824 rekeying/refresh during UE mobility Scenario (Registration/authentication/PDU session establishment/modification) - Trusted Non-3GPP Access.
  • the N5CW device 810 may be a device that does not support 5GC NAS over WLAN.
  • the signalling diagram 800 illustrates N5CW device 810 mobility with trusted Non-3GPP access.
  • the N5CW device 810 is capable to register to 5GC with 3GPP credentials and to establish 5GC connectivity via the trusted WLAN access network 822.
  • the TWIF 824 provides interworking functionality that enables connectivity with 5GC and implements the NAS protocol stack and exchanges NAS messages with the AMF/SEAF 840 on behalf of the N5CW device 810.
  • signalling diagram 800 illustrates a process for TWIF key refresh during (re-) authentication for devices that do not support 5GC NAS over WLAN access.
  • signalling diagram 800 comprises the following steps.
  • the N5CW device 810 selects a PLMN and a trusted WLAN that supports "5G connectivity- without-NAS" to this PLMN.
  • the N5CW device 810 shall provide its Network Access Identity (NAI).
  • NAI Network Access Identity
  • the Trusted WLAN Access Point (TWAP) 822 selects a Trusted WLAN Interworking Function (TWIF) 824, e.g. based on the received realm, and sends an AAA request to the selected TWIF 824.
  • TWAP Trusted WLAN Access Point
  • TWIF Trusted WLAN Interworking Function
  • the NAI shall include the SUCI.
  • the SUCI shall be constructed as specified in clause 6.12.2.
  • the NAI includes the 5G-GUTI assigned to the N5CW device 810 over 3GPP access. This enables the TWIF 824 in step 874a below to select the same AMF 840 as the one serving the N5CW device 810 over 3GPP access.
  • the NAI includes the 5G-GUTI assigned to the N5CW device 810 over 3GPP access. This enables the TWIF 824 in step 874a below to select the same AMF 840 as the one serving the N5CW device 810 over 3GPP access.
  • UE non-3GPP access key refresh capabilities indicate the UE support for one or more the key-refresh (or re-key): TNGF key refresh, N3IWF key refresh, TWIF key refresh, etc.,
  • the TWIF 824 shall create a 5GC Registration Request message on behalf of the N5CW device 810.
  • the TWIF 824 shall use default values to populate the parameters in the Registration Request message, which are the same for all N5CW device that do not support 5G NAS and additionally it includes UE non-3GPP access key refresh capabilities (if provided by the UE).
  • the Registration type indicates "Initial Registration” or "Registration Mobility Update”.
  • TWIF 824 shall select an AMF 840 (e.g. by using the 5G- GUTI in the NAI, if provided by the N5CW device 810) and shall send an N2 message to the AMF 840 including the Registration Request, the User Location, UE non-3GPP access key refresh capabilities, and an AN Type.
  • the AMF 840 may run primary authentication for the UE 810 by interacting with AUSF 850 and UDM 860. Even if the AMF 840 already has a security context identified by 5G-GUTI, the AMF 840 may initiate the primary authentication.
  • step 875 and 876 are skipped.
  • the AMF 840 may determine to skip primary full authentication based on local policy and performs the following to re- key/refresh Non-3GPP access network keys:
  • the AMF 840 based on 5G-GUTI fetches the UE context and latest k.wn and derives a fresh TWIF key (krwiF*).
  • a fresh TWIF key is derived using the following inputs but the access type distinguisher can use value related to the ‘TWIF refresh/rekey’.
  • the ‘TWIF refresh/rekey’ process comprises the following.
  • Freshness parameter (e.g., A Count/random number/Nonce)
  • P2 and L2 should be used in additional inputs for ‘TWIF refresh/rekey’ as using of NAS Count ‘0’ as default value for N5CW devices cannot guarantee uniqueness/freshness.
  • Figure 9 is a table, indicated generally by reference numeral 900, of access type distinguishers and values, according to one or more embodiments.
  • the value of a “3GPP access” access type distinguisher is 0x01. In some embodiments, the value of a “non-3GPP access” access type distinguisher is 0x02. In some embodiments, the value of a “non-3GPP access key refresh/rekey” access type distinguisher is 0x03. In some embodiments, the value of a “N3IWF refresh/rekey” access type distinguisher is 0x03 or 0x04. In some embodiments, the value of a “TNGF refresh/rekey” access type distinguisher is 0x03 or 0x05. In some embodiments, the value of a “WAGF refresh/rekey” access type distinguisher is 0x03 or 0x05.
  • the value of a “TWIF refresh/rekey” access type distinguisher is 0x03 or 0x07.
  • the values 0x00 and 0x03 to OxfO are reserved for future use, and the values Oxfl to Oxff are reserved for private use.
  • the access type distinguisher shall be set to the value for 3 GPP (0x01) when deriving k g NB.
  • the access type distinguisher shall be set (initially) to the value for non- 3GPP (0x02) when deriving kwuwi; kwAGF, krwiF or I ⁇ T ⁇ GL .
  • the input key KEY shall be the 256-bit kAMF.
  • This function is applied when cryptographically protected 5G radio bearers are established and when a key change on-the-fly is performed.
  • the AMF 840 may indicate (in step 880a (SMC) as option 1 or in a later step 881a (N2 Initial Context Setup Request) TNGF key refresh indication/non-3GPP access key refresh indication, freshness parameter (if used in TNGF key refresh) in a N2 message to inform/notify the UE (via TNGF) to perform TNGF key refresh (same as the network) to re-establish the security for the new 3GPP-access network (through which the UE connects to the network).
  • SMC System Management Entity
  • step 876 the NAS security between AMF 840 and TWIF 824 is established similar to unauthenticated emergency calls, i.e., with NULL encryption and NULL integrity protection.
  • N5CW devices does not support NAS; therefore, using the NAS counter is not possible in N5CW devices.
  • step 877 the AMF 840 shall send NAS Security Mode Command to the TWIF 824.
  • the NAS Security Mode Command shall contain the EAP-Success message, and the NULL security algorithms.
  • Figure 8b illustrates a signalling diagram, indicated generally by reference numeral 805, for trusted non-3GPP access authentication, according to one or more embodiments.
  • the signalling diagram 805 comprises a Non-5G-Capable over WLAN (N5CW) device 810, a trusted WLAN access network 820, an AMF/SEAF 840, an AUSF 850 and a Unified Data Management (UDM) 860.
  • the trusted WLAN access network 820 comprises a trusted WLAN access point 822 and a Trusted WLAN Interworking Function (TWIF) 824.
  • the signalling diagram 805 illustrates a process that follows on from the first part of the process illustrated in signalling diagram 800 in Figure 8a.
  • the signalling diagram 805 illustrates a second part of a process which may be performed when a N5CW device 810 disconnects from a first TWIF 824 and reconnects to the first TWIF 824.
  • the signalling diagram 800 illustrates a second part of a process that may be performed when the N5CW device 810 disconnects from a first TWIF 824 and connects to a second TWIF 824.
  • the signalling diagram 805 comprises the following steps.
  • the TWIF 824 shall not forward the EAP-Success to the N5CW directly, instead, it shall store the EAP-Success message and wait for fresh krwiF.
  • step 878b the TWIF 824 shall send the NAS Security Mode Complete message to the AMF 840.
  • step 879 the AMF 840 sends an N2 Initial Context Setup Request and provides the fresh KTWIF key (KTWIF*), TNGF key refresh indication/non-3GPP access key refresh indication, freshness parameter (used in fresh TWIF generation) to TWIF 824.
  • KTWIF* fresh KTWIF key
  • TNGF key refresh indication/non-3GPP access key refresh indication freshness parameter (used in fresh TWIF generation)
  • the TWIF 824 shall derive a TNAP key, I ⁇ T ⁇ AI>, from the kiNGF key and send the TNAP key and the EAP-Success message along with TNGF key refresh indication/non-3GPP access key refresh indication, freshness parameter to the Trusted WLAN Access Point, which forwards the EAP-Success to the N5CW device 810.
  • the N5CW device 810 on receiving the TWIF key refresh indication/non-3GPP access key refresh indication, determines to perform the TWIF key refresh similar to the network.
  • the UE derives a fresh TWIF key as described in ‘TWIF refresh/rekey’ process_(above) similar to the network.
  • the freshness parameter (if received from the TWIF), it can also be used as an additional input to the fresh TWIF key (krwiF*) derivation.
  • the TNAP key (derived from fresh TWIF key) corresponds to the PMK (Pairwise Master Key) which is used to secure the WLAN airinterface communication according to IEEE 802.11.
  • a layer-2 or layer-3 connection is established between the Trusted WLAN Access Point 822 and the TWIF 824 for transporting all user-plane traffic of the N5CW device 810 to TWIF 824. This connection is later bound to an N3 connection that is created for this N5CW device 810.
  • the TWIF shall send N2 Initial Context Setup Response message to the AMF 840 which includes 5G-GUTI, Non-3GPP access UE/N5CW device 810 mobility switch successful indication and current AP Identifier (for latest N5CW location information).
  • the AMF 840 may determine whether the TNGF is appropriate for the slice selected as defined in clause 4.12.2.2 of TS 23.502 VI 8.3.0. If it is compatible with the selected TNGF, then proceed with steps (NAS registration accept case a).
  • the AMF 840 shall proceed with alternative steps (NAS registration reject case b).
  • the AMF 840 accepts the registration and if the AMF 840 received Non-3GPP access UE/ N5CW device 810 mobility switch successful indication and current AP Identifier (for latest UE location information) in step 884, then the AMF 840 stores the received information as part of the UE/ N5CW device 810 context.
  • Figure 10 illustrates a signalling diagram, indicated generally by reference numeral 1000, for non-3GPP access authentication, according to one or more embodiments.
  • the signalling diagram 1000 comprises a 5 th generation residential gateway (5G-RG) 1010, a wireline access gateway function 1020, an AMF 1040 and an AUSF 1050.
  • 5G-RG 5 th generation residential gateway
  • the signalling diagram 1000 illustrates a process which may be performed when a 5G-RG 1010 disconnects from a first W-AGF 1020 and reconnects to the first W-AGF 1020.
  • the signalling diagram 1000 illustrates a process that may be performed when the 5G-RG disconnects from a first W-AGF 1020 and connects to a second W-AGF 1020.
  • 5G-RG 1010 and FN-RG are introduced.
