Core network device, communication terminal, communication system, authentication method and communication method

Abstract

The purpose is to provide a core network device that can efficiently perform secondary authentication to be performed on each network slice. The core network device (10) according to the present invention includes: an authentication unit (11), which is configured to perform a first authentication process for determining whether the communication terminal is a communication terminal permitted to be registered in the core network during a registration process for registering the communication terminal in the core network; a communication unit (13), which is configured to receive permission list information indicating at least one network slice that can be used by the communication terminal in the service network; and an authentication unit (12), which is configured to perform a second authentication process for determining whether the communication terminal is a communication terminal permitted to use the network slice included in the permission list information during a registration process for registering the communication terminal in the core network.

Description

Technical Field

[0001] The present invention relates to a core network device, a communication terminal, a communication system, an authentication method and a communication method. Background Art

[0002] In the 5th generation (5G) network, the provision of services by using network slicing is discussed. A network slice is at least one logical network defined on a physical network. A specific network slice may be, for example, a network slice that provides public safety services. In addition, other network slices may be network slices that guarantee extremely short latency times and may be network slices that accommodate many Internet of Things (IoT) terminals at the same time.

[0003] In addition, in the 5G network, it is also assumed that the communication operator leases the network slice to a third party with the original subscriber database. In this case, in addition to the authentication of the communication terminal accessing the public land mobile network (PLMN), the authentication of the communication terminal accessing the network slice is also discussed. The communication terminal accessing the PLMN and the communication terminal accessing the network slice are the same communication terminals. The authentication of the communication terminal accessing the PLMN is, for example, called the primary authentication. The authentication of the communication terminal accessing the network slice is, for example, called the secondary authentication. The secondary authentication also includes the processing of authorizing access to the network slice, and can be called slice-specific secondary authentication and authorization.

[0004] Non-patent document 1 describes an overview of primary authentication and secondary authentication being performed on a user equipment (UE) that is a communication terminal. Primary authentication is performed between the UE and core network devices such as an access management function (AMF) entity and an authentication server function (AUSF) entity based on authentication information determined in the Third Generation Partnership Project (3GPP). On the other hand, secondary authentication is performed between the UE and an authentication, authorization, and accounting (AAA) server managed by a third party based on authentication information not determined in 3GPP. The authentication information determined in 3GPP may, for example, be authentication information used when the UE accesses a PLMN. The authentication information not determined in 3GPP may, for example, be authentication information managed by a third party. Specifically, the authentication information managed by a third party may be a user ID and password (credentials) being managed in the AAA server.

[0005] In addition, non-patent document 1 describes an overview of the authentication process during PDU session establishment, which is used to authenticate access to a network slice when a PDU session is first established in a specific network slice.

[0006] Citation List

[0007] Non-patent literature

[0008] [Non-Patent Document 1] 3GPP TS 23.740 V0.5.0 (2018-08), Sections 6.3.1 and 6.3.2 Summary of the invention

[0009] Problem that the invention aims to solve

[0010] The UE can access multiple network slices. For example, identification information related to multiple network slices accessible to the UE is included in the subscriber information of the UE. The network slices accessible to the UE may be, for example, network slices previously applied for or contracted by a user operating the UE.

[0011] In the case where a plurality of network slices accessible to the UE are included in the subscriber information, secondary authentication is performed for each network slice during the registration process of the UE. Therefore, there is a problem that as the number of network slices included in the subscriber information increases, the time and processing load required for secondary authentication increase, and the time and processing load required until the UE communicates using the network slices increase.

[0012] The object of the present invention is to provide a core network device, a communication terminal, a communication system, an authentication method and a communication method that can efficiently perform auxiliary authentication on each network slice.

[0013] Solutions for solving problems

[0014] According to the first aspect of the present invention, a core network device includes: a first authentication unit, which is configured to perform a first authentication process for determining whether the communication terminal is a communication terminal permitted to be registered in the core network during a registration process for registering the communication terminal in the core network; a communication unit, which is configured to receive permission list information indicating at least one network slice in a service network that can be used by the communication terminal; and a second authentication unit, which is configured to perform a second authentication process for determining whether the communication terminal is a communication terminal permitted to use the network slice included in the permission list information during a registration process for registering the communication terminal in the core network.

[0015] According to the second aspect of the present invention, a communication terminal includes a communication unit, which is configured to send capability information to a core network device during a registration process for registering the communication terminal in the core network, indicating whether a process associated with a second authentication process for determining whether the communication terminal is a communication terminal permitted to use a network slice can be performed.

[0016] The communication system according to the third aspect of the present invention includes: a first core network device, which is configured to perform a first authentication process for determining whether the communication terminal is a communication terminal permitted to be registered in the core network during a registration process for registering the communication terminal in the core network, perform a second authentication process for determining whether the communication terminal is a communication terminal permitted to use a network slice during a registration process for registering the communication terminal in the core network, and send information indicating a network slice for performing the second authentication process; and a second core network device, which is configured to receive information indicating a network slice for performing the second authentication process, determine whether to perform the second authentication process related to the communication terminal after the registration process is completed and when the communication terminal uses the network slice for the first time, perform the second authentication process if the second authentication process has not been performed, and not perform the second authentication process if the second authentication process has been performed.

[0017] The authentication method according to the fourth aspect of the present invention includes: during a registration process for registering a communication terminal in a core network, performing a first authentication process for determining whether the communication terminal is a communication terminal permitted to be registered in the core network; receiving permission list information indicating at least one network slice in a service network that can be used by the communication terminal; and during a registration process for registering the communication terminal in the core network, performing a second authentication process for determining whether the communication terminal is a communication terminal permitted to use the network slice included in the permission list information.

[0018] According to the fifth aspect of the present invention, the communication method includes: during a registration process for registering a communication terminal in a core network, generating capability information indicating whether processing associated with a second authentication process for determining whether the communication terminal is a communication terminal permitted to use a network slice can be performed; and sending the capability information to a core network device.

[0019] Advantageous Effects of the Invention

[0020] The present invention can provide a core network device, a communication terminal, a communication system, an authentication method and a communication method that can efficiently perform auxiliary authentication on each network slice. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is a structural diagram of a core network device according to the first exemplary embodiment.

[0022] Figure 2 is a block diagram of a communication system according to the second exemplary embodiment.

[0023] Figure 3is a diagram showing the flow of registration processing according to the second exemplary embodiment.

[0024] Figure 4 is a block diagram of a communication terminal according to the third exemplary embodiment.

[0025] Figure 5 is a diagram showing the flow of registration processing according to the third exemplary embodiment.

[0026] Figure 6 is a diagram showing the flow of registration processing according to the fourth exemplary embodiment.

[0027] Figure 7 is a diagram showing the flow of authentication processing during PDU session establishment according to the fifth exemplary embodiment.

[0028] Figure 8 is a diagram showing the flow of authentication processing during PDU session establishment according to the fifth exemplary embodiment.

[0029] Fig. 9 is a diagram of a communication terminal and a UE according to various exemplary embodiments.

[0030] Fig.10 is a structural diagram of a core network device and AMF according to various exemplary embodiments. DETAILED DESCRIPTION

[0031] (First Exemplary Embodiment)

[0032] The embodiments of the present invention will be described below with reference to the accompanying drawings. Figure 1 A configuration example of core network device 10 according to the first exemplary embodiment will be described. Core network device 10 may be a computer device operated by a processor that executes a program stored in a memory.

[0033] The core network device 10 includes an authentication unit 11, an authentication unit 12, and a communication unit 13. The authentication unit 11, the authentication unit 12, and the communication unit 13 may be software or modules processed by a processor that executes a program stored in a memory. Alternatively, the authentication unit 11, the authentication unit 12, and the communication unit 13 may be hardware such as a circuit or a chip.

[0034] The authentication unit 11 performs an authentication process of determining whether the communication terminal is a communication terminal permitted to be registered in the core network during a registration process of registering the communication terminal in the core network. The authentication of the communication terminal performed by the authentication unit 11 corresponds to the main authentication. The communication terminal may be, for example, a cellular phone terminal, a smart phone terminal, or a tablet terminal. Alternatively, the communication terminal may be an Internet of Things (IoT) terminal or a Machine Type Communication (MTC) terminal. Alternatively, the communication terminal may be a UE, which is a general term for a communication terminal in 3GPP.

