WO2026027152A1

WO2026027152A1 - A method, performed by a first wireless device, for configuring a security configuration and related devices

Info

Publication number: WO2026027152A1
Application number: PCT/EP2025/068501
Authority: WO
Inventors: Johan Hill; Nafiseh Seyed MAZLOUM
Original assignee: Sony Europe Ltd; Sony Group Corp
Current assignee: Sony Europe BV United Kingdom Branch; Sony Group Corp
Priority date: 2024-07-31
Filing date: 2025-06-30
Publication date: 2026-02-05
Anticipated expiration: 2027-01-31

Abstract

A method is disclosed, performed by a first wireless device, such as a method for configuring a security configuration for communication between one or more low power wireless devices and a network node in a cellular network. The method comprises communicating, with a network node, a first request to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless devices. The first request is associated with a security configuration. The method comprises, in response to the first request, configuring the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration. The method comprises transmitting, to the network node, a message informing the network node about the configuring of the one or more low power wireless devices.

Description

A METHOD, PERFORMED BY A FIRST WIRELESS DEVICE, FOR CONFIGURING A SECURITY CONFIGURATION AND RELATED DEVICES.

The present disclosure pertains to the field of wireless communications. The present disclosure relates to a method for configuring a security configuration and a related first wireless device, first low power wireless device, and network node.

BACKGROUND

Future wireless communication services will benefit from widespread connectivity between large networks of wireless devices. Changing or recharging batteries manually may not be feasible due to the inefficiency of the labor work of such battery solutions and the physical inaccessibility of some these devices.

New low power wireless devices, such as Ambient Internet of Things, loT (AloT) devices, are expected to be battery-less and/or to have very limited energy storage. These AloT devices may be capable of performing backscattering uplink transmission. However, effective integration of low power wireless devices into cellular networks may prove challenging. For example, a lower coverage range, requirements on power consumption, security requirements of cellular network communication, and backscattering communication type may present challenges.

SUMMARY

Accordingly, there is a need for devices and methods for configuring a security configuration, which may mitigate, alleviate or address the shortcomings existing and may provide effective integration of security configurations for communication between low power wireless devices and network nodes in cellular networks.

A method is disclosed, performed by a first wireless device, such as a method for configuring a security configuration for communication between one or more low power wireless devices and a network node in a cellular network. The method comprises communicating, with a network node, a first request to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless devices. The first request is associated with a security configuration. The method comprises, in response to the first request, configuring the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration. The method comprises transmitting, to the network node, a message informing the network node about the configuring of the one or more low power wireless devices. A first wireless device comprising memory circuitry, processor circuitry, and a wireless interface is disclosed. The first wireless device is configured to perform any of the methods performed in a wireless device as disclosed herein.

It is an advantage of the present disclosure that the wireless device may signal its transformation into an intermediate node to provide for connectivity of a low power wireless device, with or without a security requirement. The present disclosure provides effective integration of security configurations for communication between low power wireless devices and network nodes in cellular networks.

In other words, the disclosed methods and devices may advantageously facilitate an improvement in the efficiency and adaptability of communications and security configurations of a wireless communication system by allowing for communication between devices with previously incompatibility due to security differences. For example, the disclosed methods and devices may allow for increased coordination and efficiency of a wireless communication system comprising one or more low power wireless devices, one or more wireless devices, and a network node.

Further, the disclosed method and devices may provide for increased flexibility of a wireless communication system by, for example, enabling wireless devices with very low power levels to communicate data (such as critical data or control data) without the power demands required from the security overhead. As such, devices which previously would have been unable to communicate critical data, to due, for example, extremely low power, and which may therefore disrupt the communication system due to this inability to communicate critical data, may be enabled to communicate the data despite its extremely low power. Thus, the system may have additional options and access to data and devices for data communication than previously. While the disclosed therefore provides for an increased access to devices, the disclosed also provides flexibility by allowing for a security aspects (such as different security configurations) to be optional, as is situationally appropriate. The optionality of the security configuration also provides for more flexibility in the device-to-device (for example, between a wireless device and a low power wireless device) communication.

The advantages of the disclosed as described above may also provide advantages to the device itself, allowing devices to extend their useful battery charge to stay functional at a basic level which may then extend the longevity of the battery, as the device may be used for longer between charges. The advantages of the disclosed as described above may also provide advantages to the network node and the wireless network in general by allowing communication with low power wireless devices and deployment of security configuration to low power wireless devices.

A method performed by a network node is disclosed, such as a method for configuring a security configuration. The method comprises communicating, with a first wireless device, a first request for the first wireless device to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless device. The first request is associated with a security configuration. The method comprises in response to the first request, configuring the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration. The method comprises receiving, from the first wireless device, a message informing the network node about the configuring of the one or more low power wireless devices.

A network node comprising memory circuitry, processor circuitry, and a wireless interface is disclosed. The network node is configured to perform any of the methods performed in a network node as disclosed herein.

Further, the disclosed method and devices may provide for increased flexibility of a wireless communication system by, for example, enabling wireless devices with very low power levels to communicate data (such as critical data or control data) without the power demands required from the security overhead. As such, devices which previously would have been unable to communicate critical data, to due, for example, extremely low power, and which may therefore disrupt the communication system due to this inability to communicate critical data, may be enabled to communicate the data despite its extremely low power. Thus, the system may have additional options and access to data and devices for data communication than previously. While the disclosed therefore provides for an increased access to devices, the disclosed also provides flexibility by allowing for security aspects (such as different security configurations) to be optional, as is situationally appropriate. The optionality of the security configuration also provides for more flexibility in the device-to-device (for example, between a wireless device and a low power wireless device) communication.

A method performed by a first low power wireless device is disclosed. The method comprises transmitting, to a first wireless device, a first identifier associated with the first low power wireless device. The method comprises receiving, from the first wireless device, a request for a key validation according to a security configuration. The method comprises receiving, from the first wireless device, a first validation message. The method comprises transmitting, to the first wireless device, a second validation message in response to the first validation message.

A first low power wireless device comprising memory circuitry, processor circuitry, and a wireless interface is disclosed. The first low power wireless device is configured to perform any of the methods performed in low power wireless device as disclosed herein.

It is an advantage of the present disclosure that the low power wireless device and its related method provides for configuring a communication link, such as secure communication link, between the first low power wireless device and one or more intermediate devices. Further, the low power wireless device and its related method allows for performing key validation with an intermediate device and in turn allows increased security for the communication link between the low power wireless device and the intermediate device. BRIEF DESCRIPTION OF THE DRAWINGS

The above and other features and advantages of the present disclosure will become readily apparent to those skilled in the art by the following detailed description of examples thereof with reference to the attached drawings, in which:

Fig. 1 is a diagram illustrating an example wireless communication system comprising an example network node, an example first wireless device, and an example first low power wireless device according to this disclosure,

Fig. 2 show a flow-chart illustrating an example method, performed in a first wireless device, according to this disclosure,

Fig. 3 is a flow-chart illustrating an example method, performed in a network node, according to this disclosure,

Fig. 4 is a flow-chart illustrating an example method, performed in a first low power wireless device, according to this disclosure,

Fig. 5 is a block diagram illustrating an example first wireless device according to this disclosure,

Fig. 6 is a block diagram illustrating an example network node according to this disclosure, Fig. 7 is a block diagram illustrating an example first low power wireless device according to this disclosure, and

Fig. 8 is a signalling diagram of example communications between a first wireless device, a network node, and a first low power wireless device according to this disclosure.

DETAILED DESCRIPTION

Various examples and details are described hereinafter, with reference to the figures when relevant. It should be noted that the figures may or may not be drawn to scale and that elements of similar structures or functions are represented by like reference numerals throughout the figures. It should also be noted that the figures are only intended to facilitate the description of the examples. They are not intended as an exhaustive description of the disclosure or as a limitation on the scope of the disclosure. In addition, an illustrated example needs not have all the aspects or advantages shown. An aspect or an advantage described in conjunction with a particular example is not necessarily limited to that example and can be practiced in any other examples even if not so illustrated, or if not so explicitly described.

To meet design targets and use cases where existing 3GPP low-power, wide-area, LPWA, loT solutions are not able to compete, 3GPP has agreed to study what is called Ambient loT (AloT). The present disclosure relates to ultra-low complexity devices with ultra-low power consumption for very-low end loT applications. In terms of energy storage, two main types of device characteristics can be considered. The first type is for example an extremely low energy storage device, capable of consuming only approximately 1 pW in peak power consumption. The second type has for example more energy storage and aims at supporting less than a few hundred pW. Both, the first type and the second type, may be considered to have its uplink communication based on backscattering transmission. The second type may be considered to generate its own uplink transmission as traditionally wireless devices do. The coverage design target may be in the range of 10-50 meters and is well below any other legacy 3GPP specified access technologies.

To support the very much lower coverage range, e.g., compared to legacy systems, the aggressive requirements on power consumption and the backscattering communication type, a set of network scenarios based on topologies and/or deployments are agreed to be studied. A few nodes can be defined as part of the scenario definition. A carrier wave emitter (CW) may be seen as the functional node transmitting the excitation signal used for backscattering. A Reader may be seen as the receiver of AloT signals, communicating directly with the AloT Device and can be both the base station (BS) or other wireless devices (such as User Equipment, UEs) in the system (referred to as an intermediate node or intermediate device in the present disclosure).

