Slice-specific security requirement information
Apparatuses, methods, and systems are disclosed for determining and enforcing service specific network slice security. One apparatus in a mobile communication network includes processor that performs primary authentication with a mobile communication network and a transceiver that receives a SMC message comprising SSI. The processor applies slice security for control plane and user plane traffic related to a network slice according to a Security Requirement Type indicated in the SSI.
1 . A user equipment (“UE”) for wireless communication, comprising:
at least one memory; and
at least one processor coupled with the at least one memory and configured to cause the UE to:
perform primary authentication with a mobile communication network;
receive a security mode command (“SMC”) message comprising slice-specific security requirement information (“SSI”) and a slice security requirement identifier (“SRID”), wherein the SSI includes a security requirement type parameter indicating whether to derive a dedicated security context after the primary authentication, and wherein the SRID identifies a security requirement information corresponding to a single network slice selection assistance information (“S-NSSAI”); and
apply slice security for control plane and user plane traffic related to a network slice in response to the security requirement type parameter included in the SSI indicating to derive the dedicated security context after the primary authentication,
wherein to apply slice security for control plane and user plane traffic related to the network slice, the at least one processor is configured to cause the UE to derive at least one slice-specific security key based on the received SSI and the SRID.
2 . The UE of claim 1 , wherein the at least one processor is configured to cause the UE to derive the at least one slice-specific security key using as additional inputs at least one of:
a slice identifier (“ID”),
a slice type, or
a service type.
3 . The UE of claim 2 , wherein the at least one slice-specific security key comprises at least one of:
a slice-specific access and mobility management function (“AMF”) key (“Kamf”),
a slice-specific radio access network (“RAN”) key,
a slice-specific non-access stratum (“NAS”) key, or
a slice-specific access stratum (“AS”) key.
4 . The UE of claim 1 , wherein to apply security for control plane and user plane traffic related to a network slice, the at least one processor is configured to cause the UE to use slice-specific inputs in the ciphering and integrity protection while applying a default primary authentication-based security context for a non-access stratum (“NAS”) connection, in response to the security requirement type parameter indicating that traffic of a corresponding network slice is to be protected using the dedicated security context.
5 . The UE of claim 1 , wherein the SMC message contains an SSI inclusion indication parameter that indicates that the SSI for enforcement at the UE is provided with the security mode command message, wherein the SSI is both integrity protected and confidentiality protected with default security keys.
6 . The UE of claim 1 , wherein the SMC message contains a security requirement identifier (“SRID”) that indicates that the SMC message is slice-specific and is cryptographic separated using the SRID.
7 . A processor for wireless communication, comprising:
at least one memory; and
at least one controller coupled with the at least one memory and configured to cause the processor to:
perform primary authentication with a mobile communication network;
receive a security mode command (“SMC”) message comprising slice-specific security requirement information (“SSI”) and a slice security requirement identifier (“SRID”), wherein the SSI includes a security requirement type parameter indicating whether to derive a dedicated security context after the primary authentication, and wherein the SRID identifies a security requirement information corresponding to a single network slice selection assistance information (“S-NSSAI”); and
apply slice security for control plane and user plane traffic related to a network slice in response to the security requirement type parameter included in the SSI indicating to derive the dedicated security context after the primary authentication,
wherein to apply slice security for control plane and user plane traffic related to the network slice, the at least one controller is configured to cause the processor to derive at least one slice-specific security key based on the received SSI and the SRID.
8 . The processor of claim 7 , wherein the at least one controller is configured to cause the processor to derive the at least one slice-specific security key using as additional inputs at least one of:
a slice identifier (“ID”),
a slice type, or
a service type.
9 . The processor of claim 7 , wherein the at least one slice-specific security key comprises at least one of:
a slice-specific access and mobility management function (“AMF”) key (“Kamf”),
a slice-specific radio access network (“RAN”) key,
a slice-specific non-access stratum (“NAS”) key, or
a slice-specific access stratum (“AS”) key.
10 . A method performed by a user equipment (“UE”), the method comprising:
performing primary authentication with a mobile communication network;
receiving a security mode command (“SMC”) message comprising slice-specific security requirement information (“SSI”) and a slice security requirement identifier (“SRID”), wherein the SSI includes a security requirement type parameter indicating whether to derive a dedicated security context after the primary authentication, wherein the security requirement type parameter indicates to derive the dedicated security context after the primary authentication, and wherein the SRID identifies a security requirement information corresponding to a single network slice selection assistance information (“S-NSSAI”); and
applying slice security for control plane and user plane traffic related to a network slice in response to the security requirement type parameter included in the SSI indicating to derive the dedicated security context after the primary authentication,
wherein applying slice security for control plane and user plane traffic related to the network slice further comprises deriving at least one slice-specific security key based on the received SSI and the SRID.
11 . The method of claim 10 , further comprising deriving the at least one slice-specific security key using as additional inputs at least one of:
a slice identifier (“ID”),
a slice type, or
a service type.
12 . The method of claim 10 , wherein the at least one slice-specific security key comprises at least one of:
a slice-specific access and mobility management function (“AMF”) key (“Kamf”),
a slice-specific radio access network (“RAN”) key,
a slice-specific non-access stratum (“NAS”) key, or
a slice-specific access stratum (“AS”) key.