5G broadcast/multicast security key refresh

1. An apparatus for wireless communication at a user equipment (UE), comprising:

a memory; and

at least one processor coupled to the memory and configured to:

transmit a UE capability message indicating one or more security algorithms;

receive a security policy, via non-access stratum (NAS) signaling or radio resource control (RRC) signaling, indicating a selected security algorithm;

receive at least one multicast-broadcast key for a multicast or broadcast service carried by a radio bearer (RB) associated with a data session;

receive at least one updated multicast-broadcast key for the data session via the NAS signaling protected by radio access network (RAN) security between a core network node and the UE or RRC via a reconfiguration message for the UE from a radio access network (RAN) node with which the UE is in a connected mode; and

decode packets for the multicast or broadcast service received on the RB using the at least one updated multicast-broadcast key, or a key derived from the updated multicast-broadcast key utilizing the selected security algorithm.

2. The apparatus of claim 1 , wherein the at least one processor is configured to receive the at least one updated multicast-broadcast key from a session management function (SMF) that generated the updated multicast-broadcast key via the NAS signaling over an N4 interface.

3. The apparatus of claim 2 , wherein the at least one processor is configured to decode encoded Quality of Service (QoS) flow packets from a packet data convergence protocol (PDCP) layer using the at least one updated multicast-broadcast key, or a key derived from the at least one updated multicast-broadcast key.

4. The apparatus of claim 2 , wherein the at least one processor is configured to:

change from a first cell to a second cell; and

decode packets for the multicast or broadcast service from the second cell without changing the multicast-broadcast key.

5. The apparatus of claim 1 , wherein the at least one processor is configured to receive the at least one multicast-broadcast key from the RAN node that generated the at least one updated multicast-broadcast key.

6. The apparatus of claim 5 , wherein the at least one processor is configured to decode the packets at a packet data convergence protocol (PDCP) layer using the updated multicast-broadcast key.

7. The apparatus of claim 5 , wherein the at least one processor is configured to:

change from a first cell to a second cell;

receive a new cell-specific multicast-broadcast key from the second cell; and

decode the packets from the second cell with the new cell-specific multicast-broadcast key for the second cell.

8. The apparatus of claim 1 , wherein the data session includes one or more QoS flows, each QoS flow being associated with a unique multicast-broadcast key of the at least one updated multicast-broadcast key.

9. The apparatus of claim 1 , wherein the data session is a protocol data unit (PDU) session.

10. The apparatus of claim 1 , wherein the at least one processor is configured to, prior to receiving the at least one updated multicast-broadcast key:

receive packets for the multicast or broadcast service; and

decode the packets for the multicast or broadcast service using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key.

11. An apparatus for wireless communication at a user equipment (UE), comprising:

a memory; and

at least one processor coupled to the memory and configured to:

receive at least one multicast-broadcast key for a multicast or broadcast service carried by a radio bearer (RB) associated with a data session;

receive at least one updated multicast-broadcast key for the data session; and

decode packets for the multicast or broadcast service received on the RB using the at least one updated multicast-broadcast key, or a key derived from the updated multicast-broadcast key,

wherein to receive the at least one multicast-broadcast key, the at least one processor is configured to:

receive a root key generated by a session management function (SMF) via NAS signaling; and

derive a cell-specific multicast-broadcast key for a first cell of a radio access network node based on the root key.

12. The apparatus of claim 11 , wherein the at least one processor is configured to decode the packets at a packet data convergence protocol (PDCP) layer using the cell-specific multicast-broadcast key.

13. The apparatus of claim 11 , wherein the at least one processor is configured to:

transmit a UE capability message indicating one or more security algorithms; and

receive a security policy, via radio resource control (RRC) signaling, indicating a selected security algorithm for the decoding.

14. The apparatus of claim 11 , wherein the at least one processor is configured to:

change from the first cell to a second cell;

derive a cell-specific multicast-broadcast key for the second cell; and

decode the packets from the second cell with the cell-specific multicast-broadcast key for the second cell.

