Medium access control security
Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a user equipment (UE) may transmit to a base station (BS), information indicating a medium access control (MAC) security capability of the UE. The UE may receive from the BS, a communication that includes an indication of a MAC security configuration for communications between the UE and the BS. The indication of the MAC security configuration may be based at least in part on the MAC security capability of the UE. Numerous other aspects are provided.
1. A method of wireless communication performed by a user equipment (UE), comprising:
transmitting, to a base station (BS), information indicating a medium access control (MAC) security capability of the UE;
receiving, from the BS, a communication that includes an indication of a MAC security configuration for communications between the UE and the BS,
wherein the indication of the MAC security configuration is based at least in part on the MAC security capability of the UE;
generating a distributed unit (DU) key from a BS key based at least in part on the communication, wherein the DU key is associated with a DU of the BS and the BS key is associated with a central unit (CU) of the BS;
generating a MAC encryption key and a MAC integrity key from the DU key; and
using the MAC encryption key or the MAC integrity key to communicate with the BS.
2. The method of claim 1 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for an entire MAC protocol data unit (PDU) transmitted between the UE and the BS,
an indication that MAC security is to be used for all MAC sub-PDUs, included in the MAC PDU, that include a MAC control element (MAC-CE), or
an indication that MAC security is to be used for a subset of the MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE.
3. The method of claim 1 , wherein the communication includes one or more parameters unique to the DU; and
wherein generating the DU key further comprises:
generating, based at least in part on the one or more parameters unique to the DU, the DU key.
4. The method of claim 3 , wherein the one or more parameters unique to the DU comprises at least one of:
a physical cell identifier (PCI) associated with the DU,
a random number that is randomly generated by the DU, or
an alphanumeric string.
5. The method of claim 3 , further comprising:
generating, based at least in part on the DU key, at least one of:
a radio resource control (RRC) encryption key associated with the DU,
an RRC integrity key associated with the DU,
a DU encryption key associated with the DU, or
a DU integrity key associated with the DU.
6. The method of claim 3 , further comprising:
generating, based at least in part on the DU key:
a DU encryption key associated with the DU, and
a DU integrity key associated with the DU; and
at least one of:
decrypting a radio resource control (RRC) communication, received from the DU, based at least in part on a decryption algorithm in which the DU encryption key and an RRC input parameter are used,
encrypting an RRC communication, to be transmitted to the DU, based at least in part on an encryption algorithm in which the DU encryption key and the RRC input parameter are used,
decrypting a MAC protocol data unit (PDU) communication, received from the DU, based at least in part on a decryption algorithm in which the DU encryption key and a MAC input parameter are used, or
encrypting a MAC PDU communication, to be transmitted to the DU, based at least in part on an encryption algorithm in which the DU encryption key and the MAC input parameter are used.
7. The method of claim 1 , further comprising:
receiving, from the BS, a MAC protocol data unit (PDU);
identifying a MAC security control element (CE) included in the MAC PDU; and
identifying, based at least in part on the MAC security configuration, information, associated with MAC security of the MAC PDU, included in the MAC security CE.
8. The method of claim 7 , wherein the information associated with the MAC security of the MAC PDU comprises:
a MAC security sequence number associated with the MAC PDU.
9. The method of claim 7 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a quantity of all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE, and
an indication of a combined length of all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE.
10. The method of claim 7 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for an entire MAC PDU transmitted between the UE and the BS; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a length of the MAC PDU.
11. The method of claim 7 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for a subset of MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a quantity of MAC sub-PDUs included in the subset of MAC sub-PDUs, and
an indication of a respective length of each MAC sub-PDU included in the subset of MAC sub-PDUs.
12. The method of claim 1 , further comprising:
generating, for transmission to the BS, a MAC protocol data unit (PDU); and
configuring, based at least in part on the MAC security configuration, a MAC security control element (CE) included in the MAC PDU,
wherein the MAC security CE includes information associated with MAC security of the MAC PDU.
13. The method of claim 12 , wherein the information associated with the MAC security of the MAC PDU comprises:
a MAC security sequence number associated with the MAC PDU.
14. The method of claim 12 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a quantity of all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE, and
an indication of a combined length of all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE.
15. The method of claim 12 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for an entire MAC PDU transmitted between the UE and the BS; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a length of the MAC PDU.
16. The method of claim 12 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for a subset of MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a quantity of MAC sub-PDUs included in subset of the MAC sub-PDUs, and
an indication of a respective length of each MAC sub-PDU included in the subset of MAC sub-PDUs.
17. A method of wireless communication performed by a base station (BS), comprising:
receiving, from a user equipment (UE), information indicating a medium access control (MAC) security capability of the UE;
transmitting, to the UE, a communication that includes an indication of a MAC security configuration for communications between the UE and the BS,
wherein the indication of the MAC security configuration is based at least in part on the MAC security capability of the UE;
generating a distributed unit (DU) key from a BS key based at least in part on the communication, wherein the DU key is associated with a DU of the BS and the BS key is associated with a central unit (CU) of the BS;
generating a MAC encryption key and a MAC integrity key from the DU key; and
using the MAC encryption key or the MAC integrity key to communicate with the UE.
18. The method of claim 17 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for an entire MAC protocol data unit (PDU) transmitted between the UE and the BS,
an indication that MAC security is to be used for all MAC sub-PDUs, included in the MAC PDU, that include a MAC control element (MAC-CE), or
an indication that MAC security is to be used for a subset of the MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE.
19. The method of claim 17 , wherein the communication includes one or more parameters unique to the DU; and
wherein generating the DU key further comprises:
generating, based at least in part on the one or more parameters unique to the DU, the DU key.
