Behavior of user equipment upon failure of emergency service fallback procedure due to failure of 5G system network authentication

Abstract

In one aspect of the disclosure, a method, a computer readable medium, and an apparatus are provided. In some embodiments, the device may be a User Equipment, UE, or the like. The user equipment performs a procedure for emergency service fallback. A user equipment receives an AUHENTICATION REJECT message from a network during a first procedure. The user equipment performs a generic operation of authentication rejection by the network. These generic operations may involve updating the internal state of the user equipment and clearing certain security parameters to maintain network integrity.

Description

[0001] Cross-referencing This application claims priority to Indian Patent Application Serial No. 202321066164, entitled “A METHOD TO DEFINE UE BEHAVIOR WHEN EMERGENCY SERVICES FALLBACK IS FAILED DUE TOAUTHENTICATION FAILURE”, filed on October 3, 2023; and priority to Indian Patent Application Serial No. 202321066165, entitled “A METHOD TO DEFINE UE BEHAVIOR WHEN EMERGENCY SERVICES FALLBACK IS FAILED DUE TO AUTHENTICATION FAILURE”, filed on October 3, 2023; the entire contents of the above two applications are hereby incorporated by reference. Technical Field

[0002] This disclosure generally relates to communication systems, and more specifically, to techniques for handling authentication failures during emergency service rollback processes in mobile networks. Background Technology

[0003] The statements in this section provide only background information in relation to this disclosure and may not constitute prior art.

[0004] Wireless communication systems are widely deployed to provide a variety of telecommunications services, such as telephone, video, data, messaging, and broadcasting. Typical wireless communication systems employ various multiple access technologies to support communication with multiple users by sharing available system resources. Examples of such multiple access technologies include code division multiple access (CDMA) systems, time division multiple access (TDMA) systems, frequency division multiple access (FDMA) systems, orthogonal frequency division multiple access (OFDMA) systems, single-carrier frequency division multiple access (SC-FDMA) systems, and time division synchronous code division multiple access (TD-SCDMA) systems.

[0005] These multiple access technologies have been adopted in various telecommunications standards to provide a common protocol enabling different wireless devices to communicate at the city, national, regional, and even global levels. An example of a telecommunications standard is 5G New Radio (NR). 5G NR is part of the ongoing evolution of mobile broadband driven by the Third Generation Partnership Project (3GPP) to meet new requirements related to latency, reliability, security, scalability (e.g., the Internet of Things, IoT), and other needs. Some aspects of 5G NR may be based on the 4G Long Term Evolution (LTE) standard. Further improvements to 5G NR technology are still needed. These improvements can also be applied to other multiple access technologies and telecommunications standards that adopt them. Summary of the Invention

[0006] The following is a simplified summary of one or more aspects to provide a basic understanding of them. This content is not a comprehensive overview of all hypothetical aspects, nor is it intended to identify key or essential elements of all aspects, nor to define the scope of any or all aspects. Its sole purpose is to present certain concepts of one or more aspects in a simplified form as a prelude to a more detailed description thereafter.

[0007] In one aspect of this disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus may be user equipment (UE). The UE executes a procedure for emergency service rollback. During a first procedure, the UE receives an AUTHENTICATION REJECT message from the network. The UE performs general operations of authentication rejection by the network. These general operations may involve updating the UE's internal state and clearing certain security parameters to maintain network integrity.

[0008] In another aspect of this disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus may be a user equipment. The user equipment executes a procedure for emergency service rollback. The user equipment encounters an authentication failure because it determines that the network has failed an authentication check. The user equipment performs general operations for authentication failure. These operations may involve updating the user equipment's internal state and clearing certain security parameters to maintain network integrity.

[0009] To achieve the foregoing and related objectives, one or more aspects include the features described in detail below and specifically pointed out in the claims. The following description and accompanying drawings illustrate certain exemplary features of one or more aspects. However, these features only indicate a portion of the various aspects' principles that may be employed, and this description is intended to encompass all such aspects and their equivalents. Attached Figure Description

[0010] Figure 1 This is a schematic diagram illustrating an example wireless communication system and access network.

[0011] Figure 2 This is a schematic diagram illustrating communication between a base station and user equipment in the access network.

[0012] Figure 3 This example illustrates the logical architecture of a distributed access network.

[0013] Figure 4 This is an example of the physical architecture of a distributed access network.

[0014] Figure 5 This is an example of a downlink-centric time slot.

[0015] Figure 6 This is an example of an uplink-centric timeslot.

[0016] Figure 7 A technical diagram illustrating how authentication failures are handled during an emergency service rollback process in a mobile network.

[0017] Figure 8 Flowchart of a wireless communication method for handling network authentication denials during an emergency service rollback process.

[0018] Figure 9 A flowchart illustrating the method for handling authentication failures during an emergency service rollback process. Detailed Implementation

[0019] The detailed description below, taken in conjunction with the accompanying drawings, is intended to describe various configurations and is not intended to represent the only configuration in which the concepts described herein can be practiced. The detailed description includes specific details to provide a thorough understanding of the various concepts. However, it will be apparent to those skilled in the art that these concepts can be practiced without these specific details. In some cases, to avoid obscuring these concepts, known structures and components are shown in block diagram form.

[0020] Several aspects of telecommunications systems will now be introduced in conjunction with various devices and methods. These devices and methods will be described in detail below and illustrated with accompanying drawings as various modules, components, circuits, processes, algorithms, etc. (collectively, "elements"). These elements can be implemented by electronic hardware, computer software, or any combination thereof. Whether these elements are implemented in hardware or software depends on the specific application and design constraints imposed on the overall system.

[0021] For example, a single element, any part of an element, or any combination of elements may be implemented as a "processing system" containing one or more processors. Examples of processors include microprocessors, microcontrollers, graphics processing units (GPUs), central processing units (CPUs), application processors, digital signal processors (DSPs), reduced instruction set computing (RISC) processors, systems on a chip (SoCs), baseband processors, field-programmable gate arrays (FPGAs), programmable logic devices (PLDs), state machines, gated logic, discrete hardware circuits, and other hardware suitable for performing the various functions described in this disclosure. One or more processors in the processing system can execute software. Software should be understood broadly as instructions, instruction sets, code, code segments, program code, programs, subroutines, software components, applications, software applications, software packages, routines, subroutines, objects, executable files, threads of execution, flows, functions, etc., regardless of whether they are referred to as software, firmware, middleware, microcode, hardware description languages, or other names.

[0022] Therefore, in one or more example aspects, the functionality can be implemented by hardware, software, or any combination thereof. If implemented in software, these functions can be stored in or encoded as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media. Storage media can be any existing medium accessible to a computer. For example, but not limited to, such computer-readable media can include random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), optical disc storage, magnetic disk storage, other magnetic storage devices, combinations of computer-readable media of the types described above, or any medium that can be used to store computer-executable code in the form of instructions or data structures and is accessible to a computer.

[0023] Figure 1 This illustration shows an example of a wireless communication system and access network 100. The wireless communication system (also known as a wireless wide area network (WWAN)) includes base station 102, user equipment 104, an evolved packet core (EPC) 160, and another core network 190 (e.g., a 5G core (5GC)). Base station 102 may include macro cells (high-power cellular base stations) and / or small cells (low-power cellular base stations). Macro cells include base stations. Small cells include femtocells, picocells, and microcells.

[0024] Base station 102 configured as 4G LTE (collectively referred to as Evolved Universal Mobile Telecommunications System Terrestrial Radio Access Network (E-UTRAN)) can be connected to EPC 160 via backhaul link 132 (e.g., SI interface). Base station 102 configured as 5G radio (collectively referred to as Next Generation RAN (NG-RAN)) can be connected to core network 190 via backhaul link 184. Among other functions, base station 102 can perform one or more of the following functions: user data transmission, radio channel encryption and decryption, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity), inter-cell interference coordination, connection establishment and release, load balancing, non-access stratum (NAS) message distribution, NAS node selection, synchronization, radio access network sharing, multimedia broadcast multicast service (MBMS), user and device tracking, radio access network information management (RIM), paging, location, and warning message delivery. Base stations 102 can communicate with each other directly or indirectly (e.g., via EPC 160 or core network 190) via backhaul link 134 (e.g., X2 interface). Backhaul link 134 can be wired or wireless.

