# US 2019/0320352 A1 · Access stratum (as) security for a centralized radio access network (c-ran)

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0320352 A1
- Document ID: US20190320352A1
- Status: Published application
- Kind: A1
- Application number: 16/380,104
- Filed: 2019-04-10
- Published: 2019-10-17
- Earliest claimed: 2018-04-12
- Assignees: QUALCOMM Incorporated
- Applicants: QUALCOMM Incorporated
- Inventors: Soo Bum LEE; Gavin Bernard HORN
- Web page: https://patentgrep.com/patent/US20190320352A1

## CPC

- H04W 36/0038: {of security context information}
- H04W 12/041: Key generation or derivation
- H04W 12/0471: Key exchange
- H04W 36/00692: {using simultaneous multiple data streams, e.g. cooperative multipoint [CoMP], carrier aggregation [CA] or multiple input multiple output [MIMO] (allocation of physical resources in CoMP or in CA H04L5/0035)}
- H04W 36/087: {between radio units of access points}
- H04W 76/27: Transitions between radio resource control [RRC] states
- H04W 88/085: {Access point devices with remote components}
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Techniques for secure control plane communications between a User Equipment (UE) and a gNB are provided. A RAN network entity decides to handover a UE from a source base station (BS) to a target BS, wherein the RAN network entity controls a plurality of BSs including at least one of the source BS or the target BS, and wherein at least a portion of a control plane (CP) protocol layer is implemented at the target BS. The network entity generates at least one key specific to the target BS, based on a master key and a freshness parameter, the master key associated with the network entity. The network entity transmits an indication of the at least one key to the target BS, wherein the target BS exchanges control signaling with the UE based on the CP protocol layer using the at least one key.

## Claims

### Claim 1

A method for wireless communication by a User Equipment (UE), comprising:
receiving a command to handover the UE from a source base station (BS) to a target BS, the command including at least an indication to generate at least one key specific to the target BS and a freshness parameter for generating the at least one key, wherein at least a portion of a control plane (CP) protocol layer is implemented at the target BS;
generating the at least one key based at least on the freshness parameter and a master key, the master key associated with a Radio Access Network (RAN) network entity controlling at least the source BS; and
exchanging control signaling with the target BS based on the CP protocol layer using the at least one key.

### Claim 2 (depends on 1)

The method of claim 1, wherein generating the at least one key includes generating an intermediate key specific to the target BS, based on the master key and the freshness parameter.

### Claim 3 (depends on 2)

The method of claim 2, wherein generating the at least one key further includes generating a Radio Resource Control (RRC) encryption key (KRRCenc) and a RRC integrity protection key (KRRCint) based on the intermediate key.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
receiving a subsequent command to handover the UE from the target BS to a subsequent target BS, the subsequent command including an indication to generate a subsequent at least one key specific to the subsequent target BS and a subsequent freshness parameter; and
exchanging signaling with the subsequent target BS based on the subsequent at least one key.

### Claim 5 (depends on 4)

The method of claim 4, wherein generating the subsequent at least one key includes:
generating a subsequent intermediate key for handover of the UE to the subsequent target BS, based on the intermediate key and the subsequent freshness parameter; and
generating a Radio Resource Control (RRC) encryption key (KRRCenc) and a RRC integrity protection key (KRRCint) based on the subsequent intermediate key.

### Claim 6 (depends on 1)

The method of claim 1, wherein the network entity includes a central unit (CU) according to the 5th Generation (5G) New Radio (NR) Radio Access Network (RAN) architecture.

### Claim 7 (depends on 6)

The method of claim 6, wherein each of the source BS and the target BS includes a Distributed Unit (DU) according to the 5G NR RAN architecture.

### Claim 8 (depends on 1)

The method of claim 1, wherein the CP protocol layer includes Central Unit (CU)-CP (CU-CP) according to the 5G NR RAN architecture.

### Claim 9 (depends on 8)

The method of claim 8, wherein the portion of the CP protocol layer includes Packet Data Convergence Protocol (PDCP)-CP (PDCP-CP) according to the 5G NR RAN architecture.

### Claim 10 (depends on 1)

The method of claim 1, wherein control signaling includes Radio Resource Control (RRC) signaling.

### Claim 11 (depends on 1)

The method of claim 1, wherein the command to handover includes an indication to generate the master key, wherein the indication includes a freshness parameter to generate the master key.

### Claim 12

A method for wireless communication by a Radio Access Network (RAN) network entity, comprising:
deciding to handover a UE from a source base station (BS) to a target BS, wherein the RAN network entity controls a plurality of BSs including at least one of the source BS or the target BS, and wherein at least a portion of a control plane (CP) protocol layer is implemented at the target BS;
generating at least one key specific to the target BS, based on a master key and a freshness parameter, the master key associated with the network entity; and
transmitting an indication of the at least one key to the target BS,
wherein the target BS exchanges control signaling with the UE based on the CP protocol layer, wherein the control signaling is protected based on the at least one key.

