WO2024231424A1

WO2024231424A1 - Secure delivery in mobile network access

Info

Publication number: WO2024231424A1
Application number: PCT/EP2024/062667
Authority: WO
Inventors: Saurabh Khare; Laurent Thiébaut; Ranganathan MAVUREDDI DHANASEKARAN
Original assignee: Nokia Technologies Oy
Current assignee: Nokia Technologies Oy
Priority date: 2023-05-09
Filing date: 2024-05-08
Publication date: 2024-11-14
Anticipated expiration: 2025-11-09
Also published as: CN121080012A

Abstract

In accordance with an example embodiment of the present disclosure an apparatus is provided for user equipment registration procedure to a mobile network access The apparatus has at least one processor; and at least one memory including executable instructions that, when executed by the at least one processor, cause the apparatus to participate in a user equipment registration procedure to a mobile network access; to determine, in an access and mobility management function, AMF, an access gateway contact information; and to send, from the AMF, an integrity protected message comprising the integrity protected access gateway contact information to a trusted non-3GPP access gateway function, TNGF.

Description

SECURE DELIVERY IN MOBILE NETWORK ACCESS

TECHNICAL FIELD

[0001] Various example embodiments relate to secure delivery in mobile network access.

BACKGROUND

[0002] This section illustrates useful background information without admission of any technique described herein representative of the state of the art.

[0003] Secure delivery of information is one important aspect in mobile network access.

[0004] Present disclosure relates to the development of security procedures of mobile networks in mobile network access.

SUMMARY

[0005] The scope of protection sought for various embodiments of present disclosure is set out by the independent claims. The embodiments and features, if any, described in this specification that do not fall under the scope of the independent claims are to be interpreted as examples useful for understanding various example embodiments.

[0006] According to a first example aspect of the present disclosure, there is provided an apparatus comprising at least one processor; and at least one memory including executable instructions that, when executed by the at least one processor, cause the apparatus to participate in a user equipment registration procedure to a mobile network access; to determine, in an access and mobility management function, AMF, an access gateway contact information; and to send, from the AMF, an integrity protected message comprising the integrity protected access gateway contact information to a trusted non-3GPP access gateway function, TNGF.

[0007] In some example embodiments said determination comprises receiving a message comprising access gateway contact information through an interface protected by network domain security, NDS.

[0008] In some example embodiments the mobile network access comprises trusted non-3GPP access, TNAN, to the 5G core network, 5GC. [0009] In some example embodiments the apparatus is further caused to integrity protect the access gateway contact information in the AMF using NAS keys.

[0010] In some example embodiments the access gateway contact information comprised in the sent integrity protected message is integrity protected in a non-access stratum, NAS, payload.

[0011] In some example embodiments the apparatus is further caused to send the integrity protected message from the AMF comprising the access gateway contact information integrity protected based on access gateway contact information received in one of a user equipment related message from a trusted non-3GPP access gateway or a non user equipment related message from a trusted non-3GPP access gateway.

[0012] In some example embodiments the access gateway contact information comprises at least one TNGF IP Address.

[0013] In some example embodiments the apparatus is further caused to determine that the target access gateway contact information is different from the access gateway being used, and to send an integrity protected and ciphered registration reject message comprising the target access gateway contact information to an UE.

[0014] According to a second example aspect of the present disclosure, there is provided an apparatus comprising at least one processor; and at least one memory including executable instructions that, when executed by the at least one processor, cause the apparatus to participate in a user equipment registration procedure to a mobile network access; to receive, in a trusted non-3GPP gateway function, TNGF, an integrity protected message from an access and mobility management function, AMF, comprising integrity protected access gateway contact information; and to forward, in the TNGF, the received integrity protected access gateway contact information in a message to a user equipment, UE.

[0015] In some example embodiments the apparatus is further caused to send, in trusted non-3GPP gateway function, TNGF, a message comprising access gateway contact information through an interface protected by network domain security, NDS, to an access and mobility management function, AMF.

[0016] In some example embodiments the mobile network access comprises trusted non-3GPP, TNAN, access to the 5G core network, 5GC.

[0017] In some example embodiments sending the message to the AMF comprises sending a user equipment related message or comprises sending a non-user equipment related message.

[0018] In some example embodiments the user equipment related message sent to the AMF also carries an SMC complete message or a registration request message.

[0019] In some example embodiments the non-user equipment related message sent to the AMF is one of NG SETUP request or RAN CONFIGURATION UPDATE request.

[0020] In some example embodiments the message forwarded to the UE is an SMC request.

[0021] In some example embodiments the contact information comprises at least one TNGF IP Address.

[0022] According to a third example aspect of the present disclosure, there is provided an apparatus comprising at least one processor; and at least one memory including executable instructions that, when executed by the at least one processor, cause the apparatus to receive, at a user equipment, UE, from a mobile network a message comprising integrity protected access gateway contact information; and to verify the integrity protection of the access gateway contact information at the UE.

[0023] In some example embodiments the mobile network access comprises trusted non-3GPPaccess, TNAN, to the 5G core network, 5GC.

[0024] In some example embodiments the message from the mobile network comprises integrity protected access gateway contact information in a NAS payload.

[0025] In some example embodiments the access gateway contact information comprises at least one TNGF IP Address.

[0026] In some example embodiments the message from the mobile network is an SMC request message.