It may be appreciated that the CW also may be the BS or have direct connection with the BS and that the Reader may be the same physical entity as the CW in some scenarios. Since those new nodes are included, the traditional use of "uplink" and "downlink" channels may not be fully applicable. For example, the node names are used to define the physical channels such as R2D (Reader to Device) and D2R (Device to Reader) and CW2D (Carrier Wave Emitter to Device). The Reader may be deployed in various ways in the system. The Reader can be a node part in the wireless network, such as Next Generation Radio Access Network, NG-RAN, a wireless device (such as UE) configured as Reader, and/or a specific component or node intended for implementing the reader functionality.

Traditionally ever since deployment of GSM there has been extensive security applied in the 3GPP based cellular network system and their interfaces. Hence, a legacy wireless device (such as UE) is required to support various encryption/decryption standards and key management procedures to be able to communicate in cellular networks. The security information, such as main keys, is usually located in the subscriber identity module, SIM, and at the operator side of a network, e.g., large highly secure databases. Both the UE and the network node derive based on the main key a key hierarchy of key sets to be used for various purposes in the system. The key generation and management procedures are defined in 3GPP technical specifications. Both ciphering and integrity are supported. The present disclosure relates to security aspects in the communication between low power wireless devices and network nodes. For example, the present disclosure relates to security aspects when registering a low power wireless device, such as an AloT Device, to a wireless device, such as UE, as an intermediate device, such as IN, and provide a method that may be applicable for the very low power characteristics of an AloT Device.

The present disclosure relates to the Reader (herein referred to as intermediate device and/or wireless device) and in particular when the Reader is deployed as an intermediate node or device. The intermediate device may have to identify itself in the network and may have to be on-boarded into the wireless network, such as NG-RAN/5GC, as a node capable of managing the low power wireless devices, such as AloT Devices. The most extreme device type may have as low power consumption as 1 pW in peak consumption. This may allow lower coverage than currently deployed cellular systems. To maintain the network component density, the present disclosure provides a solution to utilize intermediate devices for interaction with the low power wireless devices.

The present disclosure provides, inter alia, a method for configuring how the system components, such as the network node, the one or more intermediate devices, and the one or more low power wireless devices, interact. For example, the present disclosure provides a method for configuring how to handle (e.g. control) communication of data between a network node and one or more low power wireless devices when there are multiple intermediate devices and how to configure (such as on-board) and associate the low power wireless devices to the intermediate devices and the network. For example, the present disclosure provides a method for configuring a security configuration for communication between one or more low power wireless devices and a network node in a cellular network.

It may be appreciated that the present disclosure provides different security configurations, e.g., with different sets of security parameters and/or different security measures for handling communication of data, for example depending on different criteria relating to the low power wireless devices, the intermediate devices, and/or the data communicated. In other words, the present disclosure provides a method to let a wireless device, such as mobile phone or UE, signal its transformation into an intermediate node or device that is to connect low power wireless devices, such as AloT devices, to a cellular network according to a security configuration, e.g., that may have different security levels.

A wireless device, such as an intermediate device, disclosed herein may for example be seen as a network node configured to communicate with one or more low power wireless devices, such as a first low power wireless device, a second low power wireless device, etc. The intermediate device disclosed herein may for example be seen as an intermediate node, such as an intermediate node of the wireless communication system. In some examples, the intermediate device can be seen as a receiver or a receiving node, such as a receiving node configured to receive information transmitted from the low power wireless device and/or data transmission transmitted from the network node. In some examples, the intermediate device can be seen as a transmitter or a transmitting node, such as a transmitting node configured to transmit information to the low power wireless device and/or to the network node. The intermediate device may for example act as both a receiving node and a transmitting node. In some examples, the intermediate device may be seen as a reader, such as a reader device. A reader may be seen as a reader of AloT signals, e.g., communicating directly with the low power wireless device, such as AloT device. In some examples, the intermediate device may be a mobile device and/or a user equipment, UE. The intermediate device may for example be seen as an assistant in the communication system, such as a communication assistance for communications between one or more low power wireless devices and the network node. In one or more example embodiments, a network node (such as base station) may act as an intermediate device, e.g., an intermediate device for communication between a low power wireless device and another network node.

A network node disclosed herein refers to a radio network node, such as a radio access network node operating in the radio access network, e.g., a base station, an evolved Node B, eNB, a next generation Node B, gNB in NR. In one or more examples, the radio access node is a functional unit which may be distributed in several physical units. The network node 400 disclosed herein can for example be seen as one or more of: a base station, an eNB, a gNB and/or an access point.

A low power wireless device disclosed herein refers to a low power wireless device capable of communication in a wireless communication network. The low power wireless device can for example be seen as a wireless device not comprising an internal power source, such as a battery-less wireless device. For example, the low power wireless device may be a wireless device with a limited energy source, such as a limited external energy source. For example, the low power wireless device can be seen as a wireless device having a low energy source. For example, the low power wireless device may harvest energy from ambient energy sources, such as solar energy or kinetic energy, or dedicatedly via wireless power transfer technique. The low power wireless device for example consumes a low amount of energy, e.g., having a peak power consumption less than 2000 pW, and/or less 1000 pW, (e.g. less than 700 pW, such as less than 500 pW, such as less than 200 pW), and can therefore be seen as a low power wireless device. There may for example be two types of low power wireless devices. A first type having extremely low energy storage, capable of consuming less than 5 pW in peak power consumption and a second type having more energy storage and capable of consuming less than 200 pW in peak power consumption. Therefore, a low power wireless device as disclosed herein may have a peak power consumption in the range of 1 pW to 200 pW. The low power wireless device may for example be seen as and/or referred to as an ambient Internet-of- Things (AloT) device. The low power wireless device is for example a backscatter device, BSD, e.g., configured to perform uplink transmissions using a backscattering technique. The backscatter device may for example be referred to as a backscattering device. The low power wireless device is for example designed to perform low-power reception receiving low- complexity signals. For example, the low power wireless device may be seen as a device having low complexity modulation and/or low complexity in communication protocol. The low power wireless device may be seen as different from normal UEs or machine-type communication devices, in that the low power wireless device runs a different protocol with less complex decoding.

The term “communicate” used herein can be seen as provide, such as transmit, and/or obtain, such as receive. For example, when a device and/or node, such as a wireless device and/or a wireless device acting as an intermediate device, low power wireless device, and/or network node, communicates information, the device and/or node may for example transmit and/or receive said information (such as any message, signal, etc.).

Any methods, such as method steps, disclosed herein that apply to any of the first devices, e.g., the first low power wireless device, first wireless device, and/or the first intermediate device, may also apply to the second devices, (such as the second low power wireless device, second wireless device, and/or the second intermediate device), the third devices, the fourth devices, etc. In other words, any action performed by any first device, e.g. first low power wireless device, first wireless device, and/or first intermediate device, may for example also be performed by the corresponding second device, third device, fourth device, etc.

The figures are schematic and simplified for clarity, and they merely show details which aid understanding the disclosure, while other details have been left out. Throughout, the same reference numerals are used for identical or corresponding parts.

Fig. 1 is a diagram illustrating an example wireless communication system 1 comprising an example network node 400, an example wireless device 300, such as an example intermediate device, an example low power wireless device 500, and an example application layer 600 according to this disclosure. As discussed in detail herein, the present disclosure relates to a wireless communication system 1 comprising a cellular system, for example, a 3rd Generation Partnership Project, 3GPP, wireless communication system.

A network node disclosed herein refers to a radio access network node operating in the radio access network, such as a base station, an evolved Node B, eNB, gNB in NR. In one or more examples, the RAN node is a functional unit which may be distributed in several physical units.

The actual Application layer may for example be deployed via a Core Network, CN, node. The core network, CN, node disclosed herein refers to a network node operating in the core network, such as in the Evolved Packet Core Network, EPC, and/or a 5G Core Network, 5GC. Examples of CN nodes in EPC include a Mobility Management Entity, MME. In some examples, the application layer may be deployed via cloud, such as communicating by Network Exposure function (NEF) with a low power wireless device, network node, and/or wireless device (such as intermediate device). It may be appreciated that other core network functions and network node functions may be deployed in the cloud. The application layer, such as NEF or AF, may be seen as an interface to 3^rd party applications on the network side, which may be cloud-based or not. In some examples, the application layer may be configured to communicate via an internet protocol, IP, based connection. In some examples, the application layer may be deployed within the application layer of the intermediate device, such as using an interface of the wireless device (such as intermediate device). In some examples, the low power wireless device may have an application level profile setting. In some examples, the application layer may be deployed via the network node disclosed herein. In other words, the application layer may for example in some examples be seen as located in the network itself. The application layer can for example be seen as the upper layer of the wireless communication system, as shown in Fig. 1.

The wireless communication system 1 described herein may comprise one or more intermediate devices 300, 300A, one or more network nodes 400, such as one or more of: a base station, an eNB, a gNB and/or an access point, one or more low power wireless devices 500, 500A, and/or an application layer 600.

Wireless device 300, such as intermediate device, can be seen as the first wireless device, such as first intermediate device, and wireless device 300A can be seen as the second wireless device, such as second intermediate device.

