JP7209024B2 - Enhanced mobility for cellular communications - Google Patents

Description

TECHNICAL FIELD This application relates to cellular wireless communication devices and, more particularly, to techniques for tracking security configurations during handovers.

The use of wireless communication systems is growing rapidly. In recent years, wireless devices such as smart phones and tablet computers have become increasingly sophisticated. In addition to supporting telephony functions, many mobile devices now provide Internet access, email, text messaging, and navigation using a global positioning system (GPS), enabling these functions. You can run sophisticated applications that you use.

The next generation high speed cellular communication standard (Long Term Evolution, LTE) has become the technology of choice for most wireless network operators around the world, bringing mobile broadband data and high speed Internet access to their subscriber base. LTE defines a number of downlink (DL) physical channels (classified as transport or control channels) that carry information blocks received from the media access control (MAC) and higher layers. LTE also defines a number of physical layer channels for the uplink (UL).

The next-generation telecommunications standard proposal beyond the current International Mobile Telecommunications Advanced (IMT-Advanced) standard is referred to as the 5th generation mobile network or 5th generation radio system, or 5G for short (otherwise, known as 5G-NR, which stands for 5G New Radio, also simply NR). Compared to the current LTE standard, 5G-NR will offer higher capacity to accommodate denser mobile broadband users, as well as ultra-reliable and high-volume device-to-machine communication, as well as low latency and low battery. Support consumption.

Conventional LTE handover procedures (e.g., from one base station to another) are prone to handover failures and may introduce tens of milliseconds of latency for user plane data. be. Latency causes can be, for example, RF retuning, DL and UL synchronization on the target cell, and L2 reset.

In some implementations, the device is connected to base stations of the same radio access network or multiple different radio access networks (e.g., LTE and NR networks, different LTE networks, different NR networks, different base stations of the same NR network, etc.). may have dual connections to it.

A better understanding of the present subject matter can be obtained when the following detailed description of various embodiments is considered in conjunction with the following drawings.

1 illustrates an exemplary wireless communication system, in accordance with some embodiments; FIG.

1 illustrates a base station (BS) in communication with user equipment (UE) devices, according to some embodiments; FIG.

FIG. 4 is an exemplary block diagram of a UE, according to some embodiments;

FIG. 4 is an exemplary block diagram of a BS, according to some embodiments;

[0014] Figure 4 illustrates an example multi-connection handover procedure in accordance with some embodiments;

FIG. 4 is a block diagram illustrating PDCP relocation according to some embodiments;

FIG. 4 is a communication diagram illustrating exemplary handover techniques with determined activation sequence numbers according to some embodiments; FIG. 4 is a communication diagram illustrating exemplary handover techniques with determined activation sequence numbers according to some embodiments; FIG. 4 is a communication diagram illustrating exemplary handover techniques with determined activation sequence numbers according to some embodiments; FIG. 4 is a communication diagram illustrating exemplary handover techniques with determined activation sequence numbers according to some embodiments; FIG. 4 is a communication diagram illustrating exemplary handover techniques with determined activation sequence numbers according to some embodiments;

FIG. 2 illustrates a typical PDCP PDU format according to some embodiments;

FIG. 4 is a flow diagram illustrating exemplary techniques for implicitly detecting security configuration switches according to some embodiments;

FIG. 4 is a communication diagram illustrating implicit detection of security configuration switching according to some embodiments; FIG. 4 is a communication diagram illustrating implicit detection of security configuration switching according to some embodiments;

FIG. 4 is a communication diagram illustrating an exemplary make-before-break handover technique according to some embodiments; FIG. 4 is a communication diagram illustrating an exemplary make-before-break handover technique according to some embodiments; FIG. 4 is a communication diagram illustrating an exemplary make-before-break handover technique according to some embodiments;

While the features described herein are susceptible to various modifications and alternative forms, specific embodiments thereof have been shown by way of example in the drawings and will herein be described in detail. However, the drawings and detailed description thereto are not intended to be limited to the particular forms disclosed, but rather the intention is as defined by the appended claims. It should be understood to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the subject matter.

Within this disclosure, various entities (variably referred to as “units,” “circuits,” other components, etc.) are “configured” to perform one or more tasks or operations. configured)”. This explicit description of "an 'entity' that is configured to 'perform one or more tasks'" is used herein to refer to a structure (i.e., something physical, such as an electronic circuit). be done. More specifically, this explicit phrase is used to indicate that the structure is arranged to perform one or more tasks during operation. A structure is sometimes said to be "configured to" perform some task even if the structure is not currently operating. An "application processor configured to send IP packets" performs this function during operation, for example, even if the circuit in question is not currently in use (e.g., no power is connected to the circuit). Intended to span circuits. Thus, an entity described or illustrated as being “configured to” perform some task may be a physical device, such as a device, circuit, or memory storing program instructions executable to perform that task. pointing to something This phrase is not used herein to refer to intangibles.

The term "configured to" is not intended to mean "configurable to." For example, an unprogrammed FPGA may be "configurable to" perform some particular function, but would not be considered "configured to" perform that function. After appropriate programming, the FPGA can then be configured to perform that function.

In an appended claim, stating that a structure is "configured to" perform one or more tasks does not invoke 35 U.S.C. §112(f) for that claim element. explicitly intended. Accordingly, none of the claims in this application as filed are intended to be interpreted as having means-plus-function elements. If an applicant wishes to invoke §112(f) during the prosecution process, it will describe the claim element using the "means for" construct.

As used herein, the term "based on" is used to describe one or more factors that influence the determination. This term does not exclude the possibility that additional factors may influence the decision. That is, the determination may be based on specified factors only, or on specified factors as well as other unspecified factors. Consider the phrase "determine A based on B." This phrase specifies that B is used to determine A or is a factor that influences the determination of A. This phrase does not exclude that the determination of A may also be based on some other factor, such as C. This phrase is also intended to cover embodiments in which A is determined based on B only. As used herein, the phrase "based on" is synonymous with the phrase "based at least in part on."

Furthermore, as used herein, the terms "first," "second," "third," etc. do not necessarily imply an ordering (eg, time) between elements. For example, when referring to a "first" graphics operation and a "second" graphics operation, no ordering semantics of the graphics operations is implied, and additional language that is not present indicates between these operations. is constrained. For brevity, references to "first," "second," etc. are used as indicators for ease of reference in the description and appended claims.

Terms The following is a glossary of terms used in this disclosure.

Storage Medium - Any of various types of non-transitory memory or storage devices. The term "storage medium" includes installation media such as computer system memory or random access memory such as CD-ROM, floppy disk or tape devices, DRAM, DDR RAM, SRAM, EDO RAM, Rambus RAM, flash, magnetic media, It is intended to include non-volatile memory, registers, or other similar types of memory elements, such as hard drives or optical storage devices. A storage medium may also include other types of non-transitory memory, as well as combinations thereof. Additionally, the storage medium may be located within a first computer system on which the program is executed, or within a second, different computer system that connects to the first computer system through a network, such as the Internet. may In the latter example, the second computer system can provide program instructions to the first computer system for execution. The term "storage medium" may include two or more storage media that can reside in different locations, eg, in different computer systems connected via a network. The storage medium may store program instructions (eg, embodied as a computer program) that are executable by one or more processors.

Carrier medium—A storage medium, as described above, and a physical transmission medium such as a bus, network, and/or other physical transmission medium that carries signals such as electrical, electromagnetic, or digital signals.

Programmable Hardware Elements--includes various hardware devices comprising multiple programmable functional blocks connected via programmable interconnects. Examples include FPGA (Field Programmable Gate Array), PLD (Programmable Logic Device), FPOA (Field Programmable Object Array), and CPLD (Complex PLD). )including. Programmable functional blocks can range from fine grained (combinatorial logic or lookup tables) to coarse grained (arithmetic logic units or processor cores). Programmable hardware elements are also sometimes referred to as "reconfigurable logic."

