Method and related apparatus for providing compliant privacy

Abstract

A method of operating network devices in a service network for providing compliant privacy in a communication network is provided. Operations of this method include: obtaining (500) a hidden subscription identifier from a user equipment UE associated with a home network HN; obtaining (504) a permanent subscription identifier associated with the hidden subscription identifier from the HN; determining (506) whether the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN; and in response to determining that the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN, performing (508) further operations to provide a service to the UE.

Description

[0001] Cross - reference to related applications

[0002] This application claims the benefit and priority of U.S. Provisional Patent Application No. 62 / 794,940, titled "METHODS FOR PROVIDING REGULATION COMPLIANT PRIVACY AND RELATED APPARATUSES", filed on January 21, 2019, the disclosure of which is incorporated herein by reference in its entirety. Field of the Invention

[0003] The present disclosure generally relates to wireless communication systems, and more particularly, to supervised compliant privacy in wireless networks. Background Art

[0004] 5G is the next generation of mobile networks developed by a standards - developing organization called 3GPP. The previous generations of mobile networks are known as 4G / LTE, 3G / UMTS, and 2G / GSM.

[0005] 5G networks are maintained by so - called mobile network operators (MNOs), and the services of 5G networks are provided by MNOs. MNOs can be distinguished from each other by two types of codes, namely, mobile country code (MCC) and mobile network code (MNC).

[0006] To use a particular 5G network provided by a particular MNO, a user is required to have a certain contractual relationship with that MNO. This relationship is usually referred to as a subscription. In the case where a user lacks a subscription to a particular MNO (e.g., in a roaming scenario), this relationship is achieved through a roaming agreement between the MNO with which the user has a subscription (i.e., the user's home network (HN)) and the MNO providing services to the user (i.e., the visited network (VN)).

[0007] Each subscription in an MNO's 5G network is identified by a unique long - term identifier called a subscription permanent identifier (SUPI). A user uses a wireless device called a user equipment (UE) to wirelessly access the 5G network over - the - air. Before providing any services, the 5G network needs to identify the user behind the UE, i.e., the user's subscription. For identification purposes, UEs in previous generations of mobile networks (4G, 3G, and 2G) would send the user's unique long - term identifier over - the - air. This raises potential privacy concerns because a user may be tracked or identified by any unauthorized entity that is able to intercept messages over - the - air or act as a man - in - the - middle.

[0008] However, in a 5G network, the MNO has the ability to provide better privacy to its users, making the user's unique long-term identifier (i.e., the SUPI) invisible in the air. This ability comes from a mechanism under which the UE calculates and sends a hidden identifier in the air instead of the SUPI. This hidden identifier is called the Subscription Concealed Identifier (SUCI). The MNO can enable the UE to obtain all the information necessary to calculate the SUCI.

[0009] Without loss of generality, an overview of the SUPI and SUCI formats is given below.

[0010] The SUPI contains the following parts (separated by ||): SUPI type || SUPI value, where the SUPI value can be of IMSI type or a network-specific identifier (sometimes also called the Network Access Identifier or NAI). In either case, the SUPI value consists of a home network identifier and a subscription identifier. The subscription identifier is what is hidden in the SUCI.

[0011] The SUCI contains the following parts (separated by ||): SUPI type || home network identifier || other parameters || hidden subscription identifier.

[0012] If the SUPI is of IMSI type, the home network identifier consists of the Mobile Country Code (MCC) and the Mobile Network Code (MNC), and the subscription identifier is called the Mobile Subscription Identification Number (MSIN). If the SUPI is of network-specific identifier type, the home network identifier is usually represented by the so-called "realm", and the subscription identifier is usually represented by the so-called "username", i.e., the SUPI looks like "username@realm". The exact definition of the SUPI can be found in 3GPP TS 23.003 V.15.6.0.

[0013] 3GPP 33.501 V.15.3.0 stipulates that for a SUPI containing an IMSI, the SUCI has the following fields: the SUPI type identifier as defined in TS23.003 V.15.6.0 that hides the SUPI type in the SUCI; the home network identifier set to the MCC and MNC of the IMSI as stipulated in 23.003 V.15.6.0; the routing indicator as stipulated in TS 23.003 V.15.6.0; the protection scheme identifier as stipulated in Appendix C of 3GPP TS 33.501 V.15.3.0; the home network public key identifier as stipulated in 3GPPTS 33.501 V.15.3.0 and detailed in TS 23.003 V.15.6.0; and the scheme output as described in this document and detailed in TS23.003 V.15.6.0.

[0014] In addition, 3GPP 33.501 V.15.3.0 stipulates that for a SUPI containing a network-specific identifier, the SUCI in NAI format has the following fields: the regional part of the SUCI is set to the regional part of the SUPI; and the user name part of the SUCI is formatted according to the SUPI type, routing indicator, protection scheme identifier, home network public key identifier, and scheme output as specified in TS23.003 V.15.6.0.

[0015] Potential problems of existing solutions

[0016] The following explanations of the potential problems of existing solutions are part of this implementation of the present disclosure and should not be construed as previously known to others.

[0017] In Figure 1 Figure 13 shows a high-level sequence diagram illustrating a message flow including SUCI, Figure 1 and Figure 14 is a data flow diagram showing UE registration using SUCI. Referring to Figure 1 , in operation 1, the UE connects to the gNB (the gNB is part of the 5G base station and 5G radio access network (RAN)) over the air and sends a registration request message including the SUCI calculated by the UE. In operation 2, the gNB forwards the received registration request message to the core network node. We denote this core network node as the access and mobility management function (AMF) or the security anchor function (SEAF), which are interchangeable. The gNB and the AMF / SEAF are collectively referred to as the serving network (SN). The SEAF further locates the authentication server function (AUSF). The SEAF then creates and sends it to the AUSF. In operation 3, information such as the 5G authentication information request (AIR) contains the received SUCI. Then, in operation 4, the AUSF contacts the unified data management (UDM) or the subscription identifier de-hiding function (SIDF) function.

[0018] The AUSF and the UDFM / SIDF are collectively referred to as the home network (HN). Note that in the case of roaming, the SN and the HN belong to different MNOS, otherwise both the SN and the HN belong to the same MNO.

[0019] It should also be noted that the registration involves more steps than these messages, but this gives an overview of how the SUCI propagates on the network.

[0020] Problems with existing solutions include that when hiding the SUPI (representing a long-term identifier) between the UE and its HN, all network functions between them do not know the SUPI, including the SN. Therefore, it is challenging for the SN to fulfill its legitimate interception duties. This may be unacceptable because the SN must be able to fulfill its legitimate interception duties regardless of whether the UE in its network is roaming. Summary of the Invention

[0021] Some embodiments relate to a method for providing compliant privacy in a communication network for operating a network device in a serving network SN. Such a method includes the following operations: obtaining a hidden subscription identifier from a user equipment UE associated with a home network HN; obtaining a permanent subscription identifier associated with the hidden subscription identifier from the HN; determining whether the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN; and in response to determining that the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN, performing further operations to provide services to the UE.

[0022] In some embodiments, the operations include: denying service to the UE in response to determining that the hidden subscription identifier from the UE does not correspond to the permanent subscription identifier from the HN.

[0023] Some embodiments provide that denying service to the UE includes at least one of the following: denying the UE's registration to the SN, recording an event corresponding to the hidden subscription identifier not corresponding to the permanent subscription identifier, notifying a law enforcement organization, and notifying the UE.

[0024] In some embodiments, the hidden subscription identifier includes a SUCI calculated by the UE based on information provided by the HN.

[0025] Some embodiments provide that the permanent subscription identifier includes a SUPI.

[0026] In some embodiments, the SUPI includes an international mobile subscription identifier IMSI or a network-specific identifier.

[0027] Some embodiments provide that the hidden subscription identifier hides the permanent subscription identifier.

[0028] In some embodiments, obtaining the hidden subscription identifier includes obtaining a first home network identifier corresponding to the UE having a first value and a second home network identifier corresponding to the HN having a second value.

[0029] In some embodiments, obtaining a first home network identifier includes obtaining a Mobile Country Code (MCC) having a first MCC value and a Mobile Network Code (MNC) having a first MNC value, obtaining a second home network identifier includes obtaining an MCC having a second MCC value and an MNC having a second MNC value, and determining that the first home network identifier corresponds to the second home network identifier includes: determining that the first MCC value is equal to the second MCC value and the first MNC value is equal to the second MNC value.

[0030] Some embodiments provide that the first home network identifier includes a first format and the second home network identifier includes a second format different from the first format, and in response to determining that the first format and the second format include the same geographical area, an operation provides services to the UE.

[0031] In some embodiments, obtaining a hidden subscription identifier includes obtaining a Mobile Country Code (MCC) having a first MCC value and a Mobile Network Code (MNC) having a first MNC value, obtaining a permanent subscription identifier includes obtaining an MCC value having a second MCC and an MNC value having a second MNC, and determining that the hidden subscription identifier corresponds to the permanent subscription identifier includes: determining that the first MCC value is equal to the second MCC value and the first MNC value is equal to the second MNC value.

[0032] Some embodiments provide that performing subscription binding includes performing subscription binding using the second MCC value and the second MNC value.

[0033] Some embodiments include determining whether the SUPI type is received from the UE and the HN.

[0034] In some embodiments, the hidden subscription identifier includes a first type and the permanent subscription identifier includes a second type different from the first type. Some embodiments provide that determining that the hidden subscription identifier corresponds to the permanent subscription identifier includes: determining that the first MCC value of the first type is equal to the second MCC value of the second type and the first MNC value of the first type is equal to the MNC value of the second type.

[0035] In some embodiments, determining that the hidden subscription identifier corresponds to the permanent subscription identifier includes: determining that the first MCC value of the first type is different from the second MCC value of the second type and determining that the first MNC value of the first type is different from the second MNC value of the second type.

[0036] Some embodiments provide that the SN generates an indication of denial of service in response to the first type being different from the second type. In some embodiments, the first type includes a first format defining a geographical area and the second type includes a second format type defining a geographical area. In some embodiments, an operation is provided to the UE.

[0037] In some embodiments, the hidden subscription identifier includes a first type and the permanent subscription identifier includes the first type. Some embodiments include: determining that the first type is an IMSI, and in response to determining that the first type is an IMSI, determining that the MCC / MNC is the same.

[0038] Some embodiments provide for: determining that the first type is an NSI, and in response to determining that the first type is an NSI, determining that the MCC / MNC includes the same geographical area.

[0039] Some embodiments include sending (700) the hidden subscription identifier received from the UE to the HN.

[0040] Some embodiments described herein relate to a method of operating a mobile terminal for providing compliant privacy in a communication network. Operations according to such a method include sending a hidden subscription identifier to a serving network. In some embodiments, the hidden subscription identifier includes at least a first home network identifier. The operations include using a SUPI having at least the first home network identifier in a binding.

[0041] Some embodiments provide that the hidden subscription identifier includes a first MCC value and a first MNC value.

[0042] In some embodiments, the hidden subscription identifier hides the permanent subscription identifier.

[0043] In some embodiments, the hidden subscription identifier includes an IMSI type.

[0044] Some embodiments provide that the hidden subscription identifier includes a network access identifier NAI.

[0045] In some embodiments, the mobile terminal uses the permanent subscription identifier hidden in the hidden subscription identifier to perform SUPI binding.

[0046] Some embodiments described herein relate to a mobile terminal that includes at least one processor and at least one memory coupled to the at least one processor. The memory stores program code that is executed by the at least one processor to perform operations including sending a hidden subscription identifier to a serving network. In some embodiments, the hidden subscription identifier includes at least a first home network identifier. The operations include using a SUPI having at least the first home network identifier in a binding.

[0047] In some embodiments, the hidden subscription identifier includes a first MCC value and a first MNC value.

[0048] Some embodiments provide that the hidden subscription identifier hides the permanent subscription identifier.

[0049] In some embodiments, the hidden subscription identifier includes an IMSI type.

[0050] In some embodiments, the hidden subscription identifier includes a Network Access Identifier (NAI).

[0051] Some embodiments provide that a mobile terminal uses a permanent subscription identifier hidden in the hidden subscription identifier to perform SUPI binding.

[0052] Embodiments herein relate to a computer program product that includes a non-transitory computer-readable medium storing program code that is configured to be executed by a processor disclosed herein and is configured to perform operations described herein to provide compliant privacy in a communication network.

[0053] Embodiments herein relate to a computer program for providing compliant privacy in a communication network that, when executed, performs the operations described herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The drawings illustrate certain non-limiting embodiments of the inventive concept and are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this application.

