Provided is an authentication device capable of generating a master key suited to a UE in a 5GS. The authentication device (10) includes a communication unit (11) configured to, in registration processing of user equipment (UE), acquire UE key derivation function (KDF) capabilities indicating a pseudo random function supported by the UE, a selection unit (12) configured to select a pseudo random function used for generation of a master key related to the UE by use of the UE KDF capabilities, and a key generation unit (13) configured to generate a master key related to the UE by use of the selected pseudo random function.

Provided is an authentication device capable of generating a master key suited to a UE in a 5GS. The authentication device (10) includes a communication unit (11) configured to, in registration processing of user equipment (UE), acquire UE key derivation function (KDF) capabilities indicating a pseudo random function supported by the UE, a selection unit (12) configured to select a pseudo random function used for generation of a master key related to the UE by use of the UE KDF capabilities, and a key generation unit (13) configured to generate a master key related to the UE by use of the selected pseudo random function.

The present disclosure relates to systems and methods for cloud-based 5G security network architectures intelligent steering, workload isolation, identity, and secure edge steering. Specifically, various approaches are described to integrate cloud-based security services into Multiaccess Edge Compute servers (MECs). That is, existing cloud-based security services are in line between a UE and the Internet. The present disclosure includes integrating the cloud-based security services and associated cloud-based system within service provider's MECs. In this manner, a cloud-based security service can be integrated with a service provider's 5G network or a 5G network privately operated by the customer. For example, nodes in a cloud-based system can be collocated within a service provider's network, to provide security functions to 5G users or connected by peering from the cloud-based security service into the 5G service provider's regional communications centers.

The present disclosure relates to systems and methods for cloud-based 5G security network architectures intelligent steering, workload isolation, identity, and secure edge steering. Specifically, various approaches are described to integrate cloud-based security services into Multiaccess Edge Compute servers (MECs). That is, existing cloud-based security services are in line between a UE and the Internet. The present disclosure includes integrating the cloud-based security services and associated cloud-based system within service provider's MECs. In this manner, a cloud-based security service can be integrated with a service provider's 5G network or a 5G network privately operated by the customer. For example, nodes in a cloud-based system can be collocated within a service provider's network, to provide security functions to 5G users or connected by peering from the cloud-based security service into the 5G service provider's regional communications centers.

Certain aspects of the present disclosure provide techniques for managing security keys for enciphering and deciphering packets transmitted in a wireless communications system. According to certain aspects, a method of wireless communication by a user equipment (UE) is provided. The method generally includes obtaining an indication of a key area identifier (ID) of a first cell node, wherein the key area ID identifies a set of cell nodes that are associated with a network node that uses a first key for enciphering or deciphering messages and communicating a first set of messages with the first cell node using the first key for enciphering or deciphering the first set of messages.

Certain aspects of the present disclosure provide techniques for managing security keys for enciphering and deciphering packets transmitted in a wireless communications system. According to certain aspects, a method of wireless communication by a user equipment (UE) is provided. The method generally includes obtaining an indication of a key area identifier (ID) of a first cell node, wherein the key area ID identifies a set of cell nodes that are associated with a network node that uses a first key for enciphering or deciphering messages and communicating a first set of messages with the first cell node using the first key for enciphering or deciphering the first set of messages.

A secured communication method for a V2X communication device is disclosed. The secured communication method for a V2X communication device comprises the steps of; receiving at least one message on the basis of V2X communication; extracting adaptive certificate pre-distribution (ACPD) target information when the at least one message includes the ACPD target information; pre-authenticating at least one short-term certificate acquired from the ACPD target information; collecting at least one pre-authenticated short-term certificate to be broadcasted at a specific predicted time at a specific predicted location; and broadcasting an ACPD group (ACPDG) message including the collected at least one pre-authenticated short-term certificate at the specific predicted location at the specific predicted time.

A secured communication method for a V2X communication device is disclosed. The secured communication method for a V2X communication device comprises the steps of; receiving at least one message on the basis of V2X communication; extracting adaptive certificate pre-distribution (ACPD) target information when the at least one message includes the ACPD target information; pre-authenticating at least one short-term certificate acquired from the ACPD target information; collecting at least one pre-authenticated short-term certificate to be broadcasted at a specific predicted time at a specific predicted location; and broadcasting an ACPD group (ACPDG) message including the collected at least one pre-authenticated short-term certificate at the specific predicted location at the specific predicted time.

Disclosed are various embodiments for performing authenticated actions when Internet connectivity is not available. An application executed in a first computing device determines that an authenticated action is requested to be performed. The application determines that Internet connectivity is unavailable to the first computing device. The application initiates the authenticated action using a communication channel that connects the first computing device to a second computing device. The Internet is inaccessible through the communication channel.

Disclosed are various embodiments for performing authenticated actions when Internet connectivity is not available. An application executed in a first computing device determines that an authenticated action is requested to be performed. The application determines that Internet connectivity is unavailable to the first computing device. The application initiates the authenticated action using a communication channel that connects the first computing device to a second computing device. The Internet is inaccessible through the communication channel.