[0027] In some example embodiments the apparatus is further caused to use the access gateway contact information to connect to a trusted non-3GPP gateway function, TNGF.

[0028] In some example embodiments the apparatus is further caused to receive an integrity protected and ciphered registration reject message comprising target access gateway contact information different from the access gateway being used, and to close the existing session with the access gateway in use and to use the target access gateway contact information to connect to the target access gateway.

[0029] According to a fourth example aspect of the present disclosure, there is provided a method, comprising: participating in an user equipment registration procedure to a mobile network access; determining, in an access and mobility management function, AMF, an access gateway contact information; and sending an integrity protected message from the AMF comprising the access gateway contact information integrity protected to a trusted non-3GPP gateway function, TNGF.

[0030] According to a fifth example aspect of the present disclosure, there is provided a non-transitory computer readable medium comprising program instructions stored thereon for performing at least the following: participating in an user equipment registration procedure to a mobile network access; determining, in an access and mobility management function, AMF, an access gateway contact information; and sending an integrity protected message from the AMF comprising the access gateway contact information integrity protected to a trusted non-3GPP gateway function, TNGF.

[0031] According to a sixth example aspect of the present disclosure, there is provided method, comprising: participating in a user equipment registration procedure to a mobile network access; receiving, in a trusted non-3GPP gateway function, TNGF, an integrity protected message from an access and mobility management function, AMF, comprising the received access gateway contact information integrity protected; and forwarding, in the TNGF, the received integrity protected access gateway contact information in a message to a user equipment, UE.

[0032] According to a seventh example aspect of the present disclosure, there is provided a non-transitory computer readable medium comprising program instructions stored thereon for performing at least the following: participating in a user equipment registration procedure to a mobile network access; receiving , in a trusted non-3GPP gateway function, TNGF, an integrity protected message from an access and mobility management function, AMF, comprising the received access gateway contact information integrity protected; and forwarding, in the TNGF, the received integrity protected access gateway contact information in a message to a user equipment, UE. [0033] According to an eighth example aspect of the present disclosure, there is provided a method, comprising: receiving, at a user equipment, UE, from a mobile network a message comprising integrity protected access gateway contact information; and verifying the integrity protection of the access gateway contact information at the UE.

[0034] According to a ninth example aspect of the present disclosure, there is provided a non-transitory computer readable medium comprising program instructions stored thereon for performing at least the following: receiving, at a user equipment, UE, from a mobile network a message comprising integrity protected access gateway contact information; and verifying the integrity protection of the access gateway contact information at the UE.

[0035] According to a tenth example aspect of the present disclosure, there is provided an apparatus comprising means for participating in a user equipment registration procedure to a mobile network access; means for determining, in an access and mobility management function, AMF, an access gateway contact information; and means for sending, from the AMF, an integrity protected message comprising the integrity protected access gateway contact information to a trusted non-3GPP access gateway function, TNGF.

[0036] In some example embodiments, the apparatus of the tenth example aspect further comprises receiving a message comprising access gateway contact information through an interface protected by network domain security, NDS.

[0037] In some example embodiments the mobile network access comprises trusted non-3GPP access, TNAN, to the 5G core network, 5GC.

[0038] In some example embodiments, the apparatus of the tenth example aspect further comprises means for integrity protecting the access gateway contact information in the AMF using NAS keys.

[0039] In some example embodiments the access gateway contact information comprised in the sent integrity protected message is integrity protected in a non-access stratum, NAS, payload.

[0040] In some example embodiments, the apparatus of the tenth example aspect further comprises means for sending the integrity protected message from the AMF comprising the access gateway contact information integrity protected based on access gateway contact information received in one of a user equipment related message from a trusted non-3GPP access gateway or a non user equipment related message from a trusted non-3GPP access gateway.

[0041] In some example embodiments the access gateway contact information comprises at least one TNGF IP Address.

[0042] In some example embodiments, the apparatus of the tenth example aspect further comprises means for determining that the target access gateway contact information is different from the access gateway being used, and means for sending an integrity protected and ciphered registration reject message comprising the target access gateway contact information to an UE.

[0043] According to an eleventh example aspect of the present disclosure, there is provided an apparatus comprising there is provided an apparatus comprising means for participating in a user equipment registration procedure to a mobile network access; means for receiving, in a trusted non-3GPP gateway function, TNGF, an integrity protected message from an access and mobility management function, AMF, comprising integrity protected access gateway contact information; and means for forwarding, in the TNGF, the received integrity protected access gateway contact information in a message to a user equipment, UE.

[0044] In some example embodiments, the apparatus of the eleventh example aspect further comprises means for sending, in trusted non-3GPP gateway function, TNGF, a message comprising access gateway contact information through an interface protected by network domain security, NDS, to an access and mobility management function, AMF.

[0045] In some example embodiments the mobile network access comprises trusted non-3GPP, TNAN, access to the 5G core network, 5GC.

[0046] In some example embodiments, the apparatus of the eleventh example aspect further comprises means for sending the message to the AMF comprising sending a user equipment related message or comprises sending a non-user equipment related message.

[0047] In some example embodiments the user equipment related message sent to the AMF also carries an SMC complete message or a registration request message.

[0048] In some example embodiments the non-user equipment related message sent to the AMF is one of NG SETUP request or RAN CONFIGURATION UPDATE request.

