# US 2019/0174368 A1 · Security handling for network slices in cellular networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0174368 A1 - Document ID: US20190174368A1 - Status: Published application - Kind: A1 - Application number: 16/319,784 - Filed: 2016-07-22 - Published: 2019-06-06 - Earliest claimed: 2016-07-22 - Assignees: Nokia Technologies Oy - Applicants: Nokia Technologies Oy - Inventors: Guillaume DECARREAU; Andreas MAEDER - Web page: https://patentgrep.com/patent/US20190174368A1 ## CPC - H04W 36/0038: {of security context information} - H04W 12/037: of the control plane, e.g. signalling traffic - H04W 24/10: Scheduling measurement reports {; Arrangements for measurement reports} - H04W 36/24: Reselection being triggered by specific parameters - H04W 76/12: Setup of transport tunnels - H04W 80/02: Data link layer protocols - H04W 80/08: Upper layer protocols {(network arrangements or communication protocols for networked applications H04L67/00)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles - H04W 36/08: Reselecting an access point - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and apparatus, including computer program products, are provided for mobility. In some example embodiments, there may be provided a method that includes determining whether to handover to a target base station, the determining based on whether a security level of the target base station satisfies a security threshold; enabling a relocation of a packet data convergence protocol entity to enable ciphering a tunnel to a user equipment, when the security level satisfies the security threshold; and inhibiting the relocation of the packet data convergence protocol entity to inhibit ciphering a tunnel to the user equipment, when the security level does not satisfy the security threshold. Related systems, methods, and articles of manufacture are also described. ## Claims ### Claim at position 1 1-20. (canceled) ### Claim 21 An apparatus comprising: at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to at least: determine, by the apparatus, whether to handover a user equipment to a target base station, the determination based on whether a security level of the target base station satisfies a security threshold; enable, when the security level satisfies the security threshold, a relocation of a packet data convergence protocol entity to enable ciphering of a tunnel to the user equipment; and inhibit, when the security level does not satisfy the security threshold, the relocation of the packet data convergence protocol entity to inhibit ciphering of a tunnel to the user equipment. ### Claim 22 (depends on 21) The apparatus of claim 21, wherein the relocation of the packet data convergence protocol entity enables an establishment of a secure session to the user equipment, and/or enables an establishment of a secure connection to the user equipment by at least enabling a relocation of ciphering information to the target base station. ### Claim 23 (depends on 21) The apparatus of claim 21, wherein to inhibit the relocation of the packet data convergence protocol entity, the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus to at least: relocate, to the target base station, a radio link protocol, a media access control protocol, and/or a radio link control protocol. ### Claim 24 (depends on 21) The apparatus of claim 21, wherein to inhibit the relocation of the packet data convergence protocol entity, the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus to at least: relocate, to a third node, at least the packet data convergence protocol entity, wherein the third node satisfies the security threshold; and relocate, to the target base station, a radio link protocol, a media access control protocol, and/or a radio link control protocol. ### Claim 25 (depends on 24) The apparatus of claim 24, wherein the third node comprises a third base station and/or a secure node implemented in a network. ### Claim 26 (depends on 21) The apparatus of claim 21, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus to at least determine whether to handover the user equipment to the target base station based on a measurement report received from the user equipment. ### Claim 27 (depends on 21) The apparatus of claim 21, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus to at least: receive the security level of at least one neighboring base station including the target base station. ### Claim 28 (depends on 21) The apparatus of claim 21, wherein the security threshold is specific to a network slice, specific to the user equipment, and/or predetermined for a plurality of base stations including the target base station. ### Claim 29 (depends on 21) The apparatus of claim 21, wherein the security level of at least one neighboring base station is received via a broadcast, received from a core network node, and/or received during an instantiation of a network slice. ### Claim 30 (depends on 21) The apparatus of claim 21, wherein the security level for a network slice is obtained from subscription information of the user equipment. ### Claim 31 A method comprising: determining, at a source base station, whether to handover a user equipment to a target base station, the determining based on whether a security level of the target base station satisfies a security threshold; enabling, when the security level satisfies the security threshold, a relocation of a packet data convergence protocol entity to enable ciphering of a tunnel to the user equipment; and inhibiting, when the security level does not satisfy the security threshold, the relocation of the packet data convergence protocol entity to inhibit ciphering of a tunnel to the user equipment. ### Claim 32 (depends on 31) The method of claim 31, wherein the relocation of the packet data convergence protocol entity enables an establishment of a secure session to the user equipment and/or an establishment of a secure connection to the user equipment by at least enabling the relocation of ciphering information to the target base station. ### Claim 33 (depends on 31) The method of claim 31, wherein the inhibiting further comprises relocating, to the target base station, a radio link protocol, a media access control protocol, and/or a radio link control protocol. ### Claim 34 (depends on 31) The method of claim 31, wherein the inhibiting further comprises: relocating, to a third node, at least the packet data convergence protocol entity, wherein the third node satisfies the security threshold; and relocating, to the target base station, a radio link protocol, a media access control protocol, and/or a radio link control protocol. ### Claim 35 (depends on 34) The method of claim 34, wherein the third node comprises a third base station and/or a secure node implemented in a network. ### Claim 36 (depends on 31) The method of claim 31, wherein the determining is performed in response to receiving a measurement report from the user equipment. ### Claim 37 (depends on 31) The method of claim 31, further comprising: receiving the security level of at least one neighboring base station including the target base station. ### Claim 38 (depends on 31) The method of claim 31, wherein the security threshold is specific to a network slice, specific to the user equipment, and/or predetermined for a plurality of base stations including the target base station. ### Claim 39 (depends on 31) The method of claim 31, wherein the security level of at least one neighboring base station is received via a broadcast, received from a core network node, and/or received during an instantiation of a network slice. ### Claim 40 A non-transitory computer-readable storage medium including program code which, when executed by at least one processor, causes operations comprising: determining, at a source base station, whether to handover a user equipment to a target base station, the determining based on whether a security level of the target base station satisfies a security threshold; enabling, when the security level satisfies the security threshold, a relocation of a packet data convergence protocol entity to enable ciphering of a tunnel to the user equipment; and inhibiting, when the security level does not satisfy the security threshold, the relocation of the packet data convergence protocol entity to inhibit ciphering of a tunnel to the user equipment.