# US 10,771,978 B2 · Methods providing security for multiple NAS connections using separate counts and related network nodes and wireless terminals > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,978 B2 - Document ID: US10771978B2 - Status: Granted - Kind: B2 - Application number: 16/473,311 - Filed: 2018-05-07 - Published: 2020-03-26 - Granted: 2020-09-08 - Earliest claimed: 2017-05-08 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget LM Ericsson (publ) - Inventors: Noamen Ben Henda; Monica Wifvesson - Web page: https://patentgrep.com/patent/US10771978B2 ## CPC - H04W 12/069: using certificates or pre-shared keys - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04W 12/033: of the user plane, e.g. user's traffic - H04W 12/041: Key generation or derivation - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04W 12/106: Packet or message integrity - H04W 72/52: based on load - H04W 76/15: Setup of multiple wireless link connections - H04L 2209/80: Wireless - H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks - H04W 88/06: adapted for operation in multiple networks {or having at least two operational modes}, e.g. multi-mode terminals - H04W 88/10: adapted for operation in multiple networks, e.g. multi-mode access points - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of transmission scheduling for one or more process devices (P1, P2, P3, P4) in an industrial application (IA), such as a sensor, an actuator and/or a process controller, capable of wireless communication, implemented by a radio control unit (LRC, GRC), is proposed, the method comprising: determining with respect to the industrial application (IA) whether a licensed shared access spectrum (LSA) is available and assigning to the one or more process devices (P1, P2, P3, P4), based on a traffic type of the data to be transmitted by the one or more process devices (P1, P2, P3, P4), an access spectrum within the licensed shared access spectrum (LSA). ## Claims ### Claim 1 A method at a first communication node providing communication of Network Access Stratum, NAS, messages with a second communication node, the method comprising: providing a first NAS connection identification for a first NAS connection between the first communication node and the second communication node, wherein the first communication node comprises a communication device; providing a second NAS connection identification for a second NAS connection between the first communication node and the second communication node, wherein the first NAS connection identification and the second NAS connection identification are different and the first NAS connection and the second NAS connection are different NAS connections and share a master key of a NAS security context to thereby provide separation for authentication of different NAS connections for the first communication device; communicating a first NAS message between the first communication node and the second communication node over the first NAS connection by at least one of performing integrity protection or performing confidentiality protection for the first NAS message using the first NAS connection identification; responsive to determining to perform the integrity protection for the first NAS message, performing the integrity protection for the first NAS message by generating a first message authentication code based on the first NAS connection identification, the master key, and the first NAS message; transmitting the first NAS message with the first message authentication code over the first NAS connection to the second communication node; communicating a second NAS message between the first communication node and the second communication node over the second NAS connection by at least one of performing integrity protection or performing confidentiality protection for the second NAS message using the second NAS connection identification; responsive to determining to perform the integrity protection for the second NAS message, performing the integrity protection for the second NAS message by generating a second message authentication code based on the second NAS connection identification, the master key, and the second NAS message; and transmitting the second NAS message with the second message authentication code over the second NAS connection to the second communication node. ### Claim 2 (depends on 1) The method of claim 1, wherein the first NAS connection identification is provided as an input to generate the first message authentication code, and wherein the second NAS connection identification is provided as an input to generate the second message authentication code. ### Claim 3 (depends on 1) The method of claim 1, wherein performing integrity protection for the first NAS message comprises performing integrity protection for the first NAS message using a 5G compatible EIA integrity protection interface, and wherein performing integrity protection for the second NAS message comprises performing integrity protection for the second NAS message using the 5G compatible EIA integrity protection interface. ### Claim 4 (depends on 1) The method of claim 1, wherein the first NAS connection is provided through a 3GPP access node between the first communication node and the second communication node and the second NAS connection is provided through a non-3GPP access node between the first communication node and the second communication node, or wherein the first NAS connection is provided through a non-3GPP access node between the first communication node and the second communication node and the second NAS connection is provided through a 3GPP access node between the first communication node and the second communication node. ### Claim 5 (depends on 4) The