WO2021026911A1

WO2021026911A1 - Radio communication

Info

Publication number: WO2021026911A1
Application number: PCT/CN2019/100861
Authority: WO
Inventors: Benoist Sebire; Chunli Wu; Samuli Turtinen
Original assignee: Nokia Shanghai Bell Co., Ltd.; Nokia Solutions And Networks Oy; Nokia Technologies Oy
Priority date: 2019-08-15
Filing date: 2019-08-15
Publication date: 2021-02-18
Also published as: EP4014537A4; CN114270926A; EP4014537A1; CN114270926B

Abstract

An apparatus comprising means for: monitoring transport of the at least one logical data channel configured with integrity protection; and in dependence upon monitoring, temporarily stopping transport of the at least one logical data channel configured with integrity protection.

Description

RADIO COMMUNICATION

TECHNOLOGICAL FIELD

Embodiments of the present disclosure relate to radio communication. In particular, embodiments of the present disclosure relate to use of integrity protection for radio communications in a cellular network.

BACKGROUND

Integrity protection of a logical data channel comprises generating a cryptographic checksum that enables receiver-based authentication of the data transmitted via the logical data channel.

The cryptographic checksum can, for example, be produced by a cryptographic function using a cryptographic key and inputs dependent upon a message conveyed by the logical data channel, a synchronized time value, and a sequence number order.

The receiver can, for example, use the same cryptographic key and cryptographic function to produce its own version of the cryptographic checksum, using its own tracked values of synchronization time value and sequence order, and the received message. Verification of the receiver-produced checksum against the received checksum authenticates the received message.

In 3GPP, at present, the synchronized time value is a 28 bit hyperframe number HFN, the sequence number is the RRC message sequence number (the PDCP SN) , the cryptographic checksum is the message authentication code MAC-I, the cryptographic key is the integrity key IK and the cryptographic function is f9.

New Radio expands the usage of Radio Access Network (RAN) integrity protection (IP) to the user plane. Integrity protection can be configured per data radio bearer (per logical data channel) .

Because IP is a computing-intensive task, a data rate limit is imposed in 3GPP.

The current 3GPP proposals entrust the network with guaranteeing that the maximum integrity protection data rate does not exceed the maximum supported data rate for integrity protection (the limit) . The maximum supported data rate per user equipment (UE) for integrity protection is communicated by the UE to the network

In radio communication systems, the radio spectrum is a scarce resource, and utilizing it efficiently is desirable.

The network cannot reliably schedule logical data channels individually. It could be difficult to guarantee that the integrity protection data rate limit will not be reached.

In 3GPP, the User Plane Security Enforcement information provides the radio access network (RAN) with User Plane security policies for a PDU session. It indicates whether UP integrity protection is:

- Required: for all the traffic on the PDU Session UP integrity protection shall apply.

- Preferred: for all the traffic on the PDU Session UP integrity protection should apply.

- Not Needed: UP integrity protection shall not apply on the PDU Session.

Once determined at the establishment of the PDU Session the User Plane Security Enforcement information applies for the life time of the PDU Session.

The User Plane Security Enforcement information for the user plane of a PDU session is based on:

- subscribed User Plane Security Policy or User Plane Security Policy in the network ; and

- the maximum supported data rate per UE for integrity protection for the DRBs, provided by the UE in the Integrity protection maximum data rate IE during PDU Session Establishment.

BRIEF SUMMARY

According to various, but not necessarily all, embodiments there is provided an apparatus comprising means for:

monitoring transport of at least one logical data channel configured with integrity protection; and

in dependence upon monitoring, temporarily stopping transport of the at least one logical data channel configured with integrity protection.

According to various, but not necessarily all, embodiments there is provided an apparatus comprising:

at least one processor; and

at least one memory including computer program code

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to perform

monitoring transport of at least one logical data channel configured with integrity protection ; and

According to various, but not necessarily all, embodiments there is provided

a method comprising:

According to various, but not necessarily all, embodiments there is provided computer program instructions for causing an apparatus to perform at least the following or for performing at least the following:

monitoring transport of the at least one logical data channel configured with integrity protection; and

In some but not necessarily all examples, monitoring transport of the at least one logical data channel configured with integrity protection comprises monitoring transport of multiple logical data channels configured with integrity protection.