Low power wireless device 500 can be seen as the first low power wireless device, and low power wireless device 500A can be seen as the second low power wireless device. The intermediate device 300, 300A may be configured to communicate with the network node 400 via a wireless link (or radio access link) 10, 10A, 11. The intermediate device 300, 300A may be configured to communicate with the low power wireless device 500 via a wireless link (or radio access link) 12, 12A. The intermediate device 300, 300A may be configured to communicate with the low power wireless device 500A via a wireless link (or radio access link) 14, 14A. The intermediate device 300 may be configured to communicate with the intermediate device 300A via a wireless link (or radio access link) 15, e.g., such as via sidelink. The network node 400 may be configured to communicate with the application layer 600, via a wireless link (or radio access link) 16.

Fig. 1 can for example be seen as showing an example deployment with two low power wireless devices 500, 500A, and two wireless devices 300, 300A e.g., intermediate devices that may be configured as readers.

The wireless communication system 1 may be configured for uplink, UL, transmission of data, such as a first signal, from the low power wireless device 500, 500A to the network node 400, e.g., via the intermediate device 300, 300A. Example uplink communications in the wireless communication system 1 can be seen in signalling diagrams shown in Figs. 9-11. For example, in the uplink scenario, the low power wireless device 500, 500A may be seen as a backscatter device, such as a device configured to communicate using a backscattering technique.

The wireless device 300, 300A, such as intermediate device, may for example communicate a first request to become a first intermediate device configured to handle communication of data between the network node 400 and one or more low power wireless device 500, 500A, where the first request is associated with a security configuration.

The first low power wireless device 500 may be connected in accordance with a security configuration, where the first low power wireless device 500 is in communication with the first wireless device 300, such as first intermediate device 300, which is indicated by the wireless links 10 and 14.

The first low power wireless device 500 may be connected in accordance with a security configuration, where the first low power wireless device 500 is in communication with the network node 400 via the first wireless device 300 and/or the second wireless device 300A, which is illustrated by the wireless links 10, 10A, 14, 14A. In other words, the links 10, 10A connect the first low power wireless device 500 and the second low power wireless device 500A to the network node 400, via the first wireless device 300 and/or the second wireless device 300A.

The second low power wireless device 500A is for example connected in accordance with a security configuration, such as a second security configuration, where the second low power wireless device 500A is in communication with the network node 400 via the first wireless device 300 and/or the second wireless device 300A, which is illustrated by the wireless links 12, 12A, 10, 10A, a first signal is sent from both intermediate devices 300, 300A.

The wireless devices 300, 300A may for example transmit, to the network node 400, data, e.g., via wireless link 10, 10A based on one or more signals from the first low power wireless device 500 and/or the second low power wireless device 500A and in accordance with the security configuration.

The wireless communication system 1 may be configured for downlink, DL, transmission of data, such as signals, from the network node 400 to the low power wireless devices 500, 500A, e.g., via the wireless devices 300, 300A, such as intermediate devices. Example downlink communications in the wireless communication system 1 can be seen in signalling diagrams shown in Fig. 8.

The wireless communication system 1 can include one or more low power wireless devices. The one or more low power wireless devices for example comprise one or more of: the first low power wireless device, the second low power wireless device, a third low power wireless device, etc. The number of low power wireless devices in the wireless communication system is not limiting. Furthermore, the number of low power wireless devices may be dynamic depending on the coverage of the low power wireless devices.

Fig. 2 show a flow diagram of an example method 100, performed by a first wireless device, such as a first intermediate device, according to the disclosure. The first wireless device is for example configured to handle, such as control, a security configuration in the communication of data between a network node and a first low power wireless device. The first wireless device is the first wireless device disclosed herein, such as the first wireless device 300 of Fig. 1 , Fig. 5, and Fig. 8.

The method 100 may for example be seen as a method, performed by a first wireless device, such as first intermediate node, for handling, such as controlling, connection of two or more intermediate devices and one or more low power wireless devices, e.g. backscatter devices, to a wireless communication system, such as a cellular system. In other words, the method 100 may be seen as a method for configuring a security configuration, e.g., for communication between one or more low power wireless devices and a network node via one or more intermediate devices.

The present disclosure proposes a signalling method to turn a regular wireless device, such as a UE, e.g., a mobile phone, into a wireless device intermediate device, such as an intermediate node, IN. In the present disclosure, it may be assumed that the wireless device hardware is capable of transmitting and receiving according to the low power wireless device, such as AloT, physical layer requirements. The present disclosure proposes a registration method to the network node where the network node authorizes the first wireless device, such as the intermediate device, and may provide security key sets for the set of low power wireless devices, such as AloT devices, that the first intermediate device will manage (such as serve). It may be appreciated that the presently disclosed method may provide security level based “onboarding” of the first wireless device, such as the first intermediate device, and the one or more low power wireless devices managed by the first intermediate device. It may be an important aspect of security to guarantee the validity and trustworthiness of an intermediate device to avoid attacks to the system and their connected low power wireless devices, such as AloT device nodes. The security configuration may be applied and configured related to the higher layer logical channels and may be different depending on the set of protocols used in the cellular network, e.g., non-access stratum, NAS, or access stratum, AS. The technique as disclosed herein may be applied for both NAS and AS independently.

The present disclosed method may allow to have a configurable security level that for example allow for a non-SIM based security for the link between first intermediate device and the low power wireless device. It may be appreciated that the request associated with the security configuration may originate in either of the involved architectural nodes with restriction of the low power wireless device, such as AloT Device, security capability.

The expression “one or more wireless devices or intermediate devices” refers to one or more of: the first wireless device or intermediate device, the second wireless device or intermediate device, and a third wireless device or intermediate device, etc. The number of wireless devices or intermediate devices in the wireless communication system is not limiting. Furthermore, the number of wireless devices or intermediate devices in the wireless communication system may be dynamic depending on the coverage of the wireless devices or intermediate devices.

The security configuration can be seen as a configuration of a security level or requirement in the communication between one or more low power wireless devices and a network node via one or more intermediate devices. In other words, the security configuration can for example be seen as a configuration of security type or level in communications between one or more (such as a first and/or second) low power wireless devices, one or more (such as a first and/or second) intermediate devices, and/or a network node, such as a radio network node. In some examples, the security configuration can be seen as a mode, and/or a mode type, and/or a profile. The security configuration can assist the intermediate device on how to handle, manipulate, support, control the handling of data communication between the low power wireless device, the network node, and the first intermediate device. In other words, the security configuration may define which security parameters and/or protocols to use for on-boarding the one or more low power wireless devices. The security configuration may assist the intermediate device on how to handle, manipulate, support, control the handling the security requirements when handling the signal(s) from the one or more low power wireless devices, e.g. in forwarding, decoding, compiling, combining, filtering, etc.

In some examples, the security configuration can be seen as a security scheme profile, e.g., of a low power wireless device. In one or more example methods, the security configuration may be seen as a security user profile of the low power wireless device. In other words, obtaining security configuration type information may be seen as obtaining a user profile, such as setting a user profile, of the low power wireless device. A security configuration may indicate to an intermediate device how to operate, control, and/or handle signals, such as how to forward signals, from one or more low power wireless devices based on the security configuration associated with the low power wireless device. The security configuration may for example be seen as type or level of security (such as a security standard) to be applied to a communication configuration, e.g., according to which one or more devices and/or nodes of the wireless communication system may be configured to communicate. In some examples, the security configuration can be seen as indicative of one or more security configuration parameters, e.g., security configuration options, according to which one or more devices and/or nodes of the wireless communication system may be configured to communicate. The one or more parameters may for example be seen as one or more parameters for configuration of security between the network node and the first low power wireless device.

The method 100 comprises communicating S102, with a network node, a first request to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless device. In one or more example methods, communicating S102 a first request comprises receiving, from the network node, a first request for the first wireless device to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless device. The first request may be comprised in a first message communicated between the first wireless device and the network node.

In one or more example methods, communicating S102 a first request comprises transmitting, to the network node, a first request for the first wireless device to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless devices. For example, the first request may be seen as a request for the first wireless device to act as a first intermediate device to handle communication of data between the network node and one or more low power wireless devices. The first request may be a request to become a first intermediate device for serving one or more low power wireless devices. In other words, the first wireless device, such as UE, may signal with the first request its transformation into an intermediate node or device that will connect low power wireless devices, such as AloT devices, to a cellular network according to a security configuration, e.g., that may have different security levels.

The first request is associated with a security configuration, such as a security configuration as disclosed herein. For example, the first request may be associated with a security configuration mode.

In one or more example embodiments, the security configuration comprises one or more of: a full security configuration associated with a SIM- based security, a non-SIM based security configuration, and a no security configuration. In other words, the first request may be indicative of one of: the full security mode, the non-sim based security mode, and the no security mode.

A full security configuration may be seen as an end-to-end SIM-based security configuration. The full security configuration may be seen as full security utilized in 3GPP cellular systems. For example, the full security configuration may use the SIM-based key management where keys are derived based on the main keys from the SIM card. For the full security configuration, it may be necessary to support signaling to setup and verify the selected ciphering and integrity settings with the inclusion of the first intermediate device. It may be appreciated that there may be two scenarios: one where the data is decoded and terminated at the first intermediate device and one where the first intermediate device only forwards the secured data.

