WO2025212969A1

WO2025212969A1 - Managing security configuration and activation for inter-central unit lower layer triggered mobility

Info

Publication number: WO2025212969A1
Application number: PCT/US2025/023065
Authority: WO
Inventors: Chih-Hsiang Wu
Original assignee: Google LLC
Current assignee: Google LLC
Priority date: 2024-04-04
Filing date: 2025-04-03
Publication date: 2025-10-09
Anticipated expiration: 2026-10-04

Abstract

A method implemented by a source base station can include receiving a request related to a lower layer triggered mobility (LTM) of a user equipment (UE). The communication can indicate at least one LTM candidate cell associated with a candidate base station. The method can include transmitting, subsequent to the request, LTM candidate configuration information including security information for at least one LTM candidate cell. Other methods, systems and apparatuses are described.

Description

MANAGING SECURITY CONFIGURATION AND ACTIVATION FOR INTER- CENTRAE UNIT LOWER LAYER TRIGGERED MOBILITY

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to and the benefit of the filing date of provisional U.S. Patent Application No. 63/574,857 entitled “Managing Security Configuration and Activation for Inter-Central Unit Lower Layer Triggered Mobility,” filed on April 4, 2024. The entire content of the provisional application is hereby expressly incorporated herein by reference.

FIELD OF THE DISCLOSURE

[0002] This disclosure relates to wireless communications and, more particularly, to configuring security configuration and activation for inter-central unit (inter-CU) lower layer triggered mobility.

BACKGROUND

[0003] This background description is provided for the purpose of generally presenting the context of the disclosure. Work of the presently named inventors, to the extent it is described in this background section, as well as aspects of the description that may not otherwise qualify as prior art at the time of filing, are neither expressly nor impliedly admitted as prior art against the present disclosure.

[0004] Generally speaking, a base station operating a cellular radio access network (RAN) communicates with a user equipment (UE) using a certain radio access technology (RAT) and multiple layers of a radio protocol stack. For example, the physical layer (PHY) of a RAT provides transport channels to the Medium Access Control (MAC) sublayer, which in turn provides logical channels to the Radio Link Control (RLC) sublayer, and the RLC sublayer in turn provides data transfer services to the Packet Data Convergence Protocol (PDCP) sublayer.

[0005] The PDCP sublayer of the radio protocol stack provides services such as transfer of user-plane data, ciphering, integrity protection, etc. For example, the PDCP layer defined for the Evolved Universal Terrestrial Radio Access (EUTRA) radio interface (see 3GPP specification TS 36.323) and New Radio (NR) (see 3GPP specification TS 38.323) provides sequencing of protocol data units (PDUs) in the uplink direction (from a user device, also known as a user equipment (UE), to a base station) as well as in the downlink direction (from the base station to the UE). Further, the PDCP sublayer provides signaling radio bearers (SRBs) and data radio bearers (DRBs) to the Radio Resource Control (RRC) sublayer. Generally speaking, the UE and a base station can use SRBs to exchange RRC messages as well as non-access stratum (NAS) messages and can use DRBs to transport data on a user plane.

[0006] The UE can concurrently utilize resources of multiple RAN nodes (e.g., base stations or components of a distributed base station), interconnected by a backhaul. When the multiple RAN nodes support different radio access technologies (RATs), this type of connectivity is referred to as Multi-Radio Dual Connectivity (MR-DC). When a UE operates in MR-DC, one base station operates as a master node (MN) that covers a primary cell (PCell), and the other base station operates as a secondary node (SN) that covers a primary secondary cell (PSCell). The UE communicates with the MN (via the PCell) and the SN (via the PSCell). In other scenarios, the UE utilizes resources of one base station at a time. One base station and/or the UE can determine that the UE should establish a radio connection with a second base station. For example, one base station can determine to hand the UE over to the second base station, and the base station can initiate a handover procedure.

[0007] When the UE moves from the coverage area of one cell to another cell in a RAN, the RAN performs a serving cell change by configuring the UE to transmit Layer 3 (L3) measurement results. Based on L3 measurement results received from the UE, the RAN transmits an RRC reconfiguration message configuring Reconfiguration with Synchronization (e.g., the RRC reconfiguration message includes a ReconfigurationWithSync IE) for change of the serving cell (e.g., PCell or PSCell). When the UE operates in carrier aggregation (CA) of at least one secondary cell (SCell) with the PCell or PSCell, the RAN releases the at least one SCell due to the change of the PCell or PSCell. The serving cell change involves complete L2 (and LI) resets, leading to longer latency, larger overhead, and longer interruption time. To address these concerns, 3GPP recently proposed procedures referred to as lower layer triggered mobility (LTM).

[0008] During RAN communication with the UE via a serving cell associated with the base station, the base station receives one or more layer 3 (e.g., RRC) measurement results from the UE. Based on the layer 3 (L3) measurement result(s), the base station determines to configure an LTM candidate cell for LTM cell switch. To configure the LTM candidate cell for the UE, the base station transmits an LTM candidate configuration to the UE via RRC signaling. Subsequently, the base station receives one or more layer 1 (LI) measurement results from the UE. Based on the one or more LI measurement result(s), the base station determines that the LTM candidate cell qualifies to be a serving cell for the UE. After making this determination, the base station transmits an LTM Cell Switch Command to the UE to command the UE to perform the LTM cell switch to the LTM candidate cell. The UE performs a cell change from the serving cell to the LTM candidate cell in response to the LTM Cell Switch Command. The base station includes a central unit (CU) and one or more distributed units (DUs). One of the DU(s) operating the serving cell is referred to as a serving DU. If the LTM candidate cell is operated by the serving DU, the LTM cell switch is an intra- CU intra-DU LTM cell switch. If the LTM candidate cell is operated by a candidate DU (C- DU) in the DU(s), the LTM cell switch is an intra-CU inter-DU LTM cell switch. 3GPP has enabled the intra-CU intra-DU LTM cell switch and intra-CU inter-DU LTN cell switch in Release 18 specifications. However, it is not clear how devices should handle inter-CU LTM cell switches. In addition, security should be considered and configured for inter-CU LTM cell switches.

SUMMARY

[0009] A method implemented by a candidate base station comprises receiving, from a source base station (S-BS), a request related to a lower layer triggered mobility (LTM) of a user equipment (UE) from a serving cell of the S-BS to a candidate cell of the C-BS, the request including security information; and transmitting, to the S-BS, a request acknowledgement including a security configuration, the security configuration being based on the security information.

[0010] In another implementation, a method implemented by a source base station comprises: transmitting, to a candidate base station (C-BS), a request related to a lower layer triggered mobility (LTM) of a user equipment (UE) from a serving cell of the S-BS to a candidate cell of the C-BS, the request including security information; receiving, from the C- BS, a request acknowledgement; and providing, to the UE, a security configuration corresponding to the candidate cell, the security configuration being based on the security information.

[0011] In yet another implementation, a method implemented by a user equipment (UE) comprises: transmitting, to a radio access network (RAN) node and in accordance with a security configuration, a report related to a lower layer triggered mobility (LTM) to an LTM candidate cell; receiving, subsequent to transmitting the report, a configuration message configuring the LTM candidate cell for the UE; and deriving at least a portion of security information for the LTM candidate cell subsequent to switching to the LTM candidate cell.

BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Fig. 1A is a block diagram of an example system in which a radio access network (RAN) and a user device can implement the techniques of this disclosure for managing security related to lower layer triggered mobility (LTM);

[0013] Fig. IB is a block diagram of an example base station including a centralized unit (CU) and a distributed unit (DU) that can operate in the system of Fig. 1 A;

[0014] Fig. 2A is a block diagram of an example protocol stack according to which the UE of Fig. 1A communicates with base stations;

[0015] Fig. 2B is a block diagram of an example protocol stack according to which the UE of Fig. 1A communicates with a CU and a DU;

[0016] Fig. 3 is a message sequence diagram of an example scenario in which a UE performs an intra-CU intra-DU LTM procedure;

[0017] Fig. 4 is a message sequence diagram of an example scenario in which a UE performs an intra-CU inter-DU LTM procedure;

[0018] Fig. 5 is a message sequence diagram of an example scenario in which a UE performs an inter-CU LTM procedure and receives a security configuration from the source BS;

[0019] Fig. 6A is a flow diagram of an example method in a source base station (S-BS) for LTM configuration, which includes receiving an LTM candidate configuration and a security configuration from a candidate base station (C-BS) and configuring the UE with the security configuration;

[0020] Fig. 6B is a flow diagram of another example method implemented in an S-BS for LTM configuration, which includes receiving an LTM candidate configuration from a C-SB, generating a security configuration and the S-BS, and configuring the UE with the security configuration; [0021] Fig. 7A is a flow diagram of an example method implemented in a C-BS for LTM configuration, which includes transmitting, to an S-BS, an LTM candidate configuration along with a security configuration;

[0022] Fig. 7B is a flow diagram of another example method implemented in a C-BS for LTM configuration, which includes transmitting, to an S-BS, an LTM candidate configuration but not a security configuration;

[0023] Fig. 8 illustrates an example method implemented in a RAN node configuring a UE with an LTM candidate configuration, which includes determining whether to include a security configuration depending on the LTM type;

[0024] Fig. 9A is a flow diagram of an example method implemented in a C-BS or target BS for generating a handover acknowledge message, including determining whether to include a security configuration depending on the handover type;

[0025] Fig. 9B is a flow diagram of an example method similar to that of Fig. 9A, but in which the C-BS or target BS also generates the security configuration;

[0026] Fig. 10 is a flow diagram of an example method implemented in a RAN node for communicating with a UE using a first and a second security keys prior to and after an LTM cell switch, respectively;

[0027] Fig. 11 is a flow diagram of an example method implemented in a UE for communicating with a RAN node using a first and a second security keys prior to and after an LTM cell switch, respectively;

[0028] Fig. 12 is a flow diagram of an example method implemented in a RAN node for communicating with a UE prior to and after an LTM cell switch, including determining whether to derive a new security key based on whether the serving cell and the LTM cell candidate cell are associated with the same BS;

[0029] Fig. 13A is a flow diagram of an example method implemented in a UE for communicating with a RAN node prior to and after an LTM cell switch, including determining whether to derive a new security key based on whether the serving cell and the LTM cell candidate cell have different security IDs;

[0030] Fig. 13B is a flow diagram of an example method implemented in a UE for communicating with a RAN node prior to and after an LTM cell switch, including determining whether to derive a new security key based on whether the UE received a security configuration for the candidate cells; and

[0031] Fig. 14 is a flow diagram of an example method implemented in a C-BS for security configuration.

DETAILED DESCRIPTION OF THE DRAWINGS

[0032] Techniques of the disclosure are directed to lower layer triggered mobility (LTM). LTM enables serving cell change via L1/L2 signaling, while keeping configuration of the upper layers and minimizing changes of configuration of the lower layers. Procedures are available for performing LTM cell switches between cells served by different base stations (e.g., inter-CU LTM), where the UE may be in DC with the two base stations. Aspects of this disclosure further provide techniques for LTM cell switches between different CUs, and for security configurations related to inter-CU LTM switches.

[0033] Referring first to Fig. 1A, an example wireless communication system 100 that can implement one or more of these techniques. The wireless communication system 100 includes a UE 102, a base station (BS) 104A, a base station 106A and a core network (CN) 110. The base stations 104A, 106A can operate in a radio access network (RAN) 105. The UE 102 initially connects to the base station 104A. In some scenarios, the base station 104A can perform an SN addition to configure the UE 102 to operate in dual connectivity (DC) with the base station 104A and the base station 106A. The base stations 104A and 106A operate as an MN and an SN for the UE 102, respectively.

[0034] In various configurations of the wireless communication system 100, the base station 104A can operate as a master eNB (MeNB) or a master gNB (MgNB), and the base station 106 A can operate as a secondary gNB (SgNB). The UE 102 can communicate with the base station 104A and the base station 106A via the same RAT such as EUTRA or NR, or different RATs. When the base station 104A is an MeNB and the base station 106 A is an SgNB, the UE 102 can be in EUTRA-NR DC (EN-DC) with the MeNB and the SgNB.

[0035] In various configurations of the wireless communication system 100, the base station 104A can operate as a master eNB (MeNB) or a master gNB (MgNB), and the base station 106 A can operate as a secondary gNB (SgNB). The UE 102 can communicate with the base station 104A and the base station 106A via the same RAT such as EUTRA or NR, or different RATs. When the base station 104A is an MeNB and the base station 106 A is an SgNB, the UE 102 can be in EUTRA-NR DC (EN-DC) with the MeNB and the SgNB.

[0036] When the UE 102 hands over from the base station 104A to the base station 106A, the base stations 104A and 106A operate as the source base station (S-BS) and a target base station (T-BS), respectively. The UE 102 can operate in DC with the base station 104A and an additional base station (not shown in Fig. 1A) for example prior to the handover. The UE 102 can continue to operate in DC with the base station 106 A and the additional base station, or the UE can operate in single connectivity (SC) with the base station 106A, after completing the handover. In the latter case, the base stations 104A and 106A operate as a source MN (S-MN) and a target MN (T-MN), respectively.

[0037] A core network (CN) 110 can be an evolved packet core (EPC) 111 or a fifthgeneration core (5GC) 160, both of which are depicted in Fig. 1A, although the CN can support other cores. The base station 104A can be an eNB supporting an SI interface for communicating with the EPC 111, an ng-eNB supporting an NG interface for communicating with the 5GC 160, or a gNB that supports an NR radio interface as well as an NG interface for communicating with the 5GC 160. To directly exchange messages with each other during the scenarios discussed below, the base stations 104A and 106A can support an X2 or an Xn interface.

[0038] As illustrated in Fig. 1A, the base station 104A supports cell 124A, and the base station 106A supports a cell 126. The cells 124A and 126 can partially overlap, so that the UE 102 can communicate in DC with the base station 104A and the base station 106 A, where one of the base stations 104A and 106A is an MN and the other is an SN. The base station 104A can support additional cell(s) such as cells 124B, and the base station 106A can support additional cell(s) (not shown in Fig. 1A). The cells 124A and 124B can partially overlap, so that the UE 102 can communicate in carrier aggregation (CA) with the base station 104A. The base station 104A can operate the cells 124A and 124B via one or more transmit and receive points (TRPs). More particularly, when the UE 102 is in DC with the base station 104A and the base station 106 A, one of the base stations 104A and 106 A operates as an MeNB, an Mng-eNB or an MgNB, and the other operates as an SgNB or an Sng-eNB.

[0039] In general, the RAN 105 can include any suitable number of base stations supporting NR cells and/or EUTRA cells. More particularly, the EPC 111 or the 5GC 160 can be connected to any suitable number of base stations supporting NR cells and/or EUTRA cells. An example configuration in which the CN 110 is connected to additional base stations is discussed below with reference to Fig. IB. Although the examples below refer specifically to specific CN types (EPC, 5GC) and RAT types (5G NR and EUTRA), in general the techniques of this disclosure also can apply to other suitable radio access and/or core network technologies such as sixth generation (6G) radio access and/or 6G core network or 5G NR- 6G DC.

[0040] With continued reference to Fig. 1A, the base station 104A includes processing hardware 130 that can include one or more general-purpose processors (e.g., CPUs) and a non-transitory computer-readable memory storing instructions that the one or more general- purpose processors execute. Additionally or alternatively, the processing hardware 130 can include special-purpose processing units. The processing hardware 130 can include a PHY controller 132 configured to transmit data and control signals on physical downlink (DL) channels and DL reference signals to one or more user devices (e.g., UE 102) via one or more cells (e.g., the cell(s) 124A, 124B) and/or one or more TRPs. The PHY controller 132 is also configured to receive data and control signals on physical uplink (UL) channels and/or UL reference signals from the one or more user devices via one or more cells (e.g., the cell(s) 124A, 124B) and/or one or more TRPs. The processing hardware 130 in an example implementation includes a MAC controller 134 configured to perform MAC functions with one or more user devices. The MAC functions include a random access (RA) procedure, managing UL timing advance (TA) for the one or more user devices, and/or communicating UL/DL MAC PDUs with the one or more user devices. The MAC functions include lower layer triggered mobility (LTM, also referred to herein as Ll/L2-triggered mobility or low layer triggered mobility) related functions as described below. In examples, the LTM Controller 137 can implement LTM functions in coordination or through signaling with MAC controller 134. The processing hardware 130 can further include an RRC controller 136 to implement procedures and messaging at the RRC sublayer of the protocol communication stack. Lor example, the RRC controller 132 may be configured to support RRC messaging associated with handover procedures, and/or to support the necessary operations when the base station 104A operates as an MN relative to an SN or as an SN relative to an MN. When the base station 104A is a distributed base station, a CU LTM Controller 137 A can operate in a CU, and a DU LTM Controller 137B can operate in a DU (see Eig. 1C). The base station 106 can include processing hardware 140 that is similar to processing hardware 130. In particular, components 142, 144, 146, and 147 can be similar to the components 132, 134, 136, and 137 respectively.

[0041] The UE 102 includes processing hardware 150 that can include one or more general-purpose processors such as CPUs and non-transitory computer-readable memory storing machine-readable instructions executable on the one or more general-purpose processors, and/or special-purpose processing units. The PHY controller 152 is also configured to receive data and control signal on physical DL channels and/or DL reference signals from the base station 104A or 106A via one or more cells (e.g., the cell(s) 124A, 124B, and/or 126) and/or one or more TRPs. The PHY controller 152 is also configured to transmit data and control signal on physical UL channels and/or UL reference signals to the base station 104A or 106A via one or more cells (e.g., the cell(s) 124A, 124B, and/or 126) and/or one or more TRPs. The processing hardware 150 in an example implementation includes a MAC controller 154 configured to perform MAC functions with base station 104A or 106A. For example, the MAC functions include a random-access procedure, managing UL timing advance for the one or more user devices, and communicating UL/DL MAC PDUs with the base station 104A or 106A. In another example, the MAC functions include LTM related functions as described below. The processing hardware 150 can further include an RRC controller 156 to implement procedures and messaging at the RRC sublayer of the protocol communication stack.

[0042] In operation, the UE 102 in DC can use a radio bearer (e.g., a DRB or an SRB) that at different times terminates at the MN 104A or the SN 106A. The UE 102 can apply one or more security keys when communicating on the radio bearer, in the uplink (UL) (from the UE 102 to a base station) and/or downlink (from a base station to the UE 102) direction. UEs can use several types of SRBs and DRBs. When operating in DC, the cells associated with the base station operating the MN define a master cell group (MCG), and the cells associated with the base station operating as SN define the secondary cell group (SCG). For example, a first type of SRB resource, referred to as SRB1 resources, carry RRC messages, which in some cases include NAS messages over the dedicated control channel (DCCH). A second type of SRB resource, referred to as SRB2 resources, support RRC messages that include logged measurement information or NAS messages, also over the DCCH but with lower priority than SRB1 resources. More generally, SRB1 and SRB2 resources allow the UE and the MN to exchange RRC messages related to the MN and to embed RRC messages related to the SN. The SRB1 and SRB2can be referred to as MCG SRBs. SRB3 resources allow the UE and the SN to exchange RRC messages related to the SN and can be referred to as SCG SRBs. Split SRBs allow the UE to exchange RRC messages directly with the MN via lower layer resources of the MN and the SN. Further, DRBs using the lower-layer resources of only the MN can be referred as MCG DRBs, DRBs using the lower-layer resources of only the SN can be referred as SCG DRBs, and DRBs using the lower-layer resources of both the MCG and the SCG can be referred to as split DRBs.

[0043] Fig. IB depicts an example distributed or disaggregated implementation of any one or more of the base station(s) shown in Fig. 1A (e.g., base station 104A or 106A). In this implementation, the base station includes a central unit (CU) 172 and one or more DUs 174. The CU 172 includes processing hardware such as one or more general-purpose processors (e.g., CPUs) and non-transitory computer-readable memory storing machine-readable instructions executable on the one or more general-purpose processors, and/or specialpurpose processing units. In one example, the CU 172 includes the processing hardware 130. In another example, the CU 172 includes the processing hardware 140. The processing hardware 140 in an example implementation includes an SN RRC controller 142 configured to manage or control one or more RRC configurations and/or RRC procedures when the base station 106 operates as an SN.

[0044] Each of the DUs 174A includes processing hardware that can include one or more general-purpose processors (e.g., CPUs) and non-transitory computer-readable memory storing machine-readable instructions executable on the one or more general-purpose processors, and/or special-purpose processing units. In some examples, the processing hardware includes a MAC controller (e.g., MAC controller 134, 144 (Fig. 1A)) configured to manage or control one or more MAC operations or procedures (e.g., a random access procedure) and a radio link control (REC) controller configured to manage or control one or more REC operations or procedures when the base station 106A operates as an MN or an SN. The processing hardware may also include a physical layer controller configured to manage or control one or more physical layer operations or procedures.

[0045] In some implementations, the CU 172 can include a logical node CU-CP 172A that hosts the control plane of the CU 172. The CU 172 can also include logical node(s) CU-UP 172B that hosts the user plane of the CU 172. The CU-CP 172A can transmit control information (e.g., RRC messages, Fl application protocol messages), and the CU-UP 172B can transmit the data packets (e.g., SDAP PDUs or Internet Protocol packets). [0046] The CU-CP 172A can be connected to multiple CU-UP 172B through the El interface. The CU-CP 172A selects the appropriate CU-UP 172B for the requested services for the UE 102. In some implementations, a single CU-UP 172B can be connected to multiple CU-CP 172A through the El interface. The CU-CP 172A can be connected to one or more DU(s) 174 through an Fl-C or Wl-C interface. The CU-UP 172B can be connected to one or more DU 174 through an Fl-U or Wl-U interface under the control of the same CU-CP 172A. In some implementations, one DU 174 can be connected to multiple CU-UP 172B under the control of the same CU-CP 172A. In such implementations, the connectivity between a CU-UP 172B and a DU 174 is established by the CU-CP 172A using Bearer Context Management functions.

[0047] Fig. 2A illustrates, in a simplified manner, an example protocol stack 200 according to which the UE 102 can communicate with an eNB/ng-eNB 230 or a gNB 232 (e.g., one or more of the base stations 104A, 106A (Figs. 1A-1B).

