Certification decision for fixed network residential gateways

Abstract

A method performed by a core network node (300) of a wireless communication system comprises: receiving (902) a registration request for registering a fixed network residential gateway FN-RG with a core network, obtaining (904) an identifier associated with the FN-RG, and determining (906) based on the identifier of the FN-RG that authentication of the FN-RG by the core network is not required.

Description

Technical Field

[0001] The present disclosure relates generally to communications, and more particularly to wireless communications and related wireless devices and network nodes. Background Art

[0002] exist Figure 1A A simplified wireless communication system is shown in . The system comprises a UE 10 communicating with one or more access nodes 21, 22 using radio connections 11, 12. The access nodes 21, 22 are connected to a core network node 20. The access nodes 21-22 are part of a radio access network 25.

[0003] For wireless communication systems that follow the 3GPP Evolved Packet System EPS (also known as Long Term Evolution LTE or 4G) standard specifications, the access nodes 21, 22 generally correspond to evolved NodeBs (eNBs) and the core network node 20 generally corresponds to a mobility management entity (MME) and / or a serving gateway (SGW). The eNB is part of a radio access network (RAN) 105, which in this case is an E-UTRAN (Evolved Universal Terrestrial Radio Access Network), while the MME and SGW are both part of an EPC (Evolved Packet Core Network).

[0004] For wireless communication systems that comply with 3GPP 5G System 5GS (also known as New Radio NR or 5G) standard specifications (such as those specified in [6] and related specifications), the access nodes 21-22 typically correspond to 5G NodeBs (gNBs) and the network node 20 typically corresponds to access and mobility management functions (AMFs) and / or user plane functions (UPFs). The gNBs are part of a radio access network 25, which in this case is a NG-RAN (Next Generation Radio Access Network), and both the AMF and UPF are part of a 5G core network (5GC).

[0005] Figure 1B An exemplary 5G system architecture is shown. Figure 1B As shown in Figure 1, functional entities (e.g., AMF, SMF, etc.) are connected to a logical communication bus. The access and mobility management function (AMF) communicates with the radio access network (RAN) and one or more user equipments (UEs), and the session management function (SMF) communicates with the user plane function (UPF). This way of modeling the system is also called a "service-based architecture".

[0006] We will now describe Figure 1B The various functions shown in .

[0007] The access and mobility management function (AMF) supports termination of the non-access stratum (NAS signaling), NAS encryption and integrity protection, registration management, connection management, mobility management, access authentication and authorization, and security context management.

[0008] The Session Management Function (SMF) supports session management (session establishment, modification, release), UE IP address allocation and management, DHCP functions, termination of NAS signaling related to session management, downlink (DL) data notification, and traffic steering configuration for the User Plane Function (UPF) for correct traffic routing.

[0009] The User Plane Function (UPF) supports packet routing and forwarding, packet inspection, QoS processing, acts as an external PDU session point for interconnection with the Data Network (DN), and is the anchor point for intra-RAT and inter-RAT mobility.

[0010] The Policy Control Function (PCF) supports the unified policy framework, thereby providing policy rules to the CP function and access subscription information used for policy decisions in the UDR.

[0011] The Authentication Server Function (AUSF) acts as an authentication server.

[0012] Unified Data Management (UDM) supports the generation of authentication and key agreement (AKA) credentials, user identity handling, access authorization, and subscription management.

[0013] Application Functions (AFs) support application influence on traffic routing, access to NEFs, and interaction with the policy framework for policy control.

[0014] The Network Exposure Function (NEF) supports the exposure of capabilities and events, the secure provision of information from external applications to the 3GPP network, and the conversion of internal / external information.

[0015] The NF Repository Function (NRF) supports the service discovery function and maintains the Network Function (NF) profiles and available NF instances.

[0016] The Network Slice Selection Function (NSSF) supports the selection of a network slice instance to serve the UE, determines the allowed NSSAI, and determines the set of AMFs to be used to serve the UE.

[0017] Wireless / wired convergence is currently being studied in 3GPP. Part of the work is to connect so-called residential gateways to the 5G core. A residential gateway (RG) can be a gateway with 5G capabilities (5G-RG) or a traditional gateway, i.e. a fixed network residential gateway (FN-RG). A residential gateway of the FN-RG type can only be connected via a wired access specified by the Broadband Forum (BBF). A residential gateway of the 5G-RG type can also be connected via a wireless 3GPP radio access.

[0018] A 5G-capable device is a device that supports the features and mechanisms described in the 3GPP 5G specifications, such as the 5G security specifications [1], which describe, for example, how to authenticate a device and how to use keys obtained after a successful authentication run to protect communications between the device and the network.

[0019] FN-RG is a legacy node specified by BBF. FN-RG does not have 5G capabilities, does not have 5G credentials, and cannot use the 5G authentication mechanism described in [4], so it cannot be authenticated by the 5G core. Summary of the invention

[0020] A method performed by a core network node of a wireless communication system includes: receiving a registration request for registering a fixed network residential gateway FN-RG to a core network; obtaining an identifier associated with the FN-RG; and determining that authentication of the FN-RG by the core network is not required based on the identifier of the FN-RG.

[0021] In some embodiments, the method further comprises: in response to determining that authentication of the FN-RG is not required, registering the FN-RG in the core network without authentication.

[0022] In some embodiments, the identifier comprises a line ID associated with the FN-RG.

[0023] In some embodiments, the method further comprises: receiving an indication from a fixed access gateway function FAGF that the FN-RG is authentic; and performing, based in part on the indication from the FAGF, determining that authentication of the FN-RG is not required.

[0024] In some embodiments, the registration request is received from the FAGF and the indication includes a flag associated with the registration request.The flag may be received with the registration request or in a separate message from the registration request.

[0025] In some embodiments, the registration request is received from a Fixed Access Gateway Function FAGF of an access network serving the FN-RG.

[0026] In some embodiments, the identifier is included in a hidden user identity SUCI included in the registration request.

[0027] In some embodiments, determining that authentication of the FN-RG is not required is performed in a unified data management (UDM) function of the core network.

[0028] In some embodiments, the method further comprises: receiving, at the UDM, an authentication request from a user authentication function AUSF function of the core network, the authentication request comprising an identifier of the FN-RG.

[0029] In some embodiments, the identifier of the FN-RG is included in a hidden user identity SUCI associated with the FN-RG, and the method further comprises: de-hiding the SUCI by the UDM to obtain a permanent user identity SUPI associated with the FN-RG.

[0030] In some embodiments, the authentication request includes an authentication acquisition request.

[0031] In some embodiments, the method further comprises: sending an authentication response to the AUSF, the authentication response comprising the SUPI.

[0032] In some embodiments, the authentication response includes an indication that authentication of the FN-RG is not required.

[0033] In some embodiments, the authentication response also includes a virtual authentication vector to be used to authenticate non-access stratum communications between the access network and the core network on behalf of the FN-RG.

[0034] In some embodiments, the authentication response comprises an authentication acquisition response.

[0035] Some embodiments provide a network node, comprising: a processor circuit; a network interface coupled to the processor circuit; and a memory coupled to the processor circuit, the memory comprising machine-readable program instructions, which, when executed by the processor circuit, cause the network node to perform the following operations: receive a registration request to register a fixed network residential gateway FN-RG with a core network; obtain an identifier associated with the FN-RG; and based on the identifier of the FN-RG, determine that authentication of the FN-RG by the core network is not required.

[0036] Some embodiments provide a computer program comprising program code to be executed by a processing circuit of a network node configured to operate in a communication network, whereby execution of the program code causes the network node to perform the following operations: receive a registration request to register a fixed network residential gateway FN-RG with a core network; obtain an identifier associated with the FN-RG; and based on the identifier of the FN-RG, determine that authentication of the FN-RG by the core network is not required.

[0037] Some embodiments provide a computer program product comprising a non-transitory storage medium comprising a program code to be executed by a processing circuit of a network node configured to operate in a communication network, whereby execution of the program code causes the network node to perform the following operations: receive a registration request to register a fixed network residential gateway FN-RG with a core network; obtain an identifier associated with the FN-RG; and based on the identifier of the FN-RG, determine that authentication of the FN-RG by the core network is not required.

[0038] Some embodiments provide a method in a unified data management function of a core network of a wireless communication system. The method includes: receiving, at the UDM, an authentication request from a user authentication function AUSF function of the core network, the authentication request requesting authentication of a fixed network residential gateway FN-RG and including an identifier of the FN-RG; determining, based on the identifier of the FN-RG, that authentication of the FN-RG is not required; and sending an authentication response to the AUSF, the authentication response including an indication that authentication of the FN-RG is not required.

[0039] In some embodiments, the identifier of the FN-RG is included in a hidden user identity SUCI associated with the FN-RG, and the method further comprises: de-hiding the SUCI by the UDM to obtain a permanent user identity SUPI associated with the FN-RG.

[0040] In some embodiments, the authentication response further includes a dummy authentication vector to be used on behalf of the FN-RG for non-access stratum communications with the core network.

[0041] In some embodiments, the authentication request includes an authentication acquisition request, and the authentication response includes an authentication acquisition response.

[0042] According to some embodiments, a network node includes: a processor circuit; a network interface coupled to the processor circuit; and a memory coupled to the processor circuit, the memory including machine-readable program instructions, which, when executed by the processor circuit, cause the network node to perform the following operations: at the UDM, receive an authentication request from a user authentication function AUSF function of the core network, the authentication request requesting authentication of a fixed network residential gateway FN-RG and including an identifier of the FN-RG; based on the identifier of the FN-RG, determine that authentication of the FN-RG is not required; and send an authentication response to the AUSF, the authentication response including an indication that authentication of the FN-RG is not required.

[0043] Some embodiments provide a computer program comprising program code to be executed by a processing circuit of a network node configured to operate in a communication network, whereby execution of the program code causes the network node to perform the following operations: at the UDM, receive an authentication request from a user authentication function AUSF function of the core network, the authentication request requesting authentication of a fixed network residential gateway FN-RG and including an identifier of the FN-RG; based on the identifier of the FN-RG, determine that authentication of the FN-RG is not required; and send an authentication response to the AUSF, the authentication response including an indication that authentication of the FN-RG is not required.

[0044] Some embodiments provide a computer program product comprising a non-transitory storage medium including a program code to be executed by a processing circuit of a network node configured to operate in a communication network, whereby execution of the program code causes the network node to perform the following operations: at the UDM, receive an authentication request from a user authentication function AUSF function of the core network, the authentication request requesting authentication of a fixed network residential gateway FN-RG and including an identifier of the FN-RG; based on the identifier of the FN-RG, determine that authentication of the FN-RG is not required; and send an authentication response to the AUSF, the authentication response including an indication that authentication of the FN-RG is not required. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings, which are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this application, illustrate certain non-limiting embodiments of the inventive concept. In the drawings:

[0046] Figure 1A A wireless communication system is shown;

[0047] Figure 1B An exemplary 5G system architecture is shown;

[0048] Figure 2 shows the process for registering the FN-RG with the 5G network;

[0049] Figure 3-8 A process for registering a FN-RG with a 5G network according to various embodiments is shown;

[0050] Figure 9-12 is a flow chart illustrating the operation of a core network node according to some embodiments;

[0051] Fig.13 is a block diagram illustrating an example of a core network (CN) node according to some embodiments;

[0052] Fig.14 is a block diagram of a wireless network according to some embodiments;

[0053] Fig.15 is a block diagram of a user equipment according to some embodiments;

[0054] Fig.16 is a block diagram of a virtualization environment according to some embodiments;

[0055] Fig.17 is a block diagram of a telecommunications network connected to a host computer via an intermediate network according to some embodiments;

[0056] Fig.18 is a block diagram of a host computer communicating with a user device via a base station over a partially wireless connection according to some embodiments;

[0057] Fig.19 is a block diagram of a method implemented in a communication system including a host computer, a base station, and a user equipment according to some embodiments;

[0058] Fig. 20 is a block diagram of a method implemented in a communication system including a host computer, a base station, and a user equipment according to some embodiments;

[0059] Fig.21 is a block diagram of a method implemented in a communication system including a host computer, a base station, and a user equipment according to some embodiments;

[0060] Fig. 22 is a block diagram of a method implemented in a communication system including a host computer, a base station, and a user equipment according to some embodiments. DETAILED DESCRIPTION

[0061] The inventive concept will now be described more fully below with reference to the accompanying drawings, in which examples of embodiments of the inventive concept are shown. However, the inventive concept can be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided so that this disclosure will be thorough and complete, and the scope of the inventive concept is fully communicated to those skilled in the art. It should also be noted that these embodiments are not mutually exclusive. Components from one embodiment may be assumed to exist / use in another embodiment by default.

[0062] The following description presents various embodiments of the disclosed subject matter. These embodiments are presented as teaching examples and should not be interpreted as limiting the scope of the disclosed subject matter. For example, some details of the described embodiments may be modified, omitted or expanded without departing from the scope of the described subject matter.

[0063] The procedure for registering FN-RG with the 5G network is proposed in [2]. Figure 2 The process is described as follows:

[0064] 1. Establish a Layer 2 (L2) connection between the 5G-RG and the Fixed Access Gateway Function (FAGF).

[0065] 2. The FN-RG is authenticated by the Wired 5G Access Node (W-5GAN). This can be, for example, based on the fixed AN inserting an identifier (called Line ID) into the DHCP request. If the RG has sent an IP addressing request (DHCPv4, DHCPV6, RS), the FAGF stores it until the RG has been registered and a PDU session is established for the RG.

[0066] [2] Note that the authentication of the FN-RG based on the trust relationship between the 5GC / AMF and the access network / FAGF is yet to be defined.

[0067] 3. The FAGF can use the Line ID to obtain the required 5GC parameters (e.g., NSSAI), which it needs to be able to send NAS signaling to the 5GC (registration, PDU session association, etc.) and to perform initial AMF selection. [2] states that the method used by the FAGF to determine these 5GC parameters will be defined by the BBF.

[0068] The FAGF performs the initial registration on behalf of the FN-RG. The NAS Registration message is sent using the same N2 mechanism as defined in [5] for N3GPP access, except that the ULI contains a different set of information (see solution 28 of [2]).