[0025] Base station 102 can wirelessly communicate with user equipment 104. Each base station 102 can provide communication coverage for a corresponding geographic coverage area 110. Geographic coverage areas 110 may overlap. For example, the coverage area 110' of small cell 102' may overlap with the coverage area 110 of one or more macro base stations 102. A network containing small cells and macro cells may be referred to as a heterogeneous network. Heterogeneous networks may also include Home Evolved Node Bs (HeNBs), which can provide services to a restricted group called a closed subscriber group (CSG). The communication link 120 between base station 102 and user equipment 104 may include uplink (UL, also known as reverse link) transmission from user equipment 104 to base station 102 and / or downlink (DL, also known as forward link) transmission from base station 102 to user equipment 104. Communication link 120 may employ multiple-input multiple-output (MIMO) antenna technology, including spatial multiplexing, beamforming, and / or transmit diversity. The communication link may be implemented using one or more carriers. Base station 102 / user equipment 104 may use up to 7 MHz (e.g., 5, 10, 15, 20, 100, 400 MHz) bandwidth per carrier, allocating a total of Yx MHz (x component carriers) for transmission in carrier aggregation in each direction. Carriers may be adjacent or non-adjacent. Carrier allocation may be asymmetrical in the downlink and uplink directions (e.g., more or fewer carriers allocated in the downlink than in the uplink). Component carriers may include primary component carriers and one or more secondary component carriers. Primary component carriers may be referred to as primary cells (PCells), and secondary component carriers may be referred to as secondary cells (SCells).

[0026] Some user equipment 104 can communicate with each other via device-to-device (D2D) communication link 158. D2D communication link 158 can use downlink / uplink wireless wide area network spectrum. D2D communication link 158 can use one or more sidelink channels, such as physical sidelink broadcast channel (PSBCH), physical sidelink discovery channel (PSDCH), physical sidelink shared channel (PSSCH), and physical sidelink control channel (PSCCH). D2D communication can be implemented through various wireless D2D communication systems, such as FlashLinQ, WiMedia, Bluetooth, ZigBee, Wi-Fi based on the IEEE 802.11 standard, LTE, or New Radio (NR).

[0027] The wireless communication system may also include a Wi-Fi access point (AP) 150 that communicates with Wi-Fi stations (STAs) 152 via a communication link 154 in the 5 GHz unlicensed spectrum. During unlicensed spectrum communication, STAs 152 / AP 150 may perform a clear channel assessment (CCA) before communication to determine channel availability.

[0028] Small cell 102' can operate in licensed and / or unlicensed spectrum. When operating in unlicensed spectrum, small cell 102' can employ a new radio interface (NR) and use the same 5 GHz unlicensed spectrum as Wi-Fi access point 150. Small cell 102' employing NR and operating in unlicensed spectrum can enhance the coverage and / or increase the capacity of the access network.

[0029] Base station 102, whether a small cell 102' or a large cell (e.g., a macro base station), may include an eNB, gNodeB (gNB), or other types of base stations. Some base stations, such as gNB 180, can communicate with user equipment (UE) 104 in conventional sub-6 GHz bands, millimeter wave (mmW) frequencies, and / or near-millimeter wave frequencies. When gNB 180 operates at millimeter wave or near-millimeter wave frequencies, gNB 180 may be referred to as a millimeter wave base station. Extremely high frequency (EHF) is a portion of the radio frequency (RF) spectrum in the electromagnetic spectrum. EHF ranges from 30 GHz to 300 GHz, with wavelengths between 1 mm and 10 mm. Radio waves in this band may be referred to as millimeter waves. Near-millimeter waves extend down to 3 GHz with wavelengths of 100 mm. The super high frequency (SHF) band ranges from 3 GHz to 30 GHz and is also known as centimeter waves. Communication using millimeter wave / near millimeter wave radio frequency bands (e.g., 3 GHz to 300 GHz) suffers from extremely high path loss and short range. Millimeter wave base station 180 can use beamforming 182 to communicate with UE 104 to compensate for the extremely high path loss and short range.

[0030] Base station 180 can transmit beamforming signals to UE 104 in one or more transmit directions 108a. UE 104 can receive beamforming signals from base station 180 in one or more receive directions 108b. UE 104 can also transmit beamforming signals to base station 180 in one or more transmit directions. Base station 180 can receive beamforming signals from UE 104 in one or more receive directions. Base station 180 / UE 104 can perform beamforming training to determine the optimal receive and transmit directions for each base station 180 / UE 104. The transmit and receive directions of base station 180 can be the same or different. The transmit and receive directions of UE 104 can be the same or different.

[0031] The evolved packet core (EPC) 160 may include a Mobility Management Entity (MME) 162, other MMEs 164, a Serving Gateway 166, a Multimedia Broadcast Multicast Service (MBMS) Gateway 168, a Broadcast Multicast Service Center (BM-SC) 170, and a Packet Data Network (PDN) Gateway 172. MME 162 can communicate with the Home Subscriber Server (HSS) 174. MME 162 is the control node that handles signaling between UE 104 and EPC 160. Typically, MME 162 provides bearer and connection management. All user Internet Protocol (IP) packets are transmitted through the Serving Gateway 166, which is itself connected to the PDN Gateway 172. The PDN Gateway 172 provides UE IP address allocation and other functions. The PDN Gateway 172 and BM-SC 170 are connected to the IP service 176. IP service 176 may include the Internet, intranet, IP Multimedia Subsystem (IMS), Packet Switched Streaming Service (PS Streaming Service), and / or other IP services. BM-SC 170 can provide MBMS user service configuration and delivery functions. BM-SC 170 can serve as an entry point for content provider MBMS transmission, can be used to authorize and initiate MBMS bearer services within a Public Land Mobile Network (PLMN), and can be used to schedule MBMS transmissions. MBMS gateway 168 can be used to distribute MBMS traffic to base station 102 that belongs to a Multicast Broadcast Single Frequency Network (MBSFN) area and broadcasts specific services, and can be responsible for session management (start / stop) and collecting billing information related to enhanced MBMS (eMBMS).

[0032] The core network 190 may include an Access and Mobility Management Function (AMF) 192, other AMFs 193, a Location Management Function (LMF) 198, a Session Management Function (SMF) 194, and a User Plane Function (UPF) 195. The AMF 192 may communicate with the Unified Data Management (UDM) 196. The AMF 192 is the control node that handles signaling between the UE 104 and the core network 190. Typically, the SMF 194 provides QoS streaming and session management. All user Internet Protocol (IP) packets are transmitted through the UPF 195. The UPF 195 provides UE IP address allocation and other functions. The UPF 195 connects to an IP service 197. The IP service 197 may include the Internet, an intranet, an IP Multimedia Subsystem (IMS), a Packet Switched Streaming Service (PS Streaming Service), and / or other IP services.

[0033] A base station may also be referred to as a gNB, Node B, Evolved Node B (eNB), access point, base transceiver, wireless base station, wireless transceiver, transceiver function, basic service set (BSS), extended service set (ESS), transmit reception point (TRP), or other appropriate terms. Base station 102 provides UE 104 with an access point to connect to EPC 160 or core network 190. Examples of UE 104 include cellular phones, smartphones, session initiation protocol (SIP) phones, laptops, personal digital assistants (PDAs), satellite radios, GPS devices, multimedia devices, video devices, digital audio players (e.g., MP3 players), cameras, game consoles, tablets, smart devices, wearable devices, vehicles, electricity meters, gas pumps, large or small kitchen appliances, medical devices, implants, sensors / actuators, displays, or any other similarly functional device. Some UE 104 devices may be referred to as Internet of Things (IoT) devices (e.g., parking meters, gas pumps, toasters, vehicles, heart monitors, etc.). UE 104 may also be referred to as a station, mobile station, user station, mobile unit, user unit, radio unit, remote unit, mobile device, radio device, wireless communication device, remote device, mobile user station, access terminal, mobile terminal, radio terminal, remote terminal, handheld device, user agent, mobile client, client, or other appropriate terms.