method of claim 4, wherein the 3GPP access node comprises a radio access network base station, and wherein the non-3GPP access node comprises at least one of a WiFi access node and/or a satellite access node. ### Claim 6 (depends on 1) The method of claim 1, wherein the first NAS connection and the second NAS connection are maintained concurrently between the first communication node and the second communication node. ### Claim 7 (depends on 1) The method of claim 1, wherein the first communication node comprises a network node of a wireless communication network and the second communication node comprises a wireless terminal, or wherein the first communication node comprises a wireless terminal and the second communication node comprises a network node of a wireless communication network. ### Claim 8 (depends on 1) The method of claim 1, the method further comprising: establishing a Packet Data Unit, PDU, session based on the first NAS message and the second NAS message_ to communicate user plane data between the first and second communication nodes. ### Claim 9 A first communication node adapted to provide communication of Network Access Stratum, NAS, messages with a second communication node, wherein the first and second NAS connections share a master key of a NAS security context, and wherein the first communication node comprises: a processor; and a memory storing instructions that, when executed by the processor, cause the first communication device to perform operations comprising is adapted to: providing a first NAS connection identification for a first NAS connection between the first and second communication nodes; providing a second NAS connection identification for a second NAS connection between the first communication node and the second communication node, wherein the first NAS connection identification and the second NAS connection identification are different NAS connection identifications and the first NAS connection and the second NAS connection are different NAS connections and share the master key of the NAS security context to thereby provide separation for authentication of different NAS connections for the first communication device; communicating a first NAS message between the first communication node and the second communication node over the first NAS connection by at least one of performing integrity protection or performing confidentiality protection for the first NAS message using the first NAS connection identification; responsive to determining to perform the integrity protection for the first NAS message, performing the integrity protection for the first NAS message by generating a first message authentication code based on the first NAS connection identification, the master key, and the first NAS message; transmitting the first NAS message with the first message authentication code over the first NAS connection to the second communication node; communicating a second NAS message between the first communication node and the second communication node over the second NAS connection by at least one of performing integrity protection or performing confidentiality protection for the second NAS message using the second NAS connection identification; responsive to determining to perform the integrity protection of the second NAS message, performing the integrity protection for the second NAS message by generating a second message authentication code based on the second NAS connection identification, the master key, and the second NAS message; and transmitting the second NAS message with the second message authentication code over the second NAS connection to the second communication node. ### Claim 10 (depends on 9) The first communication node of claim 9, wherein the first NAS connection identification is provided as an input to generate the first message authentication code, and wherein the second NAS connection identification is provided as an input to generate the second message authentication code. ### Claim 11 (depends on 9) The first communication node of claim 9, wherein performing integrity protection for the first NAS message comprises performing integrity protection for the first NAS message using a 5G compatible EIA integrity protection interface, and wherein performing integrity protection for the second NAS message comprises performing integrity protection for the second NAS message using the 5G compatible EIA integrity protection interface. ### Claim 12 (depends on 9) The first communication node of claim 9, wherein the first NAS connection is provided through a 3GPP access node between the first communication node and the second communication node and the second NAS connection is provided through a non-3GPP access node between the first communication node and the second communication node, or wherein the first NAS connection is provided through a non-3GPP access node between the first communication node and the second communication node and the second NAS connection is provided through a 3GPP access node between the first communication node and the second communication node. ### Claim 13 (depends on 12) The first communication node of claim 12, wherein the 3GPP access node comprises a radio access network base station, and wherein the non-3GPP access node comprises at least one of a WiFi access node and/or a satellite access node. ### Claim 14 (depends on 9) The first communication node of any of claim 9, wherein the first NAS connection and the second NAS connection are maintained concurrently between the first and second communication nodes. ### Claim 15 (depends on 9) The first communication node of any of claim 9, wherein the first communication node comprises a network node of a wireless communication network and the second