[0049] In some example embodiments the message forwarded to the UE is an SMC request.

[0050] In some example embodiments the contact information comprises at least one TNGF IP Address.

[0051] According to a twelfth example aspect of the present disclosure, there is provided an apparatus comprising means for receiving, at a user equipment, UE, from a mobile network a message comprising integrity protected access gateway contact information; and means for verifying the integrity protection of the access gateway contact information at the UE.

[0052] In some example embodiments the mobile network access comprises trusted non-3GPPaccess, TNAN, to the 5G core network, 5GC.

[0053] In some example embodiments the message from the mobile network comprises integrity protected access gateway contact information in a NAS payload.

[0054] In some example embodiments the access gateway contact information comprises at least one TNGF IP Address.

[0055] In some example embodiments the message from the mobile network is an SMC request message.

[0056] In some example embodiments, the apparatus of the twelfth example aspect further comprises means for using the access gateway contact information to connect to a trusted non-3GPP gateway function, TNGF.

[0057] In some example embodiments, the apparatus of the twelfth example aspect further comprises means for receiving an integrity protected and ciphered registration reject message comprising target access gateway contact information different from the access gateway being used, and means for closing the existing session with the access gateway in use and means for using the target access gateway contact information to connect to the target access gateway.

[0058] The computer program of the fifth, seventh and/or ninth example aspect may be stored in a non-transitory computer readable memory medium. The term non-transitory as used herein is a limitation of the medium itself (i.e. tangible, not a signal) as opposed to a limitation on data storage persistency (e.g. RAM vs. ROM).

[0059] Any foregoing memory medium may comprise a digital data storage such as a data disc or diskette, optical storage, magnetic storage, holographic storage, opto-magnetic storage, phase-change memory, resistive random-access memory, magnetic random-access memory, solid-electrolyte memory, ferroelectric random-access memory, organic memory or polymer memory. The memory medium may be formed into a device without other substantial functions than storing memory or it may be formed as part of a device with other functions, including but not limited to a memory of a computer, a chip set, and a sub assembly of an electronic device. [0060] The various means of the apparatus of the tenth, eleventh and/or twelfth example aspect may comprise a processor; and a memory including executable instructions that, when executed by the processor, cause the performance of the means.

[0061] Different non-binding example aspects and embodiments of the present invention have been illustrated in the foregoing. The embodiments in the foregoing are used merely to explain selected aspects or steps that may be utilized in implementations of the embodiment of the present disclosure. Some embodiments may be presented only with reference to certain example aspects. It should be appreciated that corresponding embodiments may apply to other example aspects as well.

BRIEF DESCRIPTION OF THE DRAWINGS

[0062] For a more complete understanding of example embodiments of the present invention, reference is now made to the following descriptions taken in connection with the accompanying drawings in which:

[0063] Fig. 1 shows a signaling diagram of a part of an extensible authentication (EAP) procedure in trusted non-3GPP (TNAN) access to the 5G core network (5GC);

[0064] Figs. 2-4 are flow diagrams of processes according to example embodiments;

[0065] Figs. 5A and 5B show a signaling diagram of a part of an extensible authentication (EAP) procedure in trusted non-3GPP (TNAN) access to the 5G core network (5GC) according to an example embodiment;

[0066] Figs. 6A and 6B show a signaling diagram of a part of an extensible authentication (EAP) procedure in trusted non-3GPP (TNAN) access to the 5G core network (5GC) according to another example embodiment; and

[0067] Figs. 7-8 show block diagrams of apparatuses according to example embodiments.

DETAILED DESCRIPTON OF THE DRAWINGS

[0068] An example embodiment of the present disclosure and its potential advantages are understood by referring to Figs. 1 through 8 of the drawings. In this document, like reference signs denote like parts or steps.

[0069] In the following, various example embodiments of present disclosure are discussed in detail in the context of trusted non-3GPP (TNAN) access to the 5G core network (5GC) technology. It is however to be noted that various example embodiments of present disclosure may be equally applied to other mobile networks and radio communication technologies (e.g. future technologies) in addition thereto.

[0070] Fig. 1 shows a signaling diagram of a part of an extensible authentication (EAP) procedure in trusted non-3GPP (TNAN) access to the 5G core network (5GC). Fig. 1 shows a UE (user equipment) 101 ; a TNAN (trusted Non-3GPP Access Network) 102 comprising a TNAP (Trusted Non-3GPP Access Point) 102a and a TNGF (Trusted Non-3GPP Gateway Function); an AMF (Access and Mobility Management Function) 103; and an ALISF (Authentication Server Function) 104.

[0071] The UE 101 is connected with the TNAN 102 with an L2 (Layer 2) connection using for example Ethernet, 802.3, 802.11 or PPP or any L2 data link supporting EAP encapsulation. The TNAP 102b and the TNGF 102c are connected with an AAA (Authentication, Authorization & Account) interface. The TNGF 102b is connected with the AMF 103 with an N2 interface that is protected by NDS (Network Domain Security). For simplicity, when the same message is sent from the TNGF 102b to the TNAP 102 and then to the UE 101 , the message is shown as one on the signaling diagram of Fig 1 even though the interface changes from AAA to L2 in between.