In some but not necessarily all examples, temporarily stopping transport of the at least one logical data channel configured with integrity protection comprises temporarily stopping transport of the multiple logical data channels configured with integrity.

In some but not necessarily all examples, monitoring transport of the at least one logical data channel configured with integrity protection and in dependence upon monitoring, temporarily stopping transport of the at least one logical data channel configured with integrity protection, are performed within a logical channel prioritization procedure.

In some but not necessarily all examples, the logical channel prioritization comprises: token-based allocation of resources to logical data channels in a decreasing priority order; and prioritization-based allocation of remaining resources to logical data channels in decreasing priority order.

In some but not necessarily all examples, the token-based allocation to a logical data channel is dependent upon an allocation token bucket (Bj) for that logical data channel and comprises maintaining an allocation token bucket (Bj) , for each logical data channel j, that is increased with time to a maximum value and is reduced as a consequence of resource allocation to the respective logical data channel

In some but not necessarily all examples, a rate of increase of an allocation token bucket (Bj) is different for different logical data channels (j) .

In some but not necessarily all examples, the maximum value of an allocation token bucket (Bj) is different for different logical data channels (j) .

In some but not necessarily all examples, the monitoring comprises comparing resource allocation for integrity protection against a constrained allowed use value.

In some but not necessarily all examples, the constrained allowed use value is dependent upon a maximum integrity protection bit rate for the apparatus.

In some but not necessarily all examples, the constrained allowed use value is a common value for all integrity protected logical data channels.

In some but not necessarily all examples, the monitoring comprises maintaining an integrity protection token bucket (B _IP) that is increased with time to a maximum value and is reduced as a consequence of resource allocation of a logical data channel corresponding to a radio bearer configured with integrity protection.

In some but not necessarily all examples, the integrity protection token bucket is for the apparatus not for each logical data channel.

In some but not necessarily all examples, integrity protection of a logical data channel comprises generating a cryptographic checksum that enables receiver-based authentication of data in the logical data channel.

In some but not necessarily all examples, the cryptographic checksum is produced using a cryptographic key and cryptographic function that has inputs dependent upon a message for conveyance via the logical data channel, a synchronized time value, and a sequence order.

In some but not necessarily all examples, the apparatus is configured as mobile equipment for use in cellular network or user equipment configured for use in cellular network.

According to various, but not necessarily all, embodiments there is provided examples as claimed in the appended claims.

BRIEF DESCRIPTION

Some example embodiments will now be described with reference to the accompanying drawings in which:

FIG. 1 shows an example embodiment of the subject matter described herein;

FIG. 2 shows another example embodiment of the subject matter described

FIG. 3 shows another example embodiment of the subject matter described

FIG. 4 shows another example embodiment of the subject matter described

FIG. 5A, 5B, 5C show example embodiments of the subject matter described

FIG. 6A shows another example embodiment of the subject matter described

FIG. 6B shows another example embodiment of the subject matter described herein.

DETAILED DESCRIPTION

Fig 1 illustrates an example of a network 100 comprising a plurality of network nodes including terminal nodes 110, access nodes 120 and one or more core nodes 130. The terminal nodes 110 and access nodes 120 communicate with each other. The one or more core nodes 130 communicate with the access nodes 120.

The one or more core nodes 130 may, in some examples, communicate with each other. The one or more access nodes 120 may, in some examples, communicate with each other.

The network 100 may be a cellular network comprising a plurality of cells 122 each served by an access node 120. In this example, the interface between the terminal nodes 110 and an access node 120 defining a cell 122 is a wireless interface 124.

The access node 120 is a cellular radio transceiver. The terminal nodes 110 are cellular radio transceivers.

In the example illustrated the cellular network 100 is a third generation Partnership Project (3GPP) network in which the terminal nodes 110 are user equipment (UE) and the access nodes 120 are base stations.