Computer system--various including personal computer systems (PCs), mainframe computer systems, workstations, network appliances, Internet appliances, personal digital assistants (PDAs), television systems, grid computing systems, or any other device or combination of devices any of a variety of computing or processing systems. In general, the term "computer system" can be broadly defined to encompass any device (or combination of devices) having at least one processor that executes instructions from a storage medium.

User Equipment (UE) (or “UE device”)—any of various types of computer system devices that are mobile or portable and that perform wireless communications. Examples of UE devices include mobile phones or smart phones (e.g. iPhone, Android-based phones), portable gaming devices (e.g. Nintendo DS, PlayStation Portable, Gameboy Advance®, iPhone®), laptops, wearable devices (e.g., smartwatches, smartglasses), PDAs, portable Internet devices, music players, data storage devices, or other handheld devices. be done. In general, the term "UE" or "UE device" is broadly defined to encompass any electronic, computing and/or telecommunications device (or combination of devices) that is easily carried by a user and capable of wireless communication. can be defined.

Base Station - The term "base station" has the full scope of its ordinary meaning and includes at least a radio communication station installed at a fixed location and used to communicate as part of a radiotelephone system or radio system. include.

Processing element—refers to various elements or combinations of elements capable of performing functions within a device such as user equipment or cellular network device. A processing element may be, for example, a processor and associated memory, a portion or circuit of an individual processor core, an entire processor core, a processor array, circuitry such as an ASIC (application specific integrated circuit), a field programmable gate array (FPGA), or the like. It may include programmable hardware elements, as well as any of the various combinations of the above.

Channel - The medium used to convey information from the sender (transmitter) to the receiver. Since the characteristics of the term "channel" may differ for different wireless protocols, the term "channel" as used herein conforms to the standards of the device type with which it is used in connection. Note that it can be considered as being used in a scheme. In some standards, the channel width can be variable (eg, depending on device performance, bandwidth conditions, etc.). For example, LTE can support scalable channel bandwidths from 1.4 MHz to 20 MHz. In contrast, the channel width of Bluetooth may be 1 MHz, while the channel width of WLAN may be 22 MHz. Other protocols and standards may contain different channel definitions. Additionally, some standards define and use multiple types of channels, e.g., different channels for uplink or downlink and/or different channels for different uses such as data, control information, etc. be able to.

Band - The term "band" has the full scope of its ordinary meaning, at least the portion of the spectrum in which the channel is used or set aside for the same purpose (e.g., radio frequency spectrum) included.

automatically—a computer system (e.g., software executed by a computer system) or device (e.g., circuitry, programmable hardware element, ASIC, etc.) without user input directly specifying or performing an action or operation means that those actions or operations are performed. Thus, the term "automatically" is in contrast to operations that are manually performed or specified by a user, such as the user providing input to directly perform the operation. An automated procedure may be initiated by user-provided input, but the subsequent actions to be performed "automatically" are not specified by the user, i.e., the user specifies each action to be performed. It is not run "manually". For example, when a user completes an electronic form by selecting each field and providing input identifying information (e.g., by typing information, selecting checkboxes, selecting radio buttons, etc.), the computer Filling out forms manually, even if the system has to update the form in response to a user action. A form may be automatically filled out by a computer system, in which case the computer system (e.g., software running on the computer system) completes the form without any user input specifying the answers to the fields. Analyze the fields and fill out the form. As mentioned above, a user can invoke automatic filling of a form, but does not participate in the actual filling of the form (e.g., the user does not manually specify the answers to the fields; rather, they are filled automatically). filled in completely). This specification provides examples of various actions that are automatically performed in response to actions taken by a user.

Approximate—refers to a value that is exactly or almost exactly. For example, "approximately" can refer to a value within 1-10 percent of the exact (or desired) value. However, it should be noted that the actual threshold (or tolerance) may depend on the application. For example, in some embodiments, "approximately" can mean within 0.1% of some specified or desired value, and in various other embodiments the threshold is optionally or specified For example, it may be 2%, 3%, 5%, etc., as required by the application.

Concurrent-refers to parallel execution or implementation, in which tasks, processes, or programs are executed to at least partially overlap. For example, concurrency can be achieved using "strong" or strict parallelism, in which tasks are executed (at least partially) in parallel on each computational element, or by, for example, time division multiplexing of threads of execution. It can be implemented using "weak parallelism", where tasks are executed in an interleaved fashion.

1 and 2—Communication System FIG. 1 illustrates a simplified exemplary wireless communication system in accordance with some embodiments. Note that the system of FIG. 1 is merely one example of a possible system and that the features of the present disclosure may be implemented in any of a variety of systems as desired.

As shown, the exemplary wireless communication system includes a base station 102A communicating over a transmission medium with one or more user devices 106A, 106B, etc. through 106N. Each of the user devices may be referred to herein as "user equipment" (UE). User devices 106 are therefore referred to as UEs or UE devices.

A base station (BS) 102A, which may be a base transceiver station (BTS) or a cell site (“cellular base station”), provides hardware that enables wireless communication with UEs 106A-106N. can contain.

A communication area (or coverage area) of a base station may be referred to as a "cell." The base stations 102A and the UEs 106 are compliant with GSM, UMTS (eg, associated with WCDMA or TD-SCDMA air interfaces), LTE, LTE-Advanced (LTE- A) using any of a variety of radio access technologies (RATs) such as 5G new radio (5G NR), HSPA, 3GPP2 CDMA2000 (e.g. 1xRTT, 1xEV-DO, HRPD, eHRPD) , may be configured to communicate over a transmission medium. Note that when the base station 102A is implemented in the context of LTE, it may alternatively be referred to as an "eNodeB" or "eNB." Note that when the base station 102A is implemented in the context of 5G NR, it may alternatively be referred to as a "gNodeB" or "gNB".

As shown, the base station 102A also supports a network 100 (e.g., a telecommunications network such as a cellular service provider's core network, a public switched telephone network (PSTN), among other possibilities). , and/or the Internet). Accordingly, base station 102A can facilitate communication between user devices and/or communication between user devices and network 100 . Specifically, cellular base station 102A can provide UE 106 with various telecommunications capabilities such as voice, SMS, and/or data services.

Base station 102A and other similar base stations (such as base stations 102B-102N) operating according to the same or different cellular communication standards may thus communicate with UE 106A over a geographic area via one or more cellular communication standards. 106N and similar devices can be provided as a network of cells capable of providing continuous or near-continuous overlapping services.

As shown in FIG. 1, base station 102A can serve as a "serving cell" for UEs 106A-106N, while each UE 106 can be referred to as a "neighboring cell." It is also capable of receiving signals from (possibly within range of) one or more other cells (which may be provided by base stations 102B-102N and/or any other base station) capable of receiving signals from. Such cells may also facilitate communication between user devices and/or between user devices and network 100 . Such cells may include "macro" cells, "micro" cells, "pico" cells, and/or cells that provide any other granularity of coverage area size. For example, base stations 102A and 102B illustrated in FIG. 1 may be macrocells, while base station 102N may be a microcell. Other configurations are also possible.

In some embodiments, the base station 102A may be a next generation base station, eg, a 5G New Radio (5G NR) base station, or "gNB." In some embodiments, a gNB may connect to a legacy evolved packet core (EPC) network and/or an NR core (NRC) network. Additionally, a gNB cell may include one or more transition and reception points (TRP). Additionally, a UE operable according to 5G NR may be connected to one or more TRPs in one or more gNBs.