[0072] Fig. 1 shows a part of an extensible authentication (EAP) procedure in trusted non-3GPP (TNAN) access. The shown part of the procedure EAP-5G 110 proceeds as follows in steps 1-1 Oe:

[0073] Steps 6a-7b: The TNGF 102b selects an AMF 103 and forwards a registration request received from the UE 101 to the AMF 103. The UE 101 and the AMF 103 then exchange messages for identification.

[0074] Steps 8a-8c: If the AMF 103 determines to authenticate the UE, The AMF 103 sends a key request based on UE identification to the AUSF 104 for an authentication proposal. The AUSF 104 sends a challenge, random number, to the UE 101 that answers to the AUSF 104 with a result determined based on a challenge. If the AUSF 104 determines that the result sent by the UE 101 has the value expected from a genuine UE , the AUSF declares the authentication successful and the AUSF 104 sends to the AMF a key response with a SEAF (Security Anchor Function) key. If the AMF 103 determines NOT to authenticate the UE, the AMF does not send a key request to the AUSF 104 but proceeds to step 9a and steps 8a-8c are skipped.

[0075] Steps 9a-9d: The AMF 103 sends an EAP Success and a NAS SMC (Security Mode Command) request to the UE via the TNGF 102b. The TNGF 102b forwards the SMC to the UE 101 and sends a TNGF IP address to the UE 101. Upon reception of the EAP success the UE 101 creates TNGF/TNAP keys based on the last received challenge from the AUSF; The UE 101 replies with an SMC complete message to the TNGF 102b and the TNGF 102b sends the SMC complete message to the AMF 103.

[0076] Steps 10a-10e: The AMF 103 sends an initial context setup request to and a TNGF Key to the TNGF 102b which then sends an EAP request and to the UE 101. The UE 101 replies with an EAP response. The TNGF 102b then provides a TNAP key to the TNAP 102a which then sends the UE 101 an EAP success message.

[0077] There is an identified problem in step 10b of Fig. 1. An unprotected TNGF IP address, i.e. TNGF contact info, is sent in step 9b from the TNGF 102b to the TNAP 102a and then this unprotected TNGF address is sent in step 10b over the air from the TNAP 102a to the UE 101. The TNGF IP address sent by TNGF 102b is later used for creating an IPSec tunnel between the UE 101 and TNGF 102b. This could potentially lead to a denial of service (DoS) attack on the UE 101 , as a MitM (man in the middle) attacker could change the TNGF IP address, causing the UE 101 to end up trying to establish a connection with a non-existing or different entity than the TNGF 102b.

[0078] Various example embodiments of present disclosure provide solution to this problem by increasing the security of the EAP procedure.

[0079] According to an example embodiment, the TNGF 102b sends the TNGF IP address, the TNGF contact info, to the AMF 103 using the N2 interface protected by NDS. Then the NAS security between the UE 101 and the AMF 103 allows the TNGF IP address to be integrity protected using NAS keys thus providing the UE 101 with the TNGF contact info that cannot be modified by a MitM (man in the middle). According to further example embodiment, the AMF 103 may also encrypt the TNGF IP address.

[0080] Figs. 2-4 are flow diagrams of processes according to example embodiments. The processes may be implemented in one or more computer programs comprising instructions for performing the steps of the respective process.

[0081] Fig. 2 shows a process to be performed in an AMF of a mobile network. The process comprises the following steps:

[0082] 210: Participating in a user equipment registration to a mobile network access. The mobile network access may be trusted non-3GPP (TNAN) access to the 5G core network (5GC)

[0083] 220: Determining an access gateway contact information. Determining the access gateway contact information may comprise receiving a message comprising the access gateway contact information through an interface protected by NDS.

[0084] The interface may be an N2-interface between an TNGF and an AMF. The access gateway contact information may comprise TNGF contact info. The contact information may comprise at least one TNGF IP address. The message comprising the access gateway contact information may be received from the TNGF.

[0085] 230: Sending an integrity protected message comprising the received contact information integrity protected.

[0086] Sending the integrity protected message comprising the integrity protected access gateway contact information may be based on access gateway contact information received in one of user equipment related signaling from the access gateway as part of the current UE registration procedure or non-user equipment related signaling from the access gateway received earlier. Integrity protecting may comprise integrity protecting the contact information in NAS (Non-Access Stratum) signaling.

[0087] The process of Fig. 2 may further comprise encrypting the received contact information and sending the integrity protected message may comprise the received contact information integrity protected and encrypted. Encrypting and integrity protecting may comprise encrypting and integrity protecting the contact information in NAS (Non-Access Stratum) signaling.

[0088] Fig. 3 shows a process to be performed in a TNGF of a mobile network. The process comprises the following steps:

[0089] 310: Participating in a user equipment registration to a mobile network access. The mobile network access may be trusted non-3GPP (TNAN) access to the 5G core network (5GC).

[0090] 320: Receiving an integrity protected message comprising access gateway contact information integrity protected. The integrity protected message comprising access gateway contact information integrity protected may be received through an interface protected by NDS.

[0091] The interface may be an N2-interface between an TNGF and an AMF. The access gateway contact information may comprise TNGF contact info. The access gateway contact information may comprise at least one TNGF IP address.

[0092] The message comprising the contact information may be a SMC complete message. The message comprising the contact information may be a registration request message.