In the particular example illustrated the network 100 is an Universal Terrestrial Radio Access network (UTRAN) . The UTRAN consists of UTRAN NodeBs 120, providing the UTRA user plane and control plane (RRC) protocol terminations towards the UE 110. The NodeBs 120 are interconnected with each other and are also connected by means of the interface 128 to the Mobility Management Entity (MME) 130.

The term ‘user equipment’ is used to designate mobile equipment with or without a smart card for authentication/encryption etc such as a user identity module (UIM) .

The NodeB can be any suitable base station. A base station is an access node. It can be a network element in radio access network responsible for radio transmission and reception in one or more cells to or from the user equipment.

The UTRAN can be a 3G, 4G or 5G network, for example. It can for example be a New Radio (NR) network that uses gNB as access nodes 120. New radio is the 3GPP name for 5G technology.

Fig 2 illustrates a method 200 comprising:

at block 202, monitoring transport of at least one logical data channel configured with integrity protection; and at block 204, in dependence upon monitoring, temporarily stopping transport of the at least one logical data channel configured with integrity protection.

Transport of the at least one logical data channel configured with integrity protection resumes at a later time, for example, at the next transmission.

The method 200, can for example, be performed by a terminal node 110, for example user equipment.

The method therefore provides a terminal-based mechanism to limit integrity protected uplink transmission from the terminal node 110 to an access node 120. The method avoids resource wastage when using integrity protection.

In some but not necessarily all examples, the method comprises:

monitoring transport of multiple logical data channels configured with integrity protection; and

in dependence upon the monitoring, temporarily stopping transport of the multiple logical data channels configured with integrity protection.

In some but not necessarily all examples, monitoring transport of one or more logical data channels configured with integrity protection comprises comparing resource allocation to integrity protection against a constrained allowed use value e.g. B _IP. The constrained allowed use value can be dependent upon a maximum bit rate for the terminal node 110.

The constrained allowed use value can represent average allowed use and can increase over time if integrity protection is not used. The constrained allowed use value can be constrained so that it does not exceed a maximum value.

In some but not necessarily all examples, the constrained allowed use value is a common value used for all integrity protected logical data channels. It is a value per terminal node 110, rather than per logical data channel.

In a 3GPP implementation, a Radio Resource Control (RRC) configures radio bearers with integrity protection. The radio bearers reach a MAC entity as logical channels after going through PDCP and RLC. The MAC entity allocates resources (transport channels) for the logical channels configured with integrity protection and other logical channels. The MAC entity creates transport blocks for transmission via a physical layer. If the monitoring indicates that there has been too much resource allocation to integrity protection, that is to logical channels/bearers configured with integrity protection, then the MAC entity temporarily stops enabling transport of logical channels configured with integrity protection. The MAC entity temporarily stops including logical channels configured with integrity protection in transport blocks for transmission. The MAC entity resumes including logical channels configured with integrity protection in transport blocks for the next transmission.

FIG 3 illustrates how the method 300 can be incorporated within logical channel prioritization.

Thus monitoring transport of one or more logical data channels configured with integrity protection and in dependence upon monitoring, temporarily stopping transport of the one or more logical data channels configured with integrity protection, are performed within a logical channel prioritization procedure 300.

The logical channel prioritization 300 comprises token-based allocation of resources. The method 300 refers to valid token (s) .

In the absence of an integrity protection requirement, during a first stage, there is token-based allocation of resources to logical data channels in a decreasing priority order. The allocation occurs once to each logical data channel during the first stage. The token-based allocation is based on a per logical data channel token bucket Bj. The valid token (s) are Bj. The validity is defined with respect to a threshold.

In the absence of an integrity protection requirement, during a subsequent second stage, there is prioritization-based allocation of remaining resources to logical data channels in decreasing priority order. The prioritization-based allocation is independent of the tokens used in the token-based allocation of resources. There are no valid tokens.

During the first stage, in the presence of an integrity protection requirement, the token-based allocation is based on a per logical channel token bucket Bj and on a per terminal node integrity protection bucket B _IP. The valid token (s) are Bj and B _IP. The validity of each is defined with respect to a different threhold.

