Network security architecture

1. A method for a client device in a network, comprising:

registering to the network;

obtaining at least a user plane key shared with a user plane network function implemented at a first network node or a control plane key shared with a control plane network function implemented at a second network node;

protecting a data packet with the user plane key or a control packet with the control plane key, wherein the data packet includes first destination information indicating that the data packet is to be processed at the first network node, the first destination information enabling a network access node to forward the data packet to the first network node, and wherein the control packet includes second destination information indicating that the control packet is to be processed at the second network node, the second destination information enabling the network access node to forward the control packet to the second network node;

transmitting the protected data packet or the protected control packet to the network; and

transmitting an encrypted client device context to the network, wherein the encrypted client device context includes at least the user plane key or the control plane key, and enables reconstruction of at least a security context at the network for the client device, the security context enabling processing of the protected data packet or the protected control packet at the network.

2. The method of claim 1 , further comprising:

receiving a packet from the network;

determining whether the received packet includes data or control information; and

decoding the received packet with the user plane key or the control plane key based on the determination.

3. The method of claim 2 , wherein decoding the received packet comprises:

decrypting and verifying the received packet with the user plane key or the control plane key.

4. The method of claim 3 , wherein verifying the received packet comprises:

determining a first message authentication code by applying a message authentication code generation algorithm based on the received packet and either the user plane key or the control plane key; and

comparing the first message authentication code to a second message authentication code associated with the received packet.

5. The method of claim 2 , wherein a user plane network function identifier or a control plane network function identifier is included in a header of the received packet, and wherein the client device is registered in a reduced data transfer mode.

6. The method of claim 1 , further comprising:

obtaining at least one of a user plane security context indicating network state information for the client device with respect to a user plane, or a control plane security context indicating network state information for the client device with respect to a control plane.

7. The method of claim 6 , wherein obtaining the user plane security context comprises deriving a first encryption key and a first integrity key based on the user plane key, and wherein obtaining the control plane security context comprises deriving a second encryption key and a second integrity key based on the control plane key.

8. The method of claim 6 , wherein the user plane security context or the control plane security context does not include access stratum security protection.

9. The method of claim 1 , wherein the data packet is encrypted or integrity protected, or both encrypted and integrity protected, based on the user plane key, and wherein the control packet is encrypted or integrity protected, or both encrypted and integrity protected, based on the control plane key.

10. The method of claim 1 , wherein the registering to the network comprises:

transmitting a request to attach to the network; and

receiving, from the network, a message associated with an authentication procedure in response to the request;

wherein the user plane key or the control plane key is obtained based on the message, and wherein the attach request indicates that the client device is to attach in a reduced data transfer mode.

11. A client device, comprising:

a communication circuit configured to communicate with one or more network entities; and

a processing circuit coupled to the communication circuit, the processing circuit configured to:

register to a network;

obtain at least a user plane key shared with a user plane network function implemented at a first network node or a control plane key shared with a control plane network function implemented at a second network node;

protect a data packet with the user plane key or a control packet with the control plane key, wherein the data packet includes first destination information indicating that the data packet is to be processed at the first network node, the first destination information enabling a network access node to forward the data packet to the first network node, and wherein the control packet includes second destination information indicating that the control packet is to be processed at the second network node, the second destination information enabling the network access node to forward the control packet to the second network node;

transmit the protected data packet or the protected control packet to the network; and

transmit an encrypted client device context to the network, wherein the encrypted client device context includes at least the user plane key or the control plane key, and enables reconstruction of at least a security context at the network for the client device, the security context enabling processing of the protected data packet or the protected control packet at the network.

12. The client device of claim 11 , wherein the processing circuit is further configured to:

receive a packet from the network;

determine whether the received packet includes data or control information; and

decode the received packet with the user plane key or the control plane key based on the determination.

13. The client device of claim 12 , wherein the processing circuit configured to decode the received packet is further configured to:

decrypt and verify the received packet with the user plane key or the control plane key.

14. The client device of claim 13 , wherein the processing circuit configured to verify the received packet is further configured to:

determine a first message authentication code by applying a message authentication code generation algorithm based on the received packet and either the user plane key or the control plane key; and

compare the first message authentication code to a second message authentication code associated with the received packet.

15. The client device of claim 11 , wherein the processing circuit is further configured to:

obtain at least one of a user plane security context indicating network state information for the client device with respect to a user plane, or a control plane security context indicating network state information for the client device with respect to a control plane.