Method and system for handling closed access group related procedures

Abstract

Therefore, the example embodiments of the present invention disclose a method for supporting a user equipment (UE) to access one or more closed access group (CAG) cells via a radio access network. A core network device may receive a request signal including a protected CAG identifier (ID) associated with the UE via an interface circuit. The core network device may unhide the protected CAG ID to determine the CAG ID. The proposed method can be used to define how a wireless communication system will perform a subscription check on a received CAG identifier. In addition, the method can also be defined as how to perform a recovery process on a CAG cell when the UE is in a 5G MM-CONNECTED with an inactive indication or a 5G MM-IDLE with a suspended indication.

Description

Technical Field

[0001] The present disclosure relates to a wireless communication system, and, for example, to a method and system for processing a closed access group related procedure in the wireless communication system. Background Art

[0002] The 3rd Generation Partnership Project (3GPP) (TS 23.501) specifies a Public Network Integrated Non-Public Network (PNiPN) as a non-public network (NPN) that is deployed with a public land mobile network (PLMN) that supports the use of closed access groups (CAGs) and / or network slicing. A CAG identifies a group of subscribers that are allowed to access one or more CAG cells. CAG is used for Public Network Integrated Non-Public Networks (PNiNPNs) to prevent user equipment (UE) from automatically selecting and registering from locations where access to the NPN is not provided or where the UE is not allowed to access the NPN. The CAG is identified by a CAG identifier (CAG ID), which is broadcast by the CAG cell. The New Generation Radio Access Network (NG-RAN) supports broadcasting a total of twelve CAG identifiers. In addition, the CAG cell may additionally broadcast a human-readable network name for each CAG identifier.

[0003] Since CAG cells are meant for Public Network Integrated Non-Public Network (PNiNPN), the CAG identifier broadcasted by the network, which may also reveal a human-readable name, is associated with an NPN. Thus, it is possible to establish a relationship between a CAG identifier and the NPN associated therewith.

[0004] According to 3GPP TS 33.502, in case of a service request or registration management procedure, if the UE is accessing the NG-RAN using a CAG cell, the access network (AN) parameters from the UE to the (R)AN (i.e., the RRC information elements delivered to the NG-RAN in an RRC message) include a CAG identifier. The CAG ID is delivered to the network over the air when there is no valid security context (i.e., the UE does not have a Globally Unique Temporary Identifier (GUTI) or the stored GUTI is invalid). Unfortunately, this scenario allows a "man-in-the-middle" attack to correlate possible links between the UE, the Closed Access Group (CAG), and the associated NPN.

[0005] This results in:

[0006] Possible exposure of the privacy of the NPN service that the UE is accessing. NPN means private network and may be privacy sensitive.

[0007] A man-in-the-middle attacker may be able to identify the group of UEs accessing a CAG cell (and their CAG IDs), thereby associating the group of UEs with the NPN they are accessing.

[0008] Independent non-public networks do not rely on the network functionality of public PLMNs. Independent non-public networks may also use closed access groups (CAGs) and / or non-public network identifiers (NPN IDs) to identify groups of NPN subscribers that are allowed to access one or more CAG cells or NPNs.

[0009] In another problem scenario, 3GPP TS 23.501 specifies a Public Network Integrated Non-Public Network (PNiPN) as a Non-Public Network (NPN) that is deployed with a public PLMN that supports the use of CAG and / or network slicing. CAG identifies a group of subscribers that are allowed to access one or more CAG cells. CAG is used for Public Network Integrated Non-Public Network (PNiNPN) to prevent UEs from automatically selecting and registering from locations that do not provide access to the NPN or where the UE is not allowed to access the NPN.

[0010] The UE is configured by the home network with an allowed CAG list, which includes a list of CAG IDs that the UE is allowed to access. The UE uses this list to select a CAG ID / CAG cell to access the PNiNPN. According to 3GPP TS 23.501, if the CAG identifier received from the NG-RAN that the UE attempts to access is not in the UE's allowed CAG list, the access and mobility management function (AMF) of the serving network rejects the non-access stratum (NAS) request with an appropriate cause code, and upon receiving the NAS rejection, the UE removes the CAG identifier from the UE's allowed CAG list, if present, as defined in TS 24.501.

[0011] If the AMF issues an unprotected NAS Reject to the UE in response to its NAS Request, the UE, upon receiving such NAS Reject with an appropriate cause code related to the CAG ID, shall update its list of allowed CAGs by removing the CAG ID from the list, but the authenticity of the NAS Reject message from the AMF cannot be verified. Therefore, the UE will not attempt to access the CAG ID as it is removed from the list of allowed CAGs.

[0012] Considering the above scenario, the attacker delivers an unprotected NAS reject message with an appropriate cause code related to the CAG ID to the UE. When the UE receives the NAS reject message, the UE removes the CAG ID from its allowed CAG list, and therefore, the UE no longer attempts to access the CAG ID. This attack enables the attacker to prevent the UE from accessing the CAG cell (CAG ID), resulting in a denial of service attack on the UE accessing the NPN service via the CAG cell.

[0013] In another problem scenario, after a power cycle, the UE deletes the PLMN specific attempt counter. After power-up, if the UE manually selects a PLMN that is part of the forbidden PLMN (FPLMN) list, the UE will attempt to register with that PLMN. The UE receives a Non-Integrity Protected Reject message from the network. When the PLMN specific attempt counter is reset, after the Non-Integrity Protected Reject message processing, as described in TS 24.501, the UE will retry registration "x" times, where "x" is the maximum value of the PLMN specific attempt counter. These registration re-attempts by the UE create unnecessary signaling load on the network.

[0014] In another problem scenario, the UE attempts to register on PLMN(P1). The UE receives a Non-Integrity Protected Reject with cause #11. The UE increments the PLMN-specific attempt counter. If the UE attempts, for example, 4 times, the PLMN-specific attempt counter is set to 4. Assume in this example that the MAX value achieved by each UE is 5. The UE performs a power cycle and the UE deletes the PLMN-specific attempt counter. After power-on, the UE attempts to register on PLMN P1 again. The UE receives a Non-Integrity Protected Reject message from the network. When the PLMN-specific attempt counter is reset in step 4 in TS 24.501, following the Non-Integrity Protected Reject message handling described in TS 24.501, the UE will retry to register "5" more times when "5" is the maximum value of the PLMN-specific attempt counter. These retries by the UE create unnecessary signaling load on the network.

[0015] In another problem scenario, according to the initial NAS message protection process described in the current 3GPP specifications 25.401 and 33.501, if the UE does not have a valid NAS security context, the UE will send only plaintext IEs in the initial NAS message, and after the NAS security context is established, the UE delivers plaintext IEs and non-plaintext IEs in the security mode complete message. If the UE has a valid 5G NAS security context, the UE delivers plaintext IEs and non-plaintext IEs in the initial NAS message, and the current 5G NAS security context is used to encrypt the plaintext IEs and non-plaintext IEs. New information elements (IEs) low access priority indication, strict periodic registration timer indication, extended DRX (cycle) and closed access group (CAG) identification are delivered in the initial NAS message (e.g., Registration Request message). However, when the UE does not have a valid 5G NAS security context, it is unclear how these parameters are delivered to the network, for example, whether these parameters should be delivered without encryption or with encryption.

[0016] In another problem scenario, according to the current 3GPP TS 23.501, during RRC connection establishment, the UE delivers the selected CAG ID to the NG-RAN during RRC connection establishment, and the NG-RAN forwards the CAG ID to the AMF. The AMF checks whether the UE has a valid subscription to the CAG ID. However, during the transition from 5G MM-CONNECTED with RRC inactive to 5G MM-CONNECTED mode, it is unclear how the AMF will know whether the UE is allowed to access the CAG cell.

[0017] In another problem scenario, according to the current 3GPP TS 23.501, during RRC connection establishment, the UE delivers the selected CAG ID to the NG-RAN during RRC connection establishment, and the NG-RAN forwards the CAG ID to the AMF. The AMF checks whether the UE has a valid subscription to the CAG ID. However, during the transition from 5G MM-IDLE with a suspension indication to 5G MM-CONNECTED mode, it is unclear how the AMF will know whether the UE is allowed to access the CAG cell.

[0018] In another problem scenario, the UE resides on a CAG cell that broadcasts multiple CAG identities of the same public network integrated NPN. The UE has an allowed CAG list that contains more than one broadcasted CAG cell identity. If the UE initiates an RRC connection, the UE selects one of the CAG identifiers broadcast by the CAG present in the allowed CAG list and delivers it during the RRC connection procedure. The NG-RAN then delivers the CAG identifier to the AMF. The AMF checks whether the UE has a subscription associated with the received CAG identifier. If the UE has a subscription associated with the CAG identifier, the network performs a NAS procedure. Otherwise, the network indicates to the UE that the CAG subscription corresponding to the CAG identifier has expired. The network then releases the N1 signaling connection and the NAS procedure is aborted. However, the UE may have a valid subscription to another CAG identifier broadcast in the CAG cell. Therefore, in this case, the UE behaves incorrectly.

[0019] In another problem scenario, in a disaster situation when a large number of UEs generate signaling requests related to CAG identities, the AMF cannot handle all the requests. The AMF becomes congested and may not work properly. In the worst case, the AMF stops working. Currently, the AMF has no process to limit incoming traffic related to CAG identities.

[0020] It would therefore be desirable to address the above-mentioned disadvantages or others, or at least provide a useful alternative. Summary of the invention

[0021] Solution to the problem

[0022] Example embodiments of the present disclosure provide methods and systems for handling closed access group related procedures.

[0023] Therefore, the example embodiments of the present invention disclose a core network device for supporting a user equipment (UE) to access one or more closed access group (CAG) cells via a radio access network. The core network device includes an interface circuit for interfacing with the radio access network and a processing circuit. The processing circuit can be configured to receive a request signal including a protected CAG identifier (ID) associated with the UE via the interface circuit, wherein the protected CAG ID can be used to request the UE to access the CAG cell. The processing circuit can be configured to unhide the protected CAG ID to determine the CAG ID, wherein the protected CAG ID includes the CAG ID.

[0024] In an example embodiment, the processing circuit is further configured to provide the CAG ID for authentication.

[0025] In an example embodiment, the processing circuit is further configured to perform registration of the UE when the CAG ID is authenticated.

[0026] In an example embodiment, the processing circuit is further configured to detect whether the request signal includes an indicator that a protected CAG ID is included in the request signal.

[0027] In an example embodiment, the CAG ID is a CAG ID embedded in a Subscription Hidden Identifier (SUCI) of the UE.

[0028] In an example embodiment, the protected CAG ID is a CAG ID concatenated with a Mobile Subscription Identification Number (MSIN) associated with the UE.

[0029] In an example embodiment, the protected CAG ID is a CAG ID concatenated with a portion of a subscription permanent identifier (SUPI) associated with the UE.

[0030] The example embodiments herein disclose a user equipment (UE) for accessing one or more closed access group (CAG) cells. The UE includes a radio communication circuit and a processing circuit. The processing circuit can be configured to generate a protected CAG identifier (ID) that can be used to request the UE to access the CAG cell. The processing circuit can be configured to provide the protected CAG ID to the radio communication circuit. The radio communication circuit can be configured to send a request signal directed to a core network to a radio access network, wherein the request signal can include a protected CAG ID, and wherein the protected CAG ID can include a CAG ID.

[0031] In an example embodiment, the request signal is a registration request, and the protected CAG ID protects the UE's CAG ID from being linked to an attacker to access a Public Network Integrated Non-Public Network (PNiPN) via a CAG cell.

[0032] In an example embodiment, the processing circuit is further configured to generate a protected CAG ID by embedding the CAG ID in a subscription concealed identifier (SUCI) of the UE.

[0033] In an example embodiment, the protected CAG ID is a CAG ID concatenated with a Mobile Subscription Identification Number (MSIN) associated with the UE.

[0034] In an example embodiment, the protected CAG ID is a CAG ID concatenated with a portion of a subscription permanent identifier (SUPI) associated with the UE.

[0035] In an example embodiment, the processing circuit is further configured to provide an indicator to the radio communication circuit that the protected CAG ID is included in the request signal, wherein the radio communication circuit is configured to send the indicator to the core network via the radio access network.

[0036] The example embodiments of the present invention disclose a non-transitory computer-readable storage medium having computer-readable instructions for accessing one or more closed access group (CAG) cells stored thereon, the computer-readable instructions being configured to instruct one or more processing circuits to generate a protected CAG identifier (ID) that can be used to request a UE to access the CAG cell when executed. The one or more processing circuits can provide a protected CAG ID to a radio communication circuit, and cause a request signal directed to a core network to be sent to a radio access network. The request signal may include a protected CAG ID, wherein the protected CAG ID may include a CAG ID.

[0037] The example embodiments of the present invention disclose a user equipment (UE) for accessing one or more closed access group (CAG) cells. The UE may include a radio communication circuit and a processing circuit. The processing circuit is coupled to the radio communication circuit and is configured to obtain an initial non-access stratum (NAS) message including a CAG identifier (ID) for CAG cell access, the CAG ID being protected by the scheme. The processing circuit may be configured to provide the initial NAS message to the radio communication circuit, and the radio communication circuit may be configured to send the initial NAS message to the radio access network.

[0038] In an example embodiment, the initial NAS message is a Registration Request message for accessing a Public Network Integrated Non-Public Network (PNiPN) via a CAG cell.

[0039] In an example embodiment, the processing circuit is further configured to obtain a protected CAG ID by concatenating the CAG ID with a mobile subscription identification number (MSIN) of the UE.

[0040] In an example embodiment, the processing circuit is further configured to obtain a protected CAG ID by concatenating a subscription identifier of the UE with the CAG ID.

[0041] In an example embodiment, the subscription identifier is part of the UE's International Mobile Subscriber Identity (IMSI).

[0042] In an example embodiment, the subscription identifier is part of the UE's Subscription Permanent Identifier (SUPI).

