Network Node

Abstract

The network node comprises: a receiving unit, which receives information for improving the security of communication between network nodes from a management node; and a control unit, which receives a request sent from a first network node configured in a first PLMN (Public Land Mobile Network) based on