[0069] 4. FAGF sends a registration request to AMF. Compared with the case of 5G-RG, there are the following differences:

[0070] - Provide NSSAI based on the FAGF determination done in step 3.

[0071] - The FAGF shall use the LineID to construct the SUCI used in the Registration Request. This is further documented in Solution 28 of [2].

[0072] - FAGF will indicate to the AMF that it has authenticated the FN-RG. The authentication will not be performed by the 5GC.

[0073] -FAGF should indicate that PEI cannot be provided.

[0074] - The NAS Registration message is sent using the same N2 mechanism as defined in [5] for N3GPP access, with the following differences:

[0075] -ULI contains a different set of information (see solution #28 in [2]).

[0076] - FAGF will indicate to the AMF that it has authenticated the FN-RG. The authentication will not be performed by the 5GC.

[0077] 5. The AMF selects the AUSF based on the information received in the SUCI and requests authentication from the AUSF. This solution assumes that no authentication is performed and the AUSF replies with the SUPI corresponding to the subscription.

[0078] 6.AMF selects the UDM, registers with the UDM, obtains subscription data from the UDM, and subscribes to changes in subscription data, as described in [5] Figure 4 .As defined in step 14 of 2.2.2.2-1.

[0079] 7. Considering that the registration is for W-5GAN access, AMF creates an MM context for FN-RG. Mobility and paging are not applicable.

[0080] 8.AMF interacts with PCF to obtain access and mobility policies for FN-RG.

[0081] 9.AMF sends a Registration Accept message to FAGF. This message contains at least the 5G-GUTI, the allowed NSSAI and the non-3GPP deregistration timer, as defined in [5] clause 5.5.

[0082] 10. When the procedure is completed, the FAGF sends a Registration Complete message back to the AMF. The FAGF shall store the 5G-GUTI to be able to send it in a possible subsequent NAS procedure.

[0083] Existing solutions do not describe in detail how the 5G core network decides that authentication of the FN-RG is not required and how to notify other functions about the decision. In addition, existing solutions do not describe how to establish NAS security for the FN-RG.

[0084] Some embodiments provide systems and / or methods by which the AMF, AUSF or UDM advantageously determines whether authentication is required for a FN-RG attempting to access a 5G core network, and, if applicable, notifies other functions.

[0085] Some embodiments provide systems and / or methods by which NAS security is advantageously established between the W-5GAN and the AMF on behalf of the FN-RG.

[0086] Some embodiments provide systems and / or methods by which the 5GC advantageously authenticates the FN-RG, as well as how to notify other functions.

[0087] Several embodiments of the inventive concept are described below. In a first embodiment, the UDM determines that authentication of the FN-RG is not required. In a second embodiment, the AMF determines that authentication of the FN-RG is not required, and in a third embodiment, the AUSF determines that authentication of the FN-RG is not required. One or more embodiments described herein may also be combined. For example, in some embodiments, both the AMF and the UDM must determine that authentication is not required before the FN-RG can connect to the 5G network.

[0088] In another embodiment, an additional option is described by which NAS security can be established with virtual parameters, which can be combined with any of these three embodiments.

[0089] First Embodiment—Determination by UDM

[0090] Figure 3 FIG. 2 shows a process for registering FN-RG 100 with a 5G network according to the first embodiment. Figure 3 As shown in FIG. 2 , the FN-RG 100 establishes a layer 2 (L2) connection 202 to the FAGF 110, which may be implemented in the W-5GAN, for example. The FN-RG 100 is authenticated by the W-5GAN. This may be based on, for example, a Line ID associated with the FN-RG 100 that is inserted into a DHCP request.

[0091] Assuming that the FN-RG 100 is authenticated based on the Line ID, the FAGF 110 selects the AMF 120 and sends an initial NAS Registration Request 206 to the AMF 120 on behalf of the FN-RG 100. The FAGF 110 may use the Line ID to obtain the required 5GC parameters (e.g., NSSAI) required to send NAS signaling to the 5GC and to perform the initial AMF selection. In particular, the FAGF 110 may use the LineID or other identifier of the FN-RG 100 to construct a SUCI, which is included in the Registration Request. Thus, the SUCI may include the LineID or other identifier of the FN-RG 100. As described in [2], the NAS Registration message may be sent using the same N2 mechanism as defined in [5] for N3GPP access. The FAGF 110 may also include an indication, such as a flag, sent with or otherwise associated with the Registration Request 206, indicating that authentication of the FN-RG 100 by the core network is not required.

[0092] After receiving the registration request 206, in the first embodiment, the AMF 120 constructs an authentication request 208 (Nausf_UEAuthentication_Authenticate Request), which includes a SUCI carrying the FN-RG identifier. The AMF 120 selects an AUSF based on the information received in the SUCI and sends the authentication request to the AUSF 130. The AMF 120 may interact with the PCF to obtain access and mobility policies for the FN-RG 100.

[0093] After receiving the authentication request 208 , in the first embodiment, the AUSF 130 constructs an authentication get request 210 (Nudm_UEAuthentication_Get Request) including the SUCI carrying the FN-RG identifier, and sends the authentication get request 210 to the UDM 140 .

[0094] Upon receiving the authentication acquisition request 210 from the AUSF 130, the UDM 140 performs SUCI to SUPI de-hiding and determines whether authentication of the FN-RG is required based on the FN-RG identifier included in the request (block 212).

[0095] In some embodiments, the UDM 140 may determine that authentication is not required based on a local configuration or based on subscription information for the FN-RG 100. In the former option, the UDM 140 may be preconfigured to indicate that authentication is not required based on the FN-RG identifier included in the authentication acquisition request. In the latter option, the FN-RG device eligible for service by the network may have an associated subscription or special profile stored in the UDM 134 (or accessible by the UDM 140). The profile associated with the FN-RG 100 may indicate that authentication is not required. This option may preserve the legacy behavior of the UDM 140, which is expected to act only based on subscription information.

[0096] The UDM 140 responds to the authentication obtain request with an authentication obtain response 214 to the AUSF 130, which includes the SUPI and an indication that authentication is not required for this request.

[0097] After receiving the Authentication Get Response 214, the AUSF 130 responds to the Authentication Request 208 from the AMF 120 with an Authentication Response 216 from the AMF 120, which includes the SUPI and an indication that no authentication is required for this request.

[0098] Then, the AMF 120 sends a registration accept message 218 to the FAGF 110, and the FAGF 110 completes the connection to the FN-RG 100. The NAS connection of the FN-RG 100 is terminated in the FAGF 110.

[0099] exist Figure 3 In the flow shown in , it is assumed that the generic authentication service described in [1] is used. However, new services with new message names may also be used.

[0100] Second embodiment - determination by AMF

[0101] Figure 4 FIG. 2 shows a process for registering FN-RG 100 with a 5G network according to a second embodiment. Figure 4 As shown in FIG. 2 , the FN-RG 100 establishes a layer 2 (L2) connection 202 to the FAGF 110, which may be implemented, for example, in the W-5GAN. The FN-RG 100 is authenticated by the W-5GAN (block 204). This may be based on, for example, a LineID associated with the FN-RG 100 that is inserted into a DHCP request.

[0102] Assuming that the FN-RG 100 is authenticated based on the Line ID, the FAGF 110 selects the AMF 120 and sends an initial NAS Registration Request 206 to the AMF 120 on behalf of the FN-RG 100. The FAGF 110 may use the Line ID to obtain the required 5GC parameters (e.g., NSSAI) required to send NAS signaling to the 5GC and to perform the initial AMF selection. In particular, the FAGF 110 may use the LineID or other identifier of the FN-RG 100 to construct the SUCI, which is included in the Registration Request 206. Thus, the SUCI may include the LineID or other identifier of the FN-RG 100. As described in [2], the NAS Registration message 206 may be sent using the same N2 mechanism as defined in [5] for N3GPP access.

[0103] Upon receiving the Registration Request 206, in some embodiments, the AMF 120 determines whether authentication of the FN-RG 100 is required (block 222). In these embodiments, the AMF 120 may determine that authentication is not required based on local configuration. In one option, the AMF 120 may compare the received FN-RG 100-related identifier with a stored list of identifiers of devices to be served by the network based on authentication. In another option, the AMF 120 may make a decision based on the origin / source (e.g., IP address or N2 security) of the Registration Request message 206 received from the FAGF 110.

[0104] In another option, the AMF 120 may receive information that authentication is not required in the Registration Request message 206 created by the FAGF 110 (as described in solution #23 in [2]). The AMF 120 may verify that the Registration Request 206 is from the trusted FAGF 110 by verifying that the Registration Request 206 is received through a secure N2 interface with the trusted FAGF 110 as the other endpoint. In yet another option, the AMF 120 may interact with the UDM 140 via a new procedure implemented by exchanging new messages between the AMF 120 and the UDM 140 (which may but not necessarily be through the AUSF 130) to determine whether authentication is required to operate.

[0105] The AMF 120 then constructs an authentication request 224 (NAUSF 130_UEAuthentication_AuthenticateRequest) including the SUCI carrying the FN-RG 100 identifier. The authentication request 224 also indicates that no authentication is required for this FN-RG 100. The AMF 120 selects the AUSF 130 based on the information received in the SUCI and sends the authentication request to the AUSF 130. The AMF 120 may interact with the PCF to obtain access and mobility policies for the FN-RG 100.

[0106] After receiving the authentication request, in the second embodiment, the AUSF 130 constructs an authentication get request 226 (NUDM 140_UEAuthentication_Get Request) including the SUCI carrying the FN-RG 100 identifier and sends the authentication get request 226 to the UDM 140. The authentication get request 226 also indicates that authentication of this FN-RG 100 is not required.

[0107] Upon receiving the authentication acquisition request 226 from the AUSF 130, the UDM 140 performs SUCI to SUPI de-hiding (block 228). The UDM 140 responds to the authentication acquisition request with an authentication acquisition response 230 to the AUSF 130 that includes the SUPI.

[0108] After receiving the Authentication Get Response 230, the AUSF 130 responds to the authentication request from the AMF 120 with an Authentication Response 232 including the SUPI to the AMF 120.

[0109] The AMF 120 then sends a registration accept message 218 to the FAGF 110, and the FAGF 110 completes the connection to the FN-RG 100.

[0110] Third Embodiment—Determination by AUSF 130

[0111] Figure 5 FIG. 2 shows a process for registering FN-RG 100 with a 5G network according to a third embodiment. Figure 5 As shown in FIG. 2 , the FN-RG 100 establishes a layer 2 (L2) connection 20 to the FAGF 110, which may be implemented, for example, in the W-5GAN. The FN-RG 100 is authenticated by the W-5GAN (block 204). This may be based on, for example, a LineID associated with the FN-RG 100 that is inserted into a DHCP request.

[0112] Assuming that the FN-RG 100 is authenticated based on the Line ID, the FAGF 110 selects the AMF 120 and sends an initial NAS Registration Request 206 to the AMF 120 on behalf of the FN-RG 100. The FAGF 110 may use the Line ID to obtain the required 5GC parameters (e.g., NSSAI) required to send NAS signaling to the 5GC and to perform the initial AMF selection. In particular, the FAGF 110 may use the LineID or other identifier of the FN-RG 100 to construct the SUCI, which is included in the Registration Request 206. Thus, the SUCI may include the LineID or other identifier of the FN-RG 100. As described in [2], the NAS Registration message 206 may be sent using the same N2 mechanism as defined in [5] for N3GPP access.

[0113] Then, the AMF 120 constructs an authentication request 240 (NAUSF 130_UEAuthentication_Authenticate Request) including the SUCI carrying the identifier of the FN-RG 100. The AMF 120 selects the AUSF 130 based on the information received in the SUCI and sends the authentication request to the AUSF 130. The AMF 120 may interact with the PCF to obtain access and mobility policies for the FN-RG 100.

[0114] Upon receiving the authentication request, in the third embodiment, the AUSF 130 determines whether authentication is required for the request (block 242).

[0115] In these embodiments, the AUSF 130 may be pre-configured with the necessary information to determine that authentication is not required for a particular device. Such configuration information may be, for example, a list of FN-RG 100 related identifiers that are eligible to be served without authentication.

[0116] In these embodiments, the involvement of UDM 140 is not necessarily required. In other words, in another embodiment, no Figure 5 The interaction between the AUSF 130 and the UDM 140 is shown in FIG.

[0117] In yet another embodiment, the actions related to determining whether authentication is required may be based on a specific interaction with the UDM 140. This may be accomplished by a new process with new messages. For example, the process may be a simple exchange of request / response messages between the AUSF 130 and the UDM 140 for the new authentication requirement. The AUSF 130 may provide the received FN-RG 100 identifier in the request, and the UDM 140 may respond accordingly by acting on the received information and request, as described above.

[0118] Then, the AUSF 130 constructs an authentication get request 226 (NUDM140_UEAuthentication_Get Request) including the SUCI carrying the FN-RG 100 identifier and sends the authentication get request 226 to the UDM 140. The authentication get request 226 also indicates that authentication of this FN-RG 100 is not required.

[0119] Upon receiving the authentication acquisition request 226 from the AUSF 130, the UDM 140 performs SUCI to SUPI de-hiding (block 228). The UDM 140 responds to the authentication acquisition request with an authentication acquisition response 244 to the AUSF 130 including the SUPI.

[0120] After receiving the Authentication Get Response 244, the AUSF 130 responds to the authentication request from the AMF 120 with an Authentication Response 246 including the SUPI to the AMF 120.

[0121] The AMF 120 then sends a Registration Accept 218 message to the FAGF 110 , and the FAGF 110 completes the connection to the FN-RG 100 .

[0122] Building NAS security with virtual parameters

[0123] In the above three embodiments, an additional option is to distribute virtual parameters (AV, K SEAF ) is used for establishing NAS security between AMF 120 and FAGF 110 (network entity between AMF 120 and FN-RG 100).