15. A method of wireless communication for a user equipment (UE), comprising:

transmitting a UE capability message indicating one or more security algorithms;

receiving a security policy, via non-access stratum (NAS) signaling or radio resource control (RRC) signaling, indicating a selected security algorithm;

receiving at least one multicast-broadcast key for a multicast or broadcast service carried by a radio bearer (RB) associated with a data session;

receiving at least one updated multicast-broadcast key for the data session via the NAS signaling protected by radio access network (RAN) security between a core network node and the UE or via a RRC reconfiguration message for the UE from a radio access network (RAN) node with which the UE is in a connected mode; and

decoding packets for the multicast or broadcast service received on the RB using the at least one updated multicast-broadcast key, or a key derived from the at least one updated multicast-broadcast key.

16. The method of claim 15 , wherein receiving at least one updated multicast-broadcast key for the data session comprises receiving the at least one updated multicast-broadcast key from a session management function (SMF) that generated the updated multicast-broadcast key via the NAS signaling over an N4 interface.

17. The method of claim 16 , wherein decoding packets for the multicast or broadcast service comprises decoding encoded Quality of Service (QoS) flow packets from a packet data convergence protocol (PDCP) layer using the at least one updated multicast-broadcast key, or a key derived from the at least one updated multicast-broadcast key.

18. The method of claim 16 , further comprising:

changing from a first cell to a second cell; and

decoding packets for the multicast or broadcast service from the second cell without changing the multicast-broadcast key.

19. The method of claim 15 , wherein receiving at least one updated multicast-broadcast key for the data session comprises receiving the at least one updated multicast-broadcast key from the RAN node that generated the at least one updated multicast-broadcast key.

20. The method of claim 19 , wherein decoding packets for the multicast or broadcast service comprises decoding the packets at a packet data convergence protocol (PDCP) layer using the updated multicast-broadcast key.

21. The method of claim 19 , further comprising:

changing from a first cell to a second cell;

receiving a new cell-specific multicast-broadcast key from the second cell; and

decoding the packets from the second cell with the new cell-specific multicast-broadcast key for the second cell.

22. The method of claim 15 , wherein the data session includes one or more QoS flows, each QoS flow being associated with a unique multicast-broadcast key of the at least one updated multicast-broadcast key.

23. The method of claim 15 , wherein the data session is a protocol data unit (PDU) session.

24. The method of claim 15 , further comprising, prior to receiving the at least one updated multicast-broadcast key:

receiving packets for the multicast or broadcast service; and

decoding the packets for the multicast or broadcast service using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key.

25. A method of wireless communication, comprising:

receiving at least one multicast-broadcast key for a multicast or broadcast service carried by a radio bearer (RB) associated with a data session;

receiving at least one updated multicast-broadcast key for the data session, wherein receiving at least one updated multicast-broadcast key for the data session comprises:

receiving a root key generated by a session management function (SMF) via NAS signaling; and

deriving a cell-specific multicast-broadcast key for a first cell of a radio access network node based on the root key; and

decoding packets for the multicast or broadcast service received on the RB using the at least one updated multicast-broadcast key, or a key derived from the at least one updated multicast-broadcast key.

26. The method of claim 25 , wherein decoding packets for the multicast or broadcast service comprises decoding the packets at a packet data convergence protocol (PDCP) layer using the cell-specific multicast-broadcast key.

27. The method of claim 25 , further comprising:

transmitting a UE capability message indicating one or more security algorithms; and

receiving a security policy, via RRC signaling, indicating a selected security algorithm for the decoding.

28. The method of claim 25 , further comprising:

changing from the first cell to a second cell;

deriving a cell-specific multicast-broadcast key for the second cell; and

decoding the packets from the second cell with the cell-specific multicast-broadcast key for the second cell.