Patent Description:
"<NPL>) discloses the security architecture, i.e. the security features and the security mechanisms for the <NUM> System and the <NUM> Core, and the security procedures performed within the <NUM> System including the <NUM> Core and the <NUM> New Radio.

Further advantageous features of the invention are defined by the accompanying appended dependent claims.

According to an example, a method of wireless communication is provided. The method includes generating, by a user equipment (UE), a mapped Evolved Packet System (EPS) security context associated with an intersystem change of the UE from a wireless system to an EPS, wherein the mapped EPS security context comprises security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity; determining an uplink (UL) non-access stratum (NAS) COUNT value and a downlink (DL) NAS COUNT value for the mapped EPS security context; and transmitting, by the UE, a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context.

In a further example, an apparatus for wireless communication is provided that includes a transceiver, a memory configured to store instructions, and one or more processors communicatively coupled with the transceiver and the memory. The aspect may include the one or more processors being configured execute instructions to generate, by a UE, a mapped EPS security context associated with an intersystem change of the UE from a wireless system to an EPS, wherein the mapped EPS security context comprises security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity; determine an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context; and transmit, by the UE, a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context.

In another aspect, an apparatus for wireless communication is provided that includes means for generating, by a UE, a mapped EPS security context associated with an intersystem change of the UE from a wireless system to an EPS, wherein the mapped EPS security context comprises security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity; means for determining an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context; and means for transmitting, by the UE, a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context.

In yet another aspect, a non-transitory computer-readable medium is provided including one or more processor executing code for generating, by a UE, a mapped EPS security context associated with an intersystem change of the UE from a wireless system to an EPS, wherein the mapped EPS security context comprises security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity; code for determining an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context; and code for transmitting, by the UE, a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context.

In another example, a method for wireless communication includes generating, by a first network entity, a mapped EPS security context associated with a request for an intersystem change of a UE from a wireless system to an EPS, wherein the mapped EPS security context includes security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a second network entity; determining an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context; and transmitting, by the first network entity, the mapped EPS security context with the UL NAS COUNT value and the DL NAS COUNT value to the second network entity.

In a further example, an apparatus for wireless communication is provided that includes a transceiver, a memory configured to store instructions, and one or more processors communicatively coupled with the transceiver and the memory. The aspect may include the one or more processors being configured execute instructions to generate, by a first network entity, a mapped EPS security context associated with a request for an intersystem change of a UE from a wireless system to an EPS, wherein the mapped EPS security context includes security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a second network entity; determine an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context; and transmit, by the first network entity, the mapped EPS security context with the UL NAS COUNT value and the DL NAS COUNT value to the second network entity.

In another aspect, an apparatus for wireless communication is provided that includes means for generating, by a first network entity, a mapped EPS security context associated with a request for an intersystem change of a UE from a wireless system to an EPS, wherein the mapped EPS security context includes security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a second network entity; means for determining an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context; and means for transmitting, by the first network entity, the mapped EPS security context with the UL NAS COUNT value and the DL NAS COUNT value to the second network entity.

In yet another aspect, a non-transitory computer-readable medium is provided including one or more processor executing code for generating, by a first network entity, a mapped EPS security context associated with a request for an intersystem change of a UE from a wireless system to an EPS, wherein the mapped EPS security context includes security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a second network entity; code for determining an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context; and code for transmitting, by the first network entity, the mapped EPS security context with the UL NAS COUNT value and the DL NAS COUNT value to the second network entity.

Software may be construed broadly to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software components, applications, software applications, software packages, routines, subroutines, objects, executables, threads of execution, procedures, functions, etc., whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise.

The base stations <NUM> configured for <NUM> LTE (collectively referred to as Evolved Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (E-UTRAN)) may interface with the EPC <NUM> through backhaul links <NUM> (e.g., S1 interface). The base stations <NUM> configured for 5GNR (collectively referred to as Next Generation RAN (NG-RAN)) may interface with core network <NUM> through backhaul links <NUM>. The base stations <NUM> may communicate directly or indirectly (e.g., through the EPC <NUM> or core network <NUM>) with each other over backhaul links <NUM> (e.g., X2 interface).