A non-SIM based security configuration may be seen as a non-SIM based security configuration mode, e.g., using a security configuration different from SIM-based security. For example, the non-SIM based security configuration may comprise a “Pin” based security setup from application side. For this example, the pin could be entered in various ways, such as pre- entered at production, entered at on-boarding, such as when pairing in Bluetooth. The Pinbased security may be seen as application-based security, or at least partially application-based security. A fully application-based security may only protect the payload data, whereas the present disclosure proposes to extend this protection to be able to use a user-entered pin for also validating the low power wireless device integrity, such as AloT device integrity, and any control plane functionality. In other words, here the non-SIM based security configuration may inherit an application-based security mechanism to also protect the 3GPP based link between the first intermediate device and the low power wireless device, such as IN and AloT. Keys, such as PIN keys, may be generated both for integrity protection and for ciphering. The network node may be aware of the security configuration or approach and may handle the traffic in a way suitable given the applied security configuration.

A no security configuration may be seen as a no security mode. The no security configuration may be seen as an “Open” mode where no 3GPP based security is applied between the first intermediate device and the low power wireless device. However, a fully application-based security could be used on the payload data. The network node may not be aware of the security configuration as the network node may see the link as open to any attacker.

The method 100 comprises, in response to the first request, configuring S104 the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration. In other words, configuring S104 the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration, may comprise configuring the first wireless device to become or act as the first intermediate device between the network node and the one or more low power wireless devices. For example, configuring S104 the first wireless device to handle communication of data between the network node and one or more low power wireless devices according to the security configuration may comprise applying, deploying, or implementing the security configuration when setting up data communication between the network node and the one or more low power wireless devices via the first intermediate device. In one or more example embodiments, configuring S104 the first wireless device may comprise on-boarding the one or more low power wireless devices according to the security configuration.

In one or more example embodiments, configuring S104 the first wireless device to handle communication of data comprises, in response to the first request, communicating S104A, with the network node, a first confirmation. The first confirmation may be comprised in a first confirmation message, such as a first confirmation message confirming the first request. In one or more example embodiments, the first confirmation may decline the first request.

In one or more example methods, communicating S104A a first confirmation comprises optionally receiving, from the network node, a first confirmation for the first request to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless device.

In one or more example methods, a response to the first request may be seen as an absence of a communication from the network node. For example, in response to the first request, configuring S104 the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration may comprise, in response to an absence of a communication from the network node, configuring the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration.

In one or more example methods, communicating S104A a first confirmation comprises transmitting, to the network node, a first confirmation for the first request for the first wireless device to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless devices.

The first wireless device, such as the first intermediate device, may have the capability to configure different security configurations, such as different security functions, e.g., the full security mode, the non-SIM based security configuration, and/or the no-security configuration may be supported and signaled to network node as an indication of the possible security configuration. The network node may have to grant the selection/usage of security configuration or mode, e.g., with the first confirmation. In one or more example embodiments, the communication of the first request and the first confirmation may be seen as an initial configuration of security of the first intermediate device. The first intermediate device may use multiple security configurations or modes for the different low power wireless devices, such as AloT devices, configurations but could also only use one common security configuration. Also, it could be possible for a network node to use the security configuration to select or prohibit usage of certain wireless devices, such as intermediate devices, for a low power wireless device, such as AloT device. For example, the network node may deny or decline the first request from the first intermediate device in the first confirmation. This may for example be the case if the first wireless device is deemed unsecure. The first wireless device, such as first intermediate device, may be configured to retrieve a security configuration, such as a security configuration type, of a low power wireless device. In one or more example embodiments, configuring S104 the first wireless device to handle communication of data comprises performing S104B a discovery action of one or more low power wireless devices in the vicinity of the first wireless device. A discovery phase or action can for example be seen as a phase of communications of the wireless communication system where the low power wireless device and/or intermediate devices are discovered, such as detected. For example, the discovery action may comprise detecting one or more low power wireless devices within a signalling range of one or more intermediate device and/or the network node. A discovery action may be performed during a discovery phase. A discovery action may comprise transmitting and/or receiving a first signal, such as transmitted from the first intermediate device, and may in some examples comprise the first identification information indicative of the identity of the first low power wireless device and/or the first signal may comprise any other information indicative of a low power wireless device being within a signalling range of the first intermediate device. A performing a discovery action may comprise transmitting a first signal, such as a discovery signal. The discovery signal, such as the discovery message, transmitted by the first low power wireless device may be received by one or more intermediate devices and/or the network node, such as via one or more intermediate devices. A discovery action may be done to perform an on-boarding of one or more low power wireless devices. In one or more example embodiments, the discovery action may be performed prior to the communication S102 of the first request.

The method 100 comprises transmitting S106, to the network node, a message informing the network node about the configuring of the one or more low power wireless devices. In other words, the message may be seen as a message informing the network node about the configuring of the first wireless device to handle communication of data between the network node and the one or more low power wireless devices. The message may be indicative of information regarding the on-boarding of the one or more low power wireless devices at the first intermediate device. For example, the message may be seen as a request to associate the first intermediate device with the one or more low power wireless devices, e.g., according to the security configuration.

In one or more example embodiments, configuring S104 the first wireless device to handle communication of data comprises obtaining S104C, from the one or more low power wireless devices, one or more identifiers associated with one or more low power wireless device. For example, where each identifier is associated with a low power wireless device or where a group of low power wireless devices are associated with a common identifier, such as a group-based registration. An identifier may be seen as an identification information (e.g. uniquely identifying) indicative of an identity of a low power wireless device to be allowed to communicate with the first intermediate device, such as to be allowed to receive, from the first intermediate device, one or more signals and in accordance with the security configuration. In one or more example embodiments, the one or more low power wireless devices may signal their security level or security configuration (such as current security configuration or security configuration capability) to the first wireless device. For example, a low power wireless device may include information about its security level or security configuration with the transmission of the message comprising the identifier.

In one or more example embodiments, obtaining S104C one or more identifiers may be seen as happening during a discovery phase as disclosed herein, such as a discovery response. In other words, the one or more low power wireless devices may in response to receiving a discovery signal, respond by transmitting one or more identifiers.

In one or more example embodiments, the message is to associate the first intermediate device with a list of the one or more identifiers. In other words, the message may be seen as a message comprising a request from the first wireless device to the network node to become the first intermediate device for the list of one or more identifiers. The list of one or more identifiers may indicate an association of the low power wireless devices with one or more identifiers.

In some examples, upon first discovery the intermediate device may be configured to report every low power wireless device detected, such as every identifier of each low power wireless device detected. The network node may for example provide, e.g., upon receiving these identifiers, with a populated list of intermediate device association to a low power wireless device, e.g., based on the low power wireless device within signalling range of the intermediate device detected during discovery. The network node may for example provide a list, such as a list of identifiers, of expected, allowed, and/or prohibited low power wireless devices to the intermediate device, in other words a whitelist and/or a blacklist of identifiers indicative of the identity of one or more low power wireless device.

The one or more identifiers for example comprise a first identifier indicative of the identity of the first low power wireless device. In other words, the first low power wireless device may be identified based on the first identifier.

The one or more identifiers for example comprise a second identifier indicative of the identity of the second low power wireless device. In other words, the second low power wireless device may be identified based on the second identifier. The first intermediate device may for example identification information, such as one or more identifiers, from the network node and/or the one or more low power wireless device. In some examples, the identification information may be provided to the first intermediate device from the application layer, e.g., via the network node. In some examples, the identifier is hardcoded into a SIM of the low power wireless devices. The identification information, such as one or more identifiers, may for example be seen as being obtained during a discovery phase of communications in the wireless communication system.

In one or more example embodiments, configuring S104 the first wireless device to handle communication of data comprises obtaining S104D one or more keys for the one or more identifiers, where each key is associated with an identifier. A key may be associated with one low power wireless device and/or with a group of low power wireless devices, e.g., depending on the association of the low power wireless device to one or more identifiers. A key may be seen as an encryption key, an integrity protection key, and/or an authentication key. For example, a key may comprise one or more of: a root key, an access security management entity key, a NAS encryption key, a NAS integrity key, an eNodeB key, an RRC encryption key, an RRC integrity key, a user plane encryption key, and a gNodeB key.

In one or more example embodiments, obtaining S104D one or more keys comprises obtaining S104D1 , from the network node, a list of one or more keys based on the one or more identifiers. The obtaining S104D1 of a list of one or more keys from the network node may be done according to the full security configuration.

For example, in full security configuration, the one or more keys, such as one or more main secret key(s), are known at both ends, i.e. by the network node and by the one or more low power wireless devices, such as AloT devices. However, the first intermediate device may not be aware of the key(s) and should not be. For the full security configuration, a mechanism where the derived keys for the link between the first intermediate device and the low power wireless devices may be communicated on the encrypted link network node-first intermediate device. The keys may then be used by the first intermediate device directly or be used to derive further keys. The low power wireless devices may derive the same keys and the signaling between the first intermediate device and the low power wireless devices may only be related to validating that the key generation is the same (such as corresponds) and that messages are possible to decrypt. In the example of steps S104F and S104G, a two-sided validation is performed. However, the validation of the key(s) may be done in either direction (such as either direction between the first intermediate device and the low power wireless devices) only to reduce signaling or any validity check could be prohibited. In one or more example embodiments, obtaining S104D one or more keys comprises obtaining S104D2, from an application function, a list of one or more keys based on the one or more identifiers. The obtaining S104D2 of a list of one or more keys from an application function may be done according to the non-SIM based security configuration, such as PIN-based security configuration.

It may be appreciated that the discovery phase between the first wireless device, such as first intermediate device, and the one or more low power wireless devices, such as AloT devices, may be done slightly differently depending on the security configuration.

