Methods providing security for multiple NAS connections using separate counts and related network nodes and wireless terminals

A first communication node adapted to provide communication of Network Access Stratum, NAS, messages with a second communication node, wherein the first and second NAS connections share a master key of a NAS security context, and wherein the first communication node comprises:

• a processor;
• and
• a memory storing instructions that, when executed by the processor, cause the first communication device to perform operations comprising is adapted to:
• providing a first NAS connection identification for a first NAS connection between the first and second communication nodes;
• providing a second NAS connection identification for a second NAS connection between the first communication node and the second communication node, wherein the first NAS connection identification and the second NAS connection identification are different NAS connection identifications and the first NAS connection and the second NAS connection are different NAS connections and share the master key of the NAS security context to thereby provide separation for authentication of different NAS connections for the first communication device;
• communicating a first NAS message between the first communication node and the second communication node over the first NAS connection by at least one of performing integrity protection or performing confidentiality protection for the first NAS message using the first NAS connection identification;
• responsive to determining to perform the integrity protection for the first NAS message, performing the integrity protection for the first NAS message by generating a first message authentication code based on the first NAS connection identification, the master key, and the first NAS message;
• transmitting the first NAS message with the first message authentication code over the first NAS connection to the second communication node;
• communicating a second NAS message between the first communication node and the second communication node over the second NAS connection by at least one of performing integrity protection or performing confidentiality protection for the second NAS message using the second NAS connection identification;
• responsive to determining to perform the integrity protection of the second NAS message, performing the integrity protection for the second NAS message by generating a second message authentication code based on the second NAS connection identification, the master key, and the second NAS message;
• and
• transmitting the second NAS message with the second message authentication code over the second NAS connection to the second communication node.

A first communication node comprising:

• a communication interface configured to provide communication with a second communication node;
• a processor coupled with the communication interface, wherein the processor is configured to transmit communications to the second communication node and/or receive communications from the second communication node through the communication interfaces;
• and
• a memory storing instructions that, when executed by the processor, configure the processor to:
• provide a first Network Access Stratum, NAS, connection identification for a first NAS connection between the first communication node and the second communication node;
• provide a second NAS connection identification for a second NAS connection between the first communication node and the second communication node, wherein the first NAS connection identification and the second NAS connection identification are different NAS connection identifications, wherein the first and second NAS connections are different, and wherein the first NAS connection and the second NAS connection share a master key of a NAS security context;
• communicate a first NAS message between the first communication node and the second communication node over the first NAS connection, by at least one of performing integrity protection or performing confidentiality protection for the first NAS message using the first NAS connection identification;
• responsive to determining to perform the integrity protection for the first NAS message, performing the integrity protection for the first NAS message by generating a first message authentication code based on the first NAS connection identification, the master key, and the first NAS message;
• transmitting the first NAS message with the first message authentication code over the first NAS connection to the second communication node;
• communicate a second NAS message between the first communication node and the second communication node by at least one of performing integrity protection for performing confidentiality protection for the second NAS message using the second NAS connection identification;
• responsive to determining to perform the integrity protection for the first NAS message, performing the integrity protection for the second NAS message by generating a second message authentication code based on the second NAS connection identification, the master key, and the second NAS message;
• and
• transmitting the second NAS message with the second message authentication code over the second NAS connection to the second communication node.