Note that UE 106 is capable of communicating using multiple wireless communication standards. For example, the UE 106 supports at least one cellular communication protocol (eg, GSM, UMTS (eg, associated with a WCDMA or TD-SCDMA air interface), LTE, LTE-A, 5G NR, HSPA, 3GPP2 CDMA2000 (eg, 1xRTT, 1xEV-DO, HRPD, eHRPD), as well as wireless network protocols (e.g., Wi-Fi) and/or peer-to-peer wireless communication protocols (e.g., Bluetooth, Wi-Fi peer-to-peer, etc.) It may be configured as UE 106 also or alternatively supports one or more Global Navigation Satellite Systems (GNSS, such as GPS or GLONASS), one or more mobile television broadcast standards (eg, ATSC-M/H or DVB-H), and/or Or, if desired, it may be configured to communicate using any other wireless communication protocol. Other combinations of wireless communication standards (including more than two wireless communication standards) are also possible.

FIG. 2 illustrates user equipment 106 (eg, one of devices 106A-106N) communicating with base station 102, according to some embodiments. UE 106 may be a device with cellular communication capabilities such as a mobile phone, handheld device, computer or tablet, or virtually any type of wireless device.

UE 106 may include a processor configured to execute program instructions stored in memory. UE 106 may perform any of the method embodiments described herein by executing such stored instructions. Alternatively or additionally, the UE 106 is configured to perform any of the method embodiments described herein, or any portion of the method embodiments described herein. It may also include programmable hardware such as an FPGA (Field Programmable Gate Array).

UE 106 may include one or more antennas for communicating using one or more wireless communication protocols or technologies. In some embodiments, the UE 106 may, for example, use a single shared radio, using CDMA2000 (1xRTT/1xEV-DO/HRPD/eHRPD) or LTE, and/or It can be configured to communicate using GSM or LTE using a single shared radio. A shared radio may be coupled to a single antenna or may be coupled to multiple antennas (eg, for MIMO) for performing wireless communications. In general, radios include any baseband processor, analog RF signal processing circuitry (including, for example, filters, mixers, oscillators, amplifiers, etc.), or digital processing circuitry (eg, for digital modulation and other digital processing). A combination may be included. Similarly, a radio may implement one or more receive and transmit chains using the hardware described above. For example, the UE 106 may share one or more parts of the receive and/or transmit chain among multiple wireless communication technologies described above.

In some embodiments, the UE 106 has separate transmit and/or receive chains (e.g., separate antennas and other radio components). As another possibility, the UE 106 may include one or more radios shared among multiple wireless communication protocols and one or more radios used exclusively by a single wireless communication protocol. . For example, the UE 106 may communicate using either LTE or 5G NR (alternatively LTE or 1xRTT or LTE or GSM) with a shared radio and Wi-Fi and Bluetooth respectively. separate radios. Other configurations are also possible.

FIG. 3—UE Block Diagram FIG. 3 shows an exemplary simplified block diagram of communication device 106, in accordance with some embodiments. Note that the communication device block diagram of FIG. 3 is merely one example of a possible communication device. According to embodiments, communication device 106 may be a user equipment (UE) device, a mobile device or station, a wireless device or station, a desktop computer or computing device, a mobile computing device (e.g., , laptop computer, notebook computer, or portable computing device), tablet, and/or combination of devices. As shown, communication device 106 may include a set of components 300 configured to perform core functions. For example, this set of components can be implemented as a system-on-chip (SOC) and can include portions for various purposes. Alternatively, this set of components 300 may be implemented as separate components or groups of components for various purposes. The set of components 300 may be coupled (eg, communicatively, directly or indirectly) to various other circuitry of communication device 106 .

For example, communication device 106 may include: Various types of memory (e.g., NAND flash 310, etc.), input/output interfaces, e.g., connector I/F 320 (e.g., computer systems, docks, charging stations, input devices, e.g., microphones, cameras, keyboards, output devices, e.g., speakers, etc.) ), display 360 (which may be integrated with communication device 106 or external), cellular communication circuitry 330, e.g. Communication circuitry 329 (eg, Bluetooth® and WLAN circuitry). In some embodiments, communication device 106 may include wired communication circuitry (not shown), such as a network interface card for Ethernet.

Cellular communication circuitry 330 may be coupled (eg, by communication, directly or indirectly) to one or more antennas, such as antennas 335 and 336, as shown. Short to medium range wireless communication circuitry 329 may also be coupled (eg, by communication, directly or indirectly) to one or more antennas, such as antennas 337 and 338, as shown. Alternatively, short-medium range wireless communication circuitry 329 couples (e.g., communicatively, directly or indirectly) to antennas 335 and 336 and to antennas 337 and 338 (e.g., communicatively, directly or indirectly). ) may be done in addition to or instead of combining. Near/medium range wireless communication circuitry 329 and/or cellular communication circuitry 330 may include multiple wireless communication devices for receiving and/or transmitting multiple spatial streams, such as a multiple-input multiple output (MIMO) configuration. A receive chain and/or multiple transmit chains may be included.

In some embodiments, cellular communications circuitry 330 includes dedicated receive chains (eg, dedicated processors and/or radios) and/or dedicated processors and/or radios for multiple RATs, e.g. (eg, a first receive chain for LTE and a second receive chain for 5G NR). Additionally, in some embodiments, cellular communications circuitry 330 may include a single transmit chain that can switch between radios dedicated to a particular RAT. For example, a first radio may be dedicated to a first RAT, e.g., LTE, and may communicate with a dedicated receive chain and a transmit chain shared with additional radios, e.g. , a second RAT, eg, a second radio dedicated to 5G NR and capable of communicating with a dedicated receive chain and a shared transmit chain.

Communication device 106 may also include and/or be configured for use with one or more user interface elements. User interface elements include display 360 (which may be a touch screen display), keyboard (which may be a separate keyboard or may be implemented as part of the touch screen display), mouse, microphone, and/or or any of a variety of elements such as a speaker, one or more cameras, one or more buttons, and/or any of a variety of other elements capable of providing information to a user and/or receiving or interpreting user input. may include

Communication device 106 may further include one or more smart cards 345 that include SIM (Subscriber Identity Module) functionality, such as one or more UICC (Universal Integrated Circuit Card(s)) 345 .

As shown, SOC 300 includes processor(s) 302 that can execute program instructions for communication device 106 and display circuitry 304 that can perform graphics processing and provide display signals to display 360 . and may include Processor(s) 302 may be coupled to a memory management unit (MMU) 340 that receives addresses from processor(s) 302 and translates those addresses into memory (eg, memory 306). , read only memory (ROM) 350, NAND flash memory 310) and/or display circuitry 304, near field communication circuitry 229, cellular communication circuitry 330, connector I/F 320, and/or display 360. It may be configured to convert to other circuits or devices such as. MMU 340 may be configured to perform memory protection and page table translation or setup. In some embodiments, MMU 340 may be included as part of processor(s) 302 .

As described herein, the communication device 106 includes hardware and software components for implementing the aforementioned features for the communication device 106 to communicate scheduling profiles for power savings to the network. good too. Processor 302 of communication device 106 performs some or all of the functions described herein, for example, by executing program instructions stored in a storage medium (eg, a non-transitory computer-readable storage medium). It may be configured to Alternatively (or in addition), processor 302 may be configured as a programmable hardware element such as an FPGA (Field Programmable Gate Array) or as an ASIC (Application Specific Integrated Circuit). Alternatively (or additionally), the processor 302 of the communication device 106 cooperates with one or more of the other components 300, 304, 306, 310, 320, 329, 330, 340, 345, 350, 360. may be configured to perform some or all of the functionality described herein.

Additionally, as described herein, processor 302 can include one or more processing elements. Accordingly, processor 302 may include one or more integrated circuits (ICs) configured to perform the functions of processor 302 . Additionally, each integrated circuit may include circuitry (eg, first circuitry, second circuitry, etc.) configured to perform the functions of processor(s) 302 .