[0093] 330: Forwarding the received integrity protected access gateway contact information in a message to an UE. The forwarding may be carried out via a TNAP. The message comprising the forwarded integrity protected contact information may be a NAS payload. The message comprising the forwarded integrity protected contact information may be an SMC request.

[0094] The integrity protected contact information may be encrypted. The integrity protected and encrypted contact information may be sent to an UE in a NAS payload.

[0095] The process of Fig. 3 may further comprise sending a message comprising the access gateway contact information through an interface protected by network domain security, NDS, to an access and mobility management function, AMF, before receiving the integrity protected message comprising access gateway contact information integrity protected.

[0096] Fig. 4 shows a process to be performed in an UE. The process comprises the following steps:

[0097] 410: Receiving from a mobile network a message comprising integrity protected access gateway contact information. The access gateway contact information may comprise TNGF contact information. The access gateway contact information may comprise at least one TNGF IP address. The message comprising the integrity protected contact information may be received from the TNGF. The message comprising the integrity protected contact information may be received from the TNGF via an TNAP.

[0098] The message comprising the integrity protected contact information may be an SMC request. The message comprising the integrity protected contact information may be an NAS payload.

[0099] 420: Verifying the integrity protection of the access gateway contact information.

[0100] The integrity protected access gateway contact information may be encrypted. The integrity protected and encrypted access gateway contact information may be received in a NAS payload. The process of Fig. 4 may further comprise decrypting the received contact information.

[0101] The process of Fig. 4 may further comprise using the access gateway contact information to connect to a trusted non-3GPP gateway function, TNGF.

[0102] Details of some example embodiments of present disclosure are discussed in connection with Figs. 5a to 6b. It is to be noted that some optional features may be disclosed and clearly all steps of Figs. 5a to 6b are not always mandatory. It is to be noted that some of the names of the messages discussed in connection with Figs. 5 and 6 are specific to the example embodiments, but it is not mandatory to use the messages with these names. Instead differently named messages or different messages may equally be used for the same purpose.

[0103] Figs. 5A and 5B show a signaling diagram of a part of an extensible authentication (EAP) procedure in trusted non-3GPP (TNAN) access to the 5G core network (5GC) according to an example embodiment.

[0104] Figs. 5a and 5b show a UE (user equipment) 101 ; a TNAN (trusted Non- 3GPP Access Network) 102 comprising a TNAP (Trusted Non-3GPP Access Point) 102a and a TNGF (Trusted Non-3GPP Gateway Function); an AMF (Access and Mobility Management Function) 103; and an AUSF (Authentication Server Function) 104.

[0105] The UE 101 is connected with the TNAN 102 with a L2 (Layer 2) connection using for example Ethernet, 802.3, 802.11 or PPP or any L2 data link supporting EAP encapsulation. The TNAP 102b and the TNGF 102c are connected with an AAA (Authentication, Authorization & Account) interface. The TNGF 102b is connected with the AMF 103 with an N2 interface that is protected by NDS (Network Domain Security). For simplicity, when the same message is sent from the TNGF 102b to the TNAP 102 and then to the UE 101 , the message is shown as one on the signaling diagram of Figs. 5a and 5b even though the interface changes from AAA to L2 in between.

[0106] Step 0: The TNGF 102b sends, outside of any UE related procedure thus possibly prior to serving any UE 101 , to the AMF 103 a non-user equipment related NGAP message e.g. one of NG SETUP request or RAN CONFIGURATION UPDATE request that carries TNGF contact info; the AMF stores this information for usage in a UE related procedure as described hereinafter.

[0107] Steps 6a-7b: The TNGF 102b selects an AMF 103 and forwards a registration request received from the UE 101 to the AMF 103. The UE 101 and the AMF 103 then exchange messages for identification.

[0108] Steps 8a-8c: If the AMF 103 determines to authenticate the UE, the AMF 103 sends a key request based on UE identification to the AUSF 104 for an authentication request. The AUSF 104 sends a challenge, random number, to the UE 101 that answers to the AUSF 104 with a result determined based on a challenge. If the AUSF 104 determines that the result sent by the UE 101 has the value expected from a genuine UE , the AUSF declares the authentication successful and the AUSF 104 sends to the AMF a key response with a SEAF (Security Anchor Function) key. If the AMF 103 determines NOT to authenticate the UE, the AMF does not send a key request to the AUSF 104 but proceeds to step 9a and steps 8a-8c are skipped.

[0109] Steps 9a-9e: The AMF 103 sends an EAP Success and a NAS SMC (Security Mode Command) request to the UE via the TNGF 102b. The TNGF 102b forwards the SMC to the UE 101. The UE 101 replies with an SMC complete message to the TNGF 102b. The TNGF 102b sends the SMC complete message and the TNGF contact info, i.e. a TNGF IP Address to the AMF 103. The AMF 103 integrity protects the TNGF contact info in a NAS payload. If the AMF 103 had received TNGF contact info in step 0, the value receives in user equipment related NGAP message takes precedence. If the TNGF does not send TNGF contact info in user equipment related NGAP message the value received at step 0 is used by the AMF.

