Patent Description:
Some communication systems involve a base station (e.g. eNB or gNB) making UE-specific control channel transmissions (e.g. physical downlink control channel PDCCH transmission) for a plurality of UEs. A control channel transmission specific to a UE may, for example, indicate the allocation of data channel resources (e.g. physical downlink shared channel PDSCH and/or physical uplink shared channel PUSCH resources) to uplink and/or downlink transmissions for the UE. A control channel transmission specific to a UE incorporates an identifier for the UE. The UE searches control channel transmission resources for a control channel transmission incorporating the identifier for the UE.

<CIT> discloses a method of operating a BS includes generating an indicator indicating that the BS is capable of supporting a high-capacity radio network temporary identifier (HC-RNTI), wherein a size of the HC-RNTI is based on a configurable granularity; generating a system information block including the indicator and information indicating the size of the HC-RNTI; transmitting, to a UE, the system information block; and transmitting, to the UE, the HC-RNTI, wherein the HC-RNTI is allocated to the UE.

<CIT> discloses a method performed by a wireless device for determining an identity of the wireless device , MsgB RNTI, in a wireless communications network during a random access procedure. The wireless device transmits a random access preamble on a RACH at a random access occasion. It also transmits a message on a PUSCH that corresponds to the random access preamble. Further, the wireless device determines an MsgB RNTI as the sum of a first identity, RA-RNTI, and an offset that is an integer greater than <NUM>, wherein the RA-RNTI is based on a sum comprising terms corresponding to at least the index of a first OFDM symbol, the index of a frequency resource, and the index of a first time slot that identifies the time/frequency resources of the random access occasion.

<CIT> provides a method by a terminal in a wireless communication system. The method includes receiving, from a base station, a paging message for switching a mode of the terminal in a RRC inactive mode to an RRC idle mode, transmitting an RRC message to the base station based on reception of the paging message, receiving an RRC connection release message from the base station, and transitioning from the RRC inactive mode to the RRC idle mode based on the RRC connection release message.

"<NPL>) discuss reception of MsgB in <NUM>-step RACH, i.e. the issue related to RA-RNTI ambiguity within the MsgB reception window and how to distinguish msg2 and MsgB.

Further advantageous embodiments are defined in the dependent claims.

Apparatus comprising: means for duplicating base station computation of an identifier value for a user equipment; and means for searching for one or more control channel transmissions incorporating an identifier value matching the identifier value.

The means for duplicating base station computation of an identifier value for the user equipment may comprise means for computing an identifier value based on one or more input parameter values and one or more mathematical functions used at the base station to compute an identifier value for the user equipment.

Computation of an identifier value may be based at least partly on a value of a time-related parameter; and the computed identifier value may be effective for a time period related to the value of the time-related parameter.

The apparatus may further comprise: means for duplicating base station computation of a further identifier value; and means for, after expiry of the time period, searching for one or more control channel transmissions incorporating an identifier value matching the further identifier value.

The time-related parameter may be a system frame number.

Computation of an identifier value may be at least partly based on a security key value derived at least partly from a secret key shared between the base station and the user equipment.

Computation of an identifier value may be at least partly based on a start value included in a random access reply message.

The one or more control channel transmissions may indicate radio resources allocated to the user equipment for downlink and/or uplink transmissions.

Apparatus comprising: means for duplicating user equipment computation of an identifier value for the user equipment; and means for incorporating the identifier value into one or more control channel transmissions specific to the user equipment.

The means for duplicating user equipment computation of an identifier value for the user equipment may comprise means for computing an identifier value based on one or more input parameter values and one or more mathematical functions used at the user equipment to compute an identifier value for the user equipment.

The apparatus may comprise: means for sending to the user equipment a base value for computation of an identifier value; and means for, in response to thereafter determining that computation based on the base value generates an identifier value that clashes with one or more identifier values for one or more other user equipments sharing radio resources for control channel transmissions with the user equipment, sending a new base value to the user equipment.