For example, in non-SIM based security configuration, such as “Pin” Security mode, the first intermediate device may derive the main key(s) based on the discovery response, e.g., the one or more identifiers. The key(s) can be derived by reading it from an encrypted link over application layer, e.g., by having an application function to generate the key based on the identifiers or by having it stored in the first intermediate device application layer. At the low power wireless devices, the key may be e.g., pre-programmed/pre-configured at production or deployment. The following validation steps may be similar to validation performed for the full security configuration, e.g., steps S104F and S104G. A non-SIM based security configuration may comprise or be seen as security configuration using a personal key, such as a numeric personal value stored at the low power wireless device. A “Pin” security mode may be seen as a numeric personal value key, such as a numeric personal value stored at the low power wireless device.

For the no-security configuration, such as “Open” mode, discovery phase there may be no key management related procedure needed. It may be assumed to happen at application layer if such mechanism is present.

In both the full security configuration and the non-SIM based security configuration, and in particular “Pin” mode, it may be advantageous to use a common identifier for a group of low power wireless devices and in turn a common security key set for a group of low power wireless devices, such as AloT Devices. This may of course be conditioned by the capability or possibility to configure a common key in all low power wireless devices, such as AloT devices.

In one or more example embodiments, configuring S104 the first wireless device to handle communication of data comprises requesting S104E, from the one or more low power wireless devices, a key validation according to the non-SIM based security configuration or the full security configuration. For example, the first wireless device may be configured to request S104E a key validation after having obtained the one or more keys. In other words, the first wireless device may request to validate the one or more keys with the one or more low power wireless devices. Requesting S104E a key validation from the one or more low power wireless devices may comprise transmitting a message indicative of the request for key validation to the one or more low power wireless devices. It may be appreciated that the request for key validation may initiate a two-side validation of a key, e.g., at the first intermediate device and at the one or more low power wireless devices.

In one or more example embodiments, configuring S104 the first wireless device to handle communication of data comprises transmitting S104F, to the one or more low power wireless devices, a first validation message. In other words, the method may comprise transmitting, from the first intermediate device to the one or more low power wireless devices, a first validation message associated with a key. The transmission of the first validation message may happen after the request for key validation, e.g., in response to the key validation request. In one or more example embodiments, the first validation message may be different for each low power wireless device, e.g., when each low power wireless device has a different key. In one or more example embodiments, the first validation message may be the same for a group of low power wireless devices, e.g., having the same key. The first validation message may be seen as a ciphered message using a key, such as a first key.

In one or more example embodiments, configuring S104 the first wireless device to handle communication of data comprises obtaining S104G, from the one or more low power wireless devices, a second validation message in response to the first validation message. The low power wireless device may then attempt to read the first validation message and sends back a second validation message indicating whether the low power wireless device succeeded in reading the first validation message or not. The second validation message may be seen as a ciphered message using a key, such as a second key. The first key and the second key may be the same key or a different key.

In one or more example embodiments, configuring S104 the first wireless device to handle communication of data comprises validating S104H the second validation message. In other words, the first wireless device or first intermediate device may validate the second validation message indicating a validation from the low power wireless device. This validation may be seen as the last step of the two-sided validation between the first intermediate device and the low power wireless device.

In one or more example embodiments, transmitting S106, to the network node, a message informing the network node comprises transmitting S106A, to the network node, a second request for registering the one or more low power wireless devices. For example, the second request may comprise a request for registering a list of identifiers associated with the one or more low power wireless devices, e.g., that have been validated. The second request may be seen as a message indicative of the second request. For example, when the first intermediate device-low power wireless device, such as IN-AloT Device, link is secured the first intermediate device may report and request the low power wireless devices, such as AloT Devices, to be registered to the first intermediate device and to the Network. It may be appreciated that the low power wireless devices may be authenticated differently in the network depending on the security configuration used. For example, the network node may be fully aware of how secure the link is, e.g., may be aware of the security configuration used, and may select action thereafter. The second request may indicate that the security authentication of the one or more low power wireless devices have been completed and that the first intermediate device requests to register them as being served by the first intermediate device.

In one or more example embodiments, the message transmitted in S106 may comprise or be indicative of the second request for registering the one or more low power wireless devices.

In one or more example embodiments, the method 100 comprises in response to the second request, obtaining S107, from the network node, a confirmation of registration and authentication of the one or more low power wireless devices. In other words, the network node may indicate to the first intermediate device a confirmation of registration and authentication of the one or more low power wireless devices in response to the second request for registering the one or more low power wireless devices. For example, the network node may transmit a message indicating that the list of identifiers associated with the one or more low power wireless devices have been registered as being served by the first intermediate device and have been authenticated according to the security configuration. In one or more example embodiments, the confirmation of registration and authentication may be in response to the message of step S106, such as a message from the network node in response to the message of S106.

In one or more example embodiments, the method 100 comprises in response to the message (e.g., transmitted in S106), obtaining S108, from the network node, a confirmation to use the no security configuration in a communication link between the first intermediate device and the one or more low power wireless devices. For example, when using the no security configuration there may be no key validation procedure as described before for the full security configuration and the non-SIM based security configuration. For the no security configuration, the first intermediate device may directly request for registering the one or more low power wireless devices without prior authentication procedure between the first intermediate device and the one or more low power wireless devices, e.g., with the second request. In one or more example embodiments, the method 100 comprises communicating S110 with the one or more low power wireless devices according to the security configuration, such as according to one or more security parameters defined by the security configuration. In other words, when the network node has been informed about the security configuration, such as informed about the registering of the one or more low power wireless devices, data communication may be established and the first wireless device may act as first intermediate device serving the communication link to the low power wireless devices, such as AloT devices.

In one or more example embodiments, the method 100 comprises selecting S105 the security configuration according to one or more criteria.

Given the possibly very low available energy at the low power wireless device, such as AloT device, the first intermediate device may be configured to change encryption mode of its managed low power wireless devices. The first intermediate device could indicate by a message to the low power wireless devices to change security configuration, such as security mode, and may at the same time also inform the network node about the change. For example, it may be possible to have different security configurations or modes for different interfaces or entities, e.g., if user plane and control plane or if both are handled at user plane, the security configuration may be indicated by a trigger message. This could for example enable a device with very low power levels to communicate some critical data or control without having power penalty from the security overhead.

In one or more example embodiments, the method 100 comprises selecting S105A the security configuration based on an available energy at the one or more low power wireless devices. In other words, the method comprises selecting S105A the security configuration based on a capability of the one or more low power wireless devices. For example, the no security configuration may be selected to conserve energy, e.g., at the AloT device.

It may be appreciated that the security configuration may be selected dynamically based on power consumption. For example, when there is no or very limited energy is available, the no security configuration, such as “open” mode, may be selected to save energy.

In one or more example embodiments, the security configuration may be selected based on security properties of the first intermediate device. In one or more example embodiments, the security configuration may be selected based on an environment of the first intermediate device and/or the low power wireless devices, e.g., when the first intermediate device is located in an area that is unlikely to be at security risk, such as in a secure facility, e.g., having card access readers. In one or more example embodiments, the method 100 comprises selecting S105B the security configuration based on an integrity requirement and/or a ciphering requirement. For example, when there is an integrity requirement and/or a ciphering requirement, the security configuration may have to meet a level of security and therefore the security configuration may be selected in view of these requirements. The full-security configuration and the non-SIM based security configuration may therefore be used for integrity requirement and/or a ciphering requirement.

In one or more example embodiments, the method 100 comprises selecting S105C the security configuration based on the type of data to be communicated. In other words, different data types could have different security modes. For example, a low power wireless device may report data about temperature according to the no security configuration. However, the same low power wireless device may report some other parameters with a different security configuration. This could also lead to the case of having multiple security configurations, such as modes, configured and validated.

It may be appreciated that any of the definitions and terms used in the description of Fig. 2 may also apply to the description of Fig. 1 , Fig. 3, Fig. 4, Fig. 5, Fig. 6, Fig. 7, Fig. 8, and vice versa. For example, any definitions and terms associated with the method performed by the first wireless device disclosed herein may also apply and/or be used to the definitions and terms relating to the method performed by the network node and to the network node itself as disclosed herein and vice versa.

For example, any definitions and terms associated with the method performed by the first wireless device disclosed herein may also apply and/or be used to the definitions and terms relating to the method performed by the first low power wireless device and to the first low power wireless device itself as disclosed herein and vice versa.

For example, any definitions and terms associated with the method performed by the network node disclosed herein may also apply and/or be used to the definitions and terms relating to the method performed by the first low power wireless device and to the first low power wireless device itself as disclosed herein and vice versa.

Fig. 3 shows a flow diagram of an example method 200, performed by a network node according to the disclosure. The network node is the network node disclosed herein, such as network node 400 of Fig. 1 , Fig. 6, and Fig. 8.

The method 200 may be for example be seen as a method, performed by a network node, for example configured to handle, such as control, a security configuration in the communication of data between a network node and a first low power wireless device. The method 200 may for example be seen as a method, performed by a network node, for handling, such as controlling, connection of two or more intermediate devices and one or more low power wireless devices, e.g. backscatter devices, to a wireless communication system, such as a cellular system. In other words, the method 200 may be seen as a method for configuring a security configuration, e.g., for communication between one or more low power wireless devices and a network node via one or more intermediate devices.

The method 200 comprises communicating S202, with a first wireless device, a first request for the first wireless device to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless device, wherein the first request is associated with a security configuration. The method 200 comprises in response to the first request, configuring S204 the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration.

