Abstract: A communication terminal (10) according to the present disclosure includes: a control unit (12) configured to, in a case of a movement from a communication area formed by the 5GS to a communication area formed by the EPS or a movement from a communication area formed by the EPS to a communication area formed by the 5GS, determine whether or not a communication system forming a communication area at a movement destination can satisfy requirements of services; and a communication unit (11) configured to, when it is determined that the communication system forming the communication area at the movement destination can satisfy the requirements of the services, send a connection request message to the communication system forming the communication area at the movement destination.

Abstract: An SeNB informs an MeNB that it can configure bearers for the given UE. At this time, the MeNB manages the DRB status, and then sends a key S-KeNB to the SeNB. The MeNB also sends a KSI for the S-KeNB to both of the UE and the SeNB. After this procedure, the MeNB informs an EPC (MME and S-GW) about the new bearer configured at the SeNB, such that the S-GW 50 can start offloading the bearer(s) to the SeNB 30. Prior to the offloading, the EPC network entity (MME or S-GW) performs verification that: 1) whether the request is coming from authenticated source (MeNB); and 2) whether the SeNB is a valid eNB to which the traffic can be offload.

Abstract: In order for efficiently managing communications between a UE (10) and multiple SCSs (20_1-20_n), the UE (10) includes, in one message, multiple pieces of data to be transmitted to the SCSs (20_1-20_n), and sends the message to an MTC-IWF (30). The MTC-IWF (30) receives the message from the UE (10), and distributes the date to the SCSs (20_1-20_n). Each of the SCSs sends (20_1-20_n), to the MTC-IWF (30), data to be transmitted to the UE (10) and an indicator that indicates for the SCSs (20_1-20 n) the time tolerance until the data is transmitted to the UE (10). The MTC-IWF (30) receives the data and the indicators from the SCSs (20_1-20_n), and determines when to forward the data to the UE (10) based on the indicators.

Abstract: There is provided a network system including one or more first MMEs (30), and a second MME (40) separated from the first MMEs (30). In one of operation cases, the first MME (30) pushes, to the second MME (40), security context for a UE (10) that attaches to the first MME (30). The second MME (40) stores the security context. The first MME (30) further pushes the latest security context to the second MME (40), during a switch-off procedure for the first MME (30). The second MME (40) updates the stored security context with the latest security context. The first MME (30) pulls the security context from the second MME (40), when the UE (10) re-attaches to the first MME (30) or is handovered from different one of the first MMEs (30).

Abstract: A mobile communication system includes a central processing unit coupled to a memory storing instructions for executing a User Equipment (UE) implemented by a transceiver and a controller that supports Proximity Services (ProSe), and a ProSe Function that supports the ProSe and communicates with the UE via a PC3 interface. The UE sends a message for a discovery to the ProSe Function via the PC3. The ProSe Function directly sends security information to the UE via the PC3. The UE directly sends a protected message to another UE on a PC5 interface using a key based on the security information.

Abstract: A communication terminal (10) includes control means for generating a subscription concealed identifier (SUCI) including a subscription permanent identifier (SUPI) concealed using a predetermined protection scheme, and a protection scheme identifier identifying the protection scheme, and transmission means for sending the SUCI to a first network apparatus during a registration procedure, the SUCI being sent for a second network apparatus to de-conceal the SUPI from the SUCI based on the protection scheme used to generate the SUCI.

Abstract: In order for charging SDT and MTC device trigger over control plane, there is provided a network node (40) that relays messages over a control plane (T5 and Tsp) between an MTC device (10) and an SCS (50). The network node (40) counts the number of messages successfully relayed, and generates a CDR in accordance with the counted number. The messages are SDT messages delivered from the MTC device (10) to the SCS (50), SDT messages delivered from the SCS (50) to the MTC device (10), or MTC device trigger messages delivered from the SCS (50) to the MTC device (10). The network node (40) transfers the CDR to an OCF (31) or a CDF (32).

Abstract: An object is to provide a key generation method capable of maintaining a high security level in each of sliced networks when network slicing is applied to a core network. A key generation method according to this disclosure specifies network slice identification information indicating a network slice system that provides a service to be used by a communication terminal (50) among a plurality of network slice systems included in a core network (10) and, using the network slice identification information, generates a service key to be used for security processing in the network slice system indicated by the network slice identification information.

Abstract: In order for efficiently managing communications between a UE (10) and multiple SCSs (20_1-20_n), the UE (10) includes, in one message, multiple pieces of data to be transmitted to the SCSs (20_1-20_n), and sends the message to an MTC-IWF (30). The MTC-IWF (30) receives the message from the UE (10), and distributes the date to the SCSs (20_1-20_n). Each of the SCSs sends (20_1-20_n), to the MTC-IWF (30), data to be transmitted to the UE (10) and an indicator that indicates for the SCSs (20_1-20 n) the time tolerance until the data is transmitted to the UE (10). The MTC-IWF (30) receives the data and the indicators from the SCSs (20_1-20_n), and determines when to forward the data to the UE (10) based on the indicators.

Abstract: A communication terminal capable of preventing a reduction in security level that is caused at the time of establishing multiple connections via 3GPP Access and Non-3GPP Access. A communication terminal according to the present disclosure includes: a communication unit configured to communicate with gateway devices disposed in a preceding stage of a core network device via an Untrusted Non-3GPP Access; and a key derivation unit configured to derive a second security key used for security processing of a message transmitted using a defined protocol with the gateway device, from a first security key used for security processing of a message transmitted using a defined protocol with the core network device.