Further, as described herein, cellular communications circuitry 330 and near field communications circuitry 329 may each include one or more processing elements. In other words, one or more processing elements may be included in cellular communications circuitry 330 and, similarly, one or more processing elements may be included in short-range wireless communications circuitry 329 . As such, cellular communications circuitry 330 may include one or more integrated circuits (ICs) configured to perform the functions of cellular communications circuitry 330 . Additionally, each integrated circuit may include circuitry (eg, first circuitry, second circuitry, etc.) configured to perform the functions of cellular communication circuitry 230 . Similarly, near field communication circuitry 329 may include one or more ICs configured to perform the functions of near field communication circuitry 32 . In addition, each integrated circuit can include circuitry (eg, first circuitry, second circuitry, etc.) configured to perform the functions of near field communication circuitry 329 .

Figure 4 - Base Station Block Diagram Figure 4 shows an exemplary block diagram of the base station 102, according to some embodiments. Note that the base station in FIG. 4 is only one example of possible base stations. As shown, base station 102 may include processor(s) 404 that may execute program instructions for base station 102 . Processor(s) 404 also receives addresses from processor(s) 404 and stores the addresses in memory (e.g., memory 460 and read-only memory (ROM) 450) or in other circuits or devices. It may be coupled to a memory management unit (MMU) 440, which may be configured to convert regions.

Base station 102 may include at least one network port 470 . Network port 470 may be configured to connect to a telephone network and may provide connectivity to the telephone network for multiple devices, such as UE device 106, as described above in FIGS. .

Network port 470 (or additional network ports) may also or alternatively be configured to connect to a cellular network, such as a cellular service provider's core network. This core network may provide mobility-related and/or other services to multiple devices, such as UE device 106 . In some cases, network port 470 may couple to a telephone network via a core network, and/or the core network may (e.g., communicate with other UE devices served by a cellular service provider). between) can provide a telephone network.

In some embodiments, base station 102 may be a next generation base station, eg, a 5G New Radio (5G NR) base station, or "gNB." In such embodiments, base station 102 may connect to a legacy evolved packet core (EPC) network and/or an NR core (NRC) network. Additionally, the base station 102 can be considered a 5G NR cell and can include one or more transition and reception points (TRPs). Additionally, a UE operable according to 5G NR may be connected to one or more TRPs in one or more gNBs.

Base station 102 may include at least one antenna 434, and possibly multiple antennas. At least one antenna 434 may be configured to operate as a radio transceiver and may be further configured to communicate with UE device 106 via radio 430 . Antenna 434 communicates with radio 430 via communication chain 432 . Communication chain 432 may be a receive chain, a transmit chain, or both. Radio 430 may be configured to communicate via various wireless communication standards including, but not limited to, 5G NR, LTE, LTE-A, GSM, UMTS, CDMA2000, Wi-Fi, and the like.

Base station 102 may be configured to wirelessly communicate using multiple wireless communication standards. In some examples, base station 102 may be equipped with multiple radios, thereby enabling base station 102 to communicate according to multiple wireless communication technologies. For example, one possibility is that the base station 102 may comprise an LTE radio for conducting communications according to LTE as well as a 5G NR radio for communicating according to 5G NR. In such cases, base station 102 can operate as both an LTE base station and a 5G NR base station. As another possibility, base station 102 may comprise a multi-mode radio. The multimode radio communicates according to any of a plurality of wireless communication technologies (e.g., 5G NR and Wi-Fi, LTE and Wi-Fi, LTE and UMTS, LTE and CDMA2000, UMTS and GSM, etc.). It can be performed.

As described further herein below, BS 102 may include hardware as well as software components for performing or supporting the implementation of the functions described herein. The processor 404 of the base station 102 performs some or all of the methods described herein, for example, by executing program instructions stored in a storage medium (eg, non-transitory computer-readable storage medium). or can be configured to support execution. Alternatively, processor 404 may be configured as a programmable hardware element such as an FPGA (Field Programmable Gate Array), or as an ASIC (Application Specific Integrated Circuit), or a combination thereof. Alternatively (or in addition), processor 404 of BS 102, along with one or more of other components 430, 432, 434, 440, 450, 460, 470, may implement some or all of the features described herein. may be configured to implement or support the implementation of

Additionally, as described herein, processor(s) 404 can be comprised of one or more processing elements. In other words, processor(s) 404 may include one or more processing elements. Accordingly, processor(s) 404 may include one or more integrated circuits (ICs) configured to perform the functions of processor(s) 404 . Additionally, each integrated circuit may include circuitry (eg, first circuitry, second circuitry, etc.) configured to perform the functions of processor(s) 404 .

Additionally, as described herein, radio 430 can be comprised of one or more processing elements. In other words, radio 430 may include one or more processing elements. Accordingly, radio 430 may include one or more integrated circuits (ICs) configured to perform the functions of radio 430 . Additionally, each integrated circuit can include circuitry (eg, first circuitry, second circuitry, etc.) configured to perform the functions of radio 430 .

Typical Mobility Enhancement Overview for Handover As mentioned above, the current handover procedure in LTE introduces latency and can be prone to handover failures. Various techniques described below may reduce handover failures and latency in various communication standards. Handover failure may occur due to various circumstances (eg, serving cell conditions deteriorating rapidly, preventing the UE from receiving the handover command). Latency is reduced by RF retuning (e.g., due to frequency used for target cell), DL synchronization in target cell, L2 reset, and/or UL synchronization in target cell (e.g., using RACH procedure) can occur.

Generally speaking, various techniques may be used to avoid handover failures and reduce latency. For example, a RACH-less handover may reduce the time required for UL synchronization in the target cell. A make before break (MBB) technique may reduce the time required for RF retuning and DL/UL synchronization. This is done, for example, by using a UE with multiple RF chains to set up a connection to a target cell before disconnecting from the source cell. Similarly, dual connection (DC) techniques may be used to connect to both the source and target cells prior to handover. Finally, MBB techniques may be used to provide redundancy for handovers that reduce data loss.

This disclosure provides DC-based mobility related techniques (see FIGS. 7A-10B) and MBB handover related techniques (see FIGS. 11A-11C).

DC-Based Handover and Security Configuration Schematic FIG. 5 is a communication diagram illustrating a typical DC-based handover procedure according to some embodiments. In the illustrated embodiment, the communication is between a UE 502, a master gNB (M-gNB) 504, a secondary gNB (S-gNB) 506, a mobility management entity (MME) 508, and a serving gateway (SGW) 510. takes place between Note that in some embodiments, communication between base stations and UEs is wireless, but communication between base stations may be performed using, for example, Xn links.

In the illustrated embodiment, at 515 the S-gNB is configured to initiate a duplex connection. For example, UE 502 and M-gNB may communicate prior to 515 using a single connection. In the illustrated embodiment, DL data from SGW 510 reaches M-gNB 504 from SGW 510 after configuration of S-gNB 506 . M-gNB sends data to UE 502 and forwards data to S-gNB. The S-gNB sends all or part of the data to the UE 502 via various transmissions. This may reduce data loss, for example, by communicating data through multiple base stations.

In the illustrated embodiment, at 520, the M-gNB 504 makes a role change decision, eg, based on measurement reports indicating deteriorating conditions. This role change decision may initiate the handover process. As a result, S-gNB 506 becomes the master gNB, potentially releasing gNB 504 and the handover is finished. M-gNB 504 sends role change requests to S-gNB 506 and receives role change responses. M-gNB 506 then sends an RRCConnectionReconfiguration message to UE 502 and receives an RRCConnectionReconfiguration Complete message. As shown, even after RRC connection reconfiguration, data may be sent to the M-gNB for forwarding.

