WO2018031345A1 - Initiation of radio resource control (rrc) connection reestablishment using security tokens - Google Patents

Abstract

Described is an apparatus of a User Equipment (UE) operable to communicate with a first Evolved Node B (eNB) and a second eNB on a wireless network. The apparatus may comprise a first circuitry, and a second circuitry. The first circuitry may be operable to generate a security token. The second circuitry may be operable to generate a Radio Resource Control (RRC) message for transmission to the first eNB, in response to the UE detecting a Radio Link Failure (RLF) in communication with the second eNB, the RRC message comprising the security token.

Description

INITIATION OF RADIO RESOURCE CONTROL (RRC) CONNECTION REESTABLISHMENT USING SECURITY TOKENS

CLAIM OF PRIORITY

[0001] The present application claims priority under 35 U.S.C. § 119(e) to United

States Provisional Patent Application Serial Number 62/374,195, filed August 12, 2016 and entitled "INITIATION OF RRC CONNECTION REESTABLISHMENT FOR UE USING CIOT EPS CP OPTIMIZATIONS," which is herein incorporated by reference in its entirety.

BACKGROUND

[0002] A variety of wireless cellular communication systems have been implemented, including a 3rd Generation Partnership Project (3 GPP) Universal Mobile

Telecommunications System, a 3GPP Long-Term Evolution (LTE) system, and a 3GPP LTE- Advanced (LTE-A) system. Next-generation wireless cellular communication systems based upon LTE and LTE-A systems are being developed, such as a fifth generation (5G) wireless system / 5G mobile networks system. Next-generation wireless cellular communication systems may provide support for higher bandwidths in part by supporting higher carrier frequencies, such as centimeter- wave and millimeter-wave frequencies.

[0003] Recently, a Narrow-Band Internet-of-Things (NB-IoT) design was introduced.

The 3 GPP LTE NB-IoT specifications define a Radio Access Technology (RAT) for a cellular Internet-of-Things (CIoT), e.g., based on a non-backward-compatible variant of the evolved Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access (E-UTRA) standard. In some examples, it may be useful to provide seamless coverage for NB-IoTs that may move from a coverage area of an Evolved Node B (eNB) to a coverage area of another eNB.

BRIEF DESCRIPTION OF THE DRAWINGS

[0004] The embodiments of the disclosure will be understood more fully from the detailed description given below and from the accompanying drawings of various embodiments of the disclosure. However, while the drawings are to aid in explanation and understanding, they are only an aid, and should not be taken to limit the disclosure to the specific embodiments depicted therein.

l [0005] Fig. 1 illustrates a communication system where a UE moves from a coverage area of a source eNB to a coverage area of a target eNB, and where the UE is authenticated at the target eNB using a security token, according to some embodiments.

[0006] Figs. 2A-2B illustrate an RRC connection Re-establishment Procedure, implemented using a security token, between the UE and the target eNB of Fig. 1, where the UE generates the security token, according to some embodiments.

[0007] Figs. 3A-3B illustrate an RRC connection Re-establishment Procedure, implemented using a security token, between the UE and the target eNB of Fig. 1, where the UE receives the security token from a Mobility Management Entity (MME) over Non-Access Stratum (NAS) Protocol Data Units (PDUs), according to some embodiments.

[0008] Figs. 4A-4B illustrate an RRC connection Re-establishment Procedure, implemented using a security token, between the UE and the target eNB of Fig. 1, where the security token is generated by an MME, and the security token is provided by a source eNB to the UE AS layer without activating AS security, according to some embodiments.

[0009] Fig. 5 illustrates an eNB and a UE, according to some embodiments.

[0010] Fig. 6 illustrates hardware processing circuitries for an eNB for authenticating a UE using security token, according to some embodiments.

[0011] Fig. 7 illustrates hardware processing circuitries for a UE for transmitting a security token to an eNB for authentication of the UE, according to some embodiments.

[0012] Fig. 8 illustrates a method for an eNB to authenticate a UE based on a security token, according to some embodiments.

[0013] Fig. 9 illustrates a method for an eNB to receive an indication as to whether a

UE supports Control Plane (CP) Cellular Internet-of-Things (CIoT) Evolved Packet System

(EPS) Optimization (CP CIoT EPS Optimization), according to some embodiments.

[0014] Fig. 10 illustrates a method for a UE for generating a security token for authenticating the UE with a target eNB, according to some embodiments.

[0015] Fig. 11 illustrates a method for a UE to receive, from an eNB, an indication indicating that the eNB supports RRC Connection Reestablishment procedure for UEs supporting CP CIoT EPS Optimization, according to some embodiments.

[0016] Fig. 12 illustrates an architecture of a system of a network, according to some embodiments.

[0017] Fig. 13 illustrates example components of a device, according to some embodiments. [0018] Fig. 14 illustrates example interfaces of baseband circuitry, according to some embodiments.

DETAILED DESCRIPTION

[0019] The 3GPP introduced the NB-IoT design into Release 13 specifications of the

LTE wireless mobile communications standard. The 3GPP LTE NB-IoT specifications define a RAT for CIoTs, based on a non-backward-compatible variant of the UMTS E-UTRA standard, which, for example, are specifically tailored towards improved indoor coverage, support for a massive number of low throughput devices, low delay sensitivity, ultra-low device complexity and cost, low device power consumption, optimized network architecture, etc.

[0020] In an example, the NB-IoT system may be designed to support low complexity devices that support 180 kHz bandwidth (e.g., support only 180 kHz bandwidth) for both Downlink (DL) and Uplink (UL). In an example, NB-IoT system may operate in three different modes of operation - stand-alone deployment, NB-IoT deployment in the guard band of an LTE carrier, and NB-IoT deployment in the in-band. A NB-IoT carrier may generally comprise one legacy LTE Physical Resource Block (PRB) for in-band mode and an equivalent in stand-alone/guard-band mode, e.g., corresponding to a system bandwidth of 180kHz.

[0021] In an example, there may be at least two solutions for minimizing the signaling in the Radio Access Network (RAN) and the Core Network (CN) for the NB-IOT systems. A first example solution may be referred to as the CIoT Control Plane (CP) Optimization, and as a CP-CIoT- evolved packet system (EPS)-Optimization (CP-CIoT-EPS- Optimization) solution, or simply as a CP solution. A second example solution may be referred to as CIoT User Plane (UP) Optimization, and may also be referred to as a UP solution.

[0022] In an example, for the CP solution, no Data Radio Bearer (DRB) may be established for user data transmission and/or reception. The user data may be communicated over the control plane signaling, e.g., as part of Non-Access Stratum (NAS) data. On the other hand, in an example, for the UP solution, DRB may be established for user data transmission. In an example, upon a User Equipment (UE) going into an idle mode, instead of the eNB releasing the UE Access Spectrum (AS) context, the UE AS context may be kept in a suspended state, e.g., so that when user data is again available, the UE may come out from suspended state from the perspective of the eNB (e.g., thereby avoiding exchange of signaling to setup UE AS context and the AS security).

[0023] In NB-IoT specification (e.g., as specified in one or more versions of Release

13, or any subsequent releases associated with the NB-IOT specification), no Radio Resource Control (RRC) Connected mode mobility may be supported. For example, when the UE moves out of the existing eNB coverage area, a radio link failure (RLF) may occur.

[0024] In an example, the UP solution may generally handle a RLF in the following manner. In response to a RLF, the UE may perform RRC Connection Re-establishment procedure, which may involve performing cell selection. Once a suitable cell is found, the UE may initiate a RRC Connection Re-establishment Request. If the UE was in a coverage area of a source eNB and a suitable cell is found in the coverage area of a target eNB (e.g., that is different from the source eNB), the RRC Connection Re-establishment may be rejected. For example, the target eNB may reject the RRC Connection Re-establishment request, as the target eNB may not know the UE. The UE may then inform its NAS layer with Release cause "RRC Connection Failure," and the NAS layer may perform NAS recovery (e.g., which may trigger Tracking Area Update (TAU)).

[0025] In an example, the CP solution may generally handle an RLF in the following manner. In response to an RLF, the UE may enter an idle mode, e.g., via releasing the RRC Connection. The UE may inform its NAS layer an RRC Connection failure. As part of entering the idle mode, the UE may perform cell selection to find a suitable cell. The NAS layer may then decide whether to perform a NAS recovery (e.g., which may trigger TA update), e.g., based on whether there is available UL transmission.

[0026] In an example, invoking NAS recovery may involve extra signaling overhead, and thus, may consume unnecessary UE power. In the existing UP solution, if RLF occurs and the RRC Connection Re-establishment fails, the extra signaling incurred is during the RRC Connection establishment and NAS recovery signaling (e.g., extra signaling associated with TAU). In the existing CP solution, if RLF occurs, the extra signaling may be incurred during the NAS recovery signaling (e.g., extra signaling associated with TAU).

[0027] In some embodiments, in order to avoid NAS recovery and consume unnecessary UE power, it may be useful to ensure that the RRC Connection Re-establishment is successfully executed in the case of UP solution, and for RRC Connection Re- establishment to be used for RLF in the case of the CP solution.

[0028] In an example, RRC Connection Re-establishment procedure may not be initiated in the existing CP solution, e.g., as the AS security has not been activated and the Media Access Control (MAC-I) to authenticate the UE cannot be generated by the UE AS. For example, in legacy LTE, the security context may be provided to the eNB at the Initial Context Setup. For CP solution, this may not be provided, e.g., as no DRB is established in the CP solution.

[0029] In some embodiments, to allow the UE to use the RRC Connection Re- establishment for RLF due to Connected mode mobility for CP solution, it may be useful to provide some form of UE authentication (e.g., some form of MAC-I). The target eNB may authenticate the UE based on such authentication. Thus, various embodiments of this disclosure discuss methods to ensure that RRC Connection Re-establishment for CP solution can be initiated in the target eNB using some form of UE authentication. In some embodiments, the RRC Connection Re-establishment may be initiated without AS security activated. This, for example, may avoid the UE from performing NAS recovery, and thus, avoid higher signaling overhead (e.g., signaling overhead associated with RRC Connection establishment, TAU, etc.), thereby avoiding consumption of unnecessary UE power.

[0030] In the following description, numerous details are discussed to provide a more thorough explanation of embodiments of the present disclosure. It will be apparent to one skilled in the art, however, that embodiments of the present disclosure may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring embodiments of the present disclosure.

[0031] Note that in the corresponding drawings of the embodiments, signals are represented with lines. Some lines may be thicker, to indicate a greater number of constituent signal paths, and/or have arrows at one or more ends, to indicate a direction of information flow. Such indications are not intended to be limiting. Rather, the lines are used in connection with one or more exemplary embodiments to facilitate easier understanding of a circuit or a logical unit. Any represented signal, as dictated by design needs or preferences, may actually comprise one or more signals that may travel in either direction and may be implemented with any suitable type of signal scheme.

[0032] Throughout the specification, and in the claims, the term "connected" means a direct electrical, mechanical, or magnetic connection between the things that are connected, without any intermediary devices. The term "coupled" means either a direct electrical, mechanical, or magnetic connection between the things that are connected or an indirect connection through one or more passive or active intermediary devices. The term "circuit" or "module" may refer to one or more passive and/or active components that are arranged to cooperate with one another to provide a desired function. The term "signal" may refer to at least one current signal, voltage signal, magnetic signal, or data/clock signal. The meaning of "a," "an," and "the" include plural references. The meaning of "in" includes "in" and "on."

[0033] The terms "substantially," "close," "approximately," "near," and "about" generally refer to being within +/- 10% of a target value. Unless otherwise specified the use of the ordinal adjectives "first," "second," and "third," etc., to describe a common object, merely indicate that different instances of like objects are being referred to, and are not intended to imply that the objects so described must be in a given sequence, either temporally, spatially, in ranking, or in any other manner.

[0034] It is to be understood that the terms so used are interchangeable under appropriate circumstances such that the embodiments of the invention described herein are, for example, capable of operation in other orientations than those illustrated or otherwise described herein.

[0035] The terms "left," "right," "front," "back," "top," "bottom," "over," "under," and the like in the description and in the claims, if any, are used for descriptive purposes and not necessarily for describing permanent relative positions.

[0036] For the purposes of the present disclosure, the phrases "A and/or B" and "A or

B" mean (A), (B), or (A and B). For the purposes of the present disclosure, the phrase "A, B, and/or C" means (A), (B), (C), (A and B), (A and C), (B and C), or (A, B and C).

[0037] In addition, the various elements of combinatorial logic and sequential logic discussed in the present disclosure may pertain both to physical structures (such as AND gates, OR gates, or XOR gates), or to synthesized or otherwise optimized collections of devices implementing the logical structures that are Boolean equivalents of the logic under discussion.

[0038] In addition, for purposes of the present disclosure, the term "eNB" may refer to a legacy eNB, a next-generation or NR gNB, a 5G eNB, an Access Point (AP), a Base Station or an eNB communicating on the unlicensed spectrum, and/or another base station for a wireless communication system. For purposes of the present disclosure, the term "UE" may refer to a legacy UE, a next-generation or NR UE, a 5G UE, an STA, and/or another mobile equipment for a wireless communication system.

