User equipment key derivation at mobility update in mobile communications
Examples pertaining to user equipment (UE) key derivation at mobility update in mobile communications are described. An apparatus implemented in a UE conducts a registration with a first Access and Mobility Management Function (AMF) of a network. The apparatus also conducts one other registration with a second AMF of the network over a 3 rd Generation Partnership Project (3 GPP) access. In response, the apparatus receives a request from the second AMF over the 3 GPP access. The apparatus then performs a key derivation to generate a derived key using a keying material from the initial registration with the first AMF to result in the UE and the second AMF sharing a common security context for the 3 GPP access and a non-3 GPP access.
1. A method implementable in mobile communications, comprising:
conducting, by a processor of an apparatus implemented in a user equipment (UE), a registration with a first Access and Mobility Management Function (AMF) of a network;
conducting, by the processor, one other registration with a second AMF of the network over a 3 rd Generation Partnership Project (3GPP) access;
receiving, by the processor, a request from the second AMF over the 3GPP access; and
performing, by the processor, a key derivation to generate a derived key (K′ AMF ) using a keying material from the registration with the first AMF to result in the UE and the second AMF sharing a common security context for the 3GPP access and a non-3GPP access,
wherein the UE used a common security context for the 3GPP access and the non-3GPP access with the first AMF.
2. The method of claim 1 , wherein the performing of the key derivation comprises deriving the K′ AMF for the 3GPP access and using the K′ AMF for the non-3GPP access with respect to the second AMF.
3. The method of claim 1 , wherein the performing of the key derivation comprises deriving the K′ AMF for the 3GPP access and the non-3GPP access with respect to the second AMF based on a current common security context.
4. The method of claim 1 , wherein the receiving of the request comprises receiving a SECURITY MODE COMMAND message indicating that the key derivation is required.
5. The method of claim 4 , wherein the performing of the key derivation comprises deriving the K′ AMF to be used with the second AMF for 3GPP and non-3GPP accesses.
6. The method of claim 1 , wherein the conducting of the registration with the first AMF comprises registering to the first AMF over at least one of the 3GPP access and the non-3GPP access.
7. The method of claim 1 , wherein the conducting of the other registration with the second AMF comprises registering to the second AMF over the 3GPP access.
8. The method of claim 1 , wherein the conducting of the other registration with the second AMF comprises:
detecting a movement from a first location associated with the first AMF to a second location associated with the second AMF; and
performing a MOBILITY REGISTRATION procedure responsive to the detecting of the movement.
9. The method of claim 8 , wherein the performing of the MOBILITY REGISTRATION procedure comprises:
performing, using a common security context from the first AMF, integrity protection of an initial Non-Access Stratum (NAS) message for the second AMF; and
transmitting the NAS message to the second AMF using a Globally Unique Temporary Identity (GUTI) of the UE from the first AMF.
10. A method implementable in mobile communications, comprising:
conducting, by a processor of an apparatus implemented in a user equipment (UE), a registration with a second Access and Mobility Management Function (AMF) of a network over a 3 rd Generation Partnership Project (3GPP) access; and
performing, by the processor, a key derivation to generate a derived key (K′ AMF ) using a keying material from an initial registration with a first AMF to result in the UE and the second AMF sharing a common security context for the 3GPP access and a non-3GPP access,
wherein the UE used a common security context for the 3GPP access and the non-3GPP access with the first AMF.
11. The method of claim 10 , wherein the performing of the key derivation comprises deriving the K′ AMF for the 3GPP access and using the K′ AMF for the non-3GPP access with respect to the second AMF.
12. The method of claim 10 , wherein the performing of the key derivation comprises deriving the K′ AMF for the 3GPP access and the non-3GPP access with respect to the second AMF based on a current common security context.
13. The method of claim 10 , wherein the performing of the key derivation comprises:
receiving a request from the second AMF over the 3GPP access; and
performing the key derivation responsive to receiving the request.
14. The method of claim 13 , wherein the receiving of the request comprises receiving a SECURITY MODE COMMAND message indicating that the key derivation is required.
15. The method of claim 14 , wherein the performing of the key derivation comprises deriving the K′ AMF to be used for the non-3GPP access and the 3GPP access with the second AMF.
16. The method of claim 10 , wherein the conducting of the registration with the second AMF comprises:
detecting a movement from a first location associated with the first AMF to a second location associated with the second AMF; and
performing a MOBILITY REGISTRATION procedure responsive to the detecting of the movement.
17. The method of claim 16 , wherein the performing of the MOBILITY REGISTRATION procedure comprises:
performing, using a common security context from the first AMF, integrity protection of an initial Non-Access Stratum (NAS) message for the second AMF; and
transmitting the NAS message to the second AMF using a Globally Unique Temporary Identity (GUTI) of the UE from the first AMF.
18. An apparatus implemented as a first user equipment (UE), comprising:
a transceiver configured to wirelessly communicate with a wireless network; and
a processor coupled to the communication device and configured to perform operations comprising:
conducting, via the transceiver, a registration with a second Access and Mobility Management Function (AMF) of a network over a 3 rd Generation Partnership Project (3GPP) access; and
performing a key derivation to generate a derived key (K′ AMF ) using a keying material from an initial registration with a first AMF to result in the UE and the second AMF sharing a common security context for the 3GPP access and a non-3GPP access,
wherein the UE used a common security context for the 3GPP access and the non-3GPP access with the first AMF, and
wherein, in performing the key derivation, the processor is configured to derive the K′ AMF to be used for the non-3GPP access and the 3GPP access with the second AMF.
19. The apparatus of claim 18 , wherein, in performing the key derivation, the processor is configured to derive the K′ AMF and using the K′ AMF for the non-3GPP access and for the 3GPP access with respect to the second AMF.
20. The apparatus of claim 18 , wherein the UE used a common security context for the 3GPP access and the non-3GPP access with the first AMF, and wherein, in performing the key derivation, the processor is configured to perform operations comprising:
receiving a request from the second AMF over the 3GPP access; and
performing the key derivation to derive the K′ AMF responsive to receiving the request and taking it in use for 3GPP access and for non-3GPP access,
wherein the request comprises a SECURITY MODE CONTROL command indicating that the key derivation is required.