Abstract: There is provided a method, apparatus, and computer program for causing an apparatus at least to perform establishing a first security context with another apparatus over a first access path between the another apparatus and the apparatus; establishing a second security context with the another apparatus over a second access path between the another apparatus and the apparatus, wherein the first and second access paths are associated with a same access type; and simultaneously maintaining the first and second security contexts.

Abstract: Embodiments of the present disclosure relate to sidelink positioning security. A first terminal device sends a first request message to a first network device or a second terminal device. Then the first network device requests an ID related to group from a second network device. Next, the first network device or the second terminal device sends, to the first terminal device, a reply message comprising a group specific key for sidelink groupcast/broadcast communications in a group of terminal devices for sidelink positioning. Thus, an improved solution for the security of SL groupcast/broadcast communication is provided.

Abstract: An apparatus comprises means configured to: receive an authentication request from a management service consumer, the request comprising at least an identifier associated with an identity of the management service consumer and a credential used by the identity; and authenticate the management service consumer in dependence on the request, said authentication being dependent on one or more authentication policies associated with the management service consumer, different types of management service consumers being associated with one or more different authentication policies.

Abstract: A first terminal device determines that UP traffic is to be communicated between the first terminal device and a second terminal device without confidentiality protection. The first terminal device determines that the UP traffic is to be communicated between the first terminal device and the second terminal device without integrity protection or with a partial integrity protection. The first terminal device transmits, to the second terminal device, a message indicating that the UP traffic is to be communicated without the confidentiality protection or the integrity protection, or without the confidentiality protection and with the partial integrity protection. In turn, the first terminal device communicates the UP traffic between the first terminal device and the second terminal device without the confidentiality protection or the integrity protection, or without the confidentiality protection and with the partial integrity protection.

Abstract: There is disclosed an apparatus comprising means for performing: obtaining data associated with network slice isolation performance; generating analytics information based on the data; and sending the analytics information.

Abstract: There is provided an apparatus (202, 302) comprising: means for receiving a request to create or update a network slice, wherein the request comprises a selection list; means for determining an isolation group using the selection list; and means for providing a network slice instance for the network slice request, wherein the determined isolation group is associated with the network slice instance.

Abstract: Example embodiments of the present disclosure relate to UP traffic handling for emergency case. A first terminal device determines that UP traffic is to be communicated between the first terminal device and a second terminal device without confidentiality protection. The first terminal device determines that the UP traffic is to be communicated between the first terminal device and the second terminal device without integrity protection or with a partial integrity protection. The first terminal device transmits, to the second terminal device, a message indicating that the UP traffic is to be communicated without the confidentiality protection or the integrity protection, or without the confidentiality protection and with the partial integrity protection.

Abstract: Disclosed are devices, methods, apparatuses, and computer readable media for network slice security. An example terminal device may include at least one processor and at least one memory. The at least one memory may store instructions that, when executed by the at least one processor, may cause the terminal device at least to perform: receiving from a source access network device associated with a handover of the terminal device, security information specific to a slice; and deriving at least one key specific to the slice based on the security information specific to the slice.

Abstract: Example embodiments of the present disclosure relate to methods, devices, apparatuses and a computer-readable medium for communication to enhance security for path switching between relay terminal devices. In an example method, based on determining that path switching from a source relay terminal device having a first relay service code (RSC) associated with a first set of security policies is triggered, a remote terminal device determines a second RSC. The remote terminal device obtains a second set of security policies associated with the second RSC. Then, the remote terminal device selects a candidate relay terminal device having the second RSC as a target relay terminal device for the path switching in the event that the second set of security policies match the first set of security policies. In this way, the security policies to be used after path switching could be ensured to match the security policies before path switching.

Abstract: Example embodiments of the present disclosure relate to UP traffic handling for emergency case. A first terminal device determines that UP traffic is to be communicated between the first terminal device and a second terminal device without confidentiality protection. The first terminal device determines that the UP traffic is to be communicated between the first terminal device and the second terminal device without integrity protection or with a partial integrity protection. The first terminal device transmits, to the second terminal device, a message indicating that the UP traffic is to be communicated without the confidentiality protection or the integrity protection, or without the confidentiality protection and with the partial integrity protection.