[0039] Various embodiments of eNBs and/or UEs discussed below may process one or more transmissions of various types. Some processing of a transmission may comprise receiving, conducting, and/or otherwise handling a transmission that has been received. In some embodiments, an eNB or UE processing a transmission may determine or recognize the transmission's type and/or a condition associated with the transmission. For some embodiments, an eNB or UE processing a transmission may act in accordance with the transmission's type, and/or may act conditionally based upon the transmission's type. An eNB or UE processing a transmission may also recognize one or more values or fields of data carried by the transmission. Processing a transmission may comprise moving the

transmission through one or more layers of a protocol stack (which may be implemented in, e.g., hardware and/or software-configured elements), such as by moving a transmission that has been received by an eNB or a UE through one or more layers of a protocol stack.

[0040] Various embodiments of eNBs and/or UEs discussed below may also generate one or more transmissions of various types. Some generating of a transmission may comprise receiving, conducting, and/or otherwise handling a transmission that is to be transmitted. In some embodiments, an eNB or UE generating a transmission may establish the transmission's type and/or a condition associated with the transmission. For some embodiments, an eNB or UE generating a transmission may act in accordance with the transmission's type, and/or may act conditionally based upon the transmission's type. An eNB or UE generating a transmission may also determine one or more values or fields of data carried by the transmission. Generating a transmission may comprise moving the transmission through one or more layers of a protocol stack (which may be implemented in, e.g., hardware and/or software-configured elements), such as by moving a transmission to be sent by an eNB or a UE through one or more layers of a protocol stack.

[0041] Fig. 1 illustrates a communication system 100 where a UE 104 moves from a coverage area of a source eNB 102a to a coverage area of a target eNB 102b, and where the UE 104 is authenticated at the target eNB 102b using a security token, according to some embodiments. In some embodiments, the UE 104 may be an IoT. In some embodiments, the UE 104 may be configured as a NB-IoT, a CIoT, and/or the like.

[0042] The eNBs 102a and 102b may be respectively referred to herein as a source eNB and a target eNB, e.g., from the perspective of an example movement of the UE 104. Of course, the eNB 102a may act as a target eNB in some other examples, and similarly, the eNB 102b may act as a source eNB in yet some other examples.

[0043] In an example, the source eNB 102a and the target eNB 102b have coverage areas 106a and 106b, respectively. The UE 104 may move from the coverage area 106a to the coverage area 106b. Various embodiments of this disclosure discuss authentication processes of the UE 104 to the target eNB 102b. [0044] As previously discussed herein, the RRC Connection Re-establishment procedure may be used for the CP solution. In some embodiments, it may be useful for the target eNB 102b to know whether the UE 104 is re-establishing as CP solution or UP solution (e.g. the generation of the short MAC -I for the UP solution may be different from the CP solution). That is, once the UE 104 moves to the coverage area 106b of the target eNB 102b and is to engage in the RRC Connection Re-establishment procedure with the target eNB 102b, the target eNB 102b may receive information on whether the UE 104 is re-establishing as CP solution or UP solution.

[0045] In some embodiments, knowing whether the UE 104 employs the UP solution or the CP solution may enable the target eNB 102b to do the right network node selection. In some embodiments, there may be two example approaches (referred to herein as a first example approach and a second example approach), using which the target eNB 102b may be made aware as to whether the UE 104 is re-establishing as CP solution or UP solution.

[0046] In some embodiments, the first example approach may involve the UE 104 signaling the target eNB 102b as to whether the UE 104 is re-establishing as a CP solution or a UP solution. In some embodiments, such UE signaling in the first example approach may be via MAC signaling, RRC signaling (e.g., via RRC Connection Re-establishment Request at block 234 of Fig. IB, discussed herein later), and/or the like.

[0047] In some embodiments, the second example approach may involve the source eNB 102a indicating the target eNB 102b as to whether the UE 104 is re-establishing as the CP solution or the UP solution. In some embodiments, the source eNB 102a may provide such indication to the target eNB 102b when providing the AS context of the UE 104 (e.g., at one of blocks 242, 343, or 442 of Figs. 2B, 3B or 4B, respectively, discussed herein later).

[0048] Referring again to the above discussed first approach, in some embodiments, there may be two possible options under the first approach. For example, in a first option, no indication may be provided from the UE 104 to the target eNB 102b, which may indicate one of the CP or UP solution being used by the UE 104. A second option may involve the UE 104 providing specific indication of whether the UE 104 is re-establishing as CP solution or UP solution. The first option (e.g., the UE 104 not providing any indication to the eNB 102b) may indicate that the UE 104 is a legacy UE and/or that the UE employs the UP solution. The second option may indicate that the UE 104 employs the CP solution.

[0049] In some embodiments, the second option of the first approach (e.g., the UE

104 signaling the target eNB 104 that the UE 104 employs the CP solution) may involve UE signaling that may be defined as part of Random Access Channel (RACH) (e.g., RACH message 1), RRC Connection Re-establishment Request (e.g., message 3), or RRC

Connection Re-establishment Complete (e.g., message 5), MAC CE signaling, MAC signaling (e.g. MAC control element in Message 3), LI signaling (e.g., Message 1 preamble transmission), and/or the like. For example, via a RRC Connection Re-establishment Request at 234, 334, or 434 of Figs. 2B, 3B, or 4B (discussed herein later), the UE 104 may signal the target eNB 104 that the UE 104 employs the CP solution. In some embodiments, this new indication may use a mechanism, which may be at least in part similar to the mechanism defined for a UE to indicate its support or usage while establishing a new connection via, for example, CP-CIoT- evolved packet system (EPS)-Optimization (CP- CIoT-EPS-Optimization), or via the RACH configuration. In some embodiments, if any of these indications are defined, the indication may also work in conjunction with any of the alternatives described below.

[0050] For example, in order to avoid unnecessary RRC signaling to the target eNB

102b that does not support such re-establishment, it may be desirable also to provide an indication in the RRC broadcast signaling (e.g. via System information block 2 or SIB2). Thus, put differently, the target eNB 102b may provide, via broadcast signaling (e.g., via SIB 2) whether the target eNB 102 supports RRC Connection Re-establishment request using security tokens (e.g., as discussed herein later). If the target eNB 102b supports such re- establishment (e.g., as indicated by the target eNB 102b via broadcast signaling), the UE 104 may then initiate the RRC Connection Re-establishment request with the target eNB 102b (e.g., at 234, 334, or 434 of Figs. 2B, 3B, or 4B). On the other hand, if the target eNB 102b does not support such re-establishment, then the UE 104 may assume that the RRC

Connection Re-establishment is rejected, and may perform NAS recovery (e.g., NAS recovery specified in 3GPP Release 13 NB-IoT).

[0051] Referring again to the above discussed second example approach (e.g., the source eNB 102a indicating the target eNB 102b as to whether the UE 104 is re-establishing as CP solution or UP solution), in some embodiments, the source eNB 102a may provide the target eNB 102b such indication via, for example, existing or new X2 Application Protocol (X2AP) message. Such X2AP message may be transmitted from the source eNB 102a to the target eNB 102b during the UE AS context fetch, or while retrieving the UE AS info (e.g., during blocks 242, 343, or 442 of Figs. 2B, 3B, or 4B). In some embodiments, the indication may be implicit or explicit. For example, for implicit indication, e.g., the source eNB 102a may provide the target eNB 102b with a security token (e.g., rather than an eNB key KeNB), as discussed in further details herein (e.g., discussed with respect to Figs. 2-4). In an example, for explicit indication, the source eNB 102a may explicitly signal the use of CP solution in the UE 104 to the target eNB 102b.

[0052] Figs. 2A-2B illustrate a RRC connection Re-establishment Procedure, implemented using a security token, between the UE 104 and the target eNB 102b of Fig. 1, according to some embodiments. Fig. IB is a continuation of Fig. 2A. In some

embodiments, in Figs. 2A-2B, the UE 104 is assumed to use CP CIoT optimization, and the target eNB 102b is assumed to support RRC connection Re-establishment Procedure for UEs that support CP CIoT optimization.

[0053] Figs. 2A-2B illustrate data exchange among the UE 104, the source eNB 102a, the target eNB 102b, and a Mobility Management Entity (MME) 201. The MME 201 may be included in, or associated with, a core network (not illustrated in Figs. 2A-2B) of the eNBs 102a and/or 102b.

[0054] Referring now to Fig. 2A, at 210, a RRC Connection Establishment procedure may be initiated between the UE 104 and the source eNB 102a. The RRC Connection Establishment at 210 may be performed using an appropriate procedure for establishing such an RRC connection.

[0055] At 214, the source eNB 102a may transmit to the MME 201 an S 1 initial UE message, which may comprise, for example, a NAS Protocol Data Unit (NAS PDU). The NAS PDU at 214 may comprise an Attach/CP Service Request, UL NAS DATA PDU, and/or the like.

[0056] In response, at 218, the MME 201 may transmit to the source eNB 102a one or both of an SI Connection Establishment Indication message or an SI DL NAS Transport message. In some embodiments, the SI Connection Establishment Indication message (also referred to herein as S 1 Application Protocol (AP) Connection Establishment Indication message) may comprise a UE radio capability information. In some embodiments, the SI DL NAS Transport message may comprise a NAS PDU, and the NAS PDU may include an Attach Accept message, DL NAS Data PDU, and/or the like.

[0057] In some embodiments, the message 218 (e.g., the SI Connection

Establishment Indication message or the SI DL NAS Transport message) may further comprise a security token 203a (also referred to herein as an authentication token). For example, the MME 201 may generate the security token 203a, and transmit the security token 203a to the source eNB 102a at 218. Although Fig. 2A illustrates the MME 201 generating the security token 203a and transmitting the security token 203a to the source eNB 102a, in some other embodiments, the MME 201 may provide the source eNB 102a with information, based on which the source eNB 102a may generate the security token 203 a. In some embodiments, the security token 203a may be generated based on NAS security

key/association, as discussed in further details herein later.

[0058] At 222, the source eNB 102a may transmit RRC DL Information Transfer message to the UE 104, where the RRC DL Information Transfer message may comprise NAS PDU comprising Attach Accept message, DL NAS Data PDU, and/or the like. It is to be noted that in the embodiments discussed with respect to Fig. 2A, the security token 203a may not be transmitted from the MME 201 or the source eNB 102a to the UE 104.

[0059] At 226, the UE 104 may detect a Radio Link Failure (RLF). In an example, the RLF at 226 may be due to the UE 104 moving from the coverage area 106a of the source eNB 102a to the coverage area 106b of the eNB 102b.

[0060] In some embodiments, in response to detecting the RLF at 226, the UE 104 may want to re-establish connection with the target eNB 102b (e.g., via a RRC-Connection Re-establishment procedure). For example, although not illustrated in Fig. 2A, the UE 104 may receive a broadcast message from the target eNB 102b, where the broadcast message may indicate that the target eNB 102b supports RRC-Connection Re-establishment procedure for UEs that support CP CIoT optimization. Thus, the UE 104 may know that the target eNB 102b supports RRC-Connection Re-establishment procedure. Accordingly, the UE 102 may want to re-establish connection with the target eNB 102b using the RRC-Connection Re- establishment procedure.

[0061] However, prior to the UE initiating the RRC-Connection Re-establishment procedure, at 230, the UE 104 may generate a security token 203b. For example, the NAS layer of the UE 104 may generate the security token 203b, and may provide the security token 203b to the AS layer of the UE 104.

[0062] In some embodiments, the security token 203a may be generated by the MME

201 based on a key (e.g., a NAS security key). At 230, the NAS layer of the UE 104 may use the same key to generate the security token 203b. It is to be noted that the security tokens 203 a and 203b may be based on one or more other factors as well, discussed herein later. In some embodiments, the security tokens 203a and 203b may be generated based on the same factors (e.g., generated using the same key) that may be accessible to both the MME 201 and the UE 104, and hence, the security tokens 203a and 203b may be the same (e.g., the security token 203b may be a replica of, or similar to, the security token 203a).

[0063] Subsequent to 230, the data flow of Fig. 2A may continue to Fig. IB.

Referring to Fig. 2B, at 234, the UE 104 may trigger an RRC Connection Re-establishment Request, e.g., by transmitting the RRC Connection Re-establishment Request to the target eNB 102b. The RRC Connection Re-establishment Request may comprise Re-establishment UE identity (also referred to herein as ReestabUE-Identity), the security token 203b, and/or the like. Thus, for example, upon the RFL at 226, the UE 104 may trigger the RRC

Connection Re-establishment Request at 234 with the security token 203b generated by the UE NAS layer (e.g., instead of the RRC Connection Re-establishment Request including a MAC-I). In some examples, the security token 203b may act as a short MAC-I in the RRC Connection Re-establishment Request.

[0064] Upon receiving the RRC Connection Reestablishment Request from the UE

104, the target eNB 102b may identify the source eNB 02a from the Re-establish UE identity included in the RRC Connection Reestablishment Request of 234. At 238, the target eNB 102b may transmit a X2 UE AS Context Fetch Request to the identified source eNB 102a, where the X2 UE AS Context Fetch Request may include the Re-establish UE identify of the UE 104. The X2 UE AS Context Fetch Request may be an X2AP message from the target eNB 102b to the source eNB 102a.

[0065] At 242, the source eNB 102a may transmit an X2 UE AS Context Fetch

Acknowledgement message to the target eNB 102b. The X2 UE AS Context Fetch

Acknowledgement message may comprise the UE AS Context of the UE 104. In some embodiments, the X2 UE AS Context Fetch Acknowledgement message may further comprise the security token 203a (e.g., which the source eNB 102a received earlier from the MME 201). In some embodiments, the UE AS Context of the UE 104, received by the target eNB 102b from the source eNB 102a at 242, may identify that the UE 102 uses the CP procedure. In some embodiments, the UE AS Context of the UE 104, received by the target eNB 102b from the source eNB 102a at 242, may comprise the security token 203 a.