[0110] Steps 10a-10e: The AMF 103 sends an initial context setup request and a TNGF Key to the TNGF 102b comprising the NAS payload and the integrity protected TNGF contact info. The TNGF 102b then at step 10b1 sends an EAP request to the UE 101 via the TNAP 102a, the request comprising the NAS payload and the integrity protected TNGF contact info. The UE 101 decrypts and verifies the integrity of the TNGF contact info at step 10b2 and subsequently replies with an EAP response to the TNGF. The TNGF 102b then provides a TNAP key to the TNAP 102a which then sends the UE 101 an EAP success message.

[0111] The AMF 103 may determine that the target TNGF address is different than the existing TNGF 102b and send a registration reject message to the UE including the target TNGF address. This registration reject message is sent after SMC is completed in step 9 so that further messages are integrity protected and ciphered. Once UE 101 receives this Registration Reject with target TNGF address, the UE closes the existing session with the existing TNGF 102b and tries to connect to the new target TNGF.

[0112] Figs. 6A and 6B show a signaling diagram of a part of an extensible authentication (EAP) procedure in trusted non-3GPP (TNAN) access to the 5G core network (5GC) according to an example embodiment.

[0113] Figs. 6a and 6b show a UE (user equipment) 101 ; a TNAN (trusted Non- 3GPP Access Network) 102 comprising a TNAP (Trusted Non-3GPP Access Point) 102a and a TNGF (Trusted Non-3GPP Gateway Function); an AMF (Access and Mobility Management Function) 103; and an AUSF (Authentication Server Function) 104.

[0114] Step 0: The TNGF 102b sends, outside of any UE related procedure thus possibly prior to serving any UE 101 , to the AMF 103 a non-user equipment related NGAP message e.g. one of NG SETUP request or RAN CONFIGURATION UPDATE request that carries TNGF contact info; the AMF stores this information for usage in a UE related procedure as described hereinafter.

[0115] Steps 6a-7b: The TNGF 102b selects an AMF 103 and forwards to the AMF 103 the initial NAS message received from the UE 101 , e.g. a registration request . The TNGF 102b includes TNGF contact info, i.e. TNGF IP Address, into the registration request. If the AMF 103 had received TNGF contact info in step 0, the value receives in user equipment related NGAP message takes precedence. If the TNGF does not send TNGF contact info in user equipment related NGAP message the value received at step 0 is used by the AMF. The UE 101 and the AMF 103 then exchange messages for identification. The TNGF 102b may alternatively include the TNGF contact info into the identity response message at step 7a. The TNGF 102b may alternatively include the TNGF contact info into a further message to the AMF 103.

[0116] Steps 8a-8c: If the AMF 103 determines to authenticate the UE, The AMF 103 sends a key request based on UE identification to the AUSF 104 for an authentication proposal. The AUSF 104 sends a challenge, random number, to the UE 101 that answers to the AUSF 104 with a result determined based on a challenge. If the AUSF 104 determines that the result sent by the UE 101 has the value expected from a genuine UE , the AUSF declares the authentication successful and the ALISF 104 sends to the AMF a key response with a SEAF (Security Anchor Function) key. If the AMF 103 determines NOT to authenticate the UE, the AMF does not send a key request to the ALISF 104 but proceeds to step 9a and steps 8a-8c are skipped. .

[0117] Steps 9a-9d: The AMF 103 sends an EAP Success and a NAS SMC (Security Mode Command) request that includes the TNGF contact info to the UE via the TNGF 102b and. The SMC message is integrity protected and the TNGF contact info is thus integrity protected. The TNGF 102b forwards the SMC including the integrity protected TNGF contact info to the UE 101. The UE 101 verifies the integrity of the TNGF contact info at step 9b2 and subsequently replies with an SMC complete message to the TNGF 102b and the TNGF 102b sends the SMC complete message to the AMF 103.

[0118] Steps 10a-10e: The AMF 103 sends an initial context setup request to and a TNGF Key to the TNGF 102b which then sends an EAP request and to the UE 101. The UE 101 replies with an EAP response. The TNGF 102b then provides a TNAP key to the TNAP 102a which then sends the UE 101 an EAP success message.

[0119] Fig. 7 shows a block diagram of an apparatus 700 according to an example embodiment. The apparatus 700 may operate as a network element, such as the TNAP 102a, the TTNGF 102b, the AMF 103 or the AUSF 104 of Figs. 1 , 5a-5b and 6a-6b. The apparatus 700 generally comprises a memory 740 including a computer program code 750. The apparatus 700 further comprises a processor 720 for controlling the operation of the apparatus 700 using the computer program code 750, and a communication unit 710 for communicating with other network elements and other devices. Further, the apparatus 700 may comprise a user interface unit 730.

[0120] The communication unit 710 comprises, for example, one or more of: a local area network (LAN) port; a wireless local area network (WLAN) unit; Bluetooth unit; cellular data communication unit; or satellite data communication unit. The communication interface 710 may support one or more different communication technologies. The communication interface 710 may support Ethernet communications and/or IP based communications. The apparatus 700 may also or alternatively comprise more than one of the communication interfaces 710. The processor 720 comprises, for example, any one or more of: a master control unit (MCU); a microprocessor; a digital signal processor (DSP); an application specific integrated circuit (ASIC); a field programmable gate array; and a microcontroller. The user interface unit 730 may comprise a circuitry for receiving input from a user of the apparatus 700, e.g., via a keyboard; graphical user interface of a display; speech recognition circuitry; or an accessory device; such as a headset; and for providing output to the user via, e.g., a graphical user interface or a loudspeaker. Various parts may be implemented using more than one corresponding or different elements, such as memories and storages may be multiplied for capacity and/or redundancy purposes. Similarly, processing and/or communications may be implemented with multiple parallel or elements for capacity and/or redundancy purposes.