[0034] Although this disclosure may relate to 5G New Radio (NR), it is also applicable to other similar fields, such as LTE, LTE-Advanced (LTE-A), Code Division Multiple Access (CDMA), Global System for Mobile communications (GSM) or other radio / frequency access technologies.

[0035] Figure 2This is a block diagram illustrating communication between base station 210 and UE 250 in the access network. In the downlink (DL), IP packets from EPC 160 can be provided to controller / processor 275. Controller / processor 275 implements Layer 3 and Layer 2 functions. Layer 3 includes the radio resource control (RRC) layer, and Layer 2 includes the packet data convergence protocol (PDCP) layer, radio link control (RLC) layer, and medium access control (MAC) layer. Controller / processor 275 provides RRC layer functions related to system information broadcasting (e.g., Master Information Block (MIB), System Information Blocks (SIBs)), RRC connection control (e.g., RRC connection paging, RRC connection establishment, RRC connection modification, and RRC connection release), inter-radio access technology (RAT) mobility, and measurement configuration for UE measurement reports. The controller / processor 275 provides PDCP layer functions related to header compression / decompression, security (encryption, decryption, integrity protection, integrity verification), and handover support. The controller / processor 275 provides RLC layer functions related to uplink packet data unit (PDU) transmission, error correction via Automatic Repeat Request (ARQ), concatenation, segmentation, and reassembly of RLC service data units (SDUs), resegmentation of RLC data PDUs, and reordering of RLC data PDUs. The controller / processor 275 provides MAC layer functions related to mapping between logical channels and transport channels, multiplexing MAC SDUs on transport blocks (TBs), demultiplexing MAC SDUs from TBs, scheduling information reporting, error correction via Hybrid Automatic Repeat Request (HARQ), priority handling, and logical channel priority.

[0036] The transmit (TX) processor 216 and receive (RX) processor 270 implement Layer 1 functions related to various signal processing functions. Layer 1, including the physical layer (PHY), may include error detection of the transport channel, forward error correction (FEC) encoding / decoding of the transport channel, interleaving, rate matching, mapping to the physical channel, modulation / demodulation of the physical channel, and multiple-input multiple-output (MIMO) antenna processing. The TX processor 216 processes the mapping to the signal constellation according to various modulation schemes (e.g., binary phase-shift keying (BPSK), quadrature phase-shift keying (QPSK), M-phase-shift keying (M-PSK), and M-quadrature amplitude modulation (M-QAM)). The encoded and modulated symbols can then be split into parallel streams. Each stream can then be mapped to an OFDM subcarrier, multiplexed with a reference signal (e.g., a pilot) in the time and / or frequency domains, and then combined via an inverse Fast Fourier Transform (IFFT) to generate a physical channel carrying a time-domain OFDM symbol stream. The OFDM streams are spatially precoded to generate multiple spatial streams. Channel estimates from channel estimator 274 are used to determine the coding and modulation schemes, as well as spatial processing. The channel estimates can be derived from the reference signal and / or channel state feedback transmitted by user equipment 250. Each spatial stream can then be provided to different antennas 220 via a separate transmitter TX218. Each transmitter TX218 can modulate an RF carrier into the corresponding spatial stream for transmission.

[0037] At user equipment 250, each receiver RX 254 receives signals through its corresponding antenna 252. Each receiver RX 254 recovers the information modulated onto the radio frequency carrier and provides the information to the receive (RX) processor 256. The TX processor 268 and RX processor 256 implement Layer 1 functions related to various signal processing functions. The RX processor 256 can perform spatial processing on the information to recover any spatial stream facing user equipment 250. If there are multiple spatial streams facing user equipment 250, they can be merged into a single OFDM symbol stream by the RX processor 256. The RX processor 256 then uses a Fast Fourier Transform (FFT) to transform the OFDM symbol stream from the time domain to the frequency domain. The frequency domain signal includes a separate OFDM symbol stream for each OFDM signal subcarrier. The symbols and reference signals on each subcarrier are recovered and demodulated by determining the most probable signal constellation point transmitted by base station 210. These soft decisions can be based on channel estimates calculated by channel estimator 258. The soft decision is then decoded and deinterleaved to recover the data and control signals initially transmitted by base station 210 on the physical channel. The data and control signals are then provided to controller / processor 259, which implements Layer 3 and Layer 2 functions.

[0038] Controller / processor 259 may be associated with memory 260, which stores program code and data. Memory 260 may be referred to as computer-readable medium. In the uplink, controller / processor 259 provides demultiplexing, packet reassembly, decryption, header decompression, and control signal processing between transport and logical channels to recover IP packets from Evolved Packet Core (EPC) 160. Controller / processor 259 is also responsible for error detection using ACK and / or NACK protocols to support Hybrid Automatic Repeat reQuest (HARQ) operation.

[0039] Similar to the downlink transmission functions of base station 210, controller / processor 259 provides Radio Resource Control (RRC) layer functions related to system information (e.g., Master Information Block (MIB), System Information Blocks (SIBs)) acquisition, RRC connection, and measurement reporting. It also provides Packet Data Convergence Protocol (PDCP) layer functions related to header compression / decompression and security (encryption, decryption, integrity protection, integrity verification). Controller / processor 259 provides Radio Link Control (RLC) layer functions related to upper-layer Protocol Data Unit (PDU) transmission, error correction via Automatic Repeat Request (ARQ), connection, segmentation and reassembly of RLC Service Data Units (SDUs), resegmentation of RLC data PDUs, and reordering of RLC data PDUs. The controller / processor 259 provides mapping between logical channels and transport channels, multiplexing of MAC SDUs to transport blocks (TBs), demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction via HARQ, priority handling, and Medium Access Control (MAC) layer functions related to logical channel priorities.

[0040] The channel estimate derived by channel estimator 258 based on a reference signal or feedback from base station 210 can be used by TX processor 268 to select appropriate coding and modulation schemes and facilitate spatial processing. The spatial stream generated by TX processor 268 can be provided to different antennas 252 via separate transmitters TX 254. Each transmitter TX 254 can modulate the radio frequency carrier into a corresponding spatial stream for transmission. The uplink transmission is processed at base station 210 in a manner similar to that described in relation to the user equipment 250 receiving function. Each receiver RX 218 receives signals through its corresponding antenna 220. Each receiver RX 218 recovers the information modulated onto the radio frequency carrier and provides the information to RX processor 270.

[0041] Controller / processor 275 may be associated with memory 276, which stores program code and data. Memory 276 may be referred to as computer-readable medium. In the uplink, controller / processor 275 provides demultiplexing, packet reassembly, decryption, header decompression, and control signal processing between transport and logical channels to recover IP packets from user equipment 250. IP packets from controller / processor 275 may be provided to EPC 160. Controller / processor 275 is also responsible for error detection using ACK and / or NACK protocols to support HARQ operation.

[0042] New Radio (NR) can refer to a radio configured to operate under a new air interface (e.g., a non-Orthogonal Frequency Divisional Multiple Access (OFDMA) interface) or a fixed transport layer (e.g., a non-Internet Protocol (IP)). NR can use Orthogonal Frequency Division Multiplexing (OFDM) with a cyclic prefix (CP) on both the uplink and downlink, and may include support for half-duplex operation using Time Division Duplexing (TDD). NR can include mission-critical services such as Enhanced Mobile Broadband (eMBB) for wide bandwidths (e.g., above 80 MHz), millimeter wave (mmW) for high carrier frequencies (e.g., 60 GHz), massive MTC (mMTC) for non-backward-compatible MTC technologies, and / or ultra-reliable low latency communications (URLLC).