[0124] To reduce the impact on the AMF 120 and since the AMF 120 always expects the security key K upon successful authentication operation SEAF , therefore some embodiments provide for the AUSF 130 to send a successful authentication indication as described in [1], which includes a virtual K SEAF Key. This key may be defined as a constant or may be based on an FN-RG 100 related identifier. In turn, the AMF 120 will establish NAS security with the FAGF 110 (or other network entity emulating a NAS protocol on behalf of the FN-RG 100 device) based on the same key.

[0125] In addition, in some embodiments, the UDM 140 may send a virtual authentication vector (AV) to the AUSF 130. Generally, an authentication vector is a parameter tuple that provides temporary authentication data. The AV may include elements such as a network challenge (RAND), an expected user response called XRES (expected response), CK (cryptographic key), IK (integrity key), and / or AUTN (authentication token), etc.

[0126] Either or both options may be used.The virtual AV may be defined (eg in a specification) as a constant or may be based on a FN-RG 100 related identifier.

[0127] therefore, Figure 6 A variation of the first embodiment described above is shown in which the UDM 140 makes a determination at block 252 that authentication of the FN-RG 100 is not required. In this case, the UDM 140 may include a dummy authentication vector (AV) in the authentication acquisition response message 254 to the AUSF 130. Likewise, the AUSF 130 may include a dummy KSEAF in the authentication response 256 sent to the AMF 120.

[0128] Figure 7 100, wherein the AMF 120 makes a determination that authentication of the FN-RG 100 is not required. In this case, the UDM 140 may include a dummy authentication vector (AV) in the authentication acquisition response message to the AUSF 130. Likewise, the AUSF 130 may include a dummy AV in the authentication response sent to the AMF 120. SEAF .

[0129] Figure 8 A variation of the third embodiment described above is shown in which the AUSF 130 makes a determination at block 276 that authentication of the FN-RG 100 is not required. In this case, the UDM 140 may include a dummy authentication vector (AV) in the authentication acquisition response message 282 to the AUSF 130. Likewise, the AUSF 130 may include a dummy KSEAF in the authentication response 284 sent to the AMF 120.

[0130] Fig. 9 is a flow chart illustrating the operation of a unit of a 5G core network according to some embodiments.

[0131] refer to Fig. 9, the operation of the 5G core network according to some embodiments includes: receiving (902) a registration request to register a fixed network residential gateway FN-RG with the core network; obtaining (904) an identifier of the FN-RG; based on the identifier of the FN-RG, determining (906) whether authentication of the FN-RG is required. If the CN determines that authentication of the FN-RG is not required, the CN registers (908) the FN-RG to the CN without authentication. Otherwise, the CN may require authentication of the FN-RG before registration, or alternatively, the CN may refuse to register the FN-RG.

[0132] In some embodiments, the method may include receiving an indication from a fixed access gateway function FAGF that the FN-RG is authentic, and determining that authentication of the FN-RG is not required may be performed based in part on the indication from the FAGF. The indication may include a flag or other field sent with the registration request or otherwise associated with the registration request.

[0133] The identifier may include a line ID associated with the FN-RG, and the registration request may be received from a fixed access gateway function FAGF of the core network. The identifier may be included in a user concealment identity SUCI included in the registration request.

[0134] In some embodiments, determining whether authentication of the FN-RG is required may be performed in a unified data management (UDM) function of the core network. The UDM may also include receiving an authentication acquisition request from a user authentication function (AUSF) function of the core network, the authentication acquisition request including an identifier of the FN-RG.

[0135] The identifier of the FN-RG may be included in a hidden user identity SUCI associated with the FN-RG, and the method further comprises de-hiding the SUCI by the UDM to obtain a permanent user identity SUPI associated with the FN-RG.

[0136] The method may further include sending an authentication acquisition response to the AUSF, the authentication acquisition response including the SUPI. The authentication acquisition response may include an indication that authentication of the FN-RG is not required. The authentication acquisition response may also include a virtual authentication vector to be used on behalf of the FN-RG for non-access stratum communications within the core network.

[0137] In some embodiments, determining that authentication of the FN-RG is not required may be performed in an access and mobility management function AMF function of the core network. In particular, the identifier of the FN-RG is included in a user hidden identity SUCI associated with the FN-RG, and the method may further include: sending an authentication request from the AMF to a user authorization function AUSF of the core network, the authentication request including the SUCI and an indication that authentication of the FN-RG is not required; and receiving an authentication response from the AUSF at the AMF, the authentication response including a user permanent identifier SUPI associated with the FN-RG.

[0138] The method may further include sending a registration accept message to the FAGF in response to receiving the authentication response, the registration accept message including the SUPI.

[0139] The authentication response may include a virtual security anchor function SEAF key KSEAF to be used on behalf of the FN-RG for non-access stratum communications within the core network, and the method may also include sending a registration acceptance message to the FAGF in response to receiving the authentication response, the registration acceptance message including the SUPI and the virtual SEAF key KSEAF.

[0140] In some embodiments, determining whether authentication of the FN-RG is required may be performed in a user authentication function AUSF function of the core network. The method may also include: sending an authentication acquisition request from the AUSF to a unified data management UDM function of the core network, the authentication acquisition request including the SUCI and an indication that authentication of the FN-RG is not required; and receiving an authentication acquisition response from the UDM at the AUSF, the authentication acquisition response including a user permanent identifier SUPI associated with the FN-RG.

[0141] The authentication-acquisition response may include a dummy authentication vector to be used on behalf of the FN-RG for non-access stratum communications within the core network.The authentication-acquisition response may also include an indication that authentication of the FN-RG is not required.

[0142] The method may also include: receiving, at the AUSF, an authentication request from an access and mobility management function AMF in the core network, the authentication request including a hidden user identity SUCI associated with the FN-RG; and sending an authentication response to the AMF, the authentication response including a permanent user identity SUPI associated with the FN-RG.

[0143] The method may further comprise sending, in the authentication response, to the AMF a virtual security anchor function, SEAF key, KSEAF, to be used for non-access stratum communications within the core network on behalf of the FN-RG.

[0144] Fig.10is a flow chart illustrating the operation of the UDM function of the 5G core network according to some embodiments.

[0145] refer to Fig.10 , a method in a unified data management (UDM) function of a core network of a wireless communication system comprises: at the UDM, receiving (1002) an authentication acquisition request from a user authentication function (AUSF) function of the core network, the authentication acquisition request requesting authentication of a fixed network residential gateway (FN-RG) and comprising an identifier of the FN-RG. The identifier of the FN-RG may be included in a hidden user identity (SUCI) associated with the FN-RG, and the method may include de-hiding (1004) the SUCI by the UDM to obtain a user permanent identity (SUPI) associated with the FN-RG. The method also comprises determining (1006) based on the identifier of the FN-RG that authentication of the FN-RG is not required, and if authentication of the FN-RG is not required, sending (1008) an authentication acquisition response to the AUSF, the authentication acquisition response including an indication that authentication of the FN-RG is not required. If the UDM determines that authentication of the FN-RG is required, the UDM may send an appropriate response to the authentication acquisition request to require authentication (1012) and / or reject the authentication acquisition request.

[0146] The authentication acquisition request may include an indication that authentication of the FN-RG is not required.The authentication acquisition response may also include a dummy authentication vector to be used on behalf of the FN-RG for non-access stratum communications within the core network.

[0147] Fig.11 is a flow chart illustrating the operation of the AMF function of the 5G core network according to some embodiments.

[0148] refer to Fig.11 , a method in a function access and mobility management function AMF of a core network of a wireless communication system comprises: at the AMF, receiving (1102) a registration request for registering a fixed network residential gateway FN-RG with the core network, the registration request comprising an identifier of the FN-RG; and based on the identifier of the FN-RG, determining (1104) whether authentication of the FN-RG is required. If the AMF determines that authentication of the FN-RG is required, the AMF may send an appropriate response to the registration request to require authentication (1112) and / or reject the registration request.

[0149] The method also includes registering the FN-RG without authentication in response to determining that authentication of the FN-RG is not required. Fig.11As shown in , the identifier of the FN-RG may be included in a hidden user identity SUCI associated with the FN-RG, and the method may further include: sending (1106) an authentication request from the AMF to a user authorization function AUSF of the core network, the authentication request including the SUCI; and receiving (1108) an authentication response from the AUSF at the AMF, the authentication response including the user permanent identifier SUPI associated with the FN-RG and an indication that authentication of the FN-RG is not required.

[0150] The method may further include sending (1110) a registration accept message to the FAGF in response to receiving the authentication response, the registration accept message including the SUPI.

[0151] The authentication response may include a virtual security anchor function SEAF key KSEAF to be used on behalf of the FN-RG for non-access stratum communications within the core network, and the method may also include sending (1110) a registration response message to the FAGF in response to receiving the authentication response, the registration acceptance message including the SUPI and the virtual SEAF key KSEAF.

[0152] Fig.12 is a flow chart illustrating the operation of the AUSF functionality of a 5G core network according to some embodiments.

[0153] refer to Fig.12 , a method in a user authentication function AUSF of a core network of a wireless communication system comprises: at the AUSF, receiving (1202) an authentication request from an access and mobility management function AMF in the core network, the authentication request comprising an identifier of a fixed node residential gateway FN-RG; and based on the identifier of the FN-RG, determining (1204) whether authentication of the FN-RG is required. If the AUSF determines that authentication of the FN-RG is required, the AUSF may send an appropriate response to the authentication request to require authentication (1212) and / or reject the authentication request.

[0154] The method also includes: sending (1206) an authentication acquisition request from the AUSF to a unified data management (UDM) function of the core network, the authentication acquisition request including the SUCI and an indication that authentication of the FN-RG is not required; and receiving (1208) an authentication acquisition response from the UDM at the AUSF, the authentication acquisition response including a user permanent identifier (SUPI) associated with the FN-RG.

[0155] The method also includes sending (1210) an authentication response to the AMF, the authentication response including an indication that authentication of the FN-RG is not required.

[0156] The authentication acquisition response may include an indication that authentication of the FN-RG is not required.

[0157] In some embodiments, the authentication acquisition response includes a virtual authentication vector to be used on behalf of the FN-RG for non-access stratum communications within the core network.

[0158] It may also include sending a virtual security anchor function SEAF key KSEAF to the AMF in the authentication response to be used on behalf of the FN-RG for non-access stratum communications within the core network.

[0159] Fig.13 306, a transceiver 302 coupled to the processor circuit, and a memory 308 coupled to the processor circuit. The memory 308 includes machine-readable computer program instructions that, when executed by the processor circuit, cause the processor circuit to perform Figure 3-12 Some of the operations described in .

[0160] Fig.13 An example of a core network node 300 of a core network such as a 5GC or EPC core network is depicted. As shown, the network node 300 is a network interface circuit 304 (also referred to as a network interface) configured to provide communication with other nodes of the wireless communication network (e.g., with other base stations and / or core network nodes). The network node 300 may also include a processor circuit 306 (also referred to as a processor) and a memory circuit 308 (also referred to as a memory) coupled to the processor circuit 306. The memory circuit 308 may include a computer-readable program code that, when executed by the processor circuit 306, causes the processor circuit to perform operations according to the embodiments disclosed herein. According to other embodiments, the processor circuit 306 may be defined as including a memory, so that a separate memory circuit is not required.

[0161] As discussed herein, the operations of the network node 300 may be performed by the processor 306 and / or the network interface 304. For example, the processor 306 may control the network interface 304 to send communications to one or more other network nodes through the network interface 304 and / or receive communications from one or more other network nodes through the network interface. In addition, modules may be stored in the memory 308, and these modules may provide instructions so that when the instructions of the modules are executed by the processor 306, the processor 306 performs corresponding operations (e.g., the operations discussed herein with respect to the exemplary embodiments). In addition, similar to Fig.13 In addition, the network nodes discussed in this article can be implemented as virtual network nodes.

[0162] Thus, a network node 300 (or a radio access network (RAN) node 300) according to some embodiments includes a processor circuit 306 and a memory 308 coupled to the processor circuit, the memory including machine-readable program instructions that, when executed by the processor circuit, cause the network node to perform the operations described herein.

[0163] List of Exemplary Embodiments

[0164] Exemplary embodiments are discussed below. Reference numerals / letters are provided in parentheses by way of example / illustration and do not limit the exemplary embodiments to the specific elements indicated by the reference numerals / letters.

[0165] Embodiment 1. A method performed by a core network of a wireless communication system, comprising:

[0166] receiving (902) a registration request for registering a fixed network residential gateway FN-RG with a core network; obtaining (904) an identifier of the FN-RG; and

[0167] Based on the identifier of the FN-RG, it is determined (906) that authentication of the FN-RG by the core network is not required.

[0168] Embodiment 2. The method according to embodiment 1 further includes:

[0169] In response to determining that authentication of the FN-RG is not required, the FN-RG is registered (908) in the core network without authentication.

[0170] Embodiment 3. The method of embodiment 1 or 2, wherein the identifier comprises a line ID associated with the FN-RG.

[0171] Embodiment 4. The method according to any one of embodiments 1 to 3, further comprising:

[0172] receiving an indication from the fixed access gateway function FAGF that the FN-RG is authentic;

[0173] Therein, based in part on an indication from the FAGF, a determination is performed that no authentication of the FN-RG is required.

[0174] Embodiment 5. The method of claim 4, wherein the registration request is received from a FAGF, and wherein the indication comprises a flag associated with the registration request.

[0175] Embodiment 6. The method according to any one of embodiments 1 to 5, wherein the registration request is received from a fixed access gateway function FAGF of an access network serving the FN-RG.

[0176] Embodiment 7. The method according to any one of embodiments 1 to 6, wherein the identifier is included in a hidden user identity (SUCI), which is included in the registration request.

[0177] Embodiment 8. The method according to any one of embodiments 1 to 7, wherein determining that authentication of the FN-RG is not required is performed in a unified data management (UDM) function of the core network.

[0178] Embodiment 9. The method according to embodiment 8 further comprises:

[0179] At the UDM, an authentication acquisition request from a user authentication function AUSF function of the core network is received, where the authentication acquisition request includes an identifier of the FN-RG.

[0180] Embodiment 10. The method according to embodiment 9, wherein the identifier of the FN-RG is included in a hidden user identity SUCI associated with the FN-RG, and wherein the method further comprises:

[0181] The SUCI is de-hidden by the UDM to obtain the user permanent identity SUPI associated with the FN-RG.