[0121] The computer program code 750 may control the apparatus 700 to provide one or more example embodiments of present disclosure, such as suitable parts of Figs. 2-3 and 5a-6b.

[0122] Fig 8 shows a block diagram of an apparatus 800 according to an example embodiment. The apparatus 800 may operate as a user equipment, such as the UE 101 of Figs. 1 , 5a-5b and 6a-6b. The apparatus 800 generally comprises a memory 840 including a computer program code 850. The apparatus 800 further comprises a processor 820 for controlling the operation of the apparatus 800 using the computer program code 850, and a communication unit 810 for communicating with other network elements and other devices. Further, the apparatus 800 may comprise a user interface unit 830.

[0123] The communication unit 810 comprises, for example, one or more of: a wireless local area network (WLAN) unit; Bluetooth unit; cellular data communication unit; or satellite data communication unit. The communication interface 810 may support one or more different communication technologies. The communication interface 810 may support IP based communications. The apparatus 800 may also or alternatively comprise more than one of the communication interfaces 810. The processor 820 comprises, for example, any one or more of: a master control unit (MCU); a microprocessor; a digital signal processor (DSP); an application specific integrated circuit (ASIC); a field programmable gate array; and a microcontroller. The user interface unit 830 may comprise a circuitry for receiving input from a user of the apparatus 800, e.g., via a keyboard; graphical user interface of a display; speech recognition circuitry; or an accessory device; such as a headset; and for providing output to the user via, e.g., a graphical user interface or a loudspeaker. Various parts may be implemented using more than one corresponding or different elements, such as memories and storages may be multiplied for capacity and/or redundancy purposes. Similarly, processing and/or communications may be implemented with multiple parallel or elements for capacity and/or redundancy purposes.

[0124] The computer program code 850 may control the apparatus 800 to provide one or more example embodiments of present disclosure, such as suitable parts of Figs. 4 and 5a-6b.

[0125] As used in this application, the term “circuitry” may refer to one or more or all of the following:

(a) hardware-only circuit implementations (such as implementations in only analog and/or digital circuitry) and; (b) combinations of hardware circuits and software, such as (as applicable):

(i) a combination of analog and/or digital hardware circuit(s) with software/firmware; and

(ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as a mobile phone or server, to perform various functions); and

(c) hardware circuit(s) and or processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation.

[0126] This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and/or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in server, a cellular network device, or other computing or network device.

[0127] Without in any way limiting the scope, interpretation, or application of the claims appearing below, a technical effect of one or more of the example embodiments disclosed herein is improved security in trusted non-3GPP (TNAN) access to the 5G core network.

[0128] Embodiments of the present disclosure may be implemented in software, hardware, application logic or a combination of software, hardware, and application logic. The software, application logic and/or hardware may reside e.g. on the TNAP 102a, the TNGF 102b, the AMF 103 or the ALISF 104. In an example embodiment, the application logic, software, or an instruction set is maintained on any one of various conventional computer- readable media. In the context of this document, a “computer-readable medium” may be any non-transitory media or means that can contain, store, communicate, propagate, or transport the instructions for use by or in connection with an instruction execution system, apparatus, or device, such as a computer, with one example of a computer described and depicted in Figs. 7 and 8. A computer-readable medium may comprise a computer-readable storage medium that may be any media or means that can contain or store the instructions for use by or in connection with an instruction execution system, apparatus, or device, such as a computer.

[0129] If desired, the different functions discussed herein may be performed in a different order and/or concurrently with each other. Furthermore, if desired, one or more of the before-described functions may be optional or may be combined.

[0130] Although various aspects of present disclosure are set out in the independent claims, other aspects may comprise other combinations of features from the described embodiments and/or the dependent claims with the features of the independent claims, and not solely the combinations explicitly set out in the claims.

[0131] It is also noted herein that while the foregoing describes example embodiments, these descriptions should not be viewed in a limiting sense. Rather, there are several variations and modifications which may be made without departing from the scope of the present disclosure as defined in the appended claims.

LIST OF ABBREVIATIONS

AMF Access and Mobility Management Function

AUSF Authentication Server Function

TNAN Trusted Non - 3GPP Access Network

TNAP Trusted Non-3GPP Access Point

TNGF Trusted Non-3GPP Gateway Function

USIM Universal Subscriber Identity Module

Claims

1. An apparatus comprising at least one processor; and at least one memory including executable instructions that, when executed by the at least one processor, cause the apparatus to participate in a user equipment registration procedure to a mobile network access; to determine, in an access and mobility management function, AMF, an access gateway contact information; and to send, from the AMF, an integrity protected message comprising integrity protected access gateway contact information to a trusted non-3GPP access gateway function, TNGF.

2. The apparatus of claim 1, wherein the said determination comprises receiving a message comprising access gateway contact information through an interface protected by network domain security, NDS.

3. The apparatus of claim 1 or 2, wherein the mobile network access comprises trusted non- 3GPP access, TNAN, to the 5G core network, 5GC.

