Next generation key set identifier

An apparatus comprising:

• at least one processor;
• and
• at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform at least:
• requesting authentication of a user equipment with an authentication server;
• in an instance in which the authentication by the authentication server is successful, receiving, during an authentication and key agreement protocol, from the authentication server, authentication vectors comprising a particular master key from among a plurality of master keys and authentication parameters;
• storing the particular master key and the authentication parameters at the apparatus;
• verifying validity of authentication parameters/vectors;
• in an instance in which the verification has been successful, instantiating a security context for the user equipment and assigning a security context identifier for next generation system security context to the user equipment;
• sending, to the user equipment, a security mode command message to instruct the user equipment to instantiate a Non-Access Stratum (NAS) security context using the security context identifier,
• wherein the security context identifier comprises a next generation key set identifier (NG-KSI) that is usable by the user equipment and the apparatus to identify the NAS security context during mobility events without the apparatus providing the authentication parameters to the user equipment, and
• wherein the NG-KSI comprises a first field indicating an assigned index value and a second field indicating a type of security context parameter, wherein the second field further indicates whether a next generation security context is a native next generation security context derived out of next generation authentication of the user equipment or a mapped next generation security context derived out of a non-next generation authentication of the user equipment;
• and
• receiving, from the user equipment, in response to the security mode command message, a security mode command acceptance message indicating that the user equipment has instantiated the NAS security context using the NG-KSI.

A method comprising:

• sending, from a user equipment, to an access node of a communication system, an attach request;
• after authentication verification of the user equipment at an authentication server of the communication system, receiving, at the user equipment, from a security anchor function or a common control network function of the communication system, via the access node, a security mode command message, wherein the security mode command message comprises a security context identifier for a next generation system security context;
• instantiating, at the user equipment, a non-access stratum (NAS) security context using the security context identifier;
• and
• sending, from the user equipment, to the access node, a security mode command acceptance message indicating that the user equipment has instantiated the NAS security context using the security context identifier,
• herein the security context identifier comprises a next generation key set identifier (NG-KSI) that is usable by the user equipment and the security anchor function or the common control network function to identify the NAS security context during mobility events without the user equipment receiving authentication parameters from the security anchor function or the common control network function, and
• wherein the NG-KSI comprises a first field indicating an assigned index value and a second field indicating a type of security context parameter, wherein the second field further indicates whether a next generation security context is a native next generation security context derived out of next generation authentication of the user equipment or a mapped next generation security context derived out of a non-next generation authentication of the user equipment.

An apparatus comprising:

• at least one processor;
• and
• at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform at least:
• sending, to an access node of a communication system, an attach request;
• after authentication verification of the apparatus at an authentication server of the communication system based on said attach request, receiving, from a security anchor function or a common control network function of the communication system, via the access node, a security mode command message, wherein the security mode command message comprises a security context identifier for a next generation system security context;
• instantiating a non-access stratum (NAS) security context using the security context identifier;
• and
• sending, to the access node, a security mode command acceptance message indicating that the apparatus has instantiated the NAS security context using the security context identifier,
• wherein the security context identifier comprises a next generation key set identifier (NG-KSI) that is usable by the apparatus and the security anchor function or the common control network function to identify the NAS security context during mobility events without the apparatus receiving authentication parameters from the security anchor function or the common control network function, and
• wherein the NG-KSI comprises a first field indicating an assigned index value and a second field indicating a type of security context parameter, wherein the second field further indicates whether a next generation security context is a native next generation security context derived out of next generation authentication of the apparatus or a mapped next generation security context derived out of a non-next generation authentication of the apparatus.