S-gNB 506 then sends a path switch request to MME 508 . The MME 508 responsively forwards the user plate update request to the serving gateway SGW 510 . The serving gateway then sends an end marker to indicate when a path switch occurs (eg, using a sequence number (SN)). After the user plane update response and path switch request acknowledgment (ACK), gNB504 sends SN status report and end marker to gNB506. The gNB 506 then begins processing data from the SGW using its own PDCP layer (525). As shown, after path switching, SGW 510 is configured to send DL data to gNB 506, which sends data to UE 502 and also forwards data to gNB 504 for various transmissions to UE 502. (Note that the various forwarded data described herein may or may not be duplicated when sent to UE 502 over various paths).

In the illustrated embodiment, the gNB 504 (now the secondary gNB) is released at 530 to complete the handover. After that, the DL data is simply sent to UE 502 via gNB 506 as the duplex connection is terminated.

FIG. 6 is a block diagram illustrating an exemplary PDCP relocation in response to path switching according to some embodiments. In the illustrated example, the left portion of the diagram represents the configuration before path switching, and the right portion of the diagram represents the configuration after path switching. Generally speaking, DC communication uses the PDCP entity of the source gNB before the path switch and the PDCP entity of the target gNB after the path switch.

In the illustrated embodiment, source gNB 602 implements PDCP entity A 610, RLC layer A 620, MAC layer A 622, and PHY layer A 624. In the illustrated embodiment, the target gNB 604 implements PDCP entity B 640 , RLC layer B 630 , MAC layer B 632 and PHY layer B 634 . In the illustrated embodiment, the UE 106 also configures separate RLC, MAC, PHY layer A and Also implement B.

In the illustrated embodiment, each PDCP entity includes a module for sequence numbering and reordering 612/642, a module for header compression and decompression 614/644, a module for encryption and decryption 616/646, and a module for header addition and removal. module 618/648 is implemented.

Generally speaking, each gNB's PDCP entity may have different security configurations (eg, different cipher keys (CK) and integrity keys (IK)). When the master gNB changes roles to become a secondary gNB, it uses the cryptographic key of the new master gNB when it becomes the anchor of the split data radio bearer (DRB) for DC communication.

In some embodiments, this switching may present challenges for the UE 106 . For example, the UE may need to know that the network has switched from CK1 (source eNB's encryption key) to CK2 (target gNB's encryption key) in order to synchronize with the network.

In some embodiments, an activation time is determined, communicated, and used to determine when to switch security configurations. These embodiments are described in detail with reference to Figures 7A-7E. In some embodiments, switching is automatically detected based on encryption failures. These embodiments are described in detail below with reference to FIGS. 8-10B. In some embodiments, the switch is explicitly signaled and the signaling verified by the disclosed techniques (eg, to mitigate or avoid denial of service attacks).

In various embodiments, techniques described with respect to NR techniques may be applied to other communication standards (eg, LTE) and vice versa. Moreover, various techniques described herein may be used independently or combined (eg, in different modes of operation of a given device or even in the same mode of operation). Additionally, the various techniques described with respect to duplex connections may be applied to multiple connections with any suitable number of base stations. Thus, references to dual connectivity are not intended to limit the disclosed techniques to two base stations or two cells. Similarly, various descriptions of security configuration switching refer to encryption keys and integrity keys, for example. These key types are included for illustrative purposes and are not intended to limit the types of information identified by security configurations in other embodiments.

Exemplary Activation Time-Based Synchronization of Security Configurations FIGS. 7A-7E are communication diagrams illustrating exemplary activation time-based synchronization of security configuration switching according to some embodiments. In the illustrated example, communication between any of the UE 106, gNB1 704, gNB2 706, Access and Mobility Management Function (AMF) 708, and User Plane Function (UPF) 710 are shown.

In the embodiments of Figures 7A-7E, the master base station determines and communicates the activation SN for DL data and the UE determines and communicates the activation SN for UL data. These SN indications are then used to determine when to switch security configurations. Note that the activation SN may or may not correspond to an end marker for path switching. Figures 7C-7E show examples of encryption in situations before and after activation SN and before and after path switching is complete.

Referring to FIG. 7A, the UE initiates connection at 715 to gNB1 as the master base station and gNB2 as the secondary base station in a dual connection configuration. A DC configuration may be entered in anticipation of a handover, or the UE may be operating in dual connectivity for other reasons. FIG. 7A includes an upper portion illustrating DL data processing and a lower portion illustrating UL data processing in this scenario.

For DL data (using gNB1's PDCP), gNB1 receives DL user data from UPF 710 . At 720, gNB1 uses CK1 for ciphering and its IK for integrity protection. gNB1 then sends the ciphered data to UE 106 and sends it to gNB2. gNB2 then forwards all or part of the data to UE 106 . At 722, the UE 106 decrypts both received data sets and performs an integrity check using gNB1's security configuration.

For UL data (using gNB1's PDCP), at 724, the UE 106 ciphers and performs integrity protection (IP) with CK1. UE 106 sends encrypted UL user data to both gNB1 and gNB2. gNB2 forwards the data to gNB1, which at 726 decrypts both data sets using its security configuration, performs an IP check, and sends the UL user data to UPF 710. Thus, FIG. 7A shows a split data radio bearer using a master cell group (MCG) bearer and a secondary cell group (SCG) bearer in a dual connection configuration.

FIG. 7B continues the communication described in FIG. 7A. At 730, a measurement event is triggered and gNB1 responsively sends a role switch request to gNB2 and gNB2 sends a response. A measurement event may be triggered by the UE 106 to indicate, for example, a low signal level for gNB1.

In the illustrated embodiment, gNB1 may also calculate the DL activation SN based on the role switch. The base station may determine the activation SN based on various factors. For example, path switch latency, DL throughput, and current network load, and/or other parameters. As will be described in more detail below, ideal performance may be achieved when the determined activation SN matches the actual path switch completion, although functionality may not be affected in other circumstances. The described parameters may allow the base station to estimate when the path switch will be completed. For example, the path switching latency may be determined based on procedures in place between the gNB and the core network and/or past path switching intervals. DL throughput may also tell how many SNs may be exchanged during a path switch.

In the illustrated embodiment, gNB1 sends the determined DL activation SN and information identifying the target gNB2's ciphering key (CK2) to the UE in an RRC connection reconfiguration message. At 734, the UE 106 stores the DL activation SN and CK2.

In the illustrated embodiment, at 736 the UE 106 calculates the UL activation SN. The UE may determine the UL activation SN based on various factors (eg, UL throughput estimation, etc.).

Note that by determining the DL and UL activation SNs, L2 resets can be avoided (e.g., the UE and gNB know which PDCP SNs support cipher key switching, so resets for synchronization are not necessary). This may result in reduced handover latency.

In the illustrated embodiment, UE 106 sends an RRC Connection Reconfiguration Complete message with UL Activation SN and DL Activation SN to gNB2. At 738, gNB2 stores the UL and DL activation SNs. gNB2 then sends the UL Activation SN to gNB1 at 739 in an Activation SN Status Report. gNB1 stores the UL activation SN. Note that at this point UE 106, gNB1 and gNB2 all have knowledge of the UL and DL activation SNs. Furthermore, the UE has knowledge of both cipher keys for the two gNBs. It should be noted that the disclosed techniques for communicating the Activation SN are included for purposes of explanation and are not intended to limit the scope of this disclosure. For example, in some embodiments the base station may determine the UL activation SN. As another example, in some embodiments the UE 106 may directly communicate the UL activation SN to gNB1.

In the illustrated embodiment, gNB2 sends a path switch request to AMF 708 . AMF 708 sends user plane data requests to UPF 710 . UPF 710 sends an end marker to gNB1 in response with a user plane data response.