[0066] At 244, the target eNB 102b may authenticate the UE 104, e.g., by comparing

(i) the security token 203 a received from the MME 201 via the source eNB 102a, and (ii) the security token 203b generated by the NAS layer of the UE 104, and received from the AS layer of the UE 104. The UE 104 may be authenticated if at least a part of the security token 203a substantially matches with at least a corresponding part of the security token 203b. Thus, in some embodiments, the UE 104 may be authenticated at the AS layer (e.g., by transmission of the RRC Connection Re-establishment Request, including the security token 203b, on the AS layer). [0067] At 246, the target eNB 102b may transmit a S 1 Path Switch Request to the

MME 201. At 250, the MME 201 may transmit a SI Path Switch Request

Acknowledgement.

[0068] As the security token 203b has been transmitted over the AS layer from the

UE 104 to the target eNB 102b (e.g., via the RRC Connection Re-establishment Request at 234), the integrity of the security token 203b may possibly be compromised. In some embodiments, the MME 201 may generate a new security token 205a, and transmit the security token 205a to the target eNB 102b via the SI Path Switch Acknowledgement at 250. In some other embodiments and although not illustrated in Fig. 2B, instead of the MME 201 sending the new security token 205 a to the target eNB 102b, the MME 201 may transmit information to the target eNB 102b, e.g., to enable the target eNB 102b to generate the security token 205a.

[0069] In some embodiments, the SI Path Switch Acknowledgement may also comprise security context of the UE 104. In some embodiments, in response to the SI Path Switch Acknowledgement, the control plane CP path between an eNB and the MME 201 may change from the source eNB 102a to the target eNB 102b.

[0070] It is to be noted that in Figs. 2A-2B, it is assumed that the MME 201 is the same for the source eNB 102a and the target eNB 102b. In some embodiments and although not illustrated in Figs. 2A-2B, if there is a change in the MME due to the movement of the UE 104 from the coverage area 106a to the coverage area 106b (e.g., if a MME associated with the source eNB 102a is different from a MME associated with the target eNB 102b), the Path Switch Request at 246 may be rejected, and the RRC Connection Re-establishment Request may also be rejected.

[0071] At 254, the target eNB 102b may transmit an RRC Connection Re- establishment message to the UE 104. At 258, the UE 104 may transmit an RRC Connection Re-establishment complete message to the target eNB 102b, which may complete the RRC Connection Re-establishment procedure.

[0072] At 262, the NAS layer of the UE 104 may generate a security token 205b, and provide the AS layer of the UE 104 with the security token 205b. For example, the security token 205b may be used for a future RRC Connection Re-establishment procedure (e.g., if the UE 104 moves again to another eNB coverage area). In some other embodiments, the security token 205b may be generated by the UE 104, for example, after the UE 104 detects an RLF. [0073] In some embodiments, if a new NAS security context is to be used by the UE

104 upon re-establishment (e.g., to generate the security token 205b), the MME 201 may provide the new NAS security context to the eNB 102b (e.g., via the SI path Switch Request Acknowledgement at 250), and the eNB 102b may send the new NAS security context via the RRC Connection Re-establishment Complete message at 254 to the UE AS layer. The AS layer of the UE 104 may provide the new NAS security context to the NAS layer of the UE 104. The NAS layer of the UE 104 may use the new security context to generate the security token 205b, e.g., to be possibly used for the next re-establishment.

[0074] In some embodiments, assuming that the UE 104 is within the coverage area

106b of the eNB 102b, if the UE 104 moves within a cell of the eNB 102b to another cell of the eNB 102b, a security token (e.g., the security token 205b) may be used. Each time a security token is used, a new security token may be generated by the NAS layer of the UE 104, e.g., as discussed with respect to blocks 230 and 262.

[0075] Although Figs. 2A-2B discuss using security tokens in RRC Connection Re- establishment procedures, in some embodiments, security tokens may also be used in other scenarios as well. For example, in some embodiments, security tokens may also be used for UE driven mobility, where the UE may perform cell selection and/or reselection and may inform an associated eNB about the change of the cell via UL RRC Message. Such UL RRC Message (e.g., without AS security activated) may also be accompanied by a security token, e.g., so that the UE can be authenticated at the eNB. In some embodiments, security token may also be applied to any appropriate UE initiated RRC signaling, or any other appropriate other L3 or L2 signaling, e.g., where AS security is not activated, and the security token may be used to authenticate the UE at the AS.

[0076] Although various embodiments discussed with respect to Figs. 1, 2A-2B, and one or more subsequent figures herein may assume the UE 104 being a NB-IoT and/or may assume the UE using CP CIoT optimization for NB-IoT, the scope of this disclosure is not any way limited by such assumptions. Merely as an example, in some embodiments, the teachings of this disclosure may also be applicable to other types of UE as well, e.g., Wider Band EUTRAN (WB-EUTRAN), or LTE non-NB-IoT, and/or the like. In some

embodiments, instead of being limited to NB-IoT, the teachings of this disclosure may also be applicable to other radio access technologies, e.g., LTE, enhanced Machine-Type

Communication (eMTC), 5G New Radio (5G NR), 5G, and/or the like.

[0077] Figs. 3A-3B illustrate RRC connection Re-establishment Procedure, implemented using a security token, between the UE 104 and the target eNB 102b of Fig. 1, where the UE 104 receives the security token from the MME 201 over NAS PDUs, according to some embodiments. Figs. 3A-3B are at least in part similar to Figs. 2A-2B, respectively. For example, various operations associated with blocks 310, 314, 318, 326, 334, 338, 342, 344, 346, 350, 354, and/or 358 of Figs. 3A-3B are at least in part similar to various operations associated with blocks 210, 214, 218, 226, 234, 238, 242, 244, 246, 250, 254, and/or 258 of Figs. 2A-2B, and hence, these operations of Figs. 3A-3B are not discussed in further details.

[0078] However, unlike Fig. 2A (e.g., where the UE NAS layer generates the security token 203b at 230), in Fig. 3A, the UE 104 may receive the security token 303b via a NAS PDU, where the NAS PDU may be received by the UE 104 via an RRC DL Information Transfer Message at 322. For example, the NAS PDU included in the RRC DL Information Transfer Message may include Attach Accept message, DL NAS Control PDU, and the security token 303b. Thus, unlike the operation at 230 in Fig. 2A, in Fig. 3A, the NAS layer of the UE 104 may not generate the security token 303b. Hence, in Figs. 3A-3B, the source eNB 102a may receive the security token 303a from the MME 201 (e.g., via the SI AP Connection Establishment Indication message or the SI AP DL NAS Transport message at 314), and transmit the received security token to the UE 104 via the RRC DL Information Transfer message at 322. Thus, for example, the security token 303b may be provided securely to the UE 104 via the NAS PDU. Put differently, the NAS layer of the MME 201 may provide the NAS layer of the UE 104 with the security token 303b. For example, as the security token 303a is transmitted from the MME 201 to the UE 104 (e.g., via the source eNB 102a) using the secure NAS layers, the security of the security token 303a may not be compromised.

[0079] In some embodiments, similarly, at 361 and 363 of Fig. 3B, a new security token 305b (e.g., that may be usable for future RRC Connection re-establishment) may be securely transmitted from the MME 201 to the UE 104 via the target eNB 102b over the NAS layer (e.g., by including the new security token 305b in NAS PDU).

[0080] Figs. 4A-4B illustrate RRC connection Re-establishment Procedure, implemented using a security token, between the UE 104 and the target eNB 102b of Fig. 1, where the security token is generated by the MME 201, and the security token is provided by the source eNB 102a to the UE AS layer without activating AS security, according to some embodiments. Figs. 4A-4B are at least in part similar to Figs. 3A-3B, respectively. For example, various operations associated with blocks 410, 414, 418, 426, 434, 438, 442, 444, 446, 450, and/or 458 of Figs. 4A-4B are at least in part similar to various operations associated with the corresponding blocks of Figs. 3A-3B, and hence, these operations of Figs. 4A-4B are not discussed in further details.

[0081] In Fig. 3A, the security token 303b was transmitted from the MME 201 to the

UE 104 via the source eNB 102a, where the source eNB 102a transmitted the security token 303b over the NAS PDU of the RRC DL Information Transfer message at 322. In contrast, in Fig. 4A, a security token 403b may be transmitted from the MME 201 to the UE 104 via the source eNB 102a, where the source eNB 102a may transmit the security token 403b using the RRC DL Information Transfer message at 422. The security token 403b in Fig. 4A, however, may not be included in the NAS PDU of the RRC DL Information Transfer message at 422. For example, the RRC DL Information Transfer message at 422 may comprise the NAS PDU and the security token 403b (e.g., the security token 403b may be external to the NAS PDU). In some embodiments, the transmission of the security token 403b from the source eNB 102a to the UE 104 may not be AS ciphered, e.g., as the AS layer security may not be activated. Also, referring to Fig. 4B, in some embodiments, a new security token 405b may be transmitted by the target eNB 102b to the UE 104 via a RRC Connection Re-establishment Complete message at 454, where, for example, the security token 405b may not be transmitted over the NAS layer.

[0082] Referring now to Figs. 2A-4B, in some embodiments, a security token discussed in any of these figures may be generated in the MME 201. In some other embodiments and although not illustrated in these figures, the MME 201 can provide security parameters to the eNBs (e.g., the source eNB 102a and/or the target eNB 102b), e.g., to enable the eNBs to generate the security tokens. In some embodiments, the UE 104 (e.g., the NAS layer of the UE 104) may also generate the security token (e.g., as discussed in Figs. 2A-2B)

[0083] In some embodiments, a security token may be generated (e.g., by the MME

201, the NAS layer of the UE 104, the eNBs 102a, 102b, etc.) using a security association over the NAS layer. In some embodiments, the security token may be generated based on one or more of the following parameters or fields:

[0084] (i) a security key. The security key may be a key associated with NAS security (e.g., a NAS security key). For example, the security key may be NAS security key material used by NAS security association.

[0085] (ii) BEARER bits. In an example, all the BEARER bits may be set to 1.

[0086] (iii) a DIRECTION bit, which may be set to 1.

[0087] (iv) COUNT bits, which may all be set to 1. [0088] (v) an input sequence, which may comprise one or more of an Abstract Syntax

Notation One (ASN. l) encoded Global eNB ID, an identification of an associated Public Land Mobile Network (PLMN ID), or one or more nonce that may be negotiated over the secured NAS (e.g., nonce exchanged between the UE 104 and the MME 201). In some embodiments, the ASN.1 encoded Global eNB ID may be 20 bits, and the PLMN ID may be 24 bits.

[0089] In some embodiments, the security token may be the 16 Least Significant Bits

(LSBs) of an output of a used integrity algorithm.

[0090] In some embodiments, the security key (e.g., item (i) above) may be regenerated by the UE and MME, e.g., at the RRC Connection Re-establishment (e.g., generation of security keys 205a and 205b). For example, in some embodiments, for inter- eNB handover (e.g., handover from the source eNB 102a to the target eNB 102b), a {NH, NCC} pair and an eNB handover transition Key (KeNB*) may be generated, and the (NH, KeNB*) pair may be used as the new KeNB for generating the security token. In some embodiments, for intra-eNB handover, KeNB* may be used as the new KeNB. In some embodiments, referring to Fig. 2A, as both the MME 201 and the UE 204 NAS layer have access to the same security key, the security token 203a generated by the MME 201 and the security token 203b generated by the UE 104 may match.

[0091] Fig. 5 illustrates an eNB and a UE, in accordance with some embodiments of the disclosure. Fig. 5 includes block diagrams of an eNB 510 and a UE 530 which are operable to co-exist with each other and other elements of an LTE network. High-level, simplified architectures of eNB 510 and UE 530 are described so as not to obscure the embodiments. It should be noted that in some embodiments, eNB 510 may be a stationary non-mobile device.

[0092] eNB 510 is coupled to one or more antennas 505, and UE 530 is similarly coupled to one or more antennas 525. However, in some embodiments, eNB 510 may incorporate or comprise antennas 505, and UE 530 in various embodiments may incorporate or comprise antennas 525.

[0093] In some embodiments, antennas 505 and/or antennas 525 may comprise one or more directional or omni-directional antennas, including monopole antennas, dipole antennas, loop antennas, patch antennas, microstrip antennas, coplanar wave antennas, or other types of antennas suitable for transmission of RF signals. In some MIMO (multiple-input and multiple output) embodiments, antennas 505 are separated to take advantage of spatial diversity. [0094] eNB 510 and UE 530 are operable to communicate with each other on a network, such as a wireless network. eNB 510 and UE 530 may be in communication with each other over a wireless communication channel 550, which has both a downlink path from eNB 510 to UE 530 and an uplink path from UE 530 to eNB 510.

[0095] As illustrated in Fig. 5, in some embodiments, eNB 510 may include a physical layer circuitry 512, a MAC (media access control) circuitry 514, a processor 516, a memory 518, and a hardware processing circuitry 520. A person skilled in the art will appreciate that other components not shown may be used in addition to the components shown to form a complete eNB.