20. The method of claim 19 , wherein the one or more parameters unique to the DU comprises at least one of:
a physical cell identifier (PCI) associated with the DU,
a random number that is randomly generated by the DU, or
an alphanumeric string.
21. The method of claim 19 , further comprising:
generating, based at least in part on the DU key, at least one of:
a radio resource control (RRC) encryption key associated with the DU,
an RRC integrity key associated with the DU,
a DU encryption key associated with the DU, or
a DU integrity key associated with the DU.
22. The method of claim 19 , further comprising:
generating, based at least in part on the DU key:
a DU encryption key associated with the DU, and
a DU integrity key associated with the DU; and
at least one of:
decrypting a radio resource control (RRC) communication, received from the DU, based at least in part on a decryption algorithm in which the DU encryption key and an RRC input parameter are used,
encrypting an RRC communication, to be transmitted to the DU, based at least in part on an encryption algorithm in which the DU encryption key and the RRC input parameter are used,
decrypting a MAC protocol data unit (PDU) communication, received from the DU, based at least in part on a decryption algorithm in which the DU encryption key and a MAC input parameter are used, or
encrypting a MAC PDU communication, to be transmitted to the DU, based at least in part on an encryption algorithm in which the DU encryption key and the MAC input parameter are used.
23. The method of claim 17 , further comprising:
receiving, from the UE, a MAC protocol data unit (PDU);
identifying a MAC security control element (CE) included in the MAC PDU; and
identifying, based at least in part on the MAC security configuration, information, associated with MAC security of the MAC PDU, included in the MAC security CE.
24. The method of claim 23 , wherein the information associated with the MAC security of the MAC PDU comprises:
a MAC security sequence number associated with the MAC PDU.
25. The method of claim 23 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a quantity of all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE, and
an indication of a combined length of all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE.
26. The method of claim 23 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for an entire MAC PDU transmitted between the UE and the BS; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a length of the MAC PDU.
27. The method of claim 23 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for a subset of MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a quantity of MAC sub-PDUs included in the subset of MAC sub-PDUs, and
an indication of a respective length of each MAC sub-PDU included in the subset of MAC sub-PDUs.
28. The method of claim 17 , further comprising:
generating, for transmission to the UE, a MAC protocol data unit (PDU); and
configuring, based at least in part on the MAC security configuration, a MAC security control element (CE) included in the MAC PDU,
wherein the MAC security CE includes information associated with MAC security of the MAC PDU.
29. The method of claim 28 , wherein the information associated with the MAC security of the MAC PDU comprises:
a MAC security sequence number associated with the MAC PDU.
30. The method of claim 28 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a quantity of all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE, and
an indication of a combined length of all MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE.
31. The method of claim 28 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for an entire MAC PDU transmitted between the UE and the BS; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a length of the MAC PDU.
32. The method of claim 28 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for a subset of MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE; and
wherein the information associated with the MAC security of the MAC PDU comprises:
an indication of a quantity of MAC sub-PDUs included in the subset of MAC sub-PDUs, and
an indication of a respective length of each MAC sub-PDU included in the subset of MAC sub-PDUs.
33. A user equipment (UE) for wireless communication, comprising:
a memory; and
one or more processors operatively coupled to the memory, the memory and the one or more processors configured to:
transmit, to a base station (BS), information indicating a medium access control (MAC) security capability of the UE;
receive, from the BS, a communication that includes an indication of a MAC security configuration for communications between the UE and the BS,
wherein the indication of the MAC security configuration is based at least in part on the MAC security capability of the UE;
generate a distributed unit (DU) key from a BS key based at least in part on the communication, wherein the DU key is associated with a DU of the BS and the BS key is associated with a central unit (CU) of the BS;
generate a MAC encryption key and a MAC integrity key from the DU key; and
use the MAC encryption key or the MAC integrity key to communicate with the BS.
34. The UE of claim 33 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for an entire MAC protocol data unit (PDU) transmitted between the UE and the BS,
an indication that MAC security is to be used for all MAC sub-PDUs, included in the MAC PDU, that include a MAC control element (MAC-CE), or
an indication that MAC security is to be used for a subset of the MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE.
35. The UE of claim 33 , wherein the communication includes one or more parameters unique to a distributed unit (DU) of the BS; and
wherein the one or more processors are further configured to:
generate, based at least in part on the one or more parameters unique to the DU, a DU key to be used for communications between the UE and the DU.
36. A base station (BS) for wireless communication, comprising:
a memory; and
one or more processors operatively coupled to the memory, the memory and the one or more processors configured to:
receive, from a user equipment (UE), information indicating a medium access control (MAC) security capability of the UE;
transmit, to the UE, a communication that includes an indication of a MAC security configuration for communications between the UE and the BS,
wherein the indication of the MAC security configuration is based at least in part on the MAC security capability of the UE;
generate a distributed unit (DU) key from a BS key based at least in part on the communication, wherein the DU key is associated with a DU of the BS and the BS key is associated with a central unit (CU) of the BS;
generate a MAC encryption key and a MAC integrity key from the DU key; and
use the MAC encryption key or the MAC integrity key to communicate with the UE.
37. The BS of claim 36 , wherein the indication of the MAC security configuration comprises:
an indication that MAC security is to be used for an entire MAC protocol data unit (PDU) transmitted between the UE and the BS,
an indication that MAC security is to be used for all MAC sub-PDUs, included in the MAC PDU, that include a MAC control element (MAC-CE), or
an indication that MAC security is to be used for a subset of the MAC sub-PDUs, included in the MAC PDU, that include a MAC-CE.
38. The BS of claim 36 , wherein the communication includes one or more parameters unique to the DU; and
wherein the one or more processors are further configured to:
generate, based at least in part on the one or more parameters unique to the DU, the DU key.