Determining security keys

A method performed by a network node for determining security keys, the method comprising:

• determining, for each candidate primary secondary cell (PSCell) of a plurality of candidate PSCells for conditional addition or conditional change by a wireless device for dual connectivity, a respective security key for communications between the wireless device and the candidate PSCell, wherein the respective security key is determined based on a master key and a respective value associated with the candidate PSCell, wherein the value associated with the candidate PSCell is different to the value associated with at least one other candidate PSCell;
• sending, for each candidate PSCell, the respective security key to a respective candidate secondary node associated with the candidate PSCell;
• sending, to the wireless device, one or more configurations for configuring the wireless device with the plurality of candidate PSCells, wherein the one or more configurations indicate the respective values associated with the candidate PSCells, wherein the values associated with the candidate PSCells are associated with a first primary cell for the wireless device;
• and
• for each candidate PSCell, sending, to the wireless device, a respective further value associated with the candidate PSCell, wherein the further value associated with the candidate PSCell is different to the value associated with the candidate PSCell and is different to the further value associated with at least one other candidate PSCell, and wherein the further values associated with the candidate PSCells are associated with a second primary cell for the wireless device.

Apparatus in a wireless device for determining security keys, the apparatus comprising a processor and a memory, the memory containing instructions executable by the processor such that the apparatus is operable to:

• for each candidate primary secondary cell (PSCell) of a plurality of candidate PSCells for conditional addition or conditional change by the wireless device for dual connectivity, receive, from a network node, a respective value associated with the candidate PSCell, wherein the value associated with the candidate PSCell is different to the value associated with at least one other candidate PSCell;
• when a condition associated with a first candidate PSCell of the plurality of candidate PSCells is fulfilled, a respective security key for communications between the wireless device and the first candidate PSCell, wherein the respective security key is determined based on a master key and the respective value associated with the first candidate PSCell, wherein the values associated with the candidate PSCells are associated with a first primary cell for the wireless device;
• for each candidate PSCell, receive, from the network node, a respective further value associated with the candidate PSCell, wherein the further value associated with the candidate PSCell is different to the value associated with the candidate PSCell and is different to the further value associated with at least one other candidate PSCell, and wherein the further values associated with the candidate PSCells are associated with a second primary cell for the wireless device;
• and
• when a condition associated with a second candidate PSCell of the plurality of candidate PSCells is fulfilled, determine a respective security key for communications between the wireless device and the second candidate PSCell, wherein the respective security key is determined based on a master key and the respective further value associated with the second candidate PSCell, wherein the further values associated with the candidate PSCells are associated with a secondary primary cell for the wireless device.

Apparatus in a network node for determining security keys, the apparatus comprising a processor and a memory, the memory containing instructions executable by the processor such that the apparatus is operable to:

• determine, for each candidate primary secondary cell (PSCell) of a plurality of candidate PSCells for conditional addition or conditional change by a wireless device for dual connectivity, a respective security key for communications between the wireless device and the candidate PSCell, wherein the respective security key is determined based on a master key and a respective value associated with the candidate PSCell, wherein the value associated with the candidate PSCell is different to the value associated with at least one other candidate PSCell;
• send, for each candidate PSCell, the respective security key to a respective candidate secondary node associated with the candidate PSCell;
• send, to the wireless device, one or more configurations for configuring the wireless device with the plurality of candidate PSCells, wherein the one or more configurations indicate the respective values associated with the candidate PSCells, wherein the values associated with the candidate PSCells are associated with a first primary cell for the wireless device;
• and
• for each candidate PSCell, send, to the wireless device, a respective further value associated with the candidate PSCell, wherein the further value associated with the candidate PSCell is different to the value associated with the candidate PSCell and is different to the further value associated with at least one other candidate PSCell, and wherein the further values associated with the candidate PSCells are associated with a second primary cell for the wireless device.