During the subsequent second stage, in the presence of an integrity protection requirement, there is prioritization-based allocation of of remaining resources to logical data channels in decreasing priority order, however, the allocation of integrity protected logical channel is still a token-based allocation of resources. The valid token (s) is and B _IP. The validity is defined with respect to a threhold.

This approach ensures both controlled sharing of resources and prioritization of resources while managing interity protection allocation.

Fig 4 illustrates a table 400 that defines examples of valid token (s) .

During the first stage, for a logical data channel with no integrity protection requirement the valid tokens are Bj>0 (the allocation is both priority based and single-token based) and for a logical data channel with integrity protection requirement the valid tokens are Bj>0 and B _IP>0 (the allocation is both priority based and dual-token based) .

During the second stage, for a logical data channel with no integrity protection requirement there are no valid tokens (the allocation is only priority based, not token based) and for a logical data channel with integrity protection requirement the valid tokens are Bj>0 and B _IP>0 (the allocation is both priority based and single token based) .

The terminal node variables Bj are used by the terminal node 110 for the Logical channel prioritization procedure. The variable Bj, is a token bucket maintained for each logical channel j.

The token-based allocation to a logical data channel is dependent upon an allocation token bucket Bj for that logical data channel and comprises maintaining an allocation token bucket Bj for each logical data channel that is increased with time to a maximum value and is reduced as a consequence of resource allocation to the respective logical data channel.

The rate of increase is different for different logical data channels. A prioritized bit rate (PBR) is configured per bearer, i.e. per Logical data channel (LCH) . The PBR ensures that high priority LCHs are scheduled first while avoiding the starvation of lower priority ones.

The maximum value is different for different logical data channels. A paramter bucketSizeDuration can set the Bucket Size Duration (BSD) . The maximum value is the product of BSD and PBR (BSD *PBR) . Thus the maximum value is proportional to the rate of increase (PBR) .

The network schedules uplink data by signalling for each logical channel: priority where an increasing priority value indicates a lower priority level, prioritisedBitRate which sets the Prioritized Bit Rate (PBR) , bucketSizeDuration which sets the Bucket Size Duration (BSD) .

The method 300 introduces an integrity protection token bucket B _IP for controlling allocation of integrity protected logical data channels.

The terminal node variable B _IP is used by the terminal node 110 for the Logical channel prioritization procedure. The variable B _IP, is a token bucket maintained for the terminal node 110 (not, in this example, for each logical channel j) .

The token-based allocation to a logical data channel is dependent upon not only an allocation token bucket Bj for that logical data channel but also an integrity protection token bucket B _IP

The token-based allocation comprises not only maintaining an allocation token bucket Bj for each logical data channel that is increased with time to a maximum value and is reduced as a consequence of resource allocation to the respective logical data channel but also maintaining the integrity protection token bucket B _IP for all logical data channels in common that is increased with time to a maximum value and is reduced as a consequence of resource allocation to an integrity protected logical data channel.

The rate of increase of the integrity protection token bucket (IPR) is the IP bit rate limit (which can either be configured via RRC in case there is processing limit at the receiving side at the network or be derived from UE’s IP capability) .

The integrity protection token bucket size duration BSD is used to calculate the integrity protection token bucket limit (which can either be configured via RRC as for other buckets or fixed in the specification) .

The maximum value is the product of BSD and IPR (BSD *IPR) .

The monitoring 202, described in relation to FIG 2, comprises maintaining an integrity protection token bucket B _IP that is increased with time to a maximum value and is reduced as a consequence of resource allocation to logical channels configured with integrity protection.

The IP token bucket is configured for the IP bit rate limit and every radio bearer configured with IP uses tokens from the same bucket.

When the bucket is empty, a radio bearer configured with IP cannot be scheduled and LCP either selects data from other LCH of radio bearer that does not require IP, if any, to fill up the grant.

If there is no data for other LCHs, then optionally, padding (without integrity protection) can be sent.