[0048] In the example stack 200, a physical layer (PHY) 202A of EUTRA provides transport channels to the EUTRA MAC sublayer 204A, which in turn provides logical channels to the EUTRA RLC sublayer 206A. The EUTRA RLC sublayer 206A in turn provides RLC channels to an EUTRA PDCP sublayer 208 and, in some cases, to an NR PDCP sublayer 210. Similarly, the NR PHY 202B provides transport channels to the NR MAC sublayer 204B, which in turn provides logical channels to the NR RLC sublayer 206B. The NR RLC sublayer 206B in turn provides data transfer services to the NR PDCP sublayer 210. The NR PDCP sublayer 210 in turn can provide data transfer services to Service Data Adaptation Protocol (SDAP) 212 or a radio resource control (RRC) sublayer (not shown in Fig. 2A). The UE 102, in some implementations, supports both the EUTRA and the NR stack as shown in Fig. 2A, to support handover between EUTRA and NR base stations and/or to support DC over EUTRA and NR interfaces. Further, as illustrated in Fig. 2A, the UE 102 can support layering of NR PDCP 210 over EUTRA RLC 206 A, and SDAP sublayer 212 over the NR PDCP sublayer 210.

[0049] The EUTRA PDCP sublayer 208 and the NR PDCP sublayer 210 receive packets (e.g., from an Internet Protocol (IP) layer, layered directly or indirectly over the PDCP layer 208 or 210) that can be referred to as service data units (SDUs), and output packets (e.g., to the RLC layer 206A or 206B) that can be referred to as protocol data units (PDUs). Except where the difference between SDUs and PDUs is relevant, this disclosure for simplicity refers to both SDUs and PDUs as “packets.”

[0050] On a control plane, the EUTRA PDCP sublayer 208 and the NR PDCP sublayer 210 can provide signaling radio bearers (SRBs) or an RRC sublayer (not shown in Fig. 2A) to exchange RRC messages or non-access-stratum (NAS) messages, for example. On a user plane, the EUTRA PDCP sublayer 208 and the NR PDCP sublayer 210 can provide Data Radio Bearers (DRBs) to support data exchange. Data exchanged on the NR PDCP sublayer 210 can be SDAP PDUs, Internet Protocol (IP) packets or Ethernet packets.

[0051] Fig. 2B illustrates, in a simplified manner, an example protocol stack 250, on which the UE 102 can communicate with a DU (e.g., DU 174) and a CU (e.g., CU 172). The radio protocol stack 200 is functionally split as shown by the radio protocol stack 250 in Fig. 2B. The CU at any of the base stations 104 or 106 can hold all the control and upper layer functionalities (e.g., RRC 214, SDAP 212, NR PDCP 210), while the lower layer operations (e.g., NR RLC 206B, NR MAC 204B, and NR PHY 202B) are delegated to the DU. To support connection to a 5GC, NR PDCP 210 provides SRBs to RRC 214, and NR PDCP 210 provides DRBs to SDAP 212 and SRBs to RRC 214.

[0052] Next, with reference to Figs. 3-5, several example scenarios in which a base station operating in the system of Fig. 1 A transmits a configuration to the UE 102 and later activates a configuration for communication between the UE 102 and the base station. Generally speaking, similar events in Figs. 3-5 are labeled with similar reference numbers that share two least significant digits, with differences discussed below where appropriate. For example, event 302 is similar to event 402 of Fig. 4 and event 502 of Fig. 5, and event 390 is similar to event 490 of Fig. 4 and event 590 of Fig. 5. With the exception of the differences shown in the figures and discussed below, any of the other implementations discussed with respect to a particular event (e.g., for messaging and processing) may apply to events labeled with similar reference numbers in other figures.

[0053] Referring first to Fig. 3, in a scenario 300, the base station 104A includes a CU 172 and a DU 174, and the DU 174 operates the cell 124A. The UE 102 initially communicates 302 with the DU 174 on a serving cell (e.g., the cell 124A), using a serving DU configuration, and communicates 302 with the CU 172 via the DU 174, using a serving CU configuration. The DU 174 is a serving or a source DU (S-DU) for the UE 102. In other words, the DU 174 is a serving DU (S-DU) that communicates with the UE 102. In some implementations, the UE 102 in carrier aggregation (CA) communicates with the DU 174 on the cell 124A and other cell(s) (e.g., cell(s) not shown in Fig. 1A) using the serving DU configuration. The DU 174 operates the other cell(s). The cell 124A and/or the other cell(s) are serving cell(s) for the UE 102. In other implementations, the UE 102 in communicates with the DU 174 on the cell 124A only (e.g., not on other cell(s)). In some implementations, the UE 102 communicates with the DU 174 on the cell 124A and/or other cell(s) (i.e., serving cell(s)) via one or multiple TRPs. In the following description, events 394, 324, 350, 352, 354, and 326 occur on the serving cell(s). In some implementations, the cell 124A can be a PCell. In such cases, the other cell(s) include SCell(s) and/or additional cell(s) associated with the PCell or an Scell. In other implementations, the cell 124A can be an Scell, and one of the other cell(s) is a PCell. In such cases, the additional cell(s) include(s) SCell(s) and/or additional cell(s) associated with the PCell or an Scell. In the following description, the base station 104A can include the DU 174, the CU 172 or both the DU 174 and CU 172.

[0054] In the event 302, the UE 102 can transmit UL PDUs and/or UL control signals to the base station 104 on the cell 124A and/or other cell(s) via one or multiple TRPs. In some implementations, the UE 102 communicates UL PDUs and/or DL PDUs with the base station 104 via radio bearers which can include SRBs and/or DRB(s). The base station 104 can configure the radio bearers to the UE 102. To transmit each of the UL PDUs, the UE 102 applies one or more security functions (e.g., integrity protection and/or encryption) to the UL data packet to generate a security-protected UL data packet, using at least one security key (e.g., integrity protection key and/or encryption key) and at least one security algorithm (e.g., integrity protection algorithm and/or encryption algorithm), and includes the security- protected data packet in the UL PDU. When the CU 172 receives a UL PDU from the UE 102 via the DU 174, the CU 172 retrieves a security -protected UL data packet from the UL PDU and applies one or more security functions (e.g., decryption and/or integrity check) to the security-protected UL data packet to obtain a UL data packet, using at least one security key (e.g., integrity protection key and/or encryption key) and at least one security algorithm (e.g., integrity protection algorithm and/or encryption algorithm). In some implementations, UL control signals include UL control information, channel state information, hybrid automatic repeat request (HARQ) acknowledgements (ACKs), HARQ negative ACKs, scheduling request(s) and/or sounding reference signal(s). Similarly, the UE 102 can receive DL PDUs and/or DL control signals from the base station 104 on the cell 124A and/or other cell(s) via one or multiple TRPs. In some implementations, the DL control signals include downlink control information (DCIs) and reference signals (e.g., synchronization signal block, channel state information reference signal(s) (CSI-RS(s)), and/or tracking reference signal(s)). The base station 104 can transmit the DCIs on physical downlink control channel(s) (PDCCH(s)) monitored by the UE 102, on the cell 124A and/or other cell(s) via one or multiple TRPs. To transmit each of the DL PDUs, the CU 172 applies one or more security functions (e.g., integrity protection and/or encryption) to a DL data packet to generate a security-protected DL data packet, using at least one security key (e.g., integrity protection key and/or encryption key), and includes the DL security-protected packet in the DL PDU. When the UE 102 receives a DL PDU from the CU 172 via the DU 174, the UE 102 retrieves a security -protected DL data packet from the DL PDU and applies one or more security functions (e.g., decryption and/or integrity check) to the security-protected data packet to obtain a DL data packet, using at least one security key and at least one security algorithm (e.g., integrity protection algorithm and/or encryption algorithm). In some implementations, the security key(s) used by the CU 172 is/are the same as the security key(s) used by the UE 102. In other implementations, the security key(s) used by the CU 172 is/are different from the security key(s) used by the UE 102.

[0055] The security function(s) can include an integrity protection and/or encryption function, and the security key(s) can include an integrity key and an encryption key for integrity protection/check and encryption/decryption, respectively. When integrity protection is enabled, a transmitter (i.e., one of the UE 102 and the CU 172) can generate a message authentication code for integrity (MAC-I) to protect integrity of the (UL or DL) data packet, using an integrity key and an integrity algorithm. Thus, the transmitter in this case generates a security -protected (UL or DL) packet including the data packet and the MAC-I. When encryption is enabled, the transmitter can encrypt the UL or DL data packet to obtain an encrypted packet, using an encryption key and an encryption algorithm, so that the security- protected packet includes the encrypted data packet. When both integrity protection and encryption are enabled, the transmitter can generate a MAC-I for protecting integrity of the data, using an integrity key and an integrity algorithm and encrypt the data along with the MAC-I to generate an encrypted packet and an encrypted MAC-I, using an encryption key and an encryption algorithm. The transmitter can then transmit the security-protected packet to a receiver (i.e., the other of the UE 102 and the CU 172). When the encryption is enabled, the receiver decrypts the security-protected packet to obtain a data packet using an encryption key (e.g., same as or different from the encryption key used by the transmitter) and an encryption algorithm (e.g., same as or different from the encryption algorithm used by the transmitter). When the integrity protection is enabled, the receiver performs an integrity check on the security -protected packet using an integrity key (e.g., same as the integrity key used by the transmitter) and an integrity algorithm (e.g., same as the integrity algorithm used by the transmitter). When the encryption and integrity protection are enabled, the receiver decrypts the security-protected packet to obtain an integrity-protected data packet, using an encryption key (e.g., same as or different from the encryption key) and an encryption algorithm (e.g., same as or different from the encryption algorithm used by the transmitter), and then performs an integrity check on the integrity-protected data packet using an integrity key (e.g., same as the integrity key used by the transmitter) and an integrity algorithm (e.g., same as or different from the integrity algorithm used by the transmitter). The security protection described above apply to measurement report(s), an RRC reconfiguration message, an RRC reconfiguration complete message, an RRC reconfiguration message and data communication in events 304, 318, 320, 336 and 340, respectively. In some implementations, the security key(s) include an integrity key for integrity protection of control-plane data packets such as RRC messages (e.g., events 304, 318, 320, and 336). In other implementations, the security key(s) include an encryption key for encryption/decryption of control-plane data packets such as RRC messages (e.g., events 304, 318, 320, and 336). In yet other implementations, the security key(s) include an integrity key for integrity protection of user-plane data packets (e.g., communicated via DRB(s)). In yet other implementations, the security key(s) include an encryption key for encryption/decryption of user-plane data packets (e.g., communicated via DRB(s)).

[0056] In some implementations, the serving DU configuration includes physical layer configuration parameters, MAC configuration parameters, and/or RLC configuration parameters. In some implementations, the serving DU configuration includes at least one first non-LTM transmission configuration indicator (TCI) state configuration for the serving cell(s). In some implementations, the DU 174 can transmit these configuration parameters and/or the first non-LTM TCI state configuration(s) to the CU 172. The CU 172 generates one or more messages (e.g., RRC reconfiguration message(s)) including the configuration parameters and/or the first non-LTM TCI state configuration(s), and the CU 172 transmits the one or more messages to the UE 102 via the DU 174. In other implementations, the DU 174 transmits the configuration parameters and/or the first non-LTM TCI state configuration(s) to the UE 102 directly. In some implementations, the serving DU configuration is CellGroupConfig IE defined in 3GPP specification 38.331. In other implementations, the serving DU configuration includes configuration parameters in the CellGroupConfig IE. In some implementations, the serving CU configuration includes PDCP configuration parameters, measurement configuration parameters, and/or radio bearer configuration parameters. In some implementations, the serving CU configuration includes a MeasConfig IE and/or a RadioBearerConfig IE defined in 3GPP specification 38.331, or the serving CU configuration includes configuration parameters in the MeasConfig IE and/or RadioBearerConfig IE. The radio configuration parameters or the RadioBearerConfig IE configures one or more DRBs. In some implementations, the serving DU configuration includes a CSl-MeasConfig IE or configuration parameters for channel state information (CSI) measurement and reporting. In other implementations, the serving CU configuration includes a CSl-MeasConfig IE or configuration parameters for CSI measurement and reporting. In some implementations, the UE 102 receives the serving CU configuration or the configuration parameters in the serving CU configuration from the CU 172 via the DU 174. In other implementations, the UE 102 receives a portion of the serving CU configuration and/or a portion of the serving DU configuration from a base station other than the base station 104A, and the UE receives the remaining portion of these configuration parameters from the base station 104A.

[0057] In some implementations, the DU 174 and the UE 102 communicate with each other using first non-LTM TCI state configuration(s), e.g., in the events 302, 318, 320, 324, 350, 354, and/or 326. In some implementations, the DU 174 transmits at least one first non- LTM TCI States Activation/Deactivation command (e.g., a MAC control element (CE)) to the UE 102 to activate the first non-LTM TCI state configuration(s). The UE 102 activates the first non-LTM TCI state configuration(s) in response to the first non-LTM TCI States Activation/Deactivation command(s). In some implementations, the DU 174 includes a serving cell ID (e.g., a serving cell index) in each of the first non-LTM TCI States Activation/Deactivation command(s) to identify the first non-LTM TCI state configuration(s). Each of the serving cell ID(s) indicates a respective serving cell of the serving cell(s). In some implementations, the serving DU configuration includes the serving cell ID(s), and the serving DU configures association(s) between the serving cell ID(s) and the first non-LTM TCI state configuration(s).

[0058] While communicating with the base station 104, the UE 102 transmits 304 at least one measurement report to the DU 174. In some implementations, the measurement report(s) includes measurement results for a serving cell (e.g., the cell 124A) of the UE 102 and/or at least one non-serving cell. For each of the measurement report(s), the DU 174 transmits 306 a DU-to-CU message including the measurement report to the CU 172. In some implementations, the DU-to-CU message(s) of the event 306 is/are Fl application protocol (F1AP) message(s) (e.g., UL RRC Message Transfer message(s)). The at least one serving cell includes the cell 124A and/or other cell(s), and the at least one non-serving cell includes the cell 124B and/or additional cell(s). In some implementations, the serving CU configuration includes at least one measurement configuration. In accordance with the measurement configuration(s), the UE 102 performs measurements and transmits 304 the measurement report(s) to the DU 174. In some implementations, the measurement configuration(s) includes Eayer 3 (E3) measurement configuration(s) (e.g., MeasConfig IE(s)) and the measurement report(s) include E3 measurement report(s).

[0059] After (e.g., in response to) receiving one or some of the measurement report(s) from the UE 102, the CU 172 determines to prepare a first cell (e.g., cell 1 such as the cell 124B) as an LTM candidate cell for the UE 102. In some implementations, the base station 104A determines to prepare the first cell for the UE 102 because the measurement report(s) indicates that the first cell could be used by the base station 104A to communicate with the UE 102. In some implementations, the base station 104A determines to prepare the first cell for the UE 102 because the measurement report(s) indicates that the first cell qualifies to be an LTM candidate cell that could be used for communication with the UE 102. In some implementations, if the L3 measurement report(s) indicates that the signal strength and/or the quality of the first cell is above a first predetermined threshold, is better than the signal strength and/or the quality of the serving cell (e.g., cell 124A as determined, e.g., through a comparison operation), and/or is better than the signal strength and/or the quality of the serving cell by a first predetermined threshold, the CU 172 determines to prepare the first cell for the UE 102. Alternatively, the CU 172 determines to prepare the first cell for the UE 102 regardless of whether a measure report is received from the UE 102.

[0060] In response to determining to prepare the first cell for LTM, the CU 172 transmits 308 a first CU-to-DU message to the DU 174 to prepare the first cell for the UE 102. In some implementations, the CU 172 includes a cell identity (ID) 1 of the first cell in the first CU-to- DU message to request the DU 174 to prepare the first cell for LTM for the UE 102. For example, the cell ID 1 includes cell global identity (CGI). In another example, the cell ID is a portion of the CGI. In yet another example, the cell ID is a physical cell ID (PCI). In some implementations, the CU 172 includes an LTM indicator in the first CU-to-DU message to indicate the DU 174 to prepare the first cell for LTM. In some implementations, the CU 172 includes the LTM indicator in an LTM Information Setup IE, and the CU 172 includes the LTM Information Setup IE in the first CU-to-DU message. In yet other implementations, the CU 172 includes the LTM indicator in an LTM Information Modify IE, and the CU 172 includes the LTM Information Modify IE in the first CU-to-DU message.

[0061] In response to the first CU-to-DU message, the DU 174 generates a first LTM DU configuration (referred to herein after as LTM DU configuration 1) for the UE 102, which configures the first cell for LTM. In some implementations, the CU 172 includes a first LTM configuration ID ( referred to herein after as LTM ID 1) in the first CU-to-DU message, and the DU 174 associates the LTM ID 1 and/or the cell ID 1 with the LTM DU configuration 1. The DU 174 then transmits 310 a first DU-to-CU message including the LTM DU configuration 1 to the CU 172 in response to the first CU-to-DU message.

[0062] The events 308 and 310 are collectively referred to in Fig. 3 as an LTM preparation procedure 390.

[0063] In some implementations, the DU 174 includes, in the first DU-to-CU message, the cell ID 1 of the first cell associated with the LTM DU configuration 1 to indicate that the LTM DU configuration 1 is configured for or associated with the first cell. When the CU 172 performs multiple LTM preparation procedures (e.g., the procedure 390 and the LTM preparation procedure 2, ..., N described below) with the DU 174 to prepare multiple LTM candidate cells, the CU 172 can determine that the LTM DU configuration 1 is configured for or associated with the first cell, based on the cell ID 1 in the first DU-to-CU message.

[0064] In some implementations, the CU 172 does not include an LTM reference DU configuration in the first CU-to-DU message. In such cases, the DU 174 generates an LTM reference DU configuration and includes the LTM reference DU configuration in the first DU-to-CU message. In some implementations, the DU 174 generates the LTM DU configuration 1 as a delta configuration to augment the LTM reference DU configuration. In other implementations, the DU 174 generates the LTM DU configuration 1 as a complete configuration, i.e., not merely to augment the LTM reference DU configuration.

[0065] In some implementations, the CU 172 includes an LTM reference DU configuration request in the first CU-to-DU message, and the DU 174 generates the LTM reference DU configuration, and the DU 174 includes the LTM reference DU configuration in the first DU- to-CU message in response to the request. In some implementations, the CU 172 determines whether the UE 102 supports an LTM reference configuration. In the context of implementations and as described in the 3GPP specification 38.331, a reference configuration is a configuration provided by the network to the UE that is common, within the same cell group, to a group of configured non-complete candidate configurations. A candidate configuration can include a complete candidate configuration or a delta configuration relative to the reference configuration. If the CU 172 determines that the UE 102 supports an LTM reference configuration, the CU 172 includes the LTM reference DU configuration request in the first CU-to-DU message. The DU 174 includes the LTM reference DU configuration in the first DU-to-CU message in response to the LTM reference DU configuration request. Otherwise, if the CU 172 determines that the UE 102 does not support an LTM reference configuration, the CU 172 does not include the LTM reference DU configuration request in the first CU-to-DU message. In this case, the DU 174 may generate the LTM DU configuration 1 as a complete configuration, and the DU 174 may not include a/the LTM reference DU configuration in the first DU-to-CU message. In other implementations, the CU 172 transmits an additional CU-to-DU message including the LTM reference DU configuration request to the DU 174, rather than transmitting the LTM reference DU configuration request in the first CU-to-DU message. In response, the DU 174 transmits, to the CU 172, an additional DU-to-CU message including the LTM reference DU configuration. In yet other implementations, the DU 174 determines whether the UE 102 supports an LTM reference configuration. If the DU 174 determines that the UE 102 supports an LTM reference configuration, the DU 174 includes the LTM reference DU configuration in the first DU-to-CU message. Otherwise, if the DU 174 determines that the UE 102 does not support an LTM reference configuration, the DU 174 does not include a/the LTM reference DU configuration in the first DU-to-CU message.

[0066] In some implementations, the CU 172 includes an LTM reference DU configuration in the first CU-to-DU message. In some implementations, the CU 172 receives the LTM reference DU configuration from an additional DU during an LTM preparation procedure as described above and with reference to Eig. 4. In other implementations, the CU 172 is preconfigured with the LTM reference DU configuration. In some implementations, the DU 174 generates the LTM DU configuration 1 as a delta configuration to augment the LTM reference DU configuration. In other implementations, the DU 174 ignores the LTM reference DU configuration and generates the LTM DU configuration 1 as a complete configuration, i.e., not merely to augment the LTM reference DU configuration.

[0067] If the DU 174 generates the LTM DU configuration 1 as a complete configuration, the DU 174 may include a complete configuration indication in the first DU-to-CU message to indicate that the LTM DU configuration 1 is a complete configuration. In some implementations, if the first CU-to-DU message does not include a/the LTM reference DU configuration, the CU 172 may determine that the LTM DU configuration 1 as a complete configuration. Otherwise, if the first CU-to-DU message includes an/the LTM reference DU configuration, the CU 172 may determine that the LTM DU configuration 1 is a delta configuration.

[0068] In some implementations, the LTM reference DU configuration is different from the serving DU configuration. In some implementations, a portion of the LTM reference DU configuration is the same as a portion of the serving DU configuration and the remainder of the LTM reference DU configuration is different from the other portions of the serving DU configuration. In yet other implementations, the LTM reference DU configuration is the same as the serving DU configuration. In some implementations, the LTM reference DU configuration includes physical layer configuration parameters, MAC configuration parameters, and/or RLC configuration parameters. In some implementations, the LTM reference DU configuration is the CellGroupConfig IE defined in 3GPP specification 38.331. In other implementations, the LTM reference DU configuration includes configuration parameters in the CellGroupConfig IE. In some implementations, the LTM reference DU configuration includes a CSl-MeasConfig IE or configuration parameters for channel state information (CSI) measurement and/or reporting.

[0069] In some implementations, the LTM reference DU configuration is different from the serving DU configuration. In some implementations, a portion of the LTM reference DU configuration is the same as a portion of the serving DU configuration, and the remainder of the LTM reference DU configuration is different from the other portions of the serving DU configuration. In other implementations, the LTM reference DU configuration is the same as the serving DU configuration.