Apparatus comprising: means for recovering a sequence of identifier values for a user equipment from a radio transmission; and means for searching for one or more control channel transmissions incorporating an identifier value matching one of the sequence of identifier values.

The sequence of identifier values for the user equipment may comprise at least a first identifier value effective for a first time period, and a second identifier value effective for a second time period after the first time period; and the apparatus may comprise: means for, during the first time period, searching for one or more control channel transmissions incorporating an identifier value matching the first identifier value, and, during the second time period, searching for one or more control channel transmissions incorporating an identifier value matching the second identifier value. Apparatus comprising: means for transmitting an indication of a sequence of identifier values for a user equipment; and means for incorporating one of the sequence of identifier values for the user equipment into one or more control channel transmissions specific to the user equipment.

The sequence of identifier values for the user equipment may comprise at least a first identifier value effective for a first time period, and a second identifier value effective for a second time period after the first time period; and the apparatus may comprise: means for, during the first time period, making one or more control channel transmissions incorporating the first identifier value, and, during the second time period, making one or more control channel transmissions incorporating the second identifier value.

In the above, many different aspects have been described. It should be appreciated that further aspects may be provided by the combination of any two or more of the aspects described above.

Various other aspects are also described in the following detailed description and in the attached claims.

Some example embodiments will now be described in further detail, by way of example only, with reference to the following examples and accompanying drawings, in which:.

In the following, different exemplifying embodiments will be described using, as an example of an access architecture to which the embodiments may be applied, a radio access architecture based on long term evolution advanced (LTE Advanced, LTE-A) or new radio (NR, <NUM>), without restricting the embodiments to such an architecture, however. The embodiments may also be applied to other kinds of communications networks having suitable means by adjusting parameters and procedures appropriately. Some examples of other options for suitable systems are the universal mobile telecommunications system (UMTS) radio access network (UTRAN), wireless local area network (WLAN or WiFi), worldwide interoperability for microwave access (WiMAX), Bluetooth®, personal communications services (PCS), ZigBee®, wideband code division multiple access (WCDMA), systems using ultra-wideband (UWB) technology, sensor networks, mobile ad-hoc networks (MANETs) and Internet Protocol multimedia subsystems (IMS) or any combination thereof.

For example, the radio access network may support sidelink communications described below in more detail.

<FIG> shows devices <NUM> and <NUM>. The devices <NUM> and <NUM> are configured to be in a wireless connection on one or more communication channels with a node <NUM>. The node <NUM> is further connected to a core network <NUM>. In one example, the node <NUM> may be an access node such as (e/g)NodeB serving devices in a cell. In one example, the node <NUM> may be a non-3GPP access node. The physical link from a device to a (e/g)NodeB is called uplink or reverse link and the physical link from the (e/g)NodeB to the device is called downlink or forward link. It should be appreciated that (e/g)NodeBs or their functionalities may be implemented by using any node, host, server or access point etc. entity suitable for such a usage.

A communications system typically comprises more than one (e/g)NodeB in which case the (e/g)NodeBs may also be configured to communicate with one another over links, wired or wireless, designed for the purpose. These links may be used for signalling purposes. The (e/g)NodeB is a computing device configured to control the radio resources of communication system it is coupled to. The NodeB may also be referred to as a base station, an access point or any other type of interfacing device including a relay station capable of operating in a wireless environment. The (e/g)NodeB includes or is coupled to transceivers. From the transceivers of the (e/g)NodeB, a connection is provided to an antenna unit that establishes bi-directional radio links to devices. The antenna unit may comprise a plurality of antennas or antenna elements. The (e/g)NodeB is further connected to the core network <NUM> (CN or next generation core NGC). Depending on the deployed technology, the (e/g)NodeB is connected to a serving and packet data network gateway (S-GW +P-GW) or user plane function (UPF), for routing and forwarding user data packets and for providing connectivity of devices to one or more external packet data networks, and to a mobile management entity (MME) or access mobility management function (AMF), for controlling access and mobility of the devices.