Referring back to the example method 300 illustrated in FIG 3, the Logical Channel Prioritization procedure starts, at block 302, when a new transmission is to be performed. In this example, the terminal node 110 has an uplink (UL) grant of resources.

At block 304, the required token (s) are updated. This includes the tokens Bj and, if there is a requirement for integrity protection, B _IP.

Bj and B _IP are initialized to zero when the related logical channel is established.

At block 306, the next logical data channel for allocation is selected (the current logical data channel j) . This is the next logical data channel in priority order that has a valid token for logical data channel allocation and has a resource allocation requirement.

At block 308, if there is an allocation of resources to the current logical data channel j, the valid token (s) are adjusted. For example, the valid token (s) are each decremented by the size of the allocation.

At block 310, if there are no resources for allocation the method 300 ends, otherwise it proceeds to block 312.

At block 312, if the current logical data channel j is not the lowest priority logical data channel with valid token (s) for channel allocation, then the method returns 312 to block 306. In this way, the method 300 during the first stage performs a constrained allocation of resources to all logical data channels with a resource allocation requirement in priority order (subject to there being sufficient resources) . The allocation is constrained, for each logical data channel independently using a token-based allocation.

At block 312, if the current logical data channel j is the lowest priority logical data channel with valid token (s) for channel allocation then the first stage ends. The method 300 moves to block 314 to perform the second stage. The valid token (s) are redefined and the method returns 303 to block 306 but starting again at the highest priority logical data channel.

Thus in the method 300, in the first stage, the allocation is constrained, for each logical data channel that does not require integrity protection by a single allocation token per channel and the allocation is constrained, for each logical data channel that does require integrity protection by a single allocation token per channel and a single integrity protection token per terminal node 110. Thus in the method 300, in the second stage, the allocation, for each logical data channel that does not require integrity protection is not constrained by a single allocation token per channel and the allocation is constrained, for each logical data channel that does require integrity protection by a single allocation token per channel and a single integrity protection token per terminal node.

FIG 5A illustrates an example of block 304. At block 304, the required token (s) are updated. This includes the tokens Bj and, if there is a requirement for integrity protection, B _IP.

For each logical channel j, the terminal node 110 shall:

1> increment Bj by the product PBR × T before every instance of the LCP procedure, where T is the time elapsed since Bj was last incremented and PBR is Prioritized Bit Rate of logical channel j.

1> if the value of Bj is greater than the maximum bucket size (i.e. PBR ×BSD) :

2> set Bj to the maximum bucket size.

The value of Bj can never exceed the maximum bucket size and if the value of Bj is larger than the maximum bucket size of logical channel j, it shall be set to the maximum bucket size. The maximum allocation bucket size of a logical channel is equal to PBR × BSD.

For each integrity protected logical data channel j, the UE shall:

1> increment B _IP by the product IPR × T before every instance of the LCP procedure, where T is the time elapsed since B _IP was last incremented.

1> if the value of B _IP is greater than the maximum bucket size (i.e. IPR ×BSD) :

2> set B _IP to the maximum bucket size.

The value of B _IP can never exceed the maximum bucket size and if the value of B _IP j is larger than the maximum bucket size, it shall be set to the the maximum bucket size. The maximum IP bucket size is equal to IPR × BSD.

FIG 5B illustrates an example of block 306. At block 306, the next logical data channel for allocation is selected (the current logical data channel j) . This is the next logical data channel in priority order that has valid token (s) for logical data channel allocation and has a resource allocation requirement.

In this example, valid token (s) for a logical data channel without a requirement for integrity protection is B _j >0.

In this example, valid token (s) for a logical data channel with a requirement for integrity protection is B _j >0 AND B _IP >0.

FIG 5C illustrates an example of block 308. At block 308, if there is an allocation of resources to the current logical data channel j, the valid token (s) are is adjusted. For example, the valid token (s) are each decremented by the size of the allocation.

For example:

Bj is decremented by the total size of MAC SDUs served to logical channel j

B _IP is decremented by the total size of MAC SDUs served to integrity protected logical channel j

While B _IP is below the threshold value (B _IP ≤0) , allocation of resurces to any integrity protected logical channels is suspended.