[0043] In an example embodiment, a protected CAG ID is obtained by hiding the CAG ID in a Subscription Hidden Identifier (SUCI) of the UE.

[0044] The example embodiments herein disclose a method implemented by a user equipment (UE) for accessing one or more closed access group (CAG) cells. The UE may generate a protected CAG identifier (ID) that can be used to request the UE to access the CAG cell through a processing circuit, and provide the protected CAG ID to a radio communication circuit. The UE may send a request signal directed to a core network to a radio access network through a radio communication circuit. The request signal may include a protected CAG ID, wherein the protected CAG ID may include a CAG ID.

[0045] Example embodiments herein disclose a method implemented by a core network device for supporting a user equipment (UE) to access one or more closed access group (CAG) cells via a radio access network. The core network device may receive a request signal including a protected CAG identifier (ID) associated with the UE. The protected CAG ID may be used to request the UE to access the CAG cell. The core network device may unhide the protected CAG ID to determine the CAG ID, wherein the protected CAG ID may include the CAG ID.

[0046] The exemplary embodiments herein disclose a method for processing CAG-related procedures by a UE in a wireless communication system. The UE may trigger an initial registration procedure with at least one of an AMF entity and a SEAF entity. The UE may detect that the UE does not have a valid non-access stratum (NAS) security context. The UE may protect a CAG identifier (CAG ID) based on the detection during the initial registration procedure.

[0047] The exemplary embodiments herein disclose a method for processing a closed access group (CAG) related process in a wireless communication system. A network may receive a radio resource control (RRC) recovery request message from a user equipment (UE). The network may determine, in response to the RRC recovery request message, whether at least one CAG identifier (ID) broadcasted in a CAG cell is included in an allowed CAG list of the UE. In response to determining that at least one CAG ID is included in the allowed CAG list, the network may perform an RRC recovery process.

[0048] In an example embodiment, if at least one CAG ID is not included in the allowed CAG list, the network also releases the RRC connection by delivering an RRC message.

[0049] In an example embodiment, the RRC message is at least one of an RRC Connection Release message and an RRC Connection Reject message.

[0050] In an example embodiment, based on the released RRC connection, the RRC message includes an information element indicating that at least one CAG ID is not subscribed.

[0051] In an example embodiment, based on the released RRC connection, the RRC message includes an allowed CAG list.

[0052] In an example embodiment, at least one CAG ID is determined based on mobility restrictions received from an access and mobility management function (AMF) entity, wherein the network receives an allowed CAG list from the AMF entity.

[0053] In an example embodiment, the mobility restriction corresponds to mobility-related subscription information of the UE, wherein the mobility-related subscription information includes at least one of a radio access technology (RAT) restriction, a prohibited area, a service area restriction, a core network type restriction, and closed access group information.

[0054] In an example embodiment, when the UE initiates an RRC recovery procedure for transitioning from an RRC inactive state to an RRC connected state in a CAG cell, the network receives an RRC recovery request message.

[0055] The example embodiments of the present invention disclose a network for processing closed access group (CAG) related processes in a wireless communication system. The network includes a radio communication circuit and a processing circuit. The processing circuit is coupled to the radio communication circuit and is configured to receive a radio resource control (RRC) recovery request message from a user equipment (UE). The processing circuit is configured to determine whether at least one CAG identifier (ID) broadcasted in the CAG cell is included in the UE's allowed CAG list in response to the RRC recovery request message. The processing circuit is configured to perform an RRC recovery process in response to determining that at least one CAG ID is included in the allowed CAG list.

[0056] In an example embodiment, the processing circuit is configured to release the RRC connection by delivering an RRC message when the at least one CAG ID is not included in the allowed CAG list.

[0057] In an example embodiment, the RRC message is at least one of an RRC Connection Release message and an RRC Connection Reject message.

[0058] In an example embodiment, based on the released RRC connection, the RRC message includes an information element indicating that at least one CAG ID is not subscribed.

[0059] In an example embodiment, based on the released RRC connection, the RRC message includes an allowed CAG list.

[0060] In an example embodiment, the processing circuit is configured to determine at least one CAG identifier based on mobility restrictions received from an access and mobility management function (AMF) entity, wherein the processing circuit is configured to receive an allowed CAG list from the AMF entity, and the processing circuit is configured to receive an RRC recovery request message when the UE initiates an RRC recovery procedure for transitioning from an RRC inactive state to an RRC connected state in a CAG cell.

[0061] In an example embodiment, the mobility restriction corresponds to mobility-related subscription information of the UE, wherein the mobility-related subscription information includes at least one of a radio access technology (RAT) restriction, a prohibited area, a service area restriction, a core network type restriction, and closed access group information.

[0062] Example embodiments herein disclose a method for processing a closed access group (CAG) related process in a wireless communication system. A user equipment (UE) may send a radio resource control (RRC) recovery request message to a network. The UE may receive an RRC recovery message from the network in response to determining that at least one CAG identifier (ID) broadcasted in a CAG cell is in an allowed CAG list of the UE.

[0063] In an example embodiment, when at least one CAG ID broadcast by a CAG cell is not included in an allowed CAG list, the UE may receive a radio resource control (RRC) message from a network including an information element indicating that at least one CAG ID is not subscribed. The UE may receive an RRC message including an allowed CAG list from the network. The UE may perform one of the following: removing at least one CAG ID from the allowed CAG list based on the received information element, and replacing a stored CAG list with the received allowed CAG list based on the received information element.

[0064] In an example embodiment, the RRC message is at least one of an RRC Connection Release message and an RRC Connection Reject message.

[0065] The example embodiments herein disclose a user equipment (UE) for processing a closed access group (CAG) related process in a wireless communication system. The UE includes a radio communication circuit and a processing circuit coupled to the radio communication circuit. The processing circuit can be configured to send a radio resource control (RRC) recovery request message to a network. The processing circuit can be configured to receive an RRC recovery message from the network in response to determining that at least one CAG identifier (ID) broadcasted in a CAG cell is in an allowed CAG list of the UE.

[0066] In an example embodiment, the processing circuit may be further configured to, when at least one CAG ID broadcasted by the CAG cell is not included in the allowed CAG list, receive from the network a radio resource control (RRC) message including an information element indicating that at least one CAG ID is not subscribed, and receive from the network an RRC message including the allowed CAG list, and perform one of the following: removing at least one CAG ID from the allowed CAG list based on the received information element, and replacing the stored CAG list with the received allowed CAG list based on the received information element. The RRC message may be at least one of an RRC connection release message and an RRC connection rejection message.

[0067] In an example embodiment, the CAG ID is protected in a Subscription Hidden Identifier (SUCI).

[0068] In an example embodiment, the method further includes delivering, by the UE, a registration request message including the SUCI with the protected CAG ID to at least one of the AMF entity and the SEAF entity.

[0069] In an example embodiment, the CAG ID is protected in the SUCI by protecting the CAG ID with a subscription permanent identifier (SUPI) into the SUCI.

[0070] In an example embodiment, the UE delivers a Registration Request message including the protected CAG ID as an AN parameter to at least one of the AMF entity and the SEAF entity.

[0071] In an example embodiment, whether a protected CAG ID is present in the SUCI is indicated by the UE to at least one of the AMF entity and the SEAF entity.

[0072] In an example embodiment, when a UE is accessing a New Radio Random Access Network (NG-RAN) using a CAG cell, a CAG ID is protected during an initial Non-Access Stratum (NAS) registration procedure.

[0073] In an example embodiment, during determination of the SUCI, the UE is configured to concatenate the CAG ID with at least one of a mobile subscription identification number (MSIN) and a user name of the UE and generate a scheme output of the SUCI for protecting the CAG ID in the SUCI.

[0074] In an example embodiment, the scheme output is determined based on an Elliptic Curve Cryptography (ECC) ephemeral public key, a ciphertext value, and a Media Access Control (MAC) tag value.

[0075] In an example embodiment, when the SUPI is a type of International Mobile Subscriber Identity (IMSI), the subscription identifier portion of the IMSI is concatenated with the CAG ID to construct a scheme input and generate a scheme output of the SUCI for protecting the CAG ID in the SUCI.

[0076] In an example embodiment, scheme inputs are determined by a protected CAG ID, the home network's public key, and an Elliptic Curve Cryptography (ECC) ephemeral public and private key pair based on Elliptic Curve Integrated Encryption Scheme (ECIES) parameters provided by the home network.

[0077] In an example embodiment, when the SUPI is a type of network specific identifier, the subscription identifier portion of the SUPI is concatenated with the CAG ID and used to construct a scheme input and generate a scheme output of the SUCI to protect the CAG ID in the SUCI.

[0078] The exemplary embodiments of the present invention disclose a method for processing CAG-related procedures in a wireless communication system. One of an AMF entity and a SEAF entity may receive a registration request message including a SUCI with a protected CAG ID from a UE. One of the AMF entity and the SEAF entity may deliver an authentication request message to an AUSF entity based on the registration request message. The authentication request message includes a SUCI with a protected CAG ID. One of the AMF entity and the SEAF entity may initiate a primary authentication procedure based on the authentication request message.

[0079] In an example embodiment, one of the AMF entity and the SEAF entity receives a registration request message and a message including a SUCI with a protected CAG ID in one of N2 parameters from a UE over a new generation radio access network (NG-RAN), wherein the N2 parameter is an information element delivered in a next generation application protocol (NGAP) message over an N2 interface.

[0080] The message can be a Nudm_UEAuthentication_Get_Request message.

[0081] The example embodiments of the present invention disclose a method for processing CAG-related procedures in a wireless communication system. An AUSF entity may receive an authentication request message from one of an AMF entity and a SEAF entity. The authentication request message includes a SUCI with a protected CAG ID. The AUSF entity may deliver an authentication acquisition request message to a UDM, wherein the UDM determines that the authentication request message includes a SUCI with a protected CAG ID. The AUSF entity may receive an authentication acquisition response message from the UDM by unhiding the SUCI as a SUPI and a CAGID by the UDM, wherein the authentication acquisition response message includes the unhidden CAG ID with the SUPI. The AUSF entity may share the authentication acquisition response message from the UDM to at least one of the AMF and the SEAF.

[0082] The exemplary embodiments herein disclose a UE for processing CAG-related procedures in a wireless communication system. The UE includes a processor coupled to a memory. The processor is configured to trigger an initial registration procedure with at least one of an AMF entity and a SEAF entity, and detect that the UE does not have a valid NAS security context while triggering the initial registration procedure. The processor protects the CAG ID based on the detection during the initial registration procedure.

[0083] The example embodiments of the present invention disclose an AMF entity and a SEAF entity for processing CAG-related procedures in a wireless communication system. One of the AMF entity and the SEAF entity includes a processor coupled to a memory. The processor is configured to receive a registration request message including a SUCI with a protected CAG ID from a UE. In addition, the processor is configured to deliver an authentication request message to the AUSF entity based on the registration request message. The authentication request message includes a SUCI with a protected CAG ID. In addition, the processor is configured to initiate a primary authentication process based on the authentication request message.

[0084] The example embodiments of the present invention disclose an AUSF entity for processing CAG-related procedures in a wireless communication system. The AUSF entity includes a processor coupled to a memory. The processor is configured to receive an authentication request message from one of an AMF entity and a SEAF entity. The authentication request message includes a SUCI with a protected CAG ID. In addition, the processor is configured to deliver an authentication acquisition request message to a UDM, wherein the UDM determines that the authentication request message includes a SUCI with a protected CAG ID. In addition, the processor is configured to receive an authentication acquisition response message from the UDM by unhiding the SUCI as a SUPI and a CAG ID using the UDM. The authentication acquisition response message includes a CAG ID unhidden with the SUPI. In addition, the processor is configured to share the authentication acquisition response message from the UDM with at least one of the AMF and the SEAF.

[0085] The example embodiments herein disclose a method for handling CAG-related procedures in a wireless communication system. A UE may trigger an initial registration procedure with at least one of an AMF entity and a SEAF entity. While triggering the initial registration procedure, the UE may detect that the UE does not have a valid non-access stratum (NAS) security context. The UE may deliver an initial NAS message with a plaintext information element (IE), wherein the UE does not include a first information element in the initial NAS message. The UE may create a NAS security context. The UE may send a security mode complete NAS message including a complete initial NAS message, wherein the security mode complete NAS message is encrypted using the NAS security context.

[0086] In an example embodiment, the Security Mode Complete NAS message includes a first IE.

[0087] In an example embodiment, the first IE is a CAG identifier.

[0088] In an example embodiment, creating, by the UE, a NAS security context includes performing an authentication procedure between the UE and the AMF, receiving a security mode command based on the authentication procedure, and creating the NAS security context based on the received security mode command.

[0089] The example embodiments of the present invention disclose a UE for processing CAG-related procedures in a wireless communication system. The UE includes a processor coupled to a memory. The processor triggers an initial registration procedure with at least one of an AMF entity and a SEAF entity, and while triggering the initial registration procedure, the processor detects that the UE does not have a valid NAS security context. In addition, the processor delivers an initial NAS message with a plaintext information element (IE), wherein the UE does not include a first information element in the initial NAS message. In addition, the processor creates a NAS security context and sends a security mode complete NAS message including a complete initial NAS message, wherein the security mode complete NAS message is encrypted using the NAS security context.