Exemplary embodiments of a device are a subscriber unit, a user device, a user equipment (UE), a user terminal, a terminal device, a mobile station, a mobile device, etc The device typically refers to a mobile or static device ( e.g. a portable or non-portable computing device) that includes wireless mobile communication devices operating with or without an universal subscriber identification module (USIM), including, but not limited to, the following types of devices: mobile phone, smartphone, personal digital assistant (PDA), handset, device using a wireless modem (alarm or measurement device, etc.), laptop and/or touch screen computer, tablet, game console, notebook, and multimedia device. It should be appreciated that a device may also be a nearly exclusive uplink only device, of which an example is a camera or video camera loading images or video clips to a network. A device may also be a device having capability to operate in Internet of Things (IoT) network which is a scenario in which objects are provided with the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction, e.g. to be used in smart power grids and connected vehicles. The device may also utilise cloud. In some applications, a device may comprise a user portable device with radio parts (such as a watch, earphones or eyeglasses) and the computation is carried out in the cloud.

The device illustrates one type of an apparatus to which resources on the air interface are allocated and assigned, and thus any feature described herein with a device may be implemented with a corresponding apparatus, such as a relay node. The device (or in some embodiments a layer <NUM> relay node) is configured to perform one or more of user equipment functionalities.

CPS may enable the implementation and exploitation of massive amounts of interconnected information and communications technology, ICT, devices (sensors, actuators, processors microcontrollers, etc.) embedded in physical objects at different locations.

<NUM> enables using multiple input - multiple output (MIMO) antennas, many more base stations or nodes than the LTE (a so-called small cell concept), including macro sites operating in co-operation with smaller stations and employing a variety of radio technologies depending on service needs, use cases and/or spectrum available. <NUM> mobile communications supports a wide range of use cases and related applications including video streaming, augmented reality, different ways of data sharing and various forms of machine type applications (such as (massive) machine-type communications (mMTC), including vehicular safety, different sensors and real-time control). <NUM> is expected to have multiple radio interfaces, e.g. below <NUM> or above <NUM>, cmWave and mmWave, and also being integrable with existing legacy radio access technologies, such as the LTE. Integration with the LTE may be implemented, at least in the early phase, as a system, where macro coverage is provided by the LTE and <NUM> radio interface access comes from small cells by aggregation to the LTE. In other words, <NUM> is planned to support both inter-RAT operability (such as LTE-<NUM>) and inter-RI operability (inter-radio interface operability, such as below <NUM> - cmWave, <NUM> or above <NUM> - cmWave and mmWave). One of the concepts considered to be used in <NUM> networks is network slicing in which multiple independent and dedicated virtual sub-networks (network instances) may be created within the same infrastructure to run services that have different requirements on latency, reliability, throughput and mobility.

The communication system is also able to communicate with other networks <NUM>, such as a public switched telephone network, or a VoIP network, or the Internet, or a private network, or utilize services provided by them.

The technology of Edge cloud may be brought into a radio access network (RAN) by utilizing network function virtualization (NFV) and software defined networking (SDN). Using the technology of edge cloud may mean access node operations to be carried out, at least partly, in a server, host or node operationally coupled to a remote radio head or base station comprising radio parts. Application of cloudRAN architecture enables RAN real time functions being carried out at or close to a remote antenna site (in a distributed unit, DU <NUM>) and non-real time functions being carried out in a centralized manner (in a centralized unit, CU <NUM>).

Possible use cases are providing service continuity for machine-to-machine (M2M) or Internet of Things (IoT) devices or for passengers on board of vehicles, Mobile Broadband, (MBB) or ensuring service availability for critical communications, and future railway/maritime/aeronautical communications. Each satellite in the mega-constellation may cover several satellite-enabled network entities that create on-ground cells. The on-ground cells may be created through an on-ground relay node or by a gNB located on-ground or in a satellite.