[0035] The core network is a network included in the 5G network. The 5G network includes an access network directly accessed by a communication terminal and a core network that aggregates multiple access networks.

[0036] For example, the registration process may be performed after the communication terminal changes from a power-off state to a power-on state. Alternatively, the registration process may be performed after a predetermined period of time has passed since the last registration process. The registration process may be, for example, a registration process for determining an operation in 3GPP. The communication terminal is registered in the core network, so the core network performs mobility management and session management of the communication terminal, etc.

[0037] The communication unit 13 receives permission list information indicating at least one network slice in a service network that can be used by the communication terminal. The service network is a network that provides communication services to an area where the communication terminal exists. The service network may be a home public land mobile network (HPLMN) that manages subscriber information of the communication terminal, and may be a visited PLMN (VPLMN) used as a roaming destination.

[0038] All network slices accessible to the communication terminal are included in the subscriber information of the communication terminal. The network slices that can be provided to the communication terminal are different for each service network. Therefore, the communication terminal may not be able to use all network slices included in the subscriber information in the currently connected service network. The network slices included in the permission list information are network slices that can be used in the service network among the network slices included in the subscriber information of the communication terminal. Therefore, the network slices included in the permission list information may be a part of all network slices included in the subscriber information.

[0039] The communication unit 13 may receive the permission list information from other core network devices configured in the HPLMN, or may receive the permission list information from other core network devices configured in the VPLMN.

[0040] The authentication unit 12 performs authentication processing for determining whether the communication terminal is a communication terminal permitted to use the network slice included in the permission list information during the registration processing of registering the communication terminal in the core network. The authentication performed by the authentication unit 12 corresponds to the secondary authentication. In the case where a plurality of network slices are included in the permission list information, the authentication unit 12 may cooperate with each third party that manages each network slice and perform authentication processing of the communication terminal.

[0041] As explained above, the authentication unit 12 of the core network device 10 causes the authentication unit to execute the same number of times as the number of network slices included in the license list information. Here, the number of network slices included in the license list information is smaller than the number of network slices included in the subscriber information. Therefore, compared with the case where the authentication process is executed the same number of times as the number of network slices included in the subscriber information, the time required for the authentication process performed by the authentication unit 12 during the registration process for registering the communication terminal in the core network is further shortened.

[0042] In addition, the core network device 10 performs the authentication method indicated next. First, the core network device 10 performs a first authentication process for determining whether the communication terminal is a communication terminal permitted to be registered in the core network during a registration process for registering the communication terminal in the core network. Next, the core network device 10 receives permission list information indicating at least one network slice in the service network that can be used by the communication terminal. Next, the core network device 10 performs a second authentication process for determining whether the communication terminal is a communication terminal permitted to use the network slice included in the permission list information during a registration process for registering the communication terminal in the core network.

[0043] (Second exemplary embodiment)

[0044] Then, by using Figure 2 A configuration example of a communication system according to the second exemplary embodiment will be described. Figure 2 The communication system in FIG. 5 includes UE 20, serving PLMN 30, HPLMN 40, and third-party network 50. It is assumed that UE 20 exists in an area where serving PLMN 30 provides communication services. UE 20 corresponds to a communication terminal. Serving PLMN 30 corresponds to a serving network. Figure 2 The third party network 50 may be a network managed by a communication operator different from the communication operator managing the service PLMN 30 and the communication operator managing the HPLMN 40. The third party network 50 may be, for example, a network managed by an operator providing application services.

[0045] The serving PLMN 30 includes an access management function (AMF) entity 31 (hereinafter referred to as AMF 31), a visit session management function (V-SMF) entity 32 (hereinafter referred to as V-SMF 32), and a user plane function (UPF) entity 33 (hereinafter referred to as UPF 33). Figure 1 Corresponding to the core network device 10 in.

[0046] HPLMN 40 includes a unified data management (UDM) entity 41 (hereinafter referred to as UDM 41), an authentication server function (AUSF) entity 42 (hereinafter referred to as AUSF 42), a network slice selection function (NSSF) entity 43 (hereinafter referred to as NSSF 43), a network open function (NEF) entity 44 (hereinafter referred to as NEF 44), an H-SMF entity 45 (hereinafter referred to as H-SMF 45) and a UPF entity 46 (hereinafter referred to as UPF 46).

[0047] The third party network 50 includes an authentication, authorization and accounting (AAA) server 51 .

[0048] AMF 31 manages access and mobility related to UE 20, etc. In addition, AMF 31 cooperates with AUSF 42 and UDM 41, etc., and performs primary authentication processing related to UE 20. V-SMF 32 performs session management related to UE 20. Session management includes establishment, change and deletion of sessions. UPF 33 performs routing or transmission of user plane data between UE 20 and UPF 46.

[0049] UDM 41 manages subscriber information related to UE 20. Identification information about a plurality of network slices accessible to UE 20 is included in the subscriber information. The network slice accessible to UE 20 may be, for example, a network slice previously applied for or contracted by a user operating UE 20.

[0050] AUSF 42 manages authentication information related to UE 20. The authentication information may be, for example, a security key and an authentication algorithm related to UE 20. NSSF 43 sends identification information related to a network slice in the serving PLMN 30 that can be used by UE 20 to AMF 31. The identification information related to the network slice may be, for example, network slice selection assistance information (NSSAI). In addition, AUSF 42 relays data transmitted between AAA server 51 configured in third-party network 50 and node device configured in HPLMN 40.

[0051] The NEF 44 relays data transmitted between the AAA server 51 configured in the third-party network 50 and the node device configured in the HPLMN 40. The H-SMF 45 performs session management related to the UE 20 together with the V-SMF 32. The UPF 46 performs routing or transmission of user plane data between the UPF 33 and the third-party network 50. For example, the UPF 46 may perform routing of user plane data between the application server (not shown) configured in the third-party network 50 and the UPF 33.

[0052] The V-SMF 32, UPF 33, H-SMF 45, and UPF 46 constitute a network slice 60. Each of the V-SMF 32, UPF 33, H-SMF 45, and UPF 46 can be used only for the network slice 60 and can be shared with other network slices. The network slice 60 is a network slice managed by the third-party network 50. In other words, in the case where the UE 20 uses the service provided by the third-party network 50, the UE 20 is connected to the network slice 60.

[0053] The AAA server 51 performs secondary authentication processing related to the UE 20 using the network slice 60.

[0054] exist Figure 2 In the structural example of , the AUSF 42 and the NEF 44 are configured to relay data transmitted between the AMF 31 and the AAA server 51, but another independent node device (not shown) different from the AUSF 42 and the NEF 44 may be configured to relay data. In addition, the communication system may not include the NEF 44, and the AUSF 42 may be configured to relay data transmitted between the AMF 31 and the AAA server 51. The node device that relays data transmitted between the AMF 31 and the AAA server 51 may be an AAA proxy function (AAA-F).

[0055] Then, by using Figure 3 To illustrate the process of registration processing related to UE 20. First, UE 20 sends a registration request message to AMF 31 (S11). The registration request includes a request NSSAI. The request NSSAI is the NSSAI provided from UE 20 to the serving PLMN 30. In other words, the request NSSAI is the NSSAI indicating the network slice that UE 20 expects to use or connect to in the serving PLMN 30. Single network slice selection assistance information (S-NSSAI) is identification information indicating one network slice, and multiple S-NSSAIs can be included in the NSSAI.

[0056] Note that AMF 31 may obtain the request NSSAI from a message other than the registration request message (S11). For example, in step S12, AMF 31 sends a NAS security mode command message to UE 20, and UE 20 returns a NAS security mode complete message to AMF 31 as a response to the NAS security mode command message. In this case, UE 20 may set the request NSSAI in the NAS security mode complete message, and AMF 31 may obtain the request NSSAI. In addition, for example, before step S12, AMF 31 may send an identity request message to UE 20, and UE 20 may return an identity response message to AMF 31 as a response to the identity request message. In this case, UE 20 may set the request NSSAI in the identity response message, and AMF 31 may obtain the request NSSAI.

[0057] In addition, the AMF 31 may receive a message including the request NSSAI from any node device other than the UE 20, and may acquire the request NSSAI. For example, any node device may receive a message including the request NSSAI sent from the UE 20. In this case, the AMF 31 may acquire the request NSSAI by receiving a message including the request NSSAI from any node device.