Some of the UEs <NUM> may be referred to as loT devices (e.g., parking meter, gas pump, toaster, vehicles, heart monitor, etc.).

Referring again to <FIG>, in certain aspects, the UE <NUM> may be configured to operate configuration component <NUM>. For example, as described further herein, configuration component <NUM> may generate a mapped EPS security context associated with an intersystem change of the UE from a wireless system to an EPS, wherein the mapped EPS security context comprises security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity; determining an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context; and transmitting, by the UE, a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context.

In certain aspects, the AMF <NUM> may be configured to operate configuration component <NUM>. For example, as described further herein, configuration component <NUM> may generating, by network entity, a mapped EPS security context associated with request for an intersystem change of a UE from a wireless system to an EPS, wherein the mapped EPS security context includes security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a second network entity; determining an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context; and transmitting, by the first network entity, the mapped EPS security context with the UL NAS COUNT value and the DL NAS COUNT value to the second network entity.

The described features generally relate to the configuration of a NAS COUNT value of a mapped EPS security context associated with an intersystem change of a UE from a wireless system (e.g., a <NUM> system) to an EPS. For example, in a wireless system to EPS mobility, the UE and/or Access and Mobility Management Function (AMF) create a mapped EPS security context. In generating the mapped EPS security context, the UE and AMF set the uplink and downlink NAS COUNTs to zero. However, setting the uplink and downlink NAS COUNTs to zero has unexpected issues due to either legacy Mobility Management Entity (MME) behavior or signaling optimization introduced in the wireless system to EPS mobility.

In an aspect, if UE sends a first uplink NAS message with uplink NAS COUNT = <NUM> using the mapped EPS security context, then the MME will not accept the uplink NAS message because the MME doesn't expect the NAS COUNT = <NUM> for the uplink NAS message in UE mobility. This issue can happen both in handover from the wireless system to EPS and in idle mode mobility from the wireless system to EPS. For the former case, the first uplink NAS message from UE to MME protected with the mapped EPS security context is the Tracking Area Update (TAU) request; for the latter case, the first uplink NAS message from UE to MME protected with the mapped EPS security context is the TAU complete.

In an example, after the completion of the wireless system to EPS handover, the UE sends a TAU request to update its location with uplink NAS COUNT = <NUM>. This may result in TAU request failure at the MME as the MME does not expect a TAU request with uplink NAS COUNT = <NUM>, i.e. the NAS COUNT in the TAU request is not larger than the stored NAS COUNT of the mapped EPS security context in the MME. Also, even if the TAU request is accepted at the MME, the MME sends a TAU accept with downlink NAS COUNT = <NUM> to the UE. This may also cause the UE to drop the TAU accept as the UE does not expect the downlink NAS message with DL NAS COUNT = <NUM> because the UE expects a downlink NAS COUNT larger than the stored downlink NAS COUNT in the mapped EPS security context.

In another example, in idle mode mobility from the wireless system to EPS, UE sends a TAU request protected using the current NAS security context. For the integrity protection of the TAU request, the UE uses the UL NAS COUNT of the NAS security context. This also introduces the similar issue as for the wireless system to EPS handover: the MME sends a TAU accept with DL NAS COUNT = <NUM>; the UE sends a TAU complete with UL NAS COUNT = <NUM>.

Furthermore, setting the NAS COUNTs to zero in the mapped EPS security context introduces a more serious security issue in idle mode mobility from the wireless system to EPS. In idle mode mobility from the wireless system to EPS, there are scenarios that UE and network need to setup AS security. For example, if the "active flag" is set in the TAU request message or the MME chooses to establish radio bearers when there is pending downlink UP data or pending downlink signalling, radio bearers will be established as part of the TAU procedure and a KeNB derivation is necessary. If there was no subsequent NAS SMC, the uplink NAS COUNT of the TAU request message sent from the UE to the MME is used as freshness parameter in the KeNB derivation using the KDF. The TAU request may be integrity protected.

Additionally, if KeNB needs to be derived for the above scenarios, the uplink NAS COUNT of the <NUM> NAS security context is used in KeNB derivation. However, this may cause UE and MME derive the same KeNB twice because the uplink NAS COUNT in the mapped EPS security context is set to zero and incremented for each uplink NAS message sent by the UE.