Thus B _IP is a token bucket variable which is increased when time elapses and decreased whenever data from a bearer/LCH requiring IP is processed/included.

It ensures the MAC layer would not require more data that requires IP from PDCP than the UE can process. As the IP processing limit is per UE, the token is a common one of all the bearers that require integrity protection. The token bucket will become empty when some of the bearers consume all the IP processing capability and the terminal node 110 is considered unable to perform integrity protection for further data from other bearers, or even the same bearer.

Possible adaptations to the currently proposed 3GPP specification are highlighted using bold and underlined font:

Note that the change in 5.4.3.1.2 is not strictly needed but eases the allocation of resources in 5.4.3.1.3.

Fig 6A illustrates an example of a controller 400. Implementation of a controller 400 may be as controller circuitry. The controller 400 may be implemented in hardware alone, have certain aspects in software including firmware alone or can be a combination of hardware and software (including firmware) .

As illustrated in Fig 6A the controller 400 may be implemented using instructions that enable hardware functionality, for example, by using executable instructions of a computer program 406 in a general-purpose or special-purpose processor 402 that may be stored on a computer readable storage medium (disk, memory etc) to be executed by such a processor 402.

The processor 402 is configured to read from and write to the memory 404. The processor 402 may also comprise an output interface via which data and/or commands are output by the processor 402 and an input interface via which data and/or commands are input to the processor 402.

The memory 404 stores a computer program 406 comprising computer program instructions (computer program code) that controls the operation of the apparatus 110 when loaded into the processor 402. The computer program instructions, of the computer program 406, provide the logic and routines that enables the apparatus 110, comprising the controller 400, to perform the methods illustrated in Figs 1 to 5C. The processor 402 by reading the memory 404 is able to load and execute the computer program 406.

The apparatus 110 therefore comprises:

at least one processor 402; and

at least one memory 404 including computer program code the at least one memory 404 and the computer program code configured to, with the at least one processor 402, cause the apparatus 10 at least to perform:

As illustrated in Fig 6B, the computer program 406 may arrive at the apparatus 110 via any suitable delivery mechanism 410. The delivery mechanism 410 may be, for example, a machine readable medium, a computer-readable medium, a non-transitory computer-readable storage medium, a computer program product, a memory device, a record medium such as a Compact Disc Read-Only Memory (CD-ROM) or a Digital Versatile Disc (DVD) or a solid state memory, an article of manufacture that comprises or tangibly embodies the computer program 406. The delivery mechanism may be a signal configured to reliably transfer the computer program 406. The apparatus 110 may propagate or transmit the computer program 406 as a computer data signal.

Computer program instructions for causing an apparatus to perform at least the following or for performing at least the following:

The computer program instructions may be comprised in a computer program, a non-transitory computer readable medium, a computer program product, a machine readable medium. In some but not necessarily all examples, the computer program instructions may be distributed over more than one computer program.

Although the memory 404 is illustrated as a single component/circuitry it may be implemented as one or more separate components/circuitry some or all of which may be integrated/removable and/or may provide permanent/semi-permanent/dynamic/cached storage.

Although the processor 402 is illustrated as a single component/circuitry it may be implemented as one or more separate components/circuitry some or all of which may be integrated/removable. The processor 402 may be a single core or multi-core processor.

References to ‘computer-readable storage medium’ , ‘computer program product’ , ‘tangibly embodied computer program’ etc. or a ‘controller’ , ‘computer’ , ‘processor’ etc. should be understood to encompass not only computers having different architectures such as single /multi-processor architectures and sequential (Von Neumann) /parallel architectures but also specialized circuits such as field-programmable gate arrays (FPGA) , application specific circuits (ASIC) , signal processing devices and other processing circuitry. References to computer program, instructions, code etc. should be understood to encompass software for a programmable processor or firmware such as, for example, the programmable content of a hardware device whether instructions for a processor, or configuration settings for a fixed-function device, gate array or programmable logic device etc.