[0182] Embodiment 11. The method according to embodiment 10 further includes:

[0183] Send an Authentication Get Response to the AUSF, which includes the SUPI.

[0184] Embodiment 12. The method according to embodiment 11, wherein the authentication acquisition response includes an indication that authentication of the FN-RG is not required.

[0185] Embodiment 13. The method according to embodiment 12, wherein the authentication acquisition response further includes a virtual authentication vector, which is used to authenticate non-access stratum communications between the access network and the core network on behalf of the FN-RG.

[0186] Embodiment 14. A method according to any one of embodiments 1 to 7, wherein determining that authentication of the FN-RG is not required is performed in an access and mobility management function (AMF) function of the core network.

[0187] Embodiment 15. The method according to embodiment 14, wherein the identifier of the FN-RG is included in a hidden user identity SUCI associated with the FN-RG, and wherein the method further comprises:

[0188] sending an authentication request from the AMF to an authentication server function AUSF of the core network, the authentication request including the SUCI and an indication that authentication of the FN-RG is not required; and

[0189] An authentication response is received at the AMF from the AUSF, the authentication response including the User Permanent Identifier SUPI associated with the FN-RG.

[0190] Embodiment 16. The method of embodiment 1152, wherein the registration request is received from a fixed access gateway function FAGF of an access network serving the FN-RG, the method further comprising:

[0191] In response to receiving the authentication response, a registration acceptance message is sent to the FAGF.

[0192] Embodiment 17. The method according to embodiment 16, wherein the authentication response includes a virtual security anchor function SEAF key K SEAF , which is to represent that the FN-RG is used for non-access layer communications within the core network, the method further comprising:

[0193] In response to receiving the authentication response, a registration acceptance message is sent to the FAGF.

[0194] Embodiment 18. A method according to any one of embodiments 1 to 7, wherein determining that authentication of the FN-RG is not required is performed in a user authentication function AUSF function of the core network.

[0195] Embodiment 19. The method according to embodiment 18, wherein the identifier of the FN-RG is included in a hidden user identity SUCI associated with the FN-RG, and wherein the method further comprises:

[0196] sending an authentication acquisition request from the AUSF to a unified data management (UDM) function of the core network, the authentication acquisition request including the SUCI and an indication that authentication of the FN-RG is not required; and

[0197] An authentication get response is received at the AUSF from the UDM, the authentication get response including a user permanent identifier SUPI associated with the FN-RG.

[0198] Embodiment 20. The method of embodiment 19, wherein the authentication acquisition response includes a virtual authentication vector to be used on behalf of the FN-RG for non-access stratum communication with the core network.

[0199] Embodiment 21. A method according to embodiment 19 or 20, wherein the authentication acquisition response includes an indication that authentication of the FN-RG to the core network is not required.

[0200] Embodiment 22. The method according to any one of embodiments 18 to 21, further comprising:

[0201] receiving, at the AUSF, an authentication request from an access and mobility management function AMF in the core network, the authentication request including a user concealed identity SUCI associated with the FN-RG; and

[0202] An authentication response is sent to the AMF, which includes the User Permanent Identity SUPI associated with the FN-RG.

[0203] Embodiment 23. The method according to embodiment 22 further comprises:

[0204] The virtual security anchor function SEAF key KSEAF is sent to the AMF in the authentication response, which is to be used for non-access stratum communications within the core network on behalf of the FN-RG.

[0205] Embodiment 24. A method in a unified data management (UDM) function of a core network of a wireless communication system, comprising:

[0206] At the UDM, receiving (1002) an authentication acquisition request from a user authentication function AUSF function of the core network, the authentication acquisition request requesting authentication of the fixed network residential gateway FN-RG and including an identifier of the FN-RG;

[0207] Based on the identifier of the FN-RG, determining (1006) that authentication of the FN-RG is not required; and

[0208] An authentication acquisition response is sent (1008) to the AUSF, the authentication acquisition response including an indication that authentication of the FN-RG is not required.

[0209] Embodiment 25. The method of embodiment 24, wherein the identifier of the FN-RG is included in a hidden user identity SUCI associated with the FN-RG, and wherein the method further comprises:

[0210] The SUCI is de-hidden (1004) by the UDM to obtain the user permanent identity SUPI associated with the FN-RG.

[0211] Embodiment 26. The method according to embodiment 24 or 25, wherein the authentication acquisition request includes an indication that authentication of the FN-RG to the core network is not required.

[0212] Embodiment 27. The method according to any one of embodiments 24 to 26, wherein the authentication acquisition response further includes a virtual authentication vector, which is used to represent the FN-RG for non-access layer communication with the core network.

[0213] Embodiment 28. A method in an access and mobility management function (AMF) function of a core network of a wireless communication system, the method comprising:

[0214] At the AMF, receiving (1102) a registration request for registering the fixed network residential gateway FN-RG with the core network, the registration request including an identifier of the FN-RG; and

[0215] Based on the identifier of the FN-RG, it is determined (1104) that authentication of the FN-RG is not required.

[0216] Embodiment 29. The method according to embodiment 28, further comprising:

[0217] In response to determining that authentication of the FN-RG is not required, the FN-RG is registered (1110) without authentication.

[0218] Embodiment 30. The method of Embodiment 28, wherein the identifier comprises a line ID associated with the FN-RG.

[0219] Embodiment 31. A method according to embodiment 28, 29 or 30, wherein the registration request is received from a fixed access gateway function FAGF.

[0220] Embodiment 32. The method according to embodiment 1 further comprises:

[0221] Receiving an indication from FAGF that FN-RG is credible;

[0222] Therein, determination is made that authentication of the FN-RG is not required based in part on an indication from the FAGF.

[0223] Embodiment 33. The method of claim 32, wherein the indication comprises a flag associated with the registration request.

[0224] Embodiment 34. The method according to any one of embodiments 28 to 33, wherein the identifier is included in a hidden user identity (SUCI) included in the registration request.

[0225] Embodiment 35. The method of embodiment 28, wherein the identifier of the FN-RG is included in a hidden user identity SUCI associated with the FN-RG, and wherein the method further comprises:

[0226] Sending (1106) an authentication request from the AMF to a User Authorization Function (AUSF) of the core network, the authentication request including the SUCI; and

[0227] An authentication response is received (1108) at the AMF from the AUSF, the authentication response including a user permanent identifier SUPI associated with the FN-RG and an indication that authentication of the FN-RG is not required.

[0228] Embodiment 36. The method of claim 35, wherein the registration request is received from a fixed access gateway function FAGF, the method further comprising:

[0229] In response to receiving the authentication response, a registration acceptance message is sent to the FAGF.

[0230] Embodiment 37. The method of claim 36, wherein the authentication response includes a virtual security anchor function SEAF key K SEAF , which is to represent that the FN-RG is used for non-access layer communication with the core network, the method also includes:

[0231] In response to receiving the authentication response, a registration acceptance message is sent to the FAGF.

[0232] Embodiment 38. A method in an authentication server function AUSF of a core network of a wireless communication system, comprising:

[0233] receiving (1202) at the AUSF an authentication request from an access and mobility management function AMF in the core network, the authentication request comprising an identifier of the fixed-node residential gateway FN-RG;

[0234] Based on the identifier of the FN-RG, determining (1204) that authentication of the FN-RG is not required; and

[0235] An authentication response is sent (1210) to the AMF, the authentication response including an indication that authentication of the FN-RG is not required.

[0236] Embodiment 39. The method of embodiment 38, wherein the identifier of the FN-RG is included in a hidden user identity SUCI associated with the FN-RG, and wherein the method further comprises:

[0237] sending (1206) an authentication acquisition request from the AUSF to a unified data management (UDM) function of the core network, the authentication acquisition request including the SUCI and an indication that authentication of the FN-RG is not required; and

[0238] An authentication get response is received (1208) at the AUSF from the UDM, the authentication get response including a user permanent identifier SUPI associated with the FN-RG.

[0239] Embodiment 40. The method of claim 39, wherein the authentication acquisition response includes an indication that authentication of the FN-RG is not required.

[0240] Embodiment 41. The method of embodiment 39, wherein the authentication acquisition response includes a virtual authentication vector to be used on behalf of the FN-RG for non-access stratum communication with the core network.

[0241] Embodiment 42. The method according to embodiment 38, further comprising:

[0242] In the authentication response, a virtual security anchor function SEAF key KSEAF is sent to the AMF, which is to be used on behalf of the FN-RG for non-access stratum communication with the core network.

[0243] Embodiment 43. A network node (300), comprising:

[0244] Processor circuit (306);

[0245] a network interface (304) coupled to the processor circuit; and

[0246] A memory (308) coupled to the processor circuit, the memory comprising machine-readable program instructions that, when executed by the processor circuit, cause the UE to perform operations including operations according to any one of embodiments 1 to 42.

[0247] Embodiment 44. A computer program comprising a program code to be executed by a processing circuit (306) of a core network CN node (300), wherein the CN node (300) is configured to operate in a communication network, whereby execution of the program code causes the CN node (300) to perform operations described in any one of Embodiments 1 to 42.

[0248] Embodiment 45. A computer program product, comprising a non-transitory storage medium, the non-transitory storage medium comprising a program code to be executed by a processing circuit (306) of a core network RAN ​​node (300), the RAN node (300) being configured to operate in a communication network, whereby execution of the program code causes the CN node (300) to perform operations described in any one of Embodiments 1 to 42.

[0249] Some embodiments contemplated herein will now be described more fully with reference to the accompanying drawings. However, other embodiments are included within the scope of the subject matter disclosed herein, and the disclosed subject matter should not be construed as being limited to the embodiments set forth herein; rather, these embodiments are provided by way of example to convey the scope of the subject matter to those skilled in the art.

[0250] Fig.14 : A wireless network according to some embodiments.

[0251] Although the subject matter described herein may be implemented in any suitable type of system using any suitable components, the embodiments disclosed herein are directed to wireless networks such as Fig.14 For simplicity, Fig.14The wireless network of only depicts network QQ106, network nodes QQ160 and QQ160B, and WDQQ110, QQ110B and QQ110C (also referred to as mobile terminals). In practice, the wireless network may also include any additional elements suitable for supporting communication between wireless devices or between a wireless device and another communication device (such as a route phone, a service provider, or any other network node or terminal device). In the components shown, network node QQ160 and wireless device (WD) QQ110 are depicted with additional details. The wireless network may provide communication and other types of services to one or more wireless devices to facilitate access of wireless devices and / or the use of services provided by or via the wireless network.

[0252] A wireless network may include or interface with any type of communication, telecommunication, data, cellular, and / or radio network or other similar type of system. In some embodiments, a wireless network may be configured to operate according to a specific standard or other type of predefined rules or procedures. Thus, a specific embodiment of a wireless network may implement a communication standard such as a global system for mobile communications (GSM), a universal mobile telecommunications system (UMTS), a long term evolution (LTE), and / or other suitable 2G, 3G, 4G, or 5G standard; a wireless local area network (WLAN) standard such as the IEEE 802.11 standard; and / or any other suitable wireless communication standard such as the Worldwide Interoperability for Microwave Access (Wi Max), Bluetooth, Z-Wave, and / or ZigBee standards.

[0253] The network QQ106 may include one or more backhaul networks, core networks, IP networks, public switched telephone networks (PSTN), packet data networks, optical networks, wide area networks (WANs), local area networks (LANs), wireless local area networks (WLANs), wired networks, wireless networks, metropolitan area networks, and other networks to enable communication between devices.

[0254] The network node QQ160 and WD QQ110 include various components described in more detail below. These components work together to provide network node and / or wireless device functions, such as providing wireless connections in a wireless network. In different embodiments, the wireless network may include any number of wired or wireless networks, network nodes, base stations, controllers, wireless devices, relay stations, and / or any other components or systems that may facilitate or participate in the communication of data and signals via a wired or wireless connection.

[0255] As used herein, a network node refers to a device that is capable of, configured to, set to, and / or operable to communicate directly or indirectly with a wireless device and / or with other network nodes or devices in a wireless network to enable and / or provide wireless access to a wireless device and / or perform other functions (e.g., management) in a wireless network. Examples of network nodes include, but are not limited to, access points (APs) (e.g., radio access points), base stations (BSs) (e.g., radio base stations, node Bs, evolved node Bs (eNBs), and NR NodeBs (gNBs)). They can be classified based on the amount of coverage provided by the base station (or in other words, their transmit power levels), and they can also be referred to as femto base stations, pico base stations, micro base stations, or macro base stations. A base station can be a relay node or a relay donor node that controls a relay. A network node may also include one or more (or all) parts of a distributed radio base station such as a centralized digital unit and / or a remote radio unit (RRU), sometimes also referred to as a remote radio head (RRH). Such a remote radio unit may or may not be integrated with an antenna as an antenna-integrated radio. Parts of a distributed radio base station may also be referred to as nodes in a distributed antenna system (DAS). Yet another example of a network node includes an MSR device such as a multi-standard radio (MSR) BS, a network controller such as a radio network controller (RNC) or a base station controller (BSC), a base transceiver station (BTS), a transmission point, a transmission node, a multi-cell / multicast coordination entity (MCE), a core network node (e.g., MSC, MME), an O&M node, an OSS node, a SON node, a positioning node (e.g., E-SMLC), and / or an MDT. As another example, a network node may be a virtual network node as described in more detail below. However, more generally, a network node may represent any suitable device (or group of devices) that is capable of, configured to, arranged to, and / or operable to enable and / or provide a wireless device with access to a wireless network or to provide some service to a wireless device that has accessed a wireless network.

[0256] exist Fig.14 In the embodiment, the network node QQ160 includes a processing circuit QQ170, a device readable medium QQ180, an interface QQ190, an auxiliary device QQ184, a power supply QQ186, a power supply circuit QQ187, and an antenna QQ162. Fig.14The network node QQ160 shown in the exemplary wireless network may represent a device including a combination of the hardware components shown, but other embodiments may include network nodes with different combinations of components. It should be understood that the network node includes any suitable combination of hardware and / or software required to perform the tasks, features, functions, and methods disclosed herein. In addition, although the components of the network node QQ160 are depicted as a single box within a larger box or nested within multiple boxes, in practice, the network node may include multiple different physical components that make up a single shown component (for example, the device readable medium QQ180 may include multiple separate hard drives and multiple RAM modules).