For example, in an aspect, the present disclosure includes a method, apparatus, and computer readable medium for wireless communications for configuring of a NAS COUNT value of a mapped EPS security context associated with an intersystem change of a UE from a wireless system to an EPS. The aspect may include generating, by a UE, a mapped EPS security context associated with an intersystem change of the UE from a wireless system to an EPS, wherein the mapped EPS security context comprises security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity; determining an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context; and transmitting, by the UE, a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context.

In another example, in an aspect, the present disclosure includes a method, apparatus, and computer readable medium for wireless communications for generating, by a first network entity, a mapped EPS security context associated with receiving a request for an intersystem change of a UE from a wireless system to an EPS, wherein the mapped EPS security context includes security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and the network entity; determining an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context; and transmitting, by the first network entity, the mapped EPS security context with the UL NAS COUNT value and the DL NAS COUNT value to the second network entity.

<FIG> is a diagram <NUM> illustrating an example of a handover procedure from a wireless system to EPS for a UE. For example, the UE may be similar to or the same as UE <NUM> of <FIG>, gNB/ng-eNB/eNB may be similar to or the same as base stations <NUM>, AMF may be similar to or the same as AMF <NUM>, and MME may be similar to or the same as MME <NUM>.

In an aspect, at step <NUM>, the gNB/ng-eNB sends a Handover Required message to the AMF, including the UE's identity and the UE's security capabilities. At step <NUM>, when the source AMF performs a handover procedure to the EPC, after checking the UE's access rights and security capabilities, the source AMF prepares a UE context including a mapped EPS security context for the target MME.

To construct the mapped EPS security context, the source AMF derives a K'ASME using the KAMF key and the current downlink NAS COUNT of the current security context and then increments its stored downlink NAS COUNT value by one. The source AMF selects the EPS NAS algorithms identifiers (it has stored) to be used in the target MME at interworking handover to EPS, for encryption and integrity protection. In an example, AMF may generate a mapped EPS security context associated with a request for an intersystem change of a UE from a wireless system to an EPS. The mapped EPS security context includes security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and the network entity. The AMF may further determine a DL NAS COUNT value for the mapped EPS security context.

In certain aspects, a legacy target MME is expecting to receive the selected EPS NAS algorithms identifiers over N26 from the source AMF as the target MME believes the source AMF is another MME. The source AMF has therefore provisioned the EPS NAS security algorithms identifiers to be used at interworking handover to EPS to the UE in the NAS SMC in wireless access. The target MME could re-select different EPS NAS algorithms though to be used with the UE by running a NAS SMC in the following Tracking Area Update procedure.

At step <NUM>. the source AMF transfers the UE security context (including new KASME', eKSI, uplink and downlink EPS NAS COUNT's, UE EPS security capabilities, selected EPS NAS algorithms identifiers) to the target MME in the Forward Relocation Request message. The UE NR security capabilities may be sent by the source AMF as well. At step <NUM>, when the target MME receives Forward Relocation Request message from source AMF, then the target MME derives EPS NAS keys (i.e., KNASenc and KNASint) from the received KASME' key with the received EPS NAS security algorithm identifiers as input, to be used in EPC. The target MME needs to include the {NH, NCC=<NUM>} pair and the UE security capabilities in the S1 HANDOVER REQUEST message to the target LTE eNB. The UE security capabilities include the UE EPS security capabilities received from the source AMF.

At step <NUM>, upon receipt of the S1 HANDOVER REQUEST from the target MME, the target LTE eNB selects AS security algorithms from the UE EPS security capabilities and computes the KeNB to be used with the UE and proceed. The target LTE eNB then sends the selected AS security algorithms in the target to source transparent container in the S1 Handover Request Ack Message to the target MME. At step <NUM>. the target MME includes the target to source transparent container received from the target LTE eNB in the Forward Relocation Response message sent to the source AMF. At step <NUM>, the source AMF includes the target to source transparent container and the <NUM> LSB of the downlink NAS COUNT value used in KASME' derivation in step <NUM>, in the Handover command sent to the source gNB/ng-eNB.