4. The apparatus of any preceding claim 1 - 3, wherein the apparatus is further caused to integrity protect the access gateway contact information in the AMF using NAS keys.

5. The apparatus of claim 4, wherein the access gateway contact information comprised in the sent integrity protected message is integrity protected in a non-access stratum, NAS, payload.

6. The apparatus of any preceding claim 1-5, wherein the apparatus is further caused to send the integrity protected message from the AMF comprising the access gateway contact information integrity protected based on access gateway contact information received in one of a user equipment related message from a trusted non-3GPP access gateway or a non user equipment related message from a trusted non-3GPP access gateway.

7. The apparatus of any preceding claim 1-6, wherein the access gateway contact information comprises at least one TNGF IP Address.

8. The apparatus of any preceding claim 1-7, wherein the apparatus is further caused to determine that the target access gateway contact information is different from the access gateway being used, and to send an integrity protected and ciphered registration reject message comprising the target access gateway contact information to an UE.

9. An apparatus comprising at least one processor; and at least one memory including executable instructions that, when executed by the at least one processor, cause the apparatus to participate in a user equipment registration procedure to a mobile network access; to receive, in a trusted non-3GPP gateway function, TNGF, an integrity protected message from an access and mobility management function, AMF, comprising integrity protected access gateway contact information; and to forward, in the TNGF, the received integrity protected access gateway contact information in a message to a user equipment, UE.

10. The apparatus of claim 9, wherein the apparatus is further caused to send, in trusted non-3GPP gateway function, TNGF, a message comprising access gateway contact information through an interface protected by network domain security, NDS, to an access and mobility management function, AMF.

11. The apparatus of claim 9 or 10, wherein the mobile network access comprises trusted non-3GPP, TNAN, access to the 5G core network, 5GC.

12. The apparatus of claim 10, wherein sending the message to the AMF comprises sending a user equipment related message or comprises sending a non-user equipment related message.

13. The apparatus of any preceding claim 12, wherein the user equipment related message sent to the AMF also carries an SMC complete message or a registration request message.

14. The apparatus of any preceding claim 12, wherein the non-user equipment related message sent to the AMF is one of NG SETUP request or RAN CONFIGURATION UPDATE request.

15. The apparatus of any preceding claim 9-14, wherein the message forwarded to the UE is an SMC request.

16. The apparatus of any preceding claim 9-15, wherein the contact information comprises at least one TNGF IP Address.

17. An apparatus comprising at least one processor; and at least one memory including executable instructions that, when executed by the at least one processor, cause the apparatus to receive, at a user equipment, UE, from a mobile network a message comprising integrity protected access gateway contact information; and to verify the integrity protection of the access gateway contact information at the UE.

18. The apparatus of claim 17, wherein the mobile network access comprises trusted non- 3GPPaccess, TNAN, to the 5G core network, 5GC.

19. The apparatus of claim 17 or 18, wherein the message from the mobile network comprises integrity protected access gateway contact information in a NAS payload.

20. The apparatus of any preceding claim 17-19, wherein the access gateway contact information comprises at least one TNGF IP Address.

21. The apparatus of any preceding claim 17-20, wherein the message from the mobile network is an SMC request message.

22. The apparatus of any preceding claim 17-21, wherein the apparatus is further caused to use the access gateway contact information to connect to a trusted non-3GPP gateway function, TNGF.

23. The apparatus of any preceding claim 17-22, wherein the apparatus is further caused to receive an integrity protected and ciphered registration reject message comprising target access gateway contact information different from the access gateway being used, and to close the existing session with the access gateway in use and to use the target access gateway contact information to connect to the target access gateway.

24. A method, comprising: participating in an user equipment registration procedure to a mobile network access; determining, in an access and mobility management function, AMF, an access gateway contact information; and sending an integrity protected message from the AMF comprising the access gateway contact information integrity protected to a trusted non-3GPP gateway function, TNGF.

25. A non-transitory computer readable medium comprising program instructions stored thereon for performing at least the following: participating in an user equipment registration procedure to a mobile network access; determining, in an access and mobility management function, AMF, an access gateway contact information; and sending an integrity protected message from the AMF comprising the access gateway contact information integrity protected to a trusted non-3GPP gateway function, TNGF.

26. A method, comprising: participating in a user equipment registration procedure to a mobile network access; receiving, in a trusted non-3GPP gateway function, TNGF, an integrity protected message from an access and mobility management function, AMF, comprising the received access gateway contact information integrity protected; and forwarding, in the TNGF, the received integrity protected access gateway contact information in a message to a user equipment, UE.

27. A non-transitory computer readable medium comprising program instructions stored thereon for performing at least the following: participating in a user equipment registration procedure to a mobile network access; receiving , in a trusted non-3GPP gateway function, TNGF, an integrity protected message from an access and mobility management function, AMF, comprising the received access gateway contact information integrity protected; and forwarding, in the TNGF, the received integrity protected access gateway contact information in a message to a user equipment, UE.

28. A method, comprising: receiving, at a user equipment, UE, from a mobile network a message comprising integrity protected access gateway contact information; and verifying the integrity protection of the access gateway contact information at the UE.

29. A non-transitory computer readable medium comprising program instructions stored thereon for performing at least the following: receiving, at a user equipment, UE, from a mobile network a message comprising integrity protected access gateway contact information; and verifying the integrity protection of the access gateway contact information at the UE.