[0257] Similarly, network node QQ160 can be composed of multiple physically separated components (e.g., NodeB components and RNC components, or BTS components and BSC components, etc.), and each component can have its own corresponding components. In some scenarios where network node QQ160 includes multiple separate components (e.g., BTS and BSC components), one or more separate components can be shared between several network nodes. For example, a single RNC can control multiple NodeBs. In this scenario, each unique NodeB and RNC pair can be regarded as a separate network node in some instances. In some embodiments, network node QQ160 can be configured to support multiple radio access technologies (RATs). In this embodiment, some components can be copied (e.g., separate device-readable media QQ180 for different RATs) and some components can be reused (e.g., the same antenna QQ162 can be shared by RATs). Network node QQ160 can also include various components shown in multiple groups for different wireless technologies (such as GSM, WCDMA, LTE, NR, WiFi, or Bluetooth wireless technology) integrated into network node QQ160. These wireless technologies may be integrated into the same or different chips or chipsets and other components within network node QQ 160 .

[0258] The processing circuit QQ170 is configured to perform any determination, calculation, or similar operation (e.g., certain obtaining operations) described herein as being provided by the network node. Such operations performed by the processing circuit QQ170 may include processing information obtained by the processing circuit QQ170, for example, by converting the obtained information into other information, comparing the obtained information or the converted information with information stored in the network node, and / or performing one or more operations based on the obtained information or the converted information, and making a determination as a result of the processing.

[0259] The processing circuit QQ170 may include a microprocessor, a controller, a microcontroller, a central processing unit, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or any other suitable computing device, resource, or a combination of hardware, software and / or encoded logic that is operable to provide the functions of the network node QQ160 alone or in combination with other network node QQ160 components such as device readable medium QQ180. For example, the processing circuit QQ170 may execute instructions stored in the device readable medium QQ180 or in a memory within the processing circuit QQ170. Such functions may include providing any of the various wireless features, functions, or benefits discussed herein. In some embodiments, the processing circuit QQ170 may include a system on a chip (SOC).

[0260] In some embodiments, the processing circuit QQ170 may include one or more of a radio frequency (RF) transceiver circuit QQ172 and a baseband processing circuit QQ174. In some embodiments, the radio frequency (RF) transceiver circuit QQ172 and the baseband processing circuit QQ174 may be on separate chips (or chipsets), boards, or units such as a radio unit and a digital unit. In alternative embodiments, part or all of the RF transceiver circuit QQ172 and the baseband processing circuit QQ174 may be on the same chip or chipset, board, or unit.

[0261] In certain embodiments, some or all of the functions described herein as being provided by a network node, base station, eNB or other such network device can be performed by processing circuit QQ170 executing instructions stored on a device-readable medium QQ180 or a memory in processing circuit QQ170. In alternative embodiments, some or all of the functions can be provided by processing circuit QQ170 without the need to perform instructions stored on a separate or discrete device-readable medium such as in a hard-wired manner. In any of those embodiments, whether or not to execute instructions stored on a device-readable storage medium, processing circuit QQ170 can be configured to perform the described functions. The benefits provided by such functions are not limited to processing circuit QQ170 or other components of network node QQ160 alone, but are enjoyed by network node QQ160 as a whole, and / or generally by end users and wireless networks.

[0262] The device-readable medium QQ180 may include any form of volatile or non-volatile computer-readable memory that stores information, data, and / or instructions that can be used by the processing circuit QQ170, including but not limited to permanent storage devices, solid-state memory, remotely mounted memory, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), mass storage media (e.g., hard disk), removable storage media (e.g., flash drive, compact disk (CD) or digital video disk (DVD)), and / or any other volatile or non-volatile, non-transitory device-readable and / or computer-executable storage device. The device-readable medium QQ180 may store any suitable instructions, data or information, including computer programs, software, applications including one or more of logic, rules, codes, tables, etc., and / or other instructions that can be executed by the processing circuit QQ170 and used by the network node QQ160. The device-readable medium QQ180 may be used to store any calculations performed by the processing circuit QQ170 and / or any data received via the interface QQ190. In some embodiments, the processing circuit QQ170 and the device-readable medium QQ180 may be considered to be integrated.

[0263] Interface QQ190 is used in wired or wireless communication of signaling and / or data between network node QQ160, network QQ106 and / or WD QQ110. As shown, interface QQ190 includes port / terminal QQ194 to send and receive data, such as sending data to network QQ106 and receiving data from network QQ106 via wired connection. Interface QQ190 also includes radio front-end circuit QQ192 that can be coupled to antenna QQ162, or in some embodiments, coupled to a part of antenna QQ162. Radio front-end circuit QQ192 includes filter QQ198 and amplifier QQ196. Radio front-end circuit QQ192 can be connected to antenna QQ162 and processing circuit QQ170. Radio front-end circuit QQ192 can be configured to adjust the signal transmitted between antenna QQ162 and processing circuit QQ170. Radio front-end circuit QQ192 can receive digital data that will be sent outward to other network nodes or WDs via wireless connection. The radio front end circuit QQ192 may convert the digital data into a radio signal having appropriate channel and bandwidth parameters using a combination of filters QQ198 and / or amplifiers QQ196. The radio signal may then be transmitted via antenna QQ162. Similarly, when receiving data, antenna QQ162 may collect the radio signal, which is then converted into digital data by the radio front end circuit QQ192. The digital data may be transmitted to the processing circuit QQ170. In other embodiments, the interface may include different components and / or different combinations of components.

[0264] In some alternative embodiments, the network node QQ160 may not include a separate radio front end circuit QQ192, but rather the processing circuit QQ170 may include the radio front end circuit and may be connected to the antenna QQ162 without a separate radio front end circuit QQ192. Similarly, in some embodiments, all or some of the RF transceiver circuit QQ172 may be considered part of the interface QQ190. In some other embodiments, the interface QQ190 may include one or more ports or terminals QQ194, the radio front end circuit QQ192, and the RF transceiver circuit QQ172 as part of a radio unit (not shown), and the interface QQ190 may communicate with the baseband processing circuit QQ174 as part of a digital unit (not shown).

[0265] Antenna QQ162 may include one or more antennas or antenna arrays configured to send and / or receive wireless signals. Antenna QQ162 may be coupled to the radio front end circuit QQ190 and may be any type of antenna capable of wirelessly sending and receiving data and / or signals. In some embodiments, antenna QQ162 may include one or more omnidirectional sector or flat panel antennas operable to, for example, send / receive radio signals between 2 GHz and 66 GHz. Omnidirectional antennas may be used to send / receive radio signals in any direction, sector antennas may be used to send / receive radio signals from devices within a specific area, and flat panel antennas may be line of sight antennas for sending / receiving radio signals in a relatively straight line. In some instances, using more than one antenna may be referred to as MIMO. In some embodiments, antenna QQ162 may be separated from network node QQ160 and may be connected to network node QQ160 via an interface or port.

[0266] Antenna QQ162, interface QQ190 and / or processing circuit QQ170 can be configured to perform any receiving operation and / or certain obtaining operation described herein as being performed by a network node. Any information, data and / or signal can be received from a wireless device, another network node and / or any other network device. Similarly, antenna QQ162, interface QQ190 and / or processing circuit QQ170 can be configured to perform any sending operation described herein as being performed by a network node. Any information, data and / or signal can be sent to a wireless device, another network node and / or any other network device.

[0267] The power circuit QQ187 may include or be coupled to a power management circuit, and is configured to provide power to the components of the network node QQ160 for performing the functions described herein. The power circuit QQ187 may receive power from the power supply QQ186. The power supply QQ186 and / or the power circuit QQ187 may be configured to provide power to the various components of the network node QQ160 in a form suitable for the corresponding components (e.g., at the voltage and current levels required by each corresponding component). The power supply QQ186 may be included in the power circuit QQ187 and / or the network node QQ160, or outside the power circuit QQ187 and / or the network node QQ160. For example, the network node QQ160 may be connected to an external power source (e.g., a power outlet) via an input circuit or an interface such as a cable, whereby the external power source provides power to the power circuit QQ187. As another example, the power supply QQ186 may include a power source in the form of a battery or a battery pack, which is connected to or integrated into the power circuit QQ187. If the external power supply fails, the battery can provide backup power. Other types of power supplies, such as photovoltaic devices, may also be used.

[0268] Alternative embodiments of network node QQ 160 may include Fig.14 , which may be responsible for providing certain aspects of the functionality of the network node, including any functionality described herein and / or any functionality necessary to support the subject matter described herein. For example, the network node QQ 160 may include a user interface device to allow information to be input into the network node QQ 160 and to allow information to be output from the network node QQ 160. This may allow a user to perform diagnostics, maintenance, repair, and other management functions on the network node QQ 160.

[0269] As used herein, wireless device (WD) refers to a device that can, is configured to, is set to, and / or is operable to wirelessly communicate with a network node and / or other wireless devices. Unless otherwise specified, the term WD can be used interchangeably with user equipment (UE) in this article. Wireless communication can involve the use of electromagnetic waves, radio waves, infrared waves, and / or other types of signals suitable for transmitting information through the air to send and / or receive wireless signals. In some embodiments, WD can be configured to send and / or receive information without direct human interaction. For example, WD can be designed to send information to the network on a predetermined schedule when triggered by an internal or external event, or in response to a request from the network. Examples of WD include but are not limited to smart phones, mobile phones, cellular phones, voice over IP (VoIP) phones, wireless local loop phones, desktop computers, personal digital assistants (PDAs), wireless cameras, game consoles or devices, music storage devices, playback devices, wearable terminal devices, wireless endpoints, mobile stations, tablet computers, laptop computers, laptop embedded devices (LEEs), laptop mounted devices (LMEs), smart devices, wireless customer end devices (CPEs), vehicle-mounted wireless terminal devices, etc. WD can support device-to-device (D2D) communication, for example, by implementing 3GPP standards for sidelink communication, vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), and vehicle-to-everything (V2X), and in this case can be referred to as a D2D communication device. As another specific example, in the Internet of Things (loT) scenario, WD can represent a machine or other device that performs monitoring and / or measurement and sends the results of such monitoring and / or measurement to another WD and / or network node. In this case, WD can be a machine-to-machine (M2M) device, which can be referred to as an MTC device in the 3GPP context. As a specific example, WD can be a UE that implements the 3GPP narrowband Internet of Things (NB-loT) standard. Specific examples of such machines or devices are sensors, metering devices such as power meters, industrial machinery, or household or personal appliances (e.g., refrigerators, televisions, etc.), personal wearable devices (e.g., watches, fitness trackers, etc.). In other scenarios, WD can represent a vehicle or other device that can monitor and / or report its operating status or other functions associated with its operation. As mentioned above, WD can represent the end point of wireless connection, in which case, the device can be referred to as a wireless terminal. In addition, as mentioned above, WD can be mobile, in which case, it can also be referred to as a mobile device or a mobile terminal.

[0270] As shown, the wireless device QQ110 includes an antenna QQ111, an interface QQ114, a processing circuit QQ120, a device-readable medium QQ130, a user interface device QQ132, an auxiliary device QQ134, a power supply QQ136, and a power supply circuit QQ137. The WD QQ110 may include multiple groups of one or more of the various components shown for different wireless technologies supported by the WD QQ110, such as GSM, WCDMA, LTE, NR, WiFi, WiMAX, or Bluetooth wireless technologies, to name a few. These wireless technologies may be integrated into the same or different chips or chipsets and other components within the WD QQ110.

[0271] Antenna QQ111 may include one or more antennas or antenna arrays configured to send and / or receive wireless signals, and is connected to interface QQ114. In some alternative embodiments, antenna QQ111 may be separated from WD QQ110 and may be connected to WD QQ110 via an interface or port. Antenna QQ111, interface QQ114, and / or processing circuit QQ120 may be configured to perform any receiving or sending operation described herein as being performed by WD. Any information, data, and / or signal may be received from a network node and / or another WD. In some embodiments, radio front-end circuitry and / or antenna QQ111 may be considered as an interface.

[0272] As shown, the interface QQ114 includes a radio front-end circuit QQ112 and an antenna QQ111. The radio front-end circuit QQ112 includes one or more filters QQ118 and an amplifier QQ116. The radio front-end circuit QQ114 is connected to the antenna QQ111 and the processing circuit QQ120, and is configured to adjust the signal transmitted between the antenna QQ111 and the processing circuit QQ120. The radio front-end circuit QQ112 may be coupled to the antenna QQ111 or a portion of the antenna QQ111. In some embodiments, the WD QQ110 may not include a separate radio front-end circuit QQ112; instead, the processing circuit QQ120 may include a radio front-end circuit and may be connected to the antenna QQ111. Similarly, in some embodiments, some or all of the RF transceiver circuit QQ122 may be considered as part of the interface QQ114. The radio front-end circuit QQ112 may receive digital data to be sent outward to other network nodes or WDs via a wireless connection. The radio front-end circuit QQ112 may convert the digital data into a radio signal with suitable channel and bandwidth parameters using a combination of filters QQ118 and / or amplifiers QQ116. The radio signal may then be transmitted via the antenna. Similarly, when receiving data, the antenna QQ111 may collect the radio signal, which is then converted into digital data by the radio front end circuit QQ112. The digital data may be transmitted to the processing circuit QQ120. In other embodiments, the interface may include different components and / or different combinations of components.

[0273] The processing circuit QQ120 may include a combination of one or more of a microprocessor, a controller, a microcontroller, a central processing unit, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software, and / or encoded logic operable to provide the functionality of the WD QQ110, either alone or in conjunction with other WD QQ110 components such as device readable medium QQ130. Such functionality may include providing any of the various wireless features or benefits discussed herein. For example, the processing circuit QQ120 may execute instructions stored in the device readable medium QQ130 or in a memory within the processing circuit QQ120 to provide the functionality disclosed herein.

