# US 11,452,001 B2 · Group based context and security for massive internet of things devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,452,001 B2 - Document ID: US11452001B2 - Status: Granted - Kind: B2 - Application number: 16/480,267 - Filed: 2018-04-16 - Published: 2019-12-19 - Granted: 2022-09-20 - Earliest claimed: 2017-04-17 - Assignees: Apple Inc. - Applicants: Apple Inc. - Inventors: Ching-Yu Liao; Xiruo Liu; Liuyang Yang; Moreno Ambrosin - Web page: https://patentgrep.com/patent/US11452001B2 ## CPC - H04W 4/08: User group management - H04W 76/12: Setup of transport tunnels - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 8/08: Mobility data transfer - H04W 12/06: Authentication - H04W 12/082: using revocation of authorisation - H04W 12/086: using security domains - H04W 12/088: using filters or firewalls - H04W 12/76: Group identity - H04W 36/08: Reselecting an access point - H04W 76/11: Allocation or use of connection identifiers - H04W 76/27: Transitions between radio resource control [RRC] states - H04W 80/10: adapted for {application} session management, e.g. SIP [Session Initiation Protocol] {(connection management H04W76/00; arrangements for session management H04L67/14)} - H04W 36/13: {Cell handover without a predetermined boundary, e.g. virtual cells} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods are provided for efficient group-based handling of massive internet of things (M-IoT) devices that are compatible with both current cellular networks, and next generation 5G systems. Examples allow reduced overhead between a (radio) access network (R)AN and a core network (CN) that originates from unnecessary signaling traffic for IoT devices transitioning from IDLE to CONNECTED mode, especially when sending small data packets. In addition, or in other embodiments, mobility solutions are provided for group based M-IoT. ## Claims ### Claim 1 An apparatus for a first network entity to handle group based context and security of a group of communication devices in a communication network, the apparatus comprising: a memory interface to send or receive, to or from a memory device, information corresponding to a user plane routing profile and a group security context; and a processor to: create a group context corresponding to the group of communication devices for a service, wherein the group context comprising the user plane routing profile and the group security context; based on a service subscription of the group of communication devices, determine a network slice for the group of communication devices to use for the service; and generate a message to communicate the group context to a second network entity for storing and using for authentication of one or more of the communication devices returning from an idle or inactive mode to a connected mode for packet transmission through the communication network. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the first network entity comprises an access and mobility management function, the second network entity comprises a radio access network (RAN) node, and the group of communication devices comprise Internet of Things (IoT) user equipments (UEs), wherein the user plane routing profile comprises at least one of the following information: a packet forwarding and receiving path between the RAN node and a data gateway (DGW) in a user plane function (UPF) of a core network. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein an internet protocol (IP) address/port of the DGW in the UPF, or a serving gateway (SGW) address and tunnel end-point identifier (TEID), are determined by a session management function (S1VIF) and configured at one or more DGWs in the UPF. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the processor identifies the network slice by a network slice identifier (ID), an IPv6 prefix, or an ID associated with an IPv4 address pool, and wherein the first network entity allocates an IPv4 address within an IPv4 address pool, an IPv6 prefix, or a network slice ID to an IoT UE of the group based on the IoT UE's capability. ### Claim 5 (depends on 4) The apparatus of claim 4, wherein if the processor allocates an IPv4 address to the IoT UE, the IoT UE uses the allocated IPv4 address as the source IP address in the IP packets to be transmitted, and wherein if the processor allocates an IPv6-prefix address to the IoT UE, the IoT UE auto-configures its IPv6 address accordingly and uses the IPv6 address as the source IP address in the IP packets to be transmitted. ### Claim 6 (depends on 4) The apparatus of claim 4, wherein when the IoT UE capable of non-IP packets transmission over a user plane, the IoT UE marks the Non-IP packets with the network slice ID or group identifier, which is used to identify the corresponding stored group context, when transmitting the user plane packets. ### Claim 7 (depends on 5) The apparatus of claim 5, wherein the IoT UE sends IP packets or non-IP packets towards the second network entity, and the second network entity identifies the IP packets based on the source IP address or non-IP packets based on marked network slice ID or group identifier, and forwards the IP packets or Non-IP packets based on the stored routing profile in the group context accordingly. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the group security context comprises pair-wised symmetric keys and relevant security parameters. ### Claim 9 (depends on 1) The apparatus of claim 1, wherein the first network entity generates the group context for the service in response to a first device registering to the network when there is no group context stored at the first network entity. ### Claim 10 (depends on 1) The apparatus of claim 1, wherein the first network entity generates the group context for the service in response to an application server sending a group service request to the network and the network has authorized and authenticated the application server for the group service. ### Claim 11 (depends on 3) The apparatus of claim 3, wherein the processor of the first network entity is further configured to: process a group enrollment request from an IoT UE, wherein the group enrollment request comprises a first random nonce (N1) of a bit length N and a unique group identifier corresponding to a group to which the IoT UE requests enrollment; determine whether the first network entity already includes a stored security context for the unique group identifier; and in response to a determination that the first network entity does not include the stored security context, generate an access and mobility management function (AMF) group credentials creation request message to request creation of group credentials. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the memory interface is further to send or receive, to or from the memory device, AMF context information comprising an AMF symmetric key derived from a group master key held by an authentication server function (AUSF) and/or unified data management (UDM). ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the processor of the first network entity performs a next generation NodeB (gNB) group context creation wherein a gNB group context includes at least a gNB group key, a gNB identifier, and a counter used for key refreshing and versioning of the gNB group key. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the processer is further configured to: generate a radio access network or access network ((R)AN) group context establishment request message to deliver the gNB group key to the gNB, wherein the (R)AN group context establishment request message is integrity and confidentiality protected using an integrity key and a confidentiality key; and process a group context establishment response message from the gNB. ### Claim 15 (depends on 14) The apparatus of claim 14, wherein the processor of the first network entity is further configured to: generate a second random nonce N2 of the N2 bit length N; and generate an AMF IoT-UE group enrollment request to the gNB comprising the first random nonce N1, the second random nonce N2, the unique group identifier, and a UE identifier. ### Claim 16 (depends on 1) The apparatus of claim 1, wherein the processor of the first network entity is further configured to: process an N2 request message from a third network entity, the N2 request message including the unique group identifier corresponding to an internet of things (IoT) user equipment (UE) for handover from the second network entity to the third network entity; in response to the N2 request message, trigger a group enrollment procedure for the IoT UE including context generation and/or updates and IoT-UE token generation; modify a control plane context and a user plane context for the IoT UE; and determine whether a session management function (SMF) is to change with for the handover. ### Claim 17 (depends on 16) The apparatus of claim 16, wherein the processor of the first network entity is further configured to: generate an SMF group(s) session allocation request to the SMF for user plane function (UPF) session establishment; and generate an N2 response message to the third network entity, wherein the N2 response message include information elements for AMF IoT group enrollment. ### Claim 18 (depends on 1) The apparatus of claim 1, wherein the processor of the first network entity is further configured to: process a handover message from the second network entity, wherein the handover message includes at least one of the following: the unique group identifier corresponding to an internet of things (IoT) user equipment (UE) for handover from the second network entity to a target network entity, an identifier of the target network entity, and a location of IoT UE; select a session management function (SMF) and a user plane function (UPF) for the handover; perform a group enrollment for the IoT UE, the group enrollment comprising: generate an IoT UE token; and generate a handover request message towards the target network entity, wherein the handover request message includes information elements in RAN group context establishment message and AMF IoT-UE group enrollment request message; and in response to a handover response message from the target network entity, generate a handover command to the second network entity, wherein the handover command include IoT UE token information that is protected by a radio resource control (RRC) encryption key of the target network entity. ### Claim 19 A non-transitory computer-readable storage medium having computer-readable instructions stored thereon, the computer-readable instructions to, when executed, instruct a processor of an authentication server function (AUSF) to provide group security control in a mobile network, the computer-readable instructions to: validate an internet of things (IoT) device with a first security key for integrity (KNASint) and a second security key for confidentiality (KNASenc); send a first message to a group authority (GA) for managing group enrollment for the IoT device in respond to a second message received from the IoT device, wherein the first message includes a first token (TK1) for the IoT device to deliver a third secret key (k) together with session information including nonce, user equipment (UE) security capabilities, and identifiers, and wherein the GA uses a second token (TK2) to deliver the third secret key (k) and a seed number together with the session information. ### Claim 20 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein for the first token (TK1), the third security key (k) is encrypted by the second security key for confidentiality (KNASenc) to protect confidentiality and the integrity of the session information is protected by the first security key for integrity (KNASint). ### Claim 21 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein for the second token, the third security key (k) and the seed number are encrypted by a fourth security key (KGAenc) to protect confidentiality and the integrity of the session information is protected by a fifth security key (KGAint), wherein the fourth security key and the fifth security key are generated by the AUSF as a trust anchor between the IoT device and the GA. ### Claim 22 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein when the second message is received by the AUSF, the computer-readable instructions are further to: validate the second message with the first security key for integrity (KNASint) upon determination that the validation is passed, generate a second fresh nonce (N2), the random seed number, and a random ephemeral key as the first security key that enables mutual trust between the IoT device and the GA. ### Claim 23 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the first message is in response to the second message sent by the IoT device if the AUSF validates the IoT device successfully, wherein the second message may include the following information: a first tag value (TAG1) for the second message authentication, a first fresh random nonce (N1) to prevent replay attack and uniquely identify a new protocol session, security capabilities of the IoT device used for facilitating a crypto algorithm negotiation for message exchanges, a group identifier, and an identity for preventing misbinding attacks. ### Claim 24 (depends on 23) The non-transitory computer-readable storage medium of claim 23, wherein to guarantee the integrity of the second message and prevent message modification, the first tag value is calculated with the first security key (KNASint), which is a symmetric integrity key shared between the devices and the AUSF, and wherein the GA evaluates the group membership of the first device and sends a third message for accepting the group enrollment of the first device if the first device's membership is confirmed, the third message includes the first token (TK1) and a third token (TK3), the third token (TK3) encrypted by the first security key (k).