[0058] Next, in UE 20, AMF 31 and AUSF 42, a security procedure for accessing an existing PLMN is performed (S12). Existing PLMNs are, for example, the serving PLMN 30 and the HPLMN 40. Specifically, in step S12, a main authentication process related to UE 20 is performed. For example, AMF 31 performs a main authentication process related to UE 20 by using the authentication information received from AUSF 42. For example, the authentication information received by AMF 31 from AUSF 42 may also be referred to as a 3GPP credential. In other words, the authentication information received by AMF 31 from AUSF 42 may be authentication information determined in 3GPP. For example, the 3GPP credential may include a subscription permanent identifier (SUPI) which is a user ID of UE 20 and authentication information used when UE 20 accesses the serving PLMN 30.

[0059] For example, the primary authentication process is to authenticate the SUPI in the authentication and key agreement (AKA) performed between the AMF 31 and the UE 20. In other words, the AMF 31 authenticates the SUPI indicating the UE 20 in the AKA performed between the UE 20 and the AMF 31. In addition, the primary authentication process may include an authorization process related to the UE 20. For example, the primary authentication process may include the UE 20 authorizing the UE 20 to use the serving PLMN 30 by using the subscriber information of the UE 20 acquired from the UDM 41. In other words, the AMF 31 may authorize the UE 20 to use the serving PLMN 30 by using the subscriber information of the UE 20 acquired from the UDM 41. The primary authentication process may be referred to as a primary authentication and primary authorization process.

[0060] Next, AMF 31 sends a Nudm_SDM_Get message to UDM 41 (S13). Next, UDM 41 sends a Nudm_SDM_Get response message to AMF 31 (S14). The Nudm_SDM_Get response message includes a subscription S (single)-NSSAI. S-NSSAI is identification information indicating one network slice. Subscription S-NSSAI is identification information indicating a network slice included in the subscriber information. Multiple subscription S-NSSAIs (subscription S-NSSAIs) may be included in the Nudm_SDM_Get response message.

[0061] Next, AMF 31 sends an Nnssf_NSSelection_Get message to NSSF 43 (S15). Next, NSSF 43 sends an Nnssf_NSSelection_Get response message to AMF 31 (S16). The Nnssf_NSSelection_Get response message includes an allowed NSSAI. The allowed NSSAI includes identification information (S-NSSAI) related to network slices that can be used by UE 20 in the serving PLMN 30 in multiple subscription S-NSSAIs. Multiple S-NSSAIs (S-NSSAIs) may be included in the allowed NSSAI. Here, it is assumed that the number of S-NSSAIs included in the allowed NSSAI is less than the number of multiple subscription S-NSSAIs included in the Nudm_SDM_Get response message. In other words, it is assumed that the S-NSSAI included in the allowed NSSAI is part of the multiple subscription S-NSSAIs included in the Nudm_SDM_Get response message. For example, NSSF 43 may obtain the subscribed S-NSSAI associated with UE 20 from UDM 41 and manage the S-NSSAI indicating the network slices that may be used by UE 20 in serving PLMN 30.

[0062] Next, AMF 31 checks whether the secondary authentication process is applied in the network slice indicated by each S-NSSAI included in the allowed NSSAI (S17). AMF 31 can check whether the secondary authentication process is applied in each network slice included in the allowed NSSAI by using a policy server, etc. For example, in a third-party network, there is also a third-party network that includes a policy that does not apply the secondary authentication process when using a network slice managed by the third-party network.

[0063] The policy server may manage information related to whether each network slice requests secondary authentication related to UE 20. In addition, in a node device other than the policy server, information related to whether secondary authentication related to UE 20 is requested may be managed. In this case, AMF 31 may perform the check in step S17 by using a node device that manages information related to whether secondary authentication related to UE 20 is requested.

[0064] For example, AMF 31 may check in step S17 by using UDM 41. In this case, AMF 31 may receive information related to whether the secondary authentication process is applied in the network slice indicated by the subscription S-NSSAI from the Nudm_SDM_Get response message (S14). In addition, AMF 31 may check in step S17 by using the received information.

[0065] Next, in the UE 20, AMF 31, AUSF 42 and AAA server 51, a security process (S18) for accessing the network slice 60 to which the secondary authentication process is applied is performed. Specifically, in step S18, a secondary authentication process related to the UE 20 is performed. For example, in the secondary authentication, authentication information managed by a third party can be used. The authentication information managed by the third party may include a user ID used when the UE 20 uses the network slice 60 and a password managed in the AAA server 51.

[0066] In the secondary authentication process, an authentication process using the Extensible Authentication Protocol (EAP) may be performed. For example, the AMF 31 notifies the UE 20 of the S-NSSAI and sends a request message for requesting the sending of the user ID and password used in the S-NSSAI. In addition, the AMF 31 sends the user ID and password received from the UE 20 to the AAA server 51 via the AUSF 42. The AAA server 51 may authenticate the user ID (i.e., UE 20) associated with the UE 20 received from the AUSF 42, and further authorize the UE 20 to use the network slice 60 by using the user ID and password received from the UE 20. The secondary authentication process may include authenticating the UE 20 and authorizing the UE 20 to use the network slice 60. Optionally, the secondary authentication process may be referred to as a secondary authentication process and a secondary authorization process.

[0067] In the registration process related to UE 20, the secondary authentication process is performed for each network slice. In other words, the secondary authentication process is repeated in the registration process the same number of times as the number of S-NSSAIs indicating the network slices to which the secondary authentication process is applied in the S-NSSAI included in the allowed NSSAI.

[0068] As explained above, the number of S-NSSAIs included in the allowed NSSAI is smaller than the number of subscribed S-NSSAIs transmitted from the UDM 41. In addition, among the network slices indicated by the S-NSSAIs included in the allowed NSSAI, there are network slices to which the secondary authentication process is not applied. Therefore, the number of network slices to which the secondary authentication process is applied is smaller than the number of network slices indicated by the S-NSSAIs included in the allowed NSSAI. As a result, Figure 2 In a communication system of the present invention, the number of secondary authentication processes performed in a registration process related to the UE 20 is less than the number of secondary authentication processes in a case where the secondary authentication process is repeated the same number of times as the number of subscribed S-NSSAIs transmitted from the UDM 41. In this way, the UE 20, the AMF 31, the AUSF 42, and the AAA server 51 can further reduce the time required for the secondary authentication process in the registration process, compared with a case where the secondary authentication process is repeated the same number of times as the number of subscribed S-NSSAIs. In addition, the UE 20, the AMF 31, the AUSF 42, and the AAA server 51 can reduce the processing load required for the secondary authentication process.

[0069] In addition, the process of registering UE 20 in the core network is performed for each access network. Therefore, UE 20 can send a registration request message to AMF 31 via each access network such as 3GPP access and non-3GPP access. 3GPP access is an access network that supports a wireless communication method determined in 3GPP. Non-3GPP access is an access network that supports a wireless communication method different from the wireless communication method determined in 3GPP.

[0070] AMF 31 receives a registration request message from UE 20 via any one of 3GPP access and non-3GPP access, and performs secondary authentication. For example, assume that AMF 31 receives a registration request message via 3GPP access, and performs secondary authentication. Here, in the case where AMF 31 receives a registration request message via non-3GPP access, secondary authentication in a network slice where secondary authentication related to UE20 has been performed may not be performed and may be omitted. In this way, it is possible to prevent the same UE in the same network slice from being authenticated in an overlapping manner. In this way, compared with the case where the secondary authentication process is not omitted, the time required for the secondary authentication process in the registration process can be reduced, and the processing load required for the secondary authentication process can be reduced. Similar to the case where secondary authentication is performed based on a registration request message received via non-3GPP access, secondary authentication based on a registration request message received via 3GPP access can also be omitted.

[0071] In addition, in the event that the secondary authentication related to the S-NSSAI of the UE 20 fails, the AMF 31 may replace the S-NSSAI provided to the UE 20 in the allowed N-SSAI when the secondary authentication is successful with another S-NSSAI, and may provide the S-NSSAI to the UE 20. For example, the replaced S-NSSAI may be the default S-NSSAI. In addition, the replaced S-NSSAI may be provided with an identifier indicating that the S-NSSAI has been replaced and an identifier indicating the S-NSSAI before the replacement. The UE 20 recognizes that access to the network slice indicated by the replaced S-NSSAI is authorized. In this way, the AMF 31 can prevent the situation where the UE 20 cannot access any network slice. In other words, the AMF 31 can guide the UE 20 that cannot be authenticated so that the UE 20 accesses a specific network slice.