[0274] As shown, the processing circuit QQ120 includes one or more of the RF transceiver circuit QQ122, the baseband processing circuit QQ124, and the application processing circuit QQ126. In other embodiments, the processing circuit may include different components and / or different combinations of components. In some embodiments, the processing circuit QQ120 of the WD QQ110 may include a SOC. In some embodiments, the RF transceiver circuit QQ122, the baseband processing circuit QQ124, and the application processing circuit QQ126 may be on a separate chip or chipset. In an alternative embodiment, part or all of the baseband processing circuit QQ124 and the application processing circuit QQ126 may be combined into one chip or chipset, and the RF transceiver circuit QQ122 may be on a separate chip or chipset. In another alternative embodiment, part or all of the RF transceiver circuit QQ122 and the baseband processing circuit QQ124 may be on the same chip or chipset, and the application processing circuit QQ126 may be on a separate chip or chipset. In another alternative embodiment, part or all of the RF transceiver circuit QQ122, baseband processing circuit QQ124, and application processing circuit QQ126 may be combined into the same chip or chipset. In some embodiments, the RF transceiver circuit QQ122 may be part of the interface QQ114. The RF transceiver circuit QQ122 may condition the RF signal for the processing circuit QQ120.

[0275] In certain embodiments, some or all of the functions described herein as being performed by WD may be provided by processing circuit QQ120 executing instructions stored on device-readable medium QQ130, which may be a computer-readable storage medium in certain embodiments. In alternative embodiments, some or all of the functions may be provided by processing circuit QQ120 without the need to execute instructions stored on a separate or discrete device-readable medium, such as in a hard-wired manner. In any of those particular embodiments, processing circuit QQ120 may be configured to perform the described functions, regardless of whether instructions stored on a device-readable storage medium are executed. The benefits provided by such functionality are not limited solely to processing circuit QQ120 or other components of WD QQ110, but are enjoyed by WD QQ110 as a whole, and / or generally by end users and wireless networks.

[0276] Processing circuit QQ120 may be configured to perform any determination, calculation, or similar operation (e.g., certain obtaining operations) described herein as being performed by the WD. Such operations performed by processing circuit QQ120 may include processing information obtained by processing circuit QQ120, such as by converting the obtained information into other information, comparing the obtained information or the converted information with information stored by WD QQ110, and / or performing one or more operations based on the obtained information or the converted information, and making determinations as a result of the processing.

[0277] The device readable medium QQ130 may be operable to store computer programs, software, applications including one or more of logic, rules, codes, tables, etc., and / or other instructions that can be executed by the processing circuit QQ120. The device readable medium QQ130 may include a computer memory (e.g., random access memory (RAM) or read-only memory (ROM)) that stores information, data, and / or instructions that can be used by the processing circuit 1120, a mass storage medium (e.g., a hard disk), a removable storage medium (e.g., a compact disk (CD) or a digital video disk (DVD)), and / or any other volatile or non-volatile, non-temporary device readable and / or computer executable storage device. In some embodiments, the processing circuit QQ120 and the device readable medium QQ130 may be considered to be integrated. The user interface device QQ132 may provide a component that allows a human user to interact with the WD 1110. This interaction may have multiple forms, such as visual, auditory, tactile, etc. The user interface device QQ132 may be operable to generate output to the user and allow the user to provide input to the WD QQ110. The type of interaction can vary depending on the type of user interface device QQ132 installed in WD QQ110. For example, if WD QQ110 is a smart phone, the interaction can be via a touch screen; if WD QQ110 is a smart meter, the interaction can be through a screen that provides usage (e.g., the number of gallons used) or a speaker that provides an audible alarm (e.g., if smoke is detected). The user interface device QQ132 may include input interfaces, devices, and circuits, as well as output interfaces, devices, and circuits. The user interface device QQ132 is configured to allow information to be input into the WD QQ110, and is connected to the processing circuit QQ120 to allow the processing circuit QQ120 to process the input information. The user interface device QQ132 may include, for example, a microphone, a proximity sensor or other sensor, a key / button, a touch display, one or more cameras, a USB port, or other input circuits. The user interface device 1132 is also configured to allow information to be output from the WD1110, and allows the processing circuit QQ120 to output information from the WD QQ110. User interface device QQ132 may include, for example, a speaker, a display, a vibration circuit, a USB port, a headphone jack, or other output circuits. Using one or more input and output interfaces, devices, and circuits of user interface device QQ132, WD QQ110 may communicate with end users and / or wireless networks and allow them to benefit from the functionality described herein.

[0278] The auxiliary device QQ134 is operable to provide more specific functions that may not normally be performed by the WD. This may include specialized sensors for measuring for various purposes, interfaces for additional communication types such as wired communications, etc. The inclusion and types of components of the auxiliary device QQ134 may vary depending on the embodiment and / or scenario.

[0279] In some embodiments, the power source QQ136 may be in the form of a battery or a battery pack. Other types of power sources may also be used, such as an external power source (e.g., a power outlet), a photovoltaic device, or a battery cell. The WD QQ110 may also include a power circuit QQ137 for delivering power from the power source QQ136 to various parts of the WD QQ210 that require power from the power source QQ136 to perform any function described or indicated herein. In some embodiments, the power circuit QQ137 may include a power management circuit. Additionally or alternatively, the power circuit QQ137 may be operable to receive power from an external power source; in this case, the WD QQ110 may be connected to an external power source (such as a power outlet) via an input circuit or an interface such as a power cord. In some embodiments, the power circuit QQ137 may also be operable to deliver power from an external power source to the power source QQ136. This may be used, for example, for charging the power source QQ136. The power circuit QQ137 may perform any formatting, conversion, or other modification of the power from the power source QQ136 to make the power suitable for each corresponding component of the WD QQ110 being powered.

[0280] Fig.15 : User equipment according to some embodiments

[0281] Fig.15 An embodiment of a UE according to the various aspects described herein is shown. As used herein, a user equipment or UE may not necessarily have a user in terms of a human user who owns and / or operates the associated equipment. Alternatively, a UE may represent a device that is intended to be sold to a human user or operated by a human user but may not be associated with a specific human user or was not originally associated with a specific human user (e.g., a smart sprinkler controller). Alternatively, a UE may represent a device that is not intended to be sold to an end user or operated by an end user but may be associated with the benefit of a user or may be operated for the benefit of a user (e.g., a smart meter). UE QQ2200 may be any UE identified by the Third Generation Partnership Project (3GPP), including NB-loT UE, Machine Type Communication (MTC) UE, and / or enhanced MTC (eMTC) UE. As Fig.15As shown in FIG. 1 , UE QQ 200 is an example of a WD configured to communicate according to one or more communication standards promulgated by the Third Generation Partnership Project (3GPP), such as 3GPP's GSM, UMTS, LTE, and / or 5G standards. As previously mentioned, the terms WD and UE may be used interchangeably. Therefore, although Fig.15 The reference is to UE, but the components discussed in this article are also applicable to WD and vice versa.

[0282] exist Fig.15 In the embodiment, UE QQ200 includes a processing circuit QQ201, which is operably coupled to an input / output interface QQ205, a radio frequency (RF) interface QQ209, a network connection interface QQ211, a memory QQ215 including a random access memory (RAM) QQ217, a read-only memory (ROM) QQ219, and a storage medium QQ221, a communication subsystem QQ231, a power supply QQ233, and / or any other components or any combination thereof. The storage medium QQ221 includes an operating system QQ223, an application QQ225, and data QQ227. In other embodiments, the storage medium QQ221 may include other similar types of information. Some UEs may use Fig.15 All components shown in the UE may be used, or only a subset of these components may be used. The level of integration between components may vary from one UE to another. Further, some UEs may contain multiple instances of a component, such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0283] exist Fig.15 In the embodiment of the present invention, the processing circuit QQ201 can be configured to process computer instructions and data. The processing circuit QQ201 can be configured to implement any sequential state machine operable to execute machine instructions stored as a machine-readable computer program in a memory, such as one or more hardware-implemented state machines (e.g., using discrete logic, FPGA, ASIC, etc.); programmable logic and suitable firmware; one or more stored programs, general-purpose processors such as microprocessors or digital signal processors (DSPs) and suitable software; or any combination of the above. For example, the processing circuit QQ201 may include two central processing units (CPUs). The data may be information in a form suitable for use by a computer.

[0284] In the described embodiment, the input / output interface QQ205 may be configured to provide a communication interface to an input device, an output device, or an input and output device. The UE QQ200 may be configured to use an output device via the input / output interface QQ205. The output device may use an interface port of the same type as the input device. For example, a USB port may be used to provide input to the UE QQ200 and output from the UE QQ200. The output device may be a speaker, a sound card, a video card, a display, a monitor, a printer, an actuator, a transmitter, a smart card, another output device, or any combination thereof. The UE QQ200 may be configured to use an input device via the input / output interface QQ205 to allow the user to capture information into the UE QQ200. The input device may include a touch-sensitive display or a presence-sensitive display, a camera (e.g., a digital camera, a digital video camera, a webcam, etc.), a microphone, a sensor, a mouse, a trackball, a steering wheel, a trackpad, a roller, a smart card, etc. The presence-sensitive display may include a capacitive or resistive touch sensor for sensing input from the user. The sensor can be, for example, an accelerometer, a gyroscope, a tilt sensor, a force sensor, a magnetometer, an optical sensor, a proximity sensor, another similar sensor, or any combination thereof. For example, the input device can be an accelerometer, a magnetometer, a digital camera, a microphone, and an optical sensor.

[0285] exist Fig.15 In the embodiment of the present invention, the RF interface QQ209 can be configured to provide a communication interface to RF components such as transmitters, receivers, and antennas. The network connection interface QQ211 can be configured to provide a communication interface to the network QQ243a. The network QQ243a can include a wired and / or wireless network, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a telecommunications network, another similar network, or any combination thereof. For example, the network QQ243a can include a Wi-Fi network. The network connection interface QQ211 can be configured to include a receiver and a transmitter interface for communicating with one or more other devices through a communication network according to one or more communication protocols such as Ethernet, TCP / IP, SONET, ATM, etc. The network connection interface QQ211 can implement receiver and transmitter functions suitable for communication network links (e.g., optical, electrical, etc.). The transmitter and receiver functions can share circuit components, software or firmware, or can be implemented separately.

[0286] RAM QQ217 can be configured to be connected to the processing circuit QQ201 interface via bus QQ202, to provide storage or cache of data or computer instructions during the execution of software programs such as operating systems, applications, and device drivers. ROM QQ219 can be configured to provide computer instructions or data to processing circuit QQ301. For example, ROM QQ219 can be configured to store constant low-level system code or data for basic system functions such as basic input and output (I / O) stored in non-volatile memory, startup, or receiving keystrokes from a keyboard. Storage medium QQ221 can be configured to include a memory such as RAM, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), disk, optical disk, floppy disk, hard disk, removable cassette, or flash drive. In one example, storage medium QQ321 can be configured to include an operating system QQ223, an application QQ225 such as a web browser application, a widget or a gadget engine or another application, and a data file QQ227. The storage medium QQ 221 may store any one of various operating systems or a combination of operating systems for use by the UE QQ 200 .

[0287] The storage medium QQ221 may be configured to include multiple physical drive units, such as a redundant array of independent disks (RAID), a floppy disk drive, a flash memory, a USB flash drive, an external hard drive, a thumb drive, a pen drive, a key drive, a high-density digital versatile disc (HD-DVD) optical drive, an internal hard drive, a Blu-ray optical drive, a holographic digital data storage (HDDS) optical drive, an external mini dual in-line memory module (DIMM), a synchronous dynamic random access memory (SDRAM), an external micro DIMM SDRAM, a smart card memory such as a user identity module or a removable user identity (SIM / RUIM) module, other memory, or any combination thereof. The storage medium QQ221 may allow the UEQQ200 to access computer executable instructions, applications, etc. stored on a temporary or non-temporary storage medium to unload data or upload data. An article of manufacture (such as an article of manufacture utilizing a communication system) may be tangibly embodied in the storage medium QQ221, which may include a device-readable medium.

[0288] exist Fig.15In the embodiment of the present invention, the processing circuit QQ201 can be configured to communicate with the network QQ243b using the communication subsystem QQ231. The network QQ243a and the network QQ243b can be the same network or different networks. The communication subsystem QQ231 can be configured to include one or more transceivers for communicating with the network QQ243b. For example, the communication subsystem QQ231 can be configured to include one or more transceivers for communicating with one or more remote transceivers of another device capable of wireless communication such as another WD, UE or a base station of a radio access network (RAN) according to one or more communication protocols such as IEEE 802.QQ2, CDMA, WCDMA, GSM, LTE, UTRAN, WiMax, etc. Each transceiver can include a transmitter QQ233 and / or a receiver QQ235 to respectively implement the functions of a transmitter or a receiver suitable for a RAN link (e.g., frequency allocation, etc.). Further, the transmitter QQ233 and the receiver QQ235 of each transceiver can share circuit components, software or firmware, or can alternatively be implemented separately.

[0289] In the illustrated embodiment, the communication functions of the communication subsystem QQ231 may include data communication, voice communication, multimedia communication, short-range communication such as Bluetooth, near-field communication, location-based communication such as using a global positioning system (GPS) to determine a location, another similar communication function, or any combination thereof. For example, the communication subsystem QQ231 may include cellular communication, Wi-Fi communication, Bluetooth communication, and GPS communication. The network QQ243b may cover wired and / or wireless networks, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a telecommunications network, another similar network, or any combination thereof. For example, the network QQ243b may be a cellular network, a Wi-Fi network, and / or a near-field network. The power supply QQ213 may be configured to provide alternating current (AC) or direct current (DC) to the components of the UE QQ200.

[0290] The features, benefits and / or functions described herein may be implemented in one of the components of UE QQ200, or may be divided between multiple components of UE QQ200. In addition, the features, benefits and / or functions described herein may be implemented in any combination of hardware, software or firmware. In one example, the communication subsystem QQ231 may be configured to include any component described herein. Further, the processing circuit QQ201 may be configured to communicate with any such component via bus QQ202. In another example, any such component may be represented by program instructions stored in a memory that perform corresponding functions described herein when executed by the processing circuit QQ201. In another example, the functions of any such component may be divided between the processing circuit QQ201 and the communication subsystem QQ231. In another example, the non-computationally intensive functions of any such component may be implemented in software or firmware, and the computationally intensive functions may be implemented in hardware.