In one or more example embodiments, configuring S204 the first wireless device to handle communication of data comprises transmitting S204A, to the first wireless device, a list of one or more keys based on one or more identifiers associated with one or more low power wireless devices.

In one or more example embodiments, configuring S204 the first wireless device to handle communication of data comprises in response to receiving a second request for registering the one or more low power wireless device from the first wireless device, transmitting S204B, to the first wireless device, a confirmation of registration and authentication of the one or more low power wireless devices.

The method 200 comprises receiving S206, from the first wireless device, a message informing the network node about the configuring of the one or more low power wireless devices.

In one or more example embodiments, the method comprises communicating S208 with the one or more low power wireless devices according to the security configuration.

Fig. 4 shows a flow diagram of an example method 700, performed by a first low power wireless device according to the disclosure. The first low power wireless device is the first low power wireless device disclosed herein, such as the first low power wireless device 500 of Fig. 1 , Fig.

7, and Fig. 8. The method 700 may be seen as a method for configuring a communication link between the first low power wireless device and one or more intermediate devices. For example, the method 700 may be seen as a method for performing key validation with an intermediate device. The method 700 comprises transmitting S702, to a first wireless device, a first identifier associated with the first low power wireless device. The method 700 comprises receiving S704, from the first wireless device, a request for a key validation according to a security configuration. The method 700 comprises receiving S706, from the first wireless device, a first validation message. The method 700 comprises transmitting S708, to the first wireless device, a second validation message in response to the first validation message.

In one or more example embodiments, the first low power wireless device is configured to communicate data with the network node, such as via the first wireless device, according to the security configuration.

Fig. 5 shows a block diagram of an example first wireless device 300 according to the disclosure. The first wireless device 300 comprises memory circuitry 301 , processor circuitry 302, and a wireless interface 303. The first wireless device 300 may be configured to perform any of the methods disclosed in Fig. 2. In other words, the first wireless device 300 may be configured to handle, such as control, a security configuration in the communication of data between a network node and a first low power wireless device. The first wireless device may be configured for handling, such as controlling, connection of two or more intermediate devices and one or more low power wireless devices, e.g. backscatter devices, to a wireless communication system, such as a cellular system. In other words, the first wireless device 300 may be seen as configured for configuring a security configuration, e.g., for communication between one or more low power wireless devices and a network node.

The first wireless device 300 is configured to communicate, using a wireless communication system, with a first low power wireless device, such as the low power wireless device 500 disclosed herein, and a network node, such as the network node 400 disclosed herein.

The first wireless device 300 is configured to communicate (such as via the memory circuitry 301 , the processor circuitry 302, and/or the wireless interface 303), with a network node, a first request to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless devices. The first request is associated with a security configuration. The first wireless device 300 is configured to, in response to the first request, configure (such as via the memory circuitry 301 , the processor circuitry 302, and/or the wireless interface 303) the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration. The first wireless device 300 is configured to transmit (such as via the memory circuitry 301 , the processor circuitry 302, and/or the wireless interface 303), to the network node, a message informing the network node about the configuring of the one or more low power wireless devices.

The wireless interface 303 is configured for wireless communications via a wireless communication system, such as a 3GPP system, such as a 3GPP system supporting one or more of: New Radio, NR, Long Term Evolution, LTE, Narrow-band loT, NB-loT, ambient loT, and Long Term Evolution - enhanced Machine Type Communication, LTE-M, and 3GPP system operated in licensed bands or unlicensed bands.

The first wireless device 300 may be configured to perform any of the operations disclosed in Fig. 2. The operations of the first wireless device 300 may be embodied in the form of executable logic routines (for example, lines of code, software programs, etc.) that are stored on a non-transitory computer readable medium (for example, memory circuitry 301 ) and are executed by processor circuitry 302).

Furthermore, the operations of the first wireless device 300 may be considered a method that the first wireless device 300 is configured to carry out. Also, while the described functions and operations may be implemented in software, such functionality may also be carried out via dedicated hardware or firmware, or some combination of hardware, firmware and/or software.

Memory circuitry 301 may be one or more of a buffer, a flash memory, a hard drive, a removable media, a volatile memory, a non-volatile memory, a random access memory (RAM), or other suitable device. In a typical arrangement, memory circuitry 301 may include a nonvolatile memory for long term data storage and a volatile memory that functions as system memory for processor circuitry 302. Memory circuitry 301 may exchange data with processor circuitry 302 over a data bus. Control lines and an address bus between memory circuitry 301 and processor circuitry 302 also may be present (not shown in Fig. 5). Memory circuitry 301 is considered a non-transitory computer readable medium.

Memory circuitry 301 may be configured to store security configurations, such as security configuration information, identifiers, and/or keys, in a part of the memory.

Fig. 6 shows a block diagram of an example network node 400 according to the disclosure. The network node 400 comprises memory circuitry 401 , processor circuitry 402, and a wireless interface 403. The network node 400 may be configured to perform any of the methods disclosed in Fig. 3. In other words, the network node 400 may be to handle, such as control, a security configuration in the communication of data between a network node, a first wireless device and a first low power wireless device. The network node 400 may be configured for handling, such as controlling, connection of two or more intermediate devices and one or more low power wireless devices, e.g. backscatter devices, to a wireless communication system, such as a cellular system. In other words, the network node 400 may be configured for configuring a security configuration, e.g., for communication between one or more low power wireless devices and a network node via one or more intermediate devices.

The network node 400 is configured to communicate, using a wireless communication system, with a first low power wireless device, such as the low power wireless device 500 disclosed herein, and a first intermediate device, such as the first intermediate device 300 disclosed herein.

The wireless interface 403 is configured for wireless communications via a wireless communication system, such as a 3GPP system, such as a 3GPP system supporting one or more of: New Radio, NR, Long Term Evolution, LTE, Narrow-band loT, NB-loT, ambient loT, and Long Term Evolution - enhanced Machine Type Communication, LTE-M, and 3GPP system operated in licensed bands or unlicensed bands.

The network node 400 is configured to communicate (such as via the processor circuitry 402 and/or the wireless interface 403), with a first wireless device, a first request for the first wireless device to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless device, wherein the first request is associated with a security configuration.

The network node 400 is configured to in response to the first request, configure (such as via the processor circuitry 402 and/or the wireless interface 403) the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration.

The network node 400 is configured to receive (such as via the processor circuitry 402 and/or the wireless interface 403), from the first wireless device, a message informing the network node about the configuring of the one or more low power wireless devices.

Processor circuitry 402 may be configured to perform any of the operations disclosed in Fig. 3.

The operations of the network node 400 may be embodied in the form of executable logic routines (for example, lines of code, software programs, etc.) that are stored on a non-transitory computer readable medium (for example, memory circuitry 401 ) and are executed by processor circuitry 402).

Furthermore, the operations of the network node 400 may be considered a method that the network node 400 is configured to carry out. Also, while the described functions and operations may be implemented in software, such functionality may also be carried out via dedicated hardware or firmware, or some combination of hardware, firmware and/or software.

Memory circuitry 401 may be one or more of a buffer, a flash memory, a hard drive, a removable media, a volatile memory, a non-volatile memory, a random access memory (RAM), or other suitable device. In a typical arrangement, memory circuitry 401 may include a nonvolatile memory for long term data storage and a volatile memory that functions as system memory for processor circuitry 402. Memory circuitry 401 may exchange data with processor circuitry 402 over a data bus. Control lines and an address bus between memory circuitry 401 and processor circuitry 402 also may be present (not shown in Fig. 6). Memory circuitry 401 is considered a non-transitory computer readable medium.

Memory circuitry 401 may be configured to store security configurations, such as security configuration information, identifiers, and/or keys in a part of the memory.

Fig. 7 shows a block diagram of an example first low power wireless device 500 according to the disclosure. The first low power wireless device 500 comprises memory circuitry 501 , processor circuitry 502, and a wireless interface 503. The first low power wireless device 500 may be configured to perform any of the methods disclosed in Fig. 4. The first low power wireless device 500 may be configured to configure a communication link between the first low power wireless device and one or more intermediate devices. For example, the first low power wireless device 500 may be configured to perform key validation with an intermediate device. The first low power wireless device 500 is configured to communicate, using a wireless communication system, with a network node, such as the network node 400 disclosed herein, and a first wireless device, such as first intermediate device, such as the first wireless device 300 disclosed herein.

The first low power wireless device 500 is configured to transmit (e.g., via the processor circuitry 502 and/or the wireless interface 503), to a first wireless device, a first identifier associated with the first low power wireless device. The first low power wireless device 500 is configured to receive (e.g., via the processor circuitry 502 and/or the wireless interface 503), from the first wireless device, a request for a key validation according to a security configuration. The first low power wireless device 500 is configured to receive (e.g., via the processor circuitry 502 and/or the wireless interface 503), from the first wireless device, a first validation message. The first low power wireless device 500 is configured to transmit (e.g., via the processor circuitry 502 and/or the wireless interface 503), to the first wireless device, a second validation message in response to the first validation message. Fig. 8 shows a signaling diagram according to this disclosure. The network node 400 shown in Fig. 8 is, for example the network node disclosed herein, such as network node 400 of Fig. 1 and 6. The first wireless device 300, 300A shown in Fig. 8 is, for example the first wireless device disclosed herein, such as wireless device 300 of Fig. 1 and 5. The first low power wireless device 500, 500A shown in Fig. 8 is, for example the first low power wireless device 500, 500A of Fig. 1 and Fig. 7.

