Methods for trust information in communication network and related communication equipment and communication device
A method performed by a network equipment of a communication network to dynamically provide trust information to a communication device registered or being registered to the communication network is provided. The method includes determining a trust information for each of one or more access networks. The trust information indicates whether each of the one or more access networks is trusted. The method further includes indicating to the communication device whether the one or more access networks is trusted for a current session or a later session. A method performed by a communication device registered or being registered with a communication network to dynamically receive trust information is also provided. The method includes receiving a message including a protected trust information list from a network equipment. The method further includes verifying the protection of the message. The method further includes storing the protected trust information list.
1. A method performed by a network equipment of a communication network to dynamically provide trust information to a communication device registered to or being registered the communication network, the method comprising:
determining a trust information for each of one or more access networks, wherein the trust information indicates whether each of the one or more access networks is trusted, wherein the determining a trust information for each of one or more access networks comprises protecting a trust information list with a key shared with the communication device to obtain a protected trust information list; and
indicating to the communication device whether the one or more access networks is trusted for a current session or a later session, wherein the indicating to the communication device whether the one or more access networks is trusted for a current session or a later session comprises sending the protected trust information list toward the communication device.
2. The method of claim 1 , wherein the determining a trust information for each of one or more access networks comprises:
obtaining a list of the one or more access networks; and
associating the trust information to each of the one or more of the access networks in the list of the one or more access networks resulting in the trust information list.
3. The method of claim 1 , wherein the sending the protected trust information list toward the communication device is sent toward the communication device during steering of the communication device in a visited public land mobile network (VPLMN) during registration.
4. The method of claim 1 , wherein the sending the protected trust information list toward the communication device is sent toward the communication device during steering of the communication device in a visited public land mobile network (VPLMN) after registration.
5. The method of claim 4 , further comprising:
sending a message to an authentication server function (AUSF) to obtain security material for protection of the trust information list; and
receiving a response to the first message from the AUSF with the security material.
6. The method of claim 1 , wherein the sending the protected trust information list toward the communication device is sent toward the communication device via a parameters update to the communication device during a unified data management (UDM) control plane security procedure.
7. The method of claim 6 , wherein the parameters update comprises a user equipment parameter update (UPU).
8. The method of claim 6 , further comprising:
sending a message to an authentication server function (AUSF) to obtain security material for protection of the trust information list; and
receiving a response to the first message from the AUSF with the security material.
9. The method of claim 1 , wherein the sending the protected trust information list toward the communication device is sent toward the communication device after a primary authentication.
10. The method of claim 2 , wherein the list is obtained where an authentication of the communication device was performed; and
the sending the protected trust information list toward the communication device is sent toward the communication device using a user equipment parameter update (UPU) procedure.
11. A network equipment comprising:
processing circuitry; and
memory coupled with the processing circuitry, wherein the memory includes instructions that when executed by the processing circuitry causes the network equipment to perform operations comprising:
determining a trust information for each of one or more access networks, wherein the trust information indicates whether each of the one or more access networks is trusted, wherein the determining a trust information for each of one or more access networks comprises protecting a trust information list with a key shared with the communication device to obtain a protected trust information list; and
indicating to a communication device registered or being registered with a communication network whether the one or more access networks is trusted for a current session or a later session, wherein the indicating to the communication device whether the one or more access networks is trusted for a current session or a later session comprises sending the protected trust information list toward the communication device.
12. A method performed by a communication device registered or being registered with a communication network to dynamically receive trust information, the method comprising:
receiving a message including a protected trust information list from a network equipment;
verifying the protection of the message; and
storing the protected trust information list.
13. The method of claim 12 , wherein the receiving a message including a protected trust information list from a network equipment is received during steering of the communication device in a visited public land mobile network (VPLMN) after registration.
14. The method of claim 12 , wherein the receiving a message including a protected trust information list from a network equipment is received via a parameters update to the communication device during a unified data management (UDM) control plane security procedure.
15. The method of claim 14 , wherein the parameters update comprises a user equipment parameter update (UPU).
16. The method of claim 12 , wherein the receiving a message including a protected trust information list from a network equipment is received after a primary authentication.
17. The method of claim 12 , wherein the protected trust information comprises a plurality of trust indications comprising a trust indication from a visited public land mobile network (VPLMN) and a trust indication from a home public land mobile network (HPLMN).
18. The method of claim 17 , wherein the communication device has default behavior that the trust indication from the VPLMN overrides the trust indication of the HPLMN.
19. A communication device registered or being registered with a communication network adapted to perform operations comprising:
receive a message including a protected trust information list from a network equipment;
verify the protection of the message; and
store the protected trust information list.