Security context handling in 5G during handover

A core network node in a first 5G core network of a wireless communication network, the core network node providing a source Access and Mobility Management Function, the core network node comprising:

• an interface circuit for communicating with a target Access and Mobility Management Function in the first 5G core network or a second 5G core network;
• and
• a processing circuit configured to:
• receive, from a source base station in an access network of the wireless communication network, a first handover message indicating that a handover of a user equipment is needed;
• generate, responsive to determining that an operator specific policy has been met, a new non-access stratum key from a current non-access stratum key used in a current NAS security context shared between the user equipment and the source Access and Mobility Management Function;
• and
• send the new non-access stratum key to a target Access and Mobility Management Function;
• receive, from the Access and Mobility Management Function, a transparent container containing a key change indicator flag set to a value indicating that a non-access stratum key has been changed;
• and
• send the transparent container to the user equipment in a second handover message.

A security method implemented by a user equipment in a wireless communication network that is handed over from a source Access and Mobility Management Function in a first 5G network to a target Access and Mobility Management Function in the first 5G core network or a second 5G core network, the method comprising:

• receiving a handover message from a source base station in the wireless communication network, said handover message including a transparent container containing a key change indicator flag set to a value indicating that a non-access stratum key has been changed;
• performing a handover from the source base station to a target base station in the wireless communication network;
• and
• generating, responsive to the key change indicator flag, a new non-access stratum key from a current non-access stratum key used in a current non-access stratum security context shared with a source Access and Mobility Management Function;
• and
• establishing a new non-access stratum security context with the target Access and Mobility Management Function, said new non-access stratum security context including the new non-access stratum key.

A user equipment in a 5G wireless communication network configured to implement a security procedure during a handover from a source Access and Mobility Management Function in a first 5G core network to a target Access and Mobility Management Function in the first 5G core network or a second 5G core network, the user equipment comprising:

• an interface circuit for communicating with network nodes in the wireless communication network;
• and
• a processing circuit configured to:
• receive a handover message from a source base station in the wireless communication network, said handover message including a transparent container containing a key change indicator flag set to a value indicating that a non-access stratum key has been changed;
• perform a handover from the source base station to a target base station in a mobility management domain of a target Access and Mobility Management Function;
• and
• generate, responsive to the key change indicator flag, a new non-access stratum key from a current non-access stratum key used in a current non-access stratum security context shared with a source Access and Mobility Management Function;
• and
• establish a new non-access stratum security context with the target Access and Mobility Management Function, said new non-access stratum security context including the new non-access stratum key.