Abstract: In order for making MTC more efficient and/or secure, a base station forming a communication system connects a UE to a core network. A node serves as an entering point to the core network for a service provider, and transmits traffic between the service provider and the UE. The node establishes, as a connection to the base station, a first connection for directly transceiving messages between the node and the base station. Alternatively, the node establishes a second connection for transparently transceiving the messages through a different node that is placed within the core network and has established a different secure connection to the base station.

Abstract: A purpose of the present disclosure is to provide a communication system that are capable of maintaining a high security level in each divided network in the case of applying network slicing to a core network. A communication system according to the present disclosure includes a subscriber-information management apparatus (10) configured to manage subscriber information of a communication terminal; and a security apparatus (20) configured to manage identification information of the communication terminal in association with security information used in at least one network slice system usable by the communication terminal. The subscriber-information management apparatus (10) acquires, using the identification information of the communication terminal and identification information of a network slice system used by the communication terminal, security information used in the network slice system used by the communication terminal from the security apparatus (20).

Abstract: In order for supporting separate ciphering at an MeNB (20) and an SeNB (30), the MeNB (20) derives separate first and second keys (KUPenc-M, KUPenc-S) from a third key (KeNB). The first key (KUPenc-M) is used for confidentially protecting first traffic transmitted over U-Plane between the MeNB (20) and a UE (10). The first key (KUPenc-M) may be the same as current KUPenc or a new key. The second key (KUPenc-S) is used for confidentially protecting second traffic transmitted over the U-Plane between the UE (10) and the SeNB (30). The MeNB (20) sends the second key (KUPenc-S) to the SeNB (30). The UE (10) negotiates with the MeNB (20), and derives the second key (KUPenc-S) based on a result of the negotiation.

Abstract: A mobile communication system includes a central processing unit coupled to a memory storing instructions for executing a User Equipment (UE) implemented by a transceiver and a controller that supports Proximity Services (ProSe), and a ProSe Function that supports the ProSe and communicates with the UE via a PC3 interface. The UE sends a message for a discovery to the ProSe Function via the PC3. The ProSe Function directly sends security information to the UE via the PC3. The UE directly sends a protected message to another UE on a PC5 interface using a key based on the security information.

Abstract: A method of forming a secure group in ProSe communication includes requesting a service request to a ProSe server from a requesting device (21), the service request indicating a request to communicate with a receiving device (22) from the requesting device (21), performing verification on the requesting and receiving devices (21) and (22) by the ProSe server 24, sending a ProSe Service Result to the requesting and receiving devices (21) and (22) to inform to be allowed a group member, and starting a group security establishment of the group including the requesting and receiving devices (21) and (22)

Abstract: In order for making MTC more efficient and/or secure, a base station forming a communication system connects a UE to a core network. A node serves as an entering point to the core network for a service provider, and transmits traffic between the service provider and the UE. The node establishes, as a connection to the base station, a first connection for directly transceiving messages between the node and the base station. Alternatively, the node establishes a second connection for transparently transceiving the messages through a different node that is placed within the core network and has established a different secure connection to the base station.

Abstract: A method of performing authentication and authorization in Proximity based Service (ProSe) communication by a requesting device which sends a request of a communication and a receiving device which receives the request from the requesting device, the method including deriving session keys Kpc and Kpi from an unique key Kp at the requesting and receiving devices, using the session keys Kpc and Kpi for ProSe communication setup and direct communication between the requesting and receiving devices, starting the direct communication with the requesting and receiving devices. The key Kpc is confidentiality key and the key Kpi is integrity protection key.

Abstract: In order for supporting separate ciphering at an MeNB (20) and an SeNB (30), the MeNB (20) derives separate first and second keys (KUPenc-M, KUPenc-S) from a third key (KeNB). The first key (KUPenc-M) is used for confidentially protecting first traffic transmitted over U-Plane between the MeNB (20) and a UE (10). The first key (KUPenc-M) may be the same as current KUPenc or a new key. The second key (KUPenc-S) is used for confidentially protecting second traffic transmitted over the U-Plane between the UE (10) and the SeNB (30). The MeNB (20) sends the second key (KUPenc-S) to the SeNB (30). The UE (10) negotiates with the MeNB (20), and derives the second key (KUPenc-S) based on a result of the negotiation.

Abstract: The present disclosure relates to secure provisioning of UE mobility restriction by extending neighbour relation tables to include mobility restrictions in addition to neighbour cell information and sending neighbour cell restriction information (per UE) to the UE, gNB, UE and gNB. The present invention also provides a method and apparatus and a system for mapping mobility restrictions with TA list and sending the TA list along with the Handover Restriction List during handover.

Abstract: A VNF package signing system, comprises an orchestration unit sending an acknowledge of receiving a VNF package including the VNF image, in response to the receiving the VNF package from a sender, a storage unit storing the VNF package and generating a certificate for the VNF package using a private key for at least generating a certificate for signing the VNF package and a HISEE (Hardware Isolated Secured Execution Environment) unit providing the private key in response to the request from the storage unit. The orchestration unit sends the acknowledge of receiving a VNF package when the storage unit successes generating the certificate of the VNF package.