[0055] Figure 1 is a data flow diagram showing UE registration using SUCI;

[0056] Figure 2 is a data flow diagram showing a process for SUPI binding according to some embodiments.

[0057] Figure 3 is a data flow diagram showing operations for a mismatch between SUPI and SUCI according to some embodiments;

[0058] Figure 4 is a data flow diagram showing operations including authentication of parameters corresponding to SUPI and SUCI according to some embodiments.

[0059] Figures 5 to 7 is a flowchart of operations that may be performed according to some embodiments of the present disclosure.

[0060] Figure 8 is a block diagram of elements of a mobile terminal configured according to some embodiments of the present disclosure;

[0061] Figure 9 is a block diagram of elements of a network node configured according to some embodiments of the present disclosure;

[0062] Figure 10 is a block diagram of a wireless network according to some embodiments of the present disclosure;

[0063] Figure 11is a block diagram of a user equipment or other terminal according to some embodiments of the present disclosure;

[0064] Figure 12 is a block diagram of a virtualized environment according to some embodiments of the present disclosure;

[0065] Figure 13 is a block diagram of a telecommunications network connected to a host computer via an intermediate network according to some embodiments of the present disclosure;

[0066] Figure 14 is a block diagram of a host computer communicating with a user equipment or other terminal via a base station through a partial wireless connection according to some embodiments of the present disclosure;

[0067] Figure 15 is a block diagram of a method implemented in a communication system including a host computer, a base station, and a user equipment or other terminal according to some embodiments of the present disclosure;

[0068] Figure 16 is a block diagram of a method implemented in a communication system including a host computer, a base station, and a user equipment or other terminal according to some embodiments of the present disclosure;

[0069] Figure 17 is a block diagram of a method implemented in a communication system including a host computer, a base station, and a user equipment or other terminal according to some embodiments of the present disclosure; and

[0070] Figure 18 is a block diagram of a method implemented in a communication system including a host computer, a base station, and a user equipment or other terminal according to some embodiments of the present disclosure. Detailed Description

[0071] Hereinafter, the inventive concept will be described more fully with reference to the accompanying drawings, in which examples of embodiments of the inventive concept are shown. However, the inventive concept may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the inventive concept to those skilled in the art. It should also be noted that these embodiments are not mutually exclusive. Components from one embodiment may be assumed to be present in / used in another embodiment by default.

[0072] The following description presents various embodiments of the disclosed subject matter. These embodiments are presented as illustrative examples and are not to be construed as limiting the scope of the disclosed subject matter. For example, certain details of the embodiments may be modified, omitted, or extended without departing from the scope of the subject matter. The term "terminal" is used in a non-limiting manner and, as explained below, may refer to any type of radio communication terminal. The term "terminal" herein may be interchangeably substituted with the terms "radio terminal", "radio communication terminal", "radio device", or "user equipment (UE)".

[0073] A further discussion of the potential problem provides that a potential solution is for the HN to provide the SUPI (for all SUCI for the SN service) to the SN without discrimination. While this solution can provide an important aspect of fulfilling the LI obligation, the solution by itself is not sufficient because the SN does not have any reliable verification that the HN has provided a true or genuine SUPI. Thus, it may be necessary for the HN to send the SUPI to the SN, but it is not enough.

[0074] Another solution could be for the SN to verify whether the SUPI sent by the HN actually belongs to the UE that the SN is serving. The SN can use a variety of mechanisms for this verification, for example, by calculating the SUCI by encrypting the SUPI sent by the HN and comparing the calculated SUCI with the SUCI previously sent by the UE, obtaining an additional commitment value from the UE, obtaining another commitment opener value from the HN, and verifying that the commitment opener can verify the commitment, by calculating an expected response using the SUPI sent by the HN, challenging the UE to send a response, and comparing the response sent by the UE with the calculated expected response, using the SUPI sent by the HN in the calculation of a security key so that if the UE uses a different value, the communication is interrupted, etc.

[0075] Although a certain verification of the SN can be another important aspect in fulfilling the LI duty, different kinds of the above verifications can have different attributes and complexities. Eventually, 3GPP chose the last one of the above mechanisms, i.e., using the SUPI in the calculation of the security key. The chosen mechanism can include the SUPI in the calculation of the key used for communication. Using this mechanism, if the SN receives an incorrect SUPI from the HN, the keys used by the SN and the UE will not match. If the UE and the SN have different keys, they will not be able to communicate because they will ignore the messages protected with the incorrect key. The chosen mechanism is described in Section 6.1.3.1 for EAP-AKA’ and Section 6.1.3.2 for 5G-AKA in 3GPP TS 33.501 V15.3.0. The inclusion of the SUPI is specified in Appendix A.7 of 3GPP TS 33.501 V15.3.0. In addition, there is a discussion on whether to include the entire SUPI in the calculation of the security key. Some people suggest not including the SUPI type part of the SUPI in the calculation of the security key and only using the SUPI value as the input. The argument for excluding the SUPI type is for simplicity. There are also other suggestions to include the SUPI type part of the SUPI in the calculation of the security key. One reason for including it can be to ensure the binding between the SUPI received from the UE and the SUPI received from the HN.

[0076] Although the above mechanism can work, and regardless of whether the entire SUPI is used in the calculation of the security key, it may still be insufficient for fully fulfilling the lawful interception (LI) duty because there may not be any mechanism to link the SUCI received by the SN from the UE to the SUPI received by the SN from the HN. It can be a challenge for the SN to have this link. And in the absence of such a link, there are problems in fulfilling the LI duty, which can be problematic.

[0077] In response to the above challenges, some embodiments of this document relate to enabling the network to fulfill its lawful interception (LI) duty by ensuring that the identified subscription is the same as the subscription for which the service is obtained. Such embodiments can provide reliable fulfillment of the LI duty.

[0078] As described above, due to the hiding of the SUPI between the UE and the HN, it may be challenging for the SN to fulfill its lawful interception (LI) duty because there may not exist a mechanism that enables the SN to link the SUCI received from the UE to the SUPI received from the HN. Thus, some embodiments of this document may include a SUPI of type IMSI. Additionally, the embodiments may be discussed in terms of MCC and MNC; however, these terms are merely example terms and the inventive concept is not limited thereto. Thus, the embodiments generally apply to the fields / parameters / attributes of the SUCI and the SUPI. Moreover, the embodiments are not limited to a SUPI of type IMSI. For example, the embodiments are equally applicable to a SUPI of network-specific identifier type. For example, in addition to checking the MCC and MNC fields, the SN may also check other fields, such as the territorial part, SUPI type, etc. of the network-specific identifier type of the SUPI.

[0079] Now refer to Figure 2 , Figure 2 which is a data flow diagram showing a SUPI binding process according to some embodiments. In some embodiments, in operation 1, the UE sends a SUCI to the SN. In this example, the home network identifier consists of an MCC and an MNC with values of MCC_1 and MNC_1. According to operation 2, the SN forwards the received SUCI to the HN without modification. Operation 3 stipulates that the HN converts the SUCI and returns the SUPI to the SN. The SUPI contains the same MCC_1, MNC_1 as the SUCI. In operation 4, the SN uses the SUPI (partial or complete, to be discussed) as an input for the calculation of a security key. Operation 5 stipulates that the UE uses the locally stored SUPI to derive a security key. If the local SUPI matches the SUPI in the SN, the binding is successful, as shown in operation 6.

[0080] In some embodiments, the SUPI received from the HN may not match the SUCI provided by the UE. Now refer to Figure 3 , Figure 3is a data flow diagram showing operations where the SUPI and SUCI do not match according to some embodiments. Operation 1 shows the UE sending the SUCI to the SN. In this example, the home network identifier consists of an MCC and an MNC with values MCC_I and MNC_1. In Operation 2, the SN forwards the received SUCI to the HN without modification. In Operation 3, the HN converts the SUCI and returns the SUPI to the SN. In this example, the HN returns the values MCC_2 and MNC_2. In Operation 4, the SN uses the SUPI (partial or complete, to be discussed) as an input for the calculation of a security key. In Operation 5, the UE uses the locally stored SUPI to derive a security key. Since the UE will use the SUPI with values MCC_1 and MNC_1, the UE and the SN will not calculate the same key, as shown in Operation 6.

[0081] Now refer to Figure 4 , Figure 4 is a data flow diagram showing operations including the authentication of parameters corresponding to the SUPI and SUCI according to some embodiments. The operations include Operation 1, in which the UE sends the SUCI to the SN. In this example, the home network identifier consists of an MCC and an MNC with values MCC_1 and MNC_1 respectively. Operation 2 stipulates that the SN forwards the received SUCI to the HN in an unchanged state. In Operation 3, the HN converts the SUCI and returns the SUPI to the SN. In this example, the HN returns the values MCC_x and MNC_x. In Operation 4, the SN verifies that the SUPI parameter received from the HN matches the SUPI parameter received from the UE. Examples of parameters are MCC, MNC, and / or SUPI type, etc. If the parameters do not match, the SN will not provide services to the UE and may not perform the following operations. In some embodiments, the SN may send an error or rejection message to the UE. Some embodiments stipulate that the SN may notify the HN of the error condition. In some embodiments, the SN may record the error condition, generate a report, and / or notify a law enforcement agency, etc.

[0082] Some embodiments stipulate that a similar condition may occur if the same value in the SUPI is provided as a different type. For example, a condition where the same subscription information is included in a SUPI containing an IMSI or a SUPI containing a network-specific identifier (NSI). For example, #1 and #2 below can arguably be considered the same. In such embodiments, the matching function corresponding to Operation 4 will still verify that these values are the same regardless of the SUPI type. For example, in the following example, the home network identifiers for both #1 and #2 are 123 and 45, and the subscription identifier is 6789100000.

[0083] 1. SUPI Type (IMSI) || MCC (123) || MNC (45) || MSIN (6789100000)

[0084] 2. SUPI Type (NSI) || User Name (6789100000) @ Region (MCC(123).(MNC(45).com)

[0085] In operation 5, the SN uses part or all of the SUPI as the input for the calculation of the security key. In operation 6, the UE uses the locally stored SUPI to derive the security key. If the local SUPI matches the SUPI in the SN, the binding can be identified as successful.

[0086] These and other related operations are now described in the context of an Figures 5 to 7 operation flow diagram that can be executed by a mobile terminal.

[0087] Now refer to Figure 5 which Figure 5 shows operations that can be performed by a network device. The operations can include obtaining a hidden subscription identifier from a user equipment UE (block 500). In some embodiments, the UE is associated with a home network HN. The hidden subscription identifier is sent to the HN (block 502).

[0088] Obtaining a permanent subscription identifier from the HN (block 504). The operations include determining whether the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN (block 506). In response to determining that the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN, the operations include performing further operations to provide services to the UE (block 508). In response to determining that the hidden subscription identifier from the UE does not correspond to the permanent subscription identifier from the HN, the operations include denying service to the UE (block 510).

[0089] In some embodiments, the hidden subscription identifier includes a SUCI calculated by the UE based on information provided by the HN. Some embodiments provide that the permanent subscription identifier includes a SUPI.

[0090] In some embodiments, the SUPI includes an International Mobile Subscription Identifier IMSI or a network-specific identifier. Some embodiments provide that the hidden subscription identifier hides the permanent subscription identifier.

[0091] In some embodiments, obtaining a hidden subscription identifier includes obtaining a Mobile Country Code (MCC) having a first MCC value and a Mobile Network Code (MNC) having a first MNC value, and obtaining a permanent subscription identifier includes obtaining an MCC having a second MCC value and an MNC having a second MNC value. Some embodiments provide that determining that the hidden subscription identifier corresponds to the permanent subscription identifier includes determining that the first MCC value is equal to the second MCC value and the first MNC value is equal to the second MNC value.

[0092] In some embodiments, performing subscription binding includes performing subscription binding using the second MCC value and the second MNC value. In some embodiments, subscription binding in a UE is based on the first MCC value and the first MNC value.

[0093] Some embodiments provide that determining whether the hidden subscription identifier corresponds to the permanent subscription identifier includes generating a security key using at least a portion of the permanent subscription identifier for comparison with a security key generated by the UE using the permanent subscription identifier stored on the UE.

[0094] Now refer to Figure 6 , Figure 6 FIG. shows operations that may be performed to deny service to a UE according to some embodiments. The operations may include denying service to the UE (block 600), recording an event corresponding to the hidden subscription identifier not corresponding to the permanent subscription identifier (block 602), notifying a law enforcement organization (block 604), and / or notifying the UE (block 606).