[0072] (Third Exemplary Embodiment)

[0073] Then, by using Figure 4The configuration example of the communication terminal 70 according to the third exemplary embodiment is described. The communication terminal 70 may be a computer device operated by a processor that executes a program stored in a memory. In addition, the core network device 10 described in the first exemplary embodiment is used as a core network device for communicating with the communication terminal 70.

[0074] The communication terminal 70 includes a control unit 71 and a communication unit 72. The control unit 71 and the communication unit 72 may be software or modules processed by a processor executing a program stored in a memory. Alternatively, the control unit 71 and the communication unit 72 may be hardware such as a circuit or a chip.

[0075] The control unit 71 generates capability information indicating whether processing associated with authentication processing for determining whether the communication terminal 70 is a communication terminal permitted to use the network slice can be performed during registration processing for registering the communication terminal 70 in the core network.

[0076] The authentication process for determining whether the communication terminal is a communication terminal permitted to use the network slice corresponds to the secondary authentication process. The process associated with the authentication process for determining whether the communication terminal is a communication terminal permitted to use the network slice includes a process of receiving, by the communication terminal 70, a message sent from the core network device 10 in the secondary authentication process, etc. In addition, the process associated with the authentication process for determining whether the communication terminal is a communication terminal permitted to use the network slice includes a process of reading parameters set for the received message, etc. In addition, the process associated with the authentication process for determining whether the communication terminal is a communication terminal permitted to use the network slice includes a process of sending a message to the core network device 10 or responding to the core network device 10 to continue the secondary authentication process normally.

[0077] The communication unit 72 transmits the capability information generated in the control unit 71 to the core network device 10 .

[0078] The core network apparatus 10 determines whether the capability information received from the communication terminal 70 indicates that the communication terminal 70 can perform the processing associated with the secondary authentication processing. In the case where the core network apparatus 10 determines that the communication terminal 70 can perform the processing associated with the secondary authentication processing, the core network apparatus 10 performs the secondary authentication processing related to the communication terminal 70 during the registration processing for registering the communication terminal 70 in the core network. In the case where the core network apparatus 10 does not receive the capability information from the communication terminal 70, the core network apparatus 10 may determine that the communication terminal 70 cannot perform the processing associated with the secondary authentication processing.

[0079] For example, in the case where the core network device 10 performs secondary authentication processing on a communication terminal that cannot perform processing associated with secondary authentication, the core network device 10 cannot receive information required for the secondary authentication processing from the communication terminal. In other words, even if the secondary authentication will fail, the core network device 10 wastes time associated with the secondary authentication processing.

[0080] On the other hand, the communication terminal 70 according to the third exemplary embodiment can transmit capability information indicating whether the processing associated with the secondary processing can be performed to the core network apparatus 10. In addition, the core network apparatus 10 does not perform the secondary authentication processing related to the communication terminal 70 for the communication terminal 70 determined as being unable to perform the processing associated with the secondary processing during the registration processing for registering the communication terminal 70 in the core network, and continues the processing by considering whether the secondary authentication processing succeeds or fails. In this way, the time and processing load related to the secondary authentication processing can be reduced.

[0081] For the communication terminal 70 that is determined to be unable to perform the processing associated with the auxiliary processing, the core network device 10 can determine whether the auxiliary authentication processing is deemed to be successful or failed for each network slice. For example, a certain S-NSSAI can be deemed to be successful, while other S-NSSAIs can be deemed to be failed.

[0082] In addition, the communication terminal 70 performs the communication method indicated next. First, the communication terminal 70 generates capability information indicating whether a process associated with a second authentication process for determining whether the communication terminal is a communication terminal permitted to use the network slice can be performed during a registration process for registering the communication terminal in the core network. Next, the communication terminal 70 sends the capability information to the core network device.

[0083] Then, by using Figure 5 80 corresponds to the communication terminal 70. First, the UE 80 sends a registration request message to the AMF 31 (S21). The registration request includes a request for NSSAI and UE capabilities. The UE capabilities correspond to capability information indicating whether the UE 80 can perform processing associated with the secondary authentication process. The UE capabilities can be represented by security capabilities or other representations.

[0084] Note that AMF 31 may obtain the requested NSSAI and / or UE capabilities from messages other than the registration request message (S21). For example, in step S22, when AMF 31 sends a NAS security mode command message to UE 80, UE 80 returns a NAS security mode complete message to AMF 31 as a response to the NAS security mode command message. In this case, UE 80 may set the requested NSSAI and / or UE capabilities in the NAS security mode complete message, and AMF 31 may obtain the requested NSSAI and / or UE capabilities. In addition, for example, before step S22, when AMF 31 sends an identity request message to UE 80, UE 80 may return an identity response message to AMF 31 as a response to the identity request message. In this case, UE 80 may set the requested NSSAI and / or UE capabilities in the identity response message, and AMF 31 may obtain the requested NSSAI and / or UE capabilities.

[0085] In addition, the AMF 31 may receive a message including a request for NSSAI and / or UE capabilities from any node device other than the UE 80, and may acquire the request for NSSAI and / or UE capabilities. For example, any node device may receive a message including a request for NSSAI and / or UE capabilities sent from the UE 80. In this case, the AMF 31 may acquire the request for NSSAI and / or UE capabilities by receiving a message including a request for NSSAI and / or UE capabilities from any node device that has received the message.

[0086] Steps S22 to S27 and Figure 3 Steps S12 to S17 in are the same, so their detailed description will be omitted.

[0087] Next, if the predetermined requirements are met, AMF 31 performs the secondary authentication in step S28, and if the predetermined requirements are not met, AMF 31 does not perform the secondary authentication in step S28. If the predetermined requirements are met, it may be indicated that the processing associated with the secondary authentication processing can be performed, and the network slice requested for connection is a network slice to which the secondary authentication is applied. If the predetermined requirements are not met, it may not be indicated that the processing associated with the secondary authentication processing can be performed, or the network slice requested for connection is not a network slice to which the secondary authentication is applied.

[0088] AMF 31 without secondary authentication may indicate that the authentication process using EAP is not performed. For example, AMF 31 without secondary authentication may indicate that a request message for requesting the user ID and password used in the network slice indicated by S-NSSAI is not sent from AMF 31 to UE 80.

[0089] In addition, the AMF 31 that does not perform secondary authentication may indicate that the AMF 31 returns a registration rejection message including a specific reason code in response to the registration request message (S21). The specific reason code may be referred to as a specific 5GMM reason value. For example, the specific reason code may mean that the AMF 31 does not perform secondary authentication, or may mean that the AMF 31 determines that the UE 80 cannot perform processing associated with the secondary authentication process.

[0090] In addition, in the case of receiving the registration rejection message including such a specific reason code, the UE 80 may change the S-NSSAI included in the request NSSAI and send a registration request message (S21). For example, the changed S-NSSAI may be a default S-NSSAI. Alternatively, the UE 80 may select another PLMN different from the PLMN to which the registration request message is sent, change the PLMN, and send a registration request message (S21).

[0091] Figure 5 It is shown that in step S27, AMF 31 checks whether the secondary authentication process is applied in the network slice indicated by each S-NSSAI included in the allowed NSSAI, but is not limited to this. For example, AMF31 can check whether the secondary authentication process is applied in the network slice indicated by each subscription S-NSSAI in the multiple subscription S-NSSAIs received in step S24.

[0092] As explained above, the UE 80 according to the third exemplary embodiment can transmit the UE capability indicating whether the processing associated with the secondary authentication processing can be performed to the AMF 31. In this way, the AMF 31 performs secondary authentication on the UE 80 only if the UE 80 can perform the processing associated with the secondary authentication processing. As a result, in the case where the UE 80 cannot perform the processing associated with the secondary authentication, the time and processing load associated with the secondary authentication processing can be reduced.

[0093] (Fourth Exemplary Embodiment)

[0094] Then, by using Figure 6 The flow of the registration process related to UE 90 is described below. Assume that UE 90 has Figure 4 The communication terminal 70 shown has the same structure.

