Security context handling in 5G during idle mode
The present disclosure relates to methods and apparatus for flexible, security context management during AMF changes. One aspect of the disclosure is a mechanism for achieving backward security during AMF changes in idle mode. Instead of passing the current NAS key to the target AMF, the source AMF derives a new NAS key, provides the new NAS key to the target AMF, along with a key change indication indicating that the NAS key has changed. The target AMF sends the key change indication to the user equipment.
1. A method for transferring a security context of a user equipment during an idle mode, the method implemented by one or more core network nodes in a core network of the wireless communication network, wherein the one or more core network nodes provide a target Access and Mobility Management Function, the method comprising:
receiving, from the user equipment, a registration message indicating a mobility management function change;
requesting a security context for the user equipment from a source Access and Mobility Management Function in the core network of the wireless communication network;
receiving from the source Access and Mobility Management Function, responsive to the request, a new non-access stratum key and a key change indication indicating the non-access stratum key has been changed; and
sending the key change indication to the user equipment.
2. The method of claim 1 further comprising establishing a new security context including the new non-access stratum key.
3. The method of claim 2 wherein establishing a new security context comprises, in part, selecting one or more security algorithms.
4. The method of claim 3 wherein at least one of the security algorithms is selected based on user equipment capability information.
5. The method of claim 4 wherein the key change indication is received in a context request response message.
6. The method of claim 3 further comprising sending the user equipment a security algorithm parameter indicating at least one security algorithm for the new security context.
7. The method of claim 1 further comprising receiving one or more security parameters from the source Access and Mobility Management Function.
8. The method of claim 7 wherein the one or more security parameters include user equipment capability information.
9. The method of claim 7 wherein the security parameters are received along with the key change indication.
10. The method of claim 1 wherein the key change indication is sent to the user equipment in a security establishment message.
11. The method of claim 1 wherein the non-access stratum key comprises a core network key (KcN).
12. A non-transitory computer-readable storage medium containing a computer program comprising executable instructions that, when executed by a processing circuit in a target Access and Mobility Management Function in a core network of a wireless communication network causes the target Access and Mobility Management Function to perform the methods of claim 1 .
13. A core network node in a core network of a wireless communication network, said core network node providing a target Access and Mobility Management Function, said core network node comprising:
an interface circuit for communicating with a user equipment and a source Access and Mobility Management Function in a core network of the wireless communication network;
a processing circuit configured to:
receive, from the user equipment, a registration message indicating a mobility management function change;
request a security context from the source Access and Mobility Management Function;
receive from the source Access and Mobility Management Function, responsive to the request, a new non-access stratum key and a key change indication indicating the non-access stratum key has been changed; and
send the key change indication to the user equipment.
14. The core network node of claim 13 wherein the processing circuit is further configured to establish a new security context including the new non-access stratum key.
15. The core network node of claim 14 wherein the processing circuit is further configured to select one or more security algorithms as part of the new security context.
16. The core network node of claim 15 wherein the processing circuit is further configured to select at least one of the security algorithms depending on the user equipment capability information.
17. The core network node of claim 15 wherein the processing circuit is further configured to send the user equipment a security algorithm parameter indicating at least one security algorithm for the new security context.
18. The core network node of claim 13 wherein the processing circuit is further configured to receive one or more security parameters from the source Access and Mobility Management Function.
19. The core network node of claim 18 wherein the one or more security parameters include user equipment capability information.
20. The core network node of claim 18 wherein the processing circuit is further configured to receive the security parameters along with the key change indication.
21. The core network node of claim 13 wherein the key change indication is received in a context request response message.
22. The core network node of claim 13 wherein the processing circuit is further configured to send the key change to the user equipment in a security establishment message.
23. The core network node of claim 13 wherein the non-access stratum key comprises a core network key (KcN).