[0096] In some embodiments, physical layer circuitry 512 includes a transceiver 513 for providing signals to and from UE 530. Transceiver 513 provides signals to and from UEs or other devices using one or more antennas 505. In some embodiments, MAC circuitry 514 controls access to the wireless medium. Memory 518 may be, or may include, a storage media/medium such as a magnetic storage media (e.g., magnetic tapes or magnetic disks), an optical storage media (e.g., optical discs), an electronic storage media (e.g., conventional hard disk drives, solid-state disk drives, or flash-memory-based storage media), or any tangible storage media or non-transitory storage media. Hardware processing circuitry 520 may comprise logic devices or circuitry to perform various operations. In some embodiments, processor 516 and memory 518 are arranged to perform the operations of hardware processing circuitry 520, such as operations described herein with reference to logic devices and circuitry within eNB 510 and/or hardware processing circuitry 520.

[0097] Accordingly, in some embodiments, eNB 510 may be a device comprising an application processor, a memory, one or more antenna ports, and an interface for allowing the application processor to communicate with another device.

[0098] As is also illustrated in Fig. 5, in some embodiments, UE 530 may include a physical layer circuitry 532, a MAC circuitry 534, a processor 536, a memory 538, a hardware processing circuitry 540, a wireless interface 542, and a display 544. A person skilled in the art would appreciate that other components not shown may be used in addition to the components shown to form a complete UE.

[0099] In some embodiments, physical layer circuitry 532 includes a transceiver 533 for providing signals to and from eNB 510 (as well as other eNBs). Transceiver 533 provides signals to and from eNBs or other devices using one or more antennas 525. In some embodiments, MAC circuitry 534 controls access to the wireless medium. Memory 538 may be, or may include, a storage media/medium such as a magnetic storage media (e.g., magnetic tapes or magnetic disks), an optical storage media (e.g., optical discs), an electronic storage media (e.g., conventional hard disk drives, solid-state disk drives, or flash-memory -based storage media), or any tangible storage media or non-transitory storage media. Wireless interface 542 may be arranged to allow the processor to communicate with another device. Display 544 may provide a visual and/or tactile display for a user to interact with UE 530, such as a touch-screen display. Hardware processing circuitry 540 may comprise logic devices or circuitry to perform various operations. In some embodiments, processor 536 and memory 538 may be arranged to perform the operations of hardware processing circuitry 540, such as operations described herein with reference to logic devices and circuitry within UE 530 and/or hardware processing circuitry 540.

[00100] Accordingly, in some embodiments, UE 530 may be a device comprising an application processor, a memory, one or more antennas, a wireless interface for allowing the application processor to communicate with another device, and a touch-screen display.

[00101] Elements of Fig. 5, and elements of other figures having the same names or reference numbers, can operate or function in the manner described herein with respect to any such figures (although the operation and function of such elements is not limited to such descriptions). For example, Figs. 1-4B also depict embodiments of eNBs, hardware processing circuitry of eNBs, UEs, and/or hardware processing circuitry of UEs, and the embodiments described with respect to Fig. 5 and Figs. 1-4B can operate or function in the manner described herein with respect to any of the figures.

[00102] In addition, although eNB 510 and UE 530 are each described as having several separate functional elements, one or more of the functional elements may be combined and may be implemented by combinations of software-configured elements and/or other hardware elements. In some embodiments of this disclosure, the functional elements can refer to one or more processes operating on one or more processing elements. Examples of software and/or hardware configured elements include Digital Signal Processors (DSPs), one or more microprocessors, DSPs, Field-Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs), Radio-Frequency Integrated Circuits (RFICs), and so on.

[00103] Fig. 6 illustrates hardware processing circuitries for an eNB for authenticating an UE using security token, according to some embodiments. With reference to Fig. 5, an eNB may include various hardware processing circuitries, which may in turn comprise logic devices and/or circuitry operable to perform various operations. For example, in Fig. 5, eNB 510 (or various elements or components therein, such as hardware processing circuitry 520, or combinations of elements or components therein) may include part of, or all of, these hardware processing circuitries.

[00104] In some embodiments, one or more devices or circuitries within these hardware processing circuitries may be implemented by combinations of software-configured elements and/or other hardware elements. For example, processor 516 (and/or one or more other processors which eNB 510 may comprise), memory 518, and/or other elements or components of eNB 510 (which may include hardware processing circuitry 520) may be arranged to perform the operations of these hardware processing circuitries, such as operations described herein with reference to devices and circuitry within these hardware processing circuitries. In some embodiments, processor 516 (and/or one or more other processors which eNB 510 may comprise) may be a baseband processor.

[00105] Returning to Fig. 6, an apparatus of eNB 510 (or another eNB or base station), which may be operable to communicate with one or more UEs on a wireless network, may comprise hardware processing circuitry 600. In some embodiments, hardware processing circuitry 600 may comprise one or more antenna ports 605 operable to provide various transmissions over a wireless communication channel (such as wireless communication channel 550). Antenna ports 605 may be coupled to one or more antennas 607 (which may be antennas 505). In some embodiments, hardware processing circuitry 600 may incorporate antennas 607, while in other embodiments, hardware processing circuitry 600 may merely be coupled to antennas 607.

[00106] Antenna ports 605 and antennas 607 may be operable to provide signals from an eNB to a wireless communications channel and/or a UE, and may be operable to provide signals from a UE and/or a wireless communications channel to an eNB. For example, antenna ports 605 and antennas 607 may be operable to provide transmissions from eNB 510 to wireless communication channel 550 (and from there to UE 530, or to another UE).

Similarly, antennas 607 and antenna ports 605 may be operable to provide transmissions from a wireless communication channel 550 (and beyond that, from UE 530, or another UE) to eNB 510.

[00107] Hardware processing circuitry 600 may comprise various circuitries operable in accordance with the various embodiments discussed herein. With reference to Fig. 6, hardware processing circuitry 600 may comprise a first circuitry 610, a second circuitry 620, and/or a third circuitry 630. In some embodiments, the first circuitry 610 may access a first security token generated at a MME, and access a second security token generated at the UE. In some embodiments, the first circuitry 610 may store one or both the first security token and the second security token at a memory of the eNB. In some embodiments, the second circuitry 620 may compare the first security token and the second security token. In some embodiments, the third circuitry 630 may authenticate the UE, based at least in part on the comparison of the first security token and the second security token. In some embodiments, the first circuitry 610 may process a RRC Connection Re-establishment Request from the UE, the RRC Connection Re-establishment Request comprising the second security token generated at the UE. In some embodiments, the first circuitry 610 may process a X2

Application Protocol (X2AP) message from another eNB, the X2AP message comprising the first security token generated at the MME. In some embodiments, the first circuitry 610 may process a message comprising an Access Stratum (AS) context of the UE, the message comprising the first security token generated at the MME. In some embodiments, the first circuitry 610 may process a S I message from the MME, the S I message comprising a third security token generated at the MME. In some embodiments, the first security token may be generated at the MME, based on NAS security key material used by NAS security association.

[00108] In some embodiments, the first circuitry 610 may process a Radio Resource

Control (RRC) Connection Re-establishment Request received from the UE, and may process an indication that the UE supports Control Plane (CP) Cellular Internet-of-Things (CIoT) Evolved Packet System (EPS) Optimization (CP CIoT EPS Optimization). In some embodiments, to process the indication, the first circuitry may process a X2 Application Protocol (X2AP) message from another eNB, the X2AP message comprising the indication. In some embodiments, to process the indication, the first circuitry may process a message from the UE, the message from the UE comprising the indication. In some embodiments, the eNB may generate a broadcast signal indicating that the eNB supports Radio Resource Control (RRC) Connection Reestablishment procedure for UEs supporting CP CIoT EPS Optimization.

[00109] In some embodiments, first circuitry 610, second circuitry 620, and/or third circuitry 630 may be implemented as separate circuitries. In other embodiments, first circuitry 610, second circuitry 620, and/or third circuitry 630 may be combined and implemented together in a circuitry without altering the essence of the embodiments.

[00110] Fig. 7 illustrates hardware processing circuitries for a UE for transmitting a security token to a eNB for authentication of the UE, according to some embodiments. With reference to Fig. 5, a UE may include various hardware processing circuitries, which may in turn comprise logic devices and/or circuitry operable to perform various operations. For example, in Fig. 5, UE 530 (or various elements or components therein, such as hardware processing circuitry 540, or combinations of elements or components therein) may include part of, or all of, these hardware processing circuitries.

[00111] In some embodiments, one or more devices or circuitries within these hardware processing circuitries may be implemented by combinations of software-configured elements and/or other hardware elements. For example, processor 536 (and/or one or more other processors which UE 530 may comprise), memory 538, and/or other elements or components of UE 530 (which may include hardware processing circuitry 540) may be arranged to perform the operations of these hardware processing circuitries, such as operations described herein with reference to devices and circuitry within these hardware processing circuitries. In some embodiments, processor 536 (and/or one or more other processors which UE 530 may comprise) may be a baseband processor.

[00112] Returning to Fig. 7, an apparatus of UE 530 (or another UE or mobile handset), which may be operable to communicate with one or more eNBs on a wireless network, may comprise hardware processing circuitry 700. In some embodiments, hardware processing circuitry 700 may comprise one or more antenna ports 705 operable to provide various transmissions over a wireless communication channel (such as wireless

communication channel 550). Antenna ports 705 may be coupled to one or more antennas 707 (which may be antennas 525). In some embodiments, hardware processing circuitry 700 may incorporate antennas 707, while in other embodiments, hardware processing circuitry 700 may merely be coupled to antennas 707.

[00113] Antenna ports 705 and antennas 707 may be operable to provide signals from a UE to a wireless communications channel and/or an eNB, and may be operable to provide signals from an eNB and/or a wireless communications channel to a UE. For example, antenna ports 705 and antennas 707 may be operable to provide transmissions from UE 530 to wireless communication channel 550 (and from there to eNB 510, or to another eNB). Similarly, antennas 707 and antenna ports 705 may be operable to provide transmissions from a wireless communication channel 550 (and beyond that, from eNB 510, or another eNB) to UE 530.

[00114] Hardware processing circuitry 700 may comprise various circuitries operable in accordance with the various embodiments discussed herein. With reference to Fig. 7, hardware processing circuitry 700 may comprise a first circuitry 710 and/or a second circuitry 720. In some embodiments, the first circuitry 710 may generate a security token, and store the security token in a memory of the UE. In some embodiments, the second circuitry 720 may generate a RRC message for transmission to a first eNB, in response to the UE detecting a Radio Link Failure (RLF) in communication with a second eNB, the RRC message comprising the security token. In some embodiments, the UE may further comprise an interface to output the RRC message to a transceiver, for transmission to the first eNB. In some embodiments, the security token may be generated at a NAS layer of the UE; and the security token may be provided from the NAS layer to an Access Stratum (AS) layer of the UE. In some embodiments, to generate the security token, the first circuitry 710 may generate the security token at a Non- Access Stratum (NAS) layer of the UE, based on NAS security key material. In some embodiments, the UE may process signals received from a MME via the second eNB, the signals comprising the NAS security key material. In some embodiments, the RRC message may comprise a RRC Connection Re-establishment Request for transmission to the first eNB. In some embodiments, the UE may detect the RLF in communication with the second eNB, in response to the UE moving from a coverage area of the second eNB to a coverage area of the first eNB. In some embodiments, the security token is a first security token, and the first circuitry 710 may generate a first version of a second security token, based on the first security token being used in the RRC message transmitted to the first eNB, wherein a MME may generate a second version of the second security token for transmission to the first eNB.

[00115] In some embodiments, first circuitry 710 and/or second circuitry 720 may be implemented as separate circuitries. In other embodiments, first circuitry 710 and second circuitry 720 may be combined and implemented together in a circuitry without altering the essence of the embodiments.

[00116] Fig. 8 illustrates a method 800 for an eNB to authenticate a UE based on a security token, according to some embodiments. Fig. 9 illustrates a method 900 for an eNB to receive an indication as to whether a UE supports Control Plane (CP) Cellular Internet-of- Things (CIoT) Evolved Packet System (EPS) Optimization (CP CIoT EPS Optimization), according to some embodiments. With reference to Fig. 5, various methods that may relate to eNB 510 and hardware processing circuitry 520 are discussed below. Although the actions in methods 800 and 900 are shown in a particular order, the order of the actions can be modified. Thus, the illustrated embodiments can be performed in a different order, and some actions may be performed in parallel. Some of the actions and/or operations listed in each of Figs. 8-9 are optional in accordance with certain embodiments. The numbering of the actions presented is for the sake of clarity and is not intended to prescribe an order of operations in which the various actions must occur. Additionally, operations from the various flows may be utilized in a variety of combinations.

[00117] Moreover, in some embodiments, machine readable storage media may have executable instructions that, when executed, cause eNB 510 and/or hardware processing circuitry 520 to perform an operation comprising each of the methods 800 and 900. Such machine readable storage media may include any of a variety of storage media, like magnetic storage media (e.g., magnetic tapes or magnetic disks), optical storage media (e.g., optical discs), electronic storage media (e.g., conventional hard disk drives, solid-state disk drives, or flash-memory-based storage media), or any other tangible storage media or non-transitory storage media.

[00118] In some embodiments, an apparatus may comprise means for performing various actions and/or operations of each of the methods 800 and 900.