[0095] First, UE 90 sends a registration request message to AMF 31 (S31). The registration request includes information about a priority network slice as a network slice that UE 90 accesses immediately after the registration process is completed. The priority network slice may be referred to as a network slice with high urgency. The priority network slice may be one, or may be two or more. For example, in the case where multiple S-NSSAIs are included in the request NSSAI, the request NSSAI may include an S-NSSAI indicating a priority network slice and an S-NSSAI indicating a network slice that is not a priority network slice. Immediately after the registration process is completed may be, for example, a timing before a predetermined time period has passed after the registration process is completed.

[0096] Steps S32 to S37 and Figure 5 Steps S22 to S27 are the same as in , so their detailed description will be omitted.

[0097] Next, AMF 31 performs secondary authentication on network slices that meet predetermined requirements, and does not perform secondary authentication on network slices that do not meet predetermined requirements (S38).

[0098] For example, AMF 31 performs secondary authentication on a network slice that is a priority network slice and a network slice to which secondary authentication is applied in step S38. In this case, AMF 31 does not perform secondary authentication on a network slice that is not a priority network slice and is a network slice to which secondary authentication is applied in step S38. In other words, AMF 31 does not perform secondary authentication in the registration process on a network slice that is not a priority network slice and is a network slice to which secondary authentication is applied.

[0099] The secondary authentication for a network slice that is not a priority network slice and is a network slice to which the secondary authentication is applied can be performed when the UE 90 first accesses the network slice. In other words, the secondary authentication for a network slice that is not a priority network slice and is a network slice to which the secondary authentication is applied can be performed when a PDU session is established between the UE 90 and the network slice.

[0100] In addition, if Figure 5 As described in, when UE 90 sends UE capabilities and information related to the priority network slice to AMF 31, AMF 31 may perform secondary authentication according to the following requirements. For example, when UE 90 can perform processing associated with secondary authentication, AMF 31 may perform secondary authentication on the network slice that is the priority network slice and to which secondary authentication is applied. In other words, when UE 90 cannot perform processing associated with secondary authentication, AMF 31 may not perform secondary authentication related to UE 90 in the network slice that is the priority network slice and to which secondary authentication is applied.

[0101] As explained above, the UE 90 according to the fourth exemplary embodiment can transmit information indicating the priority network slice to the AMF 31. In this way, the AMF 31 can perform secondary authentication only on the priority network slice without performing secondary authentication related to all network slices judged as network slices to which secondary authentication is applied in step S37. As a result, compared with the case where the AMF 31 performs secondary authentication on all network slices, in the case where the AMF 31 performs secondary authentication only on the priority network slice, the time associated with the secondary authentication can be reduced, and the processing load associated with the secondary authentication process can also be reduced.

[0102] (Fifth Exemplary Embodiment)

[0103] Then, by using Figure 7 The flow of the authentication process during the PDU session establishment according to the fifth exemplary embodiment is described below. Figure 7 In Figure 2 The process flow in the communication system described in . When the secondary authentication process in the registration process and the authentication process during the PDU session establishment are performed independently, the following problem occurs.

[0104] The authentication process during the PDU session establishment is initiated by the SMF. At this time, the SMF performs the secondary authentication process of the UE in the specific network slice during the PDU session establishment without the SMF recognizing that the secondary authentication process of the UE in the specific network slice is performed in the registration process. Therefore, the problem of performing the secondary authentication process in an overlapping manner during the registration process and the PDU session establishment occurs.

[0105] Therefore, in the fifth exemplary embodiment, the AMF 31 notifies the V-SMF 32 or the H-SMF 45 of information related to the network slice for which the secondary authentication has been performed. In this way, the secondary authentication process is avoided from being performed in an overlapping manner during the registration process and the PDU session establishment.

[0106] First, UE 20 sends a NAS message including a PDU session establishment request to AMF 31 (S41). The PDU session establishment request includes an S-NSSAI indicating that the network slice is a connection destination.

[0107] Next, the AMF 31 selects the V-SMF 32, and transmits a Nsmf_PDUSession_CreateSMContext request (S42) to the V-SMF 32. Instead of the Nsmf_PDUSession_CreateSMContext request, a Nsmf_PDUSession_UpdateSMContext request may be transmitted.

[0108] The Nsmf_PDUSession_CreateSMContext request includes a subscription permanent identifier (SUPI) of the UE 20, the S-NSSAI, and a flag indicating that the authentication process of the UE 20 in the network slice indicated by the S-NSSAI has been performed. The S-NSSAI is the S-NSSAI included in the message received in step S41. The AMF 31 includes the flag in the Nsmf_PDUSession_CreateSMContext request, and thus notifies the V-SMF 32 that the secondary authentication of the UE 20 in the specific network slice has been performed.

[0109] Next, the V-SMF 32 sends a Nsmf_PDUSession_CreateSMContext Response to the AMF 31 as a response to the Nsmf_PDUSession_CreateSMContext Request (S43).

[0110] Next, the V-SMF 32 sends the Nsmf_PDUSession_CreateSMContext request (S44) received in step S42 to the H-SMF 45. The H-SMF 45 can determine whether the secondary authentication process of the UE 20 in the network slice indicated by the S-NSSAI has been performed by receiving the Nsmf_PDUSession_CreateSMContext request.

[0111] Next, the H-SMF 45 acquires the subscriber data corresponding to the SUPI included in the Nsmf_PDUSession_CreateSMContext request from the UDM 41 (S45).

[0112] Next, if the flag is not included in the Nsmf_PDUSession_CreateSMContext request, the H-SMF 45 starts EAP authentication to perform a secondary authentication process (S46) related to the UE 20. On the other hand, if the flag is included in the Nsmf_PDUSession_CreateSMContext request, the H-SMF 45 determines that the authentication process related to the UE 20 has been performed, and does not start EAP authentication in step S46.

[0113] Then, by using Figure 8 To illustrate and Figure 7 The flow of authentication processing during PDU session establishment according to the fifth exemplary embodiment is different.

[0114] First, an N4 session is established between the V-SMF 32 and the UPF 33 (S51). Then, the V-SMF 32 sends an authentication / authorization request to the AAA server 51 via the UPF 33 (S52). Then, the AAA server 51 sends an authentication / authorization response to the V-SMF 32 via the UPF 33 (S53). Then, the V-SMF 32 sends a Namf_Communication_N1N2Message transmission including the authentication message sent from the AAA server 51 to the AMF 31 (S54).

[0115] Next, AMF 31 transmits a response (S55) as a response to the transmission of Namf_Communication_N1N2Message to V-SMF 32. AMF 31 includes in the response a flag indicating that the secondary authentication process of UE 20 in the network slice to which UE 20 needs to connect has been performed.

[0116] Next, AMF 31 sends a NAS SM transmission including an authentication message to UE 20 (S56). Next, UE 20 sends a NAS SM transmission including an authentication message to AMF 31 (S57). Next, AMF 31 sends a Nsmf_PDUSession_UpdateSMContext including an authentication message to V-SMF 32 (S58). Next, V-SMF 32 sends a response to AMF 31 (S59).

[0117] Here, in the case where the V-SMF 32 has not received a flag indicating that the secondary authentication process of the UE 20 has been performed in step S55, the V-SMF 32 sends an authentication / authorization request (S60) to the AAA server 51 via the UPF 33. The authentication / authorization request includes an authentication message. After the AAA server 51 performs the authentication process of the UE 20 in the specific network slice, the AAA server 51 sends an authentication / authorization response (S61) to the V-SMF 32 via the UPF 33.

[0118] In step S55, in the case where the V-SMF 32 has received a flag indicating that the secondary authentication process of the UE 20 in the network slice to which the UE 20 needs to connect has been performed, the processes after step S60 are not performed.

[0119] exist Figure 8In the above, the process of including the flag in the response of step S55 is described, but the flag may be included in Nsmf_PDUSession_UpdateSMContext in step S58. Optionally, AMF 31 may send the flag to V-SMF 32 or H-SMF 45 after performing the registration process instead of during the PDU session establishment, independently of the process of PDU session establishment. In this case, V-SMF 32 or H-SMF 45 may not perform and may omit the process after S52.

[0120] As explained above, the AMF 31 can notify the V-SMF 32 or H-SMF 45 of information related to the secondary authentication process that has been performed. As a result, it is possible to avoid performing the secondary authentication process in an overlapping manner during the registration process and the PDU session establishment. In this way, the time associated with the secondary authentication can be reduced, and the processing load associated with the secondary authentication process can also be reduced.