[0291] Fig.16 : Virtualized environment according to some embodiments

[0292] Fig.16 is a schematic block diagram showing a virtualization environment QQ300 in which functions implemented by some embodiments can be virtualized. In the current context, virtualization means creating a virtual version of an apparatus or device that may include a virtualized hardware platform, storage device, and networking resources. As used herein, virtualization can be applied to a node (e.g., a virtualized base station or a virtualized radio access node) or a device (e.g., a UE, a wireless device, or any other type of communication device) or a component thereof, and involves an implementation in which at least a portion of a function is implemented as one or more virtual components (e.g., via one or more applications, components, functions, virtual machines, or containers executed on one or more physical processing nodes in one or more networks).

[0293] In some embodiments, some or all of the functionality described herein may be implemented as virtual components executed by one or more virtual machines implemented in one or more virtual environments QQ300 hosted by one or more hardware nodes QQ330. Further, in embodiments where the virtual nodes are not radio access nodes or do not require radio connectivity (e.g., core network nodes), the network nodes may be fully virtualized.

[0294] Functionality may be implemented by one or more applications QQ320 (alternatively referred to as software instances, virtual devices, network functions, virtual nodes, virtual network functions, etc.) operable to implement some functionality, features, and / or benefits of some embodiments disclosed herein. Applications QQ320 run in a virtualization environment QQ400 that provides hardware QQ330 including processing circuitry QQ360 and memory QQ390. Memory QQ390 contains instructions QQ395 executable by processing circuitry QQ360, whereby applications QQ320 are operable to provide one or more features, benefits, and / or functionality disclosed herein.

[0295] The virtualized environment QQ300 includes a general-purpose or special-purpose network hardware device QQ330, which includes a set of one or more processors or processing circuits QQ360, which can be commercial off-the-shelf (COTS) processors, specialized application-specific integrated circuits (ASICs), or any other type of processing circuits, including digital or analog hardware components or special-purpose processors. Each hardware device may include a memory QQ390-1, which may be a non-permanent memory for temporarily storing instructions QQ395 or software executed by the processing circuit QQ360. Each hardware device may include one or more network interface controllers (NICs) QQ370, also known as network interface cards, which include a physical network interface QQ380. Each hardware device may also include a non-temporary, permanent, machine-readable storage medium QQ390-2 in which software QQ395 and / or instructions executable by the processing circuit QQ360 are stored. Software QQ395 may include any type of software, including software for instantiating one or more virtualization layers QQ350 (also referred to as a hypervisor), software for executing virtual machines QQ340, and software that enables it to perform functions, features and / or benefits related to some of the embodiments described herein.

[0296] Virtual machine QQ340 includes virtual processing, virtual memory, virtual networking or interface, and virtual storage device, and can be run by corresponding virtualization layer QQ350 or hypervisor. Different embodiments of instances of virtual device QQ320 can be implemented on one or more virtual machines QQ340, and can be implemented in different ways.

[0297] During operation, processing circuit QQ360 executes software QQ395 to instantiate a hypervisor or virtualization layer QQ350, which may sometimes be referred to as a virtual machine monitor (VMM). Virtualization layer QQ350 may present a virtual operating platform that appears to networked hardware to virtual machine QQ340.

[0298] like Fig.16As shown in , hardware QQ330 can be an independent network node with common or specific components. Hardware QQ330 can include antenna QQ3225, and some functions can be implemented via virtualization. Alternatively, hardware QQ330 can be part of a larger hardware cluster (e.g., such as in a data center or customer premise equipment (CPE)), where multiple hardware nodes work together and are managed via management and orchestration (MANO) QQ3100 (which oversees the life cycle management of application QQ320 together with other programs).

[0299] In some contexts, virtualization of hardware is referred to as network function virtualization (NFV). NFV can be used to consolidate multiple network device types onto industry-standard high-volume server hardware, physical switches, and physical storage devices that can be located in data centers and client devices.

[0300] In the context of NFV, a virtual machine QQ340 may be a software implementation of a physical machine that runs programs as if they were executed on a physical, non-virtual machine. Each virtual machine QQ340 and the portion of the hardware QQ330 that executes the virtual machine, i.e., the hardware dedicated to the virtual machine and / or the hardware shared by the virtual machine with other virtual machines QQ340, form a separate virtual network element (VNE).

[0301] Still in the context of NFV, a virtual network function (VNF) is responsible for handling specific network functions running in one or more virtual machines QQ340 on top of the hardware networking infrastructure QQ330 and corresponds to Fig.16 Application QQ320.

[0302] In some embodiments, one or more radio units QQ3200, each including one or more transmitters QQ3220 and one or more receivers QQ3210, may be coupled to one or more antennas QQ3225. The radio unit QQ3200 may communicate directly with the hardware node QQ330 via one or more suitable networks, and may be used in conjunction with virtual components to provide radio functionality to a virtual node such as a radio access node or base station.

[0303] In some embodiments, some signaling may be implemented using the control system QQ3230 , which may alternatively be used for communication between the hardware node QQ330 and the radio unit QQ3200 .

[0304] Fig.17 : A telecommunications network connected to a host computer via an intermediate network according to some embodiments.

[0305] refer to Fig.17According to an embodiment, a communication system includes a telecommunication network QQ410 such as a cellular network of the 3GPP type, which includes an access network QQ411 such as a radio access network and a core network 1414. The access network QQ411 includes a plurality of base stations QQ412a, QQ412b, QQ412c, such as NB, eNB, gNB or other types of wireless access points, each of which defines a corresponding coverage area QQ413a, QQ413b, QQ413c. Each base station QQ412a, QQ412b, QQ412c can be connected to the core network QQ414 via a wired or wireless connection QQ415. A first UE QQ491 located in the coverage area QQ413c is configured to be wirelessly connected to the corresponding base station QQ412c or to be paged by the corresponding base station QQ412c. A second UE QQ492 located in the coverage area QQ413a can be wirelessly connected to the corresponding base station QQ412a. Although multiple UEs QQ491 , QQ492 are shown in this example, the disclosed embodiments are equally applicable to situations where only a UE is in the coverage area or a only UE is connected to the corresponding base station QQ412 .

[0306] The telecommunications network QQ410 itself is connected to a host computer QQ430, which may be embodied in the hardware and / or software of a standalone server, a cloud-implemented server, a distributed server, or as a processing resource in a server farm. The host computer QQ430 may be under the ownership or control of a service provider, or may be operated by or on behalf of a service provider. The connections QQ421 and 1422 between the telecommunications network QQ410 and the host computer QQ430 may extend directly from the core network QQ414 to the host computer 1430, or may be connected via an optional intermediate network QQ420. The intermediate network QQ420 may be one or a combination of more than one of a public, private, or managed network; the intermediate network QQ420 (if any) may be a backbone network or the Internet; in particular, the intermediate network QQ420 may include two or more subnetworks (not shown).

[0307] Fig.17The communication system as a whole implements a connection between the connected UE QQ491, QQ492 and the host computer QQ430. The connection can be described as an over-the-top (OTT) connection QQ450. The host computer QQ430 and the connected UE QQ491, QQ492 are configured to use the access network QQ411, the core network QQ414, any intermediate network QQ420 and possible other infrastructure (not shown) as intermediaries to transmit data and / or signaling via the OTT connection QQ450. The OTT connection QQ450 can be transparent in the sense that the participating communication devices through which the OTT connection QQ450 passes do not know the routes of the uplink and downlink communications. For example, the base station QQ412 may not or need not be informed of the past routes of the incoming downlink communications, wherein the incoming downlink communications have data that originates from the host computer QQ430 and will be forwarded (e.g., handed over) to the connected UE QQ491. Similarly, base station QQ412 need not be aware of the future routing of outgoing uplink communications originating from UE QQ491 to host computer QQ430.

[0308] Fig.18 : According to some embodiments, a host computer communicates with a user device via a base station over a partially wireless connection.

[0309] Now refer to Fig.18 To describe the exemplary implementation of the UE, base station and host computer discussed in the previous paragraphs according to the embodiment. In the communication system QQ500, the host computer QQ510 includes hardware QQ515, which includes a communication interface QQ516 configured to establish and maintain a wired or wireless connection with the interface of different communication devices in the communication system QQ500. The host computer QQ510 also includes a processing circuit QQ518, which may have storage and / or processing capabilities. In particular, the processing circuit QQ518 may include one or more programmable processors, application specific integrated circuits, field programmable gate arrays, or a combination of these components (not shown) suitable for executing instructions. The host computer QQ510 also includes software QQ511, which is stored in the host computer QQ510 or can be accessed by it, and can be executed by the processing circuit QQ518. The software QQ511 includes a host application QQ512. The host application QQ512 may be operable to provide services to a remote user, such as a UE QQ530 connected via an OTT connection QQ550 terminating at the UE QQ530 and the host computer QQ510. In providing services to the remote user, the host application QQ512 may provide user data sent using the OTT connection QQ550.

[0310] The communication system QQ500 also includes a base station QQ520, which is provided in the telecommunication system and includes hardware 1525 enabling it to communicate with the host computer QQ510 and the UE QQ530. The hardware QQ525 may include a communication interface QQ526 for establishing and maintaining a wired or wireless connection with different communication devices in the communication system QQ500, and hardware 1526 for establishing and maintaining a connection with at least those located in the coverage area served by the base station QQ520 (not in the coverage area). Fig.18 The communication interface QQ526 may be configured to facilitate a connection QQ560 to the host computer QQ510. The connection QQ560 may be direct, or it may pass through a core network (not shown in FIG. 1 ) in the telecommunications system. Fig.18 ) and / or through one or more intermediate networks external to the telecommunications system. In the illustrated embodiment, the hardware QQ525 of the base station QQ520 also includes processing circuitry QQ528, which may include one or more programmable processors, application specific integrated circuit systems, field programmable gate arrays, or a combination of these components (not shown) suitable for executing instructions. The base station QQ520 also has software QQ521 that is stored internally or accessible via an external connection.

[0311] The communication system QQ500 also includes the UE QQ530 already mentioned. Its hardware QQ535 may include a radio interface QQ537, which is configured to establish and maintain a wireless connection QQ570 with a base station serving the coverage area where the UE 1530 is currently located. The hardware 1535 of the UE QQ530 also includes a processing circuit QQ538, which may include one or more programmable processors, a dedicated integrated circuit system, a field programmable gate array, or a combination of these components (not shown) suitable for executing instructions. The UE QQ530 also includes software QQ531, which is stored in the UE QQ530 or can be accessed by it and can be executed by the processing circuit QQ538. The software QQ531 includes a client application QQ532. The client application QQ532 can be operated with the support of the host computer QQ510 to provide services to human or non-human users via the UE QQ530. In the host computer QQ510, the executing host application QQ512 can communicate with the executing client application QQ532 via the OTT connection QQ550 terminated at the UE QQ530 and the host computer QQ510. When providing services to users, the client application QQ532 can receive request data from the host application QQ512, and provide user data in response to the request data. The OTT connection QQ550 can transmit both the request data and the user data. The client application QQ532 can interact with the user to generate the user data it provides.

[0312] Notice, Fig.18 The host computer QQ510, base station QQ520 and UE QQ530 shown in FIG. Fig.17 The host computer QQ430, one of the base stations QQ412A, QQ412B, QQ412C, and one of the UEs QQ491, QQ492 are similar or identical. That is, the internal workings of these entities can be similar to Fig.18 As shown in , and independently, the surrounding network topology can be Fig.17 Those in .

[0313] exist Fig.18 , an OTT connection QQ550 has been abstractly drawn to illustrate the communication between the host computer QQ510 and the UE QQ530 via the base station QQ520, without explicit reference to any intermediate devices and the precise message routing via these devices. The network infrastructure can determine the routing, which can be configured to be hidden from the UE QQ530 or the service provider operating the host computer QQ510, or both. When the OTT connection QQ550 is active, the network infrastructure can further make decisions by which it dynamically changes the routing (e.g., based on load balancing considerations or reconfiguration of the network).

[0314] The wireless connection QQ570 between the UE QQ530 and the base station QQ520 is in accordance with the teachings of the embodiments described in the present disclosure. One or more of the various embodiments may improve the performance of OTT services provided to the UE QQ530 using the OTT connection QQ550, where the wireless connection QQ570 constitutes the last segment. More precisely, the teachings of these embodiments may improve deblocking filtering for video processing, thereby providing benefits such as improved video encoding and / or decoding.

[0315] A measurement process may be provided for the purpose of monitoring data rate, latency, and other factors that one or more embodiments improve. There may also be an optional network function for reconfiguring the OTT connection QQ550 between the host computer QQ510 and the UE QQ530 in response to changes in the measurement results. The measurement process and / or network function for reconfiguring the OTT connection QQ550 may be implemented in the software QQ511 and hardware QQ515 of the host computer QQ510 or the software QQ531 and hardware QQ535 of the UE QQ530, or both. In an embodiment, a sensor (not shown) may be deployed in or associated with a communication device through which the OTT connection QQ550 passes; the sensor may participate in the measurement process by providing the value of the monitoring quantity exemplified above, or providing the value of other physical quantities (software QQ511, QQ531 may calculate or estimate the monitoring quantity based on the other physical quantities). The reconfiguration of the OTT connection QQ550 may include message format, retransmission settings, preferred routing, etc.; the reconfiguration does not need to affect the base station QQ520, and it may be unknown or imperceptible to the base station QQ520. Such processes and functions may be known and practiced in the art. In certain embodiments, the measurements may involve proprietary UE signaling that facilitates measurements of throughput, propagation time, latency, etc. by the host computer QQ510. These measurements may be implemented while software QQ511 and QQ531 monitor propagation time, errors, etc. by causing messages (especially empty messages or "dummy" messages) to be sent using the OTT connection QQ550.

