Apparatuses and methods for protection of an initial non-access stratum (NAS) message
A User Equipment (UE) including a wireless transceiver and a controller is provided. The wireless transceiver performs wireless transmission and reception to and from a service network. The controller transitions the UE from a Radio Resource Control (RRC) idle state to an RRC connected state, and after transitioning the UE from the RRC idle state to the RRC connected state, sends an initial Non-Access Stratum (NAS) message comprising a limited set of Information Elements (IEs) in cleartext, which are required to establish security between the UE and the service network, and a container IE carrying an initial NAS message Protocol Data Unit (PDU) ciphered with NAS security context to the service network via the wireless transceiver.
1. A User Equipment (UE), comprising:
a wireless transceiver, configured to perform wireless transmission and reception to and from a service network; and
a controller, configured to transition the UE from a Radio Resource Control (RRC) idle state to an RRC connected state, and after transitioning the UE from the RRC idle state to the RRC connected state, send an initial Non-Access Stratum (NAS) message comprising a limited set of Information Elements (IEs) in cleartext, which are required to establish security between the UE and the service network, and a container IE carrying an initial NAS message Protocol Data Unit (PDU) ciphered with NAS security context to the service network via the wireless transceiver.
2. The UE of claim 1 , wherein the initial NAS message PDU comprises the limited set of IEs and all other IEs defined for the initial NAS message.
3. The UE of claim 1 , wherein the initial NAS message is included in a NAS Security Mode Complete message, and after transitioning the UE from the RRC idle state to the RRC connected state and prior to sending the initial NAS message, the controller is further configured to send another initial NAS message comprising only the limited set of IEs in cleartext to the service network via the wireless transceiver in response to the UE not having the NAS security context.
4. The UE of claim 1 , wherein the initial NAS message is sent prior to a NAS security mode control procedure in response to the UE having the NAS security context, or the initial NAS message is included in a NAS Security Mode Complete message in response to receiving a NAS Security Mode Command requesting the UE to send an initial NAS message.
5. The UE of claim 1 , wherein the initial NAS message has a security header type indicating that the initial NAS message is integrity protected and partially ciphered.
6. The UE of claim 1 , wherein the initial NAS message has a 5G System (5GS) NAS message type indicating that the initial NAS message is a partially ciphered 5GS NAS message.
7. The UE of claim 1 , wherein the initial NAS message is a Registration Request message or a Service Request message for a 5G system.
8. A method for protection of an initial Non-Access Stratum (NAS) message, executed by a UE communicatively connected to a service network, the method comprising:
transitioning the UE from a Radio Resource Control (RRC) idle state to an RRC connected state; and
after transitioning the UE from the RRC idle state to the RRC connected state, sending an initial NAS message comprising a limited set of Information Elements (IEs) in cleartext, which are required to establish security between the UE and the service network, and a container IE carrying an initial NAS message Protocol Data Unit (PDU) ciphered with NAS security context to the service network.
9. The method of claim 8 , wherein the initial NAS message PDU comprises the limited set of IEs and all other IEs defined for the initial NAS message.
10. The method of claim 8 , wherein the initial NAS message is included in a NAS Security Mode Complete message, and the method further comprises:
after transitioning the UE from the RRC idle state to the RRC connected state and prior to sending the initial NAS message, sending another initial NAS message comprising only the limited set of IEs in cleartext to the service network in response to the UE not having the NAS security context.
11. The method of claim 8 , wherein the initial NAS message is sent prior to a NAS security mode control procedure in response to the UE having the NAS security context, or the initial NAS message is included in a NAS Security Mode Complete message in response to receiving a NAS Security Mode Command requesting the UE to send an initial NAS message.
12. The method of claim 8 , wherein the initial NAS message has a security header type indicating that the initial NAS message is integrity protected and partially ciphered.
13. The method of claim 8 , wherein the initial NAS message has a 5G System (5GS) NAS message type indicating that the initial NAS message is a partially ciphered 5GS NAS message.
14. The method of claim 8 , wherein the initial NAS message is a Registration Request message or a Service Request message for a 5G system.