[0095] Now refer to Figure 7 , Figure 7 FIG. shows operations that may be performed by a mobile terminal according to some embodiments. The operations may include sending a hidden subscription identifier to a serving network (block 700). In some embodiments, the hidden subscription identifier includes at least a first home network identifier. In some embodiments, the hidden subscription identifier includes a first MCC value and a first MNC value. The operations also include using a Subscriber Permanent Identifier (SUPI) having at least the first home network identifier. A mobile terminal security key may be generated using the permanent subscription identifier stored on the mobile terminal. The operations may include performing permanent subscription identifier binding. In some embodiments, binding is performed with the serving network based on a mobile terminal security key that matches a security key generated by the serving network, the security key generated by the serving network being based on a second MCC value and a second MNC value at the serving network.

[0096] Figure 8is a block diagram showing a mobile terminal 106 configured according to some embodiments. The mobile terminal 106 may include, but is not limited to, a wireless terminal, a wireless communication device, a wireless communication terminal, a terminal node / UE / device, etc. The mobile terminal 106 includes an RF front-end 830, which includes one or more power amplifiers that transmit and receive through the antennas of the antenna array 840 to provide uplink and downlink radio communications with a radio network node (e.g., a base station, eNB, gNB, etc.) of a telecommunication network. Instead of or in addition to the RF front-end 830, the mobile terminal 106 may include an optical reception front-end that is configured to receive optical signaling from an optical WiFi AP. The mobile terminal 106 also includes a processor circuit 810 (also referred to as a processor) and a memory circuit 820 (also referred to as a memory) coupled to the RF front-end 830. The memory 820 stores computer-readable program code that, when executed by the processor 810, causes the processor 810 to perform operations according to the embodiments disclosed herein.

[0097] Figure 9 is a block diagram showing a network node 900 (e.g., a base station, eNB, gNB, etc.) of a telecommunication network. The network node 900 includes a processor circuit 904 (also referred to as a processor), a memory circuit 906 (also referred to as a memory), and a network interface 902 (e.g., a wired network interface and / or a wireless network interface) configured to communicate with other network nodes. The network node 900 may be configured as a radio network node including an RF front-end and / or an optical signal front-end, and the RF front-end and / or the optical signaling front-end have one or more power amplifiers 908 that transmit and receive through the antennas of the antenna array 910. The memory 906 stores computer-readable program code that, when executed by the processor 904, causes the processor 904 to perform operations according to the embodiments disclosed herein.

[0098] The following are certain enumerated embodiments further showing aspects of the disclosed subject matter.

[0099] Embodiment 1. A method of operating a network device in a serving network to provide compliant privacy in a communication network, the method comprising:

[0100] obtaining a hidden subscription identifier from a user equipment UE associated with a home network;

[0101] obtaining a permanent subscription identifier associated with the hidden subscription identifier from a home network HN;

[0102] determining whether the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN; and

[0103] In response to determining that the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN, perform further operations to provide services to the UE.

[0104] Example 2. The method according to Example 1 further includes: in response to determining that the hidden subscription identifier from the UE does not correspond to the permanent subscription identifier from the HN, rejecting the service for the UE.

[0105] Example 3. The method according to Example 2, wherein rejecting the service for the UE includes at least one of the following: rejecting the registration of the UE to the serving network, recording an event corresponding to the hidden subscription identifier not corresponding to the permanent subscription identifier, notifying a law enforcement organization, and notifying the UE.

[0106] Example 4. The method according to any one of Examples 1 to 3, wherein the hidden subscription identifier includes a SUCI calculated by the UE based on information provided by the HN.

[0107] Example 5. The method according to any one of Examples 1 to 4, wherein the permanent subscription identifier includes a SUPI.

[0108] Example 6. The method according to any one of Examples 1 to 5, wherein the SUPI includes an international mobile subscription identifier IMSI or a network-specific identifier.

[0109] Example 7. The method according to any one of Examples 1 to 6, wherein the hidden subscription identifier hides the permanent subscription identifier.

[0110] Example 8. The method according to any one of Examples 1 to 7, wherein obtaining the hidden subscription identifier includes obtaining a mobile country code MCC with a first MCC value and a mobile network code MNC with a first MNC value,

[0111] wherein obtaining the permanent subscription identifier includes obtaining an MCC with a second MCC value and an MNC with a second MNC value, and

[0112] wherein determining that the hidden subscription identifier corresponds to the permanent subscription identifier includes determining that the first MCC value is equal to the second MCC value and the first MNC value is equal to the second MNC value.

[0113] Example 9. The method according to Example 8, wherein performing subscription binding includes performing subscription binding using the second MCC value and the second MNC value.

[0114] Example 10. The method according to any one of Examples 8 to 9 further includes determining whether the SUPI type is received from the UE and the HN.

[0115] Example 11. The method according to Example 10, wherein the hidden subscription identifier includes a first type, and the permanent subscription identifier includes a second type different from the first type.

[0116] Example 12. The method according to Example 11, wherein determining that the hidden subscription identifier corresponds to the permanent subscription identifier includes: determining that a first MCC value of the first type is equal to a second MCC value of the second type, and determining that a first MNC value of the first type is equal to a second MNC value of the second type.

[0117] Example 13. The method according to any one of Examples 1 to 12, further comprising sending the hidden subscription identifier received from the UE to the HN.

[0118] Example 14. A computer program product, comprising;

[0119] A non-transitory computer-readable medium storing program code, the program code being configured to be executed by a processor of a network device to cause the processor to perform operations for providing compliant privacy in a communication network according to Examples 1 to 13.

[0120] Example 15. A computer program for providing compliant privacy in a communication network, the computer program performing the operations according to Examples 1 to 13 when executed.

[0121] Example 16. A network device in a communication network, comprising:

[0122] At least one processor;

[0123] At least one memory, coupled to the at least one processor and storing program code, the program code being executed by the at least one processor to perform operations including the following:

[0124] Obtaining a hidden subscription identifier from a user equipment UE associated with a home network;

[0125] Obtaining a permanent subscription identifier associated with the hidden subscription identifier from a home network HN;

[0126] Determining whether the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN; and

[0127] In response to determining that the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN, performing further operations to provide services to the UE.

[0128] Example 17. The network device according to Example 16, the operation further comprising: rejecting services to the UE in response to determining that the hidden subscription identifier from the UE does not correspond to the permanent subscription identifier from the HN.

[0129] Example 18. The network device according to Example 17, wherein denying service to the UE includes at least one of the following: denying the UE's registration to the serving network, recording an event where the hidden subscription identifier does not correspond to the permanent subscription identifier, notifying a law enforcement organization, and notifying the UE.

[0130] Example 19. The network device according to any one of Examples 16 to 18, wherein the hidden subscription identifier includes a SUCI calculated by the UE based on information provided by the HN.

[0131] Example 20. The network device according to any one of Examples 16 to 18, wherein the permanent subscription identifier includes a SUPI.

[0132] Example 21. The network device according to any one of Examples 16 to 20, wherein the SUPI includes an international mobile subscription identifier IMSI or a network-specific identifier.

[0133] Example 22. The network device according to any one of Examples 16 to 21, wherein the hidden subscription identifier hides the permanent subscription identifier.

[0134] Example 23. The network device according to any one of Examples 16 to 22, wherein obtaining the hidden subscription identifier includes obtaining a mobile country code MCC with a first MCC value and a mobile network code MNC with a first MNC value,

[0135] wherein obtaining the permanent subscription identifier includes obtaining an MCC with a second MCC value and an MNC with a second MNC value, and

[0136] wherein determining that the hidden subscription identifier corresponds to the permanent subscription identifier includes determining that the first MCC value is equal to the second MCC value and the first MNC value is equal to the second MNC value.

[0137] Example 24. The network device according to Example 23, wherein performing subscription binding includes performing subscription binding using the second MCC value and the second MNC value.

[0138] Example 25. The network device according to Example 23, wherein performing subscription binding includes performing subscription binding using the second MCC value and the second MNC value.

[0139] Example 26. The network device according to any one of Examples 24 to 25, further includes determining whether the SUPI type is received from the UE and the HN.

[0140] Embodiment 27. The network device according to Embodiment 26, wherein the hidden subscription identifier includes a first type, and the permanent subscription identifier includes a second type different from the first type.

[0141] Embodiment 28. The network device according to Embodiment 27, wherein determining that the hidden subscription identifier corresponds to the permanent subscription identifier includes: determining that a first MCC value of the first type is equal to a second MCC value of the second type, and determining that a first MNC value of the first type is equal to a second MNC value of the second type.

[0142] Embodiment 29. The network device according to any one of Embodiments 16 to 28, further comprising sending the hidden subscription identifier received from the UE to the HN.

[0143] Embodiment 30. A method of operating a mobile terminal to provide compliant privacy in a communication network, the method comprising:

[0144] Sending a hidden subscription identifier to a serving network, the hidden subscription identifier including at least a first home network identifier; and

[0145] Using a SUPI having at least the first home network identifier in a binding.

[0146] Embodiment 31. The method according to Embodiment 30, wherein the hidden subscription identifier includes a first MCC value and a first MNC value.

[0147] Embodiment 32. The method according to Embodiment 30, wherein the hidden subscription identifier hides the permanent subscription identifier.

[0148] Embodiment 33. The method according to Embodiment 32, wherein the hidden subscription identifier includes an IMSI type.

[0149] Embodiment 34. The method according to Embodiment 32, wherein the hidden subscription identifier includes a network access identifier NAI.

[0150] Embodiment 35. The method according to Embodiment 32, wherein the mobile terminal uses the permanent subscription identifier hidden in the hidden subscription identifier to perform SUPI binding.

[0151] Embodiment 36. A mobile terminal, comprising:

[0152] At least one processor;

[0153] At least one memory, coupled to the at least one processor and storing program code, the program code being executed by the at least one processor to perform operations including the following:

[0154] Send a hidden subscription identifier to a service network, the hidden subscription identifier including at least a first home network identifier; and

[0155] Use a SUPI having at least a first home network identifier in a binding.

[0156] Example 37. The mobile terminal according to Example 36, wherein the hidden subscription identifier includes a first MCC value and a first MNC value.

[0157] Example 38. The mobile terminal according to Example 36, wherein the hidden subscription identifier hides a permanent subscription identifier.

[0158] Example 39. The mobile terminal according to Example 38, wherein the hidden subscription identifier includes an IMSI type.

[0159] Example 40. The mobile terminal according to Example 38, wherein the hidden subscription identifier includes a network access identifier NAI.

[0160] Example 41. The mobile terminal according to Example 38, wherein the mobile terminal uses the permanent subscription identifier hidden in the hidden subscription identifier to perform SUPI binding.

[0161] Example 42. A computer program product, comprising;

[0162] A non-transitory computer-readable medium storing program code, the program code being configured to be executed by a processor of a network device to cause the processor to perform the operations for providing compliant privacy in a communication network according to Examples 30 to 35.

[0163] Example 43. A computer program for providing compliant privacy in a communication network, the computer program performing the operations according to Examples 30 to 35 when executed.

[0164] Further definitions and examples are discussed below:

[0165] In the above description of various embodiments of the inventive concept, it is to be understood that the terms used herein are for the purpose of describing specific embodiments only and are not intended to limit the inventive concept. Unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which the inventive concept pertains. It should also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of this specification and the relevant art, and will not be interpreted in an idealized or overly formal sense unless explicitly so defined herein.

[0166] When an element is referred to as being “connected,” “coupled,” “responsive” or variations thereof to another element, it can be directly connected, coupled to or responsive to the other element, or intervening elements may be present. In contrast, when an element is referred to as being “directly connected,” “directly coupled,” “directly responsive” or variations thereof to another element, no intervening elements are present. Throughout the specification, like reference numerals represent like elements. Further, as used herein, “coupled,” “connected,” “responsive” or variations thereof may include wireless coupling, connection or response. As used herein, the singular forms “a,” “an” and “the” are intended to include the plural forms as well, unless the context clearly dictates otherwise. For brevity and / or clarity, well-known functions or constructions may not be described in detail. The term “and / or” includes any and all combinations of one or more of the associated listed items.

[0167] It will be understood that although the terms first, second, third, etc. may be used herein to describe various elements / operations, these elements / operations should not be limited by these terms. These terms are only used to distinguish one element / operation from another. Thus, a first element / operation in some embodiments may be termed a second element / operation in other embodiments without departing from the teachings of the inventive concept. Throughout the specification, the same reference numerals or the same reference signs denote the same or similar elements.