[0070] To prepare the first cell as an LTM candidate cell for the UE 102, the CU 172 may transmit 312 a second CU-to-DU message to the DU 174, including a CSI resource configuration (e.g., CSI resource configuration 1) and/or an LTM synchronization signal block (SSB) configuration (i.e., LTM SSB configuration 1) to request the DU 174 to generate one or more CSI report configurations (e.g., (LTM) CSI report configuration(s) 1). The CSI resource configuration (e.g., (LTM) CSI resource configuration(s) 1) include configuration parameters configuring at least one reference signal (RS) transmitted on the first cell. The RS(s) include SSB(s) and/or CSLRS(s). The LTM SSB configuration include SSB configuration parameters configuring an SSB frequency, a subcarrier spacing, an SSB periodicity, SSB positions and/or SSB power for SSB(s) transmitted on the first cell.

[0071] After (e.g., in response to) receiving the CSI resource configuration, the DU 174 generates one or more CSI report configurations based on the CSI resource configuration and includes the CSI report configuration(s) in a serving DU configuration (referred to as a second serving DU configuration to distinguish from the serving DU configuration in event 302). In some implementations, the CSI report configuration(s) configures the UE 102 to transmit CSI reports based on measurements of the RS(s). The DU 174 transmits 314 a second DU-to-CU message including the second serving DU configuration to the CU 172. In some implementations, the CSI resource configuration comprises (e.g., is or includes) one or more LTM-CSl-ResourceConfig-rl8 IES. In other implementations, the CSI resource configuration comprises an Itm-CSl-ResourceConfigToAddModList field/IE. In some implementations, the second serving DU configuration is a CellGroupConfig IE.

[0072] In some implementations, the CU 172 includes the cell ID 1 and/or the LTM ID 1 in the second CU-to-DU message, (e.g., at event 312) In one implementation, the CU 172 includes the cell ID 1 and/or the LTM ID 1 in the second CU-to-DU message to indicate that the CSI resource configuration is/are associated with the first cell. In another implementation, the CU 172 includes the cell ID 1 and/or the LTM ID 1 in the second CU-to-DU message to allow for the DU 174 to associate the LTM ID 1 with the first cell, the cell ID 1, the LTM DU configuration 1, and/or the CSI report configuration(s). Based on the above implementation(s), the DU 174 can associate the LTM ID 1 and/or the cell ID 1 with configurations (e.g., LTM DU configuration 1, the CSI resource configuration, and/or the CSI report configuration(s)) related to the first cell. In such implementations, in some implementations, the CU 172 includes the LTM ID 1 in the first CU-to-DU message while in other implementations the CU 172 does not include the LTM ID 1 in the first CU-to-DU message. [0073] In some alternative implementations, the CU 172 includes the CSI resource configuration in the first CU-to-DU message and the DU 174 includes the CSI report configuration(s) in the first DU-to-CU message.

[0074] In some implementations, the DU 174 transmits the LTM SSB configuration or the SSB configuration parameters to the CU 172, e.g., in the first DU-to-CU message, the second DU-to-CU message or an additional DU-to-CU message. In some implementations, the DU 174 transmits the additional DU-to-CU message in response to receiving an additional CU-to- DU message from the CU 172. In other implementations, the DU 174 transmits the fourth DU-to-CU message (e.g., a UE Context Modification Required message) in response to receiving the first CU-to-DU message or the second CU-to-DU message.

[0075] The events 312 and 314 are collectively referred to in Fig. 3 as an LTM CSI report configuration and/or an LTM ID configuration procedure 392.

[0076] After receiving the first DU-to-CU message, the CU 172 generates a first LTM candidate configuration (i.e., LTM candidate configuration 1) including the LTM DU configuration 1 and generates a first RRC reconfiguration message including the LTM candidate configuration 1 and the LTM ID 1. In some implementations, the CU 172 includes LTM CU configuration 1 in the LTM candidate configuration 1. In other implementations, the CU 172 does not include an LTM CU configuration in the LTM candidate configuration 1. The CU 172 transmits 316 a third CU-to-DU message including the first RRC reconfiguration message to the DU 174. In turn, the DU 174 transmits 318 the first RRC reconfiguration message to the UE 102. In response, the UE 102 transmits 320 a first RRC reconfiguration complete message to the DU 174. The DU 174 then transmits 322 a third DU-to-CU message including the first RRC reconfiguration complete message to the CU 172.

[0077] If the first DU-to-CU message includes the LTM reference DU configuration, the CU 172 generates an LTM reference configuration including the LTM reference DU configuration. In such cases, the CU 172 may include the LTM reference configuration in the first RRC reconfiguration message. In some implementations, the CU 172 includes an LTM reference CU configuration in the LTM reference configuration. In such cases, the CU 172 may generate the LTM CU configuration 1 as a delta configuration based on the LTM reference CU configuration. In other implementations, the CU 172 does not include an LTM reference CU configuration in the LTM reference configuration. In such cases, the CU 172 may generate the LTM CU configuration 1 as a complete configuration. Alternatively, the CU 172 transmits a second RRC reconfiguration message including the LTM reference configuration to the UE 102 via the DU 174, similar to the events 316 and 318. In response, the UE 102 transmits a second RRC reconfiguration complete message to the CU 172 via the DU 174, similar to the events 320 and 322. In some implementations, if the CU 172 does not receive an LTM reference DU configuration, the CU 172 may generate an LTM reference configuration including only the LTM reference CU configuration. In other implementations, if the CU 172 does not receive an LTM reference DU configuration, the CU 172 may not generate an LTM reference configuration.

[0078] In some implementations, if the first DU-to-CU message includes the complete configuration indication, the CU 172 may determine that the LTM DU configuration 1 is a complete configuration. Otherwise, if the first DU-to-CU message does not include the complete configuration indication, the CU 172 may determine that the LTM DU configuration 1 is a delta configuration. In some implementations, if the LTM DU configuration 1 is a complete configuration, the CU 172 generates the LTM candidate configuration 1 as a complete configuration. Otherwise, if the LTM DU configuration 1 is a delta configuration, the CU 172 generates the LTM candidate configuration 1 as a delta configuration. If the LTM candidate configuration 1 is a complete configuration, the CU 172 includes, in the first RRC reconfiguration message, a complete configuration indication to indicate that the LTM candidate configuration 1 is a complete configuration. If the LTM candidate configuration 1 is a delta configuration, the CU 172 excludes the complete configuration indication from the first RRC reconfiguration message to indicate that the LTM candidate configuration 1 is a delta configuration.

[0079] When the CU 172 performs the procedure 392, the CU 172 may include the second serving DU configuration in the first RRC reconfiguration message. Alternatively, the CU 172 transmits a third RRC reconfiguration message including the second serving DU configuration to the UE 102 via the DU 174, in an event similar to the events 316 and 318. In response, the UE 102 transmits a third RRC reconfiguration complete message to the CU 172 via the DU 174, in an event similar to the events 320 and 322.

[0080] In some implementations, the CU 172 includes the CSI resource configuration in the first RRC reconfiguration message, the second RRC reconfiguration message, or the third RRC reconfiguration message. In other implementations, the CU 172 transmits a fourth RRC reconfiguration message including the CSI resource configuration to the UE 102 via the DU 174, similar to the events 316 and 318. In response, the UE 102 transmits a fourth RRC reconfiguration complete message to the UE 102 via the DU 174, similar to the events 320 and 322.

[0081] In some implementations, the DU 174 transmits a DU-to-CU message to the CU 172, including early synchronization information for the UE 102. The DU-to-CU message may be the first DU-to-CU message, the second DU-to-CU message or a fourth DU-to-CU message. In some implementations, the DU 174 transmits the fourth DU-to-CU message in response to receiving a fourth CU-to-DU message from the CU 172. In other implementations, the DU 174 transmits the fourth DU-to-CU message (e.g., a UE Context Modification Required message) in response to receiving the first CU-to-DU message or the second CU-to-DU message. In one implementation, the DU 174 transmits the fourth DU-to- CU message if the DU 174 determines that the UE 102 supports (i.e., is capable of) early UL synchronization with an LTM candidate cell (e.g., early TA acquisition with an LTM candidate cell, early RA on an LTM candidate cell, or UE measured TA). Otherwise, if the DU 174 determines that the UE 102 does not support the early UL synchronization with an LTM candidate cell, the DU 174 does not transmit the early synchronization information to the CU 172. In other implementations, the CU 172 transmits a CU-to-DU message including an early synchronization information request (e.g., an IE) to the DU 174, and the DU 174 includes the early synchronization information in the DU-to-CU message in response to the early synchronization information request. The CU-to-DU message may be the first CU-to- DU message, the second CU-to-DU message or the fourth CU-to-DU message. In one implementation, the CU 172 may transmit an early synchronization information request if the CU 172 determines that the UE 102 supports the early UL synchronization with an LTM candidate cell. Otherwise, if the CU 172 determines that the UE 102 does not support the early UL synchronization with an LTM candidate cell, the CU 172 does not request the DU 174 to provide the early synchronization information for the UE 102. If the CU 172 receives the early synchronization information, the CU 172 includes the early synchronization information in the first, second, third or fourth RRC reconfiguration message. Alternatively, the CU 172 transmits a fifth RRC reconfiguration message including the early synchronization information to the UE 102 via the DU 174, similar to the events 316 and 318. In response, the UE 102 transmits a fifth RRC reconfiguration complete message to the CU 172 via the DU 174, similar to the events 320 and 322. [0082] In some implementations, the early synchronization information includes a random access channel (RACH) configuration (i.e., RACH configuration 1) and/or one or more TCI state configurations (i.e., TCI state configuration(s) 1). In some implementations, the early synchronization request may include a request for a RACH configuration. If the early synchronization request includes the request for a RACH configuration, the DU 174 includes the RACH configuration in the early synchronization information or in the DU-to-CU message (e.g., be the first, second or fourth DU-to-CU message). Otherwise, if the early synchronization request does not include the request for a RACH configuration, the DU 174 does not include the RACH configuration in either the early synchronization information or in the DU-to-CU message.

[0083] In some implementations, the CU 172 includes, in the first, second, third, fourth and/or fifth RRC reconfiguration messages, one or more other LTM related configurations for the first cell. For example, the other LTM related configuration(s) include a PCI of the first cell and/or the LTM SSB configuration.

[0084] The events 316, 318, 320, 322 are collectively referred to in Fig. 3 as an LTM configuration delivery procedure 394. The LTM configuration delivery procedure 394 can further include the second, third, fourth and/or fifth RRC reconfiguration message(s)) and the second, third, fourth and/or fifth RRC reconfiguration complete message(s), the related CU- to-DU message(s) and/or the related DU-to-CU message(s). In some implementations, the RRC reconfiguration message and the RRC reconfiguration complete message described above are an RRCReconfiguration message and an RRCReconfigurationComplete message, respectively.

[0085] In some implementations, the first CU-to-DU message is a UE Context Modification Request message, and the first DU-to-CU message is a UE Context Modification Response message. In some implementations, the second CU-to-DU message is a UE Context Modification Request message, and the second DU-to-CU message is a UE Context Modification Response message or a UE Context Modification Required message. In the case of the UE Context Modification Required message, the CU 172 can transmit a UE Context Modification Confirm message to the DU 174 in response to UE Context Modification Required message. In some implementations, the third CU-to-DU message is a DE RRC Message Transfer message. In other implementations, the third CU-to-DU message is a UE Context Modification Request message. In some implementations, the third DU-to- CU message is a UL RRC Message Transfer message. In other implementations, the third DU-to-CU message is a UE Context Modification Response message.

[0086] In some implementations, the LTM reference CU configuration is different from the serving CU configuration. In some implementations, a portion of the LTM reference CU configuration is the same as a portion of the serving CU configuration, and the remaining portions of the LTM reference CU configuration is different from the remaining portions of the serving CU configuration. In yet other implementations, the LTM reference CU configuration is the same as the serving CU configuration.

[0087] In some implementations, the LTM reference CU configuration includes PDCP configuration parameters, measurement configuration parameters, and/or radio bearer configuration parameters. In some implementations, the LTM CU configuration 1 includes a MeasConfig IE and/or a RadioBearerConfig IE defined in 3GPP specification 38.331 or the LTM CU configuration 1 includes configuration parameters in the MeasConfig IE and/or RadioBearerConfig IE.

[0088] In some implementations, the LTM CU configuration 1 and/or the LTM reference CU configuration include PDCP configuration parameters, measurement configuration parameters, and/or radio bearer configuration parameters. In some implementations, the LTM CU configuration 1 or the LTM reference CU configuration includes a MeasConfig IE and/or a RadioBearerConfig IE defined in 3GPP specification 38.331, or the LTM CU configuration 1 or the LTM reference CU configuration includes configuration parameters in the MeasConfig IE and/or RadioBearerConfig IE.

[0089] In some implementations, the LTM DU configuration 1 includes a plurality of configuration parameters for the UE 102 to communicate with the DU 174 on the first cell. In some implementations, the plurality of configuration parameters includes physical layer configuration parameters (e.g., PhysicalCellGroupConfig IE), MAC layer configuration parameters (e.g., MAC-CellGroupConfig IE), and/or RLC configuration parameters (e.g., RLC-BearerConfig IE(s)). In some further implementations, the plurality of configuration parameters includes a special cell configuration (e.g., SpCellConfig IE) and/or one or more SCell configurations (e.g., SCellConfig IE(s)). In some implementations, the LTM DU configuration 1 is CellGroupConfig IE defined in 3GPP specification 38.331. In other implementations, the LTM DU configuration 1 includes configuration parameters in the CellGroupConfig IE. [0090] In some implementations, the LTM DU configuration 1 includes a first LI measurement configuration (e.g., a CSl-MeasConfig IE) and/or at least one first transmission configuration indicator (TCI) state configuration. In other implementations, the LTM CU configuration 1 includes the first TCI state configuration(s). In some implementations, the first LI measurement configuration includes at least one first RS resource configuration and/or at least one first report configuration. In some implementations, the first RS resource configuration(s) configures one or more RSs or one or more RS resources associated with the cell 1. The RS(s) includes SSB(s) and/or CSLRS(s). The RS resource(s) includes SSB resource(s) and/or CSLRS resource(s). In some implementations, each of the first RS resource configuration(s) includes a RS resource configuration ID. In some implementations, the first RS resource configuration(s) is/are (similar to) CSl-ResourceConfig IE(s). In some implementations, the first report configuration(s) configures one or more UL resources (e.g., PUCCH resources or PUSCH resources) on the first cell for the UE 102 to transmit measurement results (e.g., CSI reports or LTM CSI reports). In some implementations, each of the first report configuration(s) includes one or more RS resource configuration IDs identifying one or more RS resource configurations included in the first RS resource configuration(s). In some implementations, each of the first TCI state configuration(s) configures a TCI state that associates one or two DL RSs with a corresponding quasicolocation (QCL) type. The DL RS(s) is/are associated with the cell 1.

[0091] After receiving the LTM-related configurations and the second serving DU configuration, or after receiving the RRC reconfiguration message(s) described above, the UE 102 performs measurements on at least one first RS, generates at least one first LI measurement result based on the measurements, and the UE 102 transmits 324 at least one first LI measurement report including the first LI measurement result(s) to the DU 174. The first RS(s) may comprise SSB(s) and/or CSLRS(s). In some implementations, the first RS(s) and/or transmission pattern(s) of the first RS(s) are configured in the CSI report configuration(s), the LTM SSB configuration, and/or the CSI resource configuration. The UE 102 performs the measurements on the first RS(s) in accordance with the CSI report configuration(s), the LTM SSB configuration, and/or the CSI resource configuration.

[0092] After receiving the LTM-related configurations and the second serving DU configuration or after receiving the RRC reconfiguration message(s) described above, the UE 102 performs measurements on at least one second RS, generates at least one second LI measurement result based on the measurements, and the UE 102 transmits at least one second LI measurement report including the first LI measurement result(s) to the DU 174. The second RS(s) may comprise SSB(s) and/or CSLRS(s). In some implementations, the second RS(s) and/or transmission pattem(s) of the second RS(s) are configured in one or more second CSI report configurations and/or in one or more second CSI resource configuration(s) that is/are included in the serving DU configuration in event 302 and/or the second serving DU configuration. The UE 102 performs the measurements on the second RS(s) in accordance with the second CSI report configuration(s) and/or the second CSI resource configuration(s). The second CSI report configuration(s) may include non-LTM CSI report configuration(s) and/or LTM CSI report configuration(s). The second CSI resource configuration(s) may include non-LTM CSI resource configuration(s) and/or LTM CSI resource configuration(s).

[0093] After transmitting the RACH configuration to the UE 102 via the CU 172, the DU 174 may transmit 350 a PDCCH order to the UE 102 to command the UE 102 to transmit an RA preamble on the first cell. In response to the PDCCH order, the UE 102 transmits an RA preamble on the first cell. The DU 174 includes PDCCH order information in the PDCCH order. The PDCCH order information includes an RA preamble index, a UL or a supplemental (or supplementary) UL indicator, an SSB index and/or a physical RACH mask index. In some implementations, the DU 174 includes the LTM ID 1 in the PDCCH order to indicate the first cell. The UE 102 identifies the first cell based on the LTM ID 1 in the PDCCH order, and the UE 102 transmits 352 the RA preamble on the first cell to the DU 174, using the PDCCH order information. Correspondingly, the DU 174 receives 352 the RA preamble in accordance with the PDCCH order information. In some implementations, the DU 174 may determine the SSB index, based on LI measurement report(s) 324, and/or the CSI resource configuration, the CSI report configuration, and/or the LTM SSB configuration. In some implementations, the LI measurement report(s) may include the SSB index. In other implementations, the LI measurement report(s) include a SS/PBCH Block Resource Indicator (SSBRI) corresponding to the SSB index. Thus, the DU 174 determines the SSB index based on the SSBRI.

[0094] In some implementations, the DU 174 determines whether to transmit the PDCCH order based on the LI measurement result(s) 324. In some implementations, if the LI measurement result(s) indicate that the first cell qualifies for the UE 102 to perform RA for early UL synchronization, the DU 174 transmits the PDCCH order. Otherwise, if the LI measurement result(s) indicate that the first cell does not qualify for the UE 102 to perform RA for early UL synchronization, the DU 174 refrains from transmitting the PDCCH order. In other implementations, if the LI measurement result(s) indicate that the first cell qualifies for the UE 102 to access, the DU 174 transmits the PDCCH order. Otherwise, if the LI measurement result(s) indicate that the first cell does not qualify for UE 102 access, the DU 174 refrains from transmitting the PDCCH order. In yet other implementations, the DU 174 transmits the PDCCH order after receiving 320 the RRC reconfiguration complete message, regardless of the LI measurement result(s) 324.

[0095] After transmitting 324 the LI measurement report(s) or 352 the RA preamble, the UE 102 may transmit 354 additional LI measurement report(s) to the DU 174, similar to the event 324. The DU 174 determines to command the UE 102 to perform an LTM cell switch to the first cell based on the additional LI measurement report(s) and/or the LI measurement report(s) 324. In response to the determination, the DU 174 generates an LTM Cell Switch Command (e.g., a MAC CE) including the LTM ID 1 and transmits 326 the LTM Cell Switch Command to the UE 102. In response to the determination, the DU 174 may transmit 328 a DU-CU Cell Switch Notification message to the CU 172. In response to the LTM Cell Switch Command, the UE 102 performs an LTM cell switch to the first cell. In the LTM cell switch, the UE 102 accesses 332 the first cell and transmits 336 an RRC reconfiguration complete message to the DU 174 via the first cell. The DU 174 transmits 338 a DU-to-CU message (e.g., UL RRC Message Transfer message) including the RRC reconfiguration complete message to the CU 172. When the UE 102 receives the LTM Cell Switch Command, the UE 102 identifies the LTM candidate configuration 1 from the LTM ID 1 and accesses 332 the first cell using the LTM candidate configuration 1. Depending on the implementation, the UE 102 may stop communicating on the serving cell(s) in response to the LTM Cell Switch Command. In turn, the DU 174 transmits a fifth DU-to-CU message including the RRC reconfiguration complete message to the CU 172. When the DU 174 detects the UE 102 accesses the first cell in the event 332, the DU 174 may transmit 334 an Access Success message to the CU 172 to indicate that the UE 102 has accessed the first cell.

[0096] In some implementations, the DU 174 includes, in the LTM Cell Switch Command, a TA value for UL synchronization with the first cell. In one implementation, the DU 174 derives the TA value based on the RA preamble (e.g., reception timing of the RA preamble). In another implementation, the DU 174 derives the TA value from a UL transmission on the serving cell (e.g., the cell 124A) from the UE 102. The UE 102 applies the TA value to synchronize with the first cell in UL transmission. After applying the TA value, the UE 102 transmits the first UL transmission on the first cell based on the LTM candidate configuration 1 without performing an RA procedure on the first cell. In some implementations, the UE 102 transmits the first UL transmission on the first cell using a UL grant. In such cases, the first UL transmission is a PUSCH transmission. In some implementations, the PUSCH transmission includes the RRC reconfiguration complete message 336. In some implementations, the UL grant is a configured grant, and the LTM candidate configuration 1 or the LTM DU configuration 1 includes the configured grant configuration configuring the configured grant. In other implementations, the UL grant is a dynamic grant that the UE 102 receives on a PDCCH on the first cell. After transmitting the first UL transmission, the UE 102 receives a PDCCH transmission addressed to a C-RNTI of the UE 102 and determines that the LTM cell switch has completed successfully in response to receiving the PDCCH transmission.

[0097] The PDCCH transmission may include a UL grant or a DL assignment. If the PDCCH transmission includes a UL grant, the UE 102 transmits a PUSCH transmission to the DU 174 on the first cell using the UL grant. If the PDCCH transmission includes a DL assignment, the DU 174 transmits a PDSCH transmission to the UE 102 on the first cell in accordance with the DL assignment. The DU 174 may transmit 334 the Access Success message to the CU 172 after receiving (e.g., in response to) the first UL transmission, transmitting the PDCCH transmission, receiving the PUSH transmission, or transmitting the PDSCH transmission.