Fig. 8 shows a signaling diagram of example communication 800 between a network node 400, a first wireless device 300, 300A, and a first low power wireless device 500, 500A. Fig. 8 can for example be seen as showing the security configuration, such as the configuration, being provided, such as triggered, by a first wireless device 300 and/or a low power wireless device 500, e.g., that is associated with a given security configuration.

In one or more examples, the first wireless device 300 communicates a first request 802 to a network node 400 to become a first intermediate device configured to handle communication of data between the network node 400 and one or more low power wireless devices, such as the first low power wireless device 500. The first request 802 for example corresponds with the first request in S102 of Fig. 2 and in S202 of Fig. 3.

In one or more examples, in response to the first request, the first wireless device 300 optionally communicates (such as receives) with the network node 400, a first confirmation 804. In other words, the network node 400 communicates (such as transmits) with the first wireless device 300 a first confirmation 804. The first confirmation 804 for example corresponds with the first confirmation in S104A of Fig. 2.

In some examples, an absence of a communication from the network node 400 may be taken by the first wireless device 300 as an indication to proceed with configuring the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration.

In one or more examples, the first wireless device 300 transmits a discovery action 806 to a first low power wireless device 500, such as a message or signal indicative of a discovery. In other words, the first low power wireless device 500 obtains (such as receives) a discovery action 806 from the first wireless device 300. The discovery action 806 for example corresponds with the discovery action in S104B of Fig. 2. In one or more examples, the first wireless device 300 obtains (such as receives) one or more identifiers 808 from the first low power device 500. In other words, the first low power device 500 transmits to the first wireless device 300, one or more identifiers 808. The one or more identifiers 808 for example corresponds with the one or more identifiers in S104C of Fig. 2.

In one or more examples, the first wireless device 300 transmits to the network node 400 a message 810 to associate the first intermediate device with a list of one or more identifiers. In other words, the network node 400 receives a message to associate the first intermediate device with a list of the one or more identifiers 810. The message 810 for example corresponds with the message in S106 of Fig. 2.

In one or more examples, the first wireless device 300 obtains (such as receives) from the network node 400, a list 812 of one or more keys based on the one or more identifiers. In other words, the network node 400 transmits to the first wireless device 300, a message comprising or indicative of a list 812 of one or more keys based on the one or more identifiers. The list 812 of one or more keys for example corresponds to the one or more keys in S104D of Fig. 2.

In one or more examples, the first wireless device 300 transmits (such as requests) to the first low power wireless device 500, a key validation 814, according to the non-SIM based security configuration or the full security configuration. In other words, the first low power wireless device 500 receives from the first wireless device 300 a key validation request 814. The request for key validation 814 for example corresponds to the request for key validation in S104E of Fig. 2.

In one or more examples, the first wireless device 300 transmits to the first low power wireless device 500, a first validation message 816. In other words, the first low power wireless device 500 obtains (such as receives) from the first wireless device 300 a first validation message 816. The first validation message 816 for example corresponds to the first validation message in S104F of Fig. 2.

In one or more examples, a first low power wireless device 500 attempts to validate 818 the message.

In one or more examples, the first low power wireless device 500 transmits a second validation message 820 to the first wireless device 300. In other words, the first wireless device 300 obtains (such as receives) from the first low power wireless device 500 a second validation message 820. The second validation message 820 for example corresponds to the second validation message in S104G of Fig. 2. In one or more examples, the wireless device 300 attempts to validate 822 the second validation message.

In one or more examples, the wireless device 300 transmits to the network node 400 a second request 824 for registering the one or more low power devices. In other words, the network node 400 obtains (such as receives) a second request 824 for registering the one or more low power devices from the wireless device 300. The second request 824 for example corresponds to the second request in S106A of Fig. 2. In one or more example embodiments, the first wireless device 300 transmits a message 824 informing the network node 400 about the configuring of the one or more low power wireless devices. The message 824 may for example correspond to the message in S106 of Fig. 2.

In one or more examples, in response to the message, the first wireless device 300 obtains (such as receives) from the network node 400 a confirmation 826 to use the security configuration. In one or more example embodiments, the confirmation 826 is a confirmation to use the no security configuration in a communication link between the first intermediate device and the one or more low powerless wireless devices, such as the first low power wireless device 500. In other words, the network node 400 transmits, to a first wireless device 300, a confirmation 826 to use the no security configuration.

In one or more example embodiments, the confirmation 826 is a confirmation of registration and authentication of the one or more low power wireless devices in response to the second request.

In one or more examples, the first wireless device 300 and the first low power wireless device 500 communicate data 828 according to the security configuration.

In one or more examples, the first wireless device 300 and the network node 400 communicate data 830. In other words, the first wireless device 300 transmits data to the network node 400 and/or the network node 400 transmit, to the first wireless device 300 data while the first wireless device 300 receives the data from the network node 400.

Examples of methods and products (network node, low power wireless device, and wireless device) according to the disclosure are set out in the following items:

Item 1 . A method (100), performed by a first wireless device, the method comprising: communicating (S102), with a network node, a first request to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless device, wherein the first request is associated with a security configuration; in response to the first request, configuring (S104) the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration; and transmitting (S106), to the network node, a message informing the network node about the configuring of the one or more low power wireless devices.

Item 2. The method according to item 1 , wherein the security configuration comprises one or more of: a full security configuration associated with a SIM-based security, a non-SIM based security configuration, and a no security configuration.

Item 3. The method according to any of the previous items, wherein configuring (S104) the first wireless device to handle communication of data comprises: in response to the first request, communicating (S104A), with the network node, a first confirmation.

Item 4. The method according to any of the previous items, wherein configuring (S104) the first wireless device to handle communication of data comprises: performing (S104B) a discovery action of one or more low power wireless devices in the vicinity of the first wireless device.

Item 5. The method according to item 4, wherein configuring (S104) the first wireless device to handle communication of data comprises: obtaining (S104C), from the one or more low power wireless devices, one or more identifiers associated with one or more low power wireless device.

Item 6. The method according to item 5, wherein the message is to associate the first intermediate device with a list of the one or more identifiers. Item 7. The method according to any of items 5-6, wherein configuring (S104) the first wireless device to handle communication of data comprises: obtaining (S104D) one or more keys for the one or more identifiers, where each key is associated with an identifier.

Item 8. The method according to item 7, wherein obtaining (S104D) one or more keys comprises obtaining (S104D1 ), from the network node, a list of one or more keys based on the one or more identifiers.

Item 9. The method according to item 7, wherein obtaining (S104D) one or more keys comprises obtaining (S104D2), from an application function, a list of one or more keys based on the one or more identifiers.

Item 10. The method according to any of items 8-9 as dependent on item 2, wherein configuring (S104) the first wireless device to handle communication of data comprises: requesting (S104E), from the one or more low power wireless devices, a key validation according to the non-SIM based security configuration or the full security configuration.

Item 11. The method according to item 10, wherein configuring (S104) the first wireless device to handle communication of data comprises: transmitting (S104F), to the one or more low power wireless devices, a first validation message.

Item 12. The method according to item 11 , wherein configuring (S104) the first wireless device to handle communication of data comprises: obtaining (S104G), from the one or more low power wireless devices, a second validation message in response to the first validation message.

Item 13. The method according to item 12, wherein configuring (S104) the first wireless device to handle communication of data comprises: validating (S104H) the second validation message.

Item 14. The method according to any of the previous items, wherein transmitting (S106), to the network node, a message informing the network node comprises: transmitting (S106A), to the network node, a second request for registering the one or more low power wireless devices.

Item 15. The method according to item 14, the method comprising: in response to the second request, obtaining (S107), from the network node, a confirmation of registration and authentication of the one or more low power wireless devices.

Item 16. The method according to any of items 2-15, the method comprising: in response to the message, obtaining (S108), from the network node, a confirmation to use the no security configuration in a communication link between the first intermediate device and the one or more low power wireless devices.

Item 17. The method according to any of the previous items, the method comprising: communicating (S110) with the one or more low power wireless devices according to the security configuration.

Item 18. The method according to any of the previous items, the method comprising: selecting (S105A) the security configuration based on an available energy at the one or more low power wireless devices.

Item 19. The method according to any of the previous items, the method comprising: selecting (S105B) the security configuration based on an integrity requirement and/or a ciphering requirement.

Item 20. The method according to any of the previous items, the method comprising: selecting (S105C) the security configuration based on the type of data to be communicated.

Item 21. A method (200), performed by a network node, the method comprising: communicating (S202), with a first wireless device, a first request for the first wireless device to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless device, wherein the first request is associated with a security configuration; in response to the first request, configuring (S204) the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration; and receiving (S206), from the first wireless device, a message informing the network node about the configuring of the one or more low power wireless devices.

Item 22. The method according to item 21 , wherein configuring (S204) the first wireless device to handle communication of data comprises: transmitting (S204A), to the first wireless device, a list of one or more keys based on one or more identifiers associated with one or more low power wireless devices.

Item 23. The method according to any of items 21-22, wherein configuring (S204) the first wireless device to handle communication of data comprises: in response to receiving a second request for registering the one or more low power wireless device from the first wireless device, transmitting (S204B), to the first wireless device, a confirmation of registration and authentication of the one or more low power wireless devices.