[0043] It supports a single component carrier bandwidth of 100 MHz. For example, NR resource blocks (RBs) can span 12 subcarriers with a subcarrier bandwidth of 60 kHz for 0.25 ms, or a bandwidth of 30 kHz for 0.5 ms (similarly, 15 kHz subcarrier spacing (SCS) provides a 50 MHz bandwidth over a 1 ms duration). Each radio frame can consist of 10 subframes (10, 20, 40, or 80 NR slots) with a length of 10 ms. Each slot can indicate the link direction of data transmission (i.e., downlink or uplink), and the link direction of each slot can be dynamically switched. Each slot can include downlink / uplink data and downlink / uplink control data. See below for details on NR uplink and downlink slots. Figure 5 and Figure 6 A detailed description.

[0044] The Radio Access Network (RAN) may include Central Units (CUs) and Distributed Units (DUs). NR Base Stations (BSs) (e.g., gNBs, 5G NodeBs, Node Bs, Transmission Reception Points (TRPs), Access Points (APs)) may correspond to one or more base stations. NR cells may be configured as Access Cells (ACells) or Data Cells (DCells). These cells may be configured by the RAN (e.g., Central Units or Distributed Units). DCells may be used for carrier aggregation or dual connectivity and may not be used for initial access, cell selection / reselection, or handover. In some cases, DCells may not transmit synchronization signals (SS), and in others they may transmit SS. NR base stations may transmit downlink signals to User Equipment (UEs) indicating the cell type. Based on the cell type indication, UEs may communicate with the NR base station. For example, UEs may determine whether the NR base station is used for cell selection, access, handover, and / or measurement based on the indicated cell type.

[0045] Figure 3An example logical architecture of a distributed radio access network (RAN) 300 is illustrated according to relevant aspects of this disclosure. A 5G access node 306 may include an access node controller (ANC) 302. The ANC may be the central unit (CU) of the distributed RAN. The backhaul interface to the next-generation core network (NG-CN) 304 may terminate at the ANC. The backhaul interface to neighboring next-generation access nodes (NG-ANs) 310 may also terminate at the ANC. The ANC may include one or more transmit / receive points (TRPs) 308 (also referred to as base stations, NR base stations, Node B, 5G NB, access points (APs), or other terms). As mentioned above, transmit / receive points can be used interchangeably with "cells".

[0046] Transmitter receiving point 308 may be a distributed unit (DU). The transmitter receiving point may connect to one ANC (ANC 302) or multiple ANCs (not shown). For example, for RAN sharing, radio as a service (RaaS), and service-specific ANC deployments, the transmitter receiving point may connect to multiple ANCs. The transmitter receiving point may include one or more antenna ports. The transmitter receiving point may be configured to provide services to user equipment (UE) individually (e.g., dynamically selected) or jointly (e.g., jointly transmitted).

[0047] The local architecture of the distributed RAN 300 can be used to illustrate the fronthaul definition. This architecture can be defined to support fronthaul solutions for different deployment types. For example, the architecture can be based on transport network capabilities (e.g., bandwidth, latency, and / or jitter). The architecture can share features and / or components with LTE. Depending on the relevant aspects, the next-generation access node (NG-AN) 310 can support dual connectivity with New Radio (NR). The NG-AN can share a common fronthaul for both LTE and NR.

[0048] This architecture enables collaboration between and within TRPs 308. For example, collaboration can be pre-defined within a TRP and / or implemented across TRPs via ANC 302. Depending on the relevant parties, inter-TRP interfaces may be unnecessary or nonexistent.

[0049] According to relevant sources, the architecture of the distributed RAN 300 allows for dynamic configuration with logical function partitioning. PDCP, RLC, and MAC protocols can be adaptively placed in the ANC or TRP.

[0050] Figure 4 An example physical architecture of the distributed RAN 400 is illustrated, according to relevant aspects of this disclosure. A centralized core network unit (C-CU) 402 can host core network functions. The C-CU can be centrally deployed. C-CU functions can be offloaded (e.g., to advanced wireless services (AWS)) to handle peak capacity. A centralized RAN unit (C-RU) 404 can host one or more ANC functions. Optionally, the C-RU can host core network functions locally. The C-RU can be distributed. The C-RU can be located closer to the network edge. A distributed unit (DU) 406 can host one or more TRPs. The DU can be located at the network edge with radio frequency (RF) capabilities.

[0051] Figure 5 Figure 500 illustrates an example of a downlink (DL)-centric timeslot. A DL-centric timeslot may include a control section 502. The control section 502 may exist in the initial or beginning portion of the DL-centric timeslot. The control section 502 may include various scheduling and / or control information corresponding to different portions of the DL-centric timeslot. In some configurations, the control section 502 may be a physical downlink control channel (PDCCH), such as... Figure 5 As shown. The DL-centered time slot may also include a DL data portion 504. The DL data portion 504 may sometimes be referred to as the payload of the DL-centered time slot. The DL data portion 504 may include communication resources used to transmit DL data from a scheduling entity (e.g., a UE or a base station) to a subordinate entity (e.g., a UE). In some configurations, the DL data portion 504 may be a physical DL shared channel (PDSCH).

[0052] The downlink-centric time slot may also include a general uplink (UL) portion 506. The general UL portion 506 may sometimes be referred to as a UL burst, a general UL burst, and / or other applicable terms. The general UL portion 506 may include feedback information corresponding to the portions of the DL-centric time slot. For example, the general UL portion 506 may include feedback information corresponding to the control portion 502. Non-limiting examples of feedback information include acknowledgment (ACK) signals, denial (NACK) signals, hybrid automatic repeat request (HARQ) indicators, and / or other applicable types of information. The general UL portion 506 may include additional or alternative information, such as information related to random access channel (RACH) procedures, scheduling requests (SRs), and other applicable types of information.

[0053] like Figure 5 As shown, the end of the DL data section 504 can be time-separated from the start of the general UL section 506. This time separation may sometimes be referred to as a gap, protection period, protection interval, and / or other applicable terms. This separation provides time for the switching from DL communication (e.g., a receiving operation of a subordinate entity (e.g., a UE)) to UL communication (e.g., a transmitting operation of a subordinate entity (e.g., a UE)). Those skilled in the art will understand that the above is merely one example of a DL-centered timeslot, and alternative structures with similar characteristics may exist without departing from the relevant aspects described herein.

[0054] Figure 6 Figure 600 illustrates an example of an uplink (UL)-centered timeslot. The UL-centered timeslot may include a control section 602. The control section 602 may be present in the initial or beginning portion of the UL-centered timeslot. Figure 6 The control section 602 in the above reference can be used as a reference. Figure 5 The control portion 502 is described similarly. The UL-centered time slot may also include an uplink data portion 604. The uplink data portion 604 may sometimes be referred to as the payload of the UL-centered time slot. The UL portion may refer to the communication resources used to transmit UL data from a subordinate entity (e.g., the UE) to a scheduling entity (e.g., the UE or the base station). In some configurations, the control portion 602 may be the Physical Downlink Control Channel (PDCCH).

[0055] like Figure 6As shown, the end of control section 602 can be time-separated from the start of UL data section 604. This time separation may sometimes be referred to as a gap, protection cycle, protection interval, and / or other applicable terms. This separation provides time for switching from DL communication (e.g., a receiving operation of a scheduling entity) to UL communication (e.g., a transmitting operation of a scheduling entity). UL-centric time slots may also include general UL section 606. Figure 6 The general UL section 606 in the document can be referenced above. Figure 5 The general UL section 506 described is similar. General UL section 606 may also include or alternatively include information relating to channel quality indicators (CQI), sounding reference signals (SRSs), and other applicable types of information. Those skilled in the art will understand that the above is merely one example of a UL-centered time slot, and alternative structures with similar characteristics may exist without departing from the relevant aspects described herein.

