Incorrect KSI handling in mobile communications

1. A method, comprising:

receiving, by a processor of an apparatus implemented in a user equipment (UE), from a 5 th Generation (5G) wireless network a non-access stratum (NAS) authentication challenge after the processor having completed an authentication and key agreement (AKA) procedure with the wireless network;

detecting, by the processor, a failure in the NAS authentication challenge, wherein the failure comprises a key set identifier (KSI) for Next Generation Radio Access Network (ngKSI) received in the authentication challenge being already in use in the UE; and

rejecting, by the processor, the NAS authentication challenge responsive to detecting the failure by transmitting to the wireless network a response indicating that the ngKSI is already in use.

2. The method of claim 1 , further comprising:

storing, by the processor, one or more parameters associated with the NAS authentication challenge despite a first ngKSI in the authentication challenge being incorrect or already in use,

wherein the one or more parameters comprise optional information elements.

3. The method of claim 2 , further comprising:

receiving, by the processor, from the wireless network a subsequent NAS authentication challenge with a second KSI different than the first KSI; and

performing, by the processor, a new AKA procedure responsive to receiving the subsequent NAS authentication challenge with the second KSI.

4. A method, comprising:

receiving, by a processor of an apparatus implemented in a user equipment (UE), from a 5 th Generation (5G) wireless network a non-access stratum (NAS) authentication challenge after the processor having completed an authentication and key agreement (AKA) procedure with the wireless network;

detecting, by the processor, a failure in the NAS authentication challenge; and

accepting, by the processor, the authentication challenge,

wherein the detecting of the failure in the NAS authentication challenge comprises detecting that a key set identifier (KSI) for Next Generation Radio Access Network (ngKSI) in the authentication challenge is incorrect.

5. The method of claim 4 , wherein the accepting of the authentication challenge comprises:

clearing an existing ngKSI and a related security context;

accepting an overlapping ngKSI provided by an Access and Mobility management Function (AMF); and

transmitting an authentication response to the wireless network.

6. The method of claim 5 , wherein the accepting of the NAS authentication challenge further comprises performing a security mode control (SMC) procedure with the wireless network with a new security context.

7. The method of claim 4 , wherein the accepting of the NAS authentication challenge comprises rejecting an upcoming security mode control (SMC) procedure with the wireless network by transmitting to the wireless network a response with a cause value indicating rejection of the upcoming SMC procedure.

8. A method, comprising:

receiving, by a processor of an apparatus implemented in a user equipment (UE), from a 5 th Generation (5G) wireless network a non-access stratum (NAS) authentication challenge after the processor having completed an authentication and key agreement (AKA) procedure with the wireless network;

detecting, by the processor, a failure in the NAS authentication challenge, wherein the failure comprises a key set identifier (KSI) for Next Generation Radio Access Network (ngKSI) received in the authentication challenge being already in use in the UE; and

handling, by the processor, the failure in the authentication challenge,

wherein the handling of the failure in the NAS authentication challenge comprises rejecting the authentication challenge by transmitting to the wireless network a response indicating that the ngKSI is already in use.

9. The method of claim 8 , wherein the handling of the failure in the authentication challenge comprises rejecting the NAS authentication challenge by transmitting to the wireless network a response to indicate authentication failure, and wherein the response comprises a cause value indicating that a first ngKSI in the NAS authentication challenge is incorrect or that the first ngKSI is already in use.

10. The method of claim 9 , wherein the handling of the failure in the NAS authentication challenge further comprises:

storing one or more parameters associated with the NAS authentication challenge despite the first ngKSI in the NAS authentication challenge being incorrect or already in use,

wherein the one or more parameters comprise optional information elements.

11. The method of claim 10 , wherein the handling of the failure in the authentication challenge further comprises:

receiving from the wireless network a subsequent NAS authentication challenge with a second ngKSI different than the first ngKSI; and

performing a new AKA procedure responsive to receiving the subsequent NAS authentication challenge with the second ngKSI.

12. The method of claim 8 , wherein the handling of the failure in the NAS authentication challenge comprises transmitting to the wireless network a response to the authentication challenge with 5th-Generation Mobility Management (SGMM) status having an existing cause value or a new cause value indicating that a ngKSI in the NAS authentication challenge is incorrect, that the ngKSI is already in use or that a security context is invalid.

13. The method of claim 8 , wherein the handling of the failure in the authentication challenge comprises:

aborting a procedure that triggered the NAS authentication challenge;

deleting a current security context; and

performing either:

restarting the procedure that triggered the NAS authentication challenge; or

initiating a registration procedure with an indication to the wireless network that no key is available.

14. The method of claim 8 , wherein the handling of the failure in the NAS authentication challenge comprises accepting the NAS authentication challenge.

15. The method of claim 14 , wherein the accepting of the NAS authentication challenge comprises:

clearing an existing ngKSI and a related security context;

accepting an overlapping ngKSI provided by an Access and Mobility management Function (AMF); and

transmitting an authentication response to the wireless network.

16. The method of claim 15 , wherein the accepting of the NAS authentication challenge further comprises performing a security mode control (SMC) procedure with the wireless network with a new security context.

17. The method of claim 14 , wherein the accepting of the NAS authentication challenge comprises rejecting an upcoming security mode control (SMC) procedure with the wireless network by transmitting to the wireless network a response with a cause value indicating rejection of the upcoming SMC procedure.