  • the 5G-RG 1010 acts as a 5GUE and can connect to 5GC via wireline access network (W-5GAN) or via Fixed Wireless Access (FWA).
  • W-5GAN wireline access network
  • FWA Fixed Wireless Access
  • the 5G-RG 1010 also acts as end point of N1 and provides the NAS signaling connection to the 5GC on behalf of the Authenticable Non-3GPP (AUN3) devices behind the 5G-RG 1010.
  • AUN3 Authenticable Non-3GPP
  • the FN-RG can connect to 5GC via wireline access network (W-5GAN).
  • W-5GAN wireline access network
  • the W-AGF 1020 performs the registration procedure on behalf of the FN-RG. It acts as end point of N1 and provides the NAS signalling connection to the 5GC on behalf of the FN- RG.
  • a 5G-capable UE can connect to 5GC through an RG that’s connected to the 5GC via wireline access network (W-5GAN) or NG-RAN.
  • the UE supports untrusted non- 3GPP access and/or trusted non-3GPP access.
  • 5G-RG 1010 is a UE from 5GC point of view
  • the authentication framework defined in 3GPP shall be used to authenticate the 5G-RG.
  • following procedural adaptations can be done as shown in Figure 10 to support rekeying/refresh of W-AGF key (kwAGF*).
  • the signalling diagram 1000 comprises the following steps.
  • step 1071 the 5G-RG 1010 establishes a wireline access control plane (W- CP) connection with a wireline 5G access network (W-5GAN).
  • W- CP wireline access control plane
  • W-5GAN wireline 5G access network
  • the 5G-RG 1010 shall send a message using W-CP protocol stack that contains a Registration message containing UE security capabilities, UE non-3GPP access key refresh capabilities and the SUCI.
  • the 5G-RG 1010 shall integrity protect the Registration Request message and shall send the 5G-GUTI instead of SUCI. If the 5G- RG 1010 has registered to the same AMF 1040 through next generation random access network (NG RAN), and if this is the first time that the 5G-RG 1010 connects to the 5GC through W-5GAN, the value of corresponding UL NAS COUNT used for integrity protection is 0; else it can use the existing non-3GPP specific UL NAS COUNT for integrity protection.
  • NG RAN next generation random access network
  • UE non-3GPP access key refresh capabilities indicate the UE support for one or more the key-refresh (or re-key): TNGF key refresh, N3IWF key refresh, TWIF key refresh, W-AGF key refresh etc.,
  • the 5G-RG 1010 can send W-AGF key refresh/rekeying. capability instead of UE non-3GPP access key refresh capabilities.
  • # UE non-3GPP access key refresh capabilities can be alternatively termed as
  • the non-3GPP specific security context is used to refer to the security context that 5G-RG 1010 is used through wireline access.
  • the W-AGF 1020 shall select an AMF 1040 as specified in TS 23.316.
  • the W-AGF 1020 shall then forward the Registration Request received from the UE to the selected AMF 1040 within an N2 initial UE message.
  • the AMF 1040 receives a 5G-GUTI and the Registration is integrity protected, it may use the security context to verify the integrity protection.
  • the AMF 1040 may determine to skip the primary authentication and determines to refresh/rekey the W-AGF key.
  • step 1077 the W-AGF 1020 shall forward the NAS packet containing NAS
  • step 1078 the AMF 1040 upon reception of the NAS SMC Complete from the UE (5G-RG 1010) or upon success of integrity protection verification, initiates the NGAP procedure to set up the AN context.
  • AMF 1040 shall compute the fresh W-AGF 1020 key, kwAGF* that is an equivalent to fresh key kviwi *, using the uplink NAS COUNT associated with NAS connection identifier "0x02" and/or using the addition input adaptations below.
  • the AMF 1040 based on 5G-GUTI fetches the UE context and latest k.wn and derives a fresh WAGF key (kwAGF*).
  • a fresh WAGF key is derived using the following inputs but the access type distinguisher can use value related to the ‘WAGF refresh/rekey’.
  • the ‘WAGF refresh/rekey’ process may involve the following.
  • - P2 Freshness parameter (e.g., A Count/random number/Nonce)
  • L2 length of Freshness parameter (i.e., 0x00 0x01)
  • P2 and L2 may be used in additional inputs for ‘WAGF refresh/rekey’.
  • Figure 11 is a table, indicated generally by reference numeral 1100, of access type distinguishers and values, according to one or more embodiments.
  • the value of a “3GPP access” access type distinguisher is 0x01. In some embodiments, the value of a “non-3GPP access” access type distinguisher is 0x02. In some embodiments, the value of a “non-3GPP access key refresh/rekey” access type distinguisher is 0x03. In some embodiments, the value of a “N3IWF refresh/rekey” access type distinguisher is 0x03 or 0x04. In some embodiments, the value of a “TNGF refresh/rekey” access type distinguisher is 0x03 or 0x05. In some embodiments, the value of a “WAGF refresh/rekey” access type distinguisher is 0x03 or 0x05. In some embodiments, the value of a “TWIF refresh/rekey” access type distinguisher is 0x03 or 0x07.
  • the access type distinguisher shall be set to the value for 3 GPP (0x01) when deriving k g NB.
  • the access type distinguisher shall be set (initially) to the value for non- 3GPP (0x02) when deriving k ⁇ 3i ⁇ vr, kwAGF, krwiF or I ⁇ T ⁇ GL .
  • the input key KEY shall be the 256-bit kAMF.
  • This function is applied when cryptographically protected 5G radio bearers are established and when a key change on-the-fly is performed.
  • the AMF 1040 upon receiving NAS Security Mode Complete, shall send an N2 Initial Context Setup Request message to the W-AGF 1020 with WAGF key refresh indication/non-3GPP access key refresh indication, freshness parameter (if used in WAGF key refresh) to re-establish the security for the wireline access to the network.
  • the message contains the fresh kwAGF.
  • the WAGF 1020 can forward the WAGF key refresh indication/non-3GPP access key refresh indication, freshness parameter (if used in WAGF key refresh) to the 5G-RG 1010.
  • step 1080 the 5G-RG 1010 device on receiving the WAGF key refresh indication/non-3GPP access key refresh indication, determines to perform the WAGF key refresh similar to the network.
  • the 5G-RGUE 1080 derives a fresh WAGF key as described in ‘WAGF refresh/rekey’ process (above) similar to the network.
  • the freshness parameter if received, it can also be used as an additional input to the fresh WAGF key (kwAGF*) derivation.
  • step 1081 secure Connection between 5G-RG 1010 established using the fresh WAGF key.
  • the W-AGF 1020 sends to the AMF 1040 a N2 Initial context response message which includes 5G-GUTI, Non-3GPP access UE/5G-RG 1010 device mobility switch successful indication and current AP Identifier (for latest 5G-RG location information).
  • the AMF 1040 stores the received current AP Identifier (for latest 5G-RG 1010 location information) as part of the UE context along with 5G-GUTI.
  • the W-AGF 1020 Upon receiving the NAS Registration Accept message from the AMF 1040, the W-AGF 1020 shall forward it to the 5G-RG 1010 over the established W-CP. All further NAS messages between the UE 1010 and the W-AGF 1020 shall be sent over the established W-CP.
  • FN RG is involved instead of 5G-RG 1010, the above procedure may be reused for mobility scenario if, a primary authentication is executed during the initial registration, else, it may not be feasible.
  • Figure 12a illustrates a signalling diagram, indicated generally by reference numeral 1200, for trusted non-3GPP access authentication, according to one or more embodiments.
  • the signalling diagram 1200 comprises a user equipment (UE) 1210, a trusted non-3GPP access network 1220 and an AMF 1240.
  • the trusted non-3GPP access network 1220 comprises a first trusted non-3GPP access point (TNAP 1) 1222, a second trusted non-3GPP access point (TNAP2) 1223 and a trusted non-3GPP gateway function (TNGF) 1223.
  • TNAP 1 trusted non-3GPP access point
  • TNAP2 second trusted non-3GPP access point
  • TNGF trusted non-3GPP gateway function
  • the signalling diagram 1200 describes how a non-3GPP access key (TNGF key in case of trusted non-3gpp access / N3IWF key in case of untrusted non-3gpp access) can be fetched from the AMF (which manages the UE security context) during the UE mobility scenario.
  • a non-3GPP access key TNGF key in case of trusted non-3gpp access / N3IWF key in case of untrusted non-3gpp access
  • AMF which manages the UE security context
  • the signalling diagram 1200 comprises the following steps.
  • step 1271 the UE 1210 established a layer-2 (L2) connection with TNAP2 1223.
  • L2 layer-2
  • TNAP 2 (in new mobility domain/belonging to a different TNGF) initiates an EAP session as usually by requesting the UE identity.
  • NAI Network Access Identifier
  • the Reauth-ID and the TNGF-ID was received when the UE 1219 was first connected to TNGF 1224, e.g. with an Initial Registration via TNGF 1224.
  • the UE 1210 context (e.g., TNGF key, UE ID) was created/provided in the TNGF 1224 when the UE 1210 performed an initial registration via TNGF 1224.
  • UE non-3GPP access key refresh capabilities indicate the UE 1210 support for one or more the key-refresh (or re-key): TNGF key refresh, N3IWF key refresh, TWIF key refresh, W-AGF key refresh etc.
  • 5G-GUTI can be sent as NAI and Re-auth ID (may include TNGF ID, MCC, MNC).
  • the UE 1210 can provide the received Re-auth in step 1271.
  • the UE 1210 may send the UE non-3GPP access key refresh capabilities inside the Registration Request message in the NAS PDU in step 1273 and the TNAP2 1223 can then forward it to TNGF 1224 in step 1274 and the TNGF 1224 can forward that to AMF 1240 in step 1276a.
  • the TNAP1 1222 selects TNGF 1224 (based on the TNG1-ID, if it cannot find a TNGF 1224, then TNAP2 1223 can select a TNGF 1224 connected to it for eventually connecting to the 5G Core or 3 GPP system) in the received realm and forwards the NAI, 5G-GUTI and received UE non-3GPP access key refresh capabilities to TNGF 1224 in AAA.
  • the TNAP2 1223 also includes its TNAP ID to the TNGF 1224.
  • the TNGF 1224 finds that the UE 1210 cannot be identified with the received Reauth-ID and no UE context/security context exists for the UE 1210. Thus, it determines that it need to fetch the security context from the AMF 1240 based on the 5G- GUTI.
  • Figure 12b illustrates a signalling diagram, indicated generally by reference numeral 1205, for trusted non-3GPP access authentication, according to one or more embodiments.
  • the signalling diagram 1205 comprises a user equipment (UE) 1210, a trusted non-3GPP access network 1220 and an AMF 1240.