[0090] When considered in conjunction with the following description and the accompanying drawings, these and other aspects of the example embodiments herein will be better appreciated and understood. However, it should be understood that the following description, although indicating preferred example embodiments and many specific details thereof, is provided by way of illustration and not limitation. Without departing from the spirit of the present invention, many changes and modifications may be made within the scope of the example embodiments herein, and the example embodiments herein include all of these modifications. BRIEF DESCRIPTION OF THE DRAWINGS

[0091] The above and other aspects, features and advantages of certain example embodiments of the present disclosure will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which:

[0092] Figure 1 is a sequential flow chart illustrating a method for delivering an encrypted CAG identifier when a UE delivers a privacy-protected CAG ID to a network according to an example embodiment disclosed herein;

[0093] Figure 2 is a sequential flow chart illustrating a method for delivering an encrypted CAG identifier upon UE authentication from an AUSF so that the UDE unhides the hidden CAG ID using an asymmetric encryption mechanism according to an example embodiment disclosed herein;

[0094] Figure 3 is a sequential flow chart illustrating an alternative method for delivering an encrypted CAG identifier upon UE authentication from an AUSF so that the UDM unhides the hidden CAG ID using an asymmetric encryption mechanism according to example embodiments disclosed herein;

[0095] Figure 4 is a sequential flow chart illustrating another alternative method for delivering an encrypted CAG identifier upon UE authentication from an AUSF so that the UDM unhides the hidden CAG ID using a symmetric encryption mechanism according to example embodiments disclosed herein;

[0096] Figure 5 is a sequential flow chart illustrating a method for processing a 5GMM cause value "CAG cell not allowed" when the 5GMM cause value "CAG cell not allowed" is received without integrity protection according to an example embodiment disclosed herein;

[0097] Figure 6 is a sequential flow chart illustrating a method for processing a registration reject message when the registration reject message is received without integrity protection according to an example embodiment disclosed herein;

[0098] Figure 7 is a sequential flow chart illustrating a method for transmitting information elements during initial NAS message transmission according to an example embodiment disclosed herein;

[0099] Figure 8 is a sequential flow chart illustrating a method for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein;

[0100] Fig. 9 is a sequential flow chart illustrating an alternative method for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein;

[0101] Fig.10 is a sequential flow chart illustrating another alternative method for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein;

[0102] Fig.11 is a sequential flow chart illustrating another alternative method for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein;

[0103] Fig.12 is a sequential flow chart illustrating another alternative method for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein;

[0104] Fig.13 is a sequential flow chart illustrating another alternative method for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein;

[0105] Fig.14 is a sequential flow chart illustrating another alternative method for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein;

[0106] Fig.15 is a sequential flow chart illustrating a method for processing a CAG ID final according to an example embodiment disclosed herein;

[0107] Fig.16AVarious hardware components of a UE for processing CAG-related procedures in a wireless communication system according to example embodiments disclosed herein are shown;

[0108] Fig. 16B Various hardware components of an AMF entity and a SEAF entity for processing CAG-related procedures in a wireless communication system according to example embodiments disclosed herein are shown;

[0109] Fig. 16C Various hardware components of an AUSF entity for processing CAG-related procedures in a wireless communication system according to example embodiments disclosed herein are shown;

[0110] Fig.16D Various hardware components of a base station (i.e., NG-RAN) for processing CAG-related procedures in a wireless communication system according to example embodiments disclosed herein are shown;

[0111] Fig.17A is a flow chart illustrating a method implemented by a UE for processing CAG-related procedures in a wireless communication system according to an example embodiment disclosed herein;

[0112] Fig. 17B is a flowchart illustrating a method implemented by an AMF entity or a SEAF entity for processing CAG-related procedures in a wireless communication system according to an example embodiment disclosed herein;

[0113] Fig. 17C is a flow chart illustrating a method implemented by an AUSF entity for handling CAG-related procedures in a wireless communication system according to an example embodiment disclosed herein;

[0114] Fig.17D is a flowchart illustrating a method for processing a CAG-related procedure in a wireless communication system according to an example embodiment disclosed herein; and

[0115] Fig.17E is a flowchart illustrating a method implemented by a UE for processing a CAG-related procedure in a wireless communication system according to an example embodiment disclosed herein.

[0116] Fig.18A is a flow chart illustrating a method implemented by a core network apparatus for supporting a UE to access one or more closed access group (CAG) cells via a radio access network according to an example embodiment disclosed herein;

[0117] Fig.18B is a flow chart illustrating a method implemented by a UE for accessing one or more CAG cells according to example embodiments disclosed herein;

[0118] Fig.18C is a flow chart illustrating a method implemented by a UE for accessing one or more CAG cells according to example embodiments disclosed herein. DETAILED DESCRIPTION

[0119] The example embodiments of this article and their various features and advantageous details are explained more fully with reference to the non-limiting example embodiments illustrated in the accompanying drawings and described in detail in the following description. Descriptions of well-known components and processing techniques are omitted so as not to unnecessarily obscure the example embodiments of this article. In addition, the various example embodiments described herein are not necessarily mutually exclusive, as some example embodiments can be combined with one or more other example embodiments to form new example embodiments. Unless otherwise stated, the term "or" as used herein refers to a non-exclusive or. The examples used herein are intended only to facilitate understanding of the manner in which the example embodiments of this article can be practiced, and further enable those skilled in the art to practice the example embodiments of this article. Therefore, the examples should not be interpreted as limiting the scope of the example embodiments herein.

[0120] As is conventional in the art, example embodiments may be described and illustrated according to blocks that perform one or more functions described. These blocks, which may be referred to herein as circuits or units or modules, etc., are physically implemented by analog or digital circuits such as logic gates, radio communication circuits, interface circuits, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hard-wired circuits, etc., and may be optionally driven by firmware and software. For example, the circuit may be embodied in one or more semiconductor chips, or embodied on substrate supports such as printed circuit boards. The circuits constituting the blocks may be implemented by dedicated hardware, or by a processor or processing circuit (e.g., one or more programmed microprocessors and associated circuits), or by a combination of dedicated hardware that performs some functions of the blocks and processors that perform other functions of the blocks. Without departing from the scope of the present invention, each block of the example embodiment may be physically separated into two or more interacting and discrete blocks. Similarly, without departing from the scope of the present invention, the blocks of the example embodiment may be physically combined into more complex blocks.

[0121] The accompanying drawings are used to help easily understand various technical features, and it should be understood that the example embodiments presented herein are not limited by the accompanying drawings. Therefore, the present disclosure should be interpreted as extending to any changes, equivalents and substitutes other than those specifically set forth in the accompanying drawings. Although the terms first, second, etc. can be used herein to describe various elements, these elements should not be limited by these terms. These terms are usually only used to distinguish one element from another element.

[0122] The following definitions and abbreviations apply to the patent disclosure:

[0123] 5GC: 5G Core Network

[0124] 5GLAN: 5G Local Area Network

[0125] 5GS: 5G System

[0126] 5G-AN: 5G Access Network

[0127] 5G-EIR: 5G-Equipment Identity Register

[0128] 5G-GUTI: 5G Globally Unique Temporary Identifier

[0129] 5G-BRG: 5G Broadband Residential Gateway

[0130] 5G-CRG: 5G Cable Residential Gateway

[0131] 5G-RG: 5G Residential Gateway

[0132] 5G-S-TMSI: 5G-S-Temporary Mobile Subscription Identifier

[0133] 5QI: 5G QoS Identifier

[0134] AF: Application Function

[0135] AMF: Access and Mobility Management Function

[0136] AS: Access layer

[0137] ATSSS: Access Traffic Steering, Switching and Segmentation

[0138] ATSSS-LL: ATSSS Low Level

[0139] AUSF: Authentication Server Function

[0140] BSF: Binding Support Function

[0141] CAG: Closed Access Group

[0142] CAPIF: Common API Framework for 3GPP Northbound APIs

[0143] CHF: Billing function

[0144] CP: Control Plane

[0145] DL: Downlink

[0146] DN: Data Network

[0147] DNAI: DN Access Identifier

[0148] DNN: Data Network Name

[0149] DRX: Discontinuous Reception

[0150] ePDG: Evolved Packet Data Gateway

[0151] EBI: EPS Bearer Identifier

[0152] FAR: Forward Action Rule

[0153] FN-BRG: Fixed Network Broadband RG

[0154] EN-CRG: Fixed network cable RG

[0155] FN-RG: Fixed Network RG

[0156] FQDN: Fully Qualified Domain Name

[0157] GFBR: Guaranteed Streaming Bit Rate

[0158] GMLC: Gateway Mobile Location Center

[0159] GPSI: General Public Subscription Identifier

[0160] GUAMI: Globally Unique AMF Identifier

[0161] HR: Home Router (Roaming)

[0162] I-SMF: Intermediate SMF

[0163] LADN: Local Area Data Network

[0164] LBO: Local Breakout (Roaming)

[0165] LMF: Location Management Function

[0166] LRF: Location Retrieval Function

[0167] MCX: Mission Critical Services

[0168] MDBV: Maximum Data Burst Capacity

[0169] MFBR: Maximum traffic bit rate

[0170] MICO: Mobile-initiated connections only

[0171] MPS: Multimedia Priority Service

[0172] MPTCP: Multipath TCP Protocol

[0173] N3IWF: Non-3GPP Interworking Function

[0174] NAI: Network Access Identifier

[0175] NEF: Network Exposure Function

[0176] NF: Network Function

[0177] NGAP: Next Generation Application Protocol

[0178] NID: Network Identifier

[0179] NPN: Non Public Network

[0180] NR: New Radio

[0181] NRF: Network Repository Function

[0182] NSI ID: Network Slice Instance Identifier

[0183] NSSAI: Network Slice Selection Assistance Information

[0184] NSSF: Network Slice Selection Function

[0185] NSSP: Network Slice Selection Strategy

[0186] NWDAF; Network data analysis function

[0187] PCF: Policy Control Function

[0188] PDR: Packet Detection Rules

[0189] PDU: Protocol Data Unit

[0190] PEI: Persistent Equipment Identifier

[0191] PER: Packet Error Rate

[0192] PFD: Packet Flow Description

[0193] PPD: Paging Policy Difference

[0194] PPF: Paging Progress Flag

[0195] PPI: Paging Policy Indicator

[0196] PSA: PDU Session Anchor

[0197] QFI: QoS Flow Identifier

[0198] QoE: Quality of Experience

[0199] (R)AN: (Radio) Access Network

[0200] RG: Residential Gateway

[0201] RQA: Reflective QoS Attribute

[0202] RQI: Reflective QoS Indication

[0203] RSN: Redundant Sequence Number

[0204] SA NR: Independent New Radio

[0205] SBA: Service Based Architecture

[0206] SBI: Service Based Interface

[0207] SCP: Service Communication Proxy

[0208] SD: Slice Differentiator

[0209] SEAF: Security Anchor Function

[0210] SEPP: Security Edge Protection Proxy

[0211] SMF: Session Management Function

[0212] SMSF: Short Message Service Function

[0213] SN: Serial Number

[0214] SNPN: Standalone Non-Public Network

[0215] S-NSSAI: Single Network Slice Selection Auxiliary Information

[0216] SSC: Session and Service Continuity

[0217] SSCMSP: Session and Service Continuity Mode Selection Policy

[0218] SST: Slice / Serving Type

[0219] SUCI: Subscription Hidden Identifier

[0220] SUPI: Subscription Persistent Identifier

[0221] TNAN: Trusted Non-3GPP Access Network

[0222] TNAP: Trusted Non-3GPP Access Point

[0223] TNGF: Trusted Non-3GPP Gateway Function

[0224] TNL: Transport Network Layer

[0225] TNLA: Transport Network Layer Association

[0226] TSC: Time Sensitive Communication

[0227] TSN: Time Sensitive Networking

[0228] TSP: Traffic Steering Strategy

[0229] UDM: Unified Data Management

[0230] UDR: Unified Data Repository

[0231] UDS: Unstructured data storage function

[0232] UL: Uplink

[0233] UL CL: Uplink Classifier

[0234] UPF: User Plane Function

[0235] URLLC: Ultra-Reliable Low-Latency Communications

[0236] URRP-AMF: UE reachability request parameters for AMF

[0237] URSP: UE Routing Selection Policy

[0238] VID: VLAN identifier

[0239] VLAN: Virtual Local Area Network

[0240] W-5GAN: Wired 5G Access Network

[0241] W-5GBAN: Wired BBF access network

[0242] W-5GCAN: Wired 5G Cable Access Network

[0243] W-AGF: Wired Access Gateway Function

[0244] 5GMM: 5G Mobility Management

[0245] CAG ID: CAG identifier

[0246] NGAP: NG Application Protocol

[0247] AS: Access layer

[0248] NAS: Non-Access Stratum

[0249] CAG identity and CAG identifier are equivalent terms in all example embodiments.

[0250] The core network device may include one of the 5G network entities (AMF, SEAF, UDM, ARPF, SIDF and AUSF). The core network may be connected to the UE (100) via NG-RAN.

[0251] Therefore, the exemplary embodiments of this document disclose a method for processing CAG-related procedures in a wireless communication system. The UE may trigger an initial registration procedure with at least one of an AMF entity and a SEAF entity. The UE may detect that the UE does not have a valid NAS security context while triggering the initial registration procedure, and protect the CAG ID based on the detection during the initial registration procedure.

[0252] Unlike conventional methods and systems, the method can be used to define a process for sending a protected (encrypted and / or integrity protected) CAG identifier. The method can be used to define how the network will perform a subscription check on a received CAG identifier. In addition, the method can also be defined as how to perform a recovery process on a CAG cell when the UE is in a 5G MM-CONNECTED with an inactive indication or a 5G MM-IDLE with a suspended indication.

[0253] Referring now to the drawings and more particularly to Figure 1 to Figure 1 7e, which shows a preferred example embodiment.

[0254] Figure 1 is a sequential flow diagram illustrating various operations for delivering an encrypted CAG identifier when a UE (100) delivers a privacy-preserving CAG ID to a network according to example embodiments disclosed herein.

[0255] The method can be used to prevent privacy exposure of a UE (100) using a CAG cell to access a public network integrated non-public network (PNiPN), and also prevent identification of a UE group that accesses an NPN via a CAG cell. The problem solved is that the UE (100) sends a CAG identifier in plain text format over the air. Various example embodiments described below solve this problem by protecting (e.g., encrypting and / or integrity protecting) the CAG identifier sent over the air to prohibit a man-in-the-middle attacker from identifying the NPN / CAG cell that the UE (100) is attempting to access.

