Granted Patent B2

US 12,652,527 · App. 18/600,871 · Granted Jun 9, 2026

Inventors: Noamen Ben Henda (Vällingby, SE); Monica Wifvesson (Lund, SE)

Assignee: Telefonaktiebolaget LM Ericsson (publ)

H04W12/041H04W12/037H04W12/06H04W36/0038

Abstract

Claims (32)

1 . A method performed by network equipment configured for use in a wireless communication network, wherein the network equipment implements an access and mobility function (AMF), the method comprising:

transmitting or receiving, over a non-access stratum (NAS) connection between the network equipment and a wireless device, NAS communication that is protected with NAS keys derived from a K AMF key;

detecting that a value of a NAS COUNT for the NAS connection is about to wrap around from a maximum value to an initial value, wherein the NAS COUNT counts a number of NAS messages sent in a certain direction over the NAS connection;

responsive to detecting that the value of the NAS COUNT is about to wrap around, using horizontal key derivation to derive a new K AMF key from the value of the NAS COUNT and from the K AMF key, wherein using horizontal key derivation to derive the new K AMF key comprises deriving the new K AMF key without running an authentication and key agreement (AKA)-based primary authentication procedure and without activating a native security context for the wireless device;

deriving fresh NAS keys from the new K AMF key; and

transmitting or receiving NAS communication that is protected with the fresh NAS keys.

2 . The method of claim 1 , wherein said deriving comprises computing the new K AMF key as an output of a key derivation function that takes a string and a key as inputs, wherein the K AMF key is input to the key derivation function as said key, wherein a set of parameters concatenated together is input to the key derivation function as said string, wherein the set of parameters includes the value of the NAS COUNT.

3 . The method of claim 2 , wherein the key derivation function is a hash-based message authentication code (HMAC) function that uses a Secure Hash Algorithm (SHA) to hash inputs to the HMAC function in the form of a string and a key.

4 . The method of claim 1 , further comprising performing a NAS security mode command (SMC) procedure between the network equipment and the wireless device to establish between the network equipment and the wireless device a new NAS security context that includes the new K AMF key.

5 . The method of claim 4 , wherein performing the NAS SMC procedure comprises transmitting a NAS SMC message to the wireless device indicating the value of the NAS COUNT.

6 . Network equipment configured for use in a wireless communication network, wherein the network equipment implements an access and mobility function (AMF), the network equipment comprising:

communication circuitry; and

processing circuitry configured to:

transmit or receive, over a non-access stratum (NAS) connection between the network equipment and a wireless device, NAS communication that is protected with NAS keys derived from a K AMF key;

detect that a value of a NAS COUNT for the NAS connection is about to wrap around from a maximum value to an initial value, wherein the NAS COUNT counts a number of NAS messages sent in a certain direction over the NAS connection;

responsive to detecting that the value of the NAS COUNT is about to wrap around, use horizontal key derivation to derive a new K AMF key from the value of the NAS COUNT and from the K AMF key, wherein the processing circuitry is configured to use horizontal key derivation to derive the new K AMF key by deriving the new K AMF key without running an authentication and key agreement (AKA)-based primary authentication procedure and without activating a native security context for the wireless device;

derive fresh NAS keys from the new K AMF key; and

transmit or receive NAS communication that is protected with the fresh NAS keys.

7 . The network equipment of claim 6 , wherein the processing circuitry is configured to derive the new K AMF key by computing the new K AMF key as an output of a key derivation function that takes a string and a key as inputs, wherein the K AMF key is input to the key derivation function as said key, wherein a set of parameters concatenated together is input to the key derivation function as said string, wherein the set of parameters includes the value of the NAS COUNT.

8 . The network equipment of claim 7 , wherein the key derivation function is a hash-based message authentication code (HMAC) function that uses a Secure Hash Algorithm (SHA) to hash inputs to the HMAC function in the form of a string and a key.

9 . The network equipment of claim 6 , wherein the processing circuitry is configured to perform a NAS security mode command (SMC) procedure between the network equipment and the wireless device to establish between the network equipment and the wireless device a new NAS security context that includes the new K AMF key.

10 . The network equipment of claim 9 , wherein the processing circuitry is configured to transmit a NAS SMC message to the wireless device indicating the value of the NAS COUNT.

11 . A non-transitory computer readable medium on which is stored instructions that, when executed by at least one processor of network equipment that implements an access and mobility function (AMF) in a wireless communication network, causes the network equipment to:

transmit or receive, over a non-access stratum (NAS) connection between the network equipment and a wireless device, NAS communication that is protected with NAS keys derived from a K AMF key;

detect that a value of a NAS COUNT for the NAS connection is about to wrap around from a maximum value to an initial value, wherein the NAS COUNT counts a number of NAS messages sent in a certain direction over the NAS connection;

responsive to detecting that the value of the NAS COUNT is about to wrap around, use horizontal key derivation to derive a new K AMF key from the value of the NAS COUNT and from the K AMF key, wherein the instructions, when executed by the at least one processor of the network equipment, cause the network equipment to use horizontal key derivation to derive the new K AMF key by deriving the new K AMF key without running an authentication and key agreement (AKA)-based primary authentication procedure and without activating a native security context for the wireless device;

derive fresh NAS keys from the new K AMF key; and

transmit or receive NAS communication that is protected with the fresh NAS keys.

12 . The non-transitory computer readable medium of claim 11 , wherein the instructions, when executed by the at least one processor of the network equipment, cause the network equipment to compute the new K AMF key as an output of a key derivation function that takes a string and a key as inputs, wherein the K AMF key is input to the key derivation function as said key, wherein a set of parameters concatenated together is input to the key derivation function as said string, wherein the set of parameters includes the value of the NAS COUNT.

13 . The non-transitory computer readable medium of claim 12 , wherein the key derivation function is a hash-based message authentication code (HMAC) function that uses a Secure Hash Algorithm (SHA) to hash inputs to the HMAC function in the form of a string and a key.

14 . The non-transitory computer readable medium of claim 11 , wherein the instructions, when executed by the at least one processor of the network equipment, cause the network equipment to perform a NAS security mode command (SMC) procedure between the network equipment and the wireless device to establish between the network equipment and the wireless device a new NAS security context that includes the new K AMF key.

15 . The non-transitory computer readable medium of claim 14 , wherein the instructions, when executed by the at least one processor of the network equipment, cause the network equipment to perform the NAS SMC procedure by transmitting a NAS SMC message to the wireless device indicating the value of the NAS COUNT.

Assignments (1)

Continuity (3)

References Cited (31)