[00119] Returning to Fig. 8, method 800 may be in accordance with the various embodiments discussed herein. The method 800 may comprise, at 804, accessing a first security token generated at a Mobility Management Entity (MME). The method 800 may comprise, at 808, accessing a second security token generated at a User Equipment (UE). The method 800 may comprise, at 812, comparing the first security token and the second security token. The method 800 may comprise, at 816, authenticating the UE, based at least in part on the comparison of the first security token and the second security token. In some embodiments, a RRC Connection Re-establishment Request from the UE may be processed, the RRC Connection Re-establishment Request comprising the second security token generated at the UE. In some embodiments, a X2 Application Protocol (X2AP) message from another eNB may be processed, the X2AP message comprising the first security token generated at the MME. In some embodiments, a message comprising an Access Stratum (AS) context of the UE may be processed, the message comprising the first security token generated at the MME. In some embodiments, a S I message from the MME may be processed, the SI message comprising a third security token generated at the MME. In some embodiments, the first security token may be generated at the MME, based on Non- Access Stratum (NAS) security key material used by NAS security association.

[00120] Returning to Fig. 9, method 900 may be in accordance with the various embodiments discussed herein. The method 900 may comprise, at 904, processing a Radio Resource Control (RRC) Connection Re-establishment Request received from the UE. The method 900 may comprise, at 908, processing an indication that the UE supports Control Plane (CP) Cellular Intemet-of-Things (CIoT) Evolved Packet System (EPS) Optimization (CP CIoT EPS Optimization. In some embodiments, a X2 Application Protocol (X2AP) message from another eNB may be processed, the X2AP message comprising the indication. In some embodiments, a message from the UE may be processed, the message from the UE comprising the indication. In some embodiments, a broadcast signal, indicating that the eNB supports Radio Resource Control (RRC) Connection Reestablishment procedure for UEs supporting CP CIoT EPS Optimization, may be generated.

[00121] Fig. 10 illustrates a method 1000 for a UE for generating a security token for authenticating the UE with a target eNB, according to some embodiments. Fig. 11 illustrates a method 1100 for a UE to receive, from an eNB, an indication indicating that the eNB supports Radio Resource Control (RRC) Connection Reestablishment procedure for UEs supporting Control Plane (CP) Cellular Internet-of-Things (CIoT) Evolved Packet System (EPS) Optimization (CP CIoT EPS Optimization), according to some embodiments. With reference to Fig. 5, methods 1000 and 1100 that may relate to UE 530 and hardware processing circuitry 540 are discussed below. Although the actions in each of the methods 1000 and 1100 are shown in a particular order, the order of the actions can be modified. Thus, the illustrated embodiments can be performed in a different order, and some actions may be performed in parallel. Some of the actions and/or operations listed in each of Figs. 10 and 11 are optional in accordance with certain embodiments. The numbering of the actions presented is for the sake of clarity and is not intended to prescribe an order of operations in which the various actions must occur. Additionally, operations from the various flows may be utilized in a variety of combinations.

[00122] Moreover, in some embodiments, machine readable storage media may have executable instructions that, when executed, cause UE 530 and/or hardware processing circuitry 540 to perform an operation comprising each of the methods 1000 and 1100. Such machine readable storage media may include any of a variety of storage media, like magnetic storage media (e.g., magnetic tapes or magnetic disks), optical storage media (e.g., optical discs), electronic storage media (e.g., conventional hard disk drives, solid-state disk drives, or flash-memory-based storage media), or any other tangible storage media or non-transitory storage media.

[00123] In some embodiments, an apparatus may comprise means for performing various actions and/or operations of each of the methods of Figs. 10 and 11.

[00124] Returning to Fig. 10, various methods may be in accordance with the various embodiments discussed herein. The method 1000 may comprise, at 1004, generating a security token. The method 1000 may comprise, at 1008, generating a Radio Resource Control (RRC) message for transmission to a first eNB, in response to the UE detecting a Radio Link Failure (RLF) in communication with a second eNB, the RRC message comprising the security token. In some embodiments, the RRC message may be output to a transceiver, for transmission to the first eNB. In some embodiments, the security token may be generated at a Non- Access Stratum (NAS) layer of the UE; and the security token may be provided from the NAS layer to an Access Stratum (AS) layer of the UE. In some embodiments, the security token may be generated at a Non-Access Stratum (NAS) layer of the UE, based on NAS security key material. In some embodiments, signals received from a Mobility Management Entity (MME) via the second eNB may be processed, the signals comprising the NAS security key material. In some embodiments, the RRC message comprises a RRC Connection Re-establishment Request for transmission to the first eNB. In some embodiments, the RLF in communication with the second eNB may be detected, in response to the UE moving from a coverage area of the second eNB to a coverage area of the first eNB. In some embodiments, the security token is a first security token, and a first version of a second security token may be generated, based on the first security token being used in the RRC message transmitted to the first eNB, wherein a Mobility Management Entity (MME) is to generate a second version of the second security token for transmission to the first eNB.

[00125] Returning to Fig. 11, various methods may be in accordance with the various embodiments discussed herein. The method 1100 may comprise, at 1104, processing a broadcast signal from a eNB, the broadcast signal indicating that the eNB supports RRC Connection Reestablishment procedure for those UEs that support CP CIoT EPS

Optimization. Thus, for example, the broadcast signal may indicate that the eNB supports RRC Connection Reestablishment procedure using security tokens. The method 1100 may comprise, at 1108, generating, for transmission to the eNB, a RRC Connection

Reestablishment Request comprising a security token. In some embodiments, it may be indicated, via the RRC Connection Reestablishment Request, that the UE supports CP CIoT EPS Optimization. In some embodiments, the eNB is a first eNB, and the UE may determine that a second eNB does not support RRC Connection Reestablishment procedure; and the UE may initiate a Non-Access Stratum (NAS) recovery process with the second eNB, instead of a RRC Connection Reestablishment Request, in response to the UE moving to a coverage area of the second eNB. In some embodiments, a message may be generated for transmission to the eNB indicating, the message indicating that the UE supports CP CIoT EPS Optimization. In some embodiments, the message may comprise one of a Message 3 RRC Connection Reestablishment request, Media Access Control (MAC), or LI signaling.

[00126] Fig. 12 illustrates an architecture of a system 1200 of a network in accordance with some embodiments. The system 1200 is shown to include a user equipment (UE) 1201 and a UE 1202. The UEs 1201 and 1202 are illustrated as smartphones (e.g., handheld touchscreen mobile computing devices connectable to one or more cellular networks), but may also comprise any mobile or non-mobile computing device, such as Personal Data Assistants (PDAs), pagers, laptop computers, desktop computers, wireless handsets, or any computing device including a wireless communications interface.

[00127] In some embodiments, any of the UEs 1201 and 1202 can comprise an Internet of Things (IoT) UE, which can comprise a network access layer designed for low-power IoT applications utilizing short-lived UE connections. An IoT UE can utilize technologies such as machine-to-machine (M2M) or machine-type communications (MTC) for exchanging data with an MTC server or device via a public land mobile network (PLMN), Proximity -Based Service (ProSe) or device-to-device (D2D) communication, sensor networks, or IoT networks. The M2M or MTC exchange of data may be a machine-initiated exchange of data. An IoT network describes interconnecting IoT UEs, which may include uniquely identifiable embedded computing devices (within the Internet infrastructure), with short-lived

connections. The IoT UEs may execute background applications (e.g., keep-alive messages, status updates, etc.) to facilitate the connections of the IoT network.

[00128] The UEs 1201 and 1202 may be configured to connect, e.g., communicatively couple, with a radio access network (RAN)— in this embodiment, an Evolved Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (E-UTRAN) 1210. The UEs 1201 and 1202 utilize connections 1203 and 1204, respectively, each of which comprises a physical communications interface or layer (discussed in further detail below); in this example, the connections 1203 and 1204 are illustrated as an air interface to enable communicative coupling, and can be consistent with cellular communications protocols, such as a Global System for Mobile Communications (GSM) protocol, a code- division multiple access (CDMA) network protocol, a Push-to-Talk (PTT) protocol, a PTT over Cellular (POC) protocol, a Universal Mobile Telecommunications System (UMTS) protocol, a 3GPP Long Term Evolution (LTE) protocol, a fifth generation (5G) protocol, a New Radio (NR) protocol, and the like.

[00129] In this embodiment, the UEs 1201 and 1202 may further directly exchange communication data via a ProSe interface 1205. The ProSe interface 1205 may alternatively be referred to as a sidelink interface comprising one or more logical channels, including but not limited to a Physical Sidelink Control Channel (PSCCH), a Physical Sidelink Shared Channel (PSSCH), a Physical Sidelink Discovery Channel (PSDCH), and a Physical Sidelink Broadcast Channel (PSBCH).

[00130] The UE 1202 is shown to be configured to access an access point (AP) 1206 via connection 1207. The connection 1207 can comprise a local wireless connection, such as a connection consistent with any IEEE 802.11 protocol, wherein the AP 1206 would comprise a wireless fidelity (WiFi®) router. In this example, the AP 1206 is shown to be connected to the Internet without connecting to the core network of the wireless system (described in further detail below).

[00131] The E-UTRAN 1210 can include one or more access nodes that enable the connections 1203 and 1204. These access nodes (ANs) can be referred to as base stations (BSs), NodeBs, evolved NodeBs (eNBs), next Generation NodeBs (gNB), RAN nodes, and so forth, and can comprise ground stations (e.g., terrestrial access points) or satellite stations providing coverage within a geographic area (e.g., a cell). The E-UTRAN 1210 may include one or more RAN nodes for providing macrocells, e.g., macro RAN node 1211, and one or more RAN nodes for providing femtocells or picocells (e.g., cells having smaller coverage areas, smaller user capacity, or higher bandwidth compared to macrocells), e.g., low power (LP) RAN node 1212.

[00132] Any of the RAN nodes 1211 and 1212 can terminate the air interface protocol and can be the first point of contact for the UEs 1201 and 1202. In some embodiments, any of the RAN nodes 1211 and 1212 can fulfill various logical functions for the E-UTRAN 1210 including, but not limited to, radio network controller (RNC) functions such as radio bearer management, uplink and downlink dynamic radio resource management and data packet scheduling, and mobility management.

[00133] In accordance with some embodiments, the UEs 1201 and 1202 can be configured to communicate using Orthogonal Frequency-Division Multiplexing (OFDM) communication signals with each other or with any of the RAN nodes 1211 and 1212 over a multicarrier communication channel in accordance various communication techniques, such as, but not limited to, an Orthogonal Frequency-Division Multiple Access (OFDMA) communication technique (e.g., for downlink communications) or a Single Carrier Frequency Division Multiple Access (SC-FDMA) communication technique (e.g., for uplink and ProSe or sidelink communications), although the scope of the embodiments is not limited in this respect. The OFDM signals can comprise a plurality of orthogonal subcarriers. [00134] In some embodiments, a downlink resource grid can be used for downlink transmissions from any of the RAN nodes 1211 and 1212 to the UEs 1201 and 1202, while uplink transmissions can utilize similar techniques. The grid can be a time-frequency grid, called a resource grid or time-frequency resource grid, which is the physical resource in the downlink in each slot. Such a time-frequency plane representation is a common practice for OFDM systems, which makes it intuitive for radio resource allocation. Each column and each row of the resource grid corresponds to one OFDM symbol and one OFDM subcarrier, respectively. The duration of the resource grid in the time domain corresponds to one slot in a radio frame. The smallest time-frequency unit in a resource grid is denoted as a resource element. Each resource grid comprises a number of resource blocks, which describe the mapping of certain physical channels to resource elements. Each resource block comprises a collection of resource elements; in the frequency domain, this may represent the smallest quantity of resources that currently can be allocated. There are several different physical downlink channels that are conveyed using such resource blocks.

[00135] The physical downlink shared channel (PDSCH) may carry user data and higher-layer signaling to the UEs 1201 and 1202. The physical downlink control channel (PDCCH) may carry information about the transport format and resource allocations related to the PDSCH channel, among other things. It may also inform the UEs 1201 and 1202 about the transport format, resource allocation, and H-ARQ (Hybrid Automatic Repeat Request) information related to the uplink shared channel. Typically, downlink scheduling (assigning control and shared channel resource blocks to the UE 102 within a cell) may be performed at any of the RAN nodes 1211 and 1212 based on channel quality information fed back from any of the UEs 1201 and 1202. The downlink resource assignment information may be sent on the PDCCH used for (e.g., assigned to) each of the UEs 1201 and 1202.

[00136] The PDCCH may use control channel elements (CCEs) to convey the control information. Before being mapped to resource elements, the PDCCH complex-valued symbols may first be organized into quadruplets, which may then be permuted using a sub- block interleaver for rate matching. Each PDCCH may be transmitted using one or more of these CCEs, where each CCE may correspond to nine sets of four physical resource elements known as resource element groups (REGs). Four Quadrature Phase Shift Keying (QPSK) symbols may be mapped to each REG. The PDCCH can be transmitted using one or more CCEs, depending on the size of the downlink control information (DCI) and the channel condition. There can be four or more different PDCCH formats defined in LTE with different numbers of CCEs (e.g., aggregation level, L=l, 2, 4, or 8). [00137] Some embodiments may use concepts for resource allocation for control channel information that are an extension of the above-described concepts. For example, some embodiments may utilize an enhanced physical downlink control channel (EPDCCH) that uses PDSCH resources for control information transmission. The EPDCCH may be transmitted using one or more enhanced the control channel elements (ECCEs). Similar to above, each ECCE may correspond to nine sets of four physical resource elements known as an enhanced resource element groups (EREGs). An ECCE may have other numbers of EREGs in some situations.

[00138] The E-UTRAN 1210 is shown to be communicatively coupled to a core network— in this embodiment, an Evolved Packet Core (EPC) network 1220 via an S I interface 1213. In this embodiment the SI interface 1213 is split into two parts: the S l-U interface 1214, which carries traffic data between the RAN nodes 1211 and 1212 and the serving gateway (S-GW) 1222, and the SI -mobility management entity (MME) interface 1215, which is a signaling interface between the RAN nodes 1211 and 1212 and MMEs 1221.

