Abstract: Systems and methods for provisioning user privacy parameters necessary for network security in 5G telecommunication networks are provided, such as the subscriber permanent identifier (SUPI), the routing indicator, the protection scheme identifier, or the home network key. In order to protect the user privacy parameters, the techniques disclosed herein use private and public key encryption, as well as integrity protection offered by 5G telecommunications protocols. Such techniques use registration response messages, update location requests, or update notification request messages to provide end-to-end or end-to-middle security in the provisioning process. Unlike existing over-the-air (OTA) techniques, the techniques described herein provision user privacy parameters or other similar data in a secure and verifiable manner.

Abstract: A device may receive, from a network device, a user equipment (UE) parameter update request notification indicating an update to a UE parameter of a universal subscriber identity module (USIM), and may generate an encrypted UE parameter update request. The device may cause the encrypted UE parameter update request to be provided to the USIM to cause the USIM to update the UE parameter and to generate an encrypted UE parameter update response. The device may receive, from the network device, the encrypted UE parameter update response, and may verify an authenticity of content of the encrypted UE parameter update response based on whether the encrypted UE parameter update response is signed by the USIM. The device may provide, to the network device, a result indicating whether the UE parameter is updated and whether the authenticity of the content of the encrypted UE parameter update response is verified.

Abstract: The systems, devices, and methods discussed herein are directed to redirecting mobile traffic of an infected mobile device, or user equipment (UE), to a security network node, which provides a security action for the UE. A mobile session management node may identify the UE as an infected device based on a database maintained at an intelligent redirection node or a security posture indicator received from the UE. The mobile management entity may then create a session with a security network node which redirects mobile traffic of the infected UE to the security network node and provides a security action for the UE.

Abstract: A telecommunications network includes a serving network and a home network. In some examples the serving network receives, from the home network, identity data associated with a network terminal. The serving network determines a tied key using a tying key derivation function (TKDF) based on the identity data, then prepares an authentication request based on the tied key and sends the request to the terminal. In some examples, the home network receives the identity data from the access network and determines a tied key using a TKDF. The home network then determines a confirmation message based on the first tied key. In some examples, the serving network receives the identity data from the home network, and receives a network-slice selector associated with the network terminal. The serving network determines a tied key using a TKDF based on the identity data and the network-slice selector.

Abstract: A method performed by an AP may comprise initializing a CCC and increasing the CCC upon a change of at least one of a plurality of parameters of the AP. The plurality of parameters may include at least a high throughput (HT) Operation element, one or more Enhanced Distributed Channel Access (EDCA) parameters, or one or more operational mode parameters. The method may further comprise transmitting a frame, to at least one STA, wherein the frame includes an indication of the CCC, and the frame indicates that the at least one STA return from a power saving mode.

Abstract: A telecommunications network includes a serving network and a home network. In some examples the serving network receives, from the home network, identity data associated with a network terminal. The serving network determines a tied key using a tying key derivation function (TKDF) based on the identity data, then prepares an authentication request based on the tied key and sends the request to the terminal. In some examples, the home network receives the identity data from the access network and determines a tied key using a TKDF. The home network then determines a confirmation message based on the first tied key. In some examples, the serving network receives the identity data from the home network, and receives a network-slice selector associated with the network terminal. The serving network determines a tied key using a TKDF based on the identity data and the network-slice selector.

Abstract: A method for fast initial link setup (FILS) for use in a wireless station, is disclosed. The method includes receiving a FILS discovery (FD) frame from an access point (AP). FD frame includes an FD frame control field and FD frame contents. The FD frame control field includes a capability presence indicator indicating whether a FD capability field is present in the FD frame contents. The method further includes determining to associate with the AP based on the received FD frame, and transmitting an association request frame to the AP.

Abstract: A method performed by a STA may comprise transmitting a first ANQP message to an AP and receiving a second ANQP message in response. The second ANQP message may comprise a CCC value representing a configuration instance of the AP which is incremented by one upon a configuration change. The CCC value may wrap around once a maximum value is reached. The first ANQP message may comprise the CCC value or may comprise another CCC value which is different than the CCC value.

Abstract: Techniques are disclosed for enhancing mobile subscriber privacy in telecommunications networks. In some embodiments, in the course of a registration process, a user device and an associated telecommunications network exchange trust indicators (TrIs), and respectively verify them. The user device and telecommunications network also transmit personally identifiable information (PII), such as an International Mobile Subscriber Identity (IMSI), in an encrypted form, and use a pseudo IMSI in place of the IMSI for the duration of the session.