[0168] As used herein, the terms “comprising,” “including,” “having” or variations thereof are open-ended and include one or more of the recited features, integers, elements, steps, components, or functions, but do not preclude the presence or addition of one or more other features, integers, elements, steps, components, functions or combinations thereof. Further, as used herein, the common abbreviation “e.g.” from the Latin phrase “exempli gratia” may be used to introduce or specify one or more general examples of a previously mentioned item, and is not intended to be limiting of that item. The common abbreviation “i.e.” from the Latin phrase “id est” may be used to specify a more specific item of a more general recitation.

[0169] This document describes example embodiments with reference to block diagrams and / or flowchart illustrations of computer-implemented methods, apparatuses (systems and / or devices), and / or computer program products. It should be understood that the blocks of the block diagrams and / or flowchart illustrations, and combinations of the blocks in the block diagrams and / or flowchart illustrations, can be implemented by computer program instructions executed by one or more computer circuits. These computer program instructions can be provided to a processor circuit of a general-purpose computer circuit, a special-purpose computer circuit, and / or other programmable data processing circuits to produce a machine, such that the instructions executed by the processor of the computer and / or other programmable data processing devices transform and control transistors, values stored in memory locations, and other hardware components within such circuits to implement the functions / actions specified in the block diagrams and / or flowchart blocks, and thereby create means (functional bodies) and / or structures for implementing the functions / actions specified in the block diagrams and / or flowchart blocks.

[0170] These computer program instructions can also be stored in a tangible computer-readable medium, which can direct a computer or other programmable data processing device to act in a specific manner, such that the instructions stored in the computer-readable medium produce an article of manufacture that includes instructions for implementing the functions / actions specified in the blocks of the block diagrams and / or flowchart. Thus, embodiments of the inventive concept can be implemented in hardware and / or in software (including firmware, resident software, microcode, etc.) running on a processor such as a digital signal processor, which can be collectively referred to as "circuits", "modules", or their variants.

[0171] It should also be noted that in some alternative implementations, the functions / actions marked in the blocks may not occur in the order marked in the flowchart. For example, depending on the functions / actions involved, two consecutive blocks shown may actually be executed substantially simultaneously, or the blocks may sometimes be executed in the reverse order. In addition, the functions of a given block of the flowchart and / or block diagram can be divided into multiple blocks, and the functions of two or more blocks of the flowchart and / or block diagram can be at least partially integrated. Finally, other blocks can be added / inserted between the shown blocks, and / or blocks / operations can be omitted without departing from the scope of the inventive concept. In addition, although some figures include arrows on communication paths to indicate the main direction of communication, it should be understood that communication can occur in the direction opposite to the depicted arrows.

[0172] Many changes and modifications can be made to the embodiments without materially departing from the principles of the inventive concept. All such changes and modifications are intended to be included within the scope of the inventive concept herein. Accordingly, the subject matter disclosed above should be understood as illustrative and not restrictive, and examples of embodiments are intended to cover all such modifications, enhancements, and other embodiments falling within the spirit and scope of the inventive concept. Accordingly, to the fullest extent permitted by law, the scope of the inventive concept shall be determined by the broadest permissible interpretation of this disclosure, including the examples of embodiments and their equivalents, and shall not be limited to or restricted by the previous detailed description.

[0173] Additional explanations are provided below.

[0174] In general, all terms used herein will be interpreted according to their ordinary meaning in the relevant technical field, unless a different meaning is explicitly given and / or implied from the context in which the terms are used. All references to an / one / the element, apparatus, component, device, step, etc. shall be construed openly as referring to at least one instance of the element, apparatus, component, device, step, etc., unless otherwise explicitly stated. The steps of any method disclosed herein need not be performed in the exact order disclosed, unless a step must be explicitly described as after or before another step and / or implicitly a step must be after or before another step. Any feature of any embodiment disclosed herein may be applied to any other embodiment, where appropriate. Similarly, any advantage of any embodiment may apply to any other embodiment, and vice versa. Other objects, features, and advantages of the appended embodiments will be apparent from the following description.

[0175] Some embodiments contemplated herein will now be described more fully with reference to the accompanying drawings. However, other embodiments are included within the scope of the subject matter disclosed herein, and the disclosed subject matter should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided by way of example to convey the scope of the subject matter to those skilled in the art.

[0176] Figure 10 : A wireless network according to some embodiments.

[0177] Although the subject matter described herein may be implemented using any suitable components in any suitable type of system, the embodiments disclosed herein are described with respect to a wireless network (e.g., Figure 10 the example wireless network shown in Figure 10The wireless network only depicts network QQ106, network nodes QQ160 and QQ160b, and WD QQ110, QQ110b, and QQ110c (also referred to as mobile terminals). In fact, the wireless network may also include any additional elements suitable for supporting communication between wireless devices or between a wireless device and another communication device (e.g., a landline phone, a service provider, or any other network node or terminal device). Among the components shown, network node QQ160 and wireless device (WD) QQ110 are depicted in additional detail. The wireless network may provide communication and other types of services to one or more wireless devices to facilitate the access and / or use of services provided by or via the wireless network.

[0178] The wireless network may include any type of communication, telecommunication, data, cellular, and / or radio network or other similar type of system, and / or interface with any type of communication, telecommunication, data, cellular, and / or radio network or other similar type of system. In some embodiments, the wireless network may be configured to operate according to a specific standard or other type of predefined rules or procedures. Thus, a particular embodiment of a wireless communication network may implement communication standards such as Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), Long Term Evolution (LTE), and / or other suitable 2G, 3G, 4G, or 5G standards; wireless local area network (WLAN) standards such as the IEEE802.11 standard; and / or any other suitable wireless communication standards such as Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, and / or ZigBee standards.

[0179] Network QQ106 may include one or more backhaul networks, core networks, IP networks, Public Switched Telephone Network (PSTN), packet data networks, optical networks, wide area networks (WAN), local area networks (LAN), wireless local area networks (WLAN), wired networks, wireless networks, metropolitan area networks, and other networks to enable communication between devices.

[0180] Network nodes QQ160 and WD QQ110 include various components described in more detail below. These components work together to provide network node and / or wireless device functionality, such as providing a wireless connection in a wireless network. In different embodiments, the wireless network may include any number of wired or wireless networks, network nodes, base stations, controllers, wireless devices, relay stations, and / or any other components or systems that can facilitate or participate in the communication of data and / or signals, whether via a wired connection or a wireless connection.

[0181] As used herein, a network node refers to a device that is capable of, configured to, arranged to, and / or operable to communicate directly or indirectly with a wireless device and / or with other network nodes or devices in a wireless network to enable and / or provide wireless access to the wireless device and / or to perform other functions in the wireless network (e.g., management). Examples of network nodes include, but are not limited to, access points (APs) (e.g., radio access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs), and NR Node Bs (gNBs)). Base stations can be classified based on the amount of coverage they provide (or in other words, based on their transmit power levels), and thus they can also be referred to as femto base stations, pico base stations, micro base stations, or macro base stations. A base station can be a relay node or a relay host node controlling a relay. A network node can also include one or more (or all) parts of a distributed radio base station, such as a centralized digital unit and / or a remote radio unit (RRU) (sometimes referred to as a remote radio head (RRH)). Such a remote radio unit may or may not be integrated with an antenna as an antenna integrated radio. Parts of a distributed radio base station can also be referred to as nodes in a distributed antenna system (DAS). Further examples of network nodes include multi-standard radio (MSR) devices (such as MSR BSs), network controllers (such as radio network controllers (RNCs) or base station controllers (BSCs)), base transceiver stations (BTSs), transmission points, transmission nodes, multi-cell / multicast coordination entities (MCEs), core network nodes (e.g., MSCs, MMEs), O&M nodes, OSS nodes, SON nodes, positioning nodes (e.g., E-SMLC), and / or MDTs. As another example, a network node can be a virtual network node, as described in more detail below. However, more generally, a network node can represent any suitable device (or group of devices) that is capable of, configured to, arranged to, and / or operable to enable and / or provide access to a wireless network to a wireless device, or to provide some service to a wireless device that is already connected to the wireless network.

[0182] In Figure 10 which, network node QQ160 includes processing circuitry QQ170, a device-readable medium QQ180, an interface QQ190, an auxiliary device QQ184, a power source QQ186, a power circuit QQ187, and an antenna QQ162. Although Figure 10The network node QQ160 shown in the example wireless network can represent a device including a combination of the shown hardware components, but other embodiments may include network nodes with different combinations of components. It should be understood that a network node includes any suitable combination of hardware and / or software required to perform the tasks, features, functions, and methods disclosed herein. Additionally, although the components of network node QQ160 are depicted as a single box located within a larger box or nested within multiple boxes, in reality, a network node may include multiple different physical components that make up a single illustrated component (e.g., the device-readable medium QQ180 may include multiple individual hard disk drives as well as multiple RAM modules).

[0183] Similarly, network node QQ160 may be composed of multiple physically separated components (e.g., NodeB components and RNC components, or BTS components and BSC components, etc.), and each of these components may have its respective corresponding components. In certain scenarios where network node QQ160 includes multiple separated components (e.g., BTS and BSC components), one or more of these separated components may be shared among several network nodes. For example, a single RNC may control multiple NodeBs. In such a scenario, each unique NodeB and RNC pair may be considered a single separate network node in some instances. In some embodiments, network node QQ160 may be configured to support multiple radio access technologies (RATs). In such embodiments, some components may be replicated (e.g., separate device-readable media QQ180 for different RATs), and some components may be reused (e.g., the same antenna QQ162 may be shared by the RATs). Network node QQ160 may also include multiple sets of various illustrated components for different wireless technologies (e.g., GSM, WCDMA, LTE, NR, WiFi, or Bluetooth wireless technologies) to be integrated into network node QQ160. These wireless technologies may be integrated into the same or different chips or chip sets and other components within network node QQ160.

[0184] The processing circuit QQ170 is configured to perform any determination, calculation, or similar operation (e.g., certain obtaining operations) described herein as being provided by the network node. These operations performed by the processing circuit QQ170 may include processing the information obtained by the processing circuit QQ170 by, for example, converting the obtained information into other information, comparing the obtained information or the converted information with the information stored in the network node, and / or performing one or more operations based on the obtained information or the converted information and making a determination based on the result of the processing.

[0185] Processing circuitry QQ170 may include one or more combinations of the following: a microprocessor, a controller, a microcontroller, a central processing unit, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software, and / or coded logic that is operable to provide network node QQ160 functionality, either alone or in combination with other network node QQ160 components (e.g., device readable medium QQ180). For example, processing circuitry QQ170 may execute instructions stored in device readable medium QQ180 or in a memory within processing circuitry QQ170. Such functionality may include providing any of the various wireless features, functions, or benefits discussed herein. In some embodiments, processing circuitry QQ170 may include a system on a chip (SOC).

[0186] In some embodiments, processing circuitry QQ170 may include one or more of radio frequency (RF) transceiver circuitry QQ172 and baseband processing circuitry QQ174. In some embodiments, radio frequency (RF) transceiver circuitry QQ172 and baseband processing circuitry QQ174 may be located on separate chips (or chip sets), boards, or units (e.g., a radio unit and a digital unit). In alternative embodiments, some or all of RF transceiver circuitry QQ172 and baseband processing circuitry QQ174 may be on the same chip or chip set, board, or unit.

[0187] In certain embodiments, some or all of the functions described herein as being provided by a network node, base station, eNB, or other such network device may be performed by processing circuitry QQ170 executing instructions stored on device readable medium QQ180 or in a memory within processing circuitry QQ170. In alternative embodiments, some or all of the functions may be provided, for example, in a hardwired manner by processing circuitry QQ170 without the execution of instructions stored on a separate or discrete device readable medium. In any of these embodiments, whether or not instructions stored on a device readable storage medium are executed, processing circuitry QQ170 may be configured to perform the described functions. The benefits provided by such functionality are not limited to processing circuitry QQ170 or to other components of network node QQ160, but are enjoyed by network node QQ160 as a whole and / or generally by end users and the wireless network.

[0188] The device-readable medium QQ180 can include any form of volatile or non-volatile computer-readable memory, including but not limited to permanent storage devices, solid-state memories, remotely installed memories, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), mass storage media (e.g., hard disks), removable storage media (e.g., flash drives, compact discs (CDs) or digital video discs (DVDs)), and / or any other volatile or non-volatile, non-transitory device-readable and / or computer-executable memory device that stores information, data, and / or instructions that can be used by the processing circuitry QQ170. The device-readable medium QQ180 can store any suitable instructions, data, or information, including computer programs, software, applications including one or more of logic, rules, code, tables, etc., and / or other instructions that can be executed by the processing circuitry QQ170 and used by the network node QQ160. The device-readable medium QQ180 can be used to store any calculations made by the processing circuitry QQ170 and / or any data received via the interface QQ190. In some embodiments, the processing circuitry QQ170 and the device-readable medium QQ180 can be considered integrated.