[00139] In this embodiment, the EPC network 1220 comprises the MMEs 1221, the S-

GW 1222, the Packet Data Network (PDN) Gateway (P-GW) 1223, and a home subscriber server (HSS) 1224. The MMEs 1221 may be similar in function to the control plane of legacy Serving General Packet Radio Service (GPRS) Support Nodes (SGSN). The MMEs 1221 may manage mobility aspects in access such as gateway selection and tracking area list management. The HSS 1224 may comprise a database for network users, including subscription-related information to support the network entities' handling of communication sessions. The EPC network 1220 may comprise one or several HSSs 1224, depending on the number of mobile subscribers, on the capacity of the equipment, on the organization of the network, etc. For example, the HSS 1224 can provide support for routing/roaming, authentication, authorization, naming/addressing resolution, location dependencies, etc.

[00140] The S-GW 1222 may terminate the SI interface 1213 towards the E-UTRAN

1210, and routes data packets between the E-UTRAN 1210 and the EPC network 1220. In addition, the S-GW 1222 may be a local mobility anchor point for inter-RAN node handovers and also may provide an anchor for inter-3GPP mobility. Other responsibilities may include lawful intercept, charging, and some policy enforcement.

[00141] The P-GW 1223 may terminate an SGi interface toward a PDN. The P-GW

1223 may route data packets between the EPC network 1223 and extemal networks such as a network including the application server 1230 (alternatively referred to as application function (AF)) via an Internet Protocol (IP) interface 1225. Generally, the application server 1230 may be an element offering applications that use IP bearer resources with the core network (e.g., UMTS Packet Services (PS) domain, LTE PS data services, etc.). In this embodiment, the P-GW 1223 is shown to be communicatively coupled to an application server 1230 via an IP communications interface 1225. The application server 1230 can also be configured to support one or more communication services (e.g., Voice-over-Internet Protocol (VoIP) sessions, PTT sessions, group communication sessions, social networking services, etc.) for the UEs 1201 and 1202 via the EPC network 1220.

[00142] The P-GW 1223 may further be a node for policy enforcement and charging data collection. Policy and Charging Enforcement Function (PCRF) 1226 is the policy and charging control element of the EPC network 1220. In a non-roaming scenario, there may be a single PCRF in the Home Public Land Mobile Network (HPLMN) associated with a UE's Internet Protocol Connectivity Access Network (IP-CAN) session. In a roaming scenario with local breakout of traffic, there may be two PCRFs associated with a UE's IP-CAN session: a Home PCRF (H-PCRF) within a HPLMN and a Visited PCRF (V-PCRF) within a Visited Public Land Mobile Network (VPLMN). The PCRF 1226 may be communicatively coupled to the application server 1230 via the P-GW 1223. The application server 1230 may signal the PCRF 1226 to indicate a new service flow and select the appropriate Quality of Service (QoS) and charging parameters. The PCRF 1226 may provision this rule into a Policy and Charging Enforcement Function (PCEF) (not shown) with the appropriate traffic flow template (TFT) and QoS class of identifier (QCI), which commences the QoS and charging as specified by the application server 1230.

[00143] Fig. 13 illustrates example components of a device 1300 in accordance with some embodiments. In some embodiments, the device 1300 may include application circuitry 1302, baseband circuitry 1304, Radio Frequency (RF) circuitry 1306, front-end module (FEM) circuitry 1308, one or more antennas 1310, and power management circuitry (PMC) 1312 coupled together at least as shown. The components of the illustrated device 1300 may be included in a UE or a RAN node. In some embodiments, the device 1300 may include less elements (e.g., a RAN node may not utilize application circuitry 1302, and instead include a processor/controller to process IP data received from an EPC). In some embodiments, the device 1300 may include additional elements such as, for example, memory /storage, display, camera, sensor, or input/output (I/O) interface. In other embodiments, the components described below may be included in more than one device (e.g., said circuitries may be separately included in more than one device for Cloud-RAN (C- RAN) implementations).

[00144] The application circuitry 1302 may include one or more application processors. For example, the application circuitry 1302 may include circuitry such as, but not limited to, one or more single-core or multi-core processors. The processor(s) may include any combination of general-purpose processors and dedicated processors (e.g., graphics processors, application processors, etc.). The processors may be coupled with or may include memory /storage and may be configured to execute instructions stored in the memory /storage to enable various applications or operating systems to run on the device 1300. In some embodiments, processors of application circuitry 1302 may process IP data packets received from an EPC.

[00145] The baseband circuitry 1304 may include circuitry such as, but not limited to, one or more single-core or multi-core processors. The baseband circuitry 1304 may include one or more baseband processors or control logic to process baseband signals received from a receive signal path of the RF circuitry 1306 and to generate baseband signals for a transmit signal path of the RF circuitry 1306. Baseband processing circuity 1304 may interface with the application circuitry 1302 for generation and processing of the baseband signals and for controlling operations of the RF circuitry 1306. For example, in some embodiments, the baseband circuitry 1304 may include a third generation (3G) baseband processor 1304A, a fourth generation (4G) baseband processor 1304B, a fifth generation (5G) baseband processor 1304C, or other baseband processor(s) 1304D for other existing generations, generations in development or to be developed in the future (e.g., second generation (2G), sil3h generation (6G), etc.). The baseband circuitry 1304 (e.g., one or more of baseband processors 1304A-D) may handle various radio control functions that enable communication with one or more radio networks via the RF circuitry 1306. In other embodiments, some or all of the functionality of baseband processors 1304A-D may be included in modules stored in the memory 1304G and executed via a Central Processing Unit (CPU) 1304E. The radio control functions may include, but are not limited to, signal modulation/demodulation,

encoding/decoding, radio frequency shifting, etc. In some embodiments,

modulation/demodulation circuitry of the baseband circuitry 1304 may include Fast-Fourier Transform (FFT), precoding, or constellation mapping/demapping functionality. In some embodiments, encoding/decoding circuitry of the baseband circuitry 1304 may include convolution, tail-biting convolution, turbo, Viterbi, or Low Density Parity Check (LDPC) encoder/decoder functionality. Embodiments of modulation/demodulation and encoder/decoder functionality are not limited to these examples and may include other suitable functionality in other embodiments.

[00146] In some embodiments, the baseband circuitry 1304 may include one or more audio digital signal processor(s) (DSP) 1304F. The audio DSP(s) 1304F may be include elements for compression/decompression and echo cancellation and may include other suitable processing elements in other embodiments. Components of the baseband circuitry may be suitably combined in a single chip, a single chipset, or disposed on a same circuit board in some embodiments. In some embodiments, some or all of the constituent components of the baseband circuitry 1304 and the application circuitry 1302 may be implemented together such as, for example, on a system on a chip (SOC).

[00147] In some embodiments, the baseband circuitry 1304 may provide for communication compatible with one or more radio technologies. For example, in some embodiments, the baseband circuitry 1304 may support communication with an evolved universal terrestrial radio access network (EUTRAN) or other wireless metropolitan area networks (WMAN), a wireless local area network (WLAN), a wireless personal area network (WPAN). Embodiments in which the baseband circuitry 1304 is configured to support radio communications of more than one wireless protocol may be referred to as multi-mode baseband circuitry.

[00148] RF circuitry 1306 may enable communication with wireless networks using modulated electromagnetic radiation through a non-solid medium. In various embodiments, the RF circuitry 1306 may include switches, filters, amplifiers, etc. to facilitate the communication with the wireless network. RF circuitry 1306 may include a receive signal path which may include circuitry to down-convert RF signals received from the FEM circuitry 1308 and provide baseband signals to the baseband circuitry 1304. RF circuitry 1306 may also include a transmit signal path which may include circuitry to up-convert baseband signals provided by the baseband circuitry 1304 and provide RF output signals to the FEM circuitry 1308 for transmission.

[00149] In some embodiments, the receive signal path of the RF circuitry 1306 may include mixer circuitry 1306a, amplifier circuitry 1306b and filter circuitry 1306c. In some embodiments, the transmit signal path of the RF circuitry 1306 may include filter circuitry 1306c and mixer circuitry 1306a. RF circuitry 1306 may also include synthesizer circuitry 1306d for synthesizing a frequency for use by the mixer circuitry 1306a of the receive signal path and the transmit signal path. In some embodiments, the mixer circuitry 1306a of the receive signal path may be configured to down-convert RF signals received from the FEM circuitry 1308 based on the synthesized frequency provided by synthesizer circuitry 1306d. The amplifier circuitry 1306b may be configured to amplify the down-converted signals and the filter circuitry 1306c may be a low-pass filter (LPF) or band-pass filter (BPF) configured to remove unwanted signals from the down-converted signals to generate output baseband signals. Output baseband signals may be provided to the baseband circuitry 1304 for further processing. In some embodiments, the output baseband signals may be zero-frequency baseband signals, although this is not a requirement. In some embodiments, mixer circuitry 1306a of the receive signal path may comprise passive mixers, although the scope of the embodiments is not limited in this respect.

[00150] In some embodiments, the mixer circuitry 1306a of the transmit signal path may be configured to up-convert input baseband signals based on the synthesized frequency provided by the synthesizer circuitry 1306d to generate RF output signals for the FEM circuitry 1308. The baseband signals may be provided by the baseband circuitry 1304 and may be filtered by filter circuitry 1306c.

[00151] In some embodiments, the mixer circuitry 1306a of the receive signal path and the mixer circuitry 1306a of the transmit signal path may include two or more mixers and may be arranged for quadrature downconversion and upconversion, respectively. In some embodiments, the mixer circuitry 1306a of the receive signal path and the mixer circuitry 1306a of the transmit signal path may include two or more mixers and may be arranged for image rejection (e.g., Hartley image rejection). In some embodiments, the mixer circuitry 1306a of the receive signal path and the mixer circuitry 1306a may be arranged for direct downconversion and direct upconversion, respectively. In some embodiments, the mixer circuitry 1306a of the receive signal path and the mixer circuitry 1306a of the transmit signal path may be configured for super-heterodyne operation.

[00152] In some embodiments, the output baseband signals and the input baseband signals may be analog baseband signals, although the scope of the embodiments is not limited in this respect. In some alternate embodiments, the output baseband signals and the input baseband signals may be digital baseband signals. In these alternate embodiments, the RF circuitry 1306 may include analog-to-digital converter (ADC) and digital-to-analog converter (DAC) circuitry and the baseband circuitry 1304 may include a digital baseband interface to communicate with the RF circuitry 1306.

[00153] In some dual-mode embodiments, a separate radio IC circuitry may be provided for processing signals for each spectrum, although the scope of the embodiments is not limited in this respect. [00154] In some embodiments, the synthesizer circuitry 1306d may be a fractional -N synthesizer or a fractional N/N+l synthesizer, although the scope of the embodiments is not limited in this respect as other types of frequency synthesizers may be suitable. For example, synthesizer circuitry 1306d may be a delta-sigma synthesizer, a frequency multiplier, or a synthesizer comprising a phase-locked loop with a frequency divider.

[00155] The synthesizer circuitry 1306d may be configured to synthesize an output frequency for use by the mixer circuitry 1306a of the RF circuitry 1306 based on a frequency input and a divider control input. In some embodiments, the synthesizer circuitry 1306d may be a fractional N/N+l synthesizer.

[00156] In some embodiments, frequency input may be provided by a voltage controlled oscillator (VCO), although that is not a requirement. Divider control input may be provided by either the baseband circuitry 1304 or the applications processor 1302 depending on the desired output frequency. In some embodiments, a divider control input (e.g., N) may be determined from a look-up table based on a channel indicated by the applications processor 1302.

[00157] Synthesizer circuitry 1306d of the RF circuitry 1306 may include a divider, a delay-locked loop (DLL), a multiplexer and a phase accumulator. In some embodiments, the divider may be a dual modulus divider (DMD) and the phase accumulator may be a digital phase accumulator (DP A). In some embodiments, the DMD may be configured to divide the input signal by either N or N+l (e.g., based on a carry out) to provide a fractional division ratio. In some example embodiments, the DLL may include a set of cascaded, tunable, delay elements, a phase detector, a charge pump and a D-type flip-flop. In these embodiments, the delay elements may be configured to break a VCO period up into Nd equal packets of phase, where Nd is the number of delay elements in the delay line. In this way, the DLL provides negative feedback to help ensure that the total delay through the delay line is one VCO cycle.

[00158] In some embodiments, synthesizer circuitry 1306d may be configured to generate a carrier frequency as the output frequency, while in other embodiments, the output frequency may be a multiple of the carrier frequency (e.g., twice the carrier frequency, four times the carrier frequency) and used in conjunction with quadrature generator and divider circuitry to generate multiple signals at the carrier frequency with multiple different phases with respect to each other. In some embodiments, the output frequency may be a LO frequency (fLO). In some embodiments, the RF circuitry 1306 may include an IQ/polar converter. [00159] FEM circuitry 1308 may include a receive signal path which may include circuitry configured to operate on RF signals received from one or more antennas 1310, amplify the received signals and provide the amplified versions of the received signals to the RF circuitry 1306 for further processing. FEM circuitry 1308 may also include a transmit signal path which may include circuitry configured to amplify signals for transmission provided by the RF circuitry 1306 for transmission by one or more of the one or more antennas 1310. In various embodiments, the amplification through the transmit or receive signal paths may be done solely in the RF circuitry 1306, solely in the FEM 1308, or in both the RF circuitry 1306 and the FEM 1308.

