Abstract: A method may be provided at a wireless terminal to support communications with a network node of a wireless communication network. An IKE SA may be initiated to establish a NAS connection between the wireless terminal and the network node through a non-3GPP access network and a non-3GPP interworking function network node. After initiating the IKE SA, an IKE authorization request may be transmitted through the non-3GPP access network to the N3IWF network node, with the IKE authorization request including an identifier of the wireless terminal. An access network key may be derived for the NAS connection through the non-3GPP access network at the wireless terminal, with the access network key being derived based on a NAS count for the wireless terminal and an anchor key. An IKE authorization response corresponding to the IKE authorization request may be received.

Abstract: There is provided mechanisms for obtaining initial cellular network connectivity. A method is performed by a terminal device. The method comprises obtaining an activation code for a network subscription and MNO specific information. The method comprises identifying at least one MNO from the MNO specific information. The method comprises wirelessly authenticating with an MNO node of one of the at least one identified MNO by using the MNO specific information to obtain the initial cellular network connectivity.

Abstract: A terminal device obtains grid location information relating to a cell of a predetermined grid in which the terminal device is located. The terminal device then calculates a message integrity code based on the grid location information and transmits a proximity service discovery message. The discovery message includes the calculated message integrity code and does not include the grid location information. A second terminal device receives the proximity service discovery message. The second terminal device then obtains grid location information relating to at least one cell of a predetermined grid within a predetermined distance of a location of the second terminal device, calculates at least one message integrity code based on the grid location information, and determines whether a calculated message integrity code matches the message integrity code in the received discovery message. The second terminal device then acts on the received discovery message only if there is a match.

Abstract: A terminal device obtains grid location information relating to a cell of a predetermined grid in which the terminal device is located. The terminal device then calculates a message integrity code based on the grid location information and transmits a proximity service discovery message. The discovery message includes the calculated message integrity code and does not include the grid location information. A second terminal device receives the proximity service discovery message. The second terminal device then obtains grid location information relating to at least one cell of a predetermined grid within a predetermined distance of a location of the second terminal device, calculates at least one message integrity code based on the grid location information, and determines whether a calculated message integrity code matches the message integrity code in the received discovery message. The second terminal device then acts on the received discovery message only if there is a match.

Abstract: Methods and apparatus for secondary authentication in a network. A method performed by a user equipment (UE) comprises establishing a user plane (UP) session or connection with a UP function (UPF), receiving an extensible authentication protocol (EAP) based authentication request from the UPF and sending an EAP based authentication response to the UPF. A method performed by a user plane UP function (UPF) comprises establishing a UP session or connection to a user equipment (UE), sending an extensible authentication protocol (EAP) based authentication request to the UE, and receiving an EAP based authentication response from the UE.

Abstract: A method performed by a proximity service server is disclosed. The method comprises generating a ProSe query code and a ProSe response code, sending at least a the ProSe response code together with a first and a second discovery key to a first end device, and sending at least the first discovery key and the ProSe query code to a second end device, so that the second end device can securely discover the first end device over an air interface.

Abstract: A terminal device obtains grid location information relating to a cell of a predetermined grid in which the terminal device is located. The terminal device then calculates a message integrity code based on the grid location information and transmits a proximity service discovery message. The discovery message includes the calculated message integrity code and does not include the grid location information. A second terminal device receives the proximity service discovery message. The second terminal device then obtains grid location information relating to at least one cell of a predetermined grid within a predetermined distance of a location of the second terminal device, calculates at least one message integrity code based on the grid location information, and determines whether a calculated message integrity code matches the message integrity code in the received discovery message. The second terminal device then acts on the received discovery message only if there is a match.

Abstract: Methods And Apparatus For Direct Communication Key Establishment Methods (100, 200, 300) and apparatus (400, 500, 600, 700, 800, 900) are disclosed for establishing a key for direct communication between a User Equipment device, UE, and a device. The methods and apparatus cooperate to form a system for securing direct communication between a UE and a device over an interface. The system comprises a UE (20), a device (30) and a Direct Communication Element (40). The Direct Communication Element (40) is configured to obtain a shared session key and Generic Bootstrapping Architecture Push Information, GPI, to derive a direct communication key from at least the shared session key, and to send the direct communication key and the GPI to the device (30). The device (30) is configured to send the GPI to the UE (20). The UE (20) is configured to derive the shared session key from at least the GPI and to derive the direct communication key from the shared session key.

Abstract: A method of operation of a terminal device in a cellular communications network is disclosed. The method comprises sending a GMM Attach Request message to the network, the GMM Attach Request message identifying security capabilities of the terminal device. The terminal device receiving from the network an echo message in the GMM layer including information identifying the security capabilities of the terminal device, wherein the echo message is received with integrity protection.

Abstract: Enabling the exchange of connection parameters where a user equipment (UE) lacks a secret shared with the network (e.g. a server), such as key materials, and lacks a valid certificate. In some embodiments, the connection parameters may be exchanged via EAP messages. In certain aspects, and particularly with respect to emergency attach, a simplified protocol is used with limited overhead because the UE does not attempt to authenticate the network, and the network does not attempt to authenticate the UE.