Item 24. The method according to any of items 21-23, the method comprising: communicating (S208) with the one or more low power wireless devices according to the security configuration.

Item 25. A method (700), performed by a first low power wireless device, the method comprising: transmitting (S702), to a first wireless device, a first identifier associated with the first low power wireless device; receiving (S704), from the first wireless device, a request for a key validation according to a security configuration; receiving (S706), from the first wireless device, a first validation message; and transmitting (S708), to the first wireless device, a second validation message in response to the first validation message.

Item 26. A first wireless device comprising memory circuitry, processor circuitry, and a wireless interface, wherein the first wireless device is configured to perform any of the methods according to any of items 1-20.

Item 27. A network node comprising memory circuitry, processor circuitry, and a wireless interface, wherein the network node is configured to perform any of the methods according to any of items 21-24

Item 28. A first low power wireless device comprising memory circuitry, processor circuitry, and a wireless interface, wherein the first low power wireless device is configured to perform any of the methods according to item 25.

The use of the terms “first”, “second”, “third” and “fourth”, “primary”, “secondary”, “tertiary” etc. does not imply any particular order, but are included to identify individual elements. Moreover, the use of the terms “first”, “second”, “third” and “fourth”, “primary”, “secondary”, “tertiary” etc. does not denote any order or importance, but rather the terms “first”, “second”, “third” and “fourth”, “primary”, “secondary”, “tertiary” etc. are used to distinguish one element from another. Note that the words “first”, “second”, “third” and “fourth”, “primary”, “secondary”, “tertiary” etc. are used here and elsewhere for labelling purposes only and are not intended to denote any specific spatial or temporal ordering. Furthermore, the labelling of a first element does not imply the presence of a second element and vice versa.

It may be appreciated that Figures comprise some circuitries or operations which are illustrated with a solid line and some circuitries, components, features, or operations which are illustrated with a dashed line. Circuitries or operations which are comprised in a solid line are circuitries, components, features or operations which are comprised in the broadest example. Circuitries, components, features, or operations which are comprised in a dashed line are examples which may be comprised in, or a part of, or are further circuitries, components, features, or operations which may be taken in addition to circuitries, components, features, or operations of the solid line examples. It should be appreciated that these operations need not be performed in order presented. Furthermore, it should be appreciated that not all of the operations need to be performed. The example operations may be performed in any order and in any combination. It should be appreciated that these operations need not be performed in order presented. Circuitries, components, features, or operations which are comprised in a dashed line may be considered optional.

Other operations that are not described herein can be incorporated in the example operations. For example, one or more additional operations can be performed before, after, simultaneously, or between any of the described operations.

Certain features discussed above as separate implementations can also be implemented in combination as a single implementation. Conversely, features described as a single implementation can also be implemented in multiple implementations separately or in any suitable sub-combination. Moreover, although features may be described above as acting in certain combinations, one or more features from a claimed combination can, in some cases, be excised from the combination, and the combination may be claimed as any sub-combination or variation of any sub-combination

It is to be noted that the word "comprising" does not necessarily exclude the presence of other elements or steps than those listed.

It is to be noted that the words "a" or "an" preceding an element do not exclude the presence of a plurality of such elements.

It is to be noted that the term "indicative of may be seen as “associated with”, “related to”, “descriptive of’, “characterizing”, and/or “defining”. The terms “indicative of”, “associated with”, “related to”, “descriptive of’, “characterizing”, and “defining” can be used interchangeably. The term “indicative of” can be seen as indicating a relation. For example, weight data indicative of weight may comprise one or more weight parameters.

It is to be noted that the word "based on" may be seen as “as a function of” and/or “derived from”. The terms “based on” and “as a function of’ can be used interchangeably. For example, a parameter determined “based on” a data set can be seen as a parameter determined “as a function of” the data set. In other words, the parameter may be an output of one or more functions with the data set as an input.

A function may be characterizing a relation between an input and an output, such as mathematical relation, a database relation, a hardware relation, logical relation, and/or other suitable relations. It should further be noted that any reference signs do not limit the scope of the claims, that the examples may be implemented at least in part by means of both hardware and software, and that several "means", "units" or "devices" may be represented by the same item of hardware. Language of degree used herein, such as the terms “approximately,” “about,” “generally,” and “substantially” as used herein represent a value, amount, or characteristic close to the stated value, amount, or characteristic that still performs a desired function or achieves a desired result.

The various example methods, devices, nodes and systems described herein are described in the general context of method steps or processes, which may be implemented in one aspect by a computer program product, embodied in a computer-readable medium, including computerexecutable instructions, such as program code, executed by computers in networked environments. A computer-readable medium may include removable and non-removable storage devices including, but not limited to, Read Only Memory (ROM), Random Access Memory (RAM), compact discs (CDs), digital versatile discs (DVD), etc. Generally, program circuitries may include routines, programs, objects, components, data structures, etc. that perform specified tasks or implement specific abstract data types. Computer-executable instructions, associated data structures, and program circuitries represent examples of program code for executing steps of the methods disclosed herein. The particular sequence of such executable instructions or associated data structures represents examples of corresponding acts for implementing the functions described in such steps or processes.

Although features have been shown and described, it will be understood that they are not intended to limit the claimed disclosure, and it will be made obvious to those skilled in the art that various changes and modifications may be made without departing from the scope of the claimed disclosure. The specification and drawings are, accordingly, to be regarded in an illustrative rather than restrictive sense. The claimed disclosure is intended to cover all alternatives, modifications, and equivalents.

Claims

1 . A method (100), performed by a first wireless device, the method comprising: communicating (S102), with a network node, a first request to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless device, wherein the first request is associated with a security configuration; in response to the first request, configuring (S104) the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration; and transmitting (S106), to the network node, a message informing the network node about the configuring of the one or more low power wireless devices.

2. The method according to claim 1 , wherein the security configuration comprises one or more of: a full security configuration associated with a SIM-based security, a non-SIM based security configuration, and a no security configuration.

3. The method according to claim 1 , wherein configuring (S104) the first wireless device to handle communication of data comprises: in response to the first request, communicating (S104A), with the network node, a first confirmation.

4. The method according to claim 1 , wherein configuring (S104) the first wireless device to handle communication of data comprises: performing (S104B) a discovery action of one or more low power wireless devices in the vicinity of the first wireless device.

5. The method according to claim 4, wherein configuring (S104) the first wireless device to handle communication of data comprises: obtaining (S104C), from the one or more low power wireless devices, one or more identifiers associated with one or more low power wireless device.

6. The method according to claim 5, wherein the message is to associate the first intermediate device with a list of the one or more identifiers.

7. The method according to claim 5, wherein configuring (S104) the first wireless device to handle communication of data comprises: obtaining (S104D) one or more keys for the one or more identifiers, where each key is associated with an identifier.

8. The method according to claim 7, wherein obtaining (S104D) one or more keys comprises obtaining (S104D1 ), from the network node, a list of one or more keys based on the one or more identifiers.

9. The method according to claim 7, wherein obtaining (S104D) one or more keys comprises obtaining (S104D2), from an application function, a list of one or more keys based on the one or more identifiers.

10. The method according to claim 2, wherein configuring (S104) the first wireless device to handle communication of data comprises: requesting (S104E), from the one or more low power wireless devices, a key validation according to the non-SIM based security configuration or the full security configuration.

11. The method according to claim 10, wherein configuring (S104) the first wireless device to handle communication of data comprises: transmitting (S104F), to the one or more low power wireless devices, a first validation message.

12. The method according to claim 11 , wherein configuring (S104) the first wireless device to handle communication of data comprises: obtaining (S104G), from the one or more low power wireless devices, a second validation message in response to the first validation message.

13. The method according to claim 12, wherein configuring (S104) the first wireless device to handle communication of data comprises: validating (S104H) the second validation message.

14. The method according to claim 1 , wherein transmitting (S106), to the network node, a message informing the network node comprises: transmitting (S106A), to the network node, a second request for registering the one or more low power wireless devices.

15. The method according to claim 14, the method comprising: in response to the second request, obtaining (S107), from the network node, a confirmation of registration and authentication of the one or more low power wireless devices.

16. The method according to claim 2, the method comprising: in response to the message, obtaining (S108), from the network node, a confirmation to use the no security configuration in a communication link between the first intermediate device and the one or more low power wireless devices.

17. The method according to claim 1 , the method comprising: communicating (S110) with the one or more low power wireless devices according to the security configuration.

18. The method according to claim 1 , the method comprising: selecting (S105A) the security configuration based on an available energy at the one or more low power wireless devices.

19. A method (200), performed by a network node, the method comprising: communicating (S202), with a first wireless device, a first request for the first wireless device to become a first intermediate device configured to handle communication of data between the network node and one or more low power wireless device, wherein the first request is associated with a security configuration; in response to the first request, configuring (S204) the first wireless device to handle communication of data between the network node and one or more low power wireless devices, according to the security configuration; and receiving (S206), from the first wireless device, a message informing the network node about the configuring of the one or more low power wireless devices.

20. A method (700), performed by a first low power wireless device, the method comprising: transmitting (S702), to a first wireless device, a first identifier associated with the first low power wireless device; receiving (S704), from the first wireless device, a request for a key validation according to a security configuration; receiving (S706), from the first wireless device, a first validation message; and transmitting (S708), to the first wireless device, a second validation message in response to the first validation message.