[0098] In other implementations, the DU 174 does not include a TA value in the LTM Cell Switch Command. If the LTM Cell Switch Command does not include a/the TA value, the UE 102 performs 332 an RA procedure on the first cell in accordance with the RA configuration parameters. In some implementations, the RA configuration parameters are included in the LTM candidate configuration 1, the LTM DU configuration 1, and/or the LTM Cell Switch Command. In some implementations, the RA configuration parameters configure PRACH resources, an association between SSB and PRACH resources, and/or one or more PRACH occasions. If the UE 102 successfully completes the RA procedure, the UE 102 determines the LTM cell switch to the first cell has completed successfully. Depending on the implementation and/or the RA configuration parameters, the RA procedure can be a four-step RA procedure or a two-step RA procedure. Depending on the implementation and/or the RA configuration parameters, the RA procedure can be a contention-free RA (CERA) procedure or a contention-based RA (CBRA) procedure. During a four-step RA procedure, the UE 102 transmits an RA preamble (i.e., Message 1) on the first cell and receives an RA response (i.e., Message 2) on the first cell from the DU 174 in response to the RA preamble. The UE then transmits Message 3 on the first cell using a UL grant in the RA response, and the DU 174 transmits a Message 4 on the first cell to the UE 102 in response. In some implementations, the Message 4 is a DCI. In the case where the RA procedure is a CBRA procedure, the UE 102 determines contention resolution is successful in response to receiving the Message 4. In the case where the RA procedure is a CBRA procedure, the RA preamble is dedicated preamble, and the UE 102 determines contention resolution is successful in response to receiving the RA response. During a two-step RA procedure, the UE 102 transmits a Message A on the first cell and the DU 174 transmits a Message B to the UE 102 on the first cell in response. When the RA procedure is a CFRA or CBRA procedure, the UE 102 determines contention resolution is successful in response to receiving the Message B. The UE 102 may include the RRC reconfiguration complete message 336 in the Message 3 or Message A. Alternatively, the UE 102 transmits the RRC reconfiguration complete message 336 after completing the RA procedure. The DU 174 may transmit 334 the Access Success message to the CU 172, after receiving the Message 3, Message A or the RRC reconfiguration complete message 336 or after transmitting the Message 4 or Message B.

[0099] In some implementations, the DU 174 includes a first set of LTM CFRA configuration parameters in the LTM Cell Switch Command to configure the UE 102 to perform a CFRA procedure to access the first cell. In some implementations, the first set of LTM CFRA configuration parameters include a first RA preamble index, a first SSB index, a first PRACH Mask index, and/or a first UL/supplemental (or supplementary) UL (SUL) indicator. In some implementations, the first UL/NUL indicator configures the UE 102 to perform the CFRA procedure on a normal UL (NUL) or a SUL. For example, if the first UL/SUL indicator indicates UL (e.g., if the first UL/SUL indicator is set to a first value), the UE 102 performs the CFRA procedure on UL. Otherwise, if the first UL/SUL indicator indicates SUL (e.g., the first UL/SUL indicator is set to a second value), the UE 102 performs the CFRA procedure on the SUL. The UE 102 performs 332 the CFRA procedure to access the first cell using the LTM CFRA configuration parameters and at least one RACH configuration. The LTM candidate configuration 1 includes the RACH configuration(s). The RACH configuration(s) is/are not configured for early UL synchronization. In some implementations, the RACH configuration(s) is/are configured for an LTM cell switch. In some implementations, the at least one RACH configuration includes a common RACH configuration (e.g., RACH-ConfigCommon IE) and/or a generic RACH configuration (e.g., RACH-ConfigGeneric IE). In some implementations, the RACH configuration(s) does not include a dedicated RACH configuration (e.g., RACH-ConfigDedicated IE). In other implementations, the RACH configuration(s) includes a dedicated RACH configuration (e.g., RACH-ConfigDedicated IE). The DU 174 performs the CFRA procedure with the UE 102 in accordance with the first set of LTM CFRA configuration parameters and the RACH configuration(s).

[0100] In some implementations, the DU 174 determines whether to include the first set of LTM CFRA configuration parameters in the LTM Cell Switch Command, based on the measurement report(s) received at event 354. In some implementations, the DU 174 obtains (e.g., retrieves, derives, calculates, or determines) one or more measurement results from the measurement report(s). In some implementations, the measurement result(s) include a measurement result for a first SSB identified by the first SSB index. The first SSB is transmitted by the DU 174 on the first cell. In such cases, if the measurement result for the first SSB is above (or equal to) a second predetermined threshold, the DU 174 includes the first set of LTM CFRA configuration parameters in the LTM Cell Switch Command. Otherwise, if the measurement result for the first SSB is below (or equal to) the second predetermined threshold, the DU 174 refrains from including the first set of LTM CFRA configuration parameters in the LTM Cell Switch Command.

[0101] In some implementations, the DU 174 preconfigures the first set of LTM CFRA configuration parameters. The DU 174 may preconfigure at least one additional set of LTM CFRA configuration parameters and each of the additional set(s) includes an RA preamble index, an SSB index, a PRACH Mask index and/or a UL/SUL indicator for the first cell. In some implementations, the first set and/or the additional set(s) are configured specifically for the first cell. In other implementations, the first set and/or the additional set(s) are configured for any cell operated by the DU 174. In some implementations, the DU 174 (pre)configures the first set and/or the additional set(s) for one of UL (i.e., NUL) and SUL. In other implementations, the DU 174 preconfigures the first set for one of UL and SUL and configures the additional set for the other of UL and SUL.

[0102] In some implementations, when the DU 174 identifies the first SSB index based on the measurement report(s) as described above, the DU 174 identifies the first set of LTM CFRA configuration parameters based on the first SSB index. In some implementations, the DU 174 determines a value of the first UL/SUL indicator based on the measurement result for the first SSB. For example, if the measurement result is below (or equal to) a third predetermined threshold, the DU 174 sets the first UL/SUL indicator to a first value indicating UL (i.e., NUL). Otherwise, if the measurement result for the first SSB is above (or equal to) the third predetermined threshold, the DU 174 sets the first UL/SUL indicator to a second value indicating SUL. In other implementations, the DU 174 determines a value of the first UL/SUL indicator based the LTM DU configuration 1. For example, if the LTM DU configuration 1 includes a RACH configuration for UL and does not include a RACH configuration for SUL, the DU 174 sets the first UL/SUL indicator to the first value. Otherwise, if the LTM DU configuration 1 includes a RACH configuration for SUL (wherein in some implementations the LTM DU configuration 1 includes a RACH configuration for UL while in other implementations the LTM DU configuration 1 does not include a RACH configuration for UL), the DU 174 may set the first UL/SUL indicator to the second value or determine a value of the first UL/SUL indicator based on the measurement result for the first SSB as described above. In yet other implementations, the DU 174 sets the first UL/SUL indicator to a preconfigured value (e.g., the first value), e.g., because the DU 174 does not support SUL. In yet other implementations, the DU 174 sets the first UL/SUL indicator to a preconfigured value (e.g., the second value), e.g., because the DU 174 is preconfigured to set the first UL/SUL indicator to this preconfigured value.

[0103] In some implementations, the first, second and third predetermined thresholds are the same threshold. In other implementations, at least two of the first, second and third predetermined thresholds are different or set to different values.

[0104] After successfully completing the LTM cell switch to the first cell as described above, the UE 102 communicates 340 with the DU 174 and the CU 172 via the first cell, using the LTM candidate configuration 1. In the case of the LTM reference configuration, the UE 102 applies the LTM reference configuration first and then applies the LTM candidate configuration 1 to augment the LTM reference configuration.

[0105] In some implementations, each of the TCI state configuration(s) include a TCI state ID. In some implementations, the DU 174 includes, in the DU-CU Cell Switch Notification message and/or the LTM Cell Switch Command, a first TCI state ID indicating a first one of the TCI state configuration(s). The UE 102 identifies the first one of the TCI state configuration(s) based on the first TCI state ID and applies the first TCI state configuration to communicate UL transmissions and/or DL transmissions with the DU 174 in the events 332, 336, and/or 340. The DU 174 applies the first TCI state configuration to communicate UL transmissions and/or DL transmissions with the UE 102 in the events 332, 336, and/or 340. In other implementations, in case that separate TCI states are used, the DL TCI State and the UL TCI state use different TCI State IDs. In such cases, the DU 174 includes, in the DU-CU Cell Switch Notification message and/or the LTM Cell Switch Command, a first TCI State ID for DL and a second TCI State ID for UL that identify a first and a second one of the TCI state configuration(s) respectively. The UE 102 identifies the first TCI state configuration and the second TCI state configuration based on the first TCI state ID and the second TCI state ID, respectively. The UE 102 applies the first TCI state configuration and/or the second TCI state configuration to communicate DL transmissions and UL transmissions, respectively, with the DU 174 in the events 332, 336, and/or 340. The DU 174 identifies the first TCI state configuration and the second TCI state configuration based on the first TCI state ID and the second TCI state ID, respectively. The DU 174 applies the first TCI state configuration and the second TCI state configuration to communicate DL transmissions and UL transmissions, respectively, with the UE 102 in the events 332, 336, and/or 340.

[0106] In some implementations, the CU 172 may prepare additional cell(s) (i.e., cell(s) 2, ..., N) as LTM candidate cell(s) for the UE 102 with the DU 174, before or after transmitting the LTM Cell Switch Command or during, before or after the procedure 390 or 392, as described above. N is an integer and larger than 1. For example, the CU 172 performs additional LTM preparation procedure(s) 2, ..., N with the DU 174 to prepare the cell(s) 2, ...N, respectively. Each of the LTM preparation procedure(s) 2, ..., N is similar to the procedure 390. In the LTM preparation procedure(s) 2, ..., N, the CU 172 receives LTM DU configuration(s) 2, ..., N configuring the cell(s) 2, ..., N for LTM, respectively. The CU 172 generates LTM candidate configuration(s) 2, ..., N including the LTM DU configuration(s) 2, .. ,N, respectively. The CU 172 assigns LTM ID(s) 2, ..., N to identify the LTM DU configuration(s) 2, ..., N and the LTM candidate configuration(s) 2, ..., N, respectively. The CU 172 may obtain CSI resource configuration 2, ..., N and perform CSI report configuration and/or LTM ID configuration procedure(s) 2, ..., N with the DU 174 to obtain the CSI report configuration(s) 2, ..., N, respectively, as described for the CSI resource configuration 1 and the CSI report configuration(s) 1. The CU 172 may obtain RACH configuration 2, ..., N for the cell(s) 2, ..., N respectively, as described for the RACH configuration 1. The CU 172 may obtain TCI state configuration(s) 2, .. N for the cell(s) 2, .. N respectively, as described for the TCI state configuration(s) 1. Each of the CSI report configuration and/or LTM ID configuration procedure(s) 2, .. N is similar to the procedure 392. The CU 172 may obtain LTM SSB configuration 2, .. N for the cell(s) 2, .. N, respectively, as described for the LTM SSB configuration 1. In some implementations, the CU 172 may perform LTM configuration delivery procedure 2, ..., N with the UE 102 to transmit a list of {the LTM ID 2, the LTM candidate configuration 2, the CSI resource configuration 2 (if obtained), the TCI state configuration 2 (if obtained), the RACH configuration 2 (if obtained), the LTM SSB configuration 2 (if obtained)}, ..., {the LTM ID N, the LTM candidate configuration N, the CSI resource configuration N, the TCI state configuration(s) N (if obtained), the RACH configuration N (if obtained), the LTM SSB configuration N (if obtained)} to the UE 102, respectively. Each of the LTM configuration delivery procedure 2, ..., N is similar to the procedure 394. In other implementations, the CU 172 includes the list in the first RRC reconfiguration message.

[0107] To simplify the following description, tuples 1, ..., N are used to represent {the LTM ID 1, the LTM candidate configuration 1, the CSI resource configuration 1 (if obtained), the TCI state configuration 1 (if obtained), the RACH configuration 1 (if obtained), the LTM SSB configuration 1 (if obtained)}, ..., {the LTM ID N, the LTM candidate configuration N, the CSI resource configuration N, the TCI state configuration(s) N (if obtained), the RACH configuration N (if obtained), the LTM SSB configuration N (if obtained)}, respectively. In some implementations, the CU 172 includes the tuples 1, ..., N in RRC reconfiguration messages 1, ... N in the LTM configuration delivery procedure 1, ..., N, respectively. The RRC reconfiguration message 1 is the first RRC reconfiguration message 316, 318. In some implementations, the CU 172 includes the tuples 1, ..., N in container IE (e.g., an LTM-Config IE) 1, ..., N and includes the container IE 1, ..., N in the RRC reconfiguration messages 1, ..., N, respectively. In other implementations, the CU 172 includes the tuples 1, ..., N in container IE 1 (e.g., an LTM-Config IE) and includes the container IE 1 in the first RRC reconfiguration message.

[0108] In some implementations, the CU 172 may include the CSI resource configuration(s) 1, ..., N in the container IE instead of the tuple, where N is an integer and larger than zero. [0109] In some implementations, after receiving 334 the Access Success message or 338 the DU-to-CU message, the CU 172 may transmit 342 a CU-to-DU message to the DU 174. In one implementation, the CU 172 transmits 342 the CU-to-DU message to release radio resources and/or configurations of the serving cell(s) configured for the UE 102. In another implementation, the CU 172 transmits 342 the CU-to-DU message to release some of the LTM candidate cell(s) 2, ..., N. In this case, the CU 172 transmits messages to release resources and configurations of candidate cells. In response to the CU-to-DU message 342, the DU 174 transmits 344 a DU-to-CU message to the CU 172. In some implementations, the CU-to-DU message 342 and the DU-to-CU message 344 are a UE Context Modification Request message and a UE Context Modification Response message, respectively.

[0110] In some implementations, an LTM ID is provided in a different format depending on which command or message provides the LTM ID. Lor example, the LTM ID may be provided differently in a PDCCH order, an LTM Cell Switch Command, and an RRC reconfiguration message. Lor example, the PDCCH order or the LTM Cell Switch Command includes a first field to include the LTM ID 1 and the first RRC reconfiguration message includes a second field to include the LTM ID 1. In some implementations, the first field and the second field have different formats or coding schemes. Lor example, the first field uses a binary format (i.e., 3 bits) with a value range of 0, ..., 7 and the second field uses an integer format with a value range of 1, ..., 8. In this example, the first field with binary value 000b is equivalent to the second field with integer value 1, the first field with binary value 001b is equivalent to the second field with integer value 2, ... , and the first field with binary value 11 lb is equivalent to the second field with integer value 8.

[0111] The events 304, 306, 390, 392, 394, and 324 are collectively referred to in Eig. 3 as an intra-CU intra-DU LTM configuration procedure 396. The events 304, 306, 390, 392, 394, 324, 350, 352, 354, 326, 328, 332, 334, 336, 338, and 340 are collectively referred to in Eig.

3 as an intra-CU intra-DU LTM procedure 380.

[0112] Referring next to Eig. 4, in a scenario 400, the base station 104A includes a CU 172, an S-DU 174A and a candidate DU (C-DU) 174B. The S-DU 174A operates the cell 124A and optionally additional cell(s), while the C-DU 174B operates a different cell (e.g., cell 124B or cell 126 (Eig. 1A)). The scenario 400 is an intra-CU inter-DU scenario, similar to the scenario 300. Thus, the descriptions for the scenario 300 can generally apply to the scenario 400. Some descriptions for the DU 174 in Eig. 3 may apply to the S-DU 174A in Fig. 4, and some descriptions for the DU 174 in Fig. 3 may apply to the C-DU 174B. The differences between the scenarios 300 and 400 are described below.

[0113] Initially, the UE 102 communicates 402 with the S-DU 174A on one or more serving cells (e.g., the cell 124A and/or other cell(s)) using a serving DU configuration, and the UE 102 communicates with the CU 172 via the S-DU 174A using a serving CU configuration. The UE 102 and CU 172 perform security protection to data communicated between the UE 102 and CU 172 via the S-DU 174A and C-DU 174B, as described with reference to Fig 3. For example, the data includes data packets, the measurement report, the RRC reconfiguration message and the RRC reconfiguration complete message, the RRC reconfiguration complete message and data packets in the events 402, 404, 494, 436, and 440, respectively.

[0114] In some implementations, the CU 172 and S-DU 174A may perform the LTM configuration procedure 496 or the LTM procedure 480 with the UE 102, as described with reference to Fig. 3. In the case of the procedure 380, the UE 102 may perform an LTM cell switch to the first cell (e.g., cell 124B) as described with reference to Fig. 3. Upon successfully completing the LTM cell switch, the first cell becomes a serving cell and cell 124A and/or the other cell(s) is/are no longer serving cell(s) for the UE 102. In the case of the procedure 496, the UE 102 does not perform an LTM cell switch. During the communication 402, the UE 102 transmits 404, 406 at least one measurement report (e.g., L3 measurement report(s)) to the CU 172 via the S-DU 174A. Based on the measurement report(s), the CU 172 determines to prepare cell 1 (e.g., cell 126 operated by the C-DU 174B) for LTM for the UE 102. The cell 1 is identified by a cell ID (i.e., cell ID 1). In response to the determination, the CU 172 performs 490 an LTM preparation procedure with the C-DU 174B to request the C-DU 174B to prepare the cell 1 as an LTM candidate cell for the UE 102. In the LTM preparation procedure 490, the CU 172 transmits a first CU-to-DU message including a cell ID 1 of the cell 1 to the C-DU 174B to request the C-DU 174B to prepare the cell 1 as an LTM candidate cell for the UE 102, similar to the event 308. In response, the C-DU 174B transmits a first DU-to-CU message including an LTM DU configuration (e.g., LTM DU configuration 1) to the CU 172, similar to the event 310. In some implementations, the CU 172 requests an LTM reference DU configuration in the first CU-to-DU message, as described with reference to Fig. 3, while in other implementations the CU 172 does not request an LTM reference DU configuration in the first CU-to-DU message. In some implementations, the C-DU 174B includes an LTM reference DU configuration in the first DU-to-CU message, as described with reference to Fig. 3, while in other implementations, the C-DU 174B does not include an LTM reference DU configuration in the first DU-to-CU message.

[0115] In some implementations, if the CU 172 receives an LTM reference DU configuration from the S-DU 174A as described with reference to Fig. 3, the CU 172 may include the LTM reference DU configuration in the first CU-to-DU message and the C-DU 174B may generate the LTM DU configuration as a delta configuration based on the LTM reference DU configuration. In such cases, the C-DU 174B does not transmit an LTM reference DU configuration for the UE 102 to the CU 172. In other implementations, the CU 172 receives an LTM reference DU configuration from the C-DU 174B, e.g., in the first DU- to-CU message or an additional DU-to-CU message as described with reference to Fig. 3. In such cases, the CU 172 may generate an LTM reference configuration including the LTM reference DU configuration. In some implementations, the CU 172 includes an LTM reference CU configuration in the LTM reference configuration while in other implementations the CU 172 does not include an LTM reference CU configuration in the LTM reference configuration.

[0116] To prepare the cell 1 for LTM, the CU 172 may perform 492 an LTM CSI report configuration and/or LTM ID configuration procedure with the S-DU 174A. In the procedure 492, the CU 172 transmits a second CU-to-DU message including a CSI resource configuration (e.g., CSI resource configuration 1) and/or an LTM SSB configuration (i.e., LTM SSB configuration 1) to the S-DU 174A, similar to the event 312. In response, the S- DU 174A transmits a second DU-to-CU message including one or more CSI report configurations (e.g., CSI report configuration(s) 1) to the CU 172. In some implementations, the CU 172 generates an LTM candidate configuration (e.g., LTM candidate configuration 1) including the LTM DU configuration, and the CU 172 assigns an LTM ID (e.g., LTM ID 1) for identifying the LTM DU configuration and/or the LTM candidate configuration as described with reference to Fig. 3. In some implementations, the CU 172 includes {the LTM ID 1, the cell ID 1 } as a tuple in the second CU-to-DU message.

[0117] To prepare the cell 1 as an LTM candidate cell for the UE 102, the CU 172 may receive early synchronization information for the cell 1 in a DU-to-CU message (e.g., the first DU-to-CU message or an additional DU-to-CU message) from the C-DU 174B. In some implementations, the C-DU 174B transmits the additional DU-to-CU message in response to receiving an additional CU-to-DU message from the CU 172. In other implementations, the C-DU 174B transmits the additional DU-to-CU message (e.g., a UE Context Modification Required message) in response to receiving the first CU-to-DU message. The early synchronization information includes a RACH configuration (e.g., RACH configuration 1) and/or at least one TCI state configuration (e.g., TCI state configuration(s) 1), as described with reference to Fig. 3. In some implementations, the C-DU 174B includes, in the early synchronization information or in the DU-to-CU message, the PDCCH order information (PDCCH order information 1) for early UL synchronization with the cell 1.

[0118] In some implementations, the CU 172 may receive the LTM SSB configuration or SSB configuration parameters in the LTM SSB configuration from the C-DU 174B, e.g., in the first DU-to-CU message or in an additional DU-to-CU message. In some implementations, the CU 172 may receive a PCI of the cell 1 from the C-DU 174B in the first DU-to-CU message or the additional DU-to-CU message. In some implementations, the C- DU 174B transmits the additional DU-to-CU message in response to receiving an additional CU-to-DU message from the CU 172. In other implementations, the C-DU 174B transmits the additional DU-to-CU message (e.g., a UE Context Modification Required message) in response to receiving the first CU-to-DU message.

[0119] In some implementations, the C-DU 174B includes a first set of LTM CFRA configuration parameters in the first DU-to-CU message of the procedure 490. In some implementations, the first set of LTM CFRA configuration parameters include a first RA preamble index, a first SSB index, a first PRACH Mask index, and/or a first UL/SUL indicator. In such cases, the CU 172 includes the first set of LTM CFRA configuration parameters in the second CU-to-DU message of the procedure 492. The C-DU 174B may include at least one additional set of LTM CFRA configuration parameters in the first DU-to- CU message of the procedure 490. Each of the additional set(s) of LTM CFRA configuration parameters include an RA preamble index, an SSB index, a PRACH Mask index, and/or a UL/SUL indicator. In such cases, the CU 172 includes the additional set(s) of LTM CFRA configuration parameters in the second CU-to-DU message of the procedure 492. In some implementations, the C-DU 174B configures the first set and/or the additional set(s) of LTM CFRA configuration parameters for the UE 102. In some implementations, the first set and/or the additional set(s) of LTM CFRA configuration parameters are configured specifically for the cell 1. In other implementations, the first set and/or the additional set(s) of LTM CFRA configuration parameters are configured for any LTM candidate cell configured by the C-DU 174B for the UE 102.

