5G broadcast/multicast security

1. An apparatus for wireless communication, comprising:

a memory, and

at least one processor coupled to the memory and configured to:

transmit, from a user equipment (UE), a data session establishment request to a service management function (SMF) for a multicast or broadcast service;

receive at least one multicast-broadcast key for the data session from the SMF that generated the at least one multicast-broadcast key via non-access stratum (NAS) signaling;

determine a radio bearer (RB) configuration for the multicast or broadcast service;

receive one or more quality of service (QoS) flow packets for the multicast or broadcast service over the RB; and

decode the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key, wherein decoding includes decrypting, verifying an integrity, or a combination thereof.

2. The apparatus of claim 1 , wherein the at least one processor is configured to decode encoded QoS flow packets from a packet data convergence protocol (PDCP) layer.

3. The apparatus of claim 1 , wherein the at least one processor is configured to:

transmit a UE capability message indicating one or more security algorithms; and

receive a security policy, via NAS signaling, indicating one or more selected security algorithms for the decoding.

4. The apparatus of claim 3 , wherein the at least one processor is configured to:

change the UE from a first cell to a second cell; and

decode the one or more QoS flow packets from the second cell without changing the at least one multicast-broadcast key.

5. The apparatus of claim 1 , wherein the data session includes one or more QoS flows, each QoS flow being associated with a unique multicast-broadcast key of the at least one multicast-broadcast key.

6. The apparatus of claim 1 , wherein the data session establishment request includes an indication of a type of service or a domain name indicating a multicast or broadcast service.

7. The apparatus of claim 1 , wherein the data session is a protocol data unit (PDU) session.

8. An apparatus for wireless communication, comprising:

a memory, and

at least one processor coupled to the memory and configured to:

transmit, from a user equipment (UE), a data session establishment request to a service management function (SMF) for a multicast or broadcast service;

receive at least one multicast-broadcast key for the data session, wherein to receive the at least one multicast broadcast key, the processor is configured to:

receive a root key generated by the SMF via NAS signaling; and

derive a cell-specific multicast-broadcast key for a cell of an access network node based on the root key;

determine a radio bearer (RB) configuration for the multicast or broadcast service;

receive one or more quality of service (QoS) flow packets for the multicast or broadcast service over the RB; and

decode the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key, wherein decoding includes decrypting, verifying an integrity, or a combination thereof.

9. The apparatus of claim 8 , wherein the at least one processor is configured to decode the one or more QoS flow packets at a packet data convergence protocol (PDCP) layer using the cell-specific multicast-broadcast key.

10. The apparatus of claim 8 , wherein the at least one processor is configured to:

transmit a UE capability message indicating one or more security algorithms; and

receive a security policy, via RRC signaling, indicating a selected security algorithm for the decoding.

11. The apparatus of claim 8 , wherein the at least one processor is configured to:

change the UE from a first cell to a second cell;

derive a cell-specific multicast-broadcast key for the second cell; and

decode the one or more QoS flow packets from the second cell with the cell-specific multicast-broadcast key for the second cell.

12. An apparatus for wireless communication, comprising:

a memory, and

at least one processor coupled to the memory and configured to:

transmit, from a user equipment (UE), a data session establishment request to a service management function (SMF) for a multicast or broadcast service;

receive at least one multicast-broadcast key for the data session from an access network node that generated the at least one multicast-broadcast key via RRC signaling;

determine a radio bearer (RB) configuration for the multicast or broadcast service;

receive one or more quality of service (QoS) flow packets for the multicast or broadcast service over the RB; and

decode the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key, wherein decoding includes decrypting, verifying an integrity, or a combination thereof.

13. The apparatus of claim 12 , wherein the at least one processor is configured to decode the one or more QoS flow packets at a packet data convergence protocol (PDCP) layer using the at least one multicast-broadcast key.

14. The apparatus of claim 12 , wherein the at least one processor is configured to:

transmit a UE capability message indicating one or more security algorithms; and

receive a security policy, via RRC signaling, indicating a selected security algorithm for the decoding.

15. The apparatus of claim 12 , wherein the at least one processor is configured to:

change the UE from a first cell to a second cell;

receive a new cell-specific multicast-broadcast key from the second cell; and

decode the one or more QoS flow packets from the second cell with the new cell-specific multicast-broadcast key for the second cell.

16. A method of wireless communication, comprising:

transmitting, from a user equipment (UE), a data session establishment request to a service management function (SMF) for a multicast or broadcast service;

receiving at least one multicast-broadcast key for the data session, wherein receiving the at least one multicast-broadcast key for the data session comprises receiving the at least one multicast-broadcast key from the SMF that generated the at least one multicast-broadcast key via NAS signaling;

determining a radio bearer (RB) configuration for the multicast or broadcast service;

receiving one or more quality of service (QoS) flow packets for the multicast or broadcast service over the RB; and

decoding the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key, wherein decoding includes decrypting, verifying an integrity, or a combination thereof.

17. The method of claim 16 , further comprising decoding encoded QoS flow packets from a packet data convergence protocol (PDCP) layer.

18. The method of claim 16 , further comprising:

transmitting a UE capability message indicating one or more security algorithms; and

receiving a security policy, via NAS signaling, indicating one or more selected security algorithms for the decoding.

19. The method of claim 18 , further comprising:

changing the UE from a first cell to a second cell; and

decoding the one or more QoS flow packets from the second cell without changing the at least one multicast-broadcast key.

20. The method of claim 16 , wherein the data session includes one or more QoS flows, each QoS flow being associated with a unique multicast-broadcast key of the at least one multicast-broadcast key.

21. The method of claim 16 , wherein the data session establishment request includes an indication of a type of service or a domain name indicating a multicast or broadcast service.

22. The method of claim 16 , wherein the data session is a protocol data unit (PDU) session.

23. A method of wireless communication, comprising:

transmitting, from a user equipment (UE), a data session establishment request to a service management function (SMF) for a multicast or broadcast service;

 receiving at least one multicast-broadcast key for the data session, wherein receiving the at least one multicast-broadcast key for the data session comprises:

receiving a root key generated by the SMF via NAS signaling; and

deriving a cell-specific multicast-broadcast key for a cell of an access network node based on the root key;

determining a radio bearer (RB) configuration for the multicast or broadcast service;

receiving one or more quality of service (QoS) flow packets for the multicast or broadcast service over the RB; and

decoding the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key, wherein decoding includes decrypting, verifying an integrity, or a combination thereof.

24. A method of wireless communication, comprising:

transmitting, from a user equipment (UE), a data session establishment request to a service management function (SMF) for a multicast or broadcast service;

receiving at least one multicast-broadcast key for the data session, wherein receiving the at least one multicast-broadcast key for the data session comprises receiving the at least one multicast-broadcast key from an access network node that generated the at least one multicast-broadcast key via RRC signaling;

determining a radio bearer (RB) configuration for the multicast or broadcast service;

receiving one or more quality of service (QoS) flow packets for the multicast or broadcast service over the RB; and

decoding the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key, wherein decoding includes decrypting, verifying an integrity, or a combination thereof.