Access stratum (as) security for a centralized radio access network (c-ran)

A method for wireless communication by a Radio Access Network (RAN) network entity, comprising:

• deciding to handover a UE from a source base station (BS) to a target BS, wherein the RAN network entity controls a plurality of BSs including at least one of the source BS or the target BS, and wherein at least a portion of a control plane (CP) protocol layer is implemented at the target BS;
• generating at least one key specific to the target BS, based on a master key and a freshness parameter, the master key associated with the network entity;
• and
• transmitting an indication of the at least one key to the target BS,
• wherein the target BS exchanges control signaling with the UE based on the CP protocol layer, wherein the control signaling is protected based on the at least one key.

A User Equipment (UE), comprising:

• at least one processor configured to:
• receive a command to handover the UE from a source base station (BS) to a target BS, the command including at least an indication to generate at least one key specific to the target BS and a freshness parameter for generating the at least one key, wherein at least a portion of a control plane (CP) protocol layer is implemented at the target BS;
• generate the at least one key based at least on the freshness parameter and a master key, the master key associated with a Radio Access Network (RAN) network entity controlling at least the source BS;
• and
• exchange control signaling with the target BS based on the CP protocol layer using the at least one key;
• and
• a memory coupled to the at least one processor.

A Radio Access Network (RAN) network entity, comprising:

• at least one processor configured to:
• decide to handover a UE from a source base station (BS) to a target BS, wherein the RAN network entity controls a plurality of BSs including at least one of the source BS or the target BS, and wherein at least a portion of a control plane (CP) protocol layer is implemented at the target BS;
• generate at least one key specific to the target BS, based on a master key and a freshness parameter, the master key associated with the network entity;
• and
• transmit an indication of the at least one key to the target BS,
• wherein the target BS exchanges control signaling with the UE based on the CP protocol layer, wherein the control signaling is protected based on the at least one key;
• and
• a memory coupled to the at least one processor.