[00160] In some embodiments, the FEM circuitry 1308 may include a TX/RX switch to switch between transmit mode and receive mode operation. The FEM circuitry may include a receive signal path and a transmit signal path. The receive signal path of the FEM circuitry may include an LNA to amplify received RF signals and provide the amplified received RF signals as an output (e.g., to the RF circuitry 1306). The transmit signal path of the FEM circuitry 1308 may include a power amplifier (PA) to amplify input RF signals (e.g., provided by RF circuitry 1306), and one or more filters to generate RF signals for subsequent transmission (e.g., by one or more of the one or more antennas 1310).

[00161] In some embodiments, the PMC 1312 may manage power provided to the baseband circuitry 1304. In particular, the PMC 1312 may control power-source selection, voltage scaling, battery charging, or DC-to-DC conversion. The PMC 1312 may often be included when the device 1300 is capable of being powered by a battery, for example, when the device is included in a UE. The PMC 1312 may increase the power conversion efficiency while providing desirable implementation size and heat dissipation characteristics.

[00162] While Fig. 13 shows the PMC 1312 coupled only with the baseband circuitry 1304. However, in other embodiments, the PMC 13 12 may be additionally or alternatively coupled with, and perform similar power management operations for, other components such as, but not limited to, application circuitry 1302, RF circuitry 1306, or FEM 1308.

[00163] In some embodiments, the PMC 1312 may control, or otherwise be part of, various power saving mechanisms of the device 1300. For example, if the device 1300 is in an RRC_Connected state, where it is still connected to the RAN node as it expects to receive traffic shortly, then it may enter a state known as Discontinuous Reception Mode (DRX) after a period of inactivity. During this state, the device 1300 may power down for brief intervals of time and thus save power. [00164] If there is no data traffic activity for an el3ended period of time, then the device 1300 may transition off to an RRC Idle state, where it disconnects from the network and does not perform operations such as channel quality feedback, handover, etc. The device 1300 goes into a very low power state and it performs paging where again it periodically wakes up to listen to the network and then powers down again. The device 1300 may not receive data in this state, in order to receive data, it must transition back to RRC Connected state.

[00165] An additional power saving mode may allow a device to be unavailable to the network for periods longer than a paging interval (ranging from seconds to a few hours). During this time, the device is totally unreachable to the network and may power down completely. Any data sent during this time incurs a large delay and it is assumed the delay is acceptable.

[00166] Processors of the application circuitry 1302 and processors of the baseband circuitry 1304 may be used to execute elements of one or more instances of a protocol stack. For example, processors of the baseband circuitry 1304, alone or in combination, may be used execute Layer 3, Layer 2, or Layer 1 functionality, while processors of the application circuitry 1304 may utilize data (e.g., packet data) received from these layers and further execute Layer 4 functionality (e.g., transmission communication protocol (TCP) and user datagram protocol (UDP) layers). As referred to herein, Layer 3 may comprise a radio resource control (RRC) layer, described in further detail below. As referred to herein, Layer 2 may comprise a medium access control (MAC) layer, a radio link control (RLC) layer, and a packet data convergence protocol (PDCP) layer, described in further detail below. As referred to herein, Layer 1 may comprise a physical (PHY) layer of a UE/RAN node, described in further detail below.

[00167] Fig. 14 illustrates example interfaces of baseband circuitry in accordance with some embodiments. As discussed above, the baseband circuitry 1304 of FIG. 13 may comprise processors 1304A-1304E and a memory 1304G utilized by said processors. Each of the processors 1304A-1304E may include a memory interface, 1404A-1404E, respectively, to send/receive data to/from the memory 1304G.

[00168] The baseband circuitry 1304 may further include one or more interfaces to communicatively couple to other circuitries/devices, such as a memory interface 1412 (e.g., an interface to send/receive data to/from memory extemal to the baseband circuitry 1304), an application circuitry interface 1414 (e.g., an interface to send/receive data to/from the application circuitry 1302 of FIG. 13), an RF circuitry interface 1416 (e.g., an interface to send/receive data to/from RF circuitry 1306 of FIG. 13), a wireless hardware connectivity interface 1418 (e.g., an interface to send/receive data to/from Near Field Communication (NFC) components, Bluetooth® components (e.g., Bluetooth® Low Energy), Wi-Fi® components, and other communication components), and a power management interface 1420 (e.g., an interface to send/receive power or control signals to/from the PMC 1312.

[00169] Reference in the specification to "an embodiment," "one embodiment," "some embodiments," or "other embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiments is included in at least some embodiments, but not necessarily all embodiments. The various appearances of "an embodiment," "one embodiment," or "some embodiments" are not necessarily all referring to the same embodiments. If the specification states a component, feature, structure, or characteristic "may," "might," or "could" be included, that particular component, feature, structure, or characteristic is not required to be included. If the specification or claim refers to "a" or "an" element, that does not mean there is only one of the elements. If the specification or claims refer to "an additional" element, that does not preclude there being more than one of the additional element.

[00170] Furthermore, the particular features, structures, functions, or characteristics may be combined in any suitable manner in one or more embodiments. For example, a first embodiment may be combined with a second embodiment anywhere the particular features, structures, functions, or characteristics associated with the two embodiments are not mutually exclusive.

[00171] While the disclosure has been described in conjunction with specific embodiments thereof, many alternatives, modifications and variations of such embodiments will be apparent to those of ordinary skill in the art in light of the foregoing description. For example, other memory architectures e.g., Dynamic RAM (DRAM) may use the

embodiments discussed. The embodiments of the disclosure are intended to embrace all such alternatives, modifications, and variations as to fall within the broad scope of the appended claims.

[00172] In addition, well known power/ground connections to integrated circuit (IC) chips and other components may or may not be shown within the presented figures, for simplicity of illustration and discussion, and so as not to obscure the disclosure. Further, arrangements may be shown in block diagram form in order to avoid obscuring the disclosure, and also in view of the fact that specifics with respect to implementation of such block diagram arrangements are highly dependent upon the platform within which the present disclosure is to be implemented (i.e., such specifics should be well within purview of one skilled in the art). Where specific details (e.g., circuits) are set forth in order to describe example embodiments of the disclosure, it should be apparent to one skilled in the art that the disclosure can be practiced without, or with variation of, these specific details. The description is thus to be regarded as illustrative instead of limiting.

[00173] The following examples pertain to further embodiments. Specifics in the examples may be used anywhere in one or more embodiments. All optional features of the apparatus described herein may also be implemented with respect to a method or process.

[00174] Example 1. An apparatus of a User Equipment (UE) operable to communicate with a first Evolved Node B (eNB) and a second eNB on a wireless network, comprising: one or more processors to: generate a security token, and generate a Radio Resource Control (RRC) message for transmission to the first eNB, in response to the UE detecting a Radio Link Failure (RLF) in communication with the second eNB, the RRC message comprising the security token; and a memory to store the security token.

[00175] Example 2. The apparatus of example 1 or any other example, further comprising: an interface for outputting the RRC message to a transceiver for transmission to the first eNB.

[00176] Example 3. The apparatus of example 1 or any other example, wherein: the security token is generated at a Non-Access Stratum (NAS) layer of the UE; and the security token is provided from the NAS layer to an Access Stratum (AS) layer of the UE.

[00177] Example 4. The apparatus of example 1 or any other example, wherein to generate the security token, the one or more processors are to: generate the security token at a Non-Access Stratum (NAS) layer of the UE, based on NAS security key material.

[00178] Example 5. The apparatus of example 4 or any other example, wherein the one or more processors are to: process signals received from a Mobility Management Entity (MME) via the second eNB, the signals comprising the NAS security key material for generating the security token.

[00179] Example 6. The apparatus of any of examples 1-5 or any other example, wherein the RRC message comprises an RRC Connection Re-establishment Request for transmission to the first eNB.

[00180] Example 7. The apparatus of any of examples 1-5 or any other example, wherein the one or more processors are to: detect the RLF in communication with the second eNB, in response to the UE moving from a coverage area of the second eNB to a coverage area of the first eNB. [00181] Example 8. The apparatus of any of examples 1-5 or any other example, wherein the security token is a first security token, and wherein the one or more processors are to: generate a first version of a second security token, based on the first security token being used in the RRC message transmitted to the first eNB, wherein a Mobility Management Entity (MME) is to generate a second version of the second security token for transmission to the first eNB.

[00182] Example 9. The apparatus of any of examples 1-8 or any other example, further comprising: a transceiver circuitry for generating transmissions and processing transmissions.

[00183] Example 10. A User Equipment (UE) device comprising an application processor, a memory, one or more antennas, a wireless interface for allowing the application processor to communicate with another device, and a touch-screen display, the UE device including the apparatus of any of examples 1-9 or any other example.

[00184] Example 11. Machine readable storage media having machine executable instructions that, when executed, cause one or more processors of a User Equipment (UE) to perform an operation comprising: generate a security token; and generate a Radio Resource Control (RRC) message for transmission to a first eNB, in response to the UE detecting a Radio Link Failure (RLF) in communication with a second eNB, the RRC message comprising the security token

[00185] Example 12. The machine readable storage media of example 11 or any other example, wherein the operation comprises: output the RRC message to a transceiver, for transmission to the first eNB.

[00186] Example 13. The machine readable storage media of example 11 or any other example, wherein: the security token is generated at a Non- Access Stratum (NAS) layer of the UE; and the security token is provided from the NAS layer to an Access Stratum (AS) layer of the UE.

[00187] Example 14. The machine readable storage media of example 11 or any other example, wherein to generate the security token, the operation comprises: generate the security token at a Non- Access Stratum (NAS) layer of the UE, based on NAS security key material.

[00188] Example 15. The machine readable storage media of example 14 or any other example, wherein the operation comprises: process signals received from a Mobility Management Entity (MME) via the second eNB, the signals comprising the NAS security key material for generating the security token. [00189] Example 16. The machine readable storage media of any of examples 11-15 or any other example, wherein the RRC message comprises an RRC Connection Re- establishment Request for transmission to the first eNB.

[00190] Example 17. The machine readable storage media of any of examples 11-15 or any other example, wherein the operation comprises: detect the RLF in communication with the second eNB, in response to the UE moving from a coverage area of the second eNB to a coverage area of the first eNB.

[00191] Example 18. The machine readable storage media of any of examples 11-15 or any other example, wherein the security token is a first security token, and wherein the operation comprises: generate a first version of a second security token, based on the first security token being used in the RRC message transmitted to the first eNB, wherein a Mobility Management Entity (MME) is to generate a second version of the second security token for transmission to the first eNB.

[00192] Example 19. An apparatus of an Evolved Node B (eNB) operable to communicate with a User Equipment (UE) on a wireless network, comprising: one or more processors to: access a first security token generated at a Mobility Management Entity (MME), access a second security token generated at the UE, compare the first security token and the second security token, and authenticate the UE, based at least in part on the comparison of the first security token and the second security token; and a memory to store one or both the first security token or the second security token.

[00193] Example 20. The apparatus of example 19 or any other example, wherein the one or more processors are to: process a Radio Resource Control (RRC) Connection Re- establishment Request from the UE, the RRC Connection Re-establishment Request comprising the second security token generated at the UE.

[00194] Example 21. The apparatus of example 19 or any other example, wherein the one or more processors are to: process an X2 Application Protocol (X2AP) message from another eNB, the X2AP message comprising the first security token generated at the MME.

[00195] Example 22. The apparatus of example 19 or any other example, wherein the one or more processors are to: process a message comprising an Access Stratum (AS) context of the UE, the message comprising the first security token generated at the MME.

[00196] Example 23. The apparatus of any of examples 19-22 or any other example, wherein the one or more processors are to: process an SI message from the MME, the SI message comprising a third security token generated at the MME. [00197] Example 24. The apparatus of any of examples 19-22 or any other example, wherein: the first security token is generated at the MME, based on Non-Access Stratum (NAS) security key material used by NAS security association.

[00198] Example 25. An Evolved Node B (eNB) device comprising an application processor, a memory, one or more antenna ports, and an interface for allowing the application processor to communicate with another device, the eNB device including the apparatus of any of examples 19-24 or any other example.

[00199] Example 26. Machine readable storage media having machine executable instructions that, when executed, cause one or more processors of an Evolved Node B (eNB) to perform an operation comprising: access a first security token generated at a Mobility Management Entity (MME); access a second security token generated at a User Equipment (UE); compare the first security token and the second security token; and authenticate the UE, based at least in part on the comparison of the first security token and the second security token.

[00200] Example 27. The machine readable storage media of example 26 or any other example, wherein the operation comprises: process a Radio Resource Control (RRC) Connection Re-establishment Request from the UE, the RRC Connection Re-establishment Request comprising the second security token generated at the UE.

[00201] Example 28. The machine readable storage media of example 26 or any other example, wherein the operation comprises: process an X2 Application Protocol (X2AP) message from another eNB, the X2AP message comprising the first security token generated at the MME.

[00202] Example 29. The machine readable storage media of example 26 or any other example, wherein the one or more processors are to: process a message comprising an Access Stratum (AS) context of the UE, the message comprising the first security token generated at the MME.

[00203] Example 30. The machine readable storage media of any of examples 26-29 or any other example, wherein the one or more processors are to: process an SI message from the MME, the S I message comprising a third security token generated at the MME.