  • the trusted non-3GPP access network 1220 comprises a first trusted non-3GPP access point (TNAP 1) 1222, a second trusted non-3GPP access point (TNAP2) 1223 and a trusted non-3GPP gateway function (TNGF) 1223.
  • TNAP 1 trusted non-3GPP access point
  • TNAP2 second trusted non-3GPP access point
  • TNGF trusted non-3GPP gateway function
  • the signalling diagram 1205 illustrates a process that follows on from the first part of the process illustrated in signalling diagram 1200 in Figure 12a.
  • the signalling diagram 1205 illustrates a second part of a method to refresh non-3GPP access network key during a UE 1210 mobility security re-establishment procedure.
  • the signalling diagram 1205 comprises the following steps.
  • step 1276a based on 5G-GUTI selects the AMF 1240 and send a Key request message (in any N2 message) along with the 5G-GUTI and NAS PDU (containing registration request) is received from the UE 1210.
  • the AMF 1240 fetches the UE context (i.e., AMF key KAMF) based on the 5G-GUTI and derives a fresh TNGF key (e.g., kiNGF*) as follows.
  • the AMF 1240 may determine to skip primary full authentication based on local policy and performs the following to re- key/refresh Non-3GPP access network keys:
  • the AMF 1240 based on 5G-GUH fetches the UE context and latest k.wn and derives a fresh TNGF key (kiNGF*).
  • a fresh TNGF key is derived using the following inputs but the access type distinguisher can use value related to the ‘TNGF refresh/rekey’.
  • the ‘TNGF refresh/rekey’ process may comprise the following.
  • Uplink NAS COUNT - LO length of uplink NAS COUNT (i.e., 0x00 0x04)
  • Freshness parameter (e.g., A Count/random number/Nonce)
  • P2 and L2 may be used in additional inputs for ‘TNGF refresh/rekey’.
  • Figure 13 is a table, indicated generally by reference numeral 1300, of access type distinguishers and values, according to one or more embodiments.
  • the value of a “3GPP access” access type distinguisher is 0x01. In some embodiments, the value of a “non-3GPP access” access type distinguisher is 0x02. In some embodiments, the value of a “non-3GPP access key refresh/rekey” access type distinguisher is 0x03. In some embodiments, the value of a “N3IWF refresh/rekey” access type distinguisher is 0x03 or 0x04. In some embodiments, the value of a “TNGF refresh/rekey” access type distinguisher is 0x03 or 0x05. In some embodiments, the value of a “WAGF refresh/rekey” access type distinguisher is 0x03 or 0x05. In some embodiments, the value of a “TWIF refresh/rekey” access type distinguisher is 0x03 or 0x07.
  • the access type distinguisher shall be set to the value for 3 GPP (0x01) when deriving k g NB.
  • the access type distinguisher shall be set (initially) to the value for non- 3GPP (0x02) when deriving kwuwr, FWAGF, krwiF or I ⁇ T ⁇ GL .
  • the input key KEY shall be the 256-bit KAMF.
  • This function is applied when cryptographically protected 5G radio bearers are established and when a key change on-the-fly is performed.
  • AMF 1240 sends the N2 Initial context Setup request (or in any N2 message/ key response message), the fresh TNGF Key (KTNGF*) and may include TNGF key refresh indication (if TNGF key is refreshed at the AMF level), freshness parameter (if used for the KTNGF* generation).
  • the TNGF 1224 stores the received KTNGF*.
  • the TNGF 1224 may derive new Re-auth ID (which is outside the scope of this document), new TNAP key and store them.
  • the TNGF 1224 completes the EAP-5G session by sending an EAP-Success packet, TNGF key refresh indication, and freshness parameter to UE and the new TNAP key to TNAP2 1223.
  • step 1279 the UE 1210 on receiving the TNGF key refresh indication/non- 3GPP access key refresh indication, determines to perform the TNGF key refresh similar to the network.
  • the UE 1210 derives a fresh TNGF key as described in ‘TNGF refresh/rekey’ process (above) similar to the network.
  • the freshness parameter (if received from the TNGF 1224), it can also be used as an additional input to the fresh TNGF key (kr ⁇ Gi *) derivation. Further the UE 1210 derives the TNAP key from the new TNGF key.
  • step 1280a to 1280b the new TNAP key is applied to establish over-the-air security between the UE 1210 and TNAP2 1223. If needed, the UE 1210 may receive new IP configuration information (e.g., a new IP address)
  • new IP configuration information e.g., a new IP address
  • step 1281 the UE 1210 resumes communication with new TNGF 1224 via TNAP2 1223.
  • the TNGF 1224 sends a N2 initial context setup update/response message (or in any N2 message sends information to update AMF 1240 with the UE 1210 current location information) with UE ID (e.g., 5G-GUTI) and current new TNAP identifier.
  • UE ID e.g., 5G-GUTI
  • the AMF 1240 updates the UE location information/UE Context) with the currently serving TNAP Identifier.
  • the AMF 1240 sends to TNGF 1224 a N2 Initial Context Setup Update Acknowledgement/Response message (in any N2 message) with Success/acknowledgment indication.
  • N2 Initial Context Setup Update Acknowledgement/Response message
  • the above step description can replace all TNGF key with TWIF key to be applied for N5CW device (with 3GPP credentials but without NAS) mobility to trusted non-3GPP access scenario.
  • the above step description can replace all TNGF key with W-AGF key to be applied for 5G-RG mobility to wireline access scenario.
  • a user equipment for wireless communication, the UE comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the UE to: establish a first secure connection with an access and mobility management function, AMF, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, k wn; send, to the AMF over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the AMF via a second non-3GPP access network, wherein the second key is derived using the kA F; receive, from the AMF, a second message, wherein the second message indicates a request for the UE to derive the second key; and derive the second key from the kAMF in response to the second message.
  • AMF access and mobility management function
  • Such a user equipment enables the access and mobility management function to instruct the user equipment to derive the second key for establishing a second secure connection with the AMF via a second non-3GPP access network.
  • Such an arrangement has the advantage that during user equipment mobility registration involving a change in the non-3GPP access network or user equipment mobility security re-establishment, the AMF does not need to perform an additional full primary authentication run. This tends to reduce signalling overhead between the user equipment and the mobile communication network. This tends to reduce delays in a connection being established between the user equipment and the mobile communication network.
  • the user equipment may be a remote unit.
  • the user equipment may be a remote device.
  • the user equipment may be a wireless communication device.
  • the user equipment may be a mobile device.
  • the user equipment may be a cell phone.
  • the user equipment may be a Non-5G-Capable over wireless local area network, WLAN, N5CW, device.
  • the user equipment may be a 5G residential gateway, 5G-RG, device.
  • the user equipment may be a fixed network residential gateway, FN-RG, device.
  • the access and mobility management function may be part of a mobile communication network.
  • the mobile communication network may be a 3 GPP mobile communication network.
  • the 3 GPP mobile communication network defined by a 3 GPP standard.
  • the mobile communication network may be a 5G network.
  • the mobile communication network may further comprise an authentication server function, AUSF.
  • the first non-3GPP access network may be any type of access network that is not based on 3rd Generation Partnership Project, 3GPP, standards or protocols.
  • the first non-3GPP access network may be a wireless fidelity, Wi-Fi, access network.
  • the first non- 3 GPP access network may be a fixed line network.
  • the first non-3GPP access network may be a satellite network.
  • the first non-3GPP access network may be a Bluetooth network.
  • the first non-3GPP access network may be an ethernet local area network.
  • the user equipment may connect to the first non-3GPP access network.
  • the user equipment may establish a secure connection with the first non-3GPP access network.
  • the user equipment may select a first non-3GPP interworking function, N3IWF.
  • the first N3IWF may facilitate interworking and communication between the mobile communications network and the first non-3GPP access network.
  • the first non-3GPP interworking function may be part of a 5th Generation, 5G, network (e.g., a 5G public land mobile network, PLMN).
  • the first N3IWF may facilitate interworking and communication between the 5G network and the first non-3GPP access network.
  • the first non-3GPP access network may comprise a first non-3GPP access point.
  • the first non-3GPP access network may comprise a first non-3GPP gateway function.
  • the first non-3GPP access network may be a first trusted non-3GPP access network, TN AN.
  • the first TN AN may comprise a first trusted non-3GPP access point, TNAP.
  • the first TNAN may comprise a first trusted non-3GPP gateway function, TNGF.
  • the first non-3GPP access network may be a first untrusted non-3GPP access network.
  • the first untrusted non-3GPP access network may comprise a first untrusted non-3GPP access point.
  • the first untrusted non-3GPP access network may comprise a first untrusted non- 3 GPP gateway function.
  • the first secure connection may be an internet protocol security, IPsec, security association, SA.
  • the first secure connection may comprise an internet protocol security, IPsec, security association, SA between the user equipment and the first non-3GPP access network.
  • the first key may be a first trusted non-3GPP gateway function, TNGF, key, kiNGF.
  • the first key may be a first non-3GPP access interworking function, N3IWF, key.
  • the first key may be a first trusted wireless local area network, WLAN, interworking function, TWIF, key.
  • the first key may be a first wireline access gateway function, W- AGF, key.
  • the AMF key, kAMF may be a 256-bit AMF key, kAMF.
  • the UE may have access to the AMF key, kAMF.
  • the UE may be provided with the AMF key, kA F.
  • the UE may derive the AMF key, kAMF.
  • the AMF may have access to the AMF key, kAMF.
  • the AMF may derive the AMF key, kAMF.
  • the AMF may be provided with the AMF key, kAMF.