It is clear to a person skilled in the art that the depicted system is only an example of a part of a radio access system and in practice, the system may comprise a plurality of (e/g)NodeBs, the device may have an access to a plurality of radio cells and the system may comprise also other apparatuses, such as physical layer relay nodes or other network elements, etc. At least one of the (e/g)NodeBs or may be a Home(e/g)nodeB.

<FIG> illustrates an example of operations at a device implementing user equipment functionality, hereafter referred to as UE (such as e.g. UE <NUM> of <FIG>) and a device implementing base station functionality, hereafter referred to as BS (such as e.g. the e/gNB node <NUM> of <FIG>). UE <NUM> makes a random access preamble transmission (OPERATION <NUM> of <FIG>). The random access preamble transmission is successful, and BS <NUM> transmits a random access reply (RAR) message (OPERATION <NUM> of <FIG>). The RAR message includes a base identifier value (hereafter referred to as base C-RNTI (cell-radio network temporary identifier) value) for UE <NUM> to use as a start value to compute identifier values for the UE <NUM>. UE <NUM> recovers the base C-RNTI value from the RAR message (OPERATION <NUM> of <FIG>).

Later, both UE <NUM> and BS <NUM> separately perform the same pre-determined computation of an identifier value (hereafter referred to as dynamic C-RNTI or DC-RNTI value) for the UE <NUM>, using the base C-RNTI value as one input (OPERATIONS 206a and 206b of <FIG>). Duplicating BS computation of a DC-RNTI value for UE <NUM> at UE <NUM> uses the same one-way mathematical function(s) and inputs as the computation of a DC-RNTI value for UE <NUM> at BS <NUM>. In this example, the computation inputs also include; (i) a security key (here referred to as KRNTI) derived ultimately from a secret key pre-shared between UE <NUM> and a home subscriber server (HSS), which secret key is primarily used to authenticate the UE subscriber/user; and (ii) a time input related to the time at which both UE <NUM> and BS <NUM> are configured to compute the DC-RNTI value for UE <NUM>. In one example, this time input is the value, at the time of DC-RNTI computation, of the system frame number (SFN) (or alternatively the hyper frame number (HFN)) of the cell via which the UE <NUM> has the RRC connection.

In this example, KRNTI is derived from existing keys KeNB or KgNB, using the key derivation function (KDF) as mentioned in 3GPP TS <NUM>, Annex A, with a further input comprising a FC-value from the FC number space controlled by TS <NUM>, as mentioned at TS <NUM> A.

In this example, the DC-RNTI value is computed from the base C-RNTI value, the SFN/HFN and KRNTI using a one-way mathematical function, such as the ones specified in the Milenage and Tuak algorithm sets identified in TS35. <NUM> and TS35.

The SFN (used in this example as one of the inputs to compute the DC-RNTI value for UE <NUM>) is broadcast by the cell, and has a value shared by all UEs served by the cell. An incremented SFN value is broadcast every <NUM> (in the physical broadcast channel (PBCH) for the cell). The SFN is <NUM> bits in length, and may therefore have <NUM> different values. The SFN cycle (the time period over which the SFN value repeats) is <NUM>*<NUM>=<NUM> seconds.

In another example, a hyper frame number (HFN) of the kind implemented in LTE is used instead of SFN as an input for computation of the DC-RNTI value. The HFN value increments when the SFN value is equal to <NUM>. The HFN is also <NUM> bits in length. The HFN cycle (the time period over which the HFN value repeats) is <NUM>*<NUM>*<NUM>=<NUM> second (about <NUM> days).

In another example, the timing reference broadcast in <NUM> NR as part of the 9th System Information Block (SIB9) is used instead of SFN or HFN as one input for computation of the DC-RNTI value.