[0120] In some implementations, the first set and the additional set(s) of LTM CFRA configuration parameters do not include separate UL/SUL indicators. In some implementations, the C-DU 174B configures the first set and/or the additional set(s) of LTM CFRA configuration parameters for one of UL (i.e., NUL) and SUL (e.g., either UL/NUL or SUL), and the C-DU 174B includes, in the first DU-to-CU message, a single UL/SUL indicator indicating that the first set and/or the additional set(s) of LTM CFRA configuration parameters are configured for UL/NUL or SUL. In such cases, the CU 172 includes, in the second CU-to-DU message, a single UL/SUL indicator indicating the first set and/or the additional set(s) of LTM CFRA configuration parameters are configured for UL/NUL or SUL. In other implementations, if the C-DU 174B configures the first set and/or the additional set(s) of LTM CFRA configuration parameters for UL, the C-DU 174B includes, in the first DU-to-CU message, the first set and/or the additional set(s) in a first field/IE in the first DU-to-CU message. Otherwise, if the C-DU 174B configures the first set and/or the additional set(s) of LTM CFRA configuration parameters for SUL, the C-DU 174B includes, in the first DU-to-CU message, the first set and/or the additional set(s) in a second field/IE in the first DU-to-CU message. In such cases, the first field/IE and the second field/IE are defined for UL and SUL, respectively. In some implementations, if the first DU-to-CU includes the first set and/or the additional set(s) of LTM CFRA configuration parameters in the first field/IE, the CU 172 includes the first set and/or the additional set(s) in a first field/IE in the second CU-to-DU message. Otherwise, if the first DU-to-CU includes the first set and/or the additional set of LTM CFRA configuration parameters in the second field/IE, the CU 172 includes the first set and/or the additional set(s) in a second field/IE in the second CU-to-DU message. In such cases, the first field/IE and the second field/IE are defined for UL and SUL, respectively.

[0121] In some implementations, the C-DU 174B configures the first set of LTM CFRA configuration parameters for one of UL and SUL (e.g., either UL or SUL), and the C-DU 174B configures the additional set for the other of UL and SUL. In some implementations, the C-DU 174B sets the first UL/SUL indicator to a value indicating the one of UL and SUL and sets the UL/SUL indicator in the additional set to a value indicating the other of the UL and SUL. In other implementations, if the C-DU 174B configures the first set for one of UL and SUL and configures the additional set for the other of UL and SUL, the C-DU 174B includes the first set and the additional set in one and the other of the first field/IE and the second field IE respectively in the first DU-to-CU message. In such cases, the CU 172 includes the first set and the additional set in one and the other of the first field/IE and the second field IE respectively in the second CU-to-DU message.

[0122] As described with reference to Fig. 3, the CU 172 performs 494 an LTM configuration delivery procedure with the UE 102 to transmit the LTM ID 1 and the LTM candidate configuration to the UE 102. In some implementations, the CU 172 transmits {LTM ID, the LTM candidate configuration} as a tuple in a first RRC reconfiguration message in the procedure 494. Depending on the implementations, the CU 172 may include the LTM reference configuration, the CSI report configuration(s), the CSI resource configuration, the RACH configuration, the TCI state configuration(s), the LTM SSB configuration and/or the PCI of the cell 1 in the first RRC reconfiguration message to the UE 102 and/or other RRC reconfiguration message(s) transmitted to the UE 102, as described with reference to Fig. 3. The CU 172 includes the LTM ID in the first RRC reconfiguration or the other RRC reconfiguration message(s) to indicate that the CSI resource configuration, the RACH configuration, the TCI state configuration(s), the LTM SSB configuration, and/or the PCI of the cell 1 are associated with the cell 1. For example, the CU 172 includes the CSI resource configuration, the RACH configuration, the TCI state configuration(s), the LTM SSB configuration, and/or the PCI of the cell 1 in the tuple. In another example, the CU 172 includes {LTM ID, the CSI resource configuration, the RACH configuration, the TCI state configuration(s), the LTM SSB configuration, and/or the PCI of the cell 1 } as a tuple in the other RRC reconfiguration message(s). In response to each of the other RRC reconfiguration message(s), the UE 102 transmits an RRC reconfiguration complete message to the CU 172 via the S-DU 174A.

[0123] In some implementations, the PDCCH order information includes a frequency domain resource assignment, an RA preamble index, a UL or a supplemental (or supplementary) UL indicator, an SSB index and/or a physical RACH mask index. The CU 172 may transmit a CU-to-DU message (e.g., the second CU-to-DU message or an additional CU-to-DU message) including the PDCCH order information to the S-DU 174A. In some implementations, the CU 172 includes the LTM ID 1 or the cell ID 1 in the CU-to-DU message to indicate that the PDCCH order information is associated with the LTM ID 1 or the cell ID 1. For example, when the CU 172 transmits the PDCCH order information in the second CU-to-DU message, the CU 172 includes {the cell ID 1, the PDCCH order information} as a tuple in the CU-to-DU message. When the CU 172 transmits an additional CU-to-DU message, the S-DU 174A may transmit an additional DU-to-CU message to the CU 172 in response. The S-DU 174A transmits 450 a PDCCH order to the UE 102, based on the PDCCH order information. For example, The S-DU 174A transmits 450 a PDCCH order to the UE 102, including the PDCCH order information. In some implementations, the S-DU 174A may determine an SSB index included in the PDCCH order, based on LI measurement report(s) 424, and/or the CSI resource configuration, the CSI report configuration, and/or the LTM SSB configuration. In some implementations, the S-DU 174A includes the LTM ID 1 in the PDCCH order to indicate the cell 1. When the CU 172 transmits the PDCCH order information in the additional CU-to-DU message, the S-DU 174A may transmit an additional DU-to-CU message to the CU 172 in response. The UE 102 transmits 452 an RA preamble to the C-DU 174B on the cell 1, using the RACH configuration and/or the PDCCH order information. The C-DU 174B derives a TA value based on the RA preamble. The C-DU 174B transmits 456 a DU-CU TA Information Transfer message including the TA value to the CU 172. The CU 172 in turn transmits 458 a CU-DU TA Information Transfer message including the TA value to the S-DU 174A. In some implementations, the C-DU 174B includes the cell ID 1, the RA preamble index, an RA radio network temporary identifier (RA-RNTI), and/or a DU ID of the S-DU 174A in the message 456. In such cases, the CU 172 includes the cell ID 1, the RA preamble index, the RA-RNTI, and/or the DU ID of the S- DU 174A in the message 458. In response to determining to command the UE 102 to perform an LTM cell switch to the cell 1, the S-DU 174A transmits 456 the LTM Cell Switch Command including the LTM ID 1 to the UE 102. If the S-DU 174A receives a TA value as described above, the S-DU 174A may include the TA value in the LTM Cell Switch Command. The S-DU 174A may include a first TCI state ID in the LTM Cell Switch Command. The first TCI state ID indicates a first one of the TCI state configuration(s).

[0124] In some implementations, the C-DU 174B determines the RA-RNTI based on a PRACH occasion in which the C-DU 174B receives the RA preamble 452. In some implementations, the C-DU 174B calculates the RA-RNTI as:

RA-RNTI = 1 + s_id + 14 x t_id + 14 x 80 x f_id + 14 x 80 x 8 x ul_carrier_id where s_id is the index of the first OFDM symbol of the PRACH occasion (0 < s_id < 14), t_id is the index of the first slot of the PRACH occasion in a system frame (0 < t_id < 80), where the subcarrier spacing to determine t_id is based on the value of p specified in clause 5.3.2 in 3GPP TS 38.211 for p = {0, 1, 2, 3}, and for p = {5, 6}, t_id is the index of the 120 kHz slot in a system frame that contains the PRACH occasion (0 < t_id < 80), f_id is the index of the PRACH occasion in the frequency domain (0 < f_id < 8), and ul_carrier_id is the UL carrier used for the RA Preamble transmission (0 for NUL carrier, and 1 for SUL carrier).

[0125] In response to determining to command the UE 102 to perform an LTM cell switch or transmitting 426 the LTM Cell Switch Command, the S-DU 174A transmits 428 a DU-CU Cell Switch Notification message to the CU 172 to indicate that the UE 102 performs an LTM cell switch to the cell 1. In response, the CU 172 transmits 430 a CU-DU Cell Switch Notification message to the C-DU 174B to indicate that the UE 102 performs an LTM cell switch to the cell 1. The UE 102 accesses 432 the cell 1 in response to the LTM Cell Switch Command. In some implementations, the S-DU 174A determines to include and/or includes the first set of LTM CERA configuration parameters in the LTM Cell Switch Command to configure the UE 102 to perform a CERA procedure to access the cell 1 as described with reference to Fig. 3. The UE 102 performs the CFRA procedure to access the cell 1, using the LTM CFRA configuration parameters and at least one RACH configuration as described with reference to Fig. 3. The C-DU 174B performs the CFRA procedure with the UE 102 in accordance with the LTM CFRA configuration parameters and the RACH configuration(s) as described with reference to Fig. 3.

[0126] In some implementations, the S-DU 174A determines (whether) to include the first set of LTM CFRA configuration parameters in the LTM Cell Switch Command, based on the measurement report(s) received at event 454. In some implementations, the S-DU 174A obtains (e.g., retrieves, derives, calculates, or determines) one or more measurement results from the measurement report(s). In some implementations, the measurement result(s) include a measurement result for a first SSB identified by the first SSB index. The first SSB is transmitted by the C-DU 174B on the cell 1. In such cases, if the measurement result for the first SSB is above (or equal to) a second predetermined threshold, the S-DU 174A includes the first set of LTM CFRA configuration parameters in the LTM Cell Switch Command. Otherwise, if the measurement result for the first SSB is below (or equal to) the second predetermined threshold, the S-DU 174A refrains from including the first set of LTM CFRA configuration parameters in the LTM Cell Switch Command.

[0127] In some implementations, in the case where the first set of LTM CFRA configuration parameters includes the first UL/SUL indicator, the S-DU 174A includes the first UL/SUL indicator in the LTM Cell Switch Command as described with reference to Fig. 3. In other implementations, in the case where the first set of LTM CFRA configuration parameters does not include a UL/SUL indicator, the S-DU 174A may determine a value of a UL/SUL indicator and includes the UL/SUL indicator in the LTM Cell Switch Command as described below and/or with reference to Fig. 3. In some implementations, if the second CU- to-DU message includes the first set of LTM CFRA configuration parameters in the first field/IE for UL, the S-DU 174A sets the UL/SUL indicator to the first value for UL. Otherwise, if the second CU-to-DU message includes the first set of LTM CFRA configuration parameters in the second field/IE for UL, the S-DU 174A sets the UL/SUL indicator to the second value for SUL. In other implementations, the S-DU 174A determines a value of the UL/SUL indicator in the LTM Cell Switch Command based on a measurement result for the first SSB that the S-DU 174A obtains from the measurement report(s) at event 454. In one implementation, if the measurement result is above (or equal to) a predetermined threshold, the S-DU 174A sets the UL/SUL indicator to the first value and includes the first set in the LTM Cell Switch Command. Otherwise, if the measurement result is below (or equal to) the predetermined threshold, the S-DU 174A sets the UL/SUL indicator to the second value and includes the additional set in the LTM Cell Switch Command instead of the first set. In other implementations, the S-DU 174A sets the UL/SUL indicator to a preconfigured value (e.g., the first value), e.g., because the C-DU 174B does not support SUL. In yet other implementations, the S-DU 174A sets the UL/SUL indicator to a preconfigured value (e.g., the second value), e.g., because the S-DU 174A is preconfigured to set the UL/SUL indicator to the preconfigured value.

[0128] In some implementations, the S-DU 174A includes the first TCI state ID in the DU- CU Cell Switch Notification message and the CU 172 in turn includes the first TCI state ID in the CU-DU Cell Switch Notification message. The UE 102 and the C-DU 174B identify the first one of the TCI state configuration(s) based on the first TCI state ID and apply the first TCI state configuration to communicate UL transmissions and/or DL transmissions in the events 432, 436 and/or 440.

[0129] In other implementations, if separate TCI states are used, the DL TCI State and the UL TCI state use different TCI State IDs. In such cases, the S-DU 174A includes, in the DU- CU Cell Switch Notification message and/or the LTM Cell Switch Command, a first TCI State ID for DL and a second TCI State ID for UL that identify a first and a second TCI state configuration(s) respectively. The CU 172, in response to the DU-CU Cell Switch Notification message, in turn includes the first TCI State ID and the second TCI state ID in the CU-DU Cell Switch Notification message to the C-DU 174B. The UE 102 identifies the first TCI state configuration and the second TCI state configuration based on the first TCI state ID and the second TCI state ID, respectively. The UE 102 applies the first TCI state configuration and the second TCI state configuration to receive DL transmissions and transmit UL transmissions, respectively, with the C-DU 174B in the events 432, 436 and/or 440. The C-DU 174B identifies the first TCI state configuration and the second the TCI state configuration based on the first TCI state ID and second TCI state ID, respectively. The C- DU 174B applies the first TCI state configuration and the second TCI state configuration to communicate DL transmissions and UL transmissions, respectively, with the UE 102 in the events 432, 436, and/or 440.

[0130] In some implementations, each of the TCI state configuration(s) includes or is associated with a TCI state ID. In some implementations, the CU 172 may transmit a CU-to- DU message (e.g., the second CU-to-DU message or an additional CU-to-DU message) including the TCI state configuration(s) and/or the associated TCI state ID(s) to the S-DU 174A. In some implementations, the CU 172 includes the LTM ID 1 or the cell ID 1 in the CU-to-DU message to indicate that the TCI state configuration(s) is associated with the LTM ID 1 or the cell ID 1. For example, when the CU 172 transmits the TCI state configuration(s) and/or the associated TCI state ID(s) in the second CU-to-DU message, the CU 172 includes {the cell ID 1, the TCI state configuration(s)} as a tuple in the CU-to-DU message. When the CU 172 transmits an additional CU-to-DU message, the S-DU 174A may transmit an additional DU-to-CU message to the CU 172 in response. In some implementations, the S- DU 174A includes, in the LTM Cell Switch Command 426, a first TCI state ID indicating a first one of the TCI state configuration(s). In some implementations, the S-DU 174A determines the first TCI state configuration or the first TCI state ID. The UE 102 identifies the one of the TCI state configuration(s) based on the first TCI state ID and applies the first TCI state configuration in UL transmissions and/or DL receptions in the events 432, 436, and/or 440.

[0131] In some implementations, the CU 172 may prepare additional cell(s) (i.e., cell(s) 2, ..., N) as LTM candidate cell(s) for the UE 102 with the C-DU 174B, before or after transmitting the LTM Cell Switch Command or during, before or after the procedure 490 or 492, as described with reference to Fig. 3. [0132] In some implementations, the first CU-to-DU message and the first DU-to-CU message are a UE Context Setup Request message and a UE Context Setup Response message. In some implementations, the first CU-to-DU message and the first DU-to-CU message are a UE Context Modification Request message and a UE Context Modification Response message. In some implementations, the LTM preparation procedure 490 is a UE Context Setup procedure and the additional LTM preparation procedure is a UE Context Modification procedure. In other implementations, the LTM procedure 490 and the additional LTM preparation procedures are UE Context Setup procedures. In yet other implementations, the LTM procedure 490 and the addition LTM preparation procedures are UE Context Modification procedures.

[0133] The events 404, 406, 490, 492, 494, and 424 are collectively referred to in Eig. 4 as an intra-CU inter-DU LTM configuration procedure 497. The events 404, 406, 490, 492, 494, 494, 424, 450, 452, 454456, 458, 426, 428, 430, 432, 434, 436, 438, 440, 442, and 444 are collectively referred to in Eig. 4 as an intra-CU inter-DU LTM procedure 480.

[0134] Referring next to Eig. 5, in a scenario 500, the base station 104 operates as a serving or source base station (S-BS), and the base station 106 operates as a candidate base station (C-BS). The C-BS 106 includes a CU 172 and a DU 174. The scenario 500 is similar to the scenarios 300 and 400, except that the scenario 500 is an inter-CU scenario (i.e., interbase station scenario) while the scenarios 300 and 400 are intra-CU (i.e., intra-base station) scenarios. The S-BS 104 can include a CU and a DU (not shown in Eig. 5), similar to the base station 104 of Figs. 3 and 4. Initially, the UE 102 communicates 502 with the S-BS 104 via serving cell(s) using a serving configuration. In some implementations, the S-BS 104 includes an S-DU and a CU and the serving configuration may include a serving CU configuration and a serving DU configuration, as described with reference to Figs. 3 and 4. The UE 102 performs security protection on data communicated with the S-BS 104 using at least one first security key and at least one first security algorithm, as described with reference to Figs. 3 and 4. The S-BS 104 performs security protection on data communicated with the UE 102 using at least one first security key and at least one first security algorithm, as described with reference to Figs. 3 and 4. Depending on the implementations, the first security key(s) and the first security algorithm(s) used by the UE 102 and the S-BS 104 can be the same or different. While communicating 502 with the UE 102, the S-BS 104 may perform 580 intra-CU LTM procedure(s) with the UE 102, similar to the procedures 380 and/or 480. Alternatively, while communicating 502 with the UE 102, the S-BS 104 may perform 596 intra-CU LTM configuration procedure(s) with the UE 102, similar to the procedures 396 and/or 496.

[0135] While communicating with the S-BS 104, the UE 102 transmits 504 at least one measurement report to the S-BS 104. The measurement report(s) include measurement results for a serving cell of the UE 102 and/or at least one non-serving cell (e.g., cell 126). The S-BS 104 determines to prepare a first cell (e.g., the cell 126) as an LTM candidate cell for the UE 102, based on the measurement report(s). For example, the measurement report(s) include a PCI of the first cell and measurement result(s) of the cell 126. The S-BS 104 identifies that the first cell is operated by the base station 106 based on the PCI and determines that the first cell qualifies for LTM preparation based on the measurement result(s).

[0136] After (e.g., in response to) determining to prepare the first cell as an LTM candidate cell for the UE 102, the S-BS 104 (e.g., the CU of the S-BS 104) generates a Handover Request message including a first cell ID (i.e., cell ID 1) of the first cell (i.e., cell 1). The S- BS 104 transmits 505 the Handover Request message to the CU 172. In some implementations, the Handover Request message includes an LTM indicator indicating the Handover Request message concerns LTM for the first cell ID. After (e.g., in response to) receiving the Handover Request message, the CU 172 performs an LTM preparation procedure 590 with the DU 174 to prepare the first cell as an LTM candidate cell for the UE 102, similar to the procedure 390 or 490. In the procedure 590, the CU 172 transmits a first CU-to-DU message including the first cell ID to the DU 174 to request preparing the first cell, similar to the event 308. In response, the CU 172 may receive a first DU-to-CU message including an LTM DU configuration 1 from the DU 174, similar to the event 310. The CU 172 generates a first LTM candidate configuration (LTM candidate configuration 1). In response to the Handover Request message, the CU 172 transmits 507 a Handover Request Acknowledge message including the first LTM candidate configuration to the S-BS 104. In some implementations, the CU 172 includes the first cell ID in the Handover Request Acknowledge message to indicate that the first LTM candidate configuration is provided for or associated with the first cell (ID).

[0137] The events 505, 590, 507 are collectively referred to in Fig. 5 as an inter-CU LTM preparation procedure (or, alternatively, an inter- MN LTM preparation procedure) 582.

[0138] In some implementations, the Handover Request message includes a DU ID of the S-DU of the S-BS 104. In such cases, the CU 172 includes the DU ID in the first CU-to-DU message. In some implementations, the Handover Request message includes a BS ID of the S-BS 104. When receiving the BS ID, the CU 172 may include the BS ID in the first CU-to- DU message. For example, the BS ID may be a gNB ID.

[0139] In some implementations, the CU 172 requests an LTM reference DU configuration in the procedure 590, as described with reference to Figs. 3 and 4, while in other implementations, the CU 172 does not request an LTM reference DU configuration. In some implementations, the DU 174 transmits an LTM reference DU configuration to the CU 172 in the procedure 590, as described with reference to Figs. 3 and 4, while in other implementations, the DU 174 does not transmit an LTM reference DU configuration to the CU 172. In some implementations, the S-BS 104A (e.g., the CU of the S-BS 104A) may obtain an LTM reference configuration, as described with reference to Figs. 3 and 4. In other implementations, the S-BS 104A may receive an LTM reference configuration from another BS (not shown in Fig. 5) in another inter-CU LTM preparation procedure as described above and later herein. If the S-BS 104A obtains an LTM reference configuration, the S-BS 104A may include the LTM reference configuration (S-BS generated LTM reference configuration) in the Handover Request message. In some implementations, the S-BS 104A includes the LTM reference configuration in the inter-node RRC message

HandoverP reparationinformation or as an Xn Application Protocol (XnAP) IE or field and includes the inter-node RRC message or the XnAP IE in the Handover Request message. Alternatively, the S-BS 104A determines to request or cause the C-BS 106A to provide a complete LTM candidate configuration in which case the S-BS 104A does not include the LTM reference configuration in the Handover Request message. If the S-BS 104A does not obtain an LTM reference configuration, the S-BS 104A does not include an LTM reference configuration in the Handover Request message. If the Handover Request message includes an LTM reference configuration, the CU 172 may include the LTM reference configuration in the first CU-to-DU message. The DU 174 may extract an LTM reference DU configuration from the LTM reference configuration. Alternatively, the CU 172 extracts an LTM reference DU configuration from the LTM reference configuration and includes the LTM reference DU configuration in the first CU-to-DU message. The DU 174 may generate an LTM DU configuration as a delta configuration based on the LTM reference DU configuration, as described with reference to Fig. 3. Alternatively, the DU 174 may ignore the LTM reference (DU) configuration and generate an LTM DU configuration as a complete configuration, as described with reference to Fig. 3. [0140] Otherwise, if the Handover Request message does not include an LTM reference configuration, in some implementations the CU 172 receives an LTM reference DU configuration from the DU 174 as described with reference to Fig. 3 while in other implementations, the CU 172 does not receive an LTM reference DU configuration from the DU 174. If the CU 172 receives an LTM reference DU configuration (e.g., in the first DU-to- CU message), the CU 172 generates an LTM reference configuration (C-BS generated LTM reference configuration) including the LTM reference DU configuration. The CU 172 may include an LTM reference CU configuration (candidate CU (C-CU) generated LTM reference CU configuration). Otherwise, if the CU 172 does not receive an LTM reference DU configuration from the DU 174 as described with reference to Fig. 3, the CU 172 does not generate an LTM reference configuration. Alternatively, the CU 172 generates an LTM reference configuration (C-BS generated LTM reference configuration) only including a C- CU generated LTM reference CU configuration. When the CU 172 generates an LTM reference configuration (C-BS generated LTM reference configuration), the CU 172 includes the C-BS generated LTM reference configuration in the Handover Request Acknowledge message.