  • the AMF may be provided with the AMF key, kAMF, from a security anchor function SEAF by deriving from a security anchor function key, KSEAF received from an authentication server function, AUSF.
  • the AMF may derive the first key from the AMF key, k.
  • the AMF may send the first key to the first non-3GPP access network.
  • the AMF may derive the second key from the AMF key, k.
  • the AMF may send the second key to the first non-3GPP access network.
  • the first message may be a registration request message.
  • the first message may be a registration update request message.
  • the first message may be a mobility registration update request message.
  • the second key may be different to the first key.
  • the second key may be a refresh of the first key.
  • the second key may be a rekey of the first key.
  • the second key may be derived from the same AMF key, kAMF as the first key.
  • the derivation of the second key may comprise the same process as the derivation of the first key.
  • the second key may be a second trusted non-3GPP gateway function, TNGF, key, kiNGF.
  • the second key may be a second non-3GPP access interworking function, N3IWF, key.
  • the second key may be a second trusted wireless local area network, WLAN, interworking function, TWIF, key.
  • the second key may be a second wireline access gateway function, W-AGF, key.
  • the second non-3GPP access network may be any type of access network that is not based on 3rd Generation Partnership Project, 3GPP, standards or protocols.
  • the second non-3GPP access network may be a wireless fidelity, Wi-Fi, access network.
  • the second non-3GPP access network may be a fixed line network.
  • the second non-3GPP access network may be a satellite network.
  • the second non-3GPP access network may be a Bluetooth network.
  • the second non-3GPP access network may be an ethernet local area network.
  • the user equipment may connect to the second non-3GPP access network.
  • the user equipment may establish a secure connection with the second non-3GPP access network.
  • the user equipment may select a second non-3GPP interworking function, N3IWF.
  • the second N3IWF may be the same as the first N3IWF.
  • the second non-3GPP interworking function may be part of the mobile communications network.
  • the second N3IWF may facilitate interworking and communication between the mobile communications network and the second non-3GPP access network.
  • the second non-3GPP interworking function may be part of a 5th Generation, 5G, network (e.g., a 5G public land mobile network, PLMN).
  • 5G 5th Generation
  • PLMN public land mobile network
  • the second N3IWF may facilitate interworking and communication between the 5G network and the second non-3GPP access network.
  • the second non-3GPP access network may be the same as the first non-3GPP access network.
  • the second non-3GPP access network may be different to the first non- 3 GPP access network.
  • the second non-3GPP access network may comprise a second non-3GPP access point.
  • the second non-3GPP access network may comprise a second non-3GPP gateway function.
  • the second non-3GPP access network may be a second trusted non-3GPP access network, TN AN.
  • the second TN AN may comprise a second trusted non-3GPP access point, TNAP.
  • the second TN AN may comprise a second trusted non-3GPP gateway function, TNGF.
  • the second non-3GPP access network may be a second untrusted non- 3GPP access network.
  • the second untrusted non-3GPP access network may comprise a second untrusted non-3GPP access point.
  • the second untrusted non-3GPP access network may comprise a second untrusted non-3GPP gateway function.
  • the second secure connection may be an internet protocol security, IPsec, security association, SA.
  • the second secure connection may comprise an internet protocol security, IPsec, security association, SA between the user equipment and the second non- 3 GPP access network.
  • the second message may have been sent to the user equipment from the AMF via the first non-3GPP access network.
  • the second message may have been sent to the user equipment from the AMF via the second non-3GPP access network.
  • the second message may comprise information from a next generation application protocol, NGAP, Initial Context Setup Request message.
  • the next generation application protocol, NGAP, Initial Context Setup Request message may have been sent to the first non-3GPP access network from the AMF.
  • the next generation application protocol, NGAP, Initial Context Setup Request message may have been sent to the second non-3GPP access network from the AMF.
  • the at least one processor coupled with the at least one memory is further configured to cause the UE to: establish the second secure connection with the AMF via the second non-3GPP access network using the second key.
  • the second non- 3GPP access network may send a next generation application protocol NGAP Initial Context Setup Response message to the AMF.
  • the second non-3GPP access network comprises one or more of: a trusted non-3GPP gateway function, TNGF; a non-3GPP access interworking function, N3IWF; a trusted wireless local area network, WLAN, interworking function, TWIF; or a wireline access gateway function, W-AGF.
  • the second key is one of: a TNGF key; a N3IWF key; a TWIF key; or a W-AGF key.
  • the second key may be a trusted non-3GPP gateway function key, L NGF, for a trusted non-3GPP gateway function in the second non-3GPP access network.
  • the second key may be a non-3GPP interworking function key, kxsiwF, for a non-3GPP interworking function in the second non-3GPP access network.
  • the second key may be a trusted wireless local area network, WLAN, interworking function key, krwiF, for a trusted wireless local area network, WLAN, interworking function in the second non-3GPP access network.
  • the second key may be a wireline access gateway function key, kwAGF, for a wireline access gateway function in the second non-3GPP access network.
  • the at least one processor coupled with the at least one memory is further configured to cause the UE to: derive the second key using one or more of: an uplink non access stratum, NAS, count, a length of the uplink NAS count, an access type distinguisher, or a length of the access type distinguisher.
  • the uplink, UL, non access stratum, NAS, count may depend on whether the user equipment has registered to the same AMF through 3 GPP access.
  • the value of the uplink, UL, non access stratum, NAS, count may be for integrity protection.
  • the value of the uplink, UL, non access stratum, NAS, count may be zero the first time that the UE connects to the 5GC through non-3GPP access.
  • the value of the uplink, UL, non access stratum, NAS, count may be for integrity protection.
  • the value of the uplink, UL, non access stratum, NAS, count may be the existing non-3GPP specific UL NAS COUNT for integrity protection.
  • the length of the uplink, UL, NAS count may correspond to the number of bits of the uplink, UL, NAS count value.
  • the length of the uplink, UL, NAS count may be 0x00 0x04.
  • the value for the access type distinguisher may be predefined.
  • the value for the access type distinguisher may be 0x00 and 0x03 to OxfO; these values may be reserved for future use.
  • the value for the access type distinguisher may be Oxfl to Oxff; these values may be reserved for private use.
  • the value for the access type distinguisher may be 0x01 (the value for 3GPP) when deriving a gNodeB key, k g NB.
  • the value for the access type distinguisher may be (initially) 0x02 (to the value for non-3GPP) when deriving kviwi , kwAGF, krwiF or I ⁇ T ⁇ GL .
  • the value for the access type distinguisher may be 0x03 when the second key is a non-3GPP access key.
  • the value for the access type distinguisher may be 0x03 or 0x04 when the second key is a non-3GPP interworking function, N3IWF, key, k ⁇ 3i ⁇ vi .
  • the value for the access type distinguisher may be 0x03 or 0x05 when the second key is a trusted non-3GPP gateway function, TNGF, key, I ⁇ T ⁇ GL .
  • the value for the access type distinguisher may be 0x03 or 0x06 when the second key is a wireline access gateway function, WAGF key, kwAGF.
  • the value for the access type distinguisher may be 0x03 or 0x07 when the second key is a trusted wireless local area network, WLAN, interworking function, TWIF, key, krwiF.
  • the length of the access type distinguisher may correspond to the number of bits of the access type distinguisher.
  • the at least one processor coupled with the at least one memory is further configured to cause the UE to: derive the second key using a freshness parameter.
  • the freshness parameter may correspond to the number of times the AMF has derived a key from the kAMF.
  • the first key may be the first derivation of a key from the kAMF by the AMF.
  • the freshness parameter corresponding to the first key may be one.
  • the second key may be the second derivation of a key from the kAMF by the AMF.
  • the freshness parameter corresponding to the second key may be two.
  • the freshness parameter corresponding to the n th key may be n.
  • the at least one processor coupled with the at least one memory is further configured to cause the UE to: derive the second key using the length of the freshness parameter.
  • the length of the freshness parameter may correspond to the number of bits of the freshness parameter.
  • the length of the freshness parameter may be 0x00 0x01.
  • the freshness parameter is one of: a count, a counter, a random number, or a nonce.
  • the nonce may be an arbitrary number used only once.
  • the nonce may be a random number.
  • the nonce may be a pseudo-random number.
  • the freshness parameter is received by the UE from the AMF.
  • the freshness parameter may be received by the UE from the AMF via the first non-3GPP access network.
  • the freshness parameter may be received by the UE from the AMF via the second non-3GPP access network.
  • the first non-3GPP access network is different to the second non-3GPP access network.
  • the first non-3GPP access network may be a physically different entity to the second non-3GPP access network.
  • the first non-3GPP access network may comprise physically different components to the second non-3GPP access network.
  • the first non- 3 GPP access network may be in a physically different location to the second non-3GPP access network.
