Methods and apparatus for secure access control in wireless communications

1. A method for wireless communications, performed by a wireless transmit/receive unit (WTRU) the method comprising:

sending, to a network entity, a first registration request via a first closed access group (CAG) cell, the first registration request indicating a capability for CAG;

receiving a registration reject message having new CAG identifier (CAG-ID) information;

selecting a second CAG cell based on the new CAG-ID information; and

sending, to the network entity, a second registration request via the selected second CAG cell.

2. The method of claim 1 , further comprising updating stored CAG-ID information with the new CAG-ID information.

3. The method of claim 2 , wherein updating comprises removing the stored CAG-ID information and adding the new CAG-ID information.

4. The method of claim 2 , wherein updating the stored CAG-ID information with the new CAG-ID information is performed on condition that the received registration reject message is integrity protected.

5. The method of claim 1 , wherein receiving a registration reject message having new CAG-ID information comprises receiving the registration reject message as integrity protected.

6. The method of claim 1 , wherein receiving a registration reject message having new CAG-ID information comprises receiving new CAG-ID information from an access and mobility management function.

7. The method of claim 1 , further comprising, before the sending of the first registration request:

identifying a first set of hashed identifiers, IDs, and a first random number based on received system information, wherein each ID of the first set of hashed IDs is individually hashed using at least the first random number;

calculating a first hash value for each ID of a second set of IDs using at least the first random number; and

determining whether at least a hashed ID of the second set of IDs matches a hashed ID of the first set of hashed IDs.

8. The method of claim 7 , further comprising:

calculating a second hash value, using at least a second random number, for at least an ID associated with a hashed ID of the second set of IDs that matches a hashed ID of the first set of hashed IDs, based on the determination that at least a hashed ID of the second set of IDs matches a hashed ID of the first set of IDs, wherein the first registration request is a message comprising any of: information of the second random number, and the ID hashed by the second random number.

9. The method of claim 8 , wherein the second hash value is calculated using the second random number and a wireless transmit/receive unit, WTRU, ID assigned by a network.

10. The method of claim 7 , wherein the first set of hashed IDs comprises one or more hashed CAG-IDs and wherein the second set of IDs comprises one or more pre-configured allowed CAG-IDs.

11. A wireless transmit/receive unit (WTRU) comprising circuitry, including a transmitter, a receiver, a processor, and memory, the WTRU configured to:

send, to a network entity, a first registration request via a first closed access group (CAG) cell, wherein the first registration request indicates a capability for CAG;

receive a registration reject message having new CAG identifier (CAG-ID) information;

select a second CAG cell based on the new CAG-ID information; and

send, to the network entity, a second registration request via the selected CAG cell.

12. The WTRU of claim 11 , wherein the WTRU is further configured to update stored CAG-ID information with the new CAG-ID information.

13. The WTRU of claim 12 , wherein the WTRU update of the stored CAG-ID information comprises removing the stored CAG-ID information and adding the new CAG-ID information.

14. The WTRU of claim 12 , wherein the WTRU update of the stored CAG-ID information is performed on condition that the received registration message is integrity protected.

15. The WTRU of claim 11 , wherein the WTRU is configured to receive an integrity protected registration reject message.

16. The WTRU of claim 11 , wherein the WTRU is configured to receive the registration reject message from an access and mobility management function.

17. The WTRU of claim 11 , wherein the WTRU is further configured, before the sending of the first registration request, to:

identify a first set of hashed identifiers, IDs, and a first random number based on received system information, wherein each ID of the first set of hashed IDs is individually hashed using at least the first random number;

calculate a first hash value for each ID of a second set of IDs using at least the first random number;

determine whether at least a hashed ID of the second set of IDs matches a hashed ID of the first set of hashed IDs; and

calculate a second hash value, using at least a second random number, for at least an ID associated with a hashed ID of the second set of IDs that matches a hashed ID of the first set of hashed IDs, based on the determination that at least a hashed ID of the second set of IDs matches a hashed ID of the first set of IDs, wherein the first registration request is a message comprising any of: information of the second random number, and the ID hashed by the second random number.

18. The WTRU of claim 17 , wherein the second hash value is calculated using the second random number and a wireless transmit/receive unit, WTRU, ID assigned by a network.

19. The WTRU of claim 17 , wherein the first set of hashed IDs comprises one or more hashed CAG-IDs and wherein the second set of IDs comprises one or more pre-configured allowed CAG-IDs.

20. A non-transient computer-readable storage device having instructions thereon, which when executed by a computer, performs a method comprising:

sending, to a network entity, a first registration request via a first closed access group (CAG) cell, the first registration request indicating a capability for CAG;

receiving a registration reject message having new CAG identifier (CAG-ID) information;

selecting a second CAG cell based on the new CAG-ID information; and

sending, to the network entity, a second registration request via the selected second CAG cell.