Protecting user privacy while bootstrapping an application function (af) key from primary authentication

A network node comprising:

• a processor operatively coupled to a transceiver;
• wherein the processor and transceiver are configured to:
• derive a KAKMA key for authentication and key management for applications (AKMA);
• receive, from a wireless transmit/receive unit (WTRU), a freshness parameter, an AF ID identifying an AF, and WTRU ID identifying the WTRU;
• and
• derive a KAF key for the AF and a KAF key ID identifying the KAF key, wherein the KAF key and a KAF key ID are derived based on the freshness parameter, the KAKMA key, AF ID and WTRU ID;
• and
• transmit, to the AF, a key response message including the KAF key.

A wireless transmit/receive unit (WTRU) comprising:

• a processor operatively coupled to a transceiver;
• wherein the processor and transceiver are configured to:
• derive a KAKMA key for authentication and key management for applications (AKMA);
• derive a KAF key for an application function (AF) and a KAF key identity (ID) identifying the KAF key, wherein the KAF key and a KAF key ID are derived based on a freshness parameter, the KAKMA key, an AF ID identifying the AF, and a WTRU ID identifying the WTRU;
• transmit, to a network node, the freshness parameter, the AF ID and the WTRU ID;
• transmit, to the AF, the KAF key ID;
• and
• perform mutual authentication with the AF using the KAF key.