[0189] The interface QQ190 is used for wired or wireless communication of signaling and / or data between the network node QQ160, the network QQ106, and / or the WD QQ110. As shown, the interface QQ190 includes ports / terminals QQ194 for sending data to and receiving data from the network QQ106, for example, via a wired connection. The interface QQ190 also includes a radio front-end circuit QQ192, which can be coupled to the antenna QQ162 or, in certain embodiments, is part of the antenna QQ162. The radio front-end circuit QQ192 includes a filter QQ198 and an amplifier QQ196. The radio front-end circuit QQ192 can be connected to the antenna QQ162 and the processing circuitry QQ170. The radio front-end circuit can be configured to condition the signals for communication between the antenna QQ162 and the processing circuitry QQ170. The radio front-end circuit QQ192 can receive digital data that will be sent out via a wireless connection to other network nodes or WDs. The radio front-end circuit QQ192 can use a combination of the filter QQ198 and / or the amplifier QQ196 to convert the digital data into a radio signal having suitable channel and bandwidth parameters. The radio signal can then be sent via the antenna QQ162. Similarly, when data is obtained, the antenna QQ162 can collect the radio signal, which is then converted into digital data by the radio front-end circuit QQ192. The digital data can be passed to the processing circuitry QQ170. In other embodiments, the interface can include different components and / or different combinations of components.

[0190] In certain alternative embodiments, the network node QQ160 may not include a separate radio front-end circuit QQ192. Instead, the processing circuit QQ170 may include the radio front-end circuit and may be connected to the antenna QQ162 without a separate radio front-end circuit QQ192. Similarly, in some embodiments, all or some of the RF transceiver circuit QQ172 may be considered part of the interface QQ190. In other embodiments, the interface QQ190 may include one or more ports or terminals QQ194, a radio front-end circuit QQ192, and the RF transceiver circuit QQ172 (as part of a radio unit (not shown)), and the interface QQ190 may communicate with the baseband processing circuit QQ174 (which is part of a digital unit (not shown)).

[0191] The antenna QQ162 may include one or more antennas or antenna arrays configured to transmit and / or receive wireless signals. The antenna QQ162 may be coupled to the radio front-end circuit QQ190 and may be any type of antenna capable of wirelessly transmitting and obtaining data and / or signals. In some embodiments, the antenna QQ162 may include one or more omnidirectional, sector, or panel antennas operable to transmit / receive radio signals in, for example, a range between 2 GHz and 66 GHz. Omnidirectional antennas may be used to transmit / receive radio signals in any direction, sector antennas may be used to transmit / receive radio signals to / from devices within a particular area, and panel antennas may be line-of-sight antennas used to transmit / receive radio signals in a relatively straight line manner. In some cases, using more than one antenna may be referred to as MIMO. In certain embodiments, the antenna QQ162 may be separate from the network node QQ160 and may be connected to the network node QQ160 via an interface or port.

[0192] The antenna QQ162, the interface QQ190, and / or the processing circuit QQ170 may be configured to perform any obtaining operations and / or certain obtaining operations described herein as being performed by the network node. Any information, data, and / or signals may be received from a wireless device, another network node, and / or any other network device. Similarly, the antenna QQ162, the interface QQ190, and / or the processing circuit QQ170 may be configured to perform any sending operations described herein as being performed by the network node. Any information, data, and / or signals may be sent to a wireless device, another network node, and / or any other network device.

[0193] The power supply circuit QQ187 may include or be coupled to a power management circuit and is configured to supply power to components of the network node QQ160 to perform the functions described herein. The power supply circuit QQ187 may receive power from a power supply QQ186. The power supply QQ186 and / or the power supply circuit QQ187 may be configured to supply power to various components of the network node QQ160 in a form suitable for the respective components (e.g., at the voltage and current levels required by each respective component). The power supply QQ186 may be included in and / or external to the power supply circuit QQ187 and / or the network node QQ160. For example, the network node QQ160 may be connected to an external power supply (e.g., a power outlet) via an input circuit or an interface such as a cable, and the external power supply supplies power to the power supply circuit QQ187. As another example, the power supply QQ186 may include a power supply in the form of a battery or a battery pack, which is connected to or integrated in the power supply circuit QQ187. The battery may provide backup power in the event of a failure of the external power supply. Other types of power supplies, such as photovoltaic devices, may also be used.

[0194] Alternative embodiments of the network node QQ160 may include additional components beyond Figure 10 the components shown in, and the additional components may be responsible for providing certain aspects of the functions of the network node (including any of the functions described herein and / or any functions required to support the subject matter described herein). For example, the network node QQ160 may include a user interface device to allow information to be input into the network node QQ160 and to allow information to be output from the network node QQ160. This may allow a user to perform diagnostic, maintenance, repair, and other management functions on the network node QQ160.

[0195] As used herein, a wireless device (WD) refers to a device that is capable of, configured to, arranged to, and / or operable to communicate wirelessly with a network node and / or another wireless device. Unless otherwise specified, the term WD may be used interchangeably herein with user equipment (UE) and other types of mobile terminals. Wireless transmission may include sending and / or receiving wireless signals using electromagnetic waves, radio waves, infrared waves, and / or other types of signals suitable for transmitting information through the air. In some embodiments, a WD may be configured to send and / or receive information without direct human interaction. For example, a WD may be designed to send information to the network at a predetermined schedule when triggered by an internal or external event, or in response to a request from the network. Examples of WDs include, but are not limited to, smart phones, mobile phones, cellular phones, Voice over Internet Protocol (VoIP) phones, wireless local loop phones, desktop computers, personal digital assistants (PDAs), wireless cameras, gaming consoles or devices, music storage devices, playback devices, wearable terminal devices, wireless endpoints, mobile stations, tablet computers, portable computers, low-end embedded devices (LEEs), low-end mobile devices (LMEs), smart devices, wireless customer premise equipment (CPEs), in-vehicle wireless terminal devices, etc. A WD may support device-to-device (D2D) communication, vehicle-to-vehicle (V2V) communication, vehicle-to-infrastructure (V2I) communication, vehicle-to-everything (V2X) communication, for example, by implementing 3GPP standards for sidelink communication, and in this case may be referred to as a D2D communication device. As yet another specific example, in an Internet of Things (IoT) scenario, a WD may represent a machine or other device that performs monitoring and / or measurement and sends the results of such monitoring and / or measurement to another WD and / or network node. In this case, the WD may be a machine-to-machine (M2M) device, which may be referred to as an MTC device in the 3GPP context. As a specific example, a WD may be a UE or other terminal that implements the 3GPP NarrowBand Internet of Things (NB-IoT) standard. Specific examples of such machines or devices are sensors, metering devices (e.g., electricity meters), industrial machines, or household or personal devices (e.g., refrigerators, TVs, etc.), personal wearable devices (e.g., watches, fitness trackers, etc.). In other scenarios, a WD may represent a vehicle or other device that is capable of monitoring and / or reporting its operating state or other functions associated with its operation. A WD as described above may represent a wirelessly connected endpoint, in which case the device may be referred to as a wireless terminal. Additionally, a WD as described above may be mobile, in which case it may also be referred to as a mobile device or mobile terminal.

[0196] As shown in the figure, the wireless device QQ110 includes an antenna QQ111, an interface QQ114, a processing circuit QQ120, a device-readable medium QQ130, a user interface device QQ132, an auxiliary device QQ134, a power supply QQ136, and a power circuit QQ137. The WD QQ110 may include multiple sets of one or more of the illustrated components for different wireless technologies supported by the WD QQ110 (e.g., GSM, WCDMA, LTE, NR, WiFi, WiMAX, or Bluetooth wireless technologies, to name a few). These wireless technologies may be integrated into the same or different chips or chip sets as other components within the WD QQ110.

[0197] The antenna QQ111 may include one or more antennas or antenna arrays configured to transmit and / or receive wireless signals and is connected to the interface QQ114. In certain alternative embodiments, the antenna QQ111 may be separate from the WD QQ110 and may be connected to the WD QQ110 through an interface or port. The antenna QQ111, the interface QQ114, and / or the processing circuit QQ120 may be configured to perform any acquisition or transmission operations described herein as being performed by the WD. Any information, data, and / or signals may be received from network nodes and / or another WD. In some embodiments, the radio front-end circuit and / or the antenna QQ111 may be considered an interface.

[0198] As shown in the figure, interface QQ114 includes radio front-end circuit QQ112 and antenna QQ111. The radio front-end circuit QQ112 includes one or more filters QQ118 and amplifiers QQ116. The radio front-end circuit QQ114 is connected to antenna QQ111 and processing circuit QQ120, and is configured to condition signals transmitted between antenna QQ111 and processing circuit QQ120. The radio front-end circuit QQ112 may be coupled to antenna QQ111 or be a part of antenna QQ111. In some embodiments, WD QQ110 may not include a separate radio front-end circuit QQ112; rather, the processing circuit QQ120 may include a radio front-end circuit and may be connected to antenna QQ111. Similarly, in some embodiments, some or all of the RF transceiver circuit QQ122 may be considered a part of interface QQ114. The radio front-end circuit QQ112 may receive digital data that will be transmitted outward via a wireless connection to other network nodes or WDs. The radio front-end circuit QQ112 may use a combination of filters QQ118 and / or amplifiers QQ116 to convert the digital data into a radio signal having suitable channel and bandwidth parameters. The radio signal may then be transmitted via antenna QQ112. Similarly, when data is obtained, antenna QQ111 may collect the radio signal, which may then be converted into digital data by the radio front-end circuit QQ112. The digital data may be passed to the processing circuit QQ120. In other embodiments, the interface may include different components and / or different combinations of components.

[0199] The processing circuit QQ120 may include a combination of one or more of the following: a microprocessor, a controller, a microcontroller, a central processing unit, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software, and / or coded logic, which may be operable to provide WD QQ110 functionality either alone or in combination with other WD QQ110 components (e.g., device-readable medium QQ130). Such functionality may include providing any one of the various wireless features or benefits discussed herein. For example, the processing circuit QQ120 may execute instructions stored in the device-readable medium QQ130 or in a memory within the processing circuit QQ120 to provide the functionality disclosed herein.

[0200] As shown in the figure, the processing circuit QQ120 includes one or more of an RF transceiver circuit QQ122, a baseband processing circuit QQ124, and an application processing circuit QQ126. In other embodiments, the processing circuit may include different components and / or different combinations of components. In certain embodiments, the processing circuit QQ120 of the WD QQ110 may include a SOC. In some embodiments, the RF transceiver circuit QQ122, the baseband processing circuit QQ124, and the application processing circuit QQ126 may be on separate chips or chip sets. In an alternative embodiment, part or all of the baseband processing circuit QQ124 and the application processing circuit QQ126 may be combined into one chip or chip set, and the RF transceiver circuit QQ122 may be on a separate chip or chip set. In another alternative embodiment, part or all of the RF transceiver circuit QQ122 and the baseband processing circuit QQ124 may be on the same chip or chip set, and the application processing circuit QQ126 may be on a separate chip or chip set. In other alternative embodiments, part or all of the RF transceiver circuit QQ122, the baseband processing circuit QQ124, and the application processing circuit QQ126 may be combined in the same chip or chip set. In some embodiments, the RF transceiver circuit QQ122 may be part of the interface QQ114. The RF transceiver circuit QQ122 may condition RF signals for the processing circuit QQ120.

[0201] In certain embodiments, some or all of the functions described herein as being performed by the WD may be provided by the processing circuit QQ120, which executes instructions stored on a device-readable medium QQ130. In certain embodiments, the device-readable medium QQ130 may be a computer-readable storage medium. In an alternative embodiment, some or all of the functions may be provided by the processing circuit QQ120, for example, in a hardwired manner, without executing instructions stored on a separate or discrete device-readable storage medium. In any of these particular embodiments, whether or not instructions stored on a device-readable storage medium are executed, the processing circuit QQ120 may be configured to perform the described functions. The benefits provided by such functions are not limited to the processing circuit QQ120 or to other components of the WD QQ110, but are enjoyed by the WD QQ110 as a whole and / or generally by the end user and the wireless network.

[0202] Processing circuit QQ120 may be configured to perform any determination, calculation, or similar operation described herein as being performed by the WD (e.g., certain acquisition operations). These operations performed by processing circuit QQ120 may include processing information obtained by processing circuit QQ120 by, for example, converting the obtained information into other information, comparing the obtained information or the converted information with information stored by WD QQ110, and / or performing one or more operations based on the obtained information or the converted information and making a determination based on the result of the processing.