BS <NUM> incorporates the DC-RNTI value computed at BS <NUM> for UE <NUM> into one or more control downlink channel transmissions (e.g. PDCCH transmissions) specific to UE <NUM> (OPERATION <NUM> of <FIG>); and UE <NUM> searches a search space for control channel transmissions incorporating a DC-RNTI value matching the DC-RNTI value computed at UE <NUM> for UE <NUM> (OPERATION <NUM> of <FIG>). In this example, incorporating the computed DC-RNTI value into a control channel transmission involves using the computed DC-RNTI value to modify the CRC (cyclic redundancy check) attached to the PDCCH payload (DCI (downlink control information) through a scrambling operation; and UE <NUM> searches the search space for a PDCCH transmission that it can correctly decode using the DC-RNTI value computed at UE <NUM>.

The computed DC-RNTI value is thus used by UE <NUM> and BS <NUM> to distinguish control channel transmissions specific to the UE <NUM> from control channel transmissions specific to other UEs searching the same search space for DCI messages specific thereto. A control channel transmission (e.g. PDCCH transmission) incorporating the computed DC-RNTI value for UE <NUM> indicates data channel radio resources allocated to uplink transmissions by UE <NUM> and/or downlink transmissions specific to UE <NUM>.

UE <NUM> is representative of a plurality of UEs searching the same search space for PDCCH transmissions incorporating a DC-RNTI value matching a DC-RNTI value computed at the respective UE based on a respective base C-RNTI value and a respective security key (KRNTI).

According to one example whose representation is shown in <FIG>, BS <NUM> periodically computes a fresh DC-RNTI for UE <NUM>, and UE <NUM> duplicates the periodic computation of fresh DC-RNTI, again using the same one-way mathematical function and input parameters as BS <NUM>. UE <NUM> and BS <NUM> may compute a fresh DC-RNTI (using e.g. the current SFN value as one input) at predetermined times (e.g. at predetermined values of SFN). The period between successive computations of a DC-RNTI value may, for example, be in the range of <NUM> to hours or days. There may be a pre-configured default timing for the fresh computing of-RNTI values, which UE <NUM> adopts unless UE <NUM> has received an overriding individual configuration from BS <NUM>.

With reference to <FIG>, UE <NUM> regularly determines whether the current SFN value is one for which the UE <NUM> is configured to compute a new DC-RNTI value (OPERATION <NUM>). If the determination is negative, UE <NUM> continues to search the PDCCH search space for PDCCH transmissions incorporating a DC-RNTI value matching the existing DC-RNTI value (i.e. the DC-RNTI value most recently computed at UE <NUM>) (OPERATION <NUM>). On the other hand, if the determination is positive, UE <NUM> computes a new DC-RNTI value using the current SFN value as one input, and subsequently searches the PDCCH search space for PDCCH transmissions incorporating a DC-RNTI value matching the new DC-RNTI value computed at UE <NUM> (OPERATION <NUM> of <FIG>).

As mentioned above, one of the input parameters is the SFN value for the cell at the time of DC-RNTI computation, which is different to the SFN value used for the previous DC-RNTI computation and is also different to the SFN value that will be used for the subsequent DC-RNTI computation. In this way, control channel transmissions specific to UE <NUM> incorporate changing identifier values over time.

As mentioned above, UE <NUM> is representative of a plurality of UEs searching the same search space for control channel transmissions incorporating a DC-RNTI value matching the DC-RNTI value computed at UE <NUM> (based on the respective base C-RNTI value and respective security key value). According to this example embodiment, other UEs (or all UEs) of the plurality of UEs searching the same search space for PDCCH transmissions compute respective fresh DC-RNTI values at the same time. For example, the SFN/HFN values at which DC-RNTI computation is performed is the same for other UEs (e.g. all UEs searching the search space for control channel transmissions).

According to another example, BS <NUM> triggers the computation of a fresh DC-RNTI value. For example, the trigger may take the form of an encrypted RRC message.