[00204] Example 31. The machine readable storage media of any of examples 26-29 or any other example, wherein: the first security token is generated at the MME, based on Non-Access Stratum (NAS) security key material used by NAS security association.

[00205] Example 32. An apparatus of a User Equipment (UE) operable to

communicate with an Evolved Node B (eNB) on a wireless network, comprising: one or more processors to: process a broadcast signal from the eNB, the broadcast signal indicating that the eNB supports Radio Resource Control (RRC) Connection Reestablishment procedure for UEs supporting Control Plane (CP) Cellular Internet-of-Things (CIoT) Evolved Packet System (EPS) Optimization (CP CIoT EPS Optimization), and generate, for transmission to the eNB, an RRC Connection Reestablishment Request comprising a security token; and a memory to store the security token.

[00206] Example 33. The apparatus of example 32 or any other example, wherein the one or more processors are to: indicate, via the RRC Connection Reestablishment Request, that the UE supports CP CIoT EPS Optimization.

[00207] Example 34. The apparatus of example 32 or any other example, wherein the eNB is a first eNB, and wherein one or more processors are to: determine that a second eNB does not support RRC Connection Reestablishment procedure; and initiate a Non- Access Stratum (NAS) recovery process with the second eNB, instead of an RRC Connection Reestablishment Request, in response to the UE moving to a coverage area of the second eNB.

[00208] Example 35. The apparatus of any of examples 32-34 or any other example, wherein the one or more processors are to: generate, for transmission to the eNB, a message indicating that the UE supports CP CIoT EPS Optimization.

[00209] Example 36. The apparatus of any of examples 32-34 or any other example, wherein the message comprises one of a Message 3 RRC Connection Reestablishment request, Media Access Control (MAC), or LI signaling.

[00210] Example 37. The apparatus of any of examples 32-36 or any other example, further comprising: a transceiver circuitry for generating transmissions and processing transmissions.

[00211] Example 38. A User Equipment (UE) device comprising an application processor, a memory, one or more antennas, a wireless interface for allowing the application processor to communicate with another device, and a touch-screen display, the UE device including the apparatus of any of examples 32-37 or any other example.

[00212] Example 39. Machine readable storage media having machine executable instructions that, when executed, cause one or more processors of a User Equipment (UE) to perform an operation comprising: process a broadcast signal from the eNB, the broadcast signal indicating that the eNB supports Radio Resource Control (RRC) Connection

Reestablishment procedure for UEs supporting Control Plane (CP) Cellular Internet-of- Things (CIoT) Evolved Packet System (EPS) Optimization (CP CIoT EPS Optimization); and generate, for transmission to the eNB, an RRC Connection Reestablishment Request comprising a security token.

[00213] Example 40. The machine readable storage media of example 39 or any other example, wherein the operation comprises: indicate, via the RRC Connection

Reestablishment Request, that the UE supports CP CIoT EPS Optimization.

[00214] Example 41. The machine readable storage media of example 39 or any other example, wherein the eNB is a first eNB, and wherein the operation comprises: determine that a second eNB does not support RRC Connection Reestablishment procedure; and initiate a Non- Access Stratum (NAS) recovery process with the second eNB, instead of an RRC Connection Reestablishment Request, in response to the UE moving to a coverage area of the second eNB.

[00215] Example 42. The machine readable storage media of examples 39-41 or any other example, wherein the operation comprises: generate, for transmission to the eNB, a message indicating that the UE supports CP CIoT EPS Optimization.

[00216] Example 43. The machine readable storage media of example 42 or any other example, wherein the message comprises one of a Message 3 RRC Connection

Reestablishment request, Media Access Control (MAC), or LI signaling.

[00217] Example 44. An apparatus of a first Evolved Node B (eNB) operable to communicate with a User Equipment (UE) on a wireless network, comprising: a memory to store instructions; and one or more processors to execute the instructions to perform an operation comprising: process a Radio Resource Control (RRC) Connection Reestablishment Request received from the UE; and process an indication that the UE supports Control Plane (CP) Cellular Internet-of-Things (CIoT) Evolved Packet System (EPS) Optimization (CP CIoT EPS Optimization.

[00218] Example 45. The apparatus of example 44 or any other example, wherein to process the indication, the one or more processors are to: process an X2 Application Protocol (X2AP) message from another eNB, the X2AP message comprising the indication.

[00219] Example 46. The apparatus of example 44 or any other example, wherein to process the indication, the one or more processors are to: process a message from the UE, the message from the UE comprising the indication.

[00220] Example 47. The apparatus of any of examples 44-46 or any other example, wherein the one or more processors are to: generate a broadcast signal indicating that the eNB supports Radio Resource Control (RRC) Connection Reestablishment procedure for UEs supporting CP CIoT EPS Optimization. [00221] Example 48. An Evolved Node B (eNB) device comprising an application processor, a memory, one or more antenna ports, and an interface for allowing the application processor to communicate with another device, the eNB device including the apparatus of any of examples 44-46 or any other example.

[00222] Example 49. Machine readable storage media having machine executable instructions that, when executed, cause one or more processors of an Evolved Node B (eNB) to perform an operation comprising: process a Radio Resource Control (RRC) Connection Re-establishment Request received from the UE; and process an indication that the UE supports Control Plane (CP) Cellular Internet-of-Things (CIoT) Evolved Packet System (EPS) Optimization (CP CIoT EPS Optimization).

[00223] Example 50. The machine readable storage media of example 49 or any other example, wherein the operation comprises: process an X2 Application Protocol (X2AP) message from another eNB, the X2AP message comprising the indication.

[00224] Example 51. The machine readable storage media of any of examples 49 or any other example, wherein the operation comprises: process a message from the UE, the message from the UE comprising the indication.

[00225] Example 52. The apparatus of any of examples 49-51 or any other example, wherein the one or more processors are to: generate a broadcast signal indicating that the eNB supports Radio Resource Control (RRC) Connection Reestablishment procedure for UEs supporting CP CIoT EPS Optimization.

[00226] Example 53. A method of operating a User Equipment (UE), comprising: generating a security token; and generating a Radio Resource Control (RRC) message for transmission to a first eNB, in response to the UE detecting a Radio Link Failure (RLF) in communication with a second eNB, the RRC message comprising the security token.

[00227] Example 54. The method of example 53 or any other example, further comprising: outputting the RRC message to a transceiver, for transmission to the first eNB.

[00228] Example 55. The method of example 53 or any other example, wherein: the security token is generated at a Non-Access Stratum (NAS) layer of the UE; and the security token is provided from the NAS layer to an Access Stratum (AS) layer of the UE.

[00229] Example 56. The method of example 53 or any other example, wherein generating the security token comprises: generating the security token at a Non-Access Stratum (NAS) layer of the UE, based on NAS security key material.

[00230] Example 57. The method of example 56 or any other example, further comprising: processing signals received from a Mobility Management Entity (MME) via the second eNB, the signals comprising the NAS security key material for generating the security token.

[00231]

[00232] Example 58. The method of any of examples 54-57 or any other example, wherein the RRC message comprises an RRC Connection Re-establishment Request for transmission to the first eNB.

[00233] Example 59. The method of any of examples 54-57 or any other example, further comprising: detecting the RLF in communication with the second eNB, in response to the UE moving from a coverage area of the second eNB to a coverage area of the first eNB.

[00234] Example 60. The method of any of examples 54-57 or any other example, wherein the security token is a first security token, and wherein the method comprises: generating a first version of a second security token, based on the first security token being used in the RRC message transmitted to the first eNB, wherein a Mobility Management Entity (MME) is to generate a second version of the second security token for transmission to the first eNB.

[00235] An abstract is provided that will allow the reader to ascertain the nature and gist of the technical disclosure. The abstract is submitted with the understanding that it will not be used to limit the scope or meaning of the claims. The following claims are hereby incorporated into the detailed description, with each claim standing on its own as a separate embodiment.

Claims

CLAIMS We claim:

1. An apparatus of a User Equipment (UE) operable to communicate with a first Evolved Node B (eNB) and a second eNB on a wireless network, comprising:

one or more processors to:

generate a security token, and

generate a Radio Resource Control (RRC) message for transmission to the first eNB, in response to the UE detecting a Radio Link Failure (RLF) in communication with the second eNB, the RRC message comprising the security token; and

a memory to store the security token.

2. The apparatus of claim 1, further comprising:

an interface for outputting the RRC message to a transceiver for transmission to the first eNB.

3. The apparatus of claim 1, wherein:

the security token is generated at a Non- Access Stratum (NAS) layer of the UE; and the security token is provided from the NAS layer to an Access Stratum (AS) layer of the UE.

4. The apparatus of claim 1, wherein to generate the security token, the one or more processors are to:

generate the security token at a Non- Access Stratum (NAS) layer of the UE, based on NAS security key material.

5. The apparatus of claim 4, wherein the one or more processors are to:

process signals received from a Mobility Management Entity (MME) via the second eNB, the signals comprising the NAS security key material for generating the security token.

6. The apparatus of any of claims 1-5, wherein the RRC message comprises an RRC Connection Re-establishment Request for transmission to the first eNB.

7. The apparatus of any of claims 1-5, wherein the one or more processors are to: detect the RLF in communication with the second eNB, in response to the UE moving from a coverage area of the second eNB to a coverage area of the first eNB.

8. The apparatus of any of claims 1-5, wherein the security token is a first security token, and wherein the one or more processors are to:

generate a first version of a second security token, based on the first security token being used in the RRC message transmitted to the first eNB,

wherein a Mobility Management Entity (MME) is to generate a second version of the second security token for transmission to the first eNB.

9. Machine readable storage media having machine executable instructions that, when executed, cause one or more processors of a User Equipment (UE) to perform an operation comprising:

generate a security token; and

generate a Radio Resource Control (RRC) message for transmission to a first eNB, in response to the UE detecting a Radio Link Failure (RLF) in communication with a second eNB, the RRC message comprising the security token

10. The machine readable storage media of claim 9, wherein the operation comprises: output the RRC message to a transceiver, for transmission to the first eNB.

11. The machine readable storage media of claim 9, wherein:

the security token is generated at a Non- Access Stratum (NAS) layer of the UE; and the security token is provided from the NAS layer to an Access Stratum (AS) layer of the UE.

12. The machine readable storage media of claim 9, wherein to generate the security token, the operation comprises:

generate the security token at a Non- Access Stratum (NAS) layer of the UE, based on NAS security key material.

13. The machine readable storage media of claim 12, wherein the operation comprises: process signals received from a Mobility Management Entity (MME) via the second eNB, the signals comprising the NAS security key material for generating the security token.

14. The machine readable storage media of any of claims 9-13, wherein the RRC message comprises an RRC Connection Re-establishment Request for transmission to the first eNB.

15. The machine readable storage media of any of claims 9-13, wherein the operation comprises:

detect the RLF in communication with the second eNB, in response to the UE moving from a coverage area of the second eNB to a coverage area of the first eNB.

16. The machine readable storage media of any of claims 9-13, wherein the security token is a first security token, and wherein the operation comprises:

generate a first version of a second security token, based on the first security token being used in the RRC message transmitted to the first eNB,

wherein a Mobility Management Entity (MME) is to generate a second version of the second security token for transmission to the first eNB.

17. An apparatus of an Evolved Node B (eNB) operable to communicate with a User Equipment (UE) on a wireless network, comprising:

one or more processors to:

access a first security token generated at a Mobility Management Entity

(MME),

access a second security token generated at the UE,

compare the first security token and the second security token, and authenticate the UE, based at least in part on the comparison of the first security token and the second security token; and

a memory to store one or both the first security token or the second security token.

18. The apparatus of claim 17, wherein the one or more processors are to:

process a Radio Resource Control (RRC) Connection Re-establishment Request from the UE, the RRC Connection Re-establishment Request comprising the second security token generated at the UE.

19. The apparatus of claim 17, wherein the one or more processors are to: process an X2 Application Protocol (X2AP) message from another eNB, the X2AP message comprising the first security token generated at the MME.

20. The apparatus of claim 17, wherein the one or more processors are to:

process a message comprising an Access Stratum (AS) context of the UE, the message comprising the first security token generated at the MME.

21. An apparatus of a User Equipment (UE) operable to communicate with an Evolved Node B (eNB) on a wireless network, comprising:

one or more processors to:

process a broadcast signal from the eNB, the broadcast signal indicating that the eNB supports Radio Resource Control (RRC) Connection Reestablishment procedure for UEs supporting Control Plane (CP) Cellular Internet-of-Things (CIoT) Evolved Packet System (EPS) Optimization (CP CIoT EPS Optimization), and

generate, for transmission to the eNB, an RRC Connection Reestablishment Request comprising a security token; and

a memory to store the security token.

22. The apparatus of claim 21, wherein the one or more processors are to:

indicate, via the RRC Connection Reestablishment Request, that the UE supports CP CIoT EPS Optimization.

23. The apparatus of claim 21, wherein the eNB is a first eNB, and wherein one or more processors are to:

determine that a second eNB does not support RRC Connection Reestablishment procedure; and

initiate a Non-Access Stratum (NAS) recovery process with the second eNB, instead of an RRC Connection Reestablishment Request, in response to the UE moving to a coverage area of the second eNB.

24. The apparatus of any of claims 21-23, wherein the one or more processors are to: generate, for transmission to the eNB, a message indicating that the UE supports CP

CIoT EPS Optimization.

25. The apparatus of any of claims 21 -23, wherein the message comprises one of a Message 3 RRC Connection Reestablishment request, Media Access Control (MAC), or LI signaling.