[0056] In some cases, two or more dependent entities (e.g., user equipment) can communicate using sidechain signals. Practical applications of this type of sidechain communication can include public safety, proximity services, UE-to-network relay, vehicle-to-vehicle (V2V) communication, Internet of Everything (IoE) communication, Internet of Things (IoT) communication, mission-critical mesh networks, and other applicable applications. Generally, a sidechain signal can refer to a signal transmitted from one dependent entity (e.g., UE1) to another dependent entity (e.g., UE2) without relaying the communication through a scheduling entity (e.g., a UE or base station), although the scheduling entity may be used for scheduling and / or control purposes. In some examples, sidechain signals can communicate using licensed spectrum (unlike wireless LANs that typically use unlicensed spectrum).

[0057] This disclosure addresses authentication failures in emergency services fallback scenarios in mobile networks, with a particular focus on handover between 5G (5GS) and 4G (Evolved Packet System, EPS) systems. Emergency Services Fallback (ESF) refers to the process by which a User Equipment (UE) switches from 5GS (N1 mode) to EPS (S1 mode) to provide emergency services when needed.

[0058] The ESF procedure is initiated under specific conditions. When the 5G core network indicates support for ESF in the current Tracking Area (TA) and Radio Access Technology (RAT), and the UE also supports this function, the UE can initiate the ESF procedure to establish an emergency session.

[0059] In scenarios where a user equipment (UE) has pending IMS emergency session requests from its upper layers, the UE notifies the network of this request. The UE does this by sending a service request message or a registration request message. In the latter case, the 5GS registration type information element is set to "mobility registration update," explicitly indicating the need for emergency service rollback.

[0060] The actual rollback process from 5GS to Evolved Packet System can occur in two main ways depending on the network configuration. When the N26 interface (which connects 5G Access and Mobility Management functions to the 4G Mobility Management Entity) is supported, the UE performs a Tracking Area Update procedure and sets the Activity Flag to '1'. This flag indicates to the network that the UE has data to send and requests immediate allocation of resources for emergency services.

[0061] In cases where the N26 interface is not supported, the fallback procedure differs slightly. The UE performs an attach procedure, which is a more comprehensive registration procedure in the Evolved Packet System (EPS). Additionally, the UE sends a packet data network connection request, set to "handover." The UE can establish the data connection required for emergency services in the EPS, maintaining continuity from the 5G network.

[0062] However, emergency service rollback processes can face challenges, especially those related to authentication failures. These processes involve two-way authentication between the user equipment and the network, establishing key negotiation such as 5G Authentication and Key Protocol (AKA) in 5GS or Evolved Packet System Authentication and Key Protocol (AKA) in Evolved Packet System.

[0063] In 5GS, a main authentication process based on the 5G authentication and key protocol is executed during service requests and mobility registration update procedures. This process establishes mutual authentication between the user equipment and the network and negotiates key materials KAUSF, KSEAF, and KAMF. Although the network initiates and controls this process, both the user equipment and the network can refuse authentication if inconsistencies are detected.

[0064] User equipment (UE) can determine that the network has failed an authentication check or that the authentication is illegitimate under certain circumstances. These circumstances include the expiration of timer T3520, or the UE detecting a combination of authentication failures, such as message authentication code failure, synchronization failure, non-5G authentication being unacceptable, or the next-generation key set identifier being in use. These failures must occur within three consecutive authentication challenges during the operation of timer T3520 to be considered a network authentication failure.

[0065] Similarly, in EPB, during the EMM attach request and tracking area update procedures, the EPB Authentication and Key Protocol (ACK) procedure is performed to achieve two-way authentication and negotiate the KASME key. This procedure, similar to 5GS, is initiated and controlled by the network, but both parties can refuse authentication if necessary.

[0066] In Evolved Packet System (EPS), user equipment considers the network to have failed the authentication check in the following situations: timer T3418 or T3420 expires, or a combination of authentication failures (message authentication code failure, synchronization failure, or non-EPS authentication unacceptable) is detected during three consecutive authentication challenges. These challenges are considered consecutive if they occur during a T3418 or T3420 timer that was started after the previous authentication failure and is still running.

[0067] Figure 7 Figure 700 is a technical illustration of handling authentication failures during an emergency service rollback process in a mobile network. Figure 700 depicts user equipment 704 initially camped on an E-UTRA or New Radio cell provided by base station 702. Base station 702 is connected to 5G core network 710 and Evolved Packet System 720, representing the coexistence of 5G and 4G networks.

[0068] The access and mobility management function in the 5G core network 710 can instruct the user equipment 704 that the 5G core network 710 supports emergency services through fallback.

[0069] In certain scenarios, user equipment 704 may need to initiate an emergency service rollback process. For example, when user equipment 704 has pending IMS emergency session requests from its upper layer, the emergency service rollback process is triggered. Emergency service rollback allows user equipment 704 to switch from 5G (N1 mode) to 4G (S1 mode) when necessary to provide emergency services.

[0070] User equipment 704 sends a service request message to access and mobility management function 714, explicitly stating its need for emergency service rollback.

[0071] Upon receiving the request, the 5G core network 710 initiates an emergency service rollback procedure. The Access and Mobility Management function 714 executes the NG-AP procedure, signaling the need for emergency service rollback to base station 702 (NG-RAN). Based on the emergency service support of the Evolved Packet System 720 and the 5G core network 710, the Access and Mobility Management function 714 can indicate the target core network to base station 702. This information helps base station 702 determine whether to perform inter-radio access technology rollback or inter-system rollback.

[0072] Based on the target core network instructions or its own configuration, base station 702 then initiates a handover or redirection procedure. If user equipment 704 is currently in a new radio cell, base station 702 may initiate a handover to an E-UTRAN cell connected to the 5G core network, or redirect to an E-UTRAN cell connected to the evolved packet system 720. In the case of redirection, base station 702 uses the security context provided by access and mobility management function 714 to safeguard the procedure.

[0073] In this example, when user equipment 704 needs to perform an emergency service rollback from 5G to 4G, user equipment 704 switches from the 5G core network 710 to the evolved packet system 720, which includes a mobility management entity 724 that manages the handover on the 4G side.

[0074] In this example, the 5G Access and Mobility Management Function (AMF) 714 and the 4G Mobility Management Entity 724 support the N26 interface. The N26 interface allows direct communication between these two core network elements, enabling efficient handover of user equipment context and security information. When user equipment 704 falls back to 4G (S1 mode) and supports the N26 interface, user equipment 704 and Mobility Management Entity 724 execute a Tracking Area Update (TAI) procedure. In this ATI request, user equipment 704 sets its activity flag to '1', indicating to Mobility Management Entity 724 that it has data to send (in this case, an emergency call). Upon receiving the ATI request, Mobility Management Entity 724 retrieves the user equipment context from AMF 714 via the N26 interface. This context includes security information, subscription data, and other relevant parameters required for managing the user equipment in the 4G network.

[0075] If necessary, the Mobility Management Entity 724 may initiate the Evolved Packet System Authentication and Key Protocol (EPC) process with the User Equipment 704. The Mobility Management Entity 724 is responsible for verifying the authentication response of the User Equipment 704 and managing any authentication failures.

[0076] Once the tracking area update is complete and authentication is successful (if performed), Mobility Management Entity 724 is responsible for establishing the necessary bearers for emergency services. It coordinates with other evolved packet system elements, such as the Serving Gateway and Packet Data Network Gateway, to establish these bearers.

[0077] During these processes, authentication ensures the security and integrity of the connection. However, authentication failure may occur, leading to potential disruptions in emergency service rollback procedures.

