System and method for security protection of NAS messages

A network element of a mobility network comprising:

• at least one processor;
• and
• at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processor, cause the network element to carry out a Non-Access Stratum (NAS) procedure in multiple phases to establish a NAS communication session between user equipment (UE) and the network element,
• wherein, in a first phase of the NAS procedure, the at least one memory and the computer program code are configured, with the at least one processor, to:
• receive, from the UE, a first initial NAS message including a first set of NAS protocol Information Elements (IEs) that are designated for security-related handling;
• construct a response to the first initial NAS message that includes a NAS security algorithm and security key set identifier associated with a NAS security context for use by the UE;
• and
• send, to the UE, the response to the first initial NAS message, and
• wherein, in a second phase of the NAS procedure, the at least one memory and the computer program code are configured, with the at least one processor, to:
• receive, from the UE, a subsequent NAS message, the subsequent NAS message including a second initial NAS message encapsulated within a NAS message container IE, the second initial NAS message defining a same message type as the first initial NAS message and including a second set of NAS protocol IEs for the NAS procedure which is different from the first set of NAS protocol IEs.

A method comprising:

• initiating a Non-Access Stratum (NAS) procedure in multiple phases to establish a NAS communication session between user equipment (UE) and a network element of a mobile network,
• wherein, in a first phase of the NAS procedure, said initiating comprises:
• constructing a first initial NAS message including a first set of NAS protocol Information Elements (IEs) that are designated for security-related handling;
• sending the first initial NAS message to the network element;
• and
• receiving a response from the network element that includes a NAS security algorithm and security key set identifier associated with a NAS security context for use by the UE, and
• wherein, in a second phase of the NAS procedure, said initiating comprises:
• constructing a subsequent NAS message, the subsequent NAS message including a second initial NAS message encapsulated within a NAS message container IE, the second initial NAS message defining a same message type as the first initial NAS message and including a second set of NAS protocol IEs for the NAS procedure which is different from the first set of NAS protocol IEs;
• and
• sending the subsequent NAS message to the network element.

A method comprising:

• causing a network element of a mobile network to carry out a Non-Access Stratum (NAS) procedure in multiple phases to establish a NAS communication session between user equipment (UE) and the network element,
• wherein, in a first phase of the NAS procedure, said causing comprises:
• receiving, from the UE, a first initial NAS message including a first set of NAS protocol Information Elements (IEs) that are designated for security-related handling;
• constructing a response to the first initial NAS message that includes a NAS security algorithm and security key set identifier associated with a NAS security context for use by the UE;
• and
• sending, to the UE, the response to the first initial NAS message, and
• wherein, in a second phase of the NAS procedure, said causing comprises:
• constructing a subsequent NAS message, the subsequent NAS message including a second initial NAS message encapsulated within a NAS message container IE, the second initial NAS message defining a same message type as the first initial NAS message and including a second set of NAS protocol IEs for the NAS procedure which is different from the first set of NAS protocol IEs;
• and
• sending the subsequent NAS message to the network element.

User equipment (UE) comprising:

• at least one processor;
• and
• at least one memory including computer program code;
• the at least one memory and the computer program code being configured to, with the at least one processor, cause the UE to initiate and perform a Non-Access Stratum (NAS) procedure to establish a NAS communication session between the UE and a network element of a mobile network;
• wherein the at least one memory and the computer program code are configured, with the at least one processor, to:
• determine that a NAS security context exists for use by the UE;
• construct a first initial NAS message, the first initial NAS message including a first set of NAS protocol Information Elements (IEs) that are designated for security-related handling, the first initial NAS message further including a second initial NAS message encapsulated within a NAS message container IE, the second initial NAS message defining a same message type as the first initial NAS message and including a second set of NAS protocol IEs for the NAS procedure, which is different from the first set of NAS protocol IEs;
• and
• send the first initial NAS message to the network element.

A network element of a mobility network comprising:

• at least one processor;
• and
• at least one memory including computer program code;
• the at least one memory and the computer program code being configured to, with the at least one processor, cause the network element to participate in performing a Non-Access Stratum (NAS) procedure to establish a NAS communication session between user equipment (UE) and the network element;
• wherein the at least one memory and the computer program code are configured, with the at least one processor, to:
• receive a first initial NAS message from the UE, the first initial NAS message including a first set of NAS protocol Information Elements (IEs) that are designated for security-related handling, the first initial NAS message further including a second initial NAS message encapsulated within a NAS message container IE, the second initial NAS message defining a same message type as the first initial NAS message and including a second set of NAS protocol IEs for the NAS procedure, which is different from the first set of NAS protocol IEs.

A method comprising:

• causing user equipment (UE) to initiate and perform a Non-Access Stratum (NAS) procedure to establish a NAS communication session between the UE and a network element of a mobile network;
• wherein said causing comprises:
• determining that a NAS security context exists for use by the UE;
• constructing a first initial NAS message, the first initial NAS message including a first set of NAS protocol Information Elements (IEs) that are designated for security-related handling, the first initial NAS message further including a second initial NAS message encapsulated within a NAS message container IE, the second initial NAS message defining a same message type as the first initial NAS message and including a second set of NAS protocol IEs for the NAS procedure, which is different from the first set of NAS protocol IEs;
• and
• sending the first initial NAS message to the network element.