[0203] The device-readable medium QQ130 is operable to store a computer program, software, an application including one or more of logic, rules, code, tables, etc., and / or other instructions executable by the processing circuitry QQ120. The device-readable medium QQ130 can include a computer memory (e.g., random access memory (RAM) or read-only memory (ROM)), a mass storage medium (e.g., a hard disk), a removable storage medium (e.g., a compact disc (CD) or a digital video disc (DVD)), and / or any other volatile or non-volatile, non-transitory device-readable and / or computer-executable memory device that stores information, data, and / or instructions usable by the processing circuitry QQ120. In some embodiments, the processing circuitry QQ120 and the device-readable medium QQ130 can be considered integrated. The user interface device QQ132 can provide components that allow a human user to interact with the WD QQ110. Such interaction can take many forms, such as visual, auditory, tactile, etc. The user interface device QQ132 is operable to generate output to the user and allow the user to provide input to the WD QQ110. The type of interaction can vary depending on the type of user interface device QQ132 installed in the WD QQ110. For example, if the WD QQ110 is a smart phone, the interaction can be via a touch screen; if the WD QQ110 is a smart meter, the interaction can be through a screen providing usage (e.g., gallons used) or a speaker providing an audible alarm (e.g., if smoke is detected). The user interface device QQ132 can include input interfaces, devices, and circuitry, as well as output interfaces, devices, and circuitry. The user interface device QQ132 is configured to allow information to be input into the WD QQ110 and is connected to the processing circuitry QQ120 to allow the processing circuitry QQ120 to process the input information. The user interface device QQ132 can include, for example, a microphone, a proximity or other sensor, keys / buttons, a touch display, one or more cameras, a USB port, or other input circuitry. The user interface device QQ132 is also configured to allow information to be output from the WD QQ110 and allow the processing circuitry QQ120 to output information from the WD QQ110. The user interface device QQ132 can include, for example, a speaker, a display, a vibration circuit, a USB port, a headphone jack, or other output circuitry. By using one or more of the input and output interfaces, devices, and circuitry of the user interface device QQ132, the WD QQ110 can communicate with an end user and / or a wireless network and allow them to benefit from the functionality described herein.

[0204] The auxiliary device QQ134 is operable to provide more specific functions that may not typically be performed by the WD. This can include dedicated sensors for making measurements for various purposes, interfaces for other types of communication such as wired communication, etc. The inclusion and type of components of the auxiliary device QQ134 can vary according to embodiments and / or scenarios.

[0205] In some embodiments, the power source QQ136 can be in the form of a battery or a battery pack. Other types of power sources can also be used, such as an external power source (e.g., a power outlet), a photovoltaic device, or a fuel cell. The WD QQ110 can also include a power circuit QQ137 for delivering power from the power source QQ136 to various parts of the WD QQ110, where the various parts of the WD QQ110 require power from the power source QQ136 to perform any of the functions described or indicated herein. In certain embodiments, the power circuit QQ137 can include a power management circuit. The power circuit QQ137 can additionally or alternatively be operable to receive power from an external power source; in such a case, the WD QQ110 can be connected to the external power source (e.g., a power outlet) through an input circuit or an interface such as a power cable. In certain embodiments, the power circuit QQ137 is also operable to deliver power from the external power source to the power source QQ136. For example, this can be used for charging the power source QQ136. The power circuit QQ137 can perform any formatting, conversion, or other modification on the power from the power source QQ136 to make the power suitable for the various components of the WD QQ110 being powered.

[0206] Figure 11 : User Equipment According to Some Embodiments

[0207] Figure 11 An embodiment of a UE in accordance with various aspects described herein is shown. As used herein, a "user equipment" or "UE" may not necessarily have a "user" in the sense of a human user who owns and / or operates the associated device. Instead, a UE can represent a device that is intended to be sold to or operated by a human user but may not or initially may not be associated with a particular human user (e.g., a smart sprinkler controller). Alternatively, a UE can represent a device that is not intended to be sold to or operated by an end user but can be associated with or operate in the interest of a user (e.g., a smart meter). The UE QQ2200 can be any UE identified by the 3rd Generation Partnership Project (3GPP), including an NB-IoT UE, a machine type communication (MTC) UE, and / or an enhanced MTC (eMTC) UE. As Figure 11As shown, UE QQ200 is an example of a WD configured for communication in accordance with one or more communication standards (such as GSM, UMTS, LTE, and / or 5G standards of 3GPP) released by the Third Generation Partnership Project (3GPP). As previously mentioned, the terms WD and UE can be used interchangeably. Thus, although Figure 11 is a UE, the components discussed herein apply equally to WDs and vice versa.

[0208] In Figure 11 , UE QQ200 includes processing circuitry QQ201 operatively coupled to an input / output interface QQ205, a radio frequency (RF) interface QQ209, a network connection interface QQ211, a memory QQ215 including a random access memory (RAM) QQ217, a read-only memory (ROM) QQ219, and a storage medium QQ221, etc., a communication subsystem QQ231, a power supply QQ233, and / or any other components, or any combination thereof. The storage medium QQ221 includes an operating system QQ223, application programs QQ225, and data QQ227. In other embodiments, the storage medium QQ221 may include other similar types of information. Some UEs may use Figure 11 all of the components shown, or only a subset of these components. The level of integration between components may vary from one UE to another. Additionally, some UEs may include multiple instances of components, such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0209] In Figure 11 , the processing circuitry QQ201 may be configured to process computer instructions and data. The processing circuitry QQ201 may be configured to implement any sequential state machine operable to execute machine instructions of a machine-readable computer program stored in the memory, such as: one or more hardware-implemented state machines (e.g., implemented in discrete logic, FPGA, ASIC, etc.); programmable logic along with appropriate firmware; one or more stored programs, a general-purpose processor (e.g., a microprocessor or a digital signal processor (DSP)) along with suitable software; or any combination of the above. For example, the processing circuitry QQ201 may include two central processing units (CPUs). Data may be information in a form suitable for use by a computer.

[0210] In the depicted embodiment, the input / output interface QQ205 can be configured to provide a communication interface to an input device, an output device, or an input and output device. The UE QQ200 can be configured to use an output device via the input / output interface QQ205. The output device can use the same type of interface port as the input device. For example, a USB port can be used to provide input to and output from the UE QQ200. The output device can be a speaker, a sound card, a video card, a display, a monitor, a printer, an actuator, a transmitter, a smart card, another output device, or any combination thereof. The UE QQ200 can be configured to use an input device via the input / output interface QQ205 to allow a user to capture information into the UE QQ200. The input device can include a touch-sensitive or presence-sensitive display, a camera (e.g., a digital camera, a digital video camera, a webcam, etc.), a microphone, a sensor, a mouse, a trackball, a directional pad, a touchpad, a scroll wheel, a smart card, etc. The presence-sensitive display can include a capacitive or resistive touch sensor to sense input from a user. The sensor can be, for example, an accelerometer, a gyroscope, an inclinometer, a force sensor, a magnetometer, an optical sensor, a proximity sensor, another similar sensor, or any combination thereof. For example, the input device can be an accelerometer, a magnetometer, a digital camera, a microphone, and an optical sensor.

[0211] In Figure 11 it, the RF interface QQ209 can be configured to provide a communication interface to RF components such as a transmitter, a receiver, and an antenna. The network connection interface QQ211 can be configured to provide a communication interface to the network QQ243a. The network QQ243a can include a wired and / or wireless network, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a telecommunications network, another similar network, or any combination thereof. For example, the network QQ243a can include a Wi-Fi network. The network connection interface QQ211 can be configured to include a receiver and a transmitter interface for communicating with one or more other devices over a communication network according to one or more communication protocols (e.g., Ethernet, TCP / IP, SONET, ATM, etc.). The network connection interface QQ211 can implement receiver and transmitter functions suitable for a communication network link (e.g., optical, electrical, etc.). The receiver and transmitter functions can share circuit components, software, or firmware, or alternatively can be implemented separately.

[0212] The RAM QQ217 can be configured to interface with the processing circuitry QQ201 via the bus QQ202 to provide storage or caching of data or computer instructions during the execution of software programs such as an operating system, application programs, and device drivers. The ROM QQ219 can be configured to provide computer instructions or data to the processing circuitry QQ201. For example, the ROM QQ219 can be configured to store invariant low-level system code or data for basic system functions stored in non-volatile memory, such as basic input and output (I / O), startup, or reception of keystrokes from a keyboard. The storage medium QQ221 can be configured to include memories such as RAM, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disks, optical disks, floppy disks, hard disks, removable cartridge tapes, or flash drives. In one example, the storage medium QQ221 can be configured to include an operating system QQ223, an application program QQ225 such as a web browser application, a widget or gadget engine, or another application, and data files QQ227. The storage medium QQ221 can store any one or combination of various operating systems for use by the UE QQ200.

[0213] The storage medium QQ221 can be configured to include a plurality of physical drive units such as redundant arrays of independent disks (RAID), floppy disk drives, flash memory, USB flash drives, external hard disk drives, thumb drives, pen drives, key drives, high definition digital versatile disc (HD-DVD) optical disc drives, internal hard disk drives, Blu-ray disc drives, holographic digital data storage (HDDS) optical disc drives, external mini dual in-line memory modules (DIMMs), synchronous dynamic random access memory (SDRAM), external micro DIMM SDRAM, smart card memories such as user identity modules or removable user identities (SIM / RUIM) modules, other memories, or any combination thereof. The storage medium QQ221 can allow the UE QQ200 to access computer-executable instructions, application programs, etc. stored on a transient or non-transient memory medium to offload or upload data. An article such as an article of manufacture utilizing a communication system can be tangibly embodied in the storage medium QQ221, and the storage medium QQ221 can include a device-readable medium.

[0214] In Figure 11Among them, the processing circuit QQ201 can be configured to communicate with the network QQ243b using the communication subsystem QQ231. The network QQ243a and the network QQ243b can be one or more identical networks or one or more different networks. The communication subsystem QQ231 can be configured to include one or more transceivers for communicating with the network QQ243b. For example, the communication subsystem QQ231 can be configured to include one or more transceivers for communicating with one or more remote transceivers of another device capable of wireless communication (such as another WD, UE) or a base station of a radio access network (RAN) according to one or more communication protocols (such as IEEE 802.QQ2, CDMA, WCDMA, GSM, LTE, UTRAN, WiMax, etc.). Each transceiver can include a transmitter QQ233 and / or a receiver QQ235 to respectively implement the transmitter or receiver functions suitable for the RAN link (such as frequency allocation, etc.). In addition, the transmitter QQ233 and the receiver QQ235 of each transceiver can share circuit components, software, or firmware, or alternatively can be implemented separately.

[0215] In the illustrated embodiment, the communication functions of the communication subsystem QQ231 can include data communication, voice communication, multimedia communication, short-range communication such as Bluetooth, near-field communication, location-based communication (such as the use of the Global Positioning System (GPS) for determining location), another similar communication function, or any combination thereof. For example, the communication subsystem QQ231 can include cellular communication, Wi-Fi communication, Bluetooth communication, and GPS communication. The network QQ243b can include wired and / or wireless networks, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a telecommunications network, another similar network, or any combination thereof. For example, the network QQ243b can be a cellular network, a Wi-Fi network, and / or a near-field network. The power supply QQ213 can be configured to provide alternating current (AC) or direct current (DC) power to the components of the UE QQ200.

[0216] The features, benefits, and / or functions described herein may be implemented in one of the components of UE QQ200 or divided among multiple components of UE QQ200. Additionally, the features, benefits, and / or functions described herein may be implemented in any combination of hardware, software, or firmware. In one example, communication subsystem QQ231 may be configured to include any of the components described herein. Additionally, processing circuitry QQ201 may be configured to communicate with any such component via bus QQ202. In another example, any such component may be represented by program instructions stored in a memory, which, when executed by processing circuitry QQ201, perform the corresponding functions described herein. In another example, the functions of any such component may be divided between processing circuitry QQ201 and communication subsystem QQ231. In another example, the non-computation-intensive functions of any such component may be implemented in software or firmware, and the computation-intensive functions may be implemented in hardware.

[0217] Figure 12 : Virtualization environment according to some embodiments

[0218] Figure 12 is a schematic block diagram showing virtualization environment QQ300, in which functions implemented by some embodiments may be virtualized. In this context, virtualization means creating a virtual version of a device or equipment, which may include virtualizing hardware platforms, storage devices, and network resources. As used herein, virtualization may be applied to nodes (e.g., virtualized base stations or virtualized radio access nodes) or devices (e.g., UEs, wireless devices, or any other type of communication device) or their components, and involves an implementation in which at least a portion of the functions are implemented as one or more virtual components (e.g., by one or more applications, components, functions, virtual machines, or containers executed on one or more physical processing nodes in one or more networks).