[0078] Two main issues have been identified related to authentication failures in the emergency service rollback process: 1. When a user equipment (UE) executes a 5G mobility management procedure for an emergency service rollback and authentication is rejected by the network (e.g., 704), the UE's behavior may not be configured. This ambiguity may lead to inconsistent handling of such failures across different UEs, thus affecting the reliability of emergency services.

[0079] 2. When a user equipment (UE) executes a 5G mobility management procedure for an emergency service rollback and authentication fails on the UE side, the UE's behavior may also be unconfigured. Similar to the first issue, this ambiguity can lead to unpredictable behavior and potential delays in accessing emergency services.

[0080] These issues become further complicated when considering specific scenarios, such as authentication failures during a 5GS mobility registration update process initiated for emergency service rollback. In such cases, the network may trigger the authentication process during the mobility registration update. However, the user equipment's behavior may not be configured when: The network rejects the authentication challenge if the user equipment's 704 authentication response is invalid.

[0081] User equipment 704 rejects the authentication challenge sent by the network, or determines that the network has failed the authentication check, or considers the authentication to be authentic.

[0082] Therefore, user equipment 704 may be unable to complete the emergency service rollback process, which may result in the user being unable to access critical emergency services.

[0083] More specifically, in the authentication process of 5G and 4G networks, the network (access and mobility management function (AMF) in 5G and mobility management entity (MME) in 4G) initiates and controls the authentication process. User equipment 704 sends an authentication response to the network (AMF or MME). If the network cannot accept the authentication response from the user equipment (i.e., the response is invalid), it generates and sends an AUTHENTICATION REJECT message back to the user equipment. Specifically, the AMF 714 in the 5G core network 710 generates and sends the AUTHENTICATION REJECT message. The MME 724 in the Evolved Packet System 720 generates and sends the AUTHENTICATION REJECT message. This can occur during various processes, including: service requests, mobility registration updates, or initial registration processes in 5G; and EMM attachment, tracking area updates, or service request processes in 4G. For example, if the authentication response from user equipment 704 is invalid, MME 724 may send an AUTHENTICATIONREJECT message to user equipment 704. Furthermore, MME 724 also needs to handle scenarios where user equipment 704 rejects the authentication challenge or determines that the network has failed the authentication check.

[0084] In the first technology, when user equipment 704 initiates a mobility registration update process triggered by an upper-layer request for pending emergency service rollback in a 5G system, it may encounter authentication failures. These failures mainly occur in two ways: the network rejects the authentication response from user equipment 704, or user equipment 704 itself determines that the network has failed the authentication check.

[0085] If the authentication response of User Equipment 704 is unacceptable to the network, resulting in User Equipment 704 receiving an AUTHENTICATION REJECT message, User Equipment 704 may follow a specific set of operations. First, User Equipment 704 performs general authentication rejection operations defined by the network protocol. These operations typically involve updating the internal state of the User Equipment and clearing certain security parameters to maintain network integrity.

[0086] After completing the general operations, user equipment 704 has several options. One option is for user equipment 704 to deregister locally from the current network without notifying the network, and then attempt an initial registration dedicated to emergency services. This approach allows user equipment 704 to focus on obtaining emergency services with a completely new registration attempt.

[0087] Alternatively, user equipment 704 can attempt to connect to an E-UTRA cell of the evolved packet system 720 or the 5G core network 710. This option allows user equipment 704 to attempt to access emergency services through different radio access technologies, potentially increasing the chances of a successful connection.

[0088] In all cases, regardless of the specific action taken, user equipment 704 can notify its upper layer of authentication failure. This notification allows the upper layer of user equipment 704 to invoke a specific implementation mechanism to handle the emergency. For example, the upper layer might decide to attempt an emergency call via a different IP Connectivity Access Network (IP-CAN), or use a Wi-Fi network if available.

[0089] In scenarios where user equipment 704 cannot accept the authentication challenge from the network, or user equipment 704 determines that the network has failed the authentication check, or believes that the authentication is not genuine, user equipment 704 may follow a similar but slightly different set of operations. First, user equipment 704 performs the general operations for authentication failure defined by the network protocol.

[0090] After completing these general operations, user equipment 704 takes more specific steps. It aborts the mobility registration update process and stops the timer. It then locally releases any resources allocated for the mobility registration update process. User equipment 704 subsequently enters the 5G mobility management registration state.

[0091] Following these steps, User Equipment 704 has options similar to those in the case of network denial. It can either locally deregister and perform an initial registration dedicated to emergency services, or attempt to select an E-UTRA cell to connect to the Evolved Packet System 720 or the 5G core network 710. As previously stated, in all cases, User Equipment 704 will notify its upper layers of the failure.

[0092] In the second technique, when User Equipment 704 initiates a registration or service request process for emergency service rollback and receives an AUTHENTICATION REJECT message from the network, User Equipment 704 follows a specific set of operations to handle authentication failure while still attempting to access emergency services. User Equipment 704 first performs general operations for authentication rejection as defined by the network protocol. These operations typically involve updating the user equipment's internal state and clearing certain security parameters to maintain network integrity.

[0093] For example, upon receiving an AUTHENTICATION REJECT message, user equipment 704 sets its update status to 5U3 (Roaming Not Allowed), indicating that roaming on the current network is not permitted. Subsequently, it deletes several critical pieces of information from its storage, including the stored 5G Globally Unique Temporary Identifier (5G-GUTI), a list of Tracking Area Identity (TAI) entries, the last access registered TAI, and the Next Generation Key Set Identifier (ngKSI). Deleting this information is a security measure to prevent unauthorized access to the network using potentially compromised credentials.

[0094] After completing these general operations, user equipment 704 has several options depending on the specific scenario and network environment. One option is for user equipment 704 to deregister from the current network without notifying the network, and then attempt an initial registration dedicated to emergency services. This approach allows user equipment 704 to focus on obtaining emergency services with a completely new registration attempt.

[0095] Alternatively, user equipment 704 can attempt to connect to an E-UTRA cell of the evolved packet system 720 or the 5G core network 710. This option allows user equipment 704 to attempt to access emergency services through different radio access technologies, potentially increasing the chances of a successful connection.

[0096] In all cases, regardless of the specific action taken, User Equipment 704 will notify its upper layer of authentication failure. This notification allows the upper layer of User Equipment 704 to invoke a specific implementation mechanism to handle the emergency. For example, the upper layer may decide to attempt an emergency call via a different IP Connectivity Access Network (IP-CAN), such as a Wi-Fi network if available, or, if User Equipment 704 supports legacy wireless access technologies, via a Circuit Switched (CS) domain.

[0097] These operations apply not only to situations where user equipment 704 attempts to register with a new Public Land Mobile Network (PLMN) after its home network becomes unavailable, but also to situations where user equipment 704 is in the same selected PLMN during its last service request process or mobility registration update process attempt. This approach provides user equipment 704 with multiple paths to attempt to establish an emergency PDU session or PDN connection, even when facing authentication challenges.

[0098] When user equipment 704 encounters an authentication failure while performing a 5G mobility management process for emergency service rollback, and the authentication failure is due to user equipment 704 itself determining that the network has failed the authentication check, specific actions need to be taken to maintain the possibility of accessing emergency services.

[0099] Authentication failure can be triggered by a variety of reasons. User equipment 704 may detect a Message Authentication Code (MAC) failure (5GMM reason #20), indicating a MAC mismatch. Alternatively, user equipment 704 may encounter a synchronization failure (5GMM reason #21), indicating a sequence number mismatch. The network may also refuse authentication because non-5G authentication is unacceptable (5GMM reason #26), or user equipment 704 may discover that the Next Generation Key Set Identifier (ngKSI) has already been used (5GMM reason #71). In some cases, user equipment 704 can independently determine that the network has failed the authentication check based on its internal security algorithms.