  • a processor for wireless communication comprising: at least one controller coupled with at least one memory and configured to cause the processor to: establish a first secure connection with an access and mobility management function, AMF, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, k.wiit output, to the AMF over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the AMF via a second non- 3GPP access network, wherein the second key is derived using the kAMF; input, from the AMF, a second message, wherein the second message indicates a request for the UE to derive the second key; and derive the second key from the kAMF in response to the second message.
  • Such a processor enables the access and mobility management function to instruct a user equipment to derive the second key for establishing a second secure connection with the AMF via a second non-3GPP access network.
  • Such an arrangement has the advantage that during user equipment mobility registration involving a change in the non-3GPP access network or user equipment mobility security re-establishment, the AMF does not need to perform an additional full primary authentication run. This tends to reduce signalling overhead between the user equipment and the mobile communication network. This tends to reduce delays in a connection being established between the user equipment and the mobile communication network.
  • the processor may be part of a user equipment.
  • a network equipment for wireless communication comprising: at least one memory; and at least one processor coupled with the at least one memory and configured to cause the network equipment to: establish a first secure connection with an user equipment, UE, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, kA F; receive, from the UE over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the network equipment via a second non-3GPP access network, wherein the second key is derived using the kAMF; and send, to the UE, a second message, wherein the second message indicates a request for the UE to derive the second key.
  • Such a network equipment is able to instruct the user equipment to derive the second key for establishing a second secure connection with the network equipment via a second non-3GPP access network.
  • Such an arrangement has the advantage that during user equipment mobility registration involving a change in the non-3GPP access network or user equipment mobility security re-establishment, the network equipment does not need to perform an additional full primary authentication run. This tends to reduce signalling overhead between the user equipment and the mobile communication network. This tends to reduce delays in a connection being established between the user equipment and the mobile communication network.
  • the network equipment may be a network entity.
  • the network equipment may be a base station.
  • the network equipment may be a network function.
  • the network equipment may be core network.
  • the network equipment may be part of a mobile communication network.
  • the network equipment may be eNodeB (eNB).
  • the network equipment may be gNodeB (gNB).
  • the network equipment may be an access and mobility management function, AMF.
  • the second key may be a new TNGF key (I ⁇ T ⁇ GI ) in case where the second non- 3 GPP access network is a trusted non-3GPP access network.
  • the second key may be a new N3IWF key (kroiwr) in the case where the second non-3GPP access network is a untrusted non-3GPP access network.
  • the second key may be a new TWIF key (krwip) in case where the second non-3GPP access network is a trusted wireless local area network (WLAN) access network.
  • the second key may be a new W-AGF key (kwAGF) in case where the user equipment is a 5G-Residential Gateway (5G-RG).
  • 5G-RG 5G-Residential Gateway
  • the network equipment may itself derive the second key.
  • the network equipment may derive the same second key as the user equipment.
  • the network equipment may provide the second key to the second non-3GPP access network.
  • the network equipment may provide the second key to a node in the second non-3GPP access network.
  • the node in the second non-3GPP access network may be a TNGF/N3IWF/WLAN-AP/ W-5GAN.
  • a method performed by a user equipment, UE comprising: establishing a first secure connection with an access and mobility management function, AMF, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, kAMF; sending, to the AMF over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the AMF via a second non- 3GPP access network, wherein the second key is derived using the kAMF; receiving, from the AMF, a second message, wherein the second message indicates a request for the UE to derive the second key; and deriving the second key from the kAMF in response to the second message.
  • Such a method enables the access and mobility management function to instruct the user equipment to derive the second key for establishing a second secure connection with the AMF via a second non-3GPP access network.
  • Such an arrangement has the advantage that during user equipment mobility registration involving a change in the non- 3 GPP access network or user equipment mobility security re-establishment, the AMF does not need to perform an additional full primary authentication run. This tends to reduce signalling overhead between the user equipment and the mobile communication network. This tends to reduce delays in a connection being established between the user equipment and the mobile communication network.
  • the method further comprises establishing the second secure connection with the AMF via the second non-3GPP access network using the second key.
  • the second non- 3GPP access network may send a next generation application protocol NGAP Initial Context Setup Response message to the AMF.
  • the second non-3GPP access network comprises one or more of: a trusted non-3GPP gateway function, TNGF; a non-3GPP access interworking function, N3IWF; a trusted wireless local area network, WLAN, interworking function, TWIF; or a wireline access gateway function, W-AGF.
  • the second key is one of: a TNGF key; a N3IWF key; a TWIF key; or a W-AGF key.
  • the step of deriving the second key further comprises using one or more of: an uplink non access stratum, NAS, count, a length of the uplink NAS count, an access type distinguisher, or a length of the access type distinguisher.
  • the step of deriving the second key further comprises using a freshness parameter.
  • the step of deriving further comprises using the length of the freshness parameter.
  • the freshness parameter is one of: a count, a counter, a random number, or a nonce.
  • a UE in the network sends non-3GPP access key-refresh capabilities to the AMF via the non-3gpp access network; receives one or more of: keyrefresh required indication and freshness parameter from the AMF via the non-3gpp access network; derives a fresh non-3GPP access key in response to the key-refresh required indication; uses the fresh non-3GPP access key to establish security with the target new non-3Gpp access network during mobility; wherein the non-3GPP access key-refresh capabilities indicate one or more of: TNGF key refresh support indication, N3IWF key refresh support indication, TWIF key refresh support indication, W-AGF key refresh support indication; wherein the key-refresh required indication indicate one of: TNGF key refresh, N3IWF key refresh, TWIF key refresh, W-AGF key refresh.
  • the UE is further arranged to derive a fresh TNGF key in response to receiving TNGF key refresh required indication.
  • the UE is further arranged to derive a fresh N3IWF key in response to receiving N3IWF key refresh required indication.
  • the UE is further arranged to derive a fresh TWIF key in response to receiving TWIF key refresh required indication.
  • the UE is further arranged to derive a fresh WAGF key in response to receiving WAGF key refresh required indication.
  • P0 Uplink NAS COUNT
  • L0 length of uplink NAS COUNT (i.e. 0x00 0x04)
  • Pl Access type distinguisher specific to (Non 3GPP access) key refresh/rekey ‘specific
  • P0 Uplink NAS COUNT
  • L0 length of uplink NAS COUNT (i.e. 0x00 0x04)
  • Pl Access type distinguisher specific to (Non 3GPP access)
  • P0 Uplink NAS COUNT
  • L0 length of uplink NAS COUNT (i.e. 0x00 0x04)
  • Pl Access type distinguisher specific to (Non 3GPP access) key refresh/rekey ‘specific
  • P0 Uplink NAS COUNT
  • L0 length of uplink NAS COUNT (i.e. 0x00 0x04)
  • Pl Access type distinguisher specific to (Non 3GPP access) key refresh/rekey ‘specific code’/
  • FIG 14 illustrates an example of a UE 1400 in accordance with aspects of the present disclosure.
  • the UE 1400 may include a processor 1402, a memory 1404, a controller 1406, and a transceiver 1408.
  • the processor 1402, the memory 1404, the controller 1406, or the transceiver 1408, or various combinations thereof or various components thereof may be examples of means for performing various aspects of the present disclosure as described herein. These components may be coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more interfaces.
  • the processor 1402, the memory 1404, the controller 1406, or the transceiver 1408, or various combinations or components thereof may be implemented in hardware (e.g., circuitry).
  • the hardware may include a processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), or other programmable logic device, or any combination thereof configured as or otherwise supporting a means for performing the functions described in the present disclosure.
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • the processor 1402 may include an intelligent hardware device (e.g., a general- purpose processor, a DSP, a CPU, an ASIC, an FPGA, or any combination thereof). In some implementations, the processor 1402 may be configured to operate the memory 1404. In some other implementations, the memory 1404 may be integrated into the processor 1402. The processor 1402 may be configured to execute computer-readable instructions stored in the memory 1404 to cause the UE 1400 to perform various functions of the present disclosure.
  • an intelligent hardware device e.g., a general- purpose processor, a DSP, a CPU, an ASIC, an FPGA, or any combination thereof.
  • the processor 1402 may be configured to operate the memory 1404. In some other implementations, the memory 1404 may be integrated into the processor 1402.
  • the processor 1402 may be configured to execute computer-readable instructions stored in the memory 1404 to cause the UE 1400 to perform various functions of the present disclosure.
  • the memory 1404 may include volatile or non-volatile memory.