[0219] In some embodiments, some or all of the functions described herein may be implemented as virtual components executed by one or more virtual machines implemented in one or more virtual environments QQ300 hosted by one or more hardware nodes QQ330. Additionally, in embodiments where the virtual node is not a radio access node or does not require a radio connection (e.g., a core network node), the network node may be fully virtualized at this time.

[0220] These functions can be implemented by one or more Application QQ320, which may alternatively be referred to as software instances, virtual devices, network functions, virtual nodes, virtual network functions, etc. One or more Application QQ320 are operable to implement some of the features, functions, and / or benefits of some of the embodiments disclosed herein. Application QQ320 runs in a virtualization environment QQ300, which provides hardware QQ330 including processing circuitry QQ360 and memory QQ390. Memory QQ390 contains instructions QQ395 executable by processing circuitry QQ360, whereby Application QQ320 is operable to provide one or more of the features, benefits, and / or functions disclosed herein.

[0221] The virtualization environment QQ300 includes general-purpose or special-purpose network hardware devices QQ330, which include a set of one or more processors or processing circuitry QQ360, which may be commercial off-the-shelf (COTS) processors, application-specific integrated circuits (ASICs), or any other type of processing circuitry including digital or analog hardware components or dedicated processors. Each hardware device may include a memory QQ390-1, which may be non-permanent memory for temporarily storing instructions QQ395 or software executed by processing circuitry QQ360. Each hardware device may include one or more network interface controllers (NICs) QQ370, also known as network interface cards, which include physical network interfaces QQ380. Each hardware device may also include a non-transitory, permanent machine-readable storage medium QQ390-2 in which software QQ395 and / or instructions executable by processing circuitry QQ360 are stored. Software QQ395 may include any type of software, including software for instantiating one or more virtualization layers QQ350 (also known as hypervisors), software for executing virtual machines QQ340, and software that allows it to perform the functions, features, and / or benefits described in connection with some of the embodiments described herein.

[0222] The virtual machine QQ340 includes virtual processing, virtual memory, virtual networking or interfaces, and virtual storage, and may be run by a corresponding virtualization layer QQ350 or hypervisor. Different embodiments of instances of virtual devices QQ320 may be implemented on one or more of the virtual machines QQ340, and the implementation may be made in different ways.

[0223] During operation, the processing circuitry QQ360 executes software QQ395 to instantiate a hypervisor or virtualization layer QQ350, which may sometimes be referred to as a virtual machine monitor (VMM). The virtualization layer QQ350 may present a virtual operating platform that appears to the virtual machines QQ340 as networked hardware.

[0224] As Figure 12As shown, the hardware QQ330 can be an independent network node with general or specific components. The hardware QQ330 can include an antenna QQ3225 and can implement some functions through virtualization. Alternatively, the hardware QQ330 can be part of a larger hardware cluster (e.g., in a data center or customer premise equipment (CPE)), where many hardware nodes work together and are managed through Management and Orchestration (MANO) QQ3100, which supervises the lifecycle management of applications QQ320 and so on.

[0225] In some contexts, the virtualization of hardware is referred to as Network Function Virtualization (NFV). NFV can be used to unify many network device types onto industrial standard high-volume server hardware, physical switches, and physical storage that can be located in data centers and customer premise equipment.

[0226] In the context of NFV, a virtual machine QQ340 can be a software implementation of a physical machine that runs programs as if they were executed on a physical non-virtualized machine. Each virtual machine QQ340, along with the part of the hardware QQ330 that executes that virtual machine (which can be hardware dedicated to that virtual machine and / or hardware shared by that virtual machine with other virtual machines in virtual machine QQ340), forms a separate Virtual Network Element (VNE).

[0227] Still in the context of NFV, a Virtual Network Function (VNF) is responsible for handling specific network functions running in one or more virtual machines QQ340 over the hardware network infrastructure QQ330, and corresponds to Figure 12 the application QQ320 in

[0228] In some embodiments, one or more radio units QQ3200, each including one or more transmitters QQ3220 and one or more receivers QQ3210, can be coupled to one or more antennas QQ3225. The radio units QQ3200 can communicate directly with the hardware node QQ330 via one or more suitable network interfaces and can be used in combination with virtual components to provide a virtual node with radio capabilities, such as a radio access node or a base station.

[0229] In some embodiments, a control system QQ3230 can be used to implement some signaling and can alternatively be used for communication between the hardware node QQ330 and the radio units QQ3200.

[0230] Figure 13 : A telecommunication network connected to a host computer via an intermediate network according to some embodiments.

[0231] Referring to Figure 13, according to an embodiment, a communication system includes a telecommunication network QQ410 (e.g., a 3GPP - type cellular network), the telecommunication network QQ410 including an access network QQ411 (e.g., a radio access network) and a core network QQ414. The access network QQ411 includes a plurality of base stations QQ412a, QQ412b, QQ412c (e.g., NB, eNB, gNB, or other types of wireless access points), each base station defining a corresponding coverage area QQ413a, QQ413b, QQ413c. Each base station QQ412a, QQ412b, QQ412c can be connected to the core network QQ414 via a wired or wireless connection QQ415. A first UE QQ491 located in the coverage area QQ413c is configured to wirelessly connect to the corresponding base station QQ412c or be paged by the corresponding base station QQ412c. A second UE QQ492 in the coverage area QQ413a can be wirelessly connected to the corresponding base station QQ412a. Although multiple UEs QQ491, QQ492 are shown in this example, the disclosed embodiments equally apply to the case where a single UE is in the coverage area or a single UE is connected to the corresponding base station QQ412.

[0232] The telecommunication network QQ410 is itself connected to a host computer QQ430, and the host computer QQ430 can be implemented as hardware and / or software of an independent server, a cloud - implemented server, a distributed server, or as processing resources in a server cluster. The host computer QQ430 can be owned or controlled by a service provider, or can be operated by or on behalf of a service provider. The connections QQ421 and QQ422 between the telecommunication network QQ410 and the host computer QQ430 can extend directly from the core network QQ414 to the host computer QQ430, or can be via an optional intermediate network QQ420. The intermediate network QQ420 can be one or a combination of more than one of a public, private, or bearer network; the intermediate network QQ420 (if present) can be a backbone network or the Internet; specifically, the intermediate network QQ420 can include two or more sub - networks (not shown).

[0233] Figure 13The communication system as a whole enables a connection between the connected UEs QQ491, QQ492 and the host computer QQ430. This connection can be described as an over-the-top (OTT) connection QQ450. The host computer QQ430 and the connected UEs QQ491, QQ492 are configured to use the access network QQ411, the core network QQ414, any intermediate network QQ420, and possibly other infrastructure (not shown) as intermediaries to transmit data and / or signaling via the OTT connection QQ450. The OTT connection QQ450 can be transparent in the sense that the participating communication devices through which the OTT connection QQ450 passes are not aware of the significance of the routing of the uplink and downlink communications. For example, the base station QQ412 may not be notified or may not need to be notified of the past routing of an incoming downlink communication having data to be forwarded (e.g., handed over) from the host computer QQ430 to the connected UE QQ491. Similarly, the base station QQ412 does not need to be aware of the future routing of an outgoing uplink communication from the UE QQ491 to the host computer QQ430.

[0234] Figure 14 : A host computer communicating with a user equipment via a base station through a partial wireless connection according to some embodiments.

[0235] Reference will now be made to Figure 14 to describe an example implementation of the UE, base station, and host computer discussed in the preceding paragraphs according to an embodiment. In a communication system QQ500, the host computer QQ510 includes hardware QQ515, and the hardware QQ515 includes a communication interface QQ516 configured to establish and maintain a wired or wireless connection to an interface of different communication devices of the communication system QQ500. The host computer QQ510 also includes a processing circuit QQ518, which may have storage and / or processing capabilities. Specifically, the processing circuit QQ518 may include one or more programmable processors suitable for executing instructions, application-specific integrated circuits, field-programmable gate arrays, or a combination thereof (not shown). The host computer QQ510 also includes software QQ511, which is stored in or accessible by the host computer QQ510 and executable by the processing circuit QQ518. The software QQ511 includes a host application QQ512. The host application QQ512 is operable to provide services to a remote user (e.g., UE QQ530), and the UE QQ530 is connected via an OTT connection QQ550 terminated at the UE QQ530 and the host computer QQ510. When providing services to the remote user, the host application QQ512 may provide user data to be sent using the OTT connection QQ550.

[0236] The communication system QQ500 also includes a base station QQ520 provided in the telecommunications system. The base station QQ520 includes hardware QQ525 that enables it to communicate with the host computer QQ510 and with the UE QQ530. The hardware QQ525 may include: a communication interface QQ526 for establishing and maintaining a wired or wireless connection to the interfaces of different communication devices of the communication system QQ500; and a radio interface QQ527 for at least establishing and maintaining a wireless connection QQ570 to the UE QQ530 located in the coverage area ( Figure 14 not shown) served by the base station QQ520. The communication interface QQ526 may be configured to facilitate a connection QQ560 to the host computer QQ510. The connection QQ560 may be direct, or it may go through the core network of the telecommunications system ( Figure 14 not shown) and / or through one or more intermediate networks external to the telecommunications system. In the illustrated embodiment, the hardware QQ525 of the base station QQ520 further includes a processing circuit QQ528, which may include one or more programmable processors suitable for executing instructions, application specific integrated circuits, field programmable gate arrays, or a combination thereof (not shown). The base station QQ520 also has software QQ521 stored internally or accessible via an external connection.

[0237] The communication system QQ500 also includes the aforementioned UE QQ530. Its hardware QQ535 may include a radio interface QQ537 configured to establish and maintain a wireless connection QQ570 to the base station serving the coverage area where the UE QQ530 is currently located. The hardware QQ535 of the UE QQ530 further includes a processing circuit QQ538, which may include one or more programmable processors suitable for executing instructions, application specific integrated circuits, field programmable gate arrays, or a combination thereof (not shown). The UE QQ530 also includes software QQ531, which is stored in or accessible by the UE QQ530 and executable by the processing circuit QQ538. The software QQ531 includes a client application QQ532. The client application QQ532 is operable to provide services to a human or non-human user via the UE QQ530 with the support of the host computer QQ510. In the host computer QQ510, the executed host application QQ512 may communicate with the executed client application QQ532 via an OTT connection QQ550 terminated at the UE QQ530 and the host computer QQ510. When providing services to the user, the client application QQ532 may receive request data from the host application QQ512 and provide user data in response to the request data. The OTT connection QQ550 may transmit both the request data and the user data. The client application QQ532 may interact with the user to generate the user data it provides.

[0238] Note that Figure 14 the host computer QQ510, base station QQ520, and UE QQ530 shown can be similar or identical to Figure 13 one of the host computers QQ430, base stations QQ412a, QQ412b, QQ412c and one of UEs QQ491, QQ492 respectively. That is, the internal workings of these entities can be as Figure 14 shown, and independently, the surrounding network topology can be Figure 13 the network topology of

[0239] In Figure 14 it, the OTT connection QQ550 has been abstractly drawn to show the communication between the host computer QQ510 and the UE QQ530 via the base station QQ520, without explicitly mentioning any intermediate devices and the exact routing of messages via these devices. The network infrastructure can determine this routing, which can be configured to be hidden from the UE QQ530 or from the service provider operating the host computer QQ510 or from both. When the OTT connection QQ550 is active, the network infrastructure can also (e.g., based on load balancing considerations or reconfiguration of the network) make a decision to dynamically change the routing.

[0240] The wireless connection QQ570 between the UE QQ530 and the base station QQ520 is in accordance with the teachings of the embodiments described throughout this disclosure. One or more of the various embodiments can improve the performance of the OTT service provided to the UE QQ530 using the OTT connection QQ550, where the wireless connection QQ570 forms the last segment in the OTT connection QQ550. More precisely, the teachings of these embodiments can improve the deblocking filter for video processing, thus providing benefits such as improved video encoding and / or decoding.