Figures 7C, 7D and 7E illustrate typical situations with different timings of activation SN and path switch completion. Illustrated in FIG. 7C is the technique for the situation where the activation SN is reached and the path switch is still pending. Illustrated in FIG. 7D is a technique for the situation where the activation SN has not been reached and path switching is complete. Illustrated in FIG. 7E is the technique for the situation where the activation SN has been reached and the path switch has been completed. It should be noted that the higher the accuracy of matching the activation SN to the path switch completion, the longer the time spent in situation 7E may be.

Referring to FIG. 7C, at 740, the activation SN has been reached, but the path switch is still pending. Now that the activation SN has been reached, gNB1 still acts as an anchor for the DC connection, although the gNB2 security configuration's encryption key (CK2) must be used. In the illustrated embodiment, at 741, for DL data, gNB1 forwards the DL data PDU to gNB2. gNB2 performs ciphering and IP on both data sets (data sent directly to UE 106 and data forwarded via gNB1) using CK2. The UE 106 uses CK2 to decrypt the data from both gNB1 and gNB2 and perform an IP check based on the knowledge that the activation SN has been reached.

In the illustrated embodiment, for UL data, at 746 the UE 106 ciphers and IPs with CK2 and sends data to both gNB1 and gNB2 (data sent to the two base stations is duplicated). may or may not). At 748, gNB1 forwards the data to gNB2 for decryption and IP checking. At 750 and 752, gNB2 decrypts both data sets using CK2, performs IP checks, and sends the decrypted data back to gNB1 to the core network.

Referring to FIG. 7D, at 760 the path switch is complete although the activation SN has not been reached. Since the Activation SN has not been reached, the encryption key (CK1) of gNB1 security configuration must be used, but gNB2 now acts as an anchor for the DC connection. In the illustrated embodiment, for DL data, at 761 gNB2 forwards the DL data PDU to gNB1. At 762, gNB2 ciphers the PDU with CK1 and performs IP to send the data to UE 106 and gNB2 706 (gNB2 then forwards the data to UE 106). At 764, the UE 106 uses CK1 to decrypt the data and perform an IP check based on the knowledge that the activation SN has not yet been reached.

In the illustrated embodiment, for UL data, at 766 the UE 106 ciphers and IPs with CK1 and sends the data to both gNB1 and gNB2. At 768 gNB2 forwards the data to gNB1 and at 769 gNB1 decrypts the data using CK1 to perform an IP check. gNB1 then sends the decrypted and IP checked data to gNB2 for delivery to the core network.

Referring to FIG. 7E, at 770 the activation SN is reached and path switching is complete. As shown, in this situation the encryption and IP check may proceed according to a conventional DC connection, with the anchor gNB2 performing the encryption/decryption and IP check on data from and to the core network.

At this point, the gNB2 may send an RRC connection reconfiguration message to the UE 106 indicating to release the duplex connection. UE 106 may release gNB1 from the DC configuration and may send an RRC connection reconfiguration complete message back to gNB2. gNB2 may then notify gNB2 to release the DC and receive an acknowledgment. At this point the handover from gNB1 to gNB2 may be completed.

The disclosed dual-connection techniques of FIGS. 7A-7E may advantageously reduce latency and/or reduce handover errors as compared to conventional techniques. Additionally, the disclosed techniques may facilitate synchronization of security configuration switches.

In some embodiments, instead of determining the Activation SN, gNB1 immediately activates the new ciphering key CK2 to cipher all DL PDCP PDUs sent after receiving the RRC Reconfiguration Complete message. may In these embodiments, the UE 106 may activate CK2 for the new DL PDCP PDU in response to receiving an RLC ACK indicating successful transmission of the RRC Reconfiguration Complete message. For the UL, in some embodiments the UE may activate CK2 for new UL PDCP PDUs in response to an RLC ACK indicating successful transmission of the RRC Reconfiguration Complete message.

In some embodiments, the method includes communicating with a mobile device by way of a first cellular base station, the communication using a multi-connection configuration with at least a second base station for the mobile device; base station is the master in a multi-connection configuration. In some embodiments, the method further comprises determining a downlink activation sequence number (SN) to switch to the security configuration of the second base station upon role switching with the second base station; sending the downlink activation SN to the mobile device. In some embodiments, the method further receives forwarded downlink data from the second base station prior to reaching the downlink activation SN and determines based on the security configuration of the first base station. and in response to reaching the downlink activation SN, send the processed downlink data to the mobile device using the security configuration of the second base station.

In some embodiments, sending the downlink data processed with the security configuration of the second base station to the mobile device is after reaching the downlink activation SN and before the role switch is completed. forwarding downlink data associated with the mobile device to a second base station for processing based on the security configuration of the second base station; Including receiving and sending to mobile devices. In some embodiments, sending the downlink data processed with the security configuration of the second base station to the mobile device is after reaching the downlink activation SN and after the role switch is completed. , receiving from the second base station downlink data associated with the mobile device processed based on the security configuration of the second base station and transmitting the processed data to the mobile device.

In some embodiments, the method includes receiving an uplink activation SN and, prior to the uplink activation SN, activating uplink data from the mobile device using a security configuration of the first base station. Further decrypting and, after the uplink activation SN, forwarding uplink data from the mobile device to the second base station for decryption using the security configuration of the second base station. include. In some embodiments, the security configurations of the first base station and the second base station each specify an encryption key and an integrity key. In some embodiments, determining the downlink activation SN is based on one or more of estimated path switching latency, downlink throughput parameters, or network load parameters.

In some embodiments, an apparatus (e.g., baseband processor or mobile device) includes one or more processing elements that communicate with first and second base stations in a multi-connection configuration; The first base station acts as a master base station, sends measurement reports to the first base station initiating a role switching procedure between the first and second base stations, and downlink activation from the first base station. receiving the SN, storing a downlink activation SN, processing downlink data from the first and second base stations using the security configuration of the first base station prior to the activation SN; After activation SN, the security configuration of the second base station is used to process downlink data from the first and second base stations.

Exemplary Techniques for Automatic Detection of Security Configuration Switching FIG. 8 is a diagram illustrating an example PDCP data PDU format with a 12-bit sequence number according to some embodiments. In some embodiments, UE 106 and/or one or more base stations in a multi-connection configuration may automatically detect security configuration switching based on ciphering failures.

In the illustrated embodiment, each row corresponds to 8 bits. This format is described in 3GPP TS 28.323, eg with reference to Figure 6.2.2.2-1 and sections 6.2.2, 6.3.3 and 6.3.4. In the illustrated example, for each PDCP data PDU, the corresponding PDCP PDU is a PDCP data PDU or a PDCP control PDU, 3 reserved bits, a 12-bit PDCP SN, a data payload, and an optional 4-byte MAC-i payload. contains a D/C bit that indicates whether or not When integrity protection is enabled, MAC-i payloads may be generated and validated using the integrity key against the current security configuration. In some embodiments, the data portion of the PDCP PDU is encrypted, but the SDAP header and MAC-i are not (if included).

In some embodiments, after an RRC reconfiguration message indicating an updated key index, the RRC entity configures both key settings for the PDCP entity (e.g., CK1/IK1 and CK2/ IK2). In these embodiments, the PDCP entity may continue to decrypt and cipher PDCP PDUs with CK1/IK1 until the first PDCP SN where ciphering failure is detected. In response to detecting a ciphering failure, in some embodiments the PDCP entity attempts to decrypt the PDCP PDU using CK2/IK2. If successful using CK2/IK2, the PDCP entity may assume that a security configuration switch has occurred and switch to using the target key after that PDCP SN. The PDCP entity may release the old key CK1/IK1 once PDCP has received all PDUs in order (up to the switch PDU). For example, any missing PDCP PDUs may still need to be decrypted using CK1/IK1.