<FIG> illustrates an example of operations at BS <NUM> aimed at avoiding DC-RNTI clashes between UEs searching the same search space for PDCCH transmissions. The operations are aimed at guaranteeing that the DC-RNTI value for UE <NUM> is unique to UE <NUM> at least among all UEs simultaneously searching the same search space for PDCCH transmissions.

BS <NUM> precomputes a sequence of DC-RNTI values for UE <NUM> based respectively on the predetermined SFN values at which UE <NUM> is configured to perform DC-RNTI computation (OPERATION <NUM> of <FIG>). The computation of each DC-RNTI value of the sequence is also based on the base C-RNTI value for UE <NUM> and the KRNTI value for UE <NUM>. The sequence of DC-RNTI values may comprise a predetermined number of DC-RNTI values (for a predetermined number of DC-RNTI computations for UE <NUM>) or DC-RNTI values for a predetermined period of time. BS <NUM> does the same pre-computation for all other UEs sharing the same PDCCH search space as UE <NUM>. BS <NUM> determines (OPERATION <NUM> of <FIG>) whether this pre-computation predicts one or more instances of DC-RNTI clashes with any other UE sharing the same PDCCH search space. If this pre-computation predicts no instances of any DC-RNTI clashes (i.e. predicts no instances of more than one UE computing the same DC-RNTI value for the same SFN value input), BS <NUM> takes no corrective action and uses the pre-computed DC-RNTI values for UE-specific PDCCH transmissions (OPERATION <NUM> of <FIG>). On the other hand, if the precomputation of a sequence of DC-RNTIs for UE <NUM> predicts one or more instances of a DC-RNTI clash with one or more other UEs, BS <NUM> precomputes a new sequence of DC-RNTI values for UE <NUM> based on a new base C-RNTI value (OPERATION <NUM> of <FIG>) and determines (OPERATION <NUM> of <FIG>) whether this pre-computation based on a new base C-RNTI value predicts one or more instances of DC-RNTI clashes with any other UE sharing the same PDCCH search space (OPERATION <NUM>). BS <NUM> repeats this pair of operations <NUM> and <NUM> until it finds a new base C-RNTI value for which the pre-computation does not predict any DC-RNTI clashes. BS <NUM> then directs UE <NUM> to use the new base C-RNTI value for the computation of DC-RNTIs (OPERATION <NUM> of <FIG>). The new base C-RNTI value for UE <NUM> can be sent to the UE <NUM> via radio resources indicated to UE <NUM> by a PDCCH transmission incorporating the currently valid DC-RNTI value for UE <NUM>.

Another example technique for avoiding DC-RNTI clashes is as follows. Instead of precomputing a future sequence of DC-RNTI values for UE <NUM> (and respective future sequences of DC-RNTI values for other UEs sharing the same PDCCH search space with UE <NUM>), BS <NUM> checks for DC-RNTI clashes each time DC-RNTI values are about to be recomputed at UEs including UE <NUM>. If the precomputation at BS <NUM> of the next round of DC-RNTIs for the UEs predicts a DC-RNTI clash for UE <NUM>, BS <NUM> tries one or more new base C-RNTI values for UE <NUM> until BS <NUM> finds a new base C-RNTI value for which pre-computation of DC-RNTI values predicts no DC-RNTI clashes; and BS <NUM> sends the new base C-RNTI value to UE <NUM>.

The implementation described so far has the advantage that no new information has to be passed between UE <NUM> and BS <NUM> for the generation of DC-RNTI values, except when an individual configuration for changing the DC-RNTI value is required, and/or unless a precomputation of DC-RNTI values at BS <NUM> predicts a DC-RNTI clash. The inputs for computing DC-RNTI values for UE are already available to UE <NUM>. The base C-RNTI value is the C-RNTI value already included in the RAR message; the security key KRNTI derived from a key already used at UE for other existing purposes at UE <NUM>; and SFN values are already broadcast by the cell.

