Network architecture and security with encrypted client device contexts

A client device comprising:

• a wireless communication circuit configured to communicate with a network access node;
• and
• a processing circuit coupled to the wireless communication circuit, the processing circuit configured to
• transmit a request to communicate with a network;
• establish a security context for a connection with the network, wherein the security context includes at least an encryption algorithm, an encryption key, an integrity protection algorithm, an integrity protection key, or combinations thereof;
• receive one or more encrypted client device contexts from the network in response to the request;
• and
• transmit a message that includes at least one of the one or more encrypted client device contexts to the network, wherein the one or more encrypted client device contexts enable reconstruction of a context at the network for communication with the client device, the context including network state information associated with the client device.

A method for a network device, comprising:

• receiving, from a client device, a request to communicate with a network;
• establishing at least one context with the client device, the at least one context including network state information associated with a connection between the client device and the network, wherein the network state information includes at least an encryption algorithm, an encryption key, an integrity protection algorithm, an integrity protection key, or combinations thereof;
• generating one or more encrypted client device contexts, wherein the one or more encrypted client device contexts enable reconstruction of the at least one context at the network for communication with the client device;
• and
• transmitting the one or more encrypted client device contexts to the client device.

A network device comprising:

• a network communication interface configured to communicate with one or more network entities;
• and
• a processing circuit coupled to the network communication interface, the processing circuit configured to
• receive, from a client device, a request to communicate with a network;
• establish at least one context with the client device, the at least one context including network state information associated with a connection between the client device and the network, wherein the network state information includes at least an encryption algorithm, an encryption key, an integrity protection algorithm, an integrity protection key, or combinations thereof;
• generate one or more encrypted client device contexts, wherein the one or more encrypted client device contexts enable reconstruction of the at least one context at the network for communication with the client device;
• and
• transmit the one or more encrypted client device contexts to the client device.

A method for a network device, comprising:

• obtaining a key for an encrypted client device context associated with a client device;
• receiving a first data packet and the encrypted client device context from the client device;
• obtaining a security context for the client device from the encrypted client device context using the key;
• decrypting and verifying the first data packet based on the security context;
• and
• forwarding the first data packet to a service network when the decryption and verification are successful.

A network device, comprising:

• a network communication interface configured to communicate with one or more network entities;
• and
• a processing circuit coupled to the network communication interface, the processing circuit configured to
• obtain a key for an encrypted client device context associated with a client device;
• receive a first data packet and the encrypted client device context from the client device;
• obtain a security context for the client device from the encrypted client device context using the key;
• decrypt and verify the first data packet based on the security context;
• and
• forward the first data packet to the service network when the decryption and verification are successful.

A method for a network access node, comprising:

• receiving, from a client device, a first data packet with a request to communicate with a network;
• determining a network node to which the first data packet is intended;
• receiving a second data packet from a network function implemented at the network node;
• and
• determining the client device to which the second data packet is to be forwarded.

A network access node, comprising:

• a communication circuit configured to communicate with one or more network entities;
• and
• a processing circuit coupled to the communication circuit, the processing circuit configured to
• receive, from a client device, a first data packet with a request to communicate with a network;
• determine a network node to which the first data packet is intended;
• receive a second data packet from a network function implemented at the network node;
• and
• determine the client device to which the second data packet is to be forwarded.