Abstract: A key management is provided that enables security activation before handing over a user equipment from a source 5G wireless communication system, i.e., a Next Generation System (NGS), to a target 4G wireless communication system, i.e., a Evolved Packet System (EPS)/Long Term Evolution (LTE). The key management achieves backward security, i.e., prevents the target 4G wireless communication system from getting knowledge of 5G security information used in the source 5G wireless communication system.

Abstract: Methods (100, 200, 300) and apparatus (400, 500, 600, 700, 800, 900) are disclosed for establishing a key for direct communication between a User Equipment device, UE, and a device. The methods and apparatus cooperate to form a system for securing direct communication between a UE and a device over an interface. The system comprises a UE (20), a device (30) and a Direct Communication Element (40). The Direct Communication Element (40) is configured to obtain a shared session key and Generic Bootstrapping Architecture Push Information, GPI, to derive a UE delivery key from at least the shared session key, to generate a direct communication key, to encrypt the direct communication key with the UE delivery key, and to send the direct communication key, the encrypted direct communication key and the GPI to the device (30). The device (30) is configured to send the encrypted direct communication key and the GPI to the UE (20).

Abstract: A method of operating a user equipment, UE, includes establishing a radio resource control, RRC, connection with a base station, following establishment of the RRC connection, sending an indication of a security capability of the UE to the base station, receiving a non-access stratum, NAS, message, from the base station, wherein the NAS message identifies a selected security algorithm, and generating the access stratum security key to be used with the selected security algorithm.

Abstract: A terminal device obtains location information relating to its location, wherein the location information comprises first location information and second location information, wherein the first location information relates to a location of the terminal device within a region, and wherein the second location information identifies the region in which the terminal device is located. The terminal device forms content for a proximity service discovery message, wherein the content for the discovery message includes the first location information; calculates a message integrity code based on the content for the discovery message and the second location information; and transmits the proximity service discovery message, comprising the content for the discovery message and the computed message integrity code.

Abstract: A UE, a device and a Direct Communication Element. The UE is configured to establish a UE shared key with a Bootstrapping Server Function (BSF) using a Generic Bootstrapping Architecture (GBA) procedure, to discover the device through a discovery procedure after establishing the UE shared key, and to derive a direct communication key from at least the UE shared key. The device is configured to receive a transaction identifier associated with the UE shared key from the UE, to send the transaction identifier to the Direct Communication Element, and to receive the direct communication key from the Direct Communication Element. The Direct Communication Element is configured to receive the transaction identifier from the device, to obtain a shared session key from the BSF; to derive the direct communication key, and to send the direct communication key to the device.

Abstract: A terminal device obtains location information relating to its location, wherein the location information comprises first location information and second location information, wherein the first location information relates to a location of the terminal device within a region, and wherein the second location information identifies the region in which the terminal device is located. The terminal device forms content for a proximity service discovery message, wherein the content for the discovery message includes the first location information; calculates a message integrity code based on the content for the discovery message and the second location information; and transmits the proximity service discovery message, comprising the content for the discovery message and the computed message integrity code.

Abstract: An authentication node (22) in a wireless communication system (10) authenticates a message received by a recipient radio node (16A) (e.g., a user equipment). The authentication node (22) in this regard determines a radio resource that carries the message received by the recipient radio node (16A). The authentication node (22) performs authentication of the message, by checking whether the message is bound to the determined radio resource. The authentication node (22) may, for example, compute an expected authentication or integrity code based on information identifying the determined radio resource and check whether the expected authentication or integrity code matches an authentication or integrity code associated with the message.

Abstract: A method of operation of a terminal device in a cellular communications network is disclosed. The method comprises sending a GMM Attach Request message to the network, the GMM Attach Request message identifying security capabilities of the terminal device. The terminal device receiving from the network an echo message in the GMM layer including information identifying the security capabilities of the terminal device, wherein the echo message is received with integrity protection.

Abstract: A method performed by a source network node for handover of a wireless communication device in a first wireless communications network using a first RAT is provided. The handover is to be performed from the source network node to a target network node. The wireless communication device is configured to communicate with the source network node directly and to communicate with the source network node via a radio access node in a second wireless communications network using a second RAT. The source network node provides (401) the target network node with information about parameters relating to a communication between the wireless communication device and the source network node via the radio access node. The source network node receives (402) a feedback from the target network node. The feedback comprises an indication of whether or not the radio access node was able to keep a context of the wireless communication device in the second wireless communications network.

Abstract: A terminal device, for example a 3GPP Proximity Services (ProSe)-enabled user equipment, obtains grid location information relating to a cell of a predetermined grid in which the terminal device is located. The terminal device then calculates a message integrity code based on the grid location information and transmits a proximity service discovery message. The discovery message includes the calculated message integrity code and does not include the grid location information. A second terminal device, for example a 3GPP Proximity Services (ProSe)-enabled user equipment, receives a proximity service discovery message containing a message integrity code.