[0121] Note that the present invention is not limited to the above-described exemplary embodiments, and can be appropriately modified without departing from the scope of the present invention.

[0122] Then, structural examples of the core network device 10, AMF 31, SMF, communication terminal 70, UE 20, UE 80 and UE 90 described in the above-mentioned multiple exemplary embodiments will be described below.

[0123] Fig. 9 1 is a block diagram showing a structural example of the communication terminal 70, the UE 20, the UE 80, and the UE 90. The radio frequency (RF) transceiver 1101 performs analog RF signal processing for communicating with the base station. The analog RF signal processing performed by the RF transceiver 1101 includes up-conversion, down-conversion, and amplification. The RF transceiver 1101 is coupled to the antenna 1102 and the baseband processor 1103. In other words, the RF transceiver 1101 receives the modulation symbol data (or OFDM symbol data) from the baseband processor 1103, generates a transmit RF signal, and supplies the transmit RF signal to the antenna 1102. In addition, the RF transceiver 1101 generates a baseband receive signal based on the receive RF signal received by the antenna 1102, and supplies the baseband receive signal to the baseband processor 1103.

[0124] The baseband processor 1103 performs digital baseband signal processing (data plane processing) and control plane processing for wireless communication. Digital baseband signal processing includes (a) data compression / decompression, (b) segmentation / concatenation of data, and (c) generation / decomposition of transmission format (transmission frame). In addition, digital baseband signal processing includes (d) transmission path encoding / decoding, (e) modulation (symbol mapping) / demodulation, and (f) generation of OFDM symbol data (baseband OFDM signal) by inverse fast Fourier transform (IFFT), etc. On the other hand, control plane processing includes communication management of layer 1 (e.g., transmit power control), layer 2 (e.g., radio resource management and hybrid automatic repeat request (HARQ) processing), and layer 3 (e.g., signaling related to attachment, mobility, and call management).

[0125] For example, in the case of LTE and 5G, the digital baseband signal processing of the baseband processor 1103 may include signal processing of the packet data convergence protocol (PDCP) layer, the radio link control (RLC) layer, the MAC layer, and the physical layer. In addition, the control plane processing of the baseband processor 1103 may include processing of the non-access layer (NAS) protocol, the RRC protocol, and the MAC CE.

[0126] The baseband processor 1103 may include a modulation and demodulation processor (e.g., a digital signal processor (DSP)) for performing digital baseband signal processing and a protocol stack processor (e.g., a central processing unit (CPU) or a microprocessing unit (MPU)) for performing control plane processing. In this case, the protocol stack processor for performing control plane processing may be common to the application processor 1104 described later.

[0127] The application processor 1104 is also referred to as a CPU, an MPU, a microprocessor, or a processor core. The application processor 1104 may include a plurality of processors (a plurality of processor cores). The application processor 1104 implements various functions of the communication terminal 70, the UE 20, the UE 80, and the UE 90 by executing a system software program (operating system (OS)) read from the memory 1106 or a memory not shown. Optionally, the application processor 1104 implements various functions of the communication terminal 70, the UE 20, the UE 80, and the UE 90 by executing various application programs read from the memory 1106 or a memory not shown. The application program may be, for example, a call application, a web browser, a mail program, a camera operation application, or a music reproduction application.

[0128] In some installations, such as Fig. 9As indicated by the dotted line (1105) in FIG. 1 , the baseband processor 1103 and the application processor 1104 may be integrated on one chip. In other words, the baseband processor 1103 and the application processor 1104 may be installed as a system on chip (SoC) device 1105. The SoC device may also be referred to as a system large scale integration (LSI) or a chipset.

[0129] The memory 1106 is a volatile memory, a non-volatile memory, or a combination of a volatile memory and a non-volatile memory. The memory 1106 may include a plurality of physically independent memory devices. The volatile memory is, for example, a static random access memory (SRAM), a dynamic RAM (DRAM), or a combination of SRAM and DRAM. The non-volatile memory is a mask read-only memory (MROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a hard disk drive, or any combination of MROM, EEPROM, flash memory, and a hard disk drive. For example, the memory 1106 may include an external memory device accessible from the baseband processor 1103, the application processor 1104, and the SoC 1105. The memory 1106 may include a built-in memory device integrated in the baseband processor 1103, the application processor 1104, or the SoC 1105. In addition, the memory 1106 may include a memory in a universal integrated circuit card (UICC).

[0130] The memory 1106 may store software modules (computer programs) including command groups and data for performing the processes of the communication terminal 70, UE 20, UE 80, and UE 90 described in the above-mentioned multiple exemplary embodiments. In some implementations, the baseband processor 1103 or the application processor 1104 may be configured to perform the processes described in the above-mentioned exemplary embodiments by reading the software modules from the memory 1106 and executing the software modules.

[0131] Fig.10 3 is a block diagram showing a configuration example of the core network device 10, the AMF 31, and the SMF. Fig.10 , the core network device 10, AMF 31 and SMF include a network interface 1201, a processor 1202 and a memory 1203. The network interface 1201 is used to communicate with other network node devices constituting the communication system. The network interface 1201 may, for example, include a network interface card (NIC) compliant with the IEEE 802.3 series.

[0132] The processor 1202 performs the processing of the core network device 10, AMF 31, and SMF explained by using the sequence diagram and the flowchart in the above-mentioned exemplary embodiment by reading the software (computer program) from the memory 1203 and executing the software. The processor 1202 may be, for example, a microprocessor, a microprocessing unit (MPU), or a central processing unit (CPU). The processor 1202 may include a plurality of processors.

[0133] The memory 1203 is composed of a combination of a volatile memory and a non-volatile memory. The memory 1203 may include a memory configured remotely from the processor 1202. In this case, the processor 1202 may access the memory 1203 via an I / O interface not shown.

[0134] exist Fig.10 In the example of , the memory 1203 is used to store the software module group. The processor 1202 can perform the processing of the core network device 10, AMF 31 and SMF described in the above exemplary embodiment by reading the software module group from the memory 1203 and executing the software module group.

[0135] By using Fig.10 As described, each processor included in the core network device 10, AMF 31, and SMF executes one or more programs including a command group for causing a computer to perform the algorithm described by using the drawings.

[0136] In the above-mentioned example, the program is stored by using various types of non-transitory computer-readable media, and the program can be supplied to the computer. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media, optical magnetic recording media (e.g., optical magnetic disks), CD-ROMs (read-only memory), CD-Rs, CD-R / Ws, and semiconductor memories. Magnetic recording media can be, for example, floppy disks, magnetic tapes, and hard disk drives. Semiconductor memories can be, for example, mask ROMs, programmable ROMs (PROMs), erasable PROMs (EPROMs), flash ROMs, and random access memories (RAMs). In addition, the program can be supplied to the computer by various types of temporary computer-readable media. Examples of temporary computer-readable media include electrical signals, optical signals, and electromagnetic waves. Temporary computer-readable media can supply programs to the computer via wired communication paths or wireless communication paths such as wires and optical fibers.

[0137] A user equipment (UE) (or mobile station, mobile terminal, mobile device, wireless device, etc.) in this specification is an entity connected to a network via a wireless interface.

[0138] The UE in this specification is not limited to a dedicated communication device, and may be any device as follows (including the communication function as the UE described in this specification).

[0139] Each of the terms "User Equipment (UE) (as used in 3GPP)", "mobile station", "mobile terminal", "mobile device" and "wireless terminal" are intended to be generally synonymous with each other, and may be an independent mobile station such as a terminal, a cellular phone, a smart phone, a tablet computer, a cellular IoT terminal and an IoT device, etc.

[0140] Note that it is understood that the terms "UE" and "wireless terminal" also include devices that are stationary for a long period of time.

[0141] In addition, the UE may be, for example, a production facility, a manufacturing facility and / or an energy-related machine (for example, a boiler, an engine, a turbine, a solar panel, a wind turbine, a hydroelectric generator, a thermal generator, an atomic power generator, a battery, an atomic power system, an atomic power-related equipment, heavy electrical equipment, pumps including vacuum pumps, compressors, fans, blowers, hydraulic equipment, pneumatic equipment, metal processing machines, manipulators, robots, robot application systems, tools, molds, rollers, conveying devices, lifting devices, freight devices, textile machines, sewing machines, printers, printing-related machines, papermaking machines, chemical machines, mining machines, mining-related machines, construction machines, construction-related machines, agricultural machines and / or equipment, forestry machines and / or equipment, fishing machines and / or equipment, safety and / or environmental protection equipment, tractors, bearings, precision bearings, chains, gears, power transmission devices, lubrication devices, valves, pipes and / or application systems of any of the above-mentioned equipment or machines).