[0241] For purposes of monitoring data rate, latency, and other factors for improvements in one or more embodiments, a measurement process may be provided. There may also be an optional network function for reconfiguring the OTT connection QQ550 between the host computer QQ510 and the UE QQ530 in response to changes in the measurement results. The measurement process and / or network function for reconfiguring the OTT connection QQ550 may be implemented in the software QQ511 and hardware QQ515 of the host computer QQ510 or in the software QQ531 and hardware QQ535 of the UE QQ530 or in both. In an embodiment, sensors (not shown) may be deployed in or associated with communication devices through which the OTT connection QQ550 passes; the sensors may participate in the measurement process by providing values of the monitored quantities exemplified above or other physical quantities whose values may be used by the software QQ511, QQ531 to calculate or estimate the monitored quantities. The reconfiguration of the OTT connection QQ550 may include message format, retransmission settings, preferred routing, etc.; the reconfiguration need not affect the base station QQ520 and may be unknown or imperceptible to the base station QQ520. Such processes and functions may be known and practiced in the art. In a particular embodiment, the measurement may involve proprietary UE signaling that facilitates measurement by the host computer QQ510 of throughput, propagation time, latency, etc. The measurement may be implemented as follows: the software QQ511 and QQ531 enable the use of the OTT connection QQ550 to send messages (specifically, empty messages or "dummy" messages) while they monitor propagation time, errors, etc.

[0242] Figure 15 : A method implemented in a communication system including a host computer, a base station, and a user equipment according to some embodiments.

[0243] Figure 15 is a flowchart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station, and a UE, which may be the host computer, base station, and UE described with reference to Figure 14 For the sake of brevity of the present disclosure, only references to the figures of Figure 15 will be included in this section. In step QQ610, the host computer provides user data. In sub-step QQ611 (which may be optional) of step QQ610, the host computer provides user data by executing a host application. In step QQ620, the host computer initiates a transmission to the UE carrying the user data. In step QQ630 (which may be optional), according to the teachings of the embodiments described throughout the present disclosure, the base station sends the user data carried in the transmission initiated by the host computer to the UE. In step QQ640 (which may also be optional), the UE executes a client application associated with the host application executed by the host computer.

[0244] Figure 16 : A method implemented in a communication system including a host computer, a base station, and a user equipment according to some embodiments.

[0245] Figure 16 is a flowchart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station, and a UE, which may be the host computer, the base station, and the UE described with reference to Figure 14 For the sake of brevity of the present disclosure, only figure references to Figure 16 will be included in this part. In step QQ710 of the method, the host computer provides user data. In an optional sub-step (not shown), the host computer provides user data by executing a host application. In step QQ720, the host computer initiates a transmission carrying the user data to the UE. According to the teachings of the embodiments described throughout the present disclosure, this transmission may be via the base station. In step QQ730 (which may be optional), the UE receives the user data carried in the transmission.

[0246] Figure 17 : A method implemented in a communication system including a host computer, a base station, and a user equipment according to some embodiments.

[0247] Figure 17 is a flowchart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station, and a UE, which may be the host computer, the base station, and the UE described with reference to Figure 14 For the sake of brevity of the present disclosure, only figure references to Figure 17 will be included in this part. In step QQ810 (which may be optional), the UE receives input data provided by the host computer. Additionally or alternatively, in step QQ820, the UE provides user data. In sub-step QQ821 of step QQ820 (which may be optional), the UE provides user data by executing a client application. In sub-step QQ811 of step QQ810 (which may be optional), the UE executes a client application that provides user data in response to the received input data provided by the host computer. When providing user data, the executed client application may also consider user input received from the user. Regardless of the specific manner of providing user data, the UE initiates a transmission of the user data to the host computer in sub-step QQ830 (which may be optional). In step QQ840 of the method, according to the teachings of the embodiments described throughout the present disclosure, the host computer receives the user data sent from the UE.

[0248] Figure 18: A method implemented in a communication system including a host computer, a base station, and a user equipment according to some embodiments.

[0249] Figure 18 is a flowchart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station, and a UE, which may be the host computer, base station, and UE described with reference to Figure 14 For the sake of brevity of the present disclosure, only figure references to Figure 18 will be included in this section. In step QQ910 (which may be optional), the base station receives user data from the UE according to the teachings of the embodiments described throughout the present disclosure. In step QQ920 (which may be optional), the base station initiates the transmission of the received user data to the host computer. In step QQ930 (which may be optional), the host computer receives the user data carried in the transmission initiated by the base station.

[0250] Any suitable steps, methods, features, functions, or benefits disclosed herein may be performed by one or more functional units or modules of one or more virtual devices. Each virtual device may include a plurality of these functional units. These functional units may be implemented by a processing circuit, which may include one or more microprocessors or microcontrollers and other digital hardware (which may include a digital signal processor (DSP), dedicated digital logic, etc.). The processing circuit may be configured to execute program code stored in a memory, which may include one or several types of memories, such as read-only memory (ROM), random access memory (RAM), cache memory, flash memory devices, optical storage devices, etc. The program code stored in the memory includes program instructions for executing one or more telecommunication and / or data communication protocols, as well as instructions for executing one or more techniques described herein. In some implementations, the processing circuit may be used to cause the corresponding functional unit to perform the corresponding function according to one or more embodiments of the present disclosure.

[0251] The term "unit" may have its conventional meaning in the field of electronic products, electrical equipment, and / or electronic devices, and may include, for example, electrical and / or electronic circuits, devices, modules, processors, memories, logic solid-state and / or discrete devices, computer programs, or instructions for performing various tasks, processes, calculations, output, and / or display functions, etc. (such as those functions described herein).

[0252] The claims are provided below. Reference numerals / letters are provided in parentheses by way of example / illustration without limiting the example embodiments to the specific elements indicated by the reference numerals / letters.

Claims

1. A method for providing compliant privacy in a communication network, performed by a network device in a service network SN, the method comprising: Obtaining (500) a hidden subscription identifier from a user equipment UE associated with a home network HN, wherein obtaining the hidden subscription identifier comprises: obtaining a MCC having a first Mobile Country Code MCC value and a MNC having a first Mobile Network Code MNC value; Obtaining (504) a permanent subscription identifier associated with the hidden subscription identifier from the HN, wherein obtaining the permanent subscription identifier comprises obtaining a MCC having a second MCC value and a MNC having a second MNC value; Determining (506) whether the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN, wherein determining that the hidden subscription identifier corresponds to the permanent subscription identifier comprises: determining that the first MCC value is equal to the second MCC value and the first MNC value is equal to the second MNC value; and In response to determining that the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN, performing (508) further operations to provide services to the UE.

2. The method according to claim 1 further comprises: In response to determining that the hidden subscription identifier from the UE does not correspond to the permanent subscription identifier from the HN, rejecting (510) services to the UE.

3. The method according to claim 2, wherein Rejecting services to the UE comprises at least one of the following: rejecting (600) the UE's registration to the SN, recording (602) an event corresponding to the hidden subscription identifier not corresponding to the permanent subscription identifier, notifying (604) a law enforcement organization, and notifying (606) the UE.

4. The method according to any one of claims 1 to 3, wherein, The hidden subscription identifier comprises a SUCI calculated by the UE based on information provided by the HN.

5. The method according to any one of claims 1 to 3, wherein The permanent subscription identifier comprises a SUPI.

6. The method according to claim 5, wherein, The SUPI comprises an International Mobile Subscription Identifier IMSI or a network-specific identifier.

7. The method according to any one of claims 1 to 3, wherein The hidden subscription identifier hides the permanent subscription identifier.

8. The method according to any one of claims 1 to 3, wherein, Obtaining the hidden subscription identifier comprises: obtaining a first home network identifier corresponding to the UE having a first value and a second home network identifier corresponding to the HN having a second value.

9. The method according to claim 1 further comprises: Performing subscription binding using the second MCC value and the second MNC value.

10. The method according to any one of claims 1 to 3 further comprises: Determining whether a SUPI type is received from the UE and the HN.

11. The method according to claim 10, wherein, The hidden subscription identifier comprises a first type, and the permanent subscription identifier comprises a second type different from the first type.

12. The method according to claim 11, wherein, Determining that the hidden subscription identifier corresponds to the permanent subscription identifier comprises: determining that the first MCC value of the first type is equal to the second MCC value of the second type, and determining that the first MNC value of the first type is equal to the second MNC value of the second type.

13. The method according to claim 11, wherein, Determining that the hidden subscription identifier corresponds to the permanent subscription identifier includes: determining that the first MCC value of the first type is different from the second MCC value of the second type, and determining that the first MNC value of the first type is different from the second MNC value of the second type.

14. The method according to claim 13, wherein, The SN generates an indication of rejecting the service in response to the first type being different from the second type.

15. The method according to claim 13, wherein, The first type includes a first format defining a geographical area, and the second type includes a second format type defining the geographical area, wherein the operation is provided to the UE.

16. The method according to claim 1, wherein, The hidden subscription identifier includes a first type, and the permanent subscription identifier includes the first type.

17. The method according to claim 16, further comprising determining that the first type is an IMSI, and Determining that the first MCC value is equal to the second MCC value and the first MNC value is equal to the second MNC value is performed in response to determining that the first type is an IMSI.

18. The method according to claim 16, further comprising determining that the first type is an NSI, and Among them, Determining that the first MCC value is equal to the second MCC value and the first MNC value is equal to the second MNC value is performed in response to determining that the first type is an NSI, and the first MCC value being equal to the second MCC value and the first MNC value being equal to the second MNC value indicates that the hidden subscription identifier and the permanent subscription identifier include the same geographical area.

19. The method according to any one of claims 1 to 3 further comprises: Send (700) the hidden subscription identifier received from the UE to the HN.

20. A computer program product, comprising; A non-transitory computer-readable medium storing program code configured to be executed by a processor of a network device to cause the processor to perform the operations for providing compliant privacy in a communication network according to any one of claims 1 to 19.

21. A network device in a communication network, comprising: At least one processor (810, 904); At least one memory (820, 906), coupled to the at least one processor and storing program code, the program code being executed by the at least one processor to perform operations including the following: Obtain (500) a hidden subscription identifier from a user equipment UE associated with a home network HN, wherein obtaining the hidden subscription identifier includes: obtaining an MCC having a first mobile country code MCC value and an MNC having a first mobile network code MNC value; Obtain (504) a permanent subscription identifier associated with the hidden subscription identifier from the HN, wherein obtaining the permanent subscription identifier includes obtaining an MCC having a second MCC value and an MNC having a second MNC value; Determine (506) whether the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN, wherein determining that the hidden subscription identifier corresponds to the permanent subscription identifier includes: determining that the first MCC value is equal to the second MCC value and the first MNC value is equal to the second MNC value; and In response to determining that the hidden subscription identifier from the UE corresponds to the permanent subscription identifier from the HN, perform (508) further operations to provide services to the UE.

22. The network device according to claim 21, wherein, The memory is connected to the processor and stores program code, which is executed by the processor to perform the steps of the method according to any one of claims 2 to 19.

23. A method for providing compliant privacy in a communication network, performed by a mobile terminal (106), the method comprising:[[]] Send (700) a hidden subscription identifier to a serving network, the hidden subscription identifier including at least a first home network identifier, the first home network identifier including an MCC having a first Mobile Country Code (MCC) value and an MNC having a first Mobile Network Code (MNC) value; And Use (702) a SUPI having at least the first home network identifier in a binding, wherein the use of the SUPI in the binding is based on the first MCC value being equal to the second MCC value of a second home network identifier and the first MNC value being equal to the second MNC value of the second home network identifier.

24. The method according to claim 23, wherein, The hidden subscription identifier hides a permanent subscription identifier.

25. The method according to claim 23, wherein The hidden subscription identifier includes an IMSI type.

26. The method according to claim 25, wherein, The hidden subscription identifier includes a Network Access Identifier (NAI).

27. The method according to claim 24, wherein The mobile terminal uses the permanent subscription identifier hidden in the hidden subscription identifier to perform SUPI binding.

28. A mobile terminal (106) comprising:[[]] At least one processor (810); At least one memory (820), coupled to the at least one processor and storing program code, the program code being executed by the at least one processor to perform operations including:[[]] Send (700) a hidden subscription identifier to a serving network, the hidden subscription identifier including at least a first home network identifier, the first home network identifier including an MCC having a first Mobile Country Code (MCC) value and an MNC having a first Mobile Network Code (MNC) value; And Use (702) a SUPI having at least the first home network identifier in a binding, wherein the use of the SUPI in the binding is based on the first MCC value being equal to the second MCC value of a second home network identifier and the first MNC value being equal to the second MNC value of the second home network identifier.

29. The mobile terminal according to claim 28, wherein, The memory is connected to the processor and stores program code, which is executed by the processor to perform the steps of the method according to any one of claims 24 to 27.

30. A computer program product, comprising; A non-transitory computer-readable medium storing program code configured to be executed by a processor of a mobile terminal to cause the processor to perform the operations for providing compliant privacy in a communication network according to any one of claims 23 to 27.

Images