Section: 6.9.2.1.1 Access stratum
Content: The general principle of key handling for KNG-RAN*/NH at handovers is depicted in Figure 6.9.2.1.1-1. Figure 6.9.2.1.1-1: Model for the handover key chaining The following is an outline of the key handling model to clarify the intended structure of the key derivations. The detailed specification is provided in sub-clauses 6.9.2.2 and 6.9.2.3. Whenever an initial AS security context needs to be established between UE and gNB/ng-eNB, AMF and the UE shall derive a KgNB and a Next Hop parameter (NH). The KgNB and the NH are derived from the KAMF. A NH Chaining Counter (NCC) is associated with each KgNB and NH parameter. Every KgNB is associated with the NCC corresponding to the NH value from which it was derived. At initial setup, the KgNB is derived directly from KAMF, and is then considered to be associated with a virtual NH parameter with NCC value equal to zero. At initial setup, the derived NH value is associated with the NCC value one. NOTE 1: At the UE, the NH derivation associated with NCC=1 could be delayed until the first handover performing vertical key derivation. NOTE 1a: In N2 handover, when the KgNB is updated either due to KAMF change or synchronising the AS security context with the NAS security context, the KgNB is derived as specified in clauses 6.9.2.3.3 and 6.9.2.3.4 of the present document. In inter-RAT handover, the KgNB is derived as specified in clause 8.4 of the present document. In UE context modification, the KgNB is derived as specified in clause 6.9.2.2. Whether the AMF sends the KgNB key or the {NH, NCC} pair to the serving gNB/ng-eNB is described in detail in sub-clauses 6.9.2.2 and 6.9.2.3. The AMF shall not send the NH value to gNB/ng-eNB at the initial connection setup. The gNB/ng-eNB shall initialize the NCC value to zero after receiving NGAP Initial Context Setup Request message. NOTE 2: Since the AMF does not send the NH value to gNB/ng-eNB at the initial connection setup, the NH value associated with the NCC value one cannot be used in the next Xn handover or the next intra-gNB/intra-ng-eNB-CU handover, for the next Xn handover or the next intra-gNB-CU/intra-ng-eNB handover the horizontal key derivation (see Figure 6.9.2.1.1-1) will apply. NOTE 3: One of the rules specified for the AMF in sub-clause 6.9.2.3.3 of the present document states that the AMF always computes a fresh {NH, NCC} pair that is given to the target gNB/ng-eNB. An implication of this is that the first {NH, NCC} pair will never be used to derive a KgNB. It only serves as an initial value for the NH chain. The UE and the gNB/ng-eNB use the KgNB to secure the communication between each other. On handovers and at transitions from RRC_INACTIVE to RRC_CONNECTED states (defined in clause 6.8.2.1), the basis for the KgNB that will be used between the UE and the target gNB/ng-eNB, called KNG-RAN*, is derived from either the currently active KgNB or from the NH parameter. If KNG-RAN* is derived from the currently active KgNB this is referred to as a horizontal key derivation (see Figure 6.9.2.1.1-1) and if the KNG-RAN* is derived from the NH parameter the derivation is referred to as a vertical key derivation (see Figure 6.9.2.1.1-1). As NH parameters are only computable by the UE and the AMF, it is arranged so that NH parameters are provided to gNB/ng-eNBs from the AMF in such a way that forward security can be achieved. On handovers with vertical key derivation the NH is further bound to the target PCI and its frequency ARFCN-DL before it is taken into use as the KgNB in the target gNB/ng-eNB. On handovers with horizontal key derivation the currently active KgNB is further bound to the target PCI and its frequency ARFCN-DL before it is taken into use as the KgNB in the target gNB/ng-eNB.