Security protection method and apparatus in wireless communication system

1. A method of performing a security mode control procedure by a user equipment (UE), the method comprising:

registering to an access and mobility management function (AMF) and a public land mobile network (PLMN) over a 3rd generation partnership project (3GPP) access;

registering to the AMF and the PLMN over a non-3GPP access;

performing, over the 3GPP access, a first authentication procedure and a first key agreement procedure with the AMF, wherein a key set identifier (ngKSI) is changed from a first ngKSI to a second ngKSI during the first authentication procedure and the first key agreement procedure, the second ngKSI corresponds to new security context; and

in response to performing the first authentication procedure and the first key agreement procedure with the AMF over the 3GPP access:

receiving, from the AMF over the 3GPP access, a first security mode command message including the second ngKSI, and

receiving, from the AMF over a non-3GPP access, a second security mode command message including the second ngKSI.

2. The method of claim 1 , wherein the second ngKSI corresponds to the new security context changed based on the first authentication procedure and the first key agreement procedure.

3. The method of claim 1 , further comprising:

transmitting, to the AMF, a first security mode complete message in response to the first security mode command message; and

transmitting, to the AMF, a second security mode complete message in response to the second security mode command message.

4. The method of claim 1 , further comprising:

performing, over the non-3GPP access, a second authentication procedure and a second key agreement procedure with the AMF, wherein the second ngKSI is changed to a third ngKSI during the second authentication procedure and the second key agreement procedure; and

in response to performing the second authentication procedure and the second key agreement procedure with the AMF over the non-3GPP access:

receiving, from the AMF over the non-3GPP access, a third security mode command message including the third ngKSI, and

receiving, from the AMF over a 3GPP access, a fourth security mode command message including the third ngKSI.

5. The method of claim 4 , wherein the third ngKSI corresponds to security context changed based on the second authentication procedure and the second key agreement procedure.

6. A user equipment (UE) comprising:

a transceiver; and

at least one controller connected to the transceiver and configured to:

register to an access and mobility management function (AMF) and a public land mobile network (PLMN) over a 3rd generation partnership project (3GPP) access,

register to the AMF and the PLMN over a non-3GPP access,

perform, over the 3GPP access, a first authentication procedure and a first key agreement procedure with the AMF wherein a key set identifier (ngKSI) is changed from a first ngKSI to a second ngKSI during the first authentication procedure and the first key agreement procedure, the second ngKSI corresponds to new security context, and

in response to performing the first authentication procedure and the first key agreement procedure with the AMF over the 3GPP access:

receive, from the AMF over the 3GPP access, a first security mode command message including the second ngKSI, and

receive, from the AMF over a non-3GPP access, a second security mode command message including the second ngKSI.

7. The UE of claim 6 , wherein the second ngKSI corresponds to the new security context changed based on the first authentication procedure and the first key agreement procedure.

8. The UE of claim 6 , wherein the at least one controller is further configured to:

transmit, to the AMF, a first security mode complete message in response to the first security mode command message, and

transmit, to the AMF, a second security mode complete message in response to the second security mode command message.

9. The UE of claim 6 , wherein the at least one controller is further configured to:

perform, over a non-3GPP access, a second authentication procedure and a second key agreement procedure with the AMF, wherein the second ngKSI is changed to a third ngKSI during the second authentication procedure and the second key agreement procedure,

receive, from the AMF over the non-3GPP access, a third security mode command message including the third ngKSI, and

receive, from the AMF over a 3GPP access, a fourth security mode command message including the third ngKSI.

10. The UE of claim 9 , wherein the third ngKSI corresponds to security context changed based on the second authentication procedure and the second key agreement procedure.

11. A method of performing a security mode control procedure by an access and mobility management function (AMF), the method comprising:

performing, over a 3 rd generation partnership project (3GPP) access, a first authentication procedure and a first key agreement procedure with a user equipment (UE), wherein a key set identifier (ngKSI) is changed from a first ngKSI to a second ngKSI during the first authentication procedure and the first key agreement procedure, the second ngKSI corresponds to new security context; and

in response to performing the first authentication procedure and the first key agreement procedure with the UE over the 3GPP access:

transmitting, to the UE over the 3GPP access, a first security mode command message including the second ngKSI, and

transmitting, to the UE over a non-3GPP access, a second security mode command message including the second ngKSI,

wherein the UE is registered to the AMF and a same public land mobile network (PLMN) over both the 3GPP access and the non-3GPP access.

12. The method of claim 11 , wherein the second ngKSI corresponds to the new security context changed based on the first authentication procedure and the first key agreement procedure.

13. The method of claim 11 , further comprising:

receiving, from the UE, a first security mode complete message in response to the first security mode command message; and

receiving, from the UE, a second security mode complete message in response to the second security mode command message.

14. The method of claim 11 , further comprising:

performing, over the non-3GPP access, a second authentication procedure and a second key agreement procedure with the UE, wherein the second ngKSI is changed to a third ngKSI during the second authentication procedure and the second key agreement procedure; and

in response to performing the second authentication procedure and the second key agreement procedure with the UE over the non-3GPP access:

transmitting, to the UE over the non-3GPP access, a third security mode command message including the third ngKSI, and

transmitting, to the UE over a 3GPP access, a fourth security mode command message including the third ngKSI.

15. The method of claim 14 , wherein the third ngKSI corresponds to security context changed based on the second authentication procedure and the second key agreement procedure.

16. An access and mobility management function (AMF) comprising:

a transceiver; and

at least one controller connected to the transceiver and configured to:

perform, over a 3 rd generation partnership project (3GPP) access, a first authentication procedure and a first key agreement procedure with a user equipment (UE), wherein a key set identifier (ngKSI) is changed from a first ngKSI to a second ngKSI during the first authentication procedure and the first key agreement procedure, the second ngKSI corresponds to new security context, and

in response to performing the first authentication procedure and the first key agreement procedure with the UE over the 3GPP access:

transmit, to the UE over the 3GPP access, a first security mode command message including the second ngKSI, and

transmit, to the UE over a non-3GPP access, a second security mode command message including the second ngKSI,

wherein the UE is registered to the AMF and a same public land mobile network (PLMN) over both the 3GPP access and the non-3GPP access.

17. The AMF of claim 16 , wherein the second ngKSI corresponds to the new security context changed based on the first authentication procedure and the first key agreement procedure.

18. The AMF of claim 16 , wherein the at least one controller is further configured to:

receive, from the UE, a first security mode complete message in response to the first security mode command message, and

receive, from the UE, a second security mode complete message in response to the second security mode command message.

19. The AMF of claim 16 , wherein the at least one controller is further configured to:

perform, over the non-3GPP access, a second authentication procedure and a second key agreement procedure with the UE, wherein the second ngKSI is changed to a third ngKSI during the second authentication procedure and the second key agreement procedure, and

in response to performing the second authentication procedure and the second key agreement procedure with the UE over the non-3GPP access:

transmit, to the UE over the non-3GPP access, a third security mode command message including the third ngKSI, and

transmit, to the UE over a 3GPP access, a fourth security mode command message including the third ngKSI.

20. The AMF of claim 19 , wherein the third ngKSI corresponds to security context changed based on the second authentication procedure and the second key agreement procedure.