[0141] In some implementations, if the LTM DU configuration 1 is a complete configuration, the CU 172 generates the LTM candidate configuration 1 as a complete configuration. The CU 172 may include a complete configuration indication (e.g., a BS-to-BS interface protocol field/IE) in the Handover Request Acknowledge message to indicate that the LTM candidate configuration 1 is a complete configuration. In some implementations, the BS-to-BS interface protocol is an Xn application protocol defined in 3GPP specification 38.423. In some implementations, the complete configuration indication is a dedicated field/IE (e.g., LTM specific) to reduce or eliminate an impact to non-LTM configurations. In other implementations, the complete configuration indication is an existing field/IE defined in 3GPP specification 38.423. Otherwise, if the LTM DU configuration 1 is a delta configuration, the CU 172 generates the LTM candidate configuration 1 as a delta configuration. The CU 172 may exclude the complete configuration indication from the Handover Request Acknowledge message to indicate that the LTM candidate configuration 1 is a delta configuration. Alternatively, the CU 172 may include a delta configuration indication (e.g., a BS-to-BS interface protocol field/IE) in the Handover Request Acknowledge message to indicate that the LTM candidate configuration 1 is a delta configuration. In some implementations, the BS-to-BS interface protocol is an Xn application protocol defined in 3GPP specification 38.423. In some implementations, the delta configuration indication is a dedicated field/IE (e.g., LTM specific) to reduce or eliminate an impact to non-LTM configurations. In other implementations, the delta configuration indication is an existing field/IE defined in 3GPP specification 38.423. In some implementations, the BS-to-BS interface protocol field/IE can have one of at least two possible values (i.e., a first value and a second value). A first value for the BS-to-BS interface protocol field/IE can indicate a complete configuration and the second value for BS-to-BS interface protocol field/IE can indicate a delta configuration.

[0142] In some implementations, the S-BS 104A is preconfigured with a CSI resource configuration (e.g., CSI resource configuration 1 or LTM CSI resource configuration 1) and/or an LTM SSB configuration (LTM SSB configuration 1) for the first cell. In other implementations, the S-BS 104A receives the CSI resource configuration and/or the LTM SSB configuration from an 0AM (Operations, Administration and Maintenance) node. In yet other implementations, the S-BS 104A receives the CSI resource configuration and/or the LTM SSB configuration from the CU 172. For example, the CU 172 includes the CSI resource configuration and/or the LTM SSB configuration in the Handover Request Acknowledge message. In some implementations, the CU 172 includes a PCI (PCI 1) of the first cell in the Handover Request Acknowledge message. To prepare the first cell as a candidate LTM cell for the UE 102, the CU of the S-BS 104A performs an LTM CSI report configuration and/or LTM ID configuration procedure (not shown in Fig. 5) with an S-DU of the S-BS 104A, similar to the procedure 392. In the LTM CSI report configuration and/or LTM ID configuration procedure, the CU of the S-BS 104A transmits the CSI resource configuration and/or the LTM SSB configuration to the S-DU of the S-BS 104A. In response, the CU of the S-BS 104A receives one or more CSI report configurations for the UE 102 from the S-DU of the S-BS 104A. In some implementations, the CU of the S-BS 104A receives the CSI report configuration(s) in a second serving DU configuration from the S- DU.

[0143] To prepare the first cell as an LTM candidate cell for the UE 102, the CU 172 may receive early synchronization information (e.g., early synchronization information 1) for the first cell from the DU 174 in a DU-to-CU message (e.g., the first DU-to-CU message or an additional DU-to-CU message). In some implementations, the DU 174 transmits the additional DU-to-CU message in response to receiving an additional CU-to-DU message from the CU 172. In other implementations, the DU 174 transmits the additional DU-to-CU message (e.g., a UE Context Modification Required message) in response to receiving the first CU-to-DU message. The CU 172 includes the early synchronization information in the Handover Request Acknowledge message. The early synchronization information includes a RACH configuration (e.g., RACH configuration 1) and/or at least one TCI state configuration (e.g., TCI state configuration(s) 1). In some implementations, the DU 174 includes, in the early synchronization information or in the DU-to-CU message, PDCCH order information for early UL synchronization with the first cell. The CU 172 includes the PDCCH order information in the Handover Request Acknowledge message.

[0144] In some implementations, the CU 172 assigns an LTM ID (e.g., LTM ID 1) for identifying the first LTM candidate configuration, and the CU 172 includes the LTM ID in the Handover Request Acknowledge message. In other implementations, the S-BS 104 assigns an LTM ID (e.g., LTM ID 1) for identifying the first LTM candidate configuration.

[0145] After (e.g., in response to) receiving the Handover Request Acknowledge message, the S-BS 104A (e.g., the CU of the S-BS 104A) transmits 518 a first RRC reconfiguration message to the UE 102, including {the LTM ID 1, the LTM candidate configuration 1 } as a tuple, similar to the event 318. If the Handover Request Acknowledge message includes the LTM reference configuration, the S-BS 104A may include the LTM reference configuration in the first RRC reconfiguration message. The S-BS 104A may include the CSI resource configuration 1, the TCI state configuration(s) 1, the RACH configuration 1, and/or the LTM SSB configuration 1 in the tuple, if the S-BS 104A received this information in the Handover Request Acknowledge message. Alternatively, the S-BS 104A transmits one or more additional RRC reconfiguration messages to the UE 102, including the CSI resource configuration 1, the TCI state configuration(s) 1, the RACH configuration 1, the LTM SSB configuration 1, and/or the PCI of the first cell. In each of the additional RRC reconfiguration message(s), the S-BS 104A includes the LTM ID 1 to indicate that the CSI resource configuration 1, the TCI state configuration(s) 1, the RACH configuration 1, the LTM SSB configuration 1, and/or the PCI of the first cell are associated with the first cell or configured for the first cell. The UE 102 transmits 520 a first RRC reconfiguration complete message to the S-BS 104A in response to the first RRC reconfiguration message. The UE 102 transmits an additional RRC reconfiguration complete message to the S-BS 104A in response to each of the additional RRC reconfiguration complete message. The RRC reconfiguration message(s) (i.e., the first RRC reconfiguration message and/or the additional RRC reconfiguration message(s)), and the RRC reconfiguration complete message(s) (i.e., the first RRC reconfiguration complete message and/or the additional RRC reconfiguration complete message(s)) form an LTM configuration delivery procedure. The S-BS 104A may include the second serving DU configuration in the first RRC reconfiguration message or in one of the additional RRC reconfiguration message(s).

[0146] In some implementations, the S-BS 104 (e.g., the CU of the S-BS 104) includes first security information in the Handover Request message. In some implementations, the first security information includes a RAN level security key (e.g., Key NG-RAN Star) and/or a next hop chaining count. In some implementations, the S-BS 104 includes security capabilities of the UE 102 in the Handover Request message.

[0147] In some implementations, the CU 172 generates a first security configuration for the UE 102 based on the first security information. In one implementation, the CU 172 includes the first security configuration in the Handover Request Acknowledge message. In another implementation, the CU 172 includes the first security configuration in the first LTM candidate configuration or the LTM reference configuration.

[0148] In other implementations, the S-BS 104 (e.g., the CU of the S-BS 104) generates the first security configuration based on the first security information instead of the CU 172. In such cases, the CU 172 does not include a security configuration (e.g., the first security configuration) for the UE 102 in the Handover Request Acknowledge message, the first LTM candidate configuration, and/or the LTM reference configuration.

[0149] In some implementations, the S-BS 104 includes the first security configuration in a container IE (e.g., LTM-Config IE) that includes the tuple 1, and the S-BS 104 includes the container IE in the first RRC reconfiguration message. In other implementations, the S-BS 104 includes the first security configuration in the tuple 1.

[0150] In some implementations, the first security configuration includes at least a portion of the first security information. For example, the first security configuration includes the next hop chaining count and does not include a RAN level security key. In some implementations, the first LTM candidate configuration, the LTM reference configuration, or the first security configuration configures at least one second security algorithm. In some implementations, the S-BS 104 (e.g., the CU of the S-BS 104) or the CU 172 determines the second security algorithm(s) based on the security capabilities. In some implementations, the second security algorithm(s) include an encryption algorithm and/or an integrity algorithm that may be the same as or different from the first security algorithm(s). [0151] In some implementations, the first security configuration includes a key set change indicator (e.g., keySetChangelndicatof) indicating whether a new BS key (e.g., a new K_gNB) needs to be derived from a new CN key (e.g., a new KAMF) or a Next Hop (NH) parameter. In some implementations, the S-BS 104 (e.g., the CU of the S-BS 104) or the CU 172 sets the key set change indicator to a first value indicating the first new key is derived from the NH parameter. In other implementations, the S-BS 104 or the CU 172 is pre-configured to set the key set change indicator to a first value indicating the first new key is derived from the NH parameter. This is because the inter-CU LTM may not support derivation of a new BS key based on a new CN key.

[0152] In some implementations, if the Handover Request Acknowledge message includes the complete configuration indication to indicate that the LTM candidate configuration 1 is a complete configuration, the S-BS 104A includes, in the first RRC reconfiguration message, a complete configuration indication (e.g., an RRC field/IE) to indicate that the LTM candidate configuration 1 is a complete configuration. Otherwise, if the Handover Request Acknowledge message does not include the complete configuration indication or if the Handover Request Acknowledge message includes the delta configuration indication to indicate that the LTM candidate configuration 1 is a delta configuration, the S-BS 104A excludes or does not include, in the first RRC reconfiguration message, the complete configuration indication (e.g., an RRC field/IE) to indicate that the LTM candidate configuration 1 is a delta configuration.

[0153] If the Handover Request Acknowledge message includes the PDCCH order information (e.g., PDCCH order information 1), the S-BS 104A transmits 550 a PDCCH order, based on the PDCCH order information. If the S-BS 104A is a distributed base station, the CU of the S-BS 104A may transmit the PDCCH order information to the S-DU of the S- BS 104A. For example, the S-BS 104A or the S-DU of the S-BS 104A transmits 550 a PDCCH order to the UE 102, including the PDCCH order information. In some implementations, the S-BS 104A or the S-DU of the S-BS 104A may determine an SSB index included in the PDCCH order, based on LI measurement report(s) 524, and/or the CSI resource configuration, the CSI report configuration, and/or the LTM SSB configuration. In some implementations, the S-DU or the S-BS 104A includes the LTM ID 1 in the PDCCH order to indicate the first cell. The UE 102 transmits 552 an RA preamble to the DU 174 on the first cell, using the RACH configuration and/or the PDCCH order information. The S-DU or the S-BS 104A derives a TA value based on the RA preamble. The DU 174 transmits 556 a DU-CU TA Information Transfer message including the TA value to the CU 172. The CU 172 transmits 558 a CU-CU TA Information Transfer message including the TA value to the S-BS 104A (e.g., the CU of the S-BS 104A). In some implementations, the DU 174 includes the cell ID 1, the RA preamble index, an RA-RNTI, the DU ID of the S-DU of the S-BS 104A, and/or the BS ID of the S-BS 104A in the message 556. In some implementations, the DU 174 does not include the BS ID in the message 556. In some implementations, the CU 172 includes the cell ID 1, the RA preamble index, the RA-RNTI, the DU ID of the S-DU, and/or the BS ID of the S-BS 104A in the message 558. In some implementations, the CU 172 does not include the BS ID in the message 558. The CU of the S-BS 104A transmits a CU-DU TA Information Transfer message including the TA value, the cell ID 1, the RA preamble index, the RA-RNTI, and/or the DU ID of the S-DU, and/or the BS ID of the S-BS 104A to the S-DU of the S-BS 104A. In some implementations, the CU of the S-BS 104A does not include the BS ID in the CU-DU TA Information Transfer message.

[0154] In some implementations, the CU 172 determines an address (e.g., an IP address) of the S-BS 104 or the CU of the S-BS 104, based on the BS ID of the S-BS 104. In other implementations, the CU 172 determines an address (e.g., an IP address) of the S-BS 104 or the CU of the S-BS 104, based on the DU ID of the S-DU of the S-BS 104. With these implementations, the CU 172 sends the CU-CU TA Information Transfer message to the S- BS 104 or the CU of the S-BS 104 in accordance with the address.

[0155] In response to determining to command the UE 102 to perform an LTM cell switch to the first cell, e.g., based on the measurement report(s) 524 and/or 554, the S-DU or the S- BS 104A transmits 526 the LTM Cell Switch Command including the LTM ID 1 (e.g., configuration identifier) to the UE 102. In response to the LTM Cell Switch Command, the UE 102 may stop communication on the serving cell(s). In response to the LTM Cell Switch Command, the UE 102 accesses 532 the first cell and transmits 536 an RRC reconfiguration complete message to DU 174. The DU 174 in turn transmits 538 a DU-to-CU message including the RRC reconfiguration complete message to the CU 172. After receiving 538 the DU-to-CU message or the RRC reconfiguration complete message, the C-BS 106A communicates 540 with the UE 102 in accordance with the first LTM candidate configuration and/or the LTM reference configuration. In some implementations, the UE 102 transmits 536 the RRC reconfiguration complete message including the LTM ID 1 to indicate that the UE 102 applies the first LTM candidate configuration. In accordance with the LTM ID 1, the CU 172 identifies the first LTM candidate configuration and/or the LTM reference configuration. In other implementations, the CU 172 identifies the first LTM candidate configuration and/or the LTM reference configuration based on the first cell ID included in the Access Success message 534. In such implementations, the CU 172 maintains or stores association information between the first cell ID, and the first LTM candidate configuration and/or between the first cell ID and the LTM reference configuration. When the CU 172 receives 534 the first cell ID in the Access Success message, the CU 172 identifies the first LTM candidate configuration and/or the LTM reference configuration in accordance with the first cell ID and the association information.

[0156] In some implementations, the UE 102 derives the second security key(s) in response to receiving 526 the LTM Cell Switch Command. In other implementations, the UE 102 derives the second security key(s) after receiving the first security configuration and before receiving 526 the LTM Cell Switch Command. The UE 102 applies the second security key(s) to communicate with the CU 172 in the events 536 and 540. If the first security configuration includes the second security algorithm(s), the UE 102 applies the second security key(s) and the second security algorithm(s) to communicate with the CU 172 in the events 536 and 540. Otherwise, if the first security configuration does not include the second security algorithm(s), the UE 102 applies the second security key(s) and the first security algorithm(s) to communicate with the CU 172 in the events 536 and 540. In some implementations, the second security key(s) include an integrity key for integrity protection of control-plane data packets (e.g., event 536 and/or RRC messages in event 540). In other implementations, the second security key(s) include an encryption key for encryption/decryption of control-plane data packets (e.g., event 536 and/or RRC messages in event 540). In yet other implementations, the security key(s) include an integrity key for integrity protection of user-plane data packets (e.g., communicated via DRB(s)) in event 540. In yet other implementations, the security key(s) include an encryption key for encryption/decryption of user-plane data packets (e.g., communicated via DRB(s)) in event 540. The UE 102 stops using the first security key(s) to communicate with the CU 172.

[0157] In some implementations, the CU 172 derives at least one second security key based on the first security information. In some implementations, the CU 172 derives a new BS key (e.g., a new K_gNB) based on the first security information, and the CU 172 derives the at least one second security key from the new BS key. In some implementations, if the first security configuration includes the second security algorithm(s), the CU 172 derives the second security key(s), based on the new BS key and the second security algorithm(s). Otherwise, if the first security configuration does not include the second security algorithm(s), the CU 172 derives the second security key(s), based on the new BS key and the first security algorithm(s). The CU 172 applies the second security key(s) to communicate with the UE 102 in the events 536 and 540. If the first security configuration includes the second security algorithm(s), the CU 172 applies the second security key(s) and the second security algorithm(s) to communicate with the UE 102 in the events 536 and 540. Otherwise, if the first security configuration does not include the second security algorithm(s), the CU 172 applies the second security key(s) and the first security algorithm(s) to communicate with the UE 102 in the events 536 and 540.

[0158] In some implementations, the CU 172 derives the second security key(s) in response to receiving 527 the CU-to-CU Cell Switch Notification message, 534 the Access Success message, or 538 the DU-to-CU message. In other implementations, the CU 172 derives the second security key(s) after receiving the first security configuration and before receiving 527 the CU-to-CU Cell Switch Notification message, 534 the Access Success message or 538 the DU-to-CU message. The CU 172 applies the second security key(s) to communicate with the UE 102 in the events 536 and 540. In some implementations, the second security key(s) include an integrity key for integrity protection of control-plane data packets (e.g., event 536 and/or RRC messages in event 540). In other implementations, the second security key(s) include an encryption key for encryption/decryption of control-plane data packets (e.g., event 536 and/or RRC messages in event 540). In yet other implementations, the second security key(s) include an integrity key for integrity protection of user-plane data packets (e.g., communicated via DRB(s)) in event 540. In yet other implementations, the second security key(s) include an encryption key for encryption/decryption of user-plane data packets (e.g., communicated via DRB(s)) in event 540. In some implementations, the second security key(s) applied by the CU 172 are the same as the second security key(s) applied by the UE 102.

[0159] After receiving 538 the DU-to-CU message or the RRC reconfiguration complete message, the C-BS 106 communicates 540 with the UE 102 in accordance with the first LTM candidate configuration and/or the LTM reference configuration. In some implementations, the UE 102 includes the LTM ID 1 in the RRC reconfiguration complete message 536 to indicate that the UE 102 applies the first LTM candidate configuration. In accordance with the LTM ID 1, the CU 172 identifies the first LTM candidate configuration and/or the LTM reference configuration. In other implementations, the CU 172 identifies the first LTM candidate configuration and/or the LTM reference configuration based on the first cell ID included in the Access Success message 534. In such implementations, the CU 172 maintains or stores association information between the first cell ID, and the first LTM candidate configuration and/or the LTM reference configuration. When the CU 172 receives the first cell ID in the Access Success message, the CU 172 identifies the first LTM candidate configuration and/or the LTM reference configuration in accordance with the first cell ID and the association information.

[0160] In some implementations, the UE 102 may perform an RA procedure to access the first cell in the event 532. The RA procedure can be a four-step RA procedure or a two-step RA procedure. The RA procedure can be a CBRA procedure or a CFRA procedure. In some implementations, the S-BS 104 includes a first set of LTM CFRA configuration parameters in the ETM Cell Switch Command to configure the UE 102 to perform a CFRA procedure to access the first cell. The UE 102 performs the CFRA procedure using the first set of ETM CFRA configuration parameters. In some implementations, the DU 174 includes the first set of the ETM CFRA configuration parameters in the first DU-to-CU message of the procedure 590 as described for the procedure 490. The CU 172 in turn includes the first set of the ETM CFRA configuration parameters in the Handover Request Acknowledge message. In some implementations, the DU 174 includes at least one additional set of ETM CFRA configuration parameters in the first DU-to-CU message as described for the procedure 490. The CU 172 in turn includes the additional set(s) of the ETM CFRA configuration parameters in the Handover Request Acknowledge message.

[0161] In some implementations, the DU 174 configures the first set and/or the additional set(s) for UE (i.e., NUE) or SUL and indicates such configurations in the first DU-to-CU message, as described for the C-DU 174B in Fig. 4. In cases where the first set and/or the additional set(s) are configured for one of UL and SUL, the CU 172 includes, in the Handover Request Acknowledge message, a single UL/SUL indicator indicating the first set and/or the additional set(s) are configured for the one of UL and SUL. In cases in which the first set and/or the additional set(s) are configured for UL, the CU 172 includes the first set and/or the additional set(s) in a first field/IE in the Handover Request Acknowledge message. In cases in which the first set and/or the additional set(s) are configured for SUL, the CU 172 includes the first set and/or the additional set(s) in a second field/IE in the Handover Request Acknowledge message. In such cases, the first field/IE and the second field/IE are defined for UL and SUL, respectively. [0162] In some implementations, the DU 174 configures the first set for one of UL and SUL and configures the additional set for the other of UL and SUL, and the DU 174 indicates such configurations in the first DU-to-CU message, as described with reference to the C-DU 174B in Fig. 4. In such cases, the CU 172 sets a UL/SUL indicator in the first set to a value indicating the one of UL and SUL, and the CU 172 sets a UL/SUL indicator in the additional set to a value indicating the other of the UL and SUL. Alternatively, the CU 172 includes the first set and the additional set in one and the other of the first field/IE and the second field IE respectively in the Handover Request Acknowledge message.

[0163] In some implementations, if the S-DU or the S-BS 104 receives a TA value as described above, the S-DU or the S-BS 104 may include the TA value in the LTM Cell Switch Command. In some implementations, the S-DU or the S-BS 104 includes a first TCI state ID in the LTM Cell Switch Command. The first TCI state ID indicates a first one of the TCI state configuration(s). If the LTM Cell Switch Command includes the TA value, the UE 102 may skip performing a/the RA procedure to access the first cell in the event 532. Otherwise, the UE 102 may perform a/the RA procedure to access the first cell in the event 532 as described above.