communication node comprises a wireless terminal, or wherein the first communication node comprises a wireless terminal and the second communication node comprises a network node of a wireless communication network. ### Claim 16 (depends on 9) The first communication node of any of claim 9, wherein the first communication node is further adapted to: establishing a Packet Data Unit, PDU, session based on the first NAS message and the second NAS message to communicate user plane data between the first communication node and the second communication node. ### Claim 17 A first communication node comprising: a communication interface configured to provide communication with a second communication node; a processor coupled with the communication interface, wherein the processor is configured to transmit communications to the second communication node and/or receive communications from the second communication node through the communication interfaces; and a memory storing instructions that, when executed by the processor, configure the processor to: provide a first Network Access Stratum, NAS, connection identification for a first NAS connection between the first communication node and the second communication node; provide a second NAS connection identification for a second NAS connection between the first communication node and the second communication node, wherein the first NAS connection identification and the second NAS connection identification are different NAS connection identifications, wherein the first and second NAS connections are different, and wherein the first NAS connection and the second NAS connection share a master key of a NAS security context; communicate a first NAS message between the first communication node and the second communication node over the first NAS connection, by at least one of performing integrity protection or performing confidentiality protection for the first NAS message using the first NAS connection identification; responsive to determining to perform the integrity protection for the first NAS message, performing the integrity protection for the first NAS message by generating a first message authentication code based on the first NAS connection identification, the master key, and the first NAS message; transmitting the first NAS message with the first message authentication code over the first NAS connection to the second communication node; communicate a second NAS message between the first communication node and the second communication node by at least one of performing integrity protection for performing confidentiality protection for the second NAS message using the second NAS connection identification; responsive to determining to perform the integrity protection for the first NAS message, performing the integrity protection for the second NAS message by generating a second message authentication code based on the second NAS connection identification, the master key, and the second NAS message; and transmitting the second NAS message with the second message authentication code over the second NAS connection to the second communication node. ### Claim 18 (depends on 17) The first communication node of claim 17, wherein the first NAS connection identification is provided as an input to generate the first message authentication code, and wherein the second NAS connection identification is provided as an input to generate the second message authentication code. ### Claim 19 (depends on 17) The first communication node of claim 17, wherein performing integrity protection for the first NAS message comprises performing integrity protection for the first NAS message using a 5G compatible EIA integrity protection interface, and wherein performing integrity protection for the second NAS message comprises performing integrity protection for the second NAS message using the 5G compatible EIA integrity protection interface. ### Claim 20 (depends on 17) The first communication node of claim 17, wherein the first NAS connection is provided through a 3GPP access node between the first communication node and the second communication node and the second NAS connection is provided through a non-3GPP access node between the first communication node and the second communication node, or wherein the first NAS connection is provided through a non-3GPP access node between the first communication node and the second communication node and the second NAS connection is provided through a 3GPP access node between the first communication node and the second communication node. ### Claim 21 (depends on 20) The first communication node of claim 20, wherein the 3GPP access node comprises a radio access network base station, and wherein the non-3GPP access node comprises at least one of a WiFi access node and/or a satellite access node. ### Claim 22 (depends on 17) The first communication node of claim 17, wherein the first NAS connection and the second NAS connection are maintained concurrently between the first and second communication nodes. ### Claim 23 (depends on 17) The first communication node of claim 17, wherein the first communication node comprises a network node of a wireless communication network and the second communication node comprises a wireless terminal, or wherein the first communication node comprises a wireless terminal and the second communication node comprises a network node of a wireless communication network. ### Claim 24 (depends on 17) The first communication node of claim 17, wherein the processor is further configured to, establish a Packet Data Unit, PDU, session based on the first NAS message and the second NAS message to communicate user plane data between the first communication node and the second communication node.