At step <NUM>, the source gNB/ng-eNB includes the target to source transparent container and the <NUM> LSB of the downlink NAS COUNT value in the Handover command sent to the UE. Upon the reception of the Handover Command message, the UE estimates the downlink NAS COUNT value using the received <NUM> LSB of the downlink NAS COUNT value and its stored downlink NAS COUNT value. The UE may ensure that the estimated downlink NAS COUNT value is greater than the stored downlink NAS COUNT value. Then, the UE may derive the mapped EPS security context, i.e. derive KASME' from KAMF as described in clause <NUM>. <NUM> using the estimated downlink NAS COUNT value. After the derivation the UE may set the downlink NAS COUNT value in the NAS security context to the received downlink NAS COUNT value.

At step <NUM>, the eKSI for the newly derived KASME' key. The UE may also derive the EPS NAS keys (i.e. KNASenc and KNASint) as the MME did in step <NUM> using the EPS NAS security algorithms identifiers stored in the ME and provisioned by the AMF to the UE in NAS SMC in earlier wireless access. The UE may also derive the initial KeNB from the KASME' and the uplink NAS COUNT using <NUM><NUM>-<NUM> as the value of the uplink NAS COUNT parameter. For example, the UE may generate a mapped EPS security context associated with an intersystem change of the UE from a wireless system to an EPS. The mapped EPS security context comprises security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity. The UE may further determine an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context.

At step <NUM>, the UE sends the Handover Complete message to the target LTE eNB. The UE may cipher and integrity protect this message using the newly created mapped EPS security context. At step <NUM>, the target LTE eNB notifies the target MME with a Handover Notify message.

<FIG> is a diagram <NUM> illustrating an example of idle mode mobility from a wireless system to EPS for a UE. For example, the UE may be similar to or the same as UE <NUM> of <FIG>, gNB/ng-eNB/eNB may be similar to or the same as base stations <NUM>, AMF may be similar to or the same as AMF <NUM>, and MME may be similar to or the same as MME <NUM>.

At step <NUM>, the UE initiates the TAU procedure by sending a TAU Request to the MME with a mapped EPS GUTI derived from the GUTI and its EPS security capabilities. The mapped EPS GUTI contains the information of the AMF that has the latest UE context in the wireless network.

The UE integrity protects the TAU Request message using the current NAS security context identified by the GUTI used to derive the mapped EPS GUTI. More precisely, the UE may compute the NAS MAC for the TAU request as it is done for a NAS message over a 3GPP access. The NAS Uplink COUNT for integrity protection of the TAU request may use the same value as the NAS Uplink COUNT. Consequently, this results in an increase of the stored NAS Uplink COUNT value in the NAS COUNT pair associated with the 3GPP access. The corresponding ngKSI value of the Security context is included in the eKSI parameter of the TAU Request message.

At step <NUM>, upon receipt of the TAU Request, the MME obtains the AMF address from the mapped EPS GUTI value. At step <NUM>, the MME forwards the complete TAU Request message including the eKSI, NAS-MAC and mapped EPS GUTI in the Context Request message.

At step <NUM>, the AMF may use the eKSI value field to identify the NAS security context and use it to verify the TAU Request message as if it was a NAS message received over 3GPP access. In an example, AMF may generate a mapped EPS security context associated with receiving a request for an intersystem change of a UE from a wireless system to an EPS. The mapped EPS security context includes security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and the network entity. The AMF may further determine an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context.

At step <NUM>, if the verification is successful, the AMF may derive a mapped EPS NAS security context. The AMF may set the EPS NAS algorithms to the ones indicated earlier to the UE in a NAS SMC. The AMF may include the mapped EPS NAS security context in the Context Response message it sends to the MME. The AMF may never transfer security parameters to an entity outside the wireless system.

At step <NUM>, the UE may derive a mapped EPS NAS security context. The UE may select the EPS algorithms using the ones received in an earlier NAS SMC from the AMF. The UE may immediately activate the mapped EPS security context and be ready to use it for the processing of the TAU Accept message in step <NUM>. For example, the UE may generate a mapped EPS security context associated with an intersystem change of the UE from a wireless system to an EPS. The mapped EPS security context comprises security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity. The UE may further determine an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context.