[0100] Upon encountering any of the above authentication failures, User Equipment 704 first performs general operations for authentication failures as defined by the network protocol. These operations typically involve updating the user equipment's internal state and clearing certain security parameters to maintain network integrity. For example, User Equipment 704 may need to reset its security context or clear stored keys to prevent potential security vulnerabilities.

[0101] After completing the general operations, user equipment 704 takes more specific steps to handle emergency service rollback scenarios. It aborts the ongoing mobility registration update process and stops the timer. It then locally releases any resources allocated for the mobility registration update process. User equipment 704 subsequently enters the 5G mobility management registration state, indicating that it remains registered with the network despite the authentication failure.

[0102] Following these initial steps, user equipment 704 has several options when attempting to access emergency services. One option is for user equipment 704 to deregister locally from the current network without notifying the network, and then attempt an initial registration dedicated to emergency services. This approach allows user equipment 704 to focus on obtaining emergency services with a completely new registration attempt.

[0103] Alternatively, User Equipment 704 can attempt to connect to an E-UTRA cell of the Evolved Packet System 720 or the 5G core network 710. This option allows User Equipment 704 to attempt access to emergency services via different radio access technologies, potentially increasing the chances of a successful connection. The choice between EPS and the 5G core network may depend on network availability and the capabilities of the User Equipment.

[0104] In all cases, regardless of the specific action taken, User Equipment 704 will notify its upper layer about the authentication failure. This notification allows the upper layer of User Equipment 704 to invoke a specific implementation mechanism to handle the emergency. For example, the upper layer might decide to attempt an emergency call via a different IP Connectivity Access Network (IP-CAN), such as via a Wi-Fi network if available. The procedures specified in 3GPP TS 24.229 provide guidance for such alternative attempts, potentially allowing an emergency call via another IP Connectivity Access Network.

[0105] These operations apply not only to user equipment 704 attempting to register to a new public land mobile network (PLMN) after its home network becomes unavailable, but also to user equipment 704 being in the same selected public land mobile network in the last service request process or mobility registration update process attempt.

[0106] In one example, User Equipment 704 may execute a mobility and periodic registration update procedure triggered by an upper-layer request to perform emergency service rollback. When User Equipment 704 receives an AUTHENTICATION REJECT message from Access and Management Function (AMF) 714 during such a procedure, User Equipment 704 may follow specific actions to handle the failure while still attempting to access emergency services. Initially, User Equipment 704 performs general authentication rejection operations, as defined in sub-clauses 5.4.1.2.2.11, 5.4.1.2.3.1, 5.4.1.2.3A.1, or 5.4.1.3.5 of the 3GPP TS 24.501 specification. These operations typically involve updating the user equipment's internal state and clearing certain security parameters to maintain network integrity. For example, user equipment 704 can set its update status to 5U3 No Roaming, which means that roaming is not allowed on the current network, and delete the stored 5G Globally Unique Temporary Identifier (5G-GUTI), Tracking Area Identity (TAI) list, the last access registered Tracking Area Identity, and Next Generation Key Set Identifier (ngKSI).

[0107] After performing these general operations, if User Equipment 704 does not attempt to select an E-UTRA cell to connect to the Evolved Packet Core (EPC) or 5G Core Network (5GCN), and User Equipment 704 is camped on a New Radio (NR) or E-UTRA cell connected to the 5G Core Network, and is in the same public terrestrial mobile network 710 where the last mobility and periodic registration update request attempt was made, User Equipment 704 will notify the upper layer that the process has failed.

[0108] The notification layer allows for the implementation of specific mechanisms to handle emergencies. For example, the procedures specified in 3GPP TS 24.229 may lead to attempts to make emergency calls via another IP connection access network (IP-CAN). This could include attempting to make an emergency call via a Wi-Fi network when available, or attempting to make a call via a circuit-switched (CS) domain when the user equipment 704 supports legacy wireless access technologies.

[0109] In another example, user equipment 704 may initiate a service request process for emergency service rollback. This process is typically triggered when user equipment 704 needs to switch from 5G (N1 mode) to 4G (S1 mode) for emergency services, as instructed by AMF714 during the registration process.

[0110] The service request process used for emergency service rollback may encounter authentication challenges. If AMF714 sends an AUTHENTICATION REJECT message to UE704, UE704 can follow a specific procedure to handle the rejection while still attempting to access emergency services. UE704 first performs general operations for authentication rejection, as described in sub-clauses 5.4.1.2.2.11, 5.4.1.2.3.1, 5.4.1.2.3A.1, or 5.4.1.3.5 of the 3GPP TS 24.501 specification. These operations typically involve updating the UE's internal state and clearing certain security parameters to maintain network integrity.

[0111] After completing these initial procedures, User Equipment 704 assesses its current situation. If User Equipment 704 did not attempt to select an E-UTRA cell to connect to the Evolved Packet Core or 5G Core network, and is camped on a New Radio or E-UTRA cell connected to the 5G Core network, and is on the same Public Land Mobile Network as the last service request attempt, further action is taken. In this case, User Equipment 704 notifies the upper layer that the service request process for this emergency service rollback has failed. This notification allows the upper layer of User Equipment 704 to invoke a specific implementation mechanism to handle the emergency.

[0112] Upon receiving this information, the upper layer can initiate an alternative procedure to attempt the emergency call in different ways. As specified in 3GPP TS23.167, the upper layer can request another emergency call attempt using domain selection. This may include attempting the emergency call through different radio access technologies or even different types of networks.

[0113] For example, the upper layer might decide to attempt an emergency call via the circuit-switched domain when the user equipment 704 supports traditional wireless access technologies such as GSM or UMTS. Alternatively, they might attempt to establish an emergency call via a different IP connection access network (IP-CAN), such as a Wi-Fi network, when available.

[0114] In another example, authentication failure may occur during a mobility and periodic registration update process triggered by an upper-layer request to perform an emergency service rollback. If this process fails due to an exceptional condition, or is not accepted or fails due to receiving an AUTHENTICATION REJECT message, user equipment 704 may follow a specific set of actions.

[0115] In this example, if User Equipment 704 does not attempt to select an E-UTRA cell to connect to the Evolved Packet Core or 5G Core Network, and User Equipment 704 is camped on a New Radio or E-UTRA cell connected to the 5G Core Network, and is in the same Public Land Mobile Network 710 where the last Mobility and Periodic Registration Update Request was attempted, User Equipment 704 will notify the upper layer that the process has failed.

[0116] Anomalies can include one or more scenarios pointing to specific authentication failures. One scenario corresponds to 5G Mobility Management (5GMM) reason #20, "MAC failure," which occurs when there is a MAC mismatch between the user equipment (UE) and the network (e.g., 704). Another scenario points to 5G Mobility Management reason #26, "non-5G authentication unacceptable." A third scenario is related to 5G Mobility Management reason #71, "ngKSI already in use." A fourth scenario indicates a scenario where the network fails the authentication check.

[0117] In these situations, user equipment 704 will follow a series of operations. In the aforementioned abnormal situations, if emergency services have been initiated or are in progress, and a mobility and periodic registration update process triggered by an upper-layer request to perform an emergency service rollback procedure is underway, user equipment 704 will take specific actions. For example, user equipment 704 may abort the registration process for mobility and periodic registration updates, or stop the timer. Locally release any resources allocated for the mobility and periodic registration update process and enter 5G mobility management registration state.

[0118] After performing these operations, User Equipment 704 may attempt to select an E-UTRA cell to connect to the Evolved Packet Core or 5G Core network according to the domain priority and selection rules specified in 3GPP TS 23.167. If User Equipment 704 finds a suitable E-UTRA cell, it will continue to execute the corresponding Evolved Mobility Management (EMM) or 5G Mobility Management (5GMM) procedures.

[0119] Figure 8 This is a flowchart 800 of a wireless communication method for handling network authentication denial during an emergency service rollback process. The method can be performed by a user equipment (e.g., user equipment 704). In operation 802, the user equipment performs a first procedure for emergency service rollback. In some configurations, this first procedure includes a mobility and periodic registration update request triggered by an upper-layer request to perform the emergency service rollback. In some configurations, the first procedure includes a service request procedure for emergency service rollback.