According to one example variation, BS <NUM> sends all parameters for computing the DC-RNTIs to UE <NUM> in an encrypted RRC message, such as, for example, the RRC reconfiguration message sent by BS <NUM> following the RRC security command procedure. For example, computation at the UE <NUM> may be based on: a KRNTI value included in the encrypted RRC message; a starting value (instead of the C-RNTI value included in the RAR message); and the SFN value.

According to another example embodiment, UE <NUM> does not duplicate the BS computation of DC-RNTI values, but instead receives from BS <NUM> a sequence of DC-RNTI values to use over a period of time.

<FIG> and <FIG> show a representation of the operations at BS <NUM> and UE <NUM> according to this example embodiment. BS <NUM> sends to UE <NUM> a sequence of DC-RNTI values that do not clash with DC-RNTI values sent to other UEs sharing the same PDCCH search space. The sequence of DC-RNTI values for UE <NUM> may be sent to UE <NUM> in an encrypted RRC message via data channel resources (e.g. PDSCH resources) indicated by a PDCCH transmission incorporating the C-RNTI value included in the RAR message (OPERATION <NUM> of <FIG>). UE <NUM> recovers the sequence of DC-RNTI values from the encrypted RRC message (OPERATION <NUM> of <FIG>). In this example, the DC-RNTI values of the sequence of DC-RNTI values are valid for respective consecutive periods of time; and UE <NUM> and BS <NUM> selectively use the DC-RNTI values of the sequence of DC-RNTI values for the respective periods of time for which they are valid. As shown by operations <NUM>, <NUM> and <NUM> of <FIG>, BS <NUM> incorporates an nth DC-RNTI value into PDCCH transmissions specific to UE <NUM> for as long as the nth DC-RNTI value is valid, and then switches to incorporating the (n+<NUM>)th DC-RNTI value of the set of values into PDCCH transmissions specific to UE <NUM>; and so on. As shown by operations <NUM>, <NUM> and <NUM> of <FIG>: UE searches for PDCCH transmissions incorporating an nth DC-RNTI value for as long as the nth DC-RNTI value is valid, and then switches to searching for PDCCH transmissions incorporating the (n+<NUM>)th DC-RNTI value of the set of values; and so on.

For all techniques described above, either (i) the information necessary for duplicating base station computation of DC-RNTI at UE <NUM> or (ii) a set of DC-RNTI values for UE <NUM>, may be included in a RRC reconfiguration message sent to command or trigger a handover of UE <NUM> from a source cell to a target cell. <FIG> shows a representation of an example of a handover of UE <NUM> from a source cell to a target cell. UE <NUM> receives (OPERATION <NUM> of <FIG>) via the source cell a RRC reconfiguration message including either (i) all the information UE <NUM> needs to duplicate base station computation of DC-RNTI value(s) at UE <NUM> or (ii) a sequence of DC-RNTI values. UE <NUM> performs handover (OPERATION <NUM> of <FIG>) using a DC-RNTI value computed at UE <NUM> using the information included in the RRC reconfiguration message, or a first one of the provided sequence of DC-RNTI values included in the RRC reconfiguration message.

Sending such an encrypted RRC reconfiguration message also in the event of an intra-cell handover (for which the source cell and the target cell are the same and only the used channel is changed) provides an opportunity to securely re-set the computation of DC-RNTI at UE <NUM> or provide UE <NUM> with a new sequence of DC-RNTI values.

Also in the event of restoring a RRC connection via a serving cell (for example, in the event of Beam Failure Recovery), UE may use a DC-RNTI value computed at UE <NUM> (or one of a sequence of DC-RNTI values received previously in an encrypted message via the serving cell). For the example of computing a DC-RNTI value at UE <NUM>, the UE <NUM> reads the current SFN value from the master information block (MIB) broadcast by the serving cell.

The example embodiments described above can reduce the risk of a malicious third party being able to track the PDCCH transmissions specific to UE <NUM>, and thus can increase security against PDCCH-tracking based attacks, and against man-in-the-middle (MITM) attacks by fake base stations (FBSs).