At step <NUM>, the MME compares the UE security algorithms to its configured list after it receives the Context Response message. If an algorithm change is required, the MME may select the NAS algorithm which has the highest priority from its configured list and is also present in the UE security capabilities and initiate an NAS SMC to the UE. Otherwise, steps <NUM>-<NUM> may be skipped. At steps <NUM> - <NUM>, the MME and the UE performs an NAS SMC to derive new NAS keys with the new algorithms. For example, at step <NUM>, the MME transmits a NAS SMC corresponding to the selected EPS algorithms. At step <NUM>, the UE may derive new a NAS key from the selected algorithm in the NAS SMC. At step <NUM>, the UE may transmit the NAS SMP after deriving the NAS key. At step <NUM>, the MME completes the procedure with a TAU Accept message. At step <NUM>, the UE transmits the TAU complete message to the MME.

<FIG> is a flowchart <NUM> of a method of wireless communication. The method may be performed by a UE (e.g., the UE <NUM>; the apparatus <NUM>/<NUM>'; the processing system <NUM>, which may include the memory <NUM> and which may be the entire UE <NUM> or a component of the UE <NUM>, such as the TX processor <NUM>, the RX processor <NUM>, and/or the controller/processor <NUM>).

At <NUM>, method <NUM> includes generating, by a user equipment (UE), a mapped Evolved Packet System (EPS) security context associated with an intersystem change of the UE from a wireless system to an EPS, wherein the mapped EPS security context comprises security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity. In an aspect, configuration component <NUM>, e.g., in conjunction with processor(s) <NUM>/<NUM>, memory(s) <NUM>/<NUM>, and generating component <NUM> may generate a mapped EPS security context associated with an intersystem change of the UE <NUM> from a wireless system to an EPS. The mapped EPS security context comprises security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE <NUM> and a network entity (e.g., MME <NUM>). As such, the UE <NUM> and/or the configuration component <NUM>, e.g., in conjunction with controller/processor <NUM>, which may include the memory <NUM>, processor(s) <NUM>, which may include the memory <NUM>, modem <NUM>, TX processor <NUM>, and transceiver <NUM> may define a means for generating, by a UE, a mapped EPS security context associated with an intersystem change of the UE from a wireless system to an EPS, wherein the mapped EPS security context comprises security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity.

At <NUM>, method <NUM> includes determining an uplink (UL) non-access stratum (NAS) COUNT value and a downlink (DL) NAS COUNT value for the mapped EPS security context. In an aspect, configuration component <NUM>, e.g., in conjunction with processor(s) <NUM>/<NUM>, memory(s) <NUM>/<NUM>, and determining component <NUM> may determine an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context. As such, the UE <NUM> and/or the configuration component <NUM>, e.g., in conjunction with controller/processor <NUM>, which may include the memory <NUM>, processor(s) <NUM>, which may include the memory <NUM>, modem <NUM>, TX processor <NUM>, and transceiver <NUM> may define a means for determining an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context.

At <NUM>, method <NUM> includes transmitting, by the UE, a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context. In an aspect, configuration component <NUM>, e.g., in conjunction with processor(s) <NUM>/<NUM>, memory(s) <NUM>/<NUM>, TX processor <NUM>, and transceiver <NUM> may transmit a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context. As such, the UE <NUM> and/or the configuration component <NUM>, e.g., in conjunction with controller/processor <NUM>, which may include the memory <NUM>, processor(s) <NUM>, which may include the memory <NUM>, modem <NUM>, TX processor <NUM>, and transceiver <NUM> may define a means for transmitting a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context.

In an example, determining the UL NAS COUNT value for the mapped EPS security context further comprises setting the UL NAS COUNT value to the UL NAS COUNT value of the security context. And, determining the DL NAS COUNT value for the mapped EPS security context further comprises setting the DL NAS COUNT value to the DL NAS COUNT value of the security context.

In another example, determining the UL NAS COUNT value for the mapped EPS security context further comprises resetting the UL NAS COUNT value to <NUM>. And, determining the DL NAS COUNT value for the mapped EPS security context further comprises resetting the DL NAS COUNT value to <NUM>. For example, method <NUM> may include incrementing the UL NAS COUNT value by <NUM> upon resetting the UL NAS COUNT value to <NUM>; and transmitting the NAS message to the network entity further comprises transmitting the NAS message to the network entity with the UL NAS COUNT value.