Encryption failure may be detected using one or more of a variety of techniques. In some embodiments, if integrity protection is enabled, cipher failure is detected when integrity protection fails (e.g., MAC-i passes IK1 to integrity check not used correctly). In some embodiments, if integrity protection is not enabled, detection of encryption failure may be based on inspection of the format of the decrypted data payload. In some embodiments, explicit signaling may be used to determine cipher switching in combination with other disclosed techniques. Any of the various techniques for detecting encryption failures described herein may be used alone or in combination.

Thus, in some embodiments, for example, integrity protection is in effect on one or more (or all) DRB and SRB entities while in a DC-based mobility configuration, or integrity protection is The integrity-based cryptographic detection failure techniques of FIGS. 8-10B may be used if available on one or more (or all) of the configured DRBs.

FIG. 9 is a flow diagram illustrating a method for exemplary integrity-based switch detection using alternate techniques when integrity is invalid, according to some embodiments. In the illustrated embodiment, at 910 after receiving the PDCP data PDU, the PDCP entity determines whether integrity is valid on this DRB/SRB. Otherwise, at 915, alternative techniques are used to detect encryption failure. An example of an alternative technique is to analyze the decrypted data to see if it matches a known format (e.g. a typical IPv4 or IPv6 header or some other typical field in a transport protocol is is used in ) or not. Another alternative technique may include inserting a new unencrypted bit, field, or header field to explicitly indicate the encryption key switch.

In the illustrated embodiment, at 920, the key index is set to 1 (eg, corresponding to CK1/IK1). In the illustrated embodiment, at 925, the PDCP entity decrypts the PDCP PDU using CK[index]. In the first iteration, this is CK[1], but subsequent iterations use the keys of other base stations in a multi-connection configuration, eg, based on the increment at 950.

In the illustrated embodiment, at 930, the PDCP entity uses IK[index] to calculate MAC-i for the PDCP PDU. At 935, if the integrity passes (eg, the calculated MAC-i matches the received MAC-i), use the index for the current key (eg, if the integrity passes in the first iteration CK1/IK1 for example, or CKn/IKn in subsequent iterations). At 935, if the integrity does not pass, at 950 the index is incremented and at 940 the PDCP entity determines if the incremented index is a valid index for multi-connection configuration. Otherwise, at 945, the actual encryption error is detected. If so, another iteration is performed to determine if a security configuration switch has occurred.

10A and 10B are communication diagrams illustrating exemplary cipher failure-based security configuration switching according to some embodiments. In the illustrated embodiment, the core network includes Next Generation Core (NGC) 1002 and User Plane Gateway (UP-GW) 1004 . In the illustrated embodiment, at 1010, the UE 106 is connected to gNB1 as master and gNB2 as secondary in a DC configuration. In response to measurement event 1012, gNB1 initiates a role switch and sends a request to gNB2. In the illustrated embodiment, the RRC reconfiguration request includes the CK of target gNB2 (CK2). At 1014, the UE memorizes the new CK and sends an RRC Reconfiguration Complete message using the new CK/IK. After rerouting, the DL user data is encrypted using CK2 and reaches the UE 106 . In the illustrated embodiment, at 1016, the UE 106 detects a decryption failure using CK1 (eg, using the method of FIG. 9). At 1018, the UE 106 attempts a new CK, detects successful decryption, and switches to CK2/IK2 for UL and DL DRBs.

As shown in FIG. 10B, for example, at 1020, the UE 106 encrypts the UL user data using CK2 and sends it to both gNBs, which decrypt the UL data using CK2. As previously mentioned, gNB1 may then be released.

In some embodiments, the uplink SRB PCDCP PDU switches to using the new target CK/IK key once it receives the key via RRC reconfiguration message (when the RRC entity terminates at the target gNB). In some embodiments, the network cannot send any further SRB data after the RRC Reconfiguration message until it receives the RRC Reconfiguration Complete message from the UE RRC entity. In some embodiments, this RRC reconfiguration complete message itself is encrypted with the target CK/IK key.

In some embodiments, uplink DRB PDCP PDUs are switched on a per DRB basis using one of two example techniques. In the first technique, the network may set the time interval T after receiving the HARQ Ack for the RRC Reconfiguration Complete message containing the key at the MAC layer. In these embodiments, the PDCP entity is configured to switch to a new keyset when T1 expires.

In a second technique, the PDCP transmitting entity may switch to the new keyset upon receiving the first DL PDCP PDU detected to be using the new cipher/integrity key. For UL-only traffic, the device RRC entity may provide an activation SN that indicates the latest possible PDCP SN for UL PDCP to switch key settings. This may imply that the device is free to switch PDCP keys in the UL sooner, eg, based on DL ciphering key switch detection.

In some embodiments, these techniques advantageously enable synchronization of key switchovers between mobile devices and base stations to reduce handover latency and/or reduce handover errors. good too.

In some embodiments, an apparatus (eg, baseband processor or mobile device) includes one or more processing elements that receive protocol data units from a first base station, The station is included in a set of base stations to which the mobile device is connected in a multi-connection configuration, and the protocol data unit is an RRC connection reconnection handover from a first base station to a second base station within the set of base stations. Attempting to decrypt the protocol data unit received after configuration using the first base station's encryption key and, in response to failing to decrypt the protocol data unit, using the second base station's encryption key. and, in response to successfully decrypting the protocol data unit using the second base station's encryption key, for subsequent multi-connection communications with the set of base stations: 2 base station security configuration.

In some embodiments, the inability to decipher the protocol data unit is based on detecting an integrity failure for the PDU. In some embodiments, the inability to decipher a protocol data unit is based on the inability to detect the expected format within the deciphered data.

Exemplary Security Techniques for Explicitly Signaled Security Configuration Switching In some embodiments, explicit signaling (e.g., bits in the PDCP header) is used to use the original-to-target key during DC-based handover. It may also indicate a key switch to . For example, one of the reserved (R) bits shown in the PDU header of Figure 8 may be used for such signals. This header may be sent in plaintext, but plaintext may be susceptible to security attacks (eg, forcing the UE to switch keys and lose synchronization with the network). This can lead to denial of service, for example, by corrupting DL data. In some embodiments, the disclosed techniques protect the first PDU that indicates a key switch. Similar techniques may be used for various explicit key switch signaling locations, eg, RRC signaling, new PDCP control PDUs, or new MAC control elements.

In some embodiments, in response to a first in-sequence PDCP PDU that explicitly indicates a switch, the receiving PDCP entity uses a new key (e.g., CK2) to It is configured to perform decryption and calculate MAC-i using the new key IK2. If an integrity failure occurs, the PDCP entity is configured to discard the PDCP PDU and ignore the key switch indicator. This may detect false toggling of the switching signal and avoid false switching to the new key. In some embodiments, if t reordering expires and RX_DELIV >= PDCP PDU SN (key switch indicator toggled) and integrity is successful, the keyset is switched for that DRB it is conceivable that.

In some embodiments, in response to the first in-sequence PDCP PDU that explicitly indicates a switch, if integrity is not configured, the receiving PDCP entity performs decryption using the new key CK2. is configured as A PDCP PDU may analyze the data payload (eg, detect expected formatting) and discard the PDU if a cipher mismatch is detected. In some embodiments, the receiving entity may be configured to initiate a radio link failure in response to detecting a cipher mismatch.

Thus, in some embodiments, the method comprises receiving, in the plaintext portion of the protocol data unit, information indicating a switch from the security configuration of the first base station to the security configuration of the second base station; Determining whether the decryption operation was successful for the PDU, and refusing to switch to the security configuration of the second base station in response to detecting the decryption failure. In some embodiments, the method includes causing a radio link failure in response to detecting a cryptographic mismatch.