[0120] In operation 804, the user equipment receives an AUTHENTICATION REJECT message from the network during the first process. In operation 806, the user equipment performs a general operation of authentication rejection by the network. To perform the general operation of authentication rejection, the user equipment updates its status to disallow roaming, deletes stored identifiers, including the 5G Globally Unique Temporary Identifier (5G-GUTI), the Tracking Area Identity (TAI) list, the Tracking Area Identity of the last access registration, and the Next Generation Key Set Identifier (ngKSI).

[0121] In Operation 808, the User Equipment (UE) can enter the 5G Mobility Management Registration state after performing the general operation of authentication rejection. In Operation 810, the UE notifies the upper layer that the first process failed. In some configurations, the upper layer is notified when the UE does not attempt to select an E-UTRA cell to connect to the Evolved Packet System (EPS) or the 5G core network, and remains camped on a new air interface or E-UTRA cell connected to the 5G core network, and on the same public terrestrial mobile network where the last service request was attempted.

[0122] In operation 812, the user equipment (UE) deregisters locally from the current network without notifying the network. In operation 814, the UE may attempt initial registration dedicated to emergency services. In operation 816, the UE may attempt to make an emergency call via a different IP Connectivity Access Network (IP-CAN). In operation 818, if the UE supports legacy wireless access technologies, it may attempt to make an emergency call via a circuit-switched (CS) domain.

[0123] Figure 9 A flowchart 900 illustrates a method for handling authentication failures during an emergency service rollback process. This method can be performed by a user equipment (e.g., user equipment 704). In operation 902, the user equipment executes a first process for emergency service rollback. In some configurations, this first process includes a registration process for mobility and periodic registration updates.

[0124] In Operation 904, the user equipment encounters authentication failure because the network determines that the authentication check has failed. In some configurations, this authentication failure may be due to one or more of the following reasons: Message Authentication Code (MAC) failure, synchronization failure, non-5G authentication is unacceptable, or the Next Generation KeySet (ngKSI) identifier has already been used.

[0125] In operation 906, the user equipment performs the general operation for authentication failure. In operation 908, the user equipment aborts the first process. In operation 910, the user equipment stops the timers associated with the first process. In operation 912, the user equipment locally releases any resources allocated for the first process.

[0126] In Operation 914, the user equipment may enter 5G Mobility Management (5GMM-REGISTERED) registration state after performing the general operation for authentication failure. In Operation 916, the user equipment deregisters locally from the current network without notifying the network. In Operation 918, the user equipment attempts initial registration dedicated to emergency services.

[0127] In Operation 920, the user equipment (UE) may attempt to select an E-UTRA cell connected to either the Evolved Packet System (EPS) or the 5G Core Network (5GCN). In Operation 922, the UE notifies the upper layer of the authentication failure. In Operation 924, the UE may attempt to make an emergency call via a different IP-CAN access network. In Operation 926, if the UE supports legacy radio access technologies, it may attempt to make an emergency call via the circuit-switched domain (CS).

[0128] It should be understood that the specific order or hierarchy of the blocks in the disclosed process / flowchart is merely exemplary. Depending on design preferences, the specific order or hierarchy of the blocks in the process / flowchart may be rearranged. Furthermore, some blocks may be combined or omitted. The appended method claims present the elements of each block in an exemplary order and are not limited to the specific order or hierarchy shown.

[0129] The foregoing description is intended to enable those skilled in the art to implement the aspects described herein. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects. Therefore, the claims are not intended to limit the aspects shown herein, but rather to be given the full scope consistent with the language of the claims, wherein a singular reference to an element does not mean “only one”, but rather “one or more” unless explicitly stated otherwise. The term “exemplary” herein means “as an example, instance, or illustration.” Any aspect described as “exemplary” is not necessarily to be construed as preferred or superior to other aspects. Unless otherwise explicitly stated, the term “some” means one or more. Combinations such as “at least one A, B, or C,” “one or more A, B, or C,” “at least one A, B, and C,” “one or more A, B, and C,” and “A, B, C, or any combination thereof” include any combination of A, B, and / or C, and may include multiple A, multiple B, or multiple C. Specifically, combinations such as “at least one A, B, or C,” “one or more A, B, or C,” “at least one A, B, and C,” “one or more A, B, and C,” and “A, B, C, or any combination thereof” can be only A, only B, only C, A and B, A and C, B and C, or A, B, and C, wherein any such combination may include one or more members of A, B, or C. All structural and functional equivalents of the elements described in this disclosure, whether known or subsequently known to those skilled in the art, are expressly incorporated herein by reference and are intended to be covered by the claims. Furthermore, the disclosure herein is not intended to be offered to the public, whether or not it is expressly recited in the claims. The terms “module,” “mechanism,” “element,” “device,” etc., are not substitutes for the word “means.” Therefore, no claim element should be construed as means plus function unless the phrase “means for…” is expressly used.

Claims

1. A wireless communication method for a user equipment, comprising: Execute the first procedure for emergency service rollback; During this first process, an AUTHENTICATION REJECT message is received from the network; as well as Perform the general operation of authentication denial by the network.

2. The method of claim 1 further includes: The upper management was notified that the first process had failed.

3. The method of claim 2, wherein the upper layer is notified when the user equipment does not attempt to select an E-UTRA cell to connect to the Evolved Packet System or the 5G core network, and is camped on a new air interface or E-UTRA cell connected to the 5G core network, and on the same public terrestrial mobile network where the last service request was attempted.

4. The method of claim 1, wherein the first process includes a mobility and periodic registration update request triggered by an upper-layer request to perform the emergency service rollback.

5. The method of claim 1, wherein the first process includes a service request process for the emergency service rollback.

6. The method of claim 1 further includes: Log out of the current network locally without notifying the network; as well as Attempt initial registration specifically for emergency services.

7. The method of claim 1, wherein the general operation of the authentication rejection includes: Set the update status to disallow roaming; Remove stored identifiers, including 5G globally unique temporary identifiers, tracking area identifier lists, tracking area identifiers of the last access registration, and next-generation key set identifiers.

8. The method of claim 1 further includes: Try connecting to the network via different IP addresses to make an emergency call.

9. The method of claim 1 further includes: If the user equipment supports traditional wireless access technology, it will attempt to make an emergency call via the circuit-switched domain.

10. The method of claim 1 further includes: After performing the general operation of the authentication rejection, the system enters the 5G mobility management registration state.

11. A wireless communication method for a user equipment, comprising: Execute the first procedure for emergency service rollback; The user equipment encountered authentication failure because it determined that the network had failed the authentication check. as well as Perform the general operation for authentication failure.

12. The method of claim 11, wherein the authentication failure is due to one or more of the following reasons: message authentication code failure, synchronization failure, non-5G authentication is unacceptable, or the next-generation key set identifier has been used.

13. The method of claim 11 further includes: The first process is suspended; Stop the timer associated with this first process; as well as Release any resources allocated for this first process locally.

14. The method of claim 11, wherein the first process includes a registration process for mobility and periodic registration updates.

15. The method of claim 11 further includes: Log out of the current network locally without notifying the network; as well as Attempt initial registration specifically for emergency services.

16. The method of claim 11 further includes: Try selecting an E-UTRA cell that connects to the Evolved Packet System or the 5G core network.

17. The method of claim 11 further includes: The upper layer was notified that the authentication had failed.

18. The method of claim 11, wherein the user equipment enters a 5G mobility management registration state after performing the general operation of the authentication failure.

19. The method of claim 11 further includes: Try connecting to the network via different IP addresses to make an emergency call.

20. The method of claim 11 further includes: If the user equipment supports traditional wireless access technology, it will attempt to make an emergency call via the circuit-switched domain.

Images