[0256] In an example embodiment, if the unhiding of the privacy protected CAG identifier (CCAG ID) fails at the network (i.e., UDM (400a) / AUSF (500)), the serving network (AMF (300a)) delivers a registration reject message with an appropriate cause value to the UE (100). After successfully unhiding the CCAG ID (i.e., the UE (100) has delivered a valid CAG ID), at the network (UDM (400a) / AUSF), the network performs the main authentication process specified in TS 33.501.

[0257] In an exemplary embodiment, if SEAF (300b) and AMF (300a) are not co-located, then AMF (300a) is connected to AUSF via SEAF (300b). In another embodiment, if SEAF (300b) and AMF (300a) are co-located, then the term "AMF" means "AMF / SEAF" throughout the document.

[0258] In an example embodiment, to support CAG, if the UE (100) is configured with an allowed CAG list by the home network, the home network may also provide a CAG identifier to be privacy protected. Based on this configuration from the home network, when accessing the NG-RAN (200) using a CAG cell, the UE (100) may apply privacy protection to the CAG ID (delivered by the UE (100) to the serving network over the air).

[0259] In an example embodiment, a non-public network identifier (NPN ID) is used instead of or in addition to a CAG identifier (CAG ID) to identify a non-public network and to check whether the UE (100) is subscribed and authorized to access a specific non-public network. NPN-ID is used for an independent non-public network (i.e., a network that does not rely on the network functionality of a public PLMN). Throughout this document, the terms "CAG identifier" and "non-public network identifier" are used interchangeably. In some scenarios, CAGID means CAG-ID and / or NPN-ID.

[0260] In an example embodiment, when the UDM (400a) unhides the protected CAG ID, it may perform a subscription check of the CAG ID (SUPI) of the UE (100). If such a check is performed, the UDM (400a) returns the unhidden CAG ID to the serving network only if the CAG ID is in the allowed CAG list of the UE (100), and if it is not in the list, the UDM (400a) may return a rejection with an appropriate cause value to the serving network. The following example alternative considers not performing a subscription check at the UDM (400a).

[0261] Example alternative 1 (UE (100) delivers a privacy-protected CAG ID to the network during a service request or registration management procedure, when the UE (100) does not have a valid security context (i.e., the UE (100) does not have a globally unique temporary identifier (GUTI) or the stored GUTI is invalid), if the UE is accessing the NG-RAN using a CAG cell, the UE delivers a privacy-protected CAG identifier (CAG ID) to the serving network in an AN parameter. The privacy-protected CAG identifier is referred to as a hidden CAG identifier (CCAG ID) in the present disclosure. The UE (100) constructs the CCAG ID and delivers it to the serving network in the AN parameter. The serving network (i.e., AMF (300a)) receives the hidden CAG ID (CCAG ID) from the UE (100) in a registration request message, or receives the hidden CAG ID (CCAG ID) from the NG-RAN (200) The CCAG ID is forwarded by the AMF (300a) of the serving network to the UDM (400a) of the home network. The UDM (400a) unhides the CCAG ID and provides the CCAG ID to the serving network.

[0262] The AMF (300a) / SEAF (300b) receives the unhidden CAG ID directly from the UDM (400a) (in the HPLMN). The UDM (400a) may provide a service (for illustration purposes, via Nudm (a service-based interface presented by the UDM (400a)) or Nudm_XXX using the N8 interface specified in TS 23.501) to the AMF (300a) of the serving network for unhiding the CCAG ID. During the request of the UE, the AMF (300a) obtains the CCAG ID from the UE (100) (from the UE (100) in a request message), or obtains the CCAG ID in a request message or from the NG-RAN (200) (e.g., via an N2 message). The AMF (300a) requests the unhidden CAG ID from the UDM (400a) via the Nudm_XXX service. The UDM (400a) unhides the CCAG ID of the request message from the AMF (300a) to the CAG ID. Then, the UDM (400a) responds to the request of the AMF based on the result of unhide of the CCAG ID. If the response from the UDM (400a) has the CAG ID, the AMF (300a) stores the CAG ID for the UE (100) to request further procedures.

[0263] Figure 2is a sequential flow chart illustrating various methods for delivering an encrypted CAG identifier after a UE (100) is authenticated by an AUSF (500) so that a UDM (400a) unhides the hidden CAG ID using an asymmetric encryption mechanism according to example embodiments disclosed herein.

[0264] Example alternative 1.a (UDM (400a) unhides the hidden CAG ID using an asymmetric encryption mechanism when the UE (100) authenticates from the AUSF (500)). During a service request or registration management process, when the UE (100) does not have a valid security context (i.e., the UE (100) does not have a GUTI or the stored GUTI is invalid), if the UE (100) is using a CAG cell to access the NG-RAN (200), the UE (100) delivers a privacy-protected CAG identifier (CCAG ID) to the serving network in the AN parameters.

[0265] The CCAG ID is constructed by the UE (100) using the home network public key, a protection scheme and a method for hiding the UE identifier in the SUCI. The UE (100) constructs the CCAG ID and delivers it to the serving network in the AN parameter. The AMF (300a) of the serving network receives the hidden CAG ID (CCAG ID) from the NG-RAN (200) in the N2 parameter. The AMF (300a) of the serving network forwards the CCAG ID to the UDM (400a) of the home network via the AUSF in an authentication request. Upon success of the primary authentication, the UDM (400a) unhides the CCAG ID and provides it to the serving network AMF (300a) via the AUSF (500).

[0266] As part of the Registration Request procedure, the AMF (300a) / SEAF (300b) of the serving network (the serving network may also belong to the HPLMN) initiates the primary authentication procedure by including a hidden CAG identifier (CCAG ID) and other possible parameters in a Nausf_UEAuthentication_Authenticate request message to the AUSF (500). The AMF (300a) receives the CCAG ID from the UE (100) in the Registration Request message, or receives the CCAG ID from the NG-RAN (e.g., via an N2 message). The AUSF (500) includes the CCAG ID and other possible parameters in a Nudm_UEAuthentication_Get_Request message to the UDM (400a). In an example embodiment, the Nudm_UEAuthentication_Get_Request message is shared with the ARPF (400b) / SIDF (400c). The UDM (400a) unhides the SUCI and CCAG ID included in the Nudm_UEAuthentication_Get_Request message. The UDM (400a) unhides the CCAG ID using the same parameters as the home network public key and the protection mechanism and method used to unhide the UE identifier in the SUCI. If the SUCI and CCAG ID are successfully unhidden, the UDM (400a) performs the procedure specified in TS 33.501. The UDM (400a) includes the CAG ID and SUPI in the response message to the AUSF (500), and the AUSF (500) forwards them to the AMF (300a) / SEAF (300b) upon successful authentication.

[0267] Since the home network public key and protection scheme used for SUCI and CCAG ID derivation are the same, the UDM (400a) that unhides the SUCI is also able to unhide the CCAG ID. Delivering the hidden CAG ID (CCAG ID) over the air to the network prevents a man-in-the-middle attacker from identifying the NPN / CAG cell that the UE (100) is trying to access.

[0268] In an exemplary embodiment, when the AMF (300a) of the serving network receives a CAG ID whose UE identification is SUCI (hidden subscription identifier SUPI) from the UE (100), the AMF (300a) considers the received CAG ID to be a hidden CAG ID (CCAG ID), and forwards the CCAG ID and SUCI to the UDM (400a) of the home network to unhide the CCAG ID. If the AMF (300a) of the serving network receives a CAG ID whose UE identification is 5G GUTI (5G temporary identifier of the UE) from the UE (100), the AMF (300a) considers the received CAG ID in the protected NAS container to be not hidden.

[0269] Figure 3 is a sequential flow chart illustrating alternative various operations for delivering an encrypted CAG identifier upon UE authentication from the AUSF (500) so that the UDM unhides the hidden CAG ID using an asymmetric encryption mechanism according to example embodiments disclosed herein.

[0270] Example alternative 1.b (UDM (400a) unhides the hidden CAG ID using an asymmetric encryption mechanism at UE authentication from AUSF (500), during a service request or registration management procedure, when the UE (100) does not have a valid security context (i.e., the UE (100) does not have a GUTI or the stored GUTI is invalid), if the UE (100) is accessing the NG-RAN (200) using a CAG cell, the UE (100) protects the CAG identifier by embedding the CAG identifier (the CAG ID of the CAG cell that the UE (100) is attempting to access) into the UE's SUCI, wherein the UE's SUCI is delivered by the UE (100) to the serving network as the UE identifier.

[0271] The CAG ID is embedded in the SUCI as follows:

[0272] During the calculation of SUCI, the UE (100) concatenates the CAG ID with the MSIN / username and generates a protection scheme output of the home network public key and SUCI.

[0273] When the SUPI is of IMSI type, the subscription identifier part of the IMSI (i.e., MSIN) is concatenated with the CAG ID to construct the scheme input and generate the scheme output of the SUCI.

[0274] When the SUPI is of the network specific identifier type, the subscription identifier part of the SUPI is concatenated with the CAG ID and used to construct the scheme input and generate the scheme output of the SUPI.

[0275] In an example embodiment, a home network public key and a protection scheme output are determined based on an Elliptic Curve Cryptography (ECC) ephemeral public key, a ciphertext value, and a Media Access Control (MAC) tag value.

[0276] In an example embodiment, the home network public key and protection scheme input is determined by the protected CAG ID, the home network's public key, and an elliptic curve cryptography (ECC) ephemeral public and private key pair based on Elliptic Curve Integrated Encryption Scheme (ECIES) parameters provided by the home network.

[0277] When the UE (100) constructs a SUCI by embedding the CAG ID in the SUCI and delivers it as a UE identifier to the serving network, the UE (100) delivers an indicator (“CAG ID in SUCI”) in which the CAG ID is embedded in the SUCI and the SUCI of the UE to the AMF (300a) of the serving network. The AMF (300a) of the serving network, upon receiving the SUCI with the “CAG ID in SUCI” indicator, forwards the SUCI of the UE and the CAG ID indication (“CAG ID in SUCI”) to the UDM (400a) of the home network via the AUSF (500) in an authentication request. Based on the CAG ID indication, the UDM (400a) unhides the SUCI to derive the SUPI and the CAG ID when the primary authentication is successful, and provides them to the serving network AMF (300a) via the AUSF (500).

[0278] As part of the Registration Request procedure, the AMF (300a) / SEAF (300b) of the serving network (the serving network may also belong to the HPLMN) initiates the primary authentication procedure by including the UE's SUCI and the "CAG ID in SUCI" indication and other possible parameters (e.g., serving network information) in a Nausf_UEAuthentication_Authenticate request message to the AUSF (500). The AMF (300a) receives the SUCI and the "CAG ID in SUCI" indication from the UE (100) in the Registration Request message, or receives the SUCI and the "CAG ID in SUCI" indication from the NG-RAN (200) (e.g., through an N2 message). The AUSF (500) includes the SUCI and the "CAG ID in SUCI" indication and other possible parameters in a Nudm_UEAuthentication_Get_Request message to the UDM (400a). Based on the "CAG ID in SUCI" indication from the AUSF (500), the UDM (400a) performs the procedure of unhiding the SUCI into SUPI and CAG ID. The UDM (400a) unhides the SUCI to identify / derive the SUPI and CAG ID using the same mechanism as the UE (100) used to hide the SUPI. If the SUCI and CCAG ID are successfully unhidden, the UDM (400a) performs the procedures specified in TS 33.501. The UDM (400a) includes the CAG ID and SUPI in the response message to the AUSF (500), and the AUSF (500) forwards them to the AMF (300a) / SEAF (300b) upon successful authentication.

[0279] Since the home network public key and the protection scheme used for SUCI and CCAG ID derivation are the same, the UDM (400a) that unhides the SUCI is also able to unhide the CAG ID. Delivering the CAG ID hidden in the SUCI over the air to the network prevents a man-in-the-middle attacker from identifying the NPN / CAG cell that the UE (100) is trying to access.

[0280] Figure 4 is a sequential flow chart illustrating another alternative example method for delivering an encrypted CAG identifier upon UE authentication from an AUSF (500) so that the UDM unhides the hidden CAG ID using a symmetric encryption mechanism according to example embodiments disclosed herein.

[0281] Example alternative 1.c: The UDM (400a) unhides the hidden CAG ID using a symmetric encryption mechanism upon UE authentication from the AUSF (500). During a service request or registration management procedure, when the UE (100) does not have a valid security context (e.g., the UE (100) does not have a GUTI or the stored GUTI is invalid), if the UE (100) is accessing the NG-RAN (200) using a CAG cell, the UE (100) sends a privacy-protected CAG identifier (CCAG ID) to the serving network in an AN parameter.

[0282] The UE (100) constructs the CCAG ID as follows:

[0283] Generates a random value called a Nonce.

[0284] The home network provides / configures a symmetric encryption algorithm for the UE (100) to protect the CAG IDs in the provided allowed CAG list.

[0285] The UE (100) generates a key stream using the Nonce and the UE's SUPI as a key of a symmetric encryption algorithm.

[0286] The generated key stream is XORed with the CAG ID to generate the CCAG ID.

[0287] The UE (100) constructs a CCAG ID and delivers the CCAG ID and Nonce to the serving network in the AN parameters. As part of the Registration Request procedure, the AMF (300a) / SEAF (300b) of the serving network (the serving network may also belong to the HPLMN) initiates the primary authentication procedure by including the hidden CAG identifier (CCAG ID) and Nonce, and other possible parameters, in a Nausf_UEAuthentication_Authenticate request message to the AUSF (500). The AMF (300a) receives the CCAG ID and Nonce from the UE (100) in the Registration Request message, or receives the CCAG ID and Nonce from the NG-RAN (200) (e.g., via an N2 message). The AUSF (500) includes the CCAG ID and Nonce, and other possible parameters, in a Nudm_UEAuthentication_Get_Request message to the UDM (400a). The UDM (400a) performs the process of unhiding the SUCI and CCAG ID included in the Nudm_UEAuthentication_Get_Request message. The UDM (400a) unhides the SUCI and identifies the UE (100) (SUPI). Based on the SUPI, the UDM (400a) identifies the symmetric encryption algorithm to be used to unhide the CCAG ID. Like the UE (100), the UDM (400a) uses Nonce, SUPI as input parameters and unhides the CCAG ID. If the SUCI and CCAG ID are successfully unhidden, the UDM (400a) performs the procedure specified in TS 33.501. The UDM (400a) includes the CAG ID and SUPI in the response message to the AUSF (500), and the AUSF (500) forwards them to the AMF (300a) / SEAF (300b) upon successful authentication.