In an example, the intersystem change of the UE from the wireless system to the EPS corresponds to a handover procedure of the UE from the wireless system to the EPS. For example, method <NUM> may include the configuration component <NUM> receiving, at the UE <NUM>, a handover command in response to the handover procedure of the UE from the wireless system to the EPS, the handover command including the security parameters for generating the mapped EPS security context; and wherein generating the mapped EPS security context further comprises generating the mapped EPS security context based on the handover command. In an example, receiving the handover command further comprises receiving the handover command from an Access Mobility and Management Function (AMF).

In an example, the intersystem change of the UE from the wireless system to the EPS corresponds to an idle mode mobility of the UE from the wireless system to the EPS. For example, method <NUM> may include transmitting, by the UE, a Tracking Area Update (TAU) Request to the network entity, the TAU Request including the previous UL NAS COUNT value of the security context; and wherein generating the mapped EPS security context further comprises generating the mapped EPS security context subsequent to transmitting the TAU Request.

<FIG> is a flowchart <NUM> of a method of wireless communication. The method may be performed by a network entity (e.g., the AMF <NUM>; the apparatus <NUM>/<NUM>'; the processing system <NUM>, which may include the memory <NUM> and which may be the entire AMF <NUM> or a component of the AMF <NUM>, such as the TX processor <NUM>, the RX processor <NUM>, and/or the controller/processor <NUM>).

At <NUM>, method <NUM> includes generating, by network entity, a mapped Evolved Packet System (EPS) security context associated with receiving a request for an intersystem change of a user equipment (UE) from a wireless system to an EPS, wherein the mapped EPS security context includes security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and the network entity. In an aspect, configuration component <NUM>, e.g., in conjunction with processor(s) <NUM>/<NUM>, memory(s) <NUM>/<NUM>, and generating component <NUM> may generate a mapped EPS security context associated with receiving a request for an intersystem change of a UE <NUM> from a wireless system to an EPS. The mapped EPS security context includes security parameters created based on a <NUM> security context used for the wireless system, the security parameters enabling security-related communications between the UE <NUM> and the network entity (e.g., AMF <NUM>). As such, the network entity <NUM> and/or the configuration component <NUM>, e.g., in conjunction with controller/processor <NUM>, which may include the memory <NUM>, processor <NUM>, which may include the memory <NUM>, RX processor <NUM>, and transceiver <NUM> may define a means for generating, by network entity, a mapped EPS security context associated with receiving a request for an intersystem change of a UE from a wireless system to an EPS, wherein the mapped EPS security context includes security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and the network entity.

At <NUM>, method <NUM> includes determining an uplink (UL) non-access stratum (NAS) COUNT value and a downlink (DL) NAS COUNT value for the mapped EPS security context. In an aspect, configuration component <NUM>, e.g., in conjunction with processor(s) <NUM>/<NUM>, memory(s) <NUM>/<NUM>, and determining component <NUM> may determine an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context. As such, the network entity <NUM> and/or the configuration component <NUM>, e.g., in conjunction with controller/processor <NUM>, which may include the memory <NUM>, processor <NUM>, which may include the memory <NUM>, RX processor <NUM>, and transceiver <NUM> may define a means for determining an UL NAS COUNT value and a DL NAS COUNT value for the mapped EPS security context.

At <NUM>, method <NUM> includes transmitting, by the first network entity, the mapped EPS security context with the UL NAS COUNT value and the DL NAS COUNT value to the second network entity. In an aspect, configuration component <NUM>, e.g., in conjunction with processor(s) <NUM>/<NUM>, memory(s) <NUM>/<NUM>, Tx processor <NUM>, and transceiver <NUM> may transmit the mapped EPS security context with the UL NAS COUNT value and the DL NAS COUNT value to the second network entity. As such, the network entity <NUM> and/or the configuration component <NUM>, e.g., in conjunction with controller/processor <NUM>, which may include the memory <NUM>, processor <NUM>, which may include the memory <NUM>, RX processor <NUM>, and transceiver <NUM> may define a means for transmitting the mapped EPS security context with the UL NAS COUNT value and the DL NAS COUNT value to the second network entity.