As used in this application, the term ‘circuitry’ may refer to one or more or all of the following:

(a) hardware-only circuitry implementations (such as implementations in only analog and/or digital circuitry) and

(b) combinations of hardware circuits and software, such as (as applicable) :

(i) a combination of analog and/or digital hardware circuit (s) with software/firmware and

(ii) any portions of hardware processor (s) with software (including digital signal processor (s) ) , software, and memory (ies) that work together to cause an apparatus, such as a mobile phone or server, to perform various functions and

(c) hardware circuit (s) and or processor (s) , such as a microprocessor (s) or a portion of a microprocessor (s) , that requires software (e.g. firmware) for operation, but the software may not be present when it is not needed for operation.

This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor and its (or their) accompanying software and/or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit for a mobile device or a similar integrated circuit in a server, a cellular network device, or other computing or network device.

The blocks illustrated in the Figs 2, 3, 5 may represent steps in a method and/or sections of code in the computer program 406. The illustration of a particular order to the blocks does not necessarily imply that there is a required or preferred order for the blocks and the order and arrangement of the block may be varied. Furthermore, it may be possible for some blocks to be omitted.

In some applications the messages are configured for providing data to a vehicle or from a vehicle. In some applications a message comprises sensor data. In some applications a message is configured for controlling an autonomous vehicle or assisting user control of a vehicle.

Where a structural feature has been described, it may be replaced by means for performing one or more of the functions of the structural feature whether that function or those functions are explicitly or implicitly described.

The above described examples find application as enabling components of: automotive systems; telecommunication systems; electronic systems including consumer electronic products; distributed computing systems; media systems for generating or rendering media content including audio, visual and audio visual content and mixed, mediated, virtual and/or augmented reality; personal systems including personal health systems or personal fitness systems; navigation systems; user interfaces also known as human machine interfaces; networks including cellular, non-cellular, and optical networks; ad-hoc networks; the internet; the internet of things; virtualized networks; and related software and services.

The term ‘comprise’ is used in this document with an inclusive not an exclusive meaning. That is any reference to X comprising Y indicates that X may comprise only one Y or may comprise more than one Y. If it is intended to use ‘comprise’ with an exclusive meaning then it will be made clear in the context by referring to “comprising only one. . ” or by using “consisting” .

In this description, reference has been made to various examples. The description of features or functions in relation to an example indicates that those features or functions are present in that example. The use of the term ‘example’ or ‘for example’ or ‘can’ or ‘may’ in the text denotes, whether explicitly stated or not, that such features or functions are present in at least the described example, whether described as an example or not, and that they can be, but are not necessarily, present in some of or all other examples. Thus ‘example’ , ‘for example’ , ‘can’ or ‘may’ refers to a particular instance in a class of examples. A property of the instance can be a property of only that instance or a property of the class or a property of a sub-class of the class that includes some but not all of the instances in the class. It is therefore implicitly disclosed that a feature described with reference to one example but not with reference to another example, can where possible be used in that other example as part of a working combination but does not necessarily have to be used in that other example.

Although embodiments have been described in the preceding paragraphs with reference to various examples, it should be appreciated that modifications to the examples given can be made without departing from the scope of the claims.

Features described in the preceding description may be used in combinations other than the combinations explicitly described above.

Although functions have been described with reference to certain features, those functions may be performable by other features whether described or not.

Although features have been described with reference to certain embodiments, those features may also be present in other embodiments whether described or not.

The term ‘a’ or ‘the’ is used in this document with an inclusive not an exclusive meaning. That is any reference to X comprising a/the Y indicates that X may comprise only one Y or may comprise more than one Y unless the context clearly indicates the contrary. If it is intended to use ‘a’ or ‘the’ with an exclusive meaning then it will be made clear in the context. In some circumstances the use of ‘at least one’ or ‘one or more’ may be used to emphasis an inclusive meaning but the absence of these terms should not be taken to infer and exclusive meaning.

The presence of a feature (or combination of features) in a claim is a reference to that feature or (combination of features) itself and also to features that achieve substantially the same technical effect (equivalent features) . The equivalent features include, for example, features that are variants and achieve substantially the same result in substantially the same way. The equivalent features include, for example, features that perform substantially the same function, in substantially the same way to achieve substantially the same result.

