5G broadcast/multicast security

An apparatus for wireless communication, comprising:

• a memory, and
• at least one processor coupled to the memory and configured to:
• transmit, from a user equipment (UE), a data session establishment request to a service management function (SMF) for a multicast or broadcast service;
• receive at least one multicast-broadcast key for the data session, wherein to receive the at least one multicast broadcast key, the processor is configured to:
• receive a root key generated by the SMF via NAS signaling;
• and
• derive a cell-specific multicast-broadcast key for a cell of an access network node based on the root key;
• determine a radio bearer (RB) configuration for the multicast or broadcast service;
• receive one or more quality of service (QoS) flow packets for the multicast or broadcast service over the RB;
• and
• decode the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key, wherein decoding includes decrypting, verifying an integrity, or a combination thereof.

An apparatus for wireless communication, comprising:

• a memory, and
• at least one processor coupled to the memory and configured to:
• transmit, from a user equipment (UE), a data session establishment request to a service management function (SMF) for a multicast or broadcast service;
• receive at least one multicast-broadcast key for the data session from an access network node that generated the at least one multicast-broadcast key via RRC signaling;
• determine a radio bearer (RB) configuration for the multicast or broadcast service;
• receive one or more quality of service (QoS) flow packets for the multicast or broadcast service over the RB;
• and
• decode the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key, wherein decoding includes decrypting, verifying an integrity, or a combination thereof.

A method of wireless communication, comprising:

• transmitting, from a user equipment (UE), a data session establishment request to a service management function (SMF) for a multicast or broadcast service;
• receiving at least one multicast-broadcast key for the data session, wherein receiving the at least one multicast-broadcast key for the data session comprises receiving the at least one multicast-broadcast key from the SMF that generated the at least one multicast-broadcast key via NAS signaling;
• determining a radio bearer (RB) configuration for the multicast or broadcast service;
• receiving one or more quality of service (QoS) flow packets for the multicast or broadcast service over the RB;
• and
• decoding the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key, wherein decoding includes decrypting, verifying an integrity, or a combination thereof.

A method of wireless communication, comprising:

• transmitting, from a user equipment (UE), a data session establishment request to a service management function (SMF) for a multicast or broadcast service;
• receiving at least one multicast-broadcast key for the data session, wherein receiving the at least one multicast-broadcast key for the data session comprises:
• receiving a root key generated by the SMF via NAS signaling;
• and
• deriving a cell-specific multicast-broadcast key for a cell of an access network node based on the root key;
• determining a radio bearer (RB) configuration for the multicast or broadcast service;
• receiving one or more quality of service (QoS) flow packets for the multicast or broadcast service over the RB;
• and
• decoding the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key, wherein decoding includes decrypting, verifying an integrity, or a combination thereof.

A method of wireless communication, comprising:

• transmitting, from a user equipment (UE), a data session establishment request to a service management function (SMF) for a multicast or broadcast service;
• receiving at least one multicast-broadcast key for the data session, wherein receiving the at least one multicast-broadcast key for the data session comprises receiving the at least one multicast-broadcast key from an access network node that generated the at least one multicast-broadcast key via RRC signaling;
• determining a radio bearer (RB) configuration for the multicast or broadcast service;
• receiving one or more quality of service (QoS) flow packets for the multicast or broadcast service over the RB;
• and
• decoding the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key, wherein decoding includes decrypting, verifying an integrity, or a combination thereof.