[0316] Fig.19 : A method implemented in a communication system including a host computer, a base station and a user equipment according to some embodiments.

[0317] Fig.19 is a flow chart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station and a UE, which can be reference Fig.17 and Fig.18 For the sake of simplicity of this disclosure, only the Fig.19. In step QQ610, the host computer provides user data. In sub-step QQ611 of step QQ610 (which may be optional), the host computer provides the user data by executing a host application. In step QQ620, the host computer initiates a transmission to the UE carrying the user data. In step QQ630 (which may be optional), in accordance with the teachings of the embodiments described in the present disclosure, the base station sends the user data carried in the transmission initiated by the host computer to the UE. In step QQ640 (which may also be optional), the UE executes a client application associated with the host application executed by the host computer.

[0318] Fig. 20 : A method implemented in a communication system including a host computer, a base station and a user equipment according to some embodiments.

[0319] Fig. 20 is a flow chart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station and a UE, which can be reference Fig.17 and Fig.18 For the sake of simplicity of this disclosure, only the Fig. 20 . In step QQ710 of the method, the host computer provides user data. In an optional sub-step (not shown), the host computer provides the user data by executing a host application. In step QQ720, the host computer initiates a transmission to the UE carrying the user data. According to the teachings of the embodiments described in the present disclosure, the transmission may pass through a base station. In step QQ730 (which may be optional), the UE receives the user data carried in the transmission.

[0320] Fig.21 : A method implemented in a communication system including a host computer, a base station and a user equipment according to some embodiments.

[0321] Fig.21 is a flow chart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station and a UE, which can be reference Fig.17 and Fig.18 For the sake of simplicity of this disclosure, only the Fig.21. In step QQ810 (which may be optional), the UE receives input data provided by the host computer. Additionally or alternatively, in step QQ820, the UE provides user data. In sub-step QQ821 of step QQ820 (which may be optional), the UE provides the user data by executing a client application. In sub-step QQ811 of step QQ810 (which may be optional), the UE executes a client application, which provides the user data in response to the received input data provided by the host computer. When providing the user data, the executed client application may also consider the user input received from the user. Regardless of the specific manner of providing the user data, in sub-step QQ830 (which may be optional), the UE initiates the transmission of the user data to the host computer. In step QQ840 of the method, according to the teachings of the embodiments described in the present disclosure, the host computer receives the user data sent from the UE.

[0322] Fig. 22 : A method implemented in a communication system including a host computer, a base station and a user equipment according to some embodiments.

[0323] Fig. 22 is a flow chart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station and a UE, which can be reference Fig.17 and Fig.18 For the sake of simplicity of this disclosure, only the Fig. 22 In step QQ910 (which may be optional), the base station receives user data from the UE in accordance with the teachings of the embodiments described in the present disclosure. In step QQ920 (which may be optional), the base station initiates transmission of the received user data to the host computer. In step QQ930 (which may be optional), the host computer receives the user data carried in the transmission initiated by the base station.

[0324] Any suitable steps, methods, features, functions or benefits disclosed herein may be performed by one or more functional units or modules of one or more virtual devices. Each virtual device may include a plurality of these functional units. These functional units may be implemented via processing circuits and other digital hardware, wherein the processing circuits may include one or more microprocessors or microcontrollers, and other digital hardware may include digital signal processors (DSPs), dedicated digital logic, etc. The processing circuit may be configured to execute program codes stored in a memory, and the memory may include one or more types of memory, such as a read-only memory (ROM), a random access memory (RAM), a buffer memory, a flash memory device, an optical memory, etc. The program code stored in the memory includes program instructions for executing one or more telecommunications and / or data communication protocols, and instructions for executing one or more technologies described herein. In some implementations, according to one or more embodiments, the processing circuit may be used to cause the corresponding functional unit to perform the corresponding function.

[0325] The term "unit" may have a conventional meaning in the field of electronics, electrical devices and / or electronic devices, and may include, for example, electrical and / or electronic circuits, devices, modules, processors, memories, logical solid-state and / or discrete devices, computer programs or instructions for performing corresponding tasks, processes, calculations, output, and / or display functions, etc. such as those described herein.

[0326] In the above description of various embodiments of the present invention, it should be understood that the terms used in this article are only used for the purpose of describing specific embodiments and are not intended to limit the present invention. Unless otherwise defined, all terms (including technical terms and scientific terms) used in this article have the same meaning as those commonly understood by ordinary technicians in the field to which the present invention belongs. It will be further understood that those terms such as those defined in common dictionaries should be interpreted as having a meaning consistent with their meaning in the context of this specification and related fields, and will not be understood in an idealized or overly formalized manner unless clearly defined in this article.

[0327] When referring to an element "connected", "coupled", "responsive" or its deformation to / in another element, it can be directly connected, coupled or responsive to / in another element or (possibly existing) intermediate element. On the contrary, when referring to an element "directly connected", "directly coupled", "directly responsive" or its deformation to / in another element, there is no intermediate element. The same number always refers to the same element. In addition, "coupling", "connection", "responsive" or its deformation used in this article may include wireless coupling, connection or response. As used in this article, the singular forms "one", "an" and "the" are intended to also include plural forms, unless otherwise clearly stated in the context. For the sake of brevity and / or clarity, well-known functions or configurations may not be described in detail. The term "and / or" includes any and all combinations of one or more associated listed items.

[0328] It will be understood that although the terms first, second, third, etc. can be used in this article to describe various elements / operations, these elements / operations should not be limited by these terms. These terms are only used to distinguish one element / operation from another element / operation. Therefore, without departing from the teaching of the present invention, the first element / operation in some embodiments may be referred to as the second element / operation in other embodiments. In the specification, the same figure mark or reference numeral represents the same or similar element.

[0329] As used herein, the terms "comprises," "including," "having," or variations thereof are open ended and include one or more of the stated features, integers, elements, steps, components, or functions, but do not exclude the presence or addition of one or more other features, integers, elements, steps, components, functions, or groups thereof. In addition, as used herein, the general abbreviation "eg," derived from the Latin phrase "exempli gratia," may be used to introduce or specify a general example or examples of a previously mentioned item, and is not intended to limit such items. The general abbreviation "ie," derived from the Latin phrase "id est," may be used to specify a specific item from a more general narrative.

[0330] Exemplary embodiments are described herein with reference to block diagrams and / or flowchart illustrations of computer-implemented methods, devices (systems and / or equipment), and / or computer program products. It should be understood that the blocks of the block diagrams and / or flowchart illustrations and the combination of blocks in the block diagrams and / or flowchart illustrations can be implemented by computer program instructions executed by one or more computer circuits. These computer program instructions can be provided to a processor circuit of a general-purpose computer circuit, a special-purpose computer circuit, and / or other programmable data processing circuit to produce a machine so that instructions executed via a processor of a computer and / or other programmable data processing device convert and control transistors, values ​​stored in memory locations, and other hardware components within such circuits to implement the functions / actions specified in the block diagrams and / or flowchart boxes, thereby creating components (functions) and / or structures for implementing the functions / actions specified in the block diagrams and / or flowchart boxes.

[0331] These computer program instructions may also be stored in a tangible computer-readable medium, which may instruct a computer or other programmable data processing device to work in a specific manner so that the instructions stored in the computer-readable medium produce an article of manufacture including instructions for implementing the functions / actions specified in the block diagram and / or flowchart block. Therefore, embodiments of the present inventive concept may be embodied in hardware and / or in software (including firmware, resident software, microcode, etc.) running on a processor such as a digital signal processor, which may be collectively referred to as a "circuit", "module" or variations thereof.

[0332] It should also be noted that in some alternative implementations, the function / action shown in the frame may not occur in the order shown in the flow chart. For example, the two frames shown in succession can actually be performed substantially simultaneously, or these frames can sometimes be performed in reverse order, depending on the function / action involved. In addition, the function of a given frame in a flow chart and / or a block diagram can be divided into a plurality of frames and / or the function of two or more frames of a flow chart and / or a block diagram can be integrated at least in part. Finally, without departing from the scope of the present invention, other frames can be added / inserted between the frames shown, and / or frames / operations can be omitted. In addition, although some schematic diagrams include arrows on a communication path to illustrate the main direction of communication, it should be understood that communication can occur in the direction opposite to the arrows shown.

[0333] Without substantially departing from the principles of the inventive concept, many variations and modifications may be made to the embodiments. All of these variations and modifications are intended to be included within the scope of the inventive concept. Therefore, the subject matter disclosed above should be considered illustrative rather than restrictive, and the examples of the embodiments are intended to cover all such modifications, enhancements, and other embodiments that fall within the spirit and scope of the inventive concept. Therefore, to the maximum extent permitted by law, the scope of the inventive concept will be determined by the broadest permissible interpretation of the present disclosure, including examples of the embodiments and their equivalents, and should not be constrained or limited by the foregoing detailed description.

[0334] Generally, all terms used in this article should be interpreted according to their common meaning in the relevant technical field, unless different meanings are clearly given and / or different meanings are implied from the context of its use. Unless clearly stated, all references to one / an / the element, device, assembly, part, step, etc. should be openly interpreted as referring to at least one instance of an element, device, assembly, part, step, etc. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless a step is clearly described as after or before another step and / or it is implied that a step must be after or before another step. Where applicable, any feature of any embodiment disclosed herein can be applied to any other embodiment. Similarly, any advantage of any embodiment can be applied to any other embodiment, and vice versa. Other purposes, features and advantages of the attached embodiments will be apparent from the following description.

[0335] Explanations of abbreviations from the above disclosure are provided below.

[0336] Abbreviations

[0337] 3GPP Third Generation Partnership Project

[0338] 5G Fifth Generation

[0339] AAA authentication, authorization, and accounting

[0340] Anti-bidding between ABBA structures falls

[0341] AKA Authentication and Key Agreement

[0342] AMF Access and Mobility Management Function

[0343] AN Access Network

[0344] AUSF authentication server function

[0345] ARPF authentication credentials repository and processing functions

[0346] AS Access Layer

[0347] AV certification vector

[0348] BBF Broadband Forum

[0349] CA Certificate Authority

[0350] CN Core Network

[0351] C-RNTI Cell Radio Network Temporary Identifier

[0352] DN Data Network

[0353] EAP Extensible Authentication Protocol

[0354] EMSK Extended Master Session Key

[0355] Enb Evolved NodeB (radio base station in LTE)

[0356] FAGF Fixed Access Gateway Function

[0357] FN-RG Fixed Network Residential Gateway

[0358] gNB NR radio base station

[0359] HPLMN belongs to PLMN

[0360] HN Home Network

[0361] IETF Internet Engineering Task Force

[0362] KDF Key Derivation Function

[0363] LTE Long Term Evolution

[0364] MSB Most Significant Bit

[0365] MSK Master Session Key

[0366] ME Mobile Devices

[0367] MNC Mobile Network Code

[0368] MCC Mobile Country Code

[0369] NAS Non-Access Stratum

[0370] NF Network Function

[0371] NRF NF Repository Functionality

[0372] NEF Network Exposure Function

[0373] NSSF network slice selection function

[0374] NPN Non Public Network

[0375] NR New Radio

[0376] OCSP Online Certificate Status Protocol

[0377] PCF Policy Control Function

[0378] PLMN Public Land Mobile Network

[0379] RAN Radio Access Network

[0380] RFC Request for Comments

[0381] SBA Service-Based Architecture

[0382] SLA Service Level Agreement

[0383] SMF session management functions

[0384] SEAF safety anchor function

[0385] SUPI User Permanent Identification

[0386] SUCI user hidden ID

[0387] TLS Transaction Layer Security

[0388] USIM Universal Subscriber Identity Module

[0389] UDM Unified Data Management

[0390] UPF User Plane Function

[0391] UE User Equipment

[0392] VPLMN Visitor PLMN

[0393] W-5GAN Wired 5G Access Node

[0394] X2 Interface / reference point between two eNBs

[0395] Xn Interface / reference point between two gNBs

[0396] References:

[0397] [1] 3GPP TS 33.501v 15.3.1

[0398] [2]3GPP TR 23.716 v.16.0.0

[0399] [3]3GPP TR 33.807v.0.3.0

[0400] [4]3GPP TS 36.300v.15.4.0

[0401] [5]3GPP TS 23.502v.15.4.1

[0402] [6]3GPP TS 38.300v.15.4.0

Claims

1. A method in a unified data management (UDM) function of a core network of a wireless communication system, comprising: receiving (1002) at the UDM an authentication request from a user authentication function AUSF function of the core network, the authentication request requesting authentication of a fixed network residential gateway FN-RG and including an identifier of the FN-RG; Based on the identifier of the FN-RG, determining (1006) that authentication of the FN-RG is not required; as well as An authentication response is sent (1008) to the AUSF, the authentication response including an indication that authentication of the FN-RG is not required.

2. The method according to claim 1, wherein: The identifier of the FN-RG is included in a hidden user identity SUCI associated with the FN-RG, and wherein the method further comprises: The SUCI is de-hidden (1004) by the UDM to obtain a user permanent identity SUPI associated with the FN-RG.

3. The method according to claim 1 or 2, wherein: The authentication response further includes a virtual authentication vector to be used on behalf of the FN-RG for non-access stratum communication with the core network.

4. The method according to claim 1 or 2, wherein: The authentication request comprises an authentication obtain request, and wherein the authentication response comprises an authentication obtain response.

5. A network node (300), comprising: Processor circuit (306); a network interface (304) coupled to the processor circuit; as well as A memory (308) coupled to the processor circuit, the memory comprising machine-readable program instructions which, when executed by the processor circuit, cause the network node to perform a method according to any one of claims 1 to 4.

6. A non-transitory storage medium having program code stored thereon, the program code to be executed by a processing circuit (306) of a network node (300) configured to operate in a communication network, whereby execution of the program code causes the network node (300) to perform a method according to any one of operational claims 1 to 4.

7. A computer program product comprising a non-transitory storage medium on which a program code is stored, the program code to be executed by a processing circuit (306) of a network node (300) configured to operate in a communication network, whereby execution of the program code causes the network node (300) to perform a method according to any one of claims 1 to 4.

Images