[0288] Delivering a hidden CAG ID (CCAG ID) over the air to the network prevents a man-in-the-middle attacker from identifying the NPN / CAG cell that the UE (100) is trying to access.

[0289] Example Solution 2: The UE (100) delivers the CAG ID to the network during a service request or registration management procedure after the security context is established. When the UE (100) does not have a valid security context (the UE does not have a GUTI or the stored GUTI is invalid), the UE does not deliver the CAG identifier to the serving network. After the primary authentication succeeds and the NAS and RRC security contexts are established between the UE and the serving network, if the UE is accessing the NG-RAN using a CAG cell, the UE shall deliver the CAG ID to the serving network.

[0290] Figure 5 is a sequential flow chart illustrating various example processes for handling a 5GMM cause value "CAG cell not allowed" when a 5GMM cause value is received without integrity protection according to an example embodiment disclosed herein.

[0291] An example procedure can be used to prevent denial of service on a UE (100) using a CAG cell to access a Public Network Integrated Non-Public Network (PNiVPN). An example problem to consider is a UE (100) updating its home network configured allowed CAG list upon receiving an unprotected NAS reject message for a CAG ID access request.

[0292] During a service request or registration management procedure, upon receiving an unprotected NAS reject message for a CAG ID access request, the UE (100) does not update its "Allowed CAG List". Preventing the UE (100) from updating its configuration (Allowed CAG List) upon receiving an unprotected NAS reject message will prevent the UE (100) from being denied service to a Public Network Integrated Non-Public Network (PNiVPN) using CAG cells. Upon receiving an unprotected NAS reject message for a CAG ID access request, the UE (100) retries to register with the network again up to X times and / or retries to register with the network again at periodic time intervals. The number of retries (X) and / or the periodic time interval may be configured in the UE (100) or received by the UE (100) from the AMF (300a).

[0293] Furthermore, during the power cycle, the UE (100) stores the PLMN specific attempt counter value in a memory (such as NV RAM) of the ME or the USIM. The UE (100) uses the same stored value after powering on, so that retry can be avoided.

[0294] like Figure 5As shown, in step 1, the UE (100) attempts to access the NPN network via a CAG cell. In step 2, the UE (100) delivers a registration request including a SUCI and a CAG identifier to the AMF (300a) / SEAF (300b). In step 3, the AMF (300a) in the serving network decides to deliver a registration reject message to the UE (100) without a security context establishment (i.e., primary authentication). The AMF (300a) / SEAF (300b) delivers the registration reject message to the UE (100) in an unprotected format. In step 4, the AMF (300a) / SEAF (300b) delivers a registration reject (cause value = CAG cell not allowed) to the UE (100). In step 5, if the Registration Reject message with the cause value related to CAG cell not allowed received from AMF (300a) / SEAF (300b) is unprotected, the UE (100) does not update its allowed CAG list by deleting the CAGID because the Registration Reject message from the AMF is unprotected. In addition, the UE (100) attempts to register with the network again. In step 6, the UE (100) delivers a Registration Request message including the SUCI and the CAG identifier to the AMF (300a) / SEAF (300b).

[0295] Figure 6 is a flow chart illustrating various methods for processing a registration reject message when the registration reject message is received without integrity protection according to example embodiments disclosed herein.

[0296] After the UE (100) is powered on, the UE (100) sets the PLMN-specific attempt counter value to a maximum value for all PLMNs that are part of the forbidden PLMN list. Although the example embodiment is described from the perspective of a PLMN-specific attempt counter, similar issues and methods apply to PLMN-specific PS attempt counters, counters for "SIM / USIM considered invalid for non-GPRS services" events, and counters for "SIM / USIM considered invalid for GPRS services" events.

[0297] In step 1, the UE's modem delivers a Registration Request message to the network (600). Based on the Registration Request message, the network (600) delivers a Registration Reject message with cause #11 to the UE's modem. Based on the Registration Reject message with cause #11, the PLMN-specific attempt counter is incremented to 1 and the NAS timer T3247 is started. After the T3247 timer expires, the registration process is restarted.

[0298] In step 2, the UE's modem delivers a Registration Request message to the network (600). Based on the Registration Request message, the network (600) delivers a Registration Reject message with cause #11 to the UE's modem. Based on the Registration Reject message with cause #11, the PLMN-specific attempt counter is increased to 2, a NAS timer T3247 is started, and after T3247 expires, the registration procedure is restarted.

[0299] In step 3, the UE's modem also delivers a Registration Request message to the network (600). Based on the Registration Request message, the network (600) delivers a Registration Reject message with cause #11 to the UE's modem. Based on the Registration Reject message with cause #11, the PLMN-specific attempt counter is incremented to 3. For example, assume that the maximum attempt counter value is 3. In this case, PLMN "P1" is populated in the FPLMN list. The UE (100) is powered off and on. The UE (100) deletes the PLMN-specific attempt counter context. The UE's AP delivers a manual selection of PLMN P1 to the UE's modem.

[0300] Then, the UE's modem delivers a Registration Request message to the network (600). Based on the Registration Request, the network (600) delivers a Registration Reject message with cause #11 to the modem. Based on the Registration Reject message with cause #11, the PLMN-specific attempt counter is incremented to 1, and a timer T3247 is started. After T3247 expires, the registration process is restarted, and steps 2 and 3 are repeated, but this generates unnecessary signaling load on the network.

[0301] Figure 7 is a sequential flow diagram illustrating various example operations for transmitting information elements during initial NAS message transmission according to example embodiments disclosed herein.

[0302] In an example embodiment,

[0303] The UE (100) does not have a valid 5G non-access stratum (NAS) security context.

[0304] The UE (100) needs to deliver the initial NAS message and the first information element (IE) to the AMF 300a. The UE (100) only delivers the initial NAS message with a plain text IE. The UE (100) does not include the first information element in the initial NAS message.

[0305] The network (5G Core) performs the 5G authentication process. The UE (100) establishes a 5G NAS security context.

[0306] The network delivers a Security Mode Command NAS message to the UE (100).

[0307] After receiving the Security Mode Command NAS message, the 5G NAS security context created in step 2 becomes the current 5G NAS security context.

[0308] The UE (100) sends a security mode complete NAS message including a complete initial NAS message including the first IE. The security mode complete NAS message is encrypted using the current 5G NAS security context.

[0309] The first IE in the above step may include at least one of the following information elements:

[0310] Low access priority indication,

[0311] Strict periodic registration timer indication,

[0312] Extended Discontinuous Reception (eDRX), and

[0313] Closed Access Group (CAG) identifier.

[0314] When the UE (100) is in a 5G mobility management (5GMM) idle state, the initial NAS message in the above steps (e.g., a registration request message, a service request message, or a deregistration request message) is delivered.

[0315] In another example embodiment,

[0316] The UE (100) does not have a valid 5G NAS security context.

[0317] The UE (100) needs to deliver an initial NAS message and a first information element (IE). The UE delivers only the initial NAS message with a plain text IE, and the UE (100) includes the first information element in the initial NAS message.

[0318] The first IE in the above step may include at least one of the following information elements:

[0319] Low access priority indication,

[0320] Strict periodic registration timer indication,

[0321] Extended Discontinuous Reception (eDRX), and

[0322] Closed Access Group (CAG) Identifier

[0323] When the UE (100) is in a 5G mobility management (5GMM) idle state, the initial NAS message in the above steps (e.g., a registration request message, a service request message, or a deregistration request message) is sent.

[0324] like Figure 7As shown, in step 1, the UE (100) does not have a valid 5G NAS security context. In step 2, the UE (100) delivers an initial NAS message (plaintext IE) to the AMF (300a). In step 3, based on the initial NAS message, an authentication process is performed between the UE (100) and the AMF (300a). In step 4, the AMF (300a) delivers a security mode command to the UE (100). In step 5, a current 5G NAS security context is created at the UE (100). In step 6, the UE (100) delivers a security mode complete message (i.e., a complete initial NAS message containing the first IE) to the AMF (300a).

[0325] Figure 8 is a sequential flow diagram illustrating various operations for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein.

[0326] Step 1: The UE (100) camps on a CAG cell and registers to a public network integrated NPN. The UE (100) has a valid subscription to the CAG cell. The UE (100) is in 5G MM-CONNECTED mode with RRC inactive indication. The CAG cell broadcasts a single CAG ID.

[0327] Step 2: The UE (100) performs a recovery procedure on the CAG cell. The UE (100) delivers the CAG ID of the cell in an RRC message during the recovery procedure. For example, the UE (100) delivers the CAG ID of the CAG cell in an RRCResumeRequest message or an RRCResumeComplete message of the NR or in a new RRC message or in an existing RRC message. For an ng-eNB, the UE (100) delivers the CAG ID of the CAG cell in an RRCConnectionResume message or an RRCConnectionResumeComplete message. In an example embodiment, the UE may deliver an RRCResumeRequest without a CAG ID.

[0328] In step 2a, the UE (100) delivers a RRCResumeRequest message including a CAG ID to the NG-RAN (200). In an example embodiment, the UE may deliver a RRCResumerequest message without a CAG ID. Based on the RRCResumeRequest, the NG-RAN (200) delivers a RRCResume message to the UE (100) in step 2b. In step 2c, the UE (100) delivers a RRCResumeComplete message including a CAG ID and a NAS message. In an example embodiment, the NAS message is optional.

[0329] In step 3: The NG-RAN (200) forwards the received CAG ID to the AMF (300a) in an existing N1AP message or in a new N1AP message.

[0330] Step 4: The AMF (300a) checks whether the UE (100) has a subscription to the CAG ID. If the UE (100) has a subscription to the CAG ID, then in step 5a, the network (i.e., the AMF (300a)) keeps the UE (100) in 5G MM-CONNECTED mode. If the UE subscription to the CAG identifier has expired, then in step 5b, the AMF (300a) delivers an existing NAS message or a new NAS message indicating to the UE (100) that the subscription to the CAG cell subscription corresponding to the CAG ID has expired. After delivering the NAS message, the network releases the N1 signaling connection.

[0331] In another example embodiment, the CAG cell broadcasts multiple CAG IDs in the CAG cell belonging to the registered public network integrated NPN, and the UE (100) subscribes to the multiple CAG IDs broadcast in the CAG cell. The allowed CAG list in the UE (100) includes more than one CAG ID broadcast in the CAG cell. In step 2, when the UE (100) selects a second CAG ID (for example, when the first CAG identifier is removed from the UE allowed CAG list), the CAG ID selected in step 1, the UE (100) delivers the second CAG ID in step 2. The UE (100) and the AMF (300a) perform steps 1-4.

[0332] In step 5a, if the UE (100) has a subscription to the CAG ID, the AMF continues the NAS procedure or keeps the UE (100) in 5GMM-CONNECTED state. In step 5b, if there is no subscription to the CAG ID, the NAS message (CAG ID not subscribed or CAG allowed list) is delivered to the UE.

[0333] Fig. 9 is a sequential flow diagram illustrating various operations for alternatives to transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein.

[0334] In step 1: UE (100) camps on a first CAG cell broadcasting CAG identifier 1 and registers to a public network integrated NPN. UE (100) has valid subscriptions to the first CAG cell and a second CAG cell. The allowed CAG list of UE (100) includes entries with CAG identifier 1 and CAG identifier 2. UE (100) is in 5G MM-CONNECTED mode with RRC inactive indication. In an example embodiment, CAG identifier 1 and CAG identifier 2 belong to registered public network integrated NPNs.

[0335] In step 2, the UE selects a second CAG cell that broadcasts CAG identifier 2 but does not broadcast CAG identifier 1. The second CAG cell may also broadcast a CAG identifier different from CAG identifier 1 and CAG identifier 2.

[0336] In step 3a, the UE (100) delivers a RRCResumeRequest message including a CAG ID to the NG-RAN (200). Based on the RRCResumeRequest, the NG-RAN (200) delivers a RRCResume message to the UE (100) in step 3b. In step 3c, the UE (100) delivers a RRCResumeComplete message including a CAG ID and a NAS message. In an example embodiment, the NAS message is optional. Typically, in steps 3a-3c, the UE (100) selects a second CAG cell that broadcasts CAG identifier 2 but does not broadcast CAG identifier 1. The second CAG cell may also broadcast a CAG identifier different from CAG identifier 1 and CAG identifier 2.

[0337] In addition, the UE (100) performs a recovery procedure for the second CAG cell upon receiving a request from an upper layer. The UE (100) selects CAG identifier 2, and the UE (100) delivers CAG identifier 2 in an RRC message during the recovery procedure. In the example, the UE (100) delivers the CAG ID of the CAG cell in an RRCResumeRequest or RRCResumeComplete message of the NR or in a new RRC message or in an existing RRC message. For ng-eNB, the UE (100) delivers the CAG ID of the CAG cell in an RRCConnectionResume message or an RRCConnectionResumeComplete message.

[0338] In step 4: The NG-RAN (200) forwards the received CAG identifier 2 to the AMF (300a) in an existing N1AP message or in a new N1AP message.

[0339] At step 5: AMF (300a) checks whether UE (100) has a valid subscription to CAG identifier 2. AMF (300a) performs step 6a or 6b.

[0340] At step 6a: If the UE (100) has a valid subscription to CAG identifier 2, the network keeps the UE in 5G MM-CONNECTED mode. If the AMF (300a) receives an optional NAS message, the AMF (300a) processes the NAS message.