  • the memory 1404 may store computer-readable, computer-executable code including instructions when executed by the processor 1402 cause the UE 1400 to perform various functions described herein.
  • the code may be stored in a non-transitory computer-readable medium such the memory 1404 or another type of memory.
  • Computer-readable media includes both non- transitory computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a non-transitory storage medium may be any available medium that may be accessed by a general-purpose or special-purpose computer.
  • the processor 1402 and the memory 1404 coupled with the processor 1402 may be configured to cause the UE 1400 to perform one or more of the functions described herein (e.g., executing, by the processor 1402, instructions stored in the memory 1404).
  • the processor 1402 may support wireless communication at the UE 1400 in accordance with examples as disclosed herein.
  • the UE 1400 may be configured to support a means for establishing a first secure connection with an access and mobility management function, AMF, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, kAMF; sending, to the AMF over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the AMF via a second non-3GPP access network, wherein the second key is derived using the kAMF; receiving, from the AMF, a second message, wherein the second message indicates a request for the UE to derive the second key; and deriving the second key from the kA F in response to the second message.
  • AMF access and mobility management function
  • the controller 1406 may manage input and output signals for the UE 1400.
  • the controller 1406 may also manage peripherals not integrated into the UE 1400.
  • the controller 1406 may utilize an operating system such as iOS®, ANDROID®, WINDOWS®, or other operating systems.
  • the controller 1406 may be implemented as part of the processor 1402.
  • the UE 1400 may include at least one transceiver 1408. In some other implementations, the UE 1400 may have more than one transceiver 1408.
  • the transceiver 1408 may represent a wireless transceiver.
  • the transceiver 1408 may include one or more receiver chains 1410, one or more transmitter chains 1412, or a combination thereof.
  • a receiver chain 1410 may be configured to receive signals (e.g., control information, data, packets) over a wireless medium.
  • the receiver chain 1410 may include one or more antennas for receive the signal over the air or wireless medium.
  • the receiver chain 1410 may include at least one amplifier (e.g., a low-noise amplifier (LN A)) configured to amplify the received signal.
  • the receiver chain 1410 may include at least one demodulator configured to demodulate the receive signal and obtain the transmitted data by reversing the modulation technique applied during transmission of the signal.
  • the receiver chain 1410 may include at least one decoder for decoding the processing the demodulated signal to receive the transmitted data.
  • a transmitter chain 1412 may be configured to generate and transmit signals (e.g., control information, data, packets).
  • the transmitter chain 1412 may include at least one modulator for modulating data onto a carrier signal, preparing the signal for transmission over a wireless medium.
  • the at least one modulator may be configured to support one or more techniques such as amplitude modulation (AM), frequency modulation (FM), or digital modulation schemes like phase-shift keying (PSK) or quadrature amplitude modulation (QAM).
  • the transmitter chain 1412 may also include at least one power amplifier configured to amplify the modulated signal to an appropriate power level suitable for transmission over the wireless medium.
  • the transmitter chain 1412 may also include one or more antennas for transmitting the amplified signal into the air or wireless medium.
  • FIG. 15 illustrates an example of a processor 1500 in accordance with aspects of the present disclosure.
  • the processor 1500 may be an example of a processor configured to perform various operations in accordance with examples as described herein.
  • the processor 1500 may include a controller 1502 configured to perform various operations in accordance with examples as described herein.
  • the processor 1500 may optionally include at least one memory 1504, which may be, for example, an L1/L2/L3 cache. Additionally, or alternatively, the processor 1500 may optionally include one or more arithmetic-logic units (ALUs) 1506.
  • ALUs arithmetic-logic units
  • One or more of these components may be in electronic communication or otherwise coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more interfaces (e.g., buses).
  • the processor 1500 may be a processor chipset and include a protocol stack (e.g., a software stack) executed by the processor chipset to perform various operations (e.g., receiving, obtaining, retrieving, transmitting, outputting, forwarding, storing, determining, identifying, accessing, writing, reading) in accordance with examples as described herein.
  • a protocol stack e.g., a software stack
  • operations e.g., receiving, obtaining, retrieving, transmitting, outputting, forwarding, storing, determining, identifying, accessing, writing, reading
  • the processor chipset may include one or more cores, one or more caches (e.g., memory local to or included in the processor chipset (e.g., the processor 1500) or other memory (e.g., random access memory (RAM), read-only memory (ROM), dynamic RAM (DRAM), synchronous dynamic RAM (SDRAM), static RAM (SRAM), ferroelectric RAM (FeRAM), magnetic RAM (MRAM), resistive RAM (RRAM), flash memory, phase change memory (PCM), and others).
  • RAM random access memory
  • ROM read-only memory
  • DRAM dynamic RAM
  • SDRAM synchronous dynamic RAM
  • SRAM static RAM
  • FeRAM ferroelectric RAM
  • MRAM magnetic RAM
  • RRAM resistive RAM
  • flash memory phase change memory
  • PCM phase change memory
  • the controller 1502 may be configured to manage and coordinate various operations (e.g., signaling, receiving, obtaining, retrieving, transmitting, outputting, forwarding, storing, determining, identifying, accessing, writing, reading) of the processor 1500 to cause the processor 1500 to support various operations in accordance with examples as described herein.
  • the controller 1502 may operate as a control unit of the processor 1500, generating control signals that manage the operation of various components of the processor 1500. These control signals include enabling or disabling functional units, selecting data paths, initiating memory access, and coordinating timing of operations.
  • the controller 1502 may be configured to fetch (e.g., obtain, retrieve, receive) instructions from the memory 1504 and determine subsequent instruction(s) to be executed to cause the processor 1500 to support various operations in accordance with examples as described herein.
  • the controller 1502 may be configured to track memory address of instructions associated with the memory 1504.
  • the controller 1502 may be configured to decode instructions to determine the operation to be performed and the operands involved.
  • the controller 1502 may be configured to interpret the instruction and determine control signals to be output to other components of the processor 1500 to cause the processor 1500 to support various operations in accordance with examples as described herein.
  • the controller 1502 may be configured to manage flow of data within the processor 1500.
  • the controller 1502 may be configured to control transfer of data between registers, arithmetic logic units (ALUs), and other functional units of the processor 1500.
  • ALUs arithmetic logic units
  • the memory 1504 may include one or more caches (e.g., memory local to or included in the processor 1500 or other memory, such RAM, ROM, DRAM, SDRAM, SRAM, MRAM, flash memory, etc. In some implementations, the memory 1504 may reside within or on a processor chipset (e.g., local to the processor 1500). In some other implementations, the memory 1504 may reside external to the processor chipset (e.g., remote to the processor 1500).
  • caches e.g., memory local to or included in the processor 1500 or other memory, such RAM, ROM, DRAM, SDRAM, SRAM, MRAM, flash memory, etc.
  • the memory 1504 may reside within or on a processor chipset (e.g., local to the processor 1500). In some other implementations, the memory 1504 may reside external to the processor chipset (e.g., remote to the processor 1500).
  • the memory 1504 may store computer-readable, computer-executable code including instructions that, when executed by the processor 1500, cause the processor 1500 to perform various functions described herein.
  • the code may be stored in a non-transitory computer-readable medium such as system memory or another type of memory.
  • the controller 1502 and/or the processor 1500 may be configured to execute computer-readable instructions stored in the memory 1504 to cause the processor 1500 to perform various functions.
  • the processor 1500 and/or the controller 1502 may be coupled with or to the memory 1504, the processor 1500, the controller 1502, and the memory 1504 may be configured to perform various functions described herein.
  • the processor 1500 may include multiple processors and the memory 1504 may include multiple memories. One or more of the multiple processors may be coupled with one or more of the multiple memories, which may, individually or collectively, be configured to perform various functions herein.
  • the one or more ALUs 1506 may be configured to support various operations in accordance with examples as described herein.
  • the one or more ALUs 1506 may reside within or on a processor chipset (e.g., the processor 1500).
  • the one or more ALUs 1506 may reside external to the processor chipset (e.g., the processor 1500).
  • One or more ALUs 1506 may perform one or more computations such as addition, subtraction, multiplication, and division on data.
  • one or more ALUs 1506 may receive input operands and an operation code, which determines an operation to be executed.
  • One or more ALUs 1506 be configured with a variety of logical and arithmetic circuits, including adders, subtractors, shifters, and logic gates, to process and manipulate the data according to the operation. Additionally, or alternatively, the one or more ALUs 1506 may support logical operations such as AND, OR, exclusive-OR (XOR), not-OR (NOR), and not- AND (NAND), enabling the one or more ALUs 1506 to handle conditional operations, comparisons, and bitwise operations.
  • logical operations such as AND, OR, exclusive-OR (XOR), not-OR (NOR), and not- AND (NAND)
  • the processor 1500 may support wireless communication in accordance with examples as disclosed herein.
  • the processor 1500 may be configured to or operable to support a means for establishing a first secure connection with an access and mobility management function, AMF, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, k.wii sending, to the AMF over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the AMF via a second non-3GPP access network, wherein the second key is derived using the k.wii receiving, from the AMF, a second message, wherein the second message indicates a request for the UE to derive the second key; and deriving the second key from the k.wn in response to the second message.
  • FIG. 16 illustrates an example of a NE 1600 in accordance with aspects of the present disclosure.
  • the NE 1600 may include a processor 1602, a memory 1604, a controller 1606, and a transceiver 1608.
  • the processor 1602, the memory 1604, the controller 1606, or the transceiver 1608, or various combinations thereof or various components thereof may be examples of means for performing various aspects of the present disclosure as described herein. These components may be coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more interfaces.
  • the hardware may include a processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), or other programmable logic device, or any combination thereof configured as or otherwise supporting a means for performing the functions described in the present disclosure.
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • the processor 1602 may include an intelligent hardware device (e.g., a general- purpose processor, a DSP, a CPU, an ASIC, an FPGA, or any combination thereof). In some implementations, the processor 1602 may be configured to operate the memory 1604. In some other implementations, the memory 1604 may be integrated into the processor 1602. The processor 1602 may be configured to execute computer-readable instructions stored in the memory 1604 to cause the NE 1600 to perform various functions of the present disclosure.
  • an intelligent hardware device e.g., a general- purpose processor, a DSP, a CPU, an ASIC, an FPGA, or any combination thereof.
  • the processor 1602 may be configured to operate the memory 1604. In some other implementations, the memory 1604 may be integrated into the processor 1602.
  • the processor 1602 may be configured to execute computer-readable instructions stored in the memory 1604 to cause the NE 1600 to perform various functions of the present disclosure.
  • the memory 1604 may include volatile or non-volatile memory.
  • the memory 1604 may store computer-readable, computer-executable code including instructions when executed by the processor 1602 cause the NE 1600 to perform various functions described herein.
  • the code may be stored in a non-transitory computer-readable medium such the memory 1604 or another type of memory.
  • Computer-readable media includes both non- transitory computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a non-transitory storage medium may be any available medium that may be accessed by a general-purpose or special-purpose computer.
  • the processor 1602 and the memory 1604 coupled with the processor 1602 may be configured to cause the NE 1600 to perform one or more of the functions described herein (e.g., executing, by the processor 1602, instructions stored in the memory 1604).
  • the processor 1602 may support wireless communication at the NE 1600 in accordance with examples as disclosed herein.
  • the NE 1600 may be configured to support a means for establishing a first secure connection with a user equipment, UE, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, k.wii receiving, from the UE over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the network equipment via a second non-3GPP access network, wherein the second key is derived using the kAMF; and sending, to the UE, a second message, wherein the second message indicates a request for the UE to derive the second key.
  • the controller 1606 may manage input and output signals for the NE 1600.
  • the controller 1606 may also manage peripherals not integrated into the NE 1600.
  • the controller 1606 may utilize an operating system such as iOS®, ANDROID®, WINDOWS®, or other operating systems.
  • the controller 1606 may be implemented as part of the processor 1602.
  • the NE 1600 may include at least one transceiver 1608. In some other implementations, the NE 1600 may have more than one transceiver 1608.
  • the transceiver 1608 may represent a wireless transceiver.
  • the transceiver 1608 may include one or more receiver chains 1610, one or more transmitter chains 1612, or a combination thereof.
  • a receiver chain 1610 may be configured to receive signals (e.g., control information, data, packets) over a wireless medium.
  • the receiver chain 1610 may include one or more antennas for receive the signal over the air or wireless medium.
  • the receiver chain 1610 may include at least one amplifier (e.g., a low-noise amplifier (LN A)) configured to amplify the received signal.
  • the receiver chain 1610 may include at least one demodulator configured to demodulate the receive signal and obtain the transmitted data by reversing the modulation technique applied during transmission of the signal.
  • the receiver chain 1610 may include at least one decoder for decoding the processing the demodulated signal to receive the transmitted data.
  • a transmitter chain 1612 may be configured to generate and transmit signals (e.g., control information, data, packets).
  • the transmitter chain 1612 may include at least one modulator for modulating data onto a carrier signal, preparing the signal for transmission over a wireless medium.
  • the at least one modulator may be configured to support one or more techniques such as amplitude modulation (AM), frequency modulation (FM), or digital modulation schemes like phase-shift keying (PSK) or quadrature amplitude modulation (QAM).
  • the transmitter chain 1612 may also include at least one power amplifier configured to amplify the modulated signal to an appropriate power level suitable for transmission over the wireless medium.
  • the transmitter chain 1612 may also include one or more antennas for transmitting the amplified signal into the air or wireless medium.
  • Figure 17 illustrates a flowchart of a method in accordance with aspects of the present disclosure.
  • the operations of the method may be implemented by a UE as described herein.
  • the UE may execute a set of instructions to control the function elements of the UE to perform the described functions.
  • the method may include establishing a first secure connection with an access and mobility management function, AMF, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, kA F.
  • AMF access and mobility management function
  • kA F AMF key
  • the method may include sending, to the AMF over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the AMF via a second non-3GPP access network, wherein the second key is derived using the kAMF.
  • the operations of 1704 may be performed in accordance with examples as described herein. In some implementations, aspects of the operations of 1704 may be performed by a UE as described with reference to Figure 14.
  • the method may include receiving, from the AMF, a second message, wherein the second message indicates a request for the UE to derive the second key.
  • the operations of 1706 may be performed in accordance with examples as described herein. In some implementations, aspects of the operations of 1706 may be performed a UE as described with reference to Figure 14.
  • the method may include deriving the second key from the kAMF in response to the second message.
  • the operations of 1708 may be performed in accordance with examples as described herein. In some implementations, aspects of the operations of 1708 may be performed a UE as described with reference to Figure 14.
  • Figure 18 illustrates a flowchart of a method in accordance with aspects of the present disclosure.
  • the operations of the method may be implemented by a NE as described herein.
  • the NE may execute a set of instructions to control the function elements of the NE to perform the described functions.
  • the method may include establishing a first secure connection with a user equipment, UE, via a first non-3GPP access network using a first key, wherein the first key is derived using an AMF key, kAMF.
  • the operations of 1802 may be performed in accordance with examples as described herein. In some implementations, aspects of the operations of 1802 may be performed by a NE as described with reference to Figure 16.
  • the method may include receiving, from the UE over the first secure connection, a first message, wherein the first message indicates that the UE supports derivation of a second key for establishing a second secure connection with the network equipment via a second non-3GPP access network, wherein the second key is derived using the kA F.
  • the operations of 1804 may be performed in accordance with examples as described herein. In some implementations, aspects of the operations of 1804 may be performed by a NE as described with reference to Figure 16.
  • the method may include sending, to the UE, a second message, wherein the second message indicates a request for the UE to derive the second key.
  • the operations of 1806 may be performed in accordance with examples as described herein. In some implementations, aspects of the operations of 1806 may be performed a NE as described with reference to Figure 16.
  • 5GC 5 G Core Network
  • 5G-AN 5G Access Network
  • 5GLAN 5G Local Area
  • 5G-BRG 5G Broadband Residential Gateway
  • 5G-CRG 5G Cable Residential Gateway
  • 5G-RG 5G Residential Gateway
  • NG-RAN 5G Radio Access Network
  • 5G AV 5G Authentication Vector
  • 5G HE AV 5G Home Environment Authentication Vector
  • 5G NSWO 5G Non-Seamless WLAN Offload
  • 5G SE AV 5G Serving Environment Authentication Vector
  • ABBA Anti-Bidding down Between Architectures; AEAD, Authenticated Encryption with Associated Data; AES, Advanced Encryption Standard; AKA, Authentication and Key Agreement; AMF, Access and Mobility Management Function; ARPF, Authentication credential Repository and Processing Function; AUN3, Authenticable Non-3GPP devices;
  • AUSF Authentication Server Function;
  • AUTN Authentication To

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

Divers aspects de la présente divulgation concernent un équipement utilisateur, UE, pour une communication sans fil, l'UE comprenant : au moins une mémoire; et au moins un processeur couplé à ladite au moins une mémoire et configuré pour amener l'UE à : établir une première connexion sécurisée avec une fonction de gestion d'accès et de mobilité, AMF, via un premier réseau d'accès non-3GPP à l'aide d'une première clé, la première clé étant dérivée à l'aide d'une clé AMF, kAMF; envoyer, à l'AMF sur la première connexion sécurisée, un premier message, le premier message indiquant que l'UE prend en charge une dérivation d'une seconde clé pour établir une seconde connexion sécurisée avec l'AMF via un second réseau d'accès non-3GPP, la seconde clé étant dérivée à l'aide de kAMF; recevoir, en provenance de l'AMF, un second message, le second message indiquant une demande pour l'UE de dériver la seconde clé; et dériver la seconde clé à partir de kAMF en réponse au second message.
PCT/EP2023/083603 2023-10-25 2023-11-29 Connexions sécurisées dans un réseau de communication sans fil WO2024208444A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
GR20230100888 2023-10-25
GR20230100888 2023-10-25

Publications (1)

Publication Number Publication Date
WO2024208444A1 true WO2024208444A1 (fr) 2024-10-10

Family

ID=89029512

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/EP2023/083603 WO2024208444A1 (fr) 2023-10-25 2023-11-29 Connexions sécurisées dans un réseau de communication sans fil

Country Status (1)

Country Link
WO (1) WO2024208444A1 (fr)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024067619A1 (fr) * 2022-09-30 2024-04-04 华为技术有限公司 Procédé de communication et appareil de communication

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024067619A1 (fr) * 2022-09-30 2024-04-04 华为技术有限公司 Procédé de communication et appareil de communication

Non-Patent Citations (9)

* Cited by examiner, † Cited by third party
Title
"3 Generation Partnership Project; Technical Specification Group Services and System Aspects; Security architecture and procedures for 5G system (Release 17)", vol. SA WG3, no. V17.11.1, 2 October 2023 (2023-10-02), pages 1 - 296, XP052512835, Retrieved from the Internet <URL:https://ftp.3gpp.org/Specs/archive/33_series/33.501/33501-hb1.zip 33501-hb1.doc> [retrieved on 20231002] *
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on security aspects for support for 5G Wireless and Wireline Convergence (5WWC) phase 2 (Release 18)", no. V18.0.1, 3 July 2023 (2023-07-03), pages 1 - 40, XP052409500, Retrieved from the Internet <URL:https://ftp.3gpp.org/Specs/archive/33_series/33.887/33887-i01.zip 33887-i01.docx> [retrieved on 20230703] *
3GPP TECHNICAL SPECIFICATION (TS) 33.501
3GPP TS 23.501
3GPP TS 33.501
LENOVO: "Discussion on KI#4 solution analysis", vol. SA WG3, no. Berlin, Germany; 20230522 - 20230526, 21 May 2023 (2023-05-21), XP052489419, Retrieved from the Internet <URL:https://ftp.3gpp.org/Meetings_3GPP_SYNC/SA3/Docs/S3-233093.zip S3-233093_Discussion on KI#4 solution analysis.doc> [retrieved on 20230521] *
TS 23.501
TS 23.502
TS 33.501

Similar Documents

Publication Publication Date Title
US10939294B2 (en) Network access identifier including an identifier for a cellular access network node
KR101961301B1 (ko) 통합된 스몰 셀 및 wi-fi 네트워크를 위한 통합 인증
US10419994B2 (en) Non-access stratum based access method and terminal supporting the same
US11490252B2 (en) Protecting WLCP message exchange between TWAG and UE
US20230247423A1 (en) Supporting remote unit reauthentication
CN114830701B (zh) 通过另一移动网络向移动网络注册
US20230231720A1 (en) Supporting remote unit reauthentication
US20240305983A1 (en) Communication method and apparatus
WO2024160413A1 (fr) Réauthentification pour mobilité d&#39;équipement utilisateur dans un réseau de communication sans fil
WO2024208444A1 (fr) Connexions sécurisées dans un réseau de communication sans fil
CN119014024A (zh) 在与wlan接入网络的第一认证之后向移动网络注册
US20250056219A1 (en) Negotiation of security mechanisms that implement combined integrity and encryption algorithms
US20250055678A1 (en) Key generation for combined integrity and encryption algorithms
WO2024121828A1 (fr) Génération d&#39;un contexte de sécurité pour mobilité de point d&#39;accès non-3gpp sécurisé (tnap) d&#39;équipement utilisateur (ue)
WO2024110949A1 (fr) Rétablissement de sécurité ip de confiance pour mobilité de points d&#39;accès non-3 gpp de confiance (tnap)
WO2025056217A1 (fr) Processus d&#39;enregistrement dans un réseau de communication sans fil
WO2024251405A1 (fr) Fonction de réseau dans un réseau de communication sans fil
WO2024069502A1 (fr) Fourniture de clés de sécurité à un réseau de desserte d&#39;un équipement utilisateur
WO2024245615A1 (fr) Établissement de session de données dans un réseau de communication sans fil
WO2024235491A1 (fr) Enregistrement d&#39;équipement utilisateur
WO2023131860A1 (fr) Authentification d&#39;équipement utilisateur pour des applications
WO2024146704A1 (fr) Connexion de données multi-accès dans un réseau de communication sans fil
WO2024234974A1 (fr) Procédé de communication et appareil de communication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23814454

Country of ref document: EP

Kind code of ref document: A1