For example, the example embodiments can reduce the effectiveness of attacks in which the attacker relies on being able to identify PDCCH transmissions related to a GUTI (Globally Unique Temporary Identifier) or SUCI (Subscription Concealed Identifier) included in a register request via data channel resources scheduled by a PDCCH transmission.

For example, the example embodiments can thus reduce the risk of a malicious third party (with the extra assistance of additional intelligence (like physical observation)) being able to identify the human subscriber using the UE that sent the register request including the GUTI or SUCI.

For example, the example embodiments can reduce the effectiveness of attacks involving a malicious attacker sending traffic (e.g. a series of silent short messages, or a series of messenger messages) to a public address of a human victim known by the attacker to have a UE served by a particular cell, and then exploiting the characteristics of the traffic resulting from the traffic originated by the malicious attacker (like number and length of messages, timing).

For example, the example embodiments can increase security in networks where the GUTI is not changed frequently, by increasing the difficulty of determining which PDCCH transmissions are related to a GUTI (i.e. specific to a UE having the GUTI).

For example, the example embodiments can reduce the effectiveness of malicious attacks involving the attacker finding (by monitoring both source and target cells for a handover of UE <NUM> (and having possibly also other intelligence)) the C-RNTI value used in a random access (RA) procedure for the UE.

For example, the example embodiments can increase security against IMP4GT (IMPersonation Attacks in <NUM> NeTworks) involving an attacker relying on being able to map PDCCH transmissions to a GUTI. IMP4GT is described in a paper entitled "<NPL>).

For example, the example embodiments can reduce the effectiveness of attacks involving exploitation of unencrypted MAC control elements sent to a certain UE.

<FIG> illustrates an example of an apparatus for implementing the operations of a device implementing UE or BS functionality. The apparatus may comprise at least one processor <NUM> coupled to one or more interfaces <NUM>. In the case of a device implementing UE functionality, the one or more interfaces may be e.g. to other equipment for which the UE functionality provides radio communications. In the case of a device implementing base station functionality, the one or more interfaces may be e.g. to other devices implementing other network functionality such as devices implementing UPF (User Plane Function) functionality in a <NUM> system. The at least one processor <NUM> is also coupled to a radio unit <NUM> including one or more antennas etc. for making and receiving radio transmissions. The at least one processor <NUM> may also be coupled to at least one memory <NUM>. The at least one processor <NUM> may be configured to execute an appropriate software code to perform the operations described above. The software code may be stored in the memory <NUM>.

<FIG> shows a schematic representation of non-volatile memory media 1100a (e.g. computer disc (CD) or digital versatile disc (DVD)) and 1100b (e.g. universal serial bus (USB) memory stick) storing instructions and/or parameters <NUM> which when executed by a processor allow the processor to perform one or more of the steps of the methods described previously.

It is to be noted that embodiments of the present invention may be implemented as circuitry, in software, hardware, application logic or a combination of software, hardware and application logic. In the context of this document, a "computer-readable medium" may be any media or means that can contain, store, communicate, propagate or transport the instructions for use by or in connection with an instruction execution system, apparatus, or device, such as the base stations or user equipment of the above-described embodiments.

Claim 1:
Apparatus comprising:
means for duplicating (206a) base station computation of an identifier value for a user equipment; and
means for searching (<NUM>) for one or more control channel transmissions incorporating an identifier value matching the identifier value,
wherein the means for duplicating base station computation of an identifier value for the user equipment comprises means for computing an identifier value based on the same one
or more input parameter values and one or more mathematical functions used at the base station to compute an identifier value for the user equipment,
wherein computation of an identifier value is at least partly based on a security key value derived at least partly from a secret key shared between the base station and the user equipment, and
wherein the means for searching for one or more control channel transmissions incorporating an identifier value matching the identifier value comprises means for searching for one or more control channel transmissions to be correctly decoded using the computed identifier value.