[0142] In addition, a UE may be, for example, a transportation device (e.g., a vehicle, an automobile, a two-wheeled vehicle, a bicycle, a train, a bus, a bicycle cart, a rickshaw, a ship and other watercraft, an airplane, a rocket, a satellite, a drone, a balloon, etc.).

[0143] In addition, the UE may be, for example, an information communication device (eg, an electronic computer and related devices, a communication device and related devices and electronic components, etc.).

[0144] In addition, the UE can be, for example, a refrigerator, refrigerator application products and devices, commercial and service equipment, vending machines, automatic service machines, office machines and devices, household electrical and electronic machinery and equipment (for example, voice equipment, speakers, radios, video equipment, televisions, multi-function microwave switches, rice cookers, coffee machines, dishwashers, dryers, fans, ventilation fans and related products, and vacuum cleaners, etc.).

[0145] In addition, the UE may be, for example, an electronic application system or an electronic application device (eg, an X-ray device, a particle acceleration device, a radioactive material application device, an acoustic wave application device, an electromagnetic application device, an electric power application device, etc.).

[0146] In addition, UE can be, for example, a light bulb, lighting, a weighing machine, an analytical device, a testing machine and a measuring machine (for example, a smoke alarm, a human alarm sensor, a motion sensor, and a wireless tag, etc.), a watch or clock, a physical and chemical machine, an optical machine, a medical device and / or a medical system, a weapon, a cutlery or a hand tool, etc.

[0147] In addition, the UE may be, for example, a personal digital assistant or a device including a wireless communication function (eg, an electronic device to which a wireless card and a wireless module, etc. are attached or inserted (eg, a personal computer and an electronic measuring instrument, etc.)).

[0148] In addition, the UE may be, for example, a device or a part of the device that provides the following applications, services, and solutions in the "Internet of Things (IoT)" using wired and wireless communication technologies.

[0149] IoT devices (or things) include appropriate electronics, software, sensors, network connections, etc. that enable data collection and data exchange between devices and with other communicating devices.

[0150] Additionally, IoT devices may be automated equipment that follows software instructions stored in internal memory.

[0151] Furthermore, IoT devices can operate without the need for human supervision or processing.

[0152] Additionally, IoT devices may be devices that are deployed for long periods of time and / or remain inactive for long periods of time.

[0153] In addition, IoT devices can be installed as part of stationary devices. IoT devices can be embedded in non-stationary devices (e.g., vehicles, etc.), or can be attached to animals and people to be monitored / tracked.

[0154] It will be appreciated that IoT technology can be installed on any communication device that can connect to a communication network that sends and receives data independently of human input or software commands stored in memory.

[0155] It is understood that an IoT device may be referred to as a machine type communication (MTC) device, a machine-to-machine (M2M) communication device, or a narrowband IoT (NB-IoT) UE.

[0156] Furthermore, it will be appreciated that a UE may support one or more IoT or MTC applications.

[0157] The following table lists some examples of MTC applications (source: 3GPP TS22.368 V13.2.0 (2017-01-13) Appendix B, the content of which is incorporated by reference into this application). This list is not exhaustive and indicates, for example, MTC applications.

[0158]

[0159]

[0160] The applications, services and solutions may be, for example, mobile virtual network operator (MVNO) services / systems, disaster prevention wireless services / systems, private wireless telephone (private branch exchange (PBX)) services / systems, PHS / digital cordless telephone services / systems, point of sale (POS) systems, advertising delivery services / systems, multicast (Multimedia Broadcast and Multicast Service (MBMS)) services / systems, vehicle-to-everything (V2X: vehicle-to-vehicle communication and road-to-vehicle and pedestrian-to-vehicle communication) services / systems, train mobile wireless services / systems, location information related services / systems, disaster / emergency wireless community services / systems, Internet of Things (IoT), etc. T) services / systems, communication services / systems, video distribution services / systems, femtocell application services / systems, voice over LTE (VoLTE) services / systems, wireless tag services / systems, billing services / systems, radio on demand services / systems, roaming services / systems, user behavior monitoring services / systems, communication operator / communication NW selection services / systems, function restriction services / systems, proof of concept (PoC) services / systems, terminal-specific personal information management services / systems, terminal-specific display and video services / systems, terminal-specific non-communication services / systems, and self-organizing NW / delay-tolerant network (DTN) services / systems, etc.

[0161] Note that the above-mentioned UE categories are merely application examples of the technical ideas and exemplary embodiments described in this specification. The present invention is not limited to these examples, and of course, those skilled in the art can make various modifications.

[0162] Although the invention of the present application has been described by the exemplary embodiments, the invention of the present application is not limited to the above exemplary embodiments. Various modifications that can be understood by those skilled in the art can be made to the structure and details of the invention of the present application within the scope of the present invention.

[0163] This application is based upon and claims the benefit of priority from Japanese patent application No. 2018-185420, filed on September 28, 2018, the disclosure of which is incorporated herein in its entirety by reference.

[0164] A part or all of the above exemplary embodiments may also be described in the following supplementary description, but is not limited thereto.

[0165] (Supplementary Note 1)

[0166] A core network device, comprising:

[0167] a first authentication component for performing a first authentication process for determining whether the communication terminal is a communication terminal permitted to be registered in the core network during a registration process for registering the communication terminal in the core network;

[0168] a communication component, configured to receive permission list information indicating at least one network slice in a service network that can be used by the communication terminal; and

[0169] The second authentication component is used to perform a second authentication process to determine whether the communication terminal is a communication terminal permitted to use the network slice included in the permission list information during the registration process for registering the communication terminal in the core network.

[0170] (Supplementary Note 2)

[0171] According to the core network device described in Supplementary Note 1, when the permission list information includes multiple network slices, the second authentication component is configured to determine whether it is necessary to perform the second authentication processing in each network slice, and perform the second authentication processing on each network slice that needs to perform the second authentication processing.

[0172] (Supplementary Note 3)

[0173] A core network device according to Supplementary Note 1 or 2, wherein the communication component is configured to send identification information related to the communication terminal used when the communication terminal uses the network slice to an authentication server associated with the network slice.

[0174] (Supplementary Note 4)

[0175] According to the core network device described in Supplementary Note 3, the communication component is configured to obtain identification information related to the communication terminal from the communication terminal for each network slice included in the permission list information.

[0176] (Supplementary Note 5)

[0177] A core network device according to any one of Supplementary Notes 1 to 4, wherein, in a case where the second authentication component is configured to perform the second authentication processing during a registration processing in which the communication terminal registers the communication terminal in the core network via a first access network, the second authentication component is configured to omit the second authentication processing during a registration processing in which the communication terminal registers the communication terminal in the core network via a second access network.

[0178] (Supplementary Note 6)

[0179] A core network device according to any one of Supplementary Notes 1 to 5, wherein, in a case where the second authentication component is configured to determine that the communication terminal is not a communication terminal permitted to use the network slice included in the permission list information, the second authentication component is configured to notify the communication terminal of identification information related to a predetermined network slice.

[0180] (Supplementary Note 7)

[0181] A core network device, comprising:

[0182] a communication means for receiving, during a registration process for registering a communication terminal in a core network, a registration request message from the communication terminal including information indicating whether the communication terminal supports slice-specific authentication and authorization; and

[0183] An authentication component, used to perform processing related to the slice-specific authentication and authorization when the information indicates that the communication terminal supports slice-specific authentication and authorization.

[0184] (Supplementary Note 8)

[0185] According to the core network device described in Supplementary Note 7, the authentication component is configured not to perform processing related to the slice-specific authentication and authorization when the information indicates that the communication terminal does not support slice-specific authentication and authorization.

[0186] (Supplementary Note 9)

[0187] A core network device according to Supplementary Note 7 or 8, wherein, when the authentication component is configured not to perform processing related to the slice-specific authentication and authorization, the communication component is configured to send a registration rejection message including a specific reason code to the communication terminal in response to the registration request message.

[0188] (Supplementary Note 10)

[0189] A communication terminal, comprising:

[0190] A communication component for sending a registration request message to a core network device, including information indicating whether the communication terminal supports slice-specific authentication and authorization.