Abstract: A network terminal, e.g., LTE or 5G, can connect to a home network via a serving network. The terminal can have a terminal identifier (TID), such as an IMEI or other PEI, and a network subscriber can have a subscriber identifier (SID), such as an IMSI or other SUPI. In some nonlimiting examples, a network node can determine that a SID and a TID are authorized for joint use and, in response, transmit authorization information. In some nonlimiting examples, a network node can receive an attach request having verification data and encrypted identification data. The network node can receive decrypted identity data and determine that the identity data corresponds with the verification data. In some nonlimiting examples, the terminal can send an attach request comprising encrypted SID and TID data, and a cryptographic hash, to a network node.

Abstract: A telecommunications network includes a serving network and a home network. In some examples the serving network receives, from the home network, identity data associated with a network terminal. The serving network determines a tied key using a tying key derivation function (TKDF) based on the identity data, then prepares an authentication request based on the tied key and sends the request to the terminal. In some examples, the home network receives the identity data from the access network and determines a tied key using a TKDF. The home network then determines a confirmation message based on the first tied key. In some examples, the serving network receives the identity data from the home network, and receives a network-slice selector associated with the network terminal. The serving network determines a tied key using a TKDF based on the identity data and the network-slice selector.

Abstract: A method performed by a STA may comprise transmitting a first ANQP message to an AP and receiving a second ANQP message in response. The second ANQP message may comprise a CCC value representing a configuration instance of the AP which is incremented by one upon a configuration change. The CCC value may wrap around once a maximum value is reached. The first ANQP message may comprise the CCC value or may comprise another CCC value which is different than the CCC value.

Abstract: A power saving method performed by a STA may comprise receiving, from an AP, a first beacon comprising a CCC value. The CCC value may be an integer value that represents a configuration instance of the AP. The STA may return from a power saving mode upon receiving the first beacon and receive a second beacon from the AP. The second beacon may be a primary beacon of the AP. The first beacon may comprise an SSID of the AP. The STA may perform an association procedure with the AP upon receiving the first beacon.

Abstract: Techniques are disclosed for enhancing mobile subscriber privacy in telecommunications networks. In some embodiments, in the course of a registration process, a user device and an associated telecommunications network exchange trust indicators (TrIs), and respectively verify them. The user device and telecommunications network also transmit personally identifiable information (PII), such as an International Mobile Subscriber Identity (IMSI), in an encrypted form, and use a pseudo IMSI in place of the IMSI for the duration of the session.

Abstract: A power saving method performed by a STA may comprise receiving, from an AP, a first beacon comprising a CCC value. The CCC value may be an integer value that represents a configuration instance of the AP. The STA may return from a power saving mode upon receiving the first beacon and receive a second beacon from the AP. The second beacon may be a primary beacon of the AP. The first beacon may comprise an SSID of the AP. The STA may perform an association procedure with the AP upon receiving the first beacon.

Abstract: Methods, apparatus and systems for managing an exposure of a network to a wireless transmit/receive unit (WTRU) are disclosed. One representative method includes receiving, by an access point (AP) of the network, information associated with the WTRU; and selectively exposing, by the AP, the network.

Abstract: A method for fast initial link setup (FILS) for use in a wireless station, is disclosed. The method includes receiving a FILS discovery (FD) frame from an access point (AP). FD frame includes an FD frame control field and FD frame contents. The FD frame control field includes a capability presence indicator indicating whether a FD capability field is present in the FD frame contents. The method further includes determining to associate with the AP based on the received FD frame, and transmitting an association request frame to the AP.

Abstract: The systems, devices, and methods discussed herein are directed to a portable communication device, or a user equipment (UE), for discovering and accessing services through a wireless local area network (WLAN) that has not previously been provisioned for the UE without having a user of the UE provide credential information. To access services through an unprovisioned WLAN, the UE sends a request to its mobile network operator (MNO), and causes the MNO to request to, and receive from, the WLAN service provider the credential information for the UE, which is used to provision both the WLAN and UE.

Abstract: The systems, devices, and methods discussed herein are directed to a portable communication device, or a user equipment (UE), for obtaining cellular network services with an unassociated cellular network with assistance from a wireless local area network (WLAN). The UE registers with the WLAN, discovers the unassociated cellular network, sends request to a WLAN service provider of the WLAN to obtain cellular network services with the unassociated cellular network, and obtains cellular network services with the unassociated cellular network.

Abstract: A method for performing active scanning by a non-AP STA may comprise transmitting, to a group of APs, one or more probe request frames and receiving in response, configuration chance count (CCC) values from first and second APs of the group of APs. The CCC values may be integer values that represent configuration instances of the respective APs. The CCC values may be stored in a memory of the non-AP STA. A determination may be made, based on the information stored in the memory, as to which AP is preferred. An association procedure may be performed with the preferred AP. Other disclosed methods employ passive scanning.