Exemplary Enhanced MBB-based Handover with Preserving Source gNB After Path Switch In some embodiments, an enhanced make-before-break (MBB) technique is used to move the network to Configure to keep the source gNB. This technique may not require key switch synchronization and may advantageously provide diversity and reduce handover failures after handover is complete.

11A-11C are communication diagrams illustrating exemplary techniques for retaining a source gNB after path switching according to some embodiments. Referring to FIG. 11A, in the illustrated embodiment, at 1022 gNB1 is the master and gNB2 is the handover setup. The upper part of FIG. 11A shows the procedure for DL data and the lower part shows the procedure for UL data. gNB1 receives the DL user data and forwards it to gNB2. Each gNB separately encrypts its data (which may or may not be duplicated) at 1024 and 1026 . The UE 106 separately decrypts communications from the gNB using its corresponding key. Thus, the UE receives DL PDUs on two RLC legs in the illustrated example.

In the illustrated embodiment, for UL data, the UE 106 separately encrypts UL data for different gNBs with their corresponding keys, and the gNBs send the decrypted UL user data to the core network.

At the end of FIG. 11A, UE 106 sends a change request to gNB2. This may be based, for example, on a low measurement threshold for gNB1 or gNB2 meeting the threshold measurement for gNB1. Referring to FIG. 11B, at 1040 the network performs a path switching procedure. gNB2 then sends a gNB change response to UE 106 with the split DRB status and an indication that gNB1 is not released. This indication may provide an advantage over the prior art where the source gNB was dropped after a successful make-before-break handover.

11B treats the DL and UL data in the same manner as in FIG. 11A, using separate keys for separate base stations. The difference is that gNB2 is the anchor in FIG. 11B.

Referring to FIG. 11C, at 1062, 1064 and 1066, procedures for releasing gNB1 in response to measurement reports are shown. A measurement report may be sent in response to gNB1 being below the threshold. After releasing gNB1, the UE 106 may communicate with the core network via gNB2 without using dual connections. Note that in situations where gNB2 indicates that gNB1 should be released in the gNB change response of FIG. 11B, the UE 106 may immediately release gNB1 limb in response to the gNB change response.

In some embodiments, the method includes the method wherein the mobile device is also communicating with the second base station using the second security configuration during the handover procedure while the first base station and the first security Including communicating with the mobile device using the configuration. In some embodiments, the method includes remaining connected to the first base station after a role switch in which the second base station becomes an anchor base station for communicating with the mobile device.

As used herein, the term "module" refers to a circuit configured to perform a particular operation or information that instructs other circuitry (e.g., a processor) to perform a particular operation ( Refers to a physical, non-transitory computer-readable medium that stores program instructions (eg, program instructions). Accordingly, a module may be implemented in multiple ways. For example, as a hard-wired circuit or as a memory storing program instructions executable by one or more processors to perform the operations. Hardware circuits may include, for example, custom very large scale integrated (VLSI) circuits or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. A module may also be implemented in programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices, or the like. A module may also be any suitable form of non-transitory computer-readable medium for storing program instructions executable to perform specified operations.

Embodiments of the disclosure may be implemented in any of a variety of forms. For example, some embodiments may be implemented as a computer-implemented method, computer-readable storage medium, or computer system. Other embodiments may be implemented using one or more custom designed hardware devices such as ASICs. Still other embodiments may be implemented using one or more programmable hardware elements such as FPGAs.

In some embodiments, a persistent computer-readable memory medium may be configured to store program instructions and/or data, which, when executed by a computer system, cause the computer system to perform the method. for example, any of the method embodiments described herein, or any combination of the method embodiments described herein, or the Any subset of any of the embodiments, or any combination of such subsets, may be practiced.

In some embodiments, a device (eg, UE 106) may be configured to include a processor (or set of processors) and a storage medium. Here, the storage medium stores program instructions, and the processor is configured to read and execute the program instructions from the storage medium. The program instructions may be any of the various method embodiments described herein (or any combination of the method embodiments described herein or the methods described herein). or any combination of such subsets). A device may be embodied in any of a variety of forms.

Although the embodiments above have been described in sufficient detail, numerous variations and modifications will become apparent to those skilled in the art once the above disclosure is fully appreciated. It is intended that the following claims be interpreted to encompass all such variations and modifications.

Claims (15)

communicating with the first base station using a first cryptographic key of the first base station;
Receive a modification response from the second base station related to a modification procedure for establishing the second base station as a primary base station for a multi-connection configuration, the modification response to perform the modification procedure. subsequently including an indication that it remains connected to the first base station;
the first encryption key for downlink communication with the first base station and the second base station for downlink communication with the second base station, following execution of the modifying procedure; communicating with both the first base station and the second base station using a second cryptographic key of
One or more configured to release communication resources for the first base station and continue communication with the second base station in response to communication including a release indication from the second base station. A device comprising a processing element of The one or more processing elements are
2. The apparatus of claim 1, further configured to send a measurement report to the second base station to trigger the release indication from the second base station. 3. The apparatus of claim 2, wherein the measurement report includes measurement information for both the first base station and the second base station. At least one of the first base station and the second base station forwards uplink data from the device to another one of the first base station and the second base station. 2. The apparatus of claim 1, wherein: 2. The apparatus of claim 1, wherein the downlink communications with both the first base station and the second base station use different integrity keys. 2. The apparatus of claim 1, wherein the downlink communications with both the first base station and the second base station use different security configurations. The apparatus is a mobile cellular device, the mobile cellular device comprising:
one or more antennas;
2. The apparatus of claim 1, further comprising one or more radios coupled to the one or more processing elements and configured to communicate via the one or more antennas. a method,
a first base station communicating with a mobile device using a first cryptographic key of the first base station;
for a multi-connection configuration, said second base station transmitting a modification response related to a modification procedure for establishing a second base station as a primary base station , said modification response being said modification procedure; including an indication that the mobile device remains connected to the first base station following execution of;
the first encryption key for downlink communication with the first base station and the second base station for downlink communication with the second base station, following execution of the modifying procedure; both the first base station and the second base station communicating with the mobile device using a second cryptographic key of
Transmitting from the second base station to the mobile device a release indication indicating releasing communication resources for the first base station and continuing communication with the second base station. and. 9. The method of claim 8, wherein said transmitting said release indication is in response to a measurement report from said mobile device. At least one of the first base station and the second base station directs uplink data from the mobile device to another one of the first base station and the second base station. 9. The method of claim 8, further comprising forwarding. A non-transitory computer-readable medium having instructions stored thereon, the instructions comprising:
communicating with a first base station using a first cryptographic key of said first base station;
Receiving from said second base station a modification response related to a modification procedure for establishing a second base station as a primary base station for a multi-connection configuration, said modification response being said modification receiving, including an indication to remain connected to the first base station following performance of the procedure;
the first encryption key for downlink communication with the first base station and the second base station for downlink communication with the second base station, following execution of the modifying procedure; communicating with both the first base station and the second base station using a second cryptographic key of
releasing communication resources for the first base station and continuing communication with the second base station in response to communication including a release indication from the second base station. A non-transitory computer-readable medium executable by a computing device for execution. 12. The non-transitory computer-readable medium of claim 11, wherein the act comprises:
The non-transitory computer-readable medium further comprising sending a measurement report to the second base station to trigger the release indication from the second base station. at least one of the first base station and the second base station forwards uplink data from the computing device to another one of the first base station and the second base station; 12. The non-transitory computer-readable medium of claim 11 that transfers. 12. The non-transitory computer-readable medium of claim 11, wherein the downlink communications with both the first base station and the second base station use different integrity keys. 12. The non-transitory computer-readable medium of claim 11, wherein the downlink communications with both the first base station and the second base station use different security configurations.

Images