In this description, reference has been made to various examples using adjectives or adjectival phrases to describe characteristics of the examples. Such a description of a characteristic in relation to an example indicates that the characteristic is present in some examples exactly as described and is present in other examples substantially as described.

Whilst endeavoring in the foregoing specification to draw attention to those features believed to be of importance it should be understood that the Applicant may seek protection via the claims in respect of any patentable feature or combination of features hereinbefore referred to and/or shown in the drawings whether or not emphasis has been placed thereon.

Claims

An apparatus comprising means for:

monitoring transport of at least one logical data channel configured with integrity protection; and

in dependence upon monitoring, temporarily stopping transport of the at least one logical data channel configured with integrity protection.
An apparatus as claimed in claim 1, wherein monitoring transport of the at least one logical data channel configured with integrity protection comprises monitoring transport of multiple logical data channels configured with integrity protection; and

wherein temporarily stopping transport of the at least one logical data channel configured with integrity protection comprises

temporarily stopping transport of the multiple logical data channels configured with integrity protection.
An apparatus as claimed in any preceding claim, wherein:

monitoring transport of the at least one logical data channel configured with integrity protection and

in dependence upon monitoring, temporarily stopping transport of the at least one logical data channel configured with integrity protection, are performed within a logical channel prioritization procedure.
An apparatus as claimed in claim 3, wherein the logical channel prioritization comprises:

token-based allocation of resources to logical data channels in a decreasing priority order; and

prioritization-based allocation of remaining resources to logical data channels in decreasing priority order.
An apparatus as claimed in claim 4, wherein the token-based allocation to a logical data channel is dependent upon an allocation token bucket for that logical data channel and comprises maintaining an allocation token bucket, for each logical data channel, that is increased with time to a maximum value and is reduced as a consequence of resource allocation to the respective logical data channel.
An apparatus as claimed in claim 5, wherein a rate of increase of an allocation token bucket is different for different logical data channels.
An apparatus as claimed in claim 5 or 6, wherein the maximum value of an allocation token bucket is different for different logical data channels.
An apparatus as claimed in any preceding claim, wherein the monitoring comprises comparing resource allocation for integrity protection against a constrained allowed use value.
An apparatus as claimed in claim 8, wherein the constrained allowed use value is dependent upon a maximum integrity protection bit rate for the apparatus.
An apparatus as claimed in claim 9, wherein the constrained allowed use value is a common value for all integrity protected logical data channels.
An apparatus as claimed in any preceding claim, wherein the monitoring comprises maintaining an integrity protection token bucket that is increased with time to a maximum value and is reduced as a consequence of resource allocation of a logical data channel corresponding to a radio bearer configured with integrity protection.
An apparatus as claimed in claim 1, wherein the integrity protection token bucket is for the apparatus not for each logical data channel.
An apparatus as claimed in any preceding claim, wherein integrity protection of a logical data channel comprises generating a cryptographic checksum that enables receiver-based authentication of data in the logical data channel.
An apparatus as claimed claim 13, wherein the cryptographic checksum is produced using a cryptographic key and cryptographic function that has inputs dependent upon a message for conveyance via the logical data channel, a synchronized time value, and a sequence order.
An apparatus as claimed in any preceding claim configured as mobile equipment for use in cellular network or user equipment configured for use in cellular network.
A method comprising:

monitoring transport of at least one logical data channel configured with integrity protection ; and

in dependence upon monitoring, temporarily stopping transport of the at least one logical data channel configured with integrity protection.
An apparatus comprising:

at least one processor; and

at least one memory including computer program code

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to perform

monitoring transport of at least one logical data channel configured with integrity protection ; and

in dependence upon monitoring, temporarily stopping transport of the at least one logical data channel configured with integrity protection.
Computer program instructions for causing an apparatus to perform at least the following or for performing at least the following:

monitoring transport of the at least one logical data channel configured with integrity protection; and

in dependence upon monitoring, temporarily stopping transport of the at least one logical data channel configured with integrity protection.