Abstract: Example embodiments of the present disclosure relate to devices, methods, apparatuses and computer readable media supporting network slice or tenant specific automated certificate management configurations. A network slice certificate orchestrator may be configured to receive from a management system certification authority configuration indicative of a certification authority configured for one or more network slices, and transmit to a registration authority or a certification authority a certificate request with respect to a network function allocated to one of the one or more network slices along with information of the certification authority configured for the one or more network slices.

Abstract: There is provided an apparatus for a network node comprising means for receiving an indication of a serving network name of a first user equipment, the first user equipment configured to operate as a relay between a second user equipment and a network by providing a proximity-based service between the first user equipment and the second user equipment, means for determining an authentication vector for a proximity-based service authentication for the second user equipment based on the serving network name of the first user equipment; and means for providing an indication of the serving network name of the first user equipment to the second user equipment.

Abstract: Various example embodiments relate to methods and apparatuses for network slice security for non-3GPP access. An apparatus may be configured to send to an access network device, a request message comprising network slice group information corresponding to network slice identification information of the terminal device; and receive from the access network device, an identification of a non-3GPP access network device capable of serving at least one network slice indicated in the network slice identification information in response to the request message.

Abstract: Embodiments of the present disclosure provide a method and apparatus for accessing information about spatial anchor. A method (400) performed by a first apparatus for accessing information about at least one spatial anchor may comprise: transmitting (S402), to a second apparatus, a first request for an authorization to access information about the at least one spatial anchor; receiving (S404), from the second apparatus, a first response indicating the authorization; transmitting (S406), to a third apparatus, a second request based at least on the authorization, for accessing information about at least one spatial anchor; and receiving (S408), from the third apparatus, a second response.

Abstract: Methods and apparatus are disclosed for protecting information for a SoR procedure initiated by a user equipment (UE). A method comprises, creating at a UE, a first secured packet which is protected with one or more keys, wherein the first secured packet comprises enhanced steering of roaming (SoR) related information for triggering a SoR procedure; and sending from the UE to a first visited public land mobile network (VPLMN), a message comprising the first secured packet. Each of the one or more keys is a symmetric key, which is available for the UE and a home public land mobile network (HPLMN) of the UE before a primary authentication of an initial registration to the first VPLMN.

Abstract: Embodiments of the present disclosure relate to registration enhancements for multi-access. A terminal device is provided comprising at least one processor and at least one memory storing instructions. The instructions, when executed by the at least one processor, cause the terminal device at least to: initiate a first registration procedure with a first network device of a first PLMN, and based on determining that the first registration procedure is completed, initiate a second registration procedure with a second network device of a second PLMN. As such, registration for multi-access is enhanced.

Abstract: Embodiments of the present disclosure relate to security communication in ProSe U2N relay. According to one aspect of the present disclosure, remote UE and relay UE receive a configuration comprising at least a set of indicators of a CP based security procedure or a UP based security procedure for a set of relay services. Based on an indicator for a relay service in the set of indicators, the remote UE and relay UE performs one of the CP based security procedure or the UP based security procedure for a communication between the remote UE and the relay UE for the relay service. In this way, remote UE and remote UE may correctly trigger a security procedure for U2N relay communication.

Abstract: Embodiments of the present disclosure relate to security communication in ProSe U2N relay. According to one aspect of the present disclosure, remote UE and relay UE receive a configuration comprising at least a set of indicators of a CP based security procedure or a UP based security procedure for a set of relay services. Based on an indicator for a relay service in the set of indicators, the remote UE and relay UE performs one of the CP based security procedure or the UP based security procedure for a communication between the remote UE and the relay UE for the relay service. In this way, remote UE and remote UE may correctly trigger a security procedure for U2N relay communication.

Abstract: There is disclosed an apparatus. The apparatus comprises means for performing: in response to determining a lack of resource or an impending lack of resource in a communication network, determining whether an agreed level of service for one or more service requirements of one or more services will be affected; and when it is determined that the agreed level of service for one or more service requirements of one or more services will be affected, determining whether one or more customers can tolerate non-compliance with the agreed level of service.

Abstract: Provided herein are systems and methods for preventing network attacks in a network slice. In particular, security requirements of a network slice instance are retrieved and specific security policies to be applied to each of multiple constituent network slice subnet instances within the network slice instance are identified based on the security requirements. A deployment of one or more security function instances for each subnet instance configured according to a corresponding security policy is then facilitated.