Methods, nodes and communication device for establishing a key related to at least two network instances

A network node of a wireless communication network to derive a joint key to encrypt a first network instance of a first network slice of the wireless communication network and a second network instance of a second network slice of the wireless communication network, each of the first and second network instances serving a wireless communication device operating in the wireless communication network, the network node comprising:

• a hardware processor configured to:
• establish the first network instance of the first network slice with the wireless communication device;
• responsive to the establishment of the first network instance, derive a first key to encrypt communications exchanged between the wireless communication device and the network node in the first network instance;
• establish the second network instance of the second network slice with the wireless communication device;
• responsive to the establishment of the second network instance, derive a second key to encrypt communications exchanged between the wireless communication device and the network node in the second network instance;
• responsive to deriving the second key, derive, based on the first key and the second key, the joint key to encrypt communications exchanged between the network node and the wireless communication device in the first network instance and in the second network instance;
• and
• encrypt communications exchanged between the network node and the wireless communication device in the first network instance and the second network instance using cryptographic keys derived from the joint key,
• wherein the first network instance comprises first access stratum and first non-access stratum communications exchanged respectively in an access stratum protocol layer and a non-access stratum protocol layer of the wireless communication network;
• and
• wherein the second network instance comprises second access stratum and second non-access stratum communications exchanged respectively in the access stratum protocol and the non-access stratum protocol layer of the wireless communication network.

A method performed by a wireless communication device operating in a wireless communication network to derive a joint key to encrypt a first network instance of a first network slice of the wireless communication network and a second network instance of a second network slice of the wireless communication network, each of the first and second network instances serving the wireless communication device, the method comprising:

• establishing the first network instance of the first network slice with a network node of the wireless communication network;
• responsive to establishing the first network instance, deriving a first key to encrypt communications exchanged between the wireless communications device and the network node in the first network instance;
• establishing the second network instance of the second network slice with the network node of the wireless communication network;
• responsive to establishing the second network instance, deriving a second key to encrypt communications exchanged between the wireless communications device and the network node in the second network instance;
• responsive to deriving the second key, deriving, based on the first key and the second key, the joint key to encrypt communications exchanged between the wireless communication device and the network node in the first network instance and in the second network instance;
• and
• encrypting communications exchanged between the wireless communication device and the network node in the first network instance and the second network instance cryptographic keys derived from the joint key,
• wherein the first network instance comprises first access stratum and first non-access stratum communications exchanged respectively in an access stratum protocol layer and a non-access stratum protocol layer of the wireless communication network;
• and
• wherein the second network instance comprises second access stratum and second non-access stratum communications exchanged respectively in the access stratum protocol and the non-access stratum protocol layer of the wireless communication network.

A wireless communication device for deriving a joint key to encrypt a first network instance of a first network slice of the wireless communication network and a second network instance of a second network slice of the wireless communication network, each of the first and second network instances serving the wireless communication device, the communication device being configured to:

• establish the first network instance of the first network slice with a network node of the wireless communication network;
• responsive to the establishment of the first network instance, derive a first key to encrypt communications exchanged between the wireless communications device and the network node in the first network instance;
• establish the second network instance of the second network slice with the network node of the wireless communication network;
• responsive to the establishment of the second network instance, derive a second key to encrypt communications exchanged between the wireless communications device and the network node in the second network instance;
• responsive to deriving the second key, determine, based on the first key and the second key, the joint key to encrypt communications exchanged between the wireless communication device and the network node in the first network instance and in the second network instance;
• and
• encrypt communications exchanged between the wireless communication device and the network node in the first network instance and the second network instance cryptographic keys derived from the joint key,
• wherein the first network instance comprises first access stratum and first non-access stratum communications exchanged respectively in an access stratum protocol layer and a non-access stratum protocol layer of the wireless communication network;
• and
• wherein the second network instance comprises second access stratum and second non-access stratum communications exchanged respectively in the access stratum protocol and the non-access stratum protocol layer of the wireless communication network.