[0164] In response to determining to command the UE 102 to perform the LTM cell switch or transmitting 526 the LTM Cell Switch Command, the S-DU of the S-BS 104A transmits a DU-CU Cell Switch Notification message to the CU of the S-BS 104A to indicate that the UE 102 performs or is performing an LTM cell switch to the first cell. In response to receiving the DU-CU Cell Switch Notification message, the CU of the S-BS 104A transmits 527 a CU- CU Cell Switch Notification message to the CU 172 to indicate that the UE 102 performs an LTM cell switch to the first cell. In response, the CU 172 transmits 530 a CU-DU Cell Switch Notification message to the DU 174 to indicate that the UE 102 performs an LTM cell switch to the first cell. In some implementations, the S-BS 104A includes the first TCI state ID in the CU-CU Cell Switch Notification message and the CU 172 then includes the first TCI state ID in the CU-DU Cell Switch Notification message. The UE 102 and the DU 174 identify the first one of the TCI state configuration(s) based on the first TCI state ID and the UE 102 and the DU 174 apply the first TCI state configuration to communicate UL transmissions and/or DL transmissions in the events 532, 536 and/or 540. In other implementations, when separate TCI states are used, the DL TCI State and the UL TCI state use different TCI State IDs. In such cases, the S-DU of the S-BS 104A includes, in the DU-CU Cell Switch Notification message and/or the LTM Cell Switch Command, a first TCI State ID for DL and/or a second TCI State ID for UL that identify a first and a second TCI state configuration(s) respectively. In response to the DU-CU Cell Switch Notification message, the CU of the S-BS 104A includes the first TCI State ID and the second TCI state ID in the CU-CU Cell Switch Notification message to the CU 172. The CU 172 then includes the first TCI state ID and the second TCI state ID in the CU-DU Cell Switch Notification message to the DU 174. The UE 102 identifies the first TCI state configuration and the second TCI state configuration based on the first TCI state ID and the second TCI state ID, respectively. The UE 102 applies the first TCI state configuration and the second TCI state configuration to receive DL transmissions and transmit UL transmissions, respectively, with the DU 174 in the events 532, 536 and/or 540. The DU 174 identifies the first TCI state configuration and the second TCI state configuration based on the first TCI state ID and second TCI state ID, respectively. The DU 174 applies the first and/or the second TCI state configuration to communicate DL transmissions and/or UL transmissions, respectively, with the UE 102 in the events 532, 536, and/or 540.

[0165] In some implementations, after (e.g., in response to) determining to command the UE 102 to perform the LTM cell switch, transmitting 526 the LTM Cell Switch Command, or receiving 527 the DU-CU Cell Switch Notification message, the S-BS 104A (e.g., the CU of the S-BS 104A) transmits 531 one or more Early Status Transfer messages to the CU 172, each including a DL COUNT value or a DISCARD DL COUNT value for a DRB over which the UE 102 and the S-BS 104A communicate 502 data with each other. In some implementations, after receiving 534 the Access Success message or after receiving 538 the DU-to-CU message or the RRC reconfiguration complete message, the CU 172 transmits 539 an LTM Success message to the S-BS 104A (e.g., the CU of the S-BS 104A) to indicate that the LTM cell switch has completed successfully. In some implementations, the LTM Success message is a Handover Success message. In some implementations, the CU 172 includes the first cell ID in the LTM Success message. In other implementations, the CU 172 does not transmit a BS-to-BS message to the S-BS 104A (e.g., the CU of the S-BS 104A) to indicate that the LTM cell switch has completed successfully.

[0166] In some implementations, after (e.g., in response to) determining to command the UE 102 to perform the LTM cell switch, transmitting 526 the LTM Cell Switch Command, receiving 527 the DU-CU Cell Switch Notification message, or receiving 539 the LTM

Success message, the S-BS 104 (e.g., the CU of the S-BS 104) transmits 541 an SN Status

Transfer message to the CU 172, including a DL COUNT value and/or a UL COUNT value for a/the DRB over which the UE 102 and the S-BS 104 communicate 502 data with each other.

[0167] In some implementations, after (e.g., in response to) receiving 534 the Access Success message, receiving 538 the DU-to-CU message or the RRC reconfiguration complete message or receiving 541 the SN Status Transfer message, the CU 172 transmits 543 a UE Context Release message to the S-BS 104. In response to the UE Context Release message, the S-BS 104 releases a UE context of the UE 102.

[0168] In some implementations, the S-BS 104 (e.g., the CU of the S-BS 104) may prepare additional cell(s) (i.e., cell(s) 2, ..., N) as LTM candidate cell(s) for the UE 102 with the CU 172, before or after transmitting the LTM Cell Switch Command or during, before or after the procedure 582, as described above. The cell(s) 2, ..., N are identified by cell ID(s) 2, ..., N, respectively and operated by the DU 174 and/or other DU(s) of the C-BS 106. N is an integer and larger than 1. For example, the S-BS 104 performs additional inter-CU LTM preparation procedure(s) 2, ..., N with the CU 172 to prepare the cell(s) 2, .. ,N, respectively. Each of the inter-CU LTM preparation procedure(s) 2, ..., N is similar to the procedure 582. In the inter-CU LTM preparation procedure(s) 2, ..., N, the S-BS 104 receives LTM candidate configuration(s) 2, ..., N configuring the cell(s) 2, ..., N for LTM, respectively. As described above, the S-BS 104 or the C-BS 106 assigns LTM ID(s) 2, ..., N to identify the LTM candidate configuration(s) 2, ..., N, respectively. The S-BS 104 may obtain CSI resource configuration 2,..., N for the cell(s) 2, ..., N respectively, as described for the CSI resource configuration 1. The S-BS 104 may obtain CSI report configuration(s) 2, ..., N or the cell(s) 2, ..., N, respectively, as described for the CSI report configuration(s) 1. The S-BS 104 may obtain RACH configuration 2, ..., N for the cell(s) 2, ..., N respectively, as described for the RACH configuration 1. The S-BS 104 may obtain TCI state configuration(s) 2, ..., N for the cell(s) 2, ..., N respectively, as described for the TCI state configuration(s) 1. The S-BS 104 may obtain LTM SSB configuration 2, ..., N for the cell(s) 2, ..., N, respectively, as described for LTM SSB configuration 1. The S-BS 104 may obtain PCI(s) 2, ..., N for the cell(s) 2, ..., N respectively, as described for the PCI 1. In some implementations, the S-BS 104 may perform LTM configuration delivery procedure 2, ..., N with the UE 102 to transmit a list of {the LTM ID 2, the LTM candidate configuration 2, the CSI resource configuration 2 (if obtained), the TCI state configuration 2 (if obtained), the RACH configuration 2 (if obtained), the LTM SSB configuration 2 (if obtained), the PCI 2 (if obtained)}, ..., {the LTM ID N, the LTM candidate configuration N, the CSI resource configuration N, the TCI state configuration(s) N (if obtained), the RACH configuration N (if obtained), the LTM SSB configuration N (if obtained), the PCI N (if obtained)} to the UE 102, respectively. Each of the LTM configuration delivery procedure 2, ..., N is similar to the procedures 394, 494 and/or LTM configuration delivery procedure 1 (i.e., events 518 and 520). In other implementations, the S-BS 104 includes the list in the first RRC reconfiguration message.

[0169] To simplify the following description, tuples 1, ..., N are used to represent {the LTM ID 1, the LTM candidate configuration 1, the CSI resource configuration 1 (if obtained), the TCI state configuration 1 (if obtained), the RACH configuration 1 (if obtained), the LTM SSB configuration 1 (if obtained)}, ..., {the LTM ID N, the LTM candidate configuration N, the CSI resource configuration N, the TCI state configuration(s) N (if obtained), the RACH configuration N (if obtained), the LTM SSB configuration N (if obtained)}, respectively. In some implementations, the S-BS 104 includes the tuples 1, ..., N in RRC reconfiguration messages 1, ... N in the LTM configuration delivery procedure 1, ..., N, respectively. The RRC reconfiguration message 1 is the first RRC reconfiguration message 518. In some implementations, the S-BS 104 includes the tuples 1, ..., N in container IE (e.g., an LTM-Config IE) 1, ..., N and includes the container IE 1, ..., N in the RRC reconfiguration messages 1, ..., N, respectively. In other implementations, the CU 172 includes the tuples 1, ..., N in the container IE (e.g., an LTM-Config IE) 1 and includes the container IE 1 in the first RRC reconfiguration message.

[0170] In other implementations, the S-BS 104A performs the procedure 582 with the CU 172 to prepare one or more of the cell(s) 1, ..., N as LTM candidate cell(s) for the UE 102. In such implementations, the S-BS 104A includes the cell ID(s) 1, ..., N in the Handover Request message 505 for LTM, as described for the cell ID 1. In some implementations, upon receiving the Handover Request message, the CU 172 determines or selects the cell(s) 1, ..., M from the cell(s) 1, ..., N as LTM candidate cell(s). M is a positive integer and M < N. In other implementations, CU 172 prepares the cell(s) 1, ..., N for LTM as requested in the Handover Request message. The CU 172 performs LTM preparation procedure(s) 2, ..., M with the DU 174 to prepare the cell(s) 2, ..., M as LTM candidate cell(s) for the UE 102, respectively. The LTM preparation procedure(s) 2, ..., M are similar to the procedure 590 that the CU 172 performs with the DU 174 to prepare the cell 1. The CU 172 obtains the LTM candidate configuration(s) 2, ..., M for the cell(s) 2, ..., M as a result of the LTM preparation procedure(s) 2, ..., M respectively, similar to obtaining the LTM candidate configuration 1. The C-BS 106A may generate the LTM candidate configuration(s) 2, M as complete configuration(s) or generate delta configuration(s) based on the LTM reference configuration, as described for the LTM candidate configuration 1. The CU 172 includes the LTM candidate configuration(s) 2, M in the Handover Request Acknowledge message. In some implementations, the CU 172 or the S-BS 104A assigns LTM ID(s) 2, ..., M to identify the LTM preparation procedure(s) 2, ..., M respectively, as described for the LTM ID 1. When the CU 172 assigns the LTM ID(s) 1, ..., M, the CU 172 includes the LTM ID(s) 1, ..., M with the LTM candidate configuration(s) 1, ..., M, respectively in the Handover Request Acknowledge message, as described for the LTM ID 1 and the LTM candidate configuration 1.

[0171] In some implementations, the CU 172 obtains early synchronization information 2, ..., M for the cell(s) 2, ..., M, respectively, as described for the early synchronization information 1. The CU 172 includes the early synchronization information 2, ..., M in the Handover Request Acknowledge message. In some implementations, the CU 172 or the S-BS 104 obtains CSI resource configuration(s) 2, ..., M for the cell(s) 2, ..., M, respectively, as described for the CSI resource configuration 1. When the CU 172 obtains the CSI resource configuration(s) 2, ..., M, the CU 172 includes the CSI resource configuration(s) 2, ..., M in the Handover Request Acknowledge message.

[0172] In some implementations, the CU 172 or the S-BS 104 obtains LTM SSB configuration(s) 2, ..., M for the cell(s) 2, ..., M, respectively, as described for the LTM SSB configuration 1. When the CU 172 obtains the LTM SSB configuration(s) 2, ..., M, the CU 172 includes the LTM SSB configuration(s) 2, ..., M in the Handover Request Acknowledge message. In some implementations, the CU 172 or the S-BS 104 obtains PCI(s) 2, ..., M for the cell(s) 2, ..., M, respectively, as described for the PCI 1. When the CU 172 obtains the PCI(s) 2, ..., M, the CU 172 includes the PCI(s) 2, ..., M in the Handover Request Acknowledge message.

[0173] In some implementations, the CU 172 includes a list of {the cell ID 1, the LTM ID 1 (if obtained or optional), the LTM candidate configuration 1, the CSI resource configuration 1 (if obtained or optional), the TCI state configuration 1 (if obtained or optional), the early synchronization information 1 (if obtained or optional), the LTM SSB configuration 1 (if obtained or optional), PCI 1 (if obtained or optional)}, , {the cell ID M, the LTM ID M (if obtained or optional), the LTM candidate configuration M, the CSI resource configuration M (if obtained or optional), the TCI state configuration M (if obtained or optional), the early synchronization information M (if obtained or optional), the LTM SSB configuration M (if obtained or optional), the PCI M (if obtained or optional)} in the Handover Request Acknowledge message.

[0174] In some implementations, the CU 172 obtains PDCCH order information 2, ..., M for the cell(s) 2, ..., M, respectively, as described with reference to the PDCCH order information 1. In one implementation, the CU 172 includes the PDCCH order information 2, ..., M in the Handover Request Acknowledge message. In another implementation, the CU 172 includes the PDCCH order information 2, ..., M in the early synchronization information 2, ..., M, respectively. The S-BS 104 may obtain RACH configuration 2, TCI state configuration(s) 2 and/or the PDCCH order information 2, ...., RACH configuration M, TCI state configuration(s) M and/or the PDCCH order information M from the early synchronization information 2, ..., M, respectively or from the Handover Request Acknowledge message.

[0175] In some implementations, the S-BS 104 may perform the LTM configuration delivery procedure 2, ..., M with the UE 102 to transmit the tuples 2, ..., M to the UE 102, respectively. In some implementations, the S-BS 104 includes the tuples 1, ..., M in container IE (e.g., an LTM-Config IE) 1, ..., M and includes the container IE 1, ..., M in the RRC reconfiguration messages 1, ..., M, respectively. In other implementations, the S-BS 104 includes the tuples 1, ..., M in the first RRC reconfiguration message. In some implementations, the S-BS 104 includes the tuples 1, ..., M in container IE 1 (e.g., an LTM- Config IE) and includes the container IE 1 in the first RRC reconfiguration message.

[0176] In some implementations, the S-BS 104 may include measurement result(s) 1, ..., N for the cell(s) 1, ..., N respectively in the Handover Request message. The S-BS 104 receives the measurement result(s) from the UE 102. The C-BS 106 may select or determine the cell(s) 1, ...M, based on the measurement result(s) 1, ..., N. In other implementations, the C-BS 106 may select or determine the cell(s) 1, ...M, based on one or more other factors (e.g., capacity or load of the cell(s) 1, ..., N and/or a maximum number of LTM candidate cell(s)). In one implementation, the maximum number is included in the Handover Request message. In another implementation, the maximum number is a predetermined number.

[0177] In some implementations, the S-BS 104 (e.g., the CU of the S-BS 104) or the CU 172 generates the first security configuration (i.e., a single security configuration) for the LTM candidate cell(s) 1, .. M of the UE 102 or the LTM candidate configuration(s) 1, .. M for the UE 102. In some implementations, the S-BS 104 indicates the LTM candidate configuration(s) 1, ... M associated with the first security configuration in the first RRC reconfiguration message 518 and/or RRC reconfiguration messages 1, ..., M in the LTM configuration delivery procedure 2, ..., M. To indicate the association, the S-BS 104 may include the first security configuration and a first security configuration ID identifying the first security configuration in the container IE 1 and include the first security configuration ID in the tuples (e.g., LTM-Candidate IES) 1, ..., M. Based on the first security configuration ID, the UE 102 identifies that the LTM candidate cell(s) 1, ..., M of the UE 102 or the LTM candidate configuration(s) 1, ..., M share the same security configuration (i.e., the first security configuration). In some implementations, the S-BS 104 includes, in the first RRC reconfiguration message or the container IE 1, a serving security configuration ID for or associated with the serving cell. In some implementations, the serving security configuration ID indicates (e.g., identifies) that the first security key(s), the first security algorithm(s) and/or security parameters used to derive the first security key(s) are associated with serving cell. The serving security configuration ID (i.e., value) is different from the first security configuration ID (i.e., value). Because the first security configuration ID is different from the serving security configuration ID, the UE 102 determines a security configuration change for the LTM cell switch to the cell 1 from the serving cell and applies the first security configuration to communicate with the C-BS 106 via the cell 1 as described above.

[0178] Subsequently, the UE 102 may receive 540 an LTM Cell Switch Command from the C-BS 106, commanding the UE 102 to perform an LTM cell switch to the cell 2. In such cases, the UE 102 performs the LTM cell switch to the cell 2 in response to the LTM Cell Switch Command as described for the LTM cell switch to the cell 1. Because the UE 102 identifies the same security configuration (i.e., the first security configuration) applies to the cell 1 and the cell 2 (or the LTM candidate configuration 1 and the LTM candidate configuration 2), the UE 102 uses or continues using the second security key(s) to communicate with the C-BS 106 on the cell 2. If the UE 102 uses the second security algorithm(s) to communicate with the C-BS 106 on the cell 1, the UE 102 uses or continues using the second security algorithm(s) to communicate with the C-BS 106 on the cell 2. Otherwise, if the UE 102 uses the first security algorithm(s) to communicate with the C-BS 106 on the cell 1, the UE 102 uses or continues using the first security algorithm(s) to communication with the C-BS 106 on the cell 2. Similarly, the C-BS 106 performs similar actions to communicate with the UE 102 as described above. “M” may be changed to “N” in the above description.

[0179] In some implementations, the S-BS 104 may perform an inter-CU LTM preparation procedure for the UE 102 with another, second C-BS to obtain an LTM candidate configuration and a second security configuration for an LTM candidate cell (e.g., a cell operated by the second C-BS), similar to the procedure 582. The S-BS 104 transmits the LTM candidate configuration and the second security configuration to the UE 102, similarly to the events 518 and 520. The S-BS 104 may transmit second security information to the second C-BS as described for the first security information. Examples and implementations described for the first security configuration and the first security information can apply to the second security configuration and the second security information, respectively. In some implementations, the second security information and/or the second security configuration are different from the first security information and/or the first security configuration.

[0180] In some implementations, the S-BS 104 may include the CSI resource configuration(s) 1, ..., N in the container IE instead of the tuple, where N is an integer and larger than zero.

[0181] Next, several example methods, which can be implemented in a RAN (e.g., the RAN 105, the S-BS 104, C-BS 106 or CU 172 in Fig. 5) or a UE (e.g., the UE 102) for inter- CU LTM, are discussed next with reference to Figs. 6A-13B. Descriptions described with reference to Figs. 3-5 can apply to Figs. 6A-13B. Similar steps are similarly labeled (e.g., 302, 402, 502, 602, etc.) and individual descriptions are therefore omitted.

[0182] Fig. 6A illustrates an example method 600A, which can be implemented by an S- BS. The method 600A begins at block 602, where the S-BS communicates with a UE via a serving cell, using at least one first security key and at least one first security algorithm. At block 680, the S-BS may perform an intra-CU LTM procedure with the UE, using at least one first security key and at least one security algorithm (e.g., event 396, 380, 496 or 480). At block 698, the S-BS performs an inter-CU LTM preparation procedure for the UE with a C- BS to prepare a first cell as an LTM candidate cell for the UE. At block 607A, the S-BS receives, from the C-BS, a first LTM candidate configuration and a first security configuration for the UE in the inter-CU LTM preparation procedure, where the first LTM candidate configuration configures the first cell for LTM. At block 618, the S-BS transmits a first RRC message to the UE, including the first LTM candidate configuration and the first security configuration. In some implementations, the S-BS transmits a first interface message to the C-BS in the inter-CU LTM preparation procedure, requesting to prepare the first cell as an LTM candidate cell for the UE. In response, the S-BS at block 607A receives a second interface message from the C-BS, including the first LTM candidate configuration and the first security configuration.

[0183] At block 626, the S-BS may transmit an LTM Cell Switch Command to the UE, commanding the UE to perform an LTM cell switch to the first cell. At block 627, the S-BS may transmit a CU-to-CU Cell Switch Notification message to the C-BS, notifying that the LTM cell switch to the first cell is triggered for the UE. At block 631, the S-BS may transmit an Early Status Transfer message to the C-BS. In some implementations, the Early Status Transfer message includes a DL COUNT value or a DISCARD DL COUNT value for each of at least one first DRB over which the S-BS communicate data with the UE. At block 639, the S-BS may receive an LTM Success message from the C-BS, indicating that the LTM cell switch is successful. At block 641, the S-BS may transmit an SN Status Transfer message for the UE to the C-BS. In some implementations, the SN Status Transfer message includes a DL COUNT value and/or a UL COUNT value for at least one second DRB over which the UE and the S-BS communicate data with each other. In some implementations, the first DRB(s) and the second DRB(s) include the same DRB(s) and/or different DRB(s).

[0184] In some implementations, the first interface message and the second interface message are a Handover Request message or a Handover Request Acknowledge message, respectively. In other implementations, the first interface message and the second interface message are new NGAP messages different from the Handover Request message or the Handover Request Acknowledge message. Bor example, the first interface message and the second interface message are LTM-specific NGAP messages.

[0185] In some implementations, the first security configuration includes a key update configuration (e.g., MasterKeyUpdate IE) and/or a security algorithm configuration. The key update configuration includes a next hop chaining count and/or a key set change indicator as described above. The security algorithm configuration configures at least one second security algorithm as described above. In some implementations, the first security configuration is associated with the first LTM candidate configuration. In some implementations the first security configuration is an LTM-specific security configuration. In some implementations, the first LTM candidate configuration includes the first security configuration. In other implementations, the first LTM candidate configuration does not include the first security configuration. In some implementations, the C-BS includes the first LTM candidate configuration and the first security configuration in a first field/IE and a second field/IE respectively in the second interface message. In such cases, the S-BS retrieves the first LTM candidate configuration and the first security configuration from the first field/IE and the second field/IE, respectively.

[0186] In some implementations, the S-BS includes a first LTM configuration ID in the first RRC message and the first LTM configuration ID identifying the first LTM candidate configuration. In some implementations, the S-BS generates a first container IE (e.g., LTM- Candidate IE), including the first LTM configuration ID and the first LTM candidate configuration. The S-BS includes the first security configuration, a first security configuration ID identifying the first security configuration, and the first container IE in the second container IE and includes the second container IE in the first RRC message. In some implementations, the S-BS includes the first security configuration ID in the first container IE to indicate that the first cell (i.e., the LTM candidate cell) or the first LTM candidate configuration is associated with the first security configuration. In some implementations, the S-BS includes a serving security configuration ID in the second container IE or the first RRC message. The serving security configuration ID indicates (e.g., identifies) that the first security key(s), the first security algorithm(s) and/or security parameters used to derive the first security key(s) are associated with serving cell.

[0187] In some implementations, the S-BS includes other LTM configuration parameters for the LTM candidate cell (i.e., the first cell) in the first RRC message, the first container IE or the second container IE. In some implementations, the other LTM configuration parameters include a CSI resource configuration, a TCI state configuration, a RACH configuration, and/or an LTM SSB configuration as described with reference to Fig. 5. In some implementations, the first RRC message is an RRC reconfiguration message. Examples and implementations of the first security configuration are as described with reference to Fig. 5.