In an example, determining the UL NAS COUNT value for the mapped EPS security context further comprises resetting the UL NAS COUNT value to <NUM>. And, determining the DL NAS COUNT value for the mapped EPS security context further comprises resetting the DL NAS COUNT value to <NUM>. The DL NAS COUNT is incremented by <NUM> similar to the UL NAS COUNT by the UE in <FIG>.

In an example, the intersystem change of the UE from the wireless system to the EPS corresponds to a handover procedure of the UE from the wireless system to the EPS. For example, method <NUM> may include receiving, at the first network entity, a handover required message in response to an initiation of the handover procedure of the UE from the wireless system to the EPS, the handover required message including one or more security capabilities of the UE; and wherein generating the mapped EPS security context further comprises generating the mapped EPS security context based on the handover required message.

In an example, the intersystem change of the UE from the wireless system to the EPS corresponds to an idle mode mobility of the UE from the wireless system to the EPS. For example, method <NUM> may include receiving, by the first network entity, a Tracking Area Update (TAU) Request forwarded from the second network entity, the TAU Request being transmitted by the UE and including the previous UL NAS COUNT value of the security context; and wherein generating the mapped EPS security context further comprises generating the mapped EPS security context based on receiving the TAU Request.

In an example, the first network entity corresponds to an Access and Mobility Management Function (AMF).

In an example, the second network entity corresponds to a Mobility Management Entity (MME).

<FIG> is a conceptual data flow diagram <NUM> illustrating the data flow between different means/components in an example apparatus <NUM>. The apparatus may be a UE <NUM> and/or network entity (e.g., AMF <NUM>). The apparatus includes a component <NUM> that receives signals to from remote device <NUM>. The apparatus includes a component <NUM> that generates a mapped EPS security context associated with an intersystem change of the UE from a wireless system (e.g., <NUM> system) to an EPS, e.g., as described in connection with blocks <NUM> and <NUM>. The apparatus includes a component <NUM> that determining an UL/DL NAS COUNT value for the mapped EPS security context, e.g., as described in connection with blocks <NUM> and <NUM>. The apparatus includes a component <NUM> that transmits the mapped EPS security context, e.g., as described in connection with blocks <NUM> and <NUM>.

<FIG> is a diagram <NUM> illustrating an example of a hardware implementation for an apparatus <NUM>' employing a processing system <NUM>. The processing system <NUM> may be implemented with a bus architecture, represented generally by the bus <NUM>. The bus <NUM> may include any number of interconnecting buses and bridges depending on the specific application of the processing system <NUM> and the overall design constraints. The bus <NUM> links together various circuits including one or more processors and/or hardware components, represented by the processor <NUM>, the components <NUM>, <NUM>, <NUM>, and the computer-readable medium / memory <NUM>. The bus <NUM> may also link various other circuits such as timing sources, peripherals, voltage regulators, and power management circuits, which are well known in the art, and therefore, will not be described any further.

The processing system <NUM> may be coupled to a transceiver <NUM>. The transceiver <NUM> is coupled to one or more antennas <NUM>. The transceiver <NUM> provides a means for communicating with various other apparatus over a transmission medium. The transceiver <NUM> receives a signal from the one or more antennas <NUM>, extracts information from the received signal, and provides the extracted information to the processing system <NUM>, specifically the reception component <NUM>. In addition, the transceiver <NUM> receives information from the processing system <NUM>, specifically the transmission component <NUM>, and based on the received information, generates a signal to be applied to the one or more antennas <NUM>. The processing system <NUM> includes a processor <NUM> coupled to a computer-readable medium / memory <NUM>. The processor <NUM> is responsible for general processing, including the execution of software stored on the computer-readable medium / memory <NUM>. The software, when executed by the processor <NUM>, causes the processing system <NUM> to perform the various functions described supra for any particular apparatus. The computer-readable medium / memory <NUM> may also be used for storing data that is manipulated by the processor <NUM> when executing software. The processing system <NUM> further includes at least one of the components <NUM>, <NUM>, <NUM>. The components may be software components running in the processor <NUM>, resident/stored in the computer readable medium / memory <NUM>, one or more hardware components coupled to the processor <NUM>, or some combination thereof. The processing system <NUM> may be a component of the base station <NUM> and may include the memory <NUM> and/or at least one of the TX processor <NUM>, the RX processor <NUM>, and the controller/processor <NUM>. Alternatively, the processing system <NUM> may be the entire base station (e.g., see <NUM> of <FIG>). The processing system <NUM> may be a component of the UE <NUM> and may include the memory <NUM> and/or at least one of the TX processor <NUM>, the RX processor <NUM>, and the controller/processor <NUM>. Alternatively, the processing system <NUM> may be the entire UE (e.g., see <NUM> of <FIG>).