[0341] At step 6b: If the UE subscription to CAG identifier 2 has expired or the UE (100) does not have a valid subscription to CAG identifier 2, the AMF (300a) delivers an existing NAS message or a new NAS message indicating to the UE (100) that the subscription to the CAG cell subscription corresponding to CAG identifier 2 has expired. After delivering the NAS message, the network releases the N1 signaling connection.

[0342] In an example embodiment, the first CAG cell and the second CAG cell belong to the same registration area. In another embodiment, the first CAG cell and the second CAG cell do not belong to the same registration area.

[0343] In an example embodiment, the NG-RAN (200) stores the CAG cell identifier 1 in step 1. The NG-RAN (200) receives the CAG identifier in step 2-3, and when the NG-RAN (200) receives the CAG identifier 2 and the NG-RAN (200) determines that the CAG identifier 1 and the CAG identifier 2 are different, the NG-RAN (200) performs one of the following steps:

[0344] The NG-RAN (200) rejects the RRC recovery procedure and delivers RRCconnectionReject.

[0345] The NG-RAN (200) delivers an RRC connection establishment message to establish an RRC connection, and the UE (100) delivers an RRC connection establishment complete message including the CAG identifier 2.

[0346] The NG-RAN (200) releases the RRC connection by delivering an RRCConnectionRelease message.

[0347] Fig.10 is a flow diagram illustrating various example operations for alternatives to transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein.

[0348] Step 1: The UE (100) camps on a first CAG cell broadcasting a CAG identifier 1 and registers to a public network integrated NPN. The UE (100) has a valid subscription to the first CAG cell and a second CAG cell. The UE's allowed CAG list includes entries for CAG identifier 1 and CAG identifier 2. The UE (100) is in 5G MM-CONNECTED mode with an RRC inactive indication. In an example embodiment, CAG identifier 1 and CAG identifier 2 belong to a registered public network integrated NPN.

[0349] Step 2: The UE (100) selects a second CAG cell that broadcasts CAG identifier 2 but does not broadcast CAG identifier 1. The second CAG cell may broadcast CAG identifiers other than CAG identifiers 1 and 2.

[0350] The UE (100) transitions from a 5GMM-CONNECTED state with RRC inactive to a 5GMM-IDLE mode and releases the stored AS context. In addition, the UE (100) establishes an RRC connection upon receiving a request from an upper layer. The UE (100) delivers the CAG identifier 2 during the RRC connection establishment procedure (e.g., in an RRC setup complete message or an RRC connection setup complete message).

[0351] In step 3a, the UE (100) delivers a RRCResumeRequest message including a CAG ID to the NG-RAN (200). Based on the RRCResumeRequest message, the NG-RAN (200) delivers a RRCResume message to the UE (100) in step 3b. In step 3c, the UE (100) delivers a RRCResumeComplete message including a CAG ID and a NAS message. In an example embodiment, the NAS message is optional.

[0352] Step 4: The NG-RAN (200) forwards the received CAG identifier 2 to the AMF (300a) in an existing N1AP message or in a new N1AP message.

[0353] Step 5: The AMF (300a) checks whether the UE (100) has a valid subscription to the CAG identifier 2. If the UE (100) has a valid subscription to the CAG identifier 2, the network maintains the UE (100) in 5G MM-CONNECTED mode at step 6a. If the UE subscription to the CAG identifier 2 has expired, the AMF (300a) delivers an existing NAS message or a new NAS message to the UE (100) indicating that the subscription corresponding to the CAG identifier 2 has expired at step 6b. After delivering the NAS message, the network releases the N1 signaling connection.

[0354] In an example embodiment, the AMF (300a) provides the NG-RAN (200) with an updated allowed CAG list. When the NG-RAN (200) receives a CAG identifier during a resumption procedure, the NG-RAN (200) determines whether the CAG identifier received from the UE (100) is in the allowed CAG list. In an example embodiment, when the NG-RAN (200) receives an RRCResumeRequest message, the NG-RAN (200) determines whether at least one CAG ID broadcasted in the CAG cell is in the allowed CAG list of the UE. If the received CAG ID or at least one CAG ID is in the allowed CAG list, the NG-RAN (200) performs a resumption procedure. Otherwise, the NG-RAN (200) releases the RRC connection and sends an information element (IE) indicating to the UE (100) in an existing RRC message (e.g., an RRCConnectionRelease message or an RRCConnectionReject message) or a new RRC message indicating that the CAG identifier is not subscribed. In one example, the information element is delivered integrity protected. When the UE (100) receives the information element in the RRC message, the UE (100) removes the delivered CAG identifier from the allowed CAG list. In another embodiment, the NG-RAN (200) delivers the entire allowed CAG list associated with the UE (100) in a new RRC message or an existing RRC message. The UE (100) upon receiving the allowed CAG list replaces the stored allowed CAG list with the allowed CAG list received from the NG-RAN (200). In another example embodiment, the NG-RAN (200) includes the CAG identifier and the information element indicating to the UE (100) that the CAG identifier is not subscribed.

[0355] Fig.11 is a sequential flow diagram illustrating another various operations for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein.

[0356] In step 1: UE (100) camps on a CAG cell and registers to a public network integrated NPN. UE (100) has a valid subscription to the CAG cell. UE (100) is in 5G MM-IDLE mode with a suspension indication. The CAG cell broadcasts a single CAGID.

[0357] In addition, the UE (100) performs a recovery procedure for the CAG cell and delivers the CAG ID of the cell in an RRC message during the recovery procedure. For example, the UE (100) delivers the CAG ID of the CAG cell in an RRCResumeRequest message or an RRCResumeComplete message of the NR or in a new RRC message or in an existing RRC message. For ng-eNB, the UE (100) delivers the CAG ID of the CAG cell in an RRCConnectionResume message or an RRCConnectionResumeComplete message.

[0358] In step 2a, the UE (100) delivers a RRCResumeRequest message including a CAG ID to the NG-RAN (200). Based on the RRCResumeRequest, the NG-RAN (200) delivers a RRCResume message to the UE (100) in step 2b. In step 2c, the UE (100) delivers a RRCResumeComplete message including a CAG ID and a NAS message. In an example embodiment, the NAS message is optional.

[0359] In step 3: the NG-RAN (200) forwards the received CAG ID to the AMG (300) in an existing N1AP message or in a new N1AP message.

[0360] At step 4: the AMF (300a) checks whether the UE (100) has a valid subscription to the CAG ID. If the UE (100) has a valid subscription to the CAG ID, the network maintains the UE (100) in 5G MM-CONNECTED mode at step 5a. If the UE subscription to the CAG identifier has expired, the AMF (300a) delivers an existing NAS message or a new NAS message at step 5b, which indicates to the UE (100) that the subscription to the CAG cell subscription corresponding to the CAG ID has expired. After delivering the NAS message, the network releases the N1 signaling connection.

[0361] In an example embodiment, when a CAG cell broadcasts a plurality of CAG IDs in a CAG cell belonging to a registered public network integrated NPN and the UE (100) subscribes to the plurality of CAG IDs broadcast in the CAG cell, that is, the allowed CAG list stored in the UE (100) includes more than one CAG ID broadcast in the CAG cell. In step 1, when the UE (100) selects a second CAG ID and delivers the second CAG ID in step 2. The UE and the network perform steps 1-3.

[0362] In step 4, the AMF (300a) determines whether the UE (100) is subscribed to the CAG ID.

[0363] In step 5a, if the UE (100) has a valid subscription to the CAG ID, the AMF (300a) continues the NAS procedure or keeps the UE (100) in 5G MM-CONNECTED state.

[0364] In step 5b, if the UE does not have a valid subscription to the CAG ID, the AMF (300a) delivers a NAS message (CAG ID not subscribed or CAG allowed list).

[0365] Fig.12 is a sequential flow diagram illustrating another alternative example embodiment for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein.

[0366] In step 1: UE (100) camps on a first CAG cell broadcasting CAG identifier 1 and registers to a registered public network integrated NPN. UE (100) has valid subscriptions to the first CAG cell and the second CAG cell, i.e., the UE's allowed CAG list has entries for CAG identifier 1 and CAG identifier 2. UE (100) is in 5G MM-IDLE mode with a suspension indication. In one example, CAG identifier 1 and CAG identifier 2 belong to the registered public network integrated NPN.

[0367] Step 2: The UE (100) selects a second CAG cell that broadcasts CAG identifier 2 but does not broadcast CAG identifier 1. The second CAG cell may broadcast CAG identifiers other than CAG identifiers 1 and 2.

[0368] In steps 3a-3c: the UE (100) performs a recovery procedure for the CAG cell upon receiving a request from an upper layer. The UE (100) selects a second CAG identifier 2 and delivers the CAG identifier 2 in an RRC message during the recovery procedure. In the example, the UE (100) delivers the CAG ID of the CAG cell in an RRCResumeRequest or RRCResumeComplete message of the NR or in a new RRC message or in an existing RRC message. For ng-eNB, the UE (100) delivers the CAG ID of the CAG cell in an RRCConnectionResume message or an RRCConnectionResumeComplete message.

[0369] In step 4: The NG-RAN (200) forwards the received CAG identifier 2 to the AMF (300a) in an existing N1AP message or in a new N1AP message.

[0370] At step 5: AMF (300a) checks whether UE (100) has a valid subscription to CAG identifier 2.

[0371] In step 6a, if the UE (100) has a valid subscription to CAG identifier 2, the AMF (300a) maintains the UE (100) in 5G MM-CONNECTED mode. If the UE subscription to CAG identifier 2 has expired, the AMF (300a) delivers an existing NAS message or a new NAS message indicating to the UE (100) that the subscription to the CAG cell subscription corresponding to CAG identifier 2 has expired. After delivering the NAS message, the network releases the N1 signaling connection in step 6b.

[0372] In an example, the first CAG cell and the second CAG cell belong to the same registration area. In another example, the first CAG cell and the second CAG cell do not belong to the same registration area.

[0373] In the example, in step 1, the NG-RAN (200) stores the CAG cell identifier 1. In steps 3-4, when the NG-RAN (200) receives the CAG identifier and when the NG-RAN (200) receives the CAG identifier 2, the NG-RAN (200) determines that the CAG identifier 1 and the CAG identifier 2 are different, and then performs one of the following steps:

[0374] The NG-RAN (200) rejects the RRC recovery procedure and delivers an RRC Connection Reject message.

[0375] The NG-RAN (200) delivers an RRC connection establishment message to establish an RRC connection, and the UE (100) delivers an RRC connection establishment complete message including the CAG identifier 2.

[0376] Fig.13 is a sequential flow diagram illustrating another example of various operations for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein.

[0377] In step 1: UE (100) camps on a first CAG cell broadcasting CAG identifier 1 and registers to a public network integrated NPN. UE (100) has a valid subscription to the first CAG cell and the second CAG cell, i.e., the UE allowed CAG list has entries CAG identifier 1 and CAG identifier 2. UE (100) is in 5G MM-IDLE mode with a suspension indication. In the example, CAG identifier 1 and CAG identifier 2 belong to a registered public network integrated NPN.

[0378] In step 2: the UE (100) selects a second CAG cell that broadcasts CAG identifier 2 but does not broadcast CAG identifier 1. The second CAG cell may broadcast CAG identifiers in addition to CAG identifiers 1 and 2. The UE (100) transitions from the 5G MM-CONNECTED state with RRC inactive to the 5G MM-IDLE mode and releases the stored AS context.

[0379] In steps 3a-3c: the UE (100) establishes an RRC connection upon receiving a request from an upper layer (e.g., non-access stratum (NAS)). The UE (100) delivers the CAG identifier 2 during the RRC connection establishment procedure (i.e., in an RRC Setup Complete message or an RRC Connection Setup Complete message).

[0380] In step 4: The NG-RAN (200) forwards the received CAG identifier 2 to the AMF (300a) in an existing N1AP message or in a new N1AP message.

[0381] At step 5: the AMF (300a) checks whether the UE (100) has a valid subscription to the CAG identifier 2. At 6a, if the UE (100) has a valid subscription to the CAG identifier 2, the network (i.e., the AMF (300a)) maintains the UE (100) in 5G MM-CONNECTED mode. At step 6b, if the UE subscription to the CAG identifier 2 has expired, the AMF (300a) delivers an existing NAS message or a new NAS message indicating to the UE (100) that the subscription to the CAG cell subscription corresponding to the CAG identifier 2 has expired. After delivering the NAS message, the network (i.e., the AMF (300a)) releases the N1 signaling connection.

[0382] In one example, for Figures 10 to 13According to the procedure disclosed in, the AMF (300a) provides the updated allowed CAG list to the NG-RAN (200). When the NG-RAN (200) receives the CAG identifier during the recovery procedure, the NG-RAN (200) determines whether the CAG identifier received from the UE (100) is in the allowed CAG list. If the received CAG ID is in the allowed list, the NG-RAN (200) performs the recovery procedure. Otherwise, the NG-RAN (200) releases the RRC connection and delivers an information element indicating to the UE (100) that the CAG identifier is not subscribed in an existing RRC message (e.g., RRCConnectionRelease or RRCConnectionReject) or a new RRC message. In an example, the information element is delivered with integrity protection. When the UE (100) receives the information element in the RRC message, the UE (100) removes the sent CAG identifier from the allowed CAG list. In another example, the NG-RAN (200) delivers the allowed CAG list related to the UE (100) in an existing RRC message. The UE (100), upon receiving the allowed CAG list, replaces the stored allowed CAG list with the allowed CAG list received from the NG-RAN (200). In another example, the NG-RAN (200) includes a CAG identifier and an information element indicating that the UE (100) is not subscribed to the CAG identifier.

[0383] Fig.14 is a sequential flow diagram illustrating other alternative example processes for transmitting a CAG identifier during a recovery process according to example embodiments disclosed herein.

[0384] At step 1: UE (100) has an allowed CAG list including more than one CAG identifier. UE (100) is camped on a CAG cell that broadcasts more than one CAG identifier of the same public network integrated NPN. There are more than one broadcasted CAG identifiers in the allowed CAG list.