[0188] Fig. 6B is a flow diagram of an example method 600B similar to the method 600A, except that the method 600B includes blocks 607B and 617 instead of block 607A. At block 607B, the S-BS receives, from the C-BS, including a first LTM candidate configuration for the UE in the inter-CU LTM preparation procedure, where the first LTM candidate configuration configures the first cell for LTM. At block 617, the S-BS generates a first security configuration for the LTM candidate cell or the first LTM candidate configuration.

[0189] Fig. 7A illustrates an example method 700A, which can be implemented by a C-BS. The method 700A begins at block 705, where the C-BS receives a first interface message from an S-BS, requesting to prepare a first cell as an LTM candidate cell for a UE and including first security information for the UE. At block 760, the C-BS generates a first security configuration for the UE based on the first security information. At block 707A, the C-BS transmits, to the S-BS, a first LTM candidate configuration and the first security configuration for the UE in the inter-CU LTM preparation procedure, where the first LTM candidate configuration configures the first cell for LTM. At block 727, the C-BS may receive a CU-to-CU Cell Switch Notification message from the S-BS, notifying that an LTM cell switch to the first cell is triggered for the UE. At block 731, the C-BS may receive an Early Status Transfer message for the UE from the S-BS. At block 732A, the C-BS may detect that the UE accesses the first cell in accordance with the first set of LTM CFRA configuration parameters. At block 739, the C-BS may transmit an LTM Success message to the S-BS, the UE successfully accesses the C-BS or the first cell. At block 741, the C-BS may receive a SN Status Transfer message for the UE from the S-BS. At block 761, the C-BS may derive one or more security keys based on the first security information. At block 740, the C- BS may communicate with the UE via the first cell using the security key(s).

[0190] Descriptions with reference to Fig. 6A can apply to Fig. 7A and vice versa.

[0191] Fig. 7B is a flow diagram of an example method 700B similar to the method 700A, except that method 700B includes block 707B instead of block. At block 707B, the C-BS transmits, to the S-BS, a first LTM candidate configuration in the inter-CU LTM preparation procedure, where the first LTM candidate configuration configures the first cell for LTM and the second interface message does not include a security configuration.

[0192] Examples and implementations described with reference to Figs. 6 A, 6B and 7 A can apply to Fig. 7B and vice versa.

[0193] Fig. 8 illustrates an example method 800, which can be implemented by a RAN. The method 800 begins at block 898, where the RAN obtains an LTM candidate configuration for a UE. At block 862, the RAN includes the LTM candidate configuration in an RRC message. At block 863, the RAN determines whether the RAN obtains the LTM candidate configuration for inter-CU LTM or intra-CU LTM. If the RAN obtains the LTM candidate configuration for inter-CU LTM (i.e., “inter-CU LTM” branch of block 863), the flow proceeds to blocks 864 and 866. At block 864, the RAN includes a security configuration in the RRC message. Otherwise, if the RAN obtains the LTM candidate configuration for intra-CU LTM (i.e., “intra-CU LTM” branch of block 863), the flow skips block 864 and proceeds to block 866. At block 866, the RAN transmits the RRC message to the UE.

[0194] In some implementations, the RAN performs an inter-CU LTM preparation procedure to obtain the LTM candidate configuration (e.g., event 598). In other implementations, the RAN performs an intra-CU LTM preparation procedure to obtain the LTM candidate configuration (e.g., events 390, 392, 490 and/or 492).

[0195] Fig. 9A illustrates an example method 900A, which can be implemented by a first BS (e.g., a C-BS or a target BS). The method 900A begins at block 905, where the first BS receives a Handover Request message for a UE from a second BS. At block 968, the first BS includes at least one configuration in an RRC reconfiguration message for the UE. At block 970, the first BS determines whether the Handover Request message requests for LTM or handover. If the Handover Request message requests for handover (i.e., “Handover” branch of block 970), the flow proceeds to blocks 972 and 974. At block 972, the first BS includes a security configuration in the RRC reconfiguration message. Otherwise, if the Handover Request message requests for LTM (i.e., “LTM” branch of block 970), the flow skips block 972 and proceeds to block 974. At block 974, the first BS includes the RRC reconfiguration message in a Handover Request Acknowledge message. At block 907, the first BS transmits the Handover Request Acknowledge message to the second BS. The security configuration is similar to the first security configuration with reference to Fig. 5. The at least one configuration is similar to or includes configurations in the DU configuration and/or the CU configuration as described with reference to Fig. 3.

[0196] Fig. 9B is a flow diagram of an example method 900B similar to the methods 900A, except that the method 900B includes blocks 969 and 975. At block 969, the first BS generates a security configuration for the UE 102. If the Handover Request message requests for LTM (i.e., “LTM” branch of block 970), the flow proceeds to blocks 975 and 907. At block 975, the first BS includes the RRC reconfiguration message and the security configuration in the Handover Request Acknowledge message. In some implementations, the first BS includes the RRC reconfiguration message and the security configuration in a first field/IE and a second field/IE respectively in the Handover Request Acknowledge message. In some implementations, the first BS at block 974 includes the RRC reconfiguration message in the first field/IE. In other implementations, the first BS at block 974 includes the RRC reconfiguration message in a third field/IE.

[0197] Fig. 10 illustrates an example method 1000, which can be implemented by a RAN (e.g., including an S-BS and/or a C-BS). The method 1000 begins at block 1002, where the RAN communicates with a UE via a serving cell, using at least one first security key. At block 1018, the RAN (e.g., the S-BS) transmits, to the UE, LTM candidate configurations 1, ..., N and a security configuration associated with the LTM candidate configurations 1, ..., N, where the LTM candidate configurations 1, ..., N configure cells 1, ..., N as LTM candidate cell(s) for the UE respectively and N is an integer larger than zero. At block 1026- 1, the RAN (e.g., the S-BS) may transmit an LTM Cell Switch Command to the UE, commanding the UE to perform an LTM cell switch to the cell 1. At block 1032-1, the RAN (e.g., the C-BS) may detect that the UE accesses the cell 1. At block 1060, the RAN (e.g., the C-BS) may derive at least one second security key based on security information. In some implementations, the RAN (e.g., the C-BS) obtains the security configuration based on the security information. In some alternative implementations, the RAN (e.g., the C-BS)) may derive at least one second security key based on the security configuration. At block 1040-1, the RAN (e.g., the C-BS) may communicate with the UE via the cell 1 using the second security key(s). At block 1026-2, the RAN (e.g., the C-BS) may transmit an LTM Cell Switch Command to the UE, commanding the UE to perform an LTM cell switch to the cell 2. At block 1032-2, the RAN (e.g., the C-BS) may detect that the UE accesses the cell 2. At block 1040-2, the RAN (e.g., the C-BS) may communicate with the UE via the cell 2 using the second security key(s).

[0198] In some implementations, the security configuration is similar to the first security configuration as described with reference to Fig. 5. In some implementations, the security information is similar to the first security information as described with reference to Fig. 5.

[0199] Fig. 11 illustrates an example method 1100, which can be implemented by a UE. The method 1100 begins at block 1102, where the UE communicates with a RAN via a serving cell, using at least one first security key. At block 1118, the UE receives, from the RAN, LTM candidate configurations 1, ..., N and a security configuration associated with the LTM candidate configurations 1, ..., N, where the LTM candidate configurations 1, ..., N configure cells 1, .. N as LTM candidate cell(s) respectively and N is an integer larger than 0. At block 1126-1, the UE may receive an LTM Cell Switch Command from the RAN, commanding the UE to perform an LTM cell switch to the cell 1. At block 1132-1, the UE may access the cell 1 in response to the LTM Cell Switch Command. At block 1160, the UE may derive at least one second security key based on the security configuration. At block 1140-1, the UE may communicate with the RAN via the cell 1 using the second security key(s). At block 1126-2, the UE may receive an LTM Cell Switch Command from the RAN, commanding the UE to perform an LTM cell switch to the cell 2. At block 1132-2, the UE may access the cell 2 in response to the LTM Cell Switch Command. At block 1140-2, the UE may communicate with the UE via the cell 2 using the second security key(s).

[0200] In some implementations, the security configuration is similar to the first security configuration as described with reference to Fig. 5.

[0201] Fig. 12 illustrates an example method 1200 similar to the method 1000, which can be implemented by a RAN (e.g., including an S-BS and/or C-BS). The method 1200 begins at block 1202, where the RAN communicates with a UE via a serving cell using at least one first security key. At block 1218, the RAN transmits, to the UE, LTM candidate configurations 1, ..., N, where the LTM candidate configurations 1, ..., N configure cells 1, ..., N as LTM candidate cell(s) respectively and N is an integer larger than 0. The flow proceeds to blocks 1226-1 and 1232-1. At block 1276, the RAN determines whether the serving and the cell 1 are operated by the same BS. If the serving cell and the cell 1 are operated by different BSs (i.e., “No” branch of block 1276), the flow proceeds to blocks 1260 and 1240-1. For example, the serving cell is operated by the S-BS and the cell 1 is operated by the C-BS. At block 1260, the RAN derives at least one second security key based on a second security configuration. Otherwise, if the serving cell and the cell 1 are operated by the same BS (i.e., “Yes” branch of block 1276), the flow proceeds to block 1240. At block 1240, the RAN communicates with the UE via the cell 1 using the first security key(s).

[0202] Fig. 13A illustrates an example method 1300A similar to the method 1100, which can be implemented by a UE. The method 1300A begins at block 1302. At block 1302, where the UE communicates with a RAN via a serving cell using at least one first security key. At block 1318, the UE receives, from the RAN, LTM candidate configurations 1, ..., N, where the LTM candidate configurations 1, ..., N configure cells 1, ..., N as LTM candidate cell(s) respectively and N is an integer larger than 0. The flow proceeds to blocks 1326-1 and 1332- 1. At block 1376, the UE determines whether a first security ID (i.e., value) for the cell 1 is different from a serving security ID (i.e., value) for the serving cell. If the first security ID is different from the serving security ID (i.e., “Yes” branch of block 1376), the flow proceeds to blocks 1360A and 1340-1. At block 1360A, the UE derives at least one second security key based on a first security configuration identified by the first security ID. Otherwise, if the first security ID is the same as the serving security ID (“No” branch of block 1376), the flow proceeds to block 1340. At block 1340, the UE communicates with the RAN via the cell 1 using the first security key(s).

[0203] In some implementations, the UE receives the first security ID and the serving security ID from the RAN. In some implementations, the “security ID” can be replaced by “security configuration ID.” In other implementations, the “security ID” can be replaced by “security cell set ID.” Examples and implementations, described for “security configuration ID” with reference to Fig. 5 can apply to the “security ID”.

[0204] Fig. 13B is a flow diagram of an example method 1300B similar to the methods 1300A, except that the method 1300B includes blocks 1376B and 1360B. At block 1376B, the UE determines whether the UE receives a security configuration for the LTM candidate configuration 1. If the UE receives a security configuration (e.g., a first security configuration) for the LTM candidate configuration 1 (i.e., “Yes” branch of block 1376B), the flow proceeds to blocks 1360B and 1340-1. At block 1360B, the UE derives at least one second security key based on the first security configuration. Otherwise, if the UE does not receive a security configuration for the LTM candidate configuration 1 (i.e., “No” branch of block 1376B), the flow proceeds to block 1340.

[0205] Fig. 14 is a flow diagram of an example method 1400, which can be implemented in a C-BS, for providing security configurations based on LTM from a serving cell of an S- BS to the C-BS.

[0206] The method 1400 can begin with operation 1405 with the C-BS receiving, from a source base station (S-BS), a request related to a lower layer triggered mobility (LTM) of a user equipment (UE) from a serving cell of the S-BS to a candidate cell of the C-BS, the request including security information (e.g., event 705). The security information can include a radio access network (RAN) level security key or a next hop chaining count. The request can include security capabilities of the UE. [0207] The method 1400 can continue with operation 1407 with the C-BS transmitting, to the S-BS, a request acknowledgement including a security configuration, the security configuration being based on the security information (e.g., event 707 A). The security configuration can include a portion of the security information. The request acknowledgement can include an LTM configuration for the candidate cell. Transmitting the security configuration can include transmitting the security configuration in a first information element (IE) and transmitting an LTM configuration of the candidate cell in a second IE separate from the first IE. The security configuration can include one or more security algorithms. The security configuration can include a key set change indicator to indicate whether a new base station key is to be derived from a core network (CN) key or a next hop (NH) parameter.

[0208] The method can continue with operation 1441 with receiving, from the S-BS, a secondary node (SN) status transfer message (e.g., event 741). The C-BS can derive, based on the security information and in response to the SN status transfer message, one or more security keys for communicating with the UE. The method 1400 can include communicating with the UE using the one or more security keys, the one or more security keys being based on the security information (e.g., event 698).

[0209] The following list of examples reflects a variety of the implementations explicitly contemplated by the present disclosure.

[0210] Example 1. A method implemented in a serving base station, the method comprising: receiving, from a candidate base station, a lower layer triggered mobility (LTM) configuration for an LTM candidate cell associated with the candidate base station; and transmitting, to a user equipment (UE) in a serving cell of the serving base station, the LTM candidate configuration and a security configuration for the UE.

[0211] Example 2. The method of example 1, further comprising: receiving the security configuration for the UE from the candidate base station.

[0212] Example 3. The method of example 2, wherein: the receiving of the security configuration is included in an inter-CU-LTM preparation procedure.

[0213] Example 4. The method of example 1, further comprising: transmitting, to the candidate base station, a request to prepare a cell as the LTM candidate cell, the request including security information for the UE. [0214] Example 5. The method of example 4, further comprising: generating the security configuration using the security information.

[0215] Example 6. The method of example 4, further comprising: transmitting an indication of security capabilities of the UE to the candidate base station.

[0216] Example 7. The method of any of the preceding examples, wherein: the security information includes a radio access network (RAN) level security key or a next hop chaining count.

[0217] Example 8. A method implemented by a target base station, the method comprising: receiving a request related to a lower layer triggered mobility (LTM) of a user equipment (UE), the communication indicating at least one LTM candidate cell associated with the target base station, the request including first security information; and transmitting, subsequent to the request, LTM candidate configuration information including first security information for at least one LTM candidate cell.

[0218] Example 9. The method of example 8, wherein the first security information is included in a handover request message.

[0219] Example 10. A method implemented by a user equipment (UE), the method comprising: transmitting a report related to a lower layer triggered mobility (LTM) of the UE, the transmitting being in accordance with a security configuration; receiving, subsequent to transmitting the report, a configuration message configuring an LTM candidate cell for the UE; and deriving at least a portion of security information for the LTM candidate cell subsequent to switching to the LTM candidate cell.

[0220] Example 11. The method of example 10, wherein the receiving includes receiving at least one security algorithm from the LTM candidate cell.

[0221] Example 12. The method of example 10, further comprising: transmitting a message to the LTM candidate cell using a security key derived from the security configuration.

[0222] Example 13. The method of example 10, further comprising: transmitting a message to the LTM candidate cell using a base station key derived from the security configuration and another security key based on the base station key.

[0223] Example 14. The method of example 13, wherein the another security key includes an encryption key for control-plane data packets. [0224] Example 15. The method of example 13, wherein the another security key includes an encryption key for user-plane data packets.

[0225] Example 16. A base station comprising a transceiver and processing hardware, the base station configured to implement a method of any of the preceding examples.

[0226] The following description may be applied to the description above.

[0227] Generally speaking, description for one of the above figures can apply to another of the above figures. Examples, implementations and methods described above can be combined, if there is no conflict. An event or block described above can be optional or omitted. For example, an event or block with dashed lines in the figures can be optional. The description described from the perspective of the receiving node also applies to the sending node. For example, a description that a receiving node (e.g., DU) receives a message from a sending node (e.g., CU) may be replaced by the sending node sending a message to the receiving node. Similarly, a description that a receiving node (e.g., CU) receives a message from a sending node (e.g., DU) may be replaced by the sending node sending a message to the receiving node.

[0228] In some implementations, “message” is used and can be replaced by “information element (IE),” and vice versa. In some implementations, “IE” is used and can be replaced by “field,” and vice versa. In some implementations, “configuration” can be replaced by “configurations” or “configuration parameters,” and vice versa. In some implementations, the “DU configuration” can be replaced by “cell group configuration.” In some implementations, the “serving” can be replaced by “source.” In some implementations, the “measurement report” can be replaced by “measurement result(s)” or “CSI report.” In some implementations, the “early TA acquisition” can be replaced by “early UL timing synchronization” or “early UL synchronization.” In some implementations, the “early TA acquisition on a/the candidate cell” can be replaced by “early UL timing synchronization with a/the candidate cell” or “early UL synchronization with a/the candidate cell.” “Handover Request” and “Handover Request Acknowledge” described above are for illustration of the invention and can be replaced by messages with general names. For example, “Handover Request” and “Handover Request Acknowledge” can be replaced by a first CU-to-CU message and a second CU-to-CU message, respectively. In another example, “Handover Request” and “Handover Request Acknowledge” can be replaced by a first interface message and a second interface message, respectively. In yet another example, “Handover Request” and “Handover Request Acknowledge” can be replaced by a first BS-to-BS message and a second BS-to-BS message, respectively. In some implementations, “include” can be replaced by “comprise.” In some implementations, “exclude” can be replaced by “refrain from including” or vice versa. “For UL” and “for SUL” can be replaced by “for UL only” and “for SUL only,” respectively. In some implementations, the “security configuration ID” can be replaced by “security cell set ID.” In some implementations, the “RACH configuration” described above for early UL synchronization can be replaced by “early UL synchronization configuration.”

[0229] A user device in which the techniques of this disclosure can be implemented (e.g., the UE 102) can be any suitable device capable of wireless communications such as a smartphone, a tablet computer, a laptop computer, a mobile gaming console, a point-of-sale (POS) terminal, a health monitoring device, a drone, a camera, a media- streaming dongle or another personal media device, a wearable device such as a smartwatch, a wireless hotspot, a femtocell, or a broadband router. Further, the user device in some cases may be embedded in an electronic system such as the head unit of a vehicle or an advanced driver assistance system (ADAS). Still further, the user device can operate as an intemet-of-things (loT) device or a mobile-internet device (MID). Depending on the type, the user device can include one or more general-purpose processors, a computer-readable memory, a user interface, one or more network interfaces, one or more sensors, etc.

[0230] Certain implementations are described in this disclosure as including logic or a number of components or modules. Modules may can be software modules (e.g., code, or machine-readable instructions stored on non-transitory machine-readable medium) or hardware modules. A hardware module is a tangible unit capable of performing certain operations and may be configured or arranged in a certain manner. A hardware module can comprise dedicated circuitry or logic that is permanently configured (e.g., as a specialpurpose processor, such as a field programmable gate array (FPGA) or an applicationspecific integrated circuit (ASIC), a digital signal processor (DSP), etc.) to perform certain operations. A hardware module may also comprise programmable logic or circuitry (e.g., as encompassed within a general-purpose processor or other programmable processor) that is temporarily configured by software to perform certain operations. The decision to implement a hardware module in dedicated and permanently configured circuitry, or in temporarily configured circuitry (e.g., configured by software) may be driven by cost and time considerations. [0231] When implemented in software, the techniques can be provided as part of the operating system, a library used by multiple applications, a particular software application, etc. The software can be executed by one or more general-purpose processors or one or more special-purpose processors.

[0232] Upon reading this disclosure, those of skill in the art will appreciate still additional and alternative structural and functional designs for handling mobility between base stations through the principles disclosed herein. Thus, while particular implementations and applications have been illustrated and described, it is to be understood that the disclosed implementations are not limited to the precise construction and components disclosed herein. Various modifications, changes, and variations, which will be apparent to those of ordinary skill in the art, may be made in the arrangement, operation and details of the method and apparatus disclosed herein without departing from the spirit and scope defined in the appended claims.

Claims

What is claimed is:

1. A method implemented in a candidate base station (C-BS), the method comprising: receiving, from a source base station (S-BS), a request related to a lower layer triggered mobility (LTM) of a user equipment (UE) from a serving cell of the S-BS to a candidate cell of the C-BS, the request including security information; and transmitting, to the S-BS, a request acknowledgement including a security configuration, the security configuration being based on the security information.

2. The method of claim 1, wherein: the security information includes a radio access network (RAN) level security key or a next hop chaining count.

3. The method of claim 1, wherein: the request includes security capabilities of the UE.

4. The method of claim 1, wherein the security configuration includes a portion of the security information.

5. The method of any of the preceding claims, wherein the request acknowledgement includes an LTM configuration for the candidate cell.

6. The method of any of the preceding claims, further comprising: receiving, from the S-BS, a secondary node (SN) status transfer message; and deriving, based on the security information and in response to the SN status transfer message, one or more security keys for communicating with the UE.

7. The method of claim 6, further comprising: communicating with the UE using the one or more security keys, the one or more security keys being based on the security information.

8. The method of any of claims 1-4, wherein the transmitting of the security configuration comprises: transmitting the security configuration in a first information element (IE), and transmitting an LTM configuration of the candidate cell in a second IE separate from the first IE.

9. The method of any of the preceding claims, wherein: the security configuration includes one or more security algorithms.

10. The method of any of the preceding claims, wherein: the security configuration includes a key set change indicator to indicate whether a new base station key is to be derived from a core network (CN) key or a next hop (NH) parameter.

11. A method implemented in a source base station (S-BS), the method comprising: transmitting, to a candidate base station (C-BS), a request related to a lower layer triggered mobility (LTM) of a user equipment (UE) from a serving cell of the S-BS to a candidate cell of the C-BS, the request including security information; and receiving, from the C-BS, a request acknowledgement; and providing, to the UE, a security configuration corresponding to the candidate cell, the security configuration being based on the security information.

12. The method of claim 11, further comprising: generating the security configuration for the candidate cell.

13. The method of claim 12, wherein: the security configuration is provided in the request acknowledgment from the C-BS.

14. A method implemented by a user equipment (UE), the method comprising: transmitting, to a radio access network (RAN) node and in accordance with a security configuration, a report related to a lower layer triggered mobility (LTM) to an LTM candidate cell; receiving, subsequent to transmitting the report, a configuration message configuring the LTM candidate cell for the UE; and deriving at least a portion of security information for the LTM candidate cell subsequent to switching to the LTM candidate cell.

15. The method of claim 14, wherein: the receiving includes receiving at least one security algorithm for the LTM candidate cell.

16. An apparatus comprising processing hardware and configured to implement a method of any of claims 1-15.