[0191] (Supplementary Note 11)

[0192] A communication terminal according to Supplementary Note 10, wherein, when the communication terminal does not support the slice-specific authentication and authorization, the core network device that receives the registration request message does not perform processing related to the slice-specific authentication and authorization.

[0193] (Supplementary Note 12)

[0194] A communication terminal according to Supplementary Note 10 or 11, wherein, when the core network device is configured not to perform processing related to the slice-specific authentication and authorization, the communication component is configured to receive a registration rejection message including a specific reason code from the core network device in response to the registration request message.

[0195] (Supplementary Note 13)

[0196] A core network device, comprising:

[0197] a first authentication component for performing a first authentication process for determining whether the communication terminal is a communication terminal permitted to be registered in the core network during a registration process for registering the communication terminal in the core network;

[0198] a communication component for receiving, from the communication terminal, information related to a plurality of network slices desired to be used and information related to a network slice to be used preferentially among the plurality of network slices; and

[0199] The second authentication component is used to perform a second authentication process to determine whether the communication terminal is a communication terminal permitted to use the priority network slice during the registration process for registering the communication terminal in the core network.

[0200] (Supplementary Note 14)

[0201] According to the core network device described in Supplementary Note 13, the second authentication component is configured to perform the second authentication process after the registration process is completed and when the communication terminal first uses the network slice that has not undergone the second authentication process.

[0202] (Supplementary Note 15)

[0203] A communication terminal, comprising:

[0204] A communication component for sending information related to multiple network slices that are desired to be used and information related to network slices that are preferentially used among the multiple network slices to a core network device during a registration process for registering a communication terminal in the core network.

[0205] (Supplementary Note 16)

[0206] A communication terminal according to Supplementary Note 15, wherein the communication component is configured to include information related to a network slice that is preferentially used and information related to a network slice that is different from the network slice that is preferentially used in a registration request message, and send the registration request message.

[0207] (Supplementary Note 17)

[0208] A communication system, comprising:

[0209] a first core network device configured to perform, during a registration process for registering a communication terminal in a core network, a first authentication process for determining whether the communication terminal is a communication terminal permitted to be registered in the core network, perform, during a registration process for registering the communication terminal in the core network, a second authentication process for determining whether the communication terminal is a communication terminal permitted to use a network slice, and transmit information indicating a network slice for which the second authentication process is to be performed; and

[0210] A second core network device is configured to receive information indicating a network slice for performing the second authentication process, determine whether to perform the second authentication process related to the communication terminal after the registration process is completed and when the communication terminal uses the network slice for the first time, perform the second authentication process if the second authentication process has not been performed, and not perform the second authentication process if the second authentication process has been performed.

[0211] (Supplementary Note 18)

[0212] A communication system according to Supplementary Note 17, wherein the first core network device sends information indicating the network slice for performing the second authentication processing during the PDU session establishment processing.

[0213] (Supplementary Note 19)

[0214] An authentication method in a core network device, the authentication method comprising:

[0215] During a registration process for registering a communication terminal in a core network, performing a first authentication process for determining whether the communication terminal is a communication terminal permitted to be registered in the core network;

[0216] Receiving permission list information indicating at least one network slice in a service network that can be used by the communication terminal; and

[0217] During the registration process for registering the communication terminal in the core network, a second authentication process is performed to determine whether the communication terminal is a communication terminal permitted to use the network slice included in the permission list information.

[0218] (Supplementary Note 20)

[0219] A communication method in a communication terminal, the communication method comprising:

[0220] generating, during a registration process for registering a communication terminal in a core network, capability information indicating whether a process associated with a second authentication process for determining whether the communication terminal is a communication terminal permitted to use a network slice can be performed; and

[0221] The capability information is sent to a core network device.

[0222] Reference numerals list

[0223] 10 Core Network Devices

[0224] 11 Certification Unit

[0225] 12 Certification Units

[0226] 13 Communication unit

[0227] 20 UE

[0228] 30 Serving PLMN

[0229] 31 AMF

[0230] 32 V-SMF

[0231] 33 UPF

[0232] 40 HPLMN

[0233] 41 UDM

[0234] 42 AUSF

[0235] 43 NSSF

[0236] 44 NEF

[0237] 45 H-SMF

[0238] 46 UPF

[0239] 50 Third-party network

[0240] 51 AAA Server

[0241] 60 Network Slicing

[0242] 70 Communication Terminal

[0243] 71 Control unit

[0244] 72 Communication Unit

[0245] 80 UE

[0246] 90 UE

Claims

1. A core network device operating as an access management function (AMF), the core network device comprising: A communication component, configured to receive, from a communication terminal, a registration request message including a request for network slice selection assistance information, i.e., a request for NSSAI, and information indicating whether the communication terminal supports slice-specific authentication and authorization; as well as an authentication component, configured to perform a process related to the slice-specific authentication and authorization if the information indicates that the communication terminal supports the slice-specific authentication and authorization, In which, when the information indicates that the communication terminal does not support the slice-specific authentication and authorization, the process related to the slice-specific authentication and authorization is not performed.

2. The core network device according to claim 1, wherein: The authentication component is configured not to perform the process related to the slice-specific authentication and authorization if the information indicates that the communication terminal does not support the slice-specific authentication and authorization.

3. The core network device according to claim 1 or 2, wherein: The communication component is configured to send a rejection message including a specific cause value to the communication terminal in response to the registration request message if the requested NSSAI included in the registration request message does not indicate a network slice for which the slice-specific authentication and authorization has been performed.

4. A communication terminal, comprising: a communication means for sending a registration request message comprising a request for network slice selection assistance information, i.e. a request for NSSAI, and information indicating whether the communication terminal supports slice specific authentication and authorization to a core network device operating as an access management function, i.e. an AMF, wherein, in a case where the information indicates that the communication terminal supports the slice-specific authentication and authorization, performing a process related to the slice-specific authentication and authorization, and In which, when the information indicates that the communication terminal does not support the slice-specific authentication and authorization, the process related to the slice-specific authentication and authorization is not performed.

5. The communication terminal according to claim 4, wherein: The communication component is configured to receive a rejection message including a specific cause value from the core network device in response to the registration request message if the requested NSSAI included in the registration request message does not indicate a network slice for which the slice-specific authentication and authorization has been performed.

6. A method in a core network device operating as an access management function (AMF), the method comprising: receiving, from a communication terminal, a registration request message including a request for network slice selection assistance information, i.e., a request for NSSAI, and information indicating whether the communication terminal supports slice specific authentication and authorization; In case the information indicates that the communication terminal supports the slice-specific authentication and authorization, performing a process related to the slice-specific authentication and authorization, In which, when the information indicates that the communication terminal does not support the slice-specific authentication and authorization, the process related to the slice-specific authentication and authorization is not performed.

7. A computer-readable medium storing a program, wherein the program causes a computer to execute: receiving, from a communication terminal, a registration request message including a request for network slice selection assistance information, i.e., a request for NSSAI, and information indicating whether the communication terminal supports slice specific authentication and authorization; In case the information indicates that the communication terminal supports the slice-specific authentication and authorization, performing a process related to the slice-specific authentication and authorization, in, In a case where the information indicates that the communication terminal does not support the slice-specific authentication and authorization, the process related to the slice-specific authentication and authorization is not performed.

8. A method in a communication terminal, the method comprising: sending a registration request message including a request for network slice selection assistance information, i.e., a request for NSSAI, and information indicating whether the communication terminal supports slice specific authentication and authorization to a core network device operating as an access management function, i.e., an AMF, wherein, in a case where the information indicates that the communication terminal supports the slice-specific authentication and authorization, performing a process related to the slice-specific authentication and authorization, and In which, when the information indicates that the communication terminal does not support the slice-specific authentication and authorization, the process related to the slice-specific authentication and authorization is not performed.

9. A computer-readable medium storing a program, the program causing a computer to execute: sending a registration request message including a request for network slice selection assistance information, i.e., a request for NSSAI, and information indicating whether the communication terminal supports slice-specific authentication and authorization to a core network device operating as an access management function, i.e., an AMF, in, In case the information indicates that the communication terminal supports the slice-specific authentication and authorization, performing a process related to the slice-specific authentication and authorization, and In which, when the information indicates that the communication terminal does not support the slice-specific authentication and authorization, the process related to the slice-specific authentication and authorization is not performed.

Images