[0385] In step 2-step 3c: the UE (100) initiates an RRC connection establishment procedure, and the UE (100) delivers to the NG-RAN (200) all broadcasted CAG identifiers present in the allowed CAG list of the UE (100) during the RRC connection. In step 3a, the UE (100) delivers to the NG-RAN (200) an RRCConnectionRequest message including the CAG ID list. Based on the RRCConnectionRequest, the NG-RAN (200) delivers to the UE (100) an RRCSetup message in step 3b. Based on the RRCSetup, the UE (100) delivers to the NG-RAN (200) an RRCSetupComplete message including the CAG ID list and a NAS message in step 3c. In an example embodiment, the NAS message is optional.

[0386] In step 4: the NG-RAN (200) forwards all CAG identifiers received from the UE (100) to the AMF (300a).

[0387] At step 5: AMF (300a) checks whether UE (100) has a valid subscription corresponding to the received CAG identifier. AMF (300a) performs step 6a or 6b.

[0388] At step 6a: If the AMF (300a) determines that the UE (100) has a valid subscription to at least one of the received CAG identifiers, the AMF (300a) performs a NAS procedure or keeps the UE (100) in a 5G MM-CONNECTED state.

[0389] In step 6b: If the UE (100) does not have a valid subscription to any CSG identifier, the AMF (300a) notifies the UE (100) that the UE (100) does not have a valid subscription to the received CAG identifier. The AMF (300a) then releases the NAS signaling connection.

[0390] In an example embodiment, during a recovery procedure when the UE (100) is in 5GMM-CONNECTED with RRC inactive indication or 5GMM-IDLE mode with suspend indication (i.e., during a state transition from 5GMM-CONNECTED with RRC inactive state to 5GMM-CONNECTED mode or from 5GMM-CONNECTED with suspend indication to 5GMM-CONNECTED mode), multiple broadcasted CAG identifiers of registered public network integrated NPNs that are also present in the CAG cell in the UE's allowed CAG list are delivered to the NG-RAN (200). The NG-RAN (200) forwards these CAG identifiers to the AMF (300a). The AMF (300a) then performs steps 5-6b.

[0391] Fig.15 is a sequential flow chart illustrating various example processes for processing CAG ID finalization according to example embodiments disclosed herein.

[0392] In step 1, the network (ie, NG-RAN (200)) supports CAG identifier (or identity) 1 and broadcasts CAG identifier 1 associated with CAG 1 in a system information block (SIB).

[0393] In step 2, the AMF (300a) determines to stop signaling associated with CAG identifier 1 (e.g., due to an overload situation in the AMF (300a) caused by a signaling storm associated with CAG identity 1).

[0394] In step 3, the AMF (300a) delivers an NGAP message (e.g., start overload) containing the CAG identifier 1 to the NG-RAN (200), instructing the NG-RAN (200) to stop signaling related to the CAG identifier 1. The AMF (300a) may not deliver the request to a random NG-RAN connected to the AMF (300a). In the example, the AMF (300a) delivers the message to all NG-RANs (200) connected to the AMF (300a). The NG-RAN (200) will perform steps 4a-5a or 4b upon receiving the NGAP message. In steps 4a-5a, the NG-RAN (200) stops broadcasting the CAG identifier 1 in the CAG cells operated by the NG-RAN (200). In the example embodiment, the NG-RAN (200) stops broadcasting the CAG identifier 1 in some CAG cells operated by the NG-RAN (200).

[0395] In step 4b, the NG-RAN (200) starts rejecting or releasing the RRC connection establishment procedure associated with the CAG identifier 1 (e.g., when the RRCsetupComplete message includes the CAG identifier 1, the NG-RAN (200) releases the RRC connection by delivering an RRCConnectionRelease message). In an example embodiment, the RRC connection release message may include a waiting time or include the waiting time and the CAG identifier 1. Upon receiving the RRC connection release message, the UE (100) does not initiate an AS or NAS procedure associated with the CAG identifier 1 during the waiting time.

[0396] In an exemplary embodiment, when the AMF (300a) receives a first NAS message related to CAG identifier 1, the AMF (300a) rejects the NAS procedure and delivers a second NAS message containing a backoff timer related to CAG identifier 1, and indicates to the UE (100) not to initiate signaling related to CAG identifier 1. The UE (100) runs the backoff timer upon receiving the second NAS message, and will not initiate any AS or NAS procedure related to CAG identifier 1 before the backoff timer expires. In another exemplary embodiment, the UE (100) still broadcasts CAG identifier 1 in the CAG cell to select the CAG cell. In another embodiment, the UE (100) does not consider using CAG identifier 1 for the cell selection / reselection process before the backoff timer expires.

[0397] Fig.16A Various hardware components of a UE (100) for processing CAG-related procedures in a wireless communication system according to an example embodiment disclosed herein are shown. The UE (100) can be, for example, but not limited to, a cellular phone, a tablet computer, a smart phone, a laptop computer, a personal digital assistant (PDA), a global positioning system, a multimedia device, a video device, an Internet of Things (IoT) device, a smart watch, a game console, a smart watch, a foldable display device, an unmanned aerial vehicle (UAV), an airplane, etc. The UE (100) may also be referred to as a mobile station, a subscriber station, a mobile unit, a subscriber unit, a wireless unit, a remote unit, a mobile device, a wireless device, a wireless communication device, a mobile subscriber station, an access terminal, a mobile terminal, a wireless terminal, a remote terminal, a handset, a user agent, a mobile client, etc. by those skilled in the art.

[0398] In an example embodiment, a UE (100) includes a processing circuit (110), a radio communication circuit (120), and other circuits (130). The processing circuit (110) is coupled to the radio communication circuit (120) and the other circuits (130). The processing circuit (110) may include a CAG identifier protection engine. The processing circuit (110) is configured to execute instructions stored in the other circuits (130) and perform various processes. The radio communication circuit (120) is configured to communicate internally between internal hardware components and to communicate with external devices via one or more networks.

[0399] Other circuits (130) may include a memory. The memory stores instructions to be executed by the processing circuit (110). The memory may include a non-volatile storage element. Examples of such non-volatile storage elements may include a magnetic hard disk, an optical disk, a floppy disk, a flash memory, or an electrically programmable memory (EPROM) or an electrically erasable programmable (EEPROM) memory. In addition, in some examples, the memory may be considered a non-transitory storage medium. The term "non-transitory" may indicate that the storage medium is not embodied in a carrier wave or a propagating signal. However, the term "non-transitory" should not be interpreted as the memory being non-removable. In some examples, the memory can be configured to store a larger amount of information than the memory. In some examples, the non-transitory storage medium may store data that can change over time (e.g., in a random access memory (RAM) or a cache memory).

[0400] In an example embodiment, a CAG identifier protection engine included in the processing circuit 110 is configured to trigger an initial registration procedure with at least one of the AMF entity (300a) and the SEAF entity (300b). In addition, the CAG identifier protection engine is configured to detect that the UE (100) does not have a valid NAS security context and protect the CAG ID based on the detection during the initial registration procedure. In an example embodiment, the CAG ID is protected in the SUCI.

[0401] The CAG identifier protection engine is further configured to deliver a registration request message including the SUCI with the protected CAG ID to at least one of the AMF entity (300a) and the SEAF entity (300b).

[0402] In another embodiment, the CAG identifier protection engine is configured to detect that the UE (100) does not have a valid NAS security context. The CAG identifier protection engine is also configured to deliver an initial NAS message with a plaintext IE, wherein the UE (100) does not include a first information element in the initial NAS message. The first IE is a CAG identifier. The CAG identifier protection engine is also configured to create a NAS security context. The NAS security context is created by performing an authentication process between the UE (100) and the AMF (300a), receiving a security mode command based on the authentication process, and creating a NAS security context based on the received security mode command. The CAG identifier protection engine is also configured to send a security mode complete NAS message including the complete initial NAS message. The security mode complete NAS message is encrypted with the NAS security context. The security mode complete NAS message includes the first IE.

[0403] In an example embodiment, the CAG ID is protected in the SUCI by protecting the CAG ID into the SUCI with the SUPI.

[0404] In an example embodiment, the CAG identifier protection engine delivers a registration request message including a protected CAG ID as an access network parameter to at least one of the AMF entity (300a) and the SEAF entity (300b).

[0405] In an example embodiment, the CAG identifier protection engine is further configured to indicate to at least one of the AMF entity (300a) and the SEAF entity (300b) whether a protected CAG ID is present in the SUCI.

[0406] In another example embodiment, the CAG identifier protection engine is configured to trigger an initial registration procedure with at least one of an AMF entity (300a) and a SEAF entity. The CAG identifier protection engine is further configured to detect that the UE (100) does not have a valid NAS security context while triggering the initial registration procedure and deliver an initial NAS message with a plaintext IE. The UE (100) does not include a first IE in the initial NAS message. The first IE can be a CAG identifier and a low access priority indicator. The CAG identifier protection engine is further configured to create a NAS security context and send a security mode complete NAS message including the complete initial NAS message. The security mode complete NAS message is encrypted with the NAS security context. The NAS security context is created by performing an authentication procedure between the UE (100) and the AMF (300a), receiving a security mode command based on the authentication procedure, and creating a NAS security context based on the received security mode command.

[0407] In an example embodiment, the Security Mode Complete NAS message includes a first IE.

[0408] In an example embodiment, a CAG identifier protection engine is configured to receive an information element indicating to a UE (100) that at least one CAG ID is not subscribed in an RRC message. The information element is received from a NG-RAN (200). Furthermore, the CAG identifier protection engine is configured to perform one of the following: removing at least one CAG ID from an allowed CAG list based on the received information element, and replacing a stored allowed CAG list with a newly received allowed CAG list from the NG-RAN based on the received information element.

[0409] although Fig.16A Various hardware components of the UE (100) are shown, but it should be understood that other example embodiments are not limited thereto. In other example embodiments, the UE (100) may include fewer or more components. In addition, the labels or names of the components are for illustrative purposes only. One or more components can be combined together to perform the same or substantially similar functions to handle CAG-related processes in a wireless communication system.

[0410] Fig. 16B Various hardware components of an AMF entity (300a) and a SEAF entity (300b) for processing CAG-related procedures in a wireless communication system according to an example embodiment disclosed herein are shown. The AMF entity (300a) and the SEAF entity (300b) include a processing circuit (310), a radio communication circuit (320), and other circuits (330). The radio communication circuit (320) may be referred to as an interface circuit. The processing circuit (310) is coupled to the other circuit (330) and the radio communication circuit (320). The radio communication circuit (520) may be referred to as an interface circuit. The processing circuit (310) may include a CAG identifier protection engine. The processing circuit (310) is configured to execute instructions stored in the other circuit (330) and perform various processes. The radio communication circuit (320) is configured to communicate internally between internal hardware components and to communicate with external devices via one or more networks.

[0411] The processing circuit (310) is configured to receive a registration request message including a SUCI with a protected CAG ID from a UE (100). The processing circuit (310) is further configured to deliver an authentication request message to an AUSF entity (500) based on the registration request message. The authentication request message includes a SUCI with a protected CAG ID. The processing circuit (310) is further configured to initiate a primary authentication procedure based on the authentication request message.

[0412] although Fig. 16BVarious hardware components of the AMF entity (300a) or SEAF entity (300b) are shown, but it should be understood that other example embodiments are not limited thereto. In other example embodiments, the AMF entity (300a) or SEAF entity (300b) may include fewer or more components. In addition, the labels or names of the components are for illustrative purposes only. One or more components may be combined together to perform the same or substantially similar functions to handle CAG-related processes in a wireless communication system.

[0413] Fig. 16C Various hardware components of an AUSF entity (500) for processing CAG-related processes in a wireless communication system according to an example embodiment disclosed herein are shown. The AUSF entity (500) includes a processing circuit (510), a radio communication circuit (520), and other circuits (530). The processing circuit (510) is coupled to the other circuits (530) and the radio communication circuit (520). The radio communication circuit (520) may be referred to as an interface circuit. The processing circuit (510) may include a CAG identifier protection engine. The processing circuit (510) is configured to execute instructions stored in a memory and perform various processes. The radio communication circuit (520) is configured to communicate internally between internal hardware components and to communicate with external devices via one or more networks.

[0414] The processing circuit (510) is configured to receive an authentication request message from one of an AMF entity (300a) and a SEAF entity (300b). The authentication request message includes a SUCI with a protected CAG ID. The processing circuit (510) is further configured to determine that the authentication request message includes a SUCI with a protected CAG ID. The processing circuit (510) is further configured to deliver an authentication acquisition request message to a UDM (400a) based on the determination. The processing circuit (510) is further configured to receive an authentication acquisition response message from the UDM (400a) by unhiding the SUCI and the CAG ID of the SUPI using the UDM (400a) based on the authentication acquisition request message. The authentication acquisition response message includes the unhidden CAG ID with the SUPI. The processing circuit (510) is further configured to share the authentication acquisition response message from the UDM (400a) to at least one of the AMF (300a) and the SEAF (300b).

[0415] Fig. 16C It may also be used for other 5G core network devices including one of the 5G core network entities (e.g., UDM, ARPF, or SIDF).

[0416] Fig.16DVarious hardware components of a base station (i.e., NG-RAN or network) (200) for processing CAG-related procedures in a wireless communication system according to an example embodiment disclosed herein are shown. In an example embodiment, the NG-RAN (200) includes a processing circuit (210), a radio communication circuit (220), and other circuits (230). The processing circuit (210) is coupled to the other circuits (230) and the radio communication circuit (220). The radio communication circuit (220) may be referred to as an interface circuit. The processing circuit (210) may include a CAG identifier protection engine. The processing circuit (210) is configured to execute instructions stored in a memory and perform various processes. The radio communication circuit (220) is configured to communicate internally between internal hardware components and to communicate with external devices via one or more networks.