### Claim 13 (depends on 12)

The method of claim 12, further comprising:
directing the source BS to transmit a handover command to the UE, the handover command including at least an indication to generate the at least one key and the freshness parameter for generating the at least one key.

### Claim 14 (depends on 13)

The method of claim 13, further comprising generating a Radio Resource Control (RRC) message including the handover command, wherein directing the source BS to transmit includes directing the source BS to forward the RRC message to the UE.

### Claim 15 (depends on 13)

The method of claim 13, further comprising transmitting the indication to generate and the freshness parameter to the source BS, for forwarding to the UE via an Radio Resource Control (RRC) message.

### Claim 16 (depends on 12)

The method of claim 12, wherein generating the at least one key includes:
generating an intermediate key specific to the target BS, based on the master key and the freshness parameter.

### Claim 17 (depends on 16)

The method of claim 16, wherein the indication includes an indication of the intermediate key.

### Claim 18 (depends on 16)

The method of claim 16, further comprising:
generating a subsequent intermediate key for handover of the UE to a subsequent target BS, based on the intermediate key and a subsequent freshness parameter.

### Claim 19 (depends on 18)

The method of claim 18, wherein generating the at least one key includes:
generating a Radio Resource Control (RRC) encryption key (KRRCenc) and a RRC integrity protection key (KRRCint) based on the subsequent intermediate key.

### Claim 20 (depends on 19)

The method of claim 19, wherein the indication includes an indication of the RRC encryption key (KRRCenc) and the RRC integrity protection key (KRRCint).

### Claim 21 (depends on 12)

The method of claim 12, wherein the network entity includes a central unit (CU) according to the 5th Generation (5G) New Radio (NR) Radio Access Network (RAN) architecture.

### Claim 22 (depends on 21)

The method of claim 21, wherein each of the source BS and the target BS includes a Distributed Unit (DU) according to the 5G NR RAN architecture.

### Claim 23 (depends on 12)

The method of claim 12, wherein the CP protocol layer includes a Control Unit (CU)-CP (CU-CP) according to the 5G NR RAN architecture.

### Claim 24 (depends on 23)

The method of claim 23, wherein the portion of the CP protocol layer includes Packet Data Convergence Protocol (PDCP)-CP (PDCP-CP) according to the 5G NR RAN architecture.

### Claim 25 (depends on 12)

The method of claim 12, wherein control signaling includes Radio Resource Control (RRC) signaling.

### Claim 26 (depends on 12)

The method of claim 12, wherein the freshness parameter includes at least one of a counter, a nonce, Physical Cell Identifier (PCI), or Absolute Radio Frequency Channel Number (ARFCN).

### Claim 27

A User Equipment (UE), comprising:
at least one processor configured to:
receive a command to handover the UE from a source base station (BS) to a target BS, the command including at least an indication to generate at least one key specific to the target BS and a freshness parameter for generating the at least one key, wherein at least a portion of a control plane (CP) protocol layer is implemented at the target BS;
generate the at least one key based at least on the freshness parameter and a master key, the master key associated with a Radio Access Network (RAN) network entity controlling at least the source BS; and
exchange control signaling with the target BS based on the CP protocol layer using the at least one key; and
a memory coupled to the at least one processor.

### Claim 28 (depends on 27)

The UE of claim 27, wherein the at least one processor is configured to generate an intermediate key specific to the target BS, based on the master key and the freshness parameter.

### Claim 29 (depends on 27)

The UE of claim 27, wherein the at least one processor is further configured to:
receive a subsequent command to handover the UE from the target BS to a subsequent target BS, the subsequent command including an indication to generate a subsequent at least one key specific to the subsequent target BS and a subsequent freshness parameter; and
exchange signaling with the subsequent target BS based on the subsequent at least one key.

### Claim 30

A Radio Access Network (RAN) network entity, comprising:
at least one processor configured to:
decide to handover a UE from a source base station (BS) to a target BS, wherein the RAN network entity controls a plurality of BSs including at least one of the source BS or the target BS, and wherein at least a portion of a control plane (CP) protocol layer is implemented at the target BS;
generate at least one key specific to the target BS, based on a master key and a freshness parameter, the master key associated with the network entity; and
transmit an indication of the at least one key to the target BS,
wherein the target BS exchanges control signaling with the UE based on the CP protocol layer, wherein the control signaling is protected based on the at least one key; and
a memory coupled to the at least one processor.

### Claim 31 (depends on 30)

The RAN network entity of claim 30, wherein the at least one processor is configured to:
generate an intermediate key specific to the target BS, based on the master key and the freshness parameter.

### Claim 32 (depends on 31)

The RAN network entity of claim 31, wherein the at least one processor is further configured to:
generate a subsequent intermediate key for handover of the UE to a subsequent target BS, based on the intermediate key and a subsequent freshness parameter.