In one configuration, the apparatus <NUM>/<NUM>' for wireless communication includes means for generating, by network entity, a mapped EPS security context in response to receiving a request for an intersystem change of a UE from a wireless system to an EPS, wherein the mapped EPS security context includes security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and the network entity; means for determining a DL NAS COUNT value for the mapped EPS security context, wherein the DL NAS COUNT value increments by <NUM> from a previous DL NAS COUNT value of the security context without reset; and means for transmitting, by the network entity, the mapped EPS security context with the DL NAS COUNT value to the UE subsequent to receiving the request for the intersystem change of the UE from the wireless system to the EPS.

In one configuration, the apparatus <NUM>/<NUM>' for wireless communication includes means for generating, by a UE, a mapped EPS security context in response to an intersystem change of the UE from a wireless system to an EPS, wherein the mapped EPS security context comprises security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity; means for determining an UL NAS COUNT value for the mapped EPS security context, wherein the UL NAS COUNT value increments by <NUM> from a previous UL NAS COUNT value of the security context without reset; and means for transmitting, by the UE, the mapped EPS security context with the UL NAS COUNT value to the network entity subsequent to the intersystem change of the UE from the wireless system to the EPS.

<FIG> is a conceptual data flow diagram <NUM> illustrating the data flow between different means/components in an example apparatus <NUM>. The apparatus may be a UE <NUM> and/or network entity (e.g., AMF <NUM>). The apparatus includes a component <NUM> that receives signals to from remote device <NUM>. The apparatus includes a component <NUM> that generates a mapped EPS security context associated with an intersystem change of the UE from a wireless system to an EPS, e.g., as described in connection with blocks <NUM> and <NUM>. The apparatus includes a component <NUM> that determining an UL/DL NAS COUNT value for the mapped EPS security context, e.g., as described in connection with blocks <NUM> and <NUM>. The apparatus includes a component <NUM> that transmits the mapped EPS security context, e.g., as described in connection with blocks <NUM> and <NUM>.

For example, in an aspect, the present disclosure includes a method, apparatus, and computer readable medium for wireless communications for configuring of a NAS COUNT value of a mapped EPS security context associated with an intersystem change of a UE from a wireless system to an EPS. The aspect may include generating, by a UE, a mapped EPS security context associated with an intersystem change of the UE from a wireless system to an EPS, wherein the mapped EPS security context comprises security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity; determining an UL NAS COUNT value for the mapped EPS security context; and transmitting, by the UE, a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context.

In another example, in an aspect, the present disclosure includes a method, apparatus, and computer readable medium for wireless communications for generating, by a first network entity, a mapped EPS security context associated with receiving a request for an intersystem change of a UE from a wireless system to an EPS, wherein the mapped EPS security context includes security parameters created based a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a second network entity; determining a DL NAS COUNT value for the mapped EPS security context; and transmitting, by the first network entity, the mapped EPS security context with the DL NAS COUNT value to the second network entity.

Claim 1:
A method (<NUM>) of wireless communication, comprising:
generating (<NUM>), by a user equipment, UE, a mapped Evolved Packet System, EPS, security context associated with an intersystem change of the UE from a wireless system to an EPS, wherein the mapped EPS security context comprises security parameters created based on a security context used for the wireless system, the security parameters enabling security-related communications between the UE and a network entity;
setting (<NUM>) an uplink, UL, non-access stratum, NAS, COUNT value for the mapped EPS security context to a UL NAS COUNT value of the security context;
setting (<NUM>) a downlink, DL, NAS COUNT value for the mapped EPS security context to a DL NAS COUNT value of the security context; and
transmitting (<NUM>), by the UE, a NAS message to the network entity, the NAS message including the UL NAS COUNT value of the mapped EPS security context.