[0417] The other circuits (230) may include memory.

[0418] The memory stores instructions to be executed by the processing circuit (210). The memory may include a non-volatile storage element. Examples of such non-volatile storage elements may include a magnetic hard disk, an optical disk, a floppy disk, a flash memory, or an electrically programmable memory (EPROM) or an electrically erasable programmable (EEPROM) memory. In addition, in some instances, the memory may be considered a non-transitory storage medium. The term "non-transitory" may indicate that the storage medium is not embodied in a carrier or propagating signal. However, the term "non-transitory" should not be interpreted as the memory being non-removable. In some examples, the memory may be configured to store a larger amount of information than the memory. In some examples, the non-transitory storage medium may store data that can change over time (e.g., in a random access memory (RAM) or a cache memory).

[0419] In an example embodiment, the CAG identifier protection engine is configured to receive an RRC recovery request message when the UE (100) initiates an RRC recovery procedure for transitioning from an RRC inactive state to an RRC connected state in a CAG cell. In an example embodiment, at least one CAG identifier in the allowed CAG list is determined based on a mobility restriction received from an AMF entity (300a).

[0420] The mobility restriction corresponds to the mobility-related subscription information of the UE (100). The mobility-related subscription information determines the cells or tracking areas in which the UE (100) can obtain services. The mobility-related subscription information includes RAT restriction, prohibited area, service area restriction, core network type restriction and closed access group information.

[0421] In addition, the CAG identifier protection engine is configured to determine whether at least one CAG identifier broadcast in the CAG cell is in the allowed CAG list. If at least one CAG ID is in the allowed CAG list, the CAG identifier protection engine is configured to perform an RRC recovery process. If the at least one CAG ID is not in the allowed CAG list, the CAG identifier protection engine is configured to release the RRC connection by delivering an RRC message if the at least one CAG ID broadcast by the CAG cell is not included in the CAG allowed list. In addition, the CAG identifier protection engine is configured to deliver an information element in the RRC message indicating to the UE that at least one CAG identifier is not subscribed based on the released RRC connection. In an example embodiment, the RRC message is at least one of an RRC connection release message and an RRC connection rejection message. In an example embodiment, the information element is delivered with integrity protection.

[0422] although Fig.16D Various hardware components of the NG-RAN (200) are shown, but it should be understood that other example embodiments are not limited thereto. In other example embodiments, the NG-RAN (200) may include fewer or more components. In addition, the labels or names of the components are for illustrative purposes only. One or more components may be combined together to perform the same or substantially similar functions to handle CAG-related processes in a wireless communication system.

[0423] Fig.17A 1700a is a flow chart illustrating a method implemented by a UE (100) for handling CAG-related procedures in a wireless communication system (1000) according to an example embodiment disclosed herein. Operations (1702a and 1706a) are performed by a processing circuit 110. The UE may trigger an initial registration procedure with at least one of an AMF entity (300a) and a SEAF entity (300b) (step 1702a). The UE may detect that the UE (100) does not have a valid NAS security context while triggering the initial registration procedure (step 1704a). The UE may protect the CAG ID based on the detection during the initial registration procedure (step 1706a).

[0424] Fig. 17B1700b is a flowchart (1700b) illustrating a method for processing CAG-related procedures in a wireless communication system implemented by an AMF entity (300a) or a SEAF entity (300b) according to an example embodiment disclosed herein. Operations (1702b to 1706b) are performed by a processing circuit 310A. The AMF entity (300a) or the SEAF entity (300b) may receive a registration request message including a SUCI with a protected CAG ID from a UE (100) (step 1702b). The AMF entity (300a) or the SEAF entity (300b) may deliver an authentication request message to an AUSF entity (500) based on the registration request message (step 1704b). The authentication request message includes a SUCI with a protected CAG ID. The AMF entity (300a) or the SEAF entity (300b) may initiate a primary authentication process based on the authentication request message (step 1706b).

[0425] Fig. 17C The present invention is a flowchart (1700c) illustrating a method implemented by an AUSF entity (500) for handling CAG-related procedures in a wireless communication system according to an example embodiment disclosed herein. Operations (1702c to 1710c) are performed by a processing circuit 510. The AUSF entity (500) may receive an authentication request message from one of an AMF entity (300a) and a SEAF entity (300b) (step 1702c). The authentication request message includes a SUCI with a protected CAG ID. The AUSF entity (500) may determine that the authentication request message includes a SUCI with a protected CAG ID (step 1704c). The AUSF entity (500) may deliver an authentication acquisition request message to a UDM (400a) based on the determination (step 1706c). The AUSF entity (500) receives an authentication acquisition response message from the UDM (400a) by unhiding the SUCI as a SUPI and a CAG ID using the UDM (400a) based on the authentication acquisition request message (step 1708c). The authentication acquisition response message includes the unhidden CAG ID with the SUPI. The AUSF entity (500) may share the authentication acquisition response message from the UDM to at least one of the AMF (300a) and the SEAF (300b) (step 1710c).

[0426] Fig.17D is a flow chart (1700d) illustrating a method for processing CAG-related procedures in a wireless communication system according to example embodiments disclosed herein. Operations (1702d and 1710d) are performed by the processing circuit (210).

[0427] At 1702d, the method includes: when the UE initiates an RRC recovery process for transitioning from an RRC inactive state to an RRC connected state in a CAG cell, receiving an RRC recovery request message. At 1704d, the method includes determining whether at least one CAG identifier broadcast in the CAG cell is in an allowed CAG list of the UE (100). If at least one CAG ID is in the allowed CAG list, then at 1706d, the method includes performing an RRC recovery process. If at least one CAG ID is not in the allowed CAG list, then at 1708d, the method includes releasing the RRC connection by delivering an RRC message. At 1710d, the method also includes delivering, based on the released RRC connection, an information element in the RRC message indicating to the UE (100) that at least one CAG identifier is not subscribed. In 1710d, the method also includes delivering, based on the released RRC connection, an allowed CAG list associated with the UE in the RRC message.

[0428] Fig.17E is a flow chart (1700e) illustrating a method implemented by a UE (100) for handling CAG-related procedures in a wireless communication system (1000) according to example embodiments disclosed herein. Operations (1702e and 1708e) are performed by a processing circuit (110).

[0429] The UE may trigger an initial registration procedure with at least one of the AMF entity (300a) and the SEAF entity (300b) (step 1702e). The UE may detect that the UE (100) does not have a valid NAS security context (step 1704e). The UE may deliver an initial NAS message with plaintext IEs, wherein the UE (100) does not include a first IE in the initial NAS message (step 1706e). The UE may create a NAS security context (step 1708e). The UE may deliver a security mode complete NAS message including the complete initial NAS message (step 1710e). The security mode complete NAS message is encrypted with the NAS security context.

[0430] Fig.18A is a flow chart illustrating a method implemented by a core network apparatus for supporting a UE (200) to access one or more closed access group (CAG) cells via a radio access network according to example embodiments disclosed herein. The operations are performed by a processing circuit.

[0431] The core network device may receive a request signal including a protected CAG identifier (ID) associated with the UE via an interface circuit (step 1802a). The protected CAG ID may be used to request the UE to access the CAG cell. The core network device may unhide the protected CAG ID to determine the CAG ID (step 1804a). The protected CAG ID includes the CAG ID.

[0432] Fig.18B is a flow chart illustrating a method implemented by a UE (200) for accessing one or more closed access group (CAG) cells according to example embodiments disclosed herein. The operations are performed by a processing circuit (210).

[0433] The UE (200) may generate a protected CAG identifier (ID) that may be used to request the UE to access the CAG cell (step 1802b). The UE may provide the protected CAG ID to the radio communication circuit (step 1804b). The UE may send a request signal directed to the core network to the radio access network (step 1806b). The request signal includes the protected CAG ID. The protected CAG ID includes the CAG ID.

[0434] Fig.18C is a flow chart illustrating a method implemented by a UE (200) for accessing one or more closed access group (CAG) cells according to example embodiments disclosed herein. The operations are performed by a processing circuit (210).

[0435] The UE may obtain an initial non-access stratum (NAS) message including a CAG identifier (ID) for CAG cell access (step 1802c). The CAG ID is protected by the scheme. The UE may provide the initial NAS message to the radio communication circuit (step 1804c). The UE may send the initial NAS message to the radio access network (step 1806c).

[0436] Example embodiments disclosed herein can be implemented in at least one software program running on at least one hardware device and performing network management functions to control elements.

[0437] The various actions, actions, boxes, steps, etc. in the flowchart can be performed in the order presented, in a different order or simultaneously. In addition, in some example embodiments, some actions, actions, boxes, steps, etc. can be omitted, added, modified, skipped, etc. without departing from the scope of the present invention.

[0438] The foregoing description of specific example embodiments will fully reveal the general nature of the example embodiments herein, so that others can easily modify and / or adjust these specific example embodiments for various applications by applying current knowledge without departing from the overall concept, and therefore, these adjustments and modifications should and are intended to be understood within the meaning and scope of the equivalents of the disclosed example embodiments. It should be understood that the wording or terminology used herein is for descriptive rather than limiting purposes. Therefore, although the example embodiments of this article have been described in terms of preferred example embodiments, those skilled in the art will recognize that the example embodiments of this article can be practiced by modification within the spirit and scope of the example embodiments as described herein.

Claims

1. A method performed by a base station in a wireless communication system, the method comprising: receiving an allowed closed access group CAG list of the user equipment UE from the access and mobility management function AMF entity; receiving a radio resource control (RRC) resumption request from a UE in a CAG cell, the UE being in an RRC inactive state and registered with the network; in response to receiving the RRC resume request, identifying whether at least one closed access group identifier (CAGID) broadcasted in the CAG cell is included in an allowed CAG list of the UE; as well as In response to identifying that the at least one CAG ID is not included in the allowed CAG list, rejecting the RRC recovery request, Wherein, rejecting the RRC recovery request includes sending an RRC message to the UE, and The RRC message is at least one of an RRC connection release message and an RRC connection rejection message.

2. The method according to claim 1, further comprising: In response to identifying that the at least one CAG ID is included in the allowed CAG list, an RRC recovery procedure is performed in the CAG cell.

3. The method according to claim 1, wherein: The RRC message includes an information element indicating that at least one CAG ID is not subscribed in the allowed CAG list.

4. The method according to claim 1, wherein: Based on the released RRC connection, the RRC message includes a list of allowed CAGs.

5. The method according to claim 1, wherein: The at least one CAGID is identified based on mobility restrictions received from an access and mobility management function, AMF entity.

6. The method according to claim 5, wherein: The mobility restriction corresponds to subscription information related to the mobility of the UE, and The mobility-related subscription information includes at least one of radio access technology RAT restriction, prohibited area, service area restriction, core network type restriction, and closed access group information.

7. A base station in a wireless communication system, the base station comprising: Radio communication circuits; as well as The processing circuit, coupled to the radio communication circuit, is configured to: receiving an allowed closed access group CAG list of the user equipment UE from the access and mobility management function AMF entity; receiving a radio resource control (RRC) resumption request from a UE in a CAG cell, the UE being in an RRC inactive state and registered with the network; in response to receiving the RRC resume request, identifying whether at least one closed access group identifier (CAGID) broadcasted in the CAG cell is included in an allowed CAG list of the UE; as well as In response to identifying that the at least one CAG ID is not included in the allowed CAG list, rejecting the RRC resumption request.

8. The base station according to claim 7, wherein: The processing circuit is further configured to: In response to identifying that the at least one CAG ID is included in the allowed CAG list, an RRC recovery procedure is performed in the CAG cell.

9. The base station according to claim 7, wherein: The processing circuit is further configured to perform the method according to any one of claims 1 to 6.

10. A method performed by a user equipment UE in a wireless communication system, the method comprising: sending a radio resource control RRC resumption request to a base station in a closed access group CAG cell, wherein the UE in an RRC inactive state is registered with the network; In response to identifying by the base station that at least one closed access group identifier (CAG ID) broadcasted in the CAG cell is not included in the allowed CAG list of the UE, receiving an RRC message from the base station, The UE's allowed CAG list is sent from the access and mobility management function AMF entity to the base station, and The RRC message is at least one of an RRC connection release message and an RRC connection rejection message.

11. The method according to claim 10, wherein: The RRC message includes at least one of an information element indicating that the at least one CAG ID is not subscribed and an allowed CAG list.

12. The method according to claim 11, further comprising: Do one of the following: removing the at least one CAG ID from an allowed CAG list based on the received information element, and Based on the received information element, the stored CAG list is replaced with the received allowed CAG list.

13. The method according to claim 10, further comprising: In response to identifying, by the base station, that at least one CAG ID broadcast by the CAG cell is included in the allowed CAG list, an RRC resume message is received from the base station.

14. A user equipment UE in a wireless communication system, the UE comprising: Radio communication circuits; as well as The processing circuit, coupled to the radio communication circuit, is configured to: sending a radio resource control (RRC) recovery request to a base station in a closed access group (CAG) cell, wherein the UE in an RRC inactive state is registered with the network, and receiving an RRC message from the base station in response to identifying by the base station that at least one closed access group identifier (CAGID) broadcasted in the CAG cell is not included in an allowed CAG list of the UE, wherein the allowed CAG list of the UE is sent from an access and mobility management function (AMF) entity to the base station, and The RRC message is at least one of an RRC connection release message and an RRC connection rejection message.

15. The UE according to claim 14, wherein: The RRC message includes at least one of an information element indicating that the at least one CAG ID is not subscribed in the allowed CAG list and the allowed CAG list.

16. The UE according to claim 15, wherein: The processing circuit is further configured to: Do one of the following: removing the at least one CAG ID from an allowed CAG list based on the received information element, and Based on the received information element, the stored CAG list is replaced with the received allowed CAG list.

17. The UE according to claim 14, wherein: The processing circuit is further configured to: In response to identifying, by the base station, that at least one CAG ID broadcast by the CAG cell is included in the allowed CAG list, an RRC resume message is received from the base station.

Images