Secure user equipment capability transfer for user equipment with no access stratum security
Disclosed embodiments are related to Management Data Analytics (MDA) relation with Self-Organizing Network (SON) functions and coverage issues analysis use case. Other embodiments may be described and/or claimed.
1. An apparatus to be employed as a network function (NF), the apparatus comprising:
processor circuitry configurable to: determine a downlink Message Authentication Code (DL_MAC) using a user equipment (UE) capability enquiry as an input to a Non-Access Stratum (NAS) integrity algorithm and a NAS integrity key (K NASint ) as a key for the NAS integrity algorithm; and
network interface circuitry (NIC) communicatively coupled with the processor circuitry, the NIC configurable to send the determined DL_MAC to a Radio Access Network (RAN) for delivery to a UE.
2. The apparatus of claim 1 , wherein the NIC is further configurable to:
obtain a NAS UE capability indication message from the RAN.
3. The apparatus of claim 1 , wherein the processor circuitry is further configurable to:
encrypt the UE capability enquiry using currently used NAS encryption algorithm and a NAS encryption key (K NASenc ) as a key for the NAS encryption algorithm, wherein the encrypted UE capability enquiry is sent to the RAN with the DL_MAC.
4. The apparatus of claim 1 , wherein the processor circuitry is further configurable to:
determine a counter value, wherein the determined counter value is sent to the RAN with the DL_MAC.
5. The apparatus of claim 1 , wherein the UE does not have Access Stratum (AS) security mechanisms enabled.
6. The apparatus of claim 1 , wherein the NIC is further configurable to:
obtain, from the RAN, an uplink Message Authentication Code (UL_MAC) generated by the UE; and
send a message including a UE capability information element (IE) to the RAN upon successful verification of the UL_MAC.
7. The apparatus of claim 6 , wherein another counter and an encrypted UE capability IE is obtained with the UL_MAC, wherein the UE capability IE is encrypted using a K NASenc .
8. The apparatus of claim 7 , wherein the processor circuitry is further configurable to:
decrypt the encrypted UE capability IE using the K NASenc ; and
generate the UE capability enquiry to include the decrypted UE capability IE.
9. The apparatus of claim 1 , wherein the NIC is further configurable to:
obtain a Radio Resource Control (RRC) message including a NAS Protocol Data Unit (PDU) generated by the UE, the NAS PDU including an encrypted version of a UE capability information message; and
send a message including a decrypted version of the UE capability information message to the RAN.
10. The apparatus of claim 1 , wherein the NF is an Access and Mobility Management Function (AMF), an Authentication Server Function (AUSF), an Authentication credential Repository and Processing Function (ARPF), a Subscription Identifier De-concealing Function (SIDF), or a Security Anchor Function (SEAF).
11. One or more non-transitory computer readable media (NTCRM) comprising instructions, wherein execution of the instructions by one or more processors of a user equipment (UE) is to cause the UE to:
receive a user equipment (UE) capability enquiry message from a Radio Access Network (RAN);
determine an uplink Message Authentication Code (UL_MAC) using the UE capability enquiry message as an input to a Non-Access Stratum (NAS) integrity algorithm and a NAS integrity key (K NASint ) as a key for the NAS integrity algorithm; and
send the determined UL_MAC to the RAN for delivery to a network function (NF).
12. The one or more NTCRM of claim 11 , wherein execution of the instructions is to cause the UE to:
verify the UE capability enquiry message using the K NASint ; and
decrypt the UE capability enquiry message using a NAS encryption key (K NASenc ) when the UE capability enquiry message includes an encrypted payload.
13. The one or more NTCRM of claim 11 , wherein a downlink Message Authentication Code (DL_MAC) and a counter value is obtained with the UE capability enquiry message.
14. The one or more NTCRM of claim 13 , wherein execution of the instructions is to cause the UE to:
determine the UL_MAC using the DL_MAC and the counter value obtained with the UE capability enquiry message.
15. The one or more NTCRM of claim 14 , wherein, to determine the UL_MAC, execution of the instructions is to cause the UE to:
operate a key derivation function (KDF) using the K NASint , the counter value, and one of UE capability information, a UE capability identifier (ID), or a hash of the UE capability information.
16. The one or more NTCRM of claim 11 , wherein the UE does not have Access Stratum (AS) security mechanisms enabled.
17. The one or more NTCRM of claim 11 , wherein execution of the instructions is to cause the UE to:
send a UE capability information message with the UL_MAC.
18. The one or more NTCRM of claim 17 , wherein execution of the instructions is to cause the UE to:
encrypt a UE capability information element (IE) using a K NASenc , wherein the K NASenc is a key outside of a Packet Data Convergence Protocol (PDCP) layer implemented by the UE; and
send the encrypted UE capability IE with the UL_MAC.
19. The one or more NTCRM of claim 18 , wherein execution of the instructions is to cause the UE to:
implement a NAS layer entity to generate a NAS Protocol Data Unit (PDU) to include the encrypted UE capability IE;
implement a Radio Resource Control (RRC) layer entity to generate an RRC message to include the NAS PDU; and
send the RRC message to the RAN for delivery to the NF.
20. The one or more NTCRM of claim 19 , wherein execution of the instructions is to cause the UE to:
receive another NAS PDU from the NF, wherein the other NAS PDU includes a Radio Network Temporary Identifier (RNTI) assigned to the UE;
obtain the RNTI from the other NAS PDU; and
generate the NAS PDU to include the obtained RNTI.