Performing security updates without resynchronization

1 . A user equipment (UE) An apparatus, comprising

at least one processor; and

at least one memory comprising computer program code,

the at least one memory and computer program code configured, with the at least one processor, to cause the UE at least to perform:

receiving, at the UE in communication with a first serving cell of a base station, a Radio Resource Control (RRC) reconfiguration command comprising:

information to perform a security update to a new security configuration,

an indication of a time to execute the security update to the new security configuration, wherein the indication of the time comprises at least one of: a number of radio frames or slots, a timer, or a timestamp in a Universal Time Coordinated (UTC) time format, and

an explicit indication to perform the security update without a re-synchronization procedure; and

based on determining that the indicated time has occurred, performing, by the UE without performing a random-access procedure, the security update to the new security configuration to use for communication with a second serving cell, wherein the first serving cell and the second serving cell are a same cell using a same physical cell identifier (PCI) before and after the security update, and wherein the security update is performed for a procedure selected from: a handover within a non-terrestrial network (NTN), and an integrated access and backhaul (IAB) inter-donor central unit migration wherein a serving IAB unit for the UE does not change during the IAB inter-donor central unit migration, and wherein the second serving cell uses a different New Radio (NR) Cell Global Identifier (NCGI) than the first serving cell after the IAB inter-donor central unit migration, and wherein performing the security update comprises:

performing a packet data convergence protocol (PDCP) re-establishment procedure, wherein performing the PDCP re-establishment procedure comprises at least one of creating a new key and implementing a new security algorithm;

performing a radio link control (RLC) re-establishment procedure, wherein the RLC re-establishment procedure is performed to clear a transmission and reception pipeline of data units protected with a previous security configuration before data units protected with the new security configuration are transmitted via the PDCP re-establishment procedure, wherein the RLC re-establishment procedure is performed by:

discarding all RLC service data units (SDUs), RLC SDU segments, and RLC protocol data units (PDUs);

stopping and resetting all timers associated with an RLC entity; and

resetting all state variables of the RLC entity to initial values; and

performing a medium access control (MAC) re-establishment procedure that includes resetting of all hybrid automatic repeat request (HARQ) processes of the UE by:

setting new-data indicators for all uplink HARQ processes to a reset value of zero;

flushing soft buffers for all downlink HARQ processes; and

for each downlink HARQ process, considering a next received transmission for a transport block as a very first transmission, wherein the MAC re-establishment procedure maintains an uplink time alignment and does not have an implicit requirement for a random-access procedure at a later stage to continue transmission.

2 . The UE of claim 1 , wherein the at least one memory and computer program code are configured, with the at least one processor, to further cause the UE at least to perform:

communicating by the UE with the second serving cell of the base station using the new security configuration.

3 . The UE of claim 1 , wherein the at least one memory and computer program code are configured, with the at least one processor, to further cause the UE at least to perform:

determining, by the UE, that the time has occurred based on one or more of the following:

a number of radio frames or slots comprised in the indication of the time;

a timer comprised in the indication of the time; or

a timestamp in a Universal Time Coordinated (UTC) time format comprised in the indication of the time.

4 . A method performed by a user equipment (UE), the method comprising:

receiving, by the UE in communication with a first serving cell of a base station, a Radio Resource Control (RRC) reconfiguration command comprising:

information to perform a security update to a new security configuration, and

an indication of a time to execute the security update to the new security configuration, wherein the indication of the time comprises at least one of: a number of radio frames or slots, a timer, or a timestamp in a Universal Time Coordinated (UTC) time format, and

an explicit indication to perform the security update without a re-synchronization procedure; and

based on determining that the indicated time has occurred, performing, by the UE without performing a random-access procedure, the security update to the new security configuration to use for communication with a second serving cell, wherein the first serving cell and the second serving cell are a same cell using a same physical cell identifier (PCI) before and after the security update, and wherein the security update is performed for a procedure selected from: a handover within a non-terrestrial network (NTN), and an integrated access and backhaul (IAB) inter-donor central unit migration wherein a serving IAB unit for the UE does not change during the IAB inter-donor central unit migration, and wherein the second serving cell uses a different New Radio (NR) Cell Global Identifier (NCGI) than the first serving cell after the IAB inter-donor central unit migration, and wherein performing the security update comprises:

performing a packet data convergence protocol (PDCP) re-establishment procedure, wherein performing the PDCP re-establishment procedure comprises at least one of creating a new key and implementing a new security algorithm;

performing a radio link control (RLC) re-establishment procedure, wherein the RLC re-establishment procedure is performed to clear a transmission and reception pipeline of data units protected with a previous security configuration before data units protected with the new security configuration are transmitted via the PDCP re-establishment procedure, wherein the RLC re-establishment procedure is performed by:

discarding all RLC service data units (SDUs), RLC SDU segments, and RLC protocol data units (PDUs);

stopping and resetting all timers associated with an RLC entity; and

resetting all state variables of the RLC entity to initial values; and

performing a medium access control (MAC) re-establishment procedure that includes resetting of all hybrid automatic repeat request (HARQ) processes of the UE by:

setting new-data indicators for all uplink HARQ processes to a reset value of zero;

flushing soft buffers for all downlink HARQ processes; and

for each downlink HARQ process, considering a next received transmission for a transport block as a very first transmission, wherein the MAC re-establishment procedure maintains an uplink time alignment and does not have an implicit requirement for a random-access procedure at a later stage to continue transmission.

5 . The method of claim 4 , wherein the UE determines that the indicated time has occurred by:

determining that a current radio frame number or slot number corresponds to the indicated number of radio frames or slots;

determining that the timer has expired; or

determining that a current time corresponds to the timestamp in the Universal Time Coordinated (UTC) time format.

6 . The method of claim 5 , wherein the RRC reconfiguration command comprises a handover command received via a source base station that is also acting as a target base station for the procedure.

7 . The method of claim 6 , wherein the indication of the time to execute the security update is generated by the base station acting as a source base station in response to receiving a handover command message in an N2-based handover procedure or a handover request acknowledge in an Xn-based handover procedure.

8 . The method of claim 7 , wherein the PDCP re-establishment procedure further comprises retransmitting one or more non-acknowledged PDCP protocol data units using the new security configuration after completion of the RLC re-establishment procedure.

9 . The method of claim 8 , wherein the PDCP re-establishment procedure, the RLC re-establishment procedure, and the MAC re-establishment procedure are performed in a coordinated manner such that retransmission of PDCP protocol data units protected with the new security configuration is not performed before RLC buffers associated with the previous security configuration are flushed.

10 . The method of claim 9 , wherein the explicit indication to perform the security update without the re-synchronization procedure indicates that the UE is not to perform a random-access procedure and is not to consider time-alignment timers as expired.

11 . The method of claim 10 , wherein prior to the indicated time occurring, the UE continues communication with the first serving cell using the previous security configuration.

12 . The method of claim 11 , further comprising, after performing the security update, transmitting an RRC Reconfiguration Complete message to the base station using the new security configuration.

13 . The method of claim 12 , wherein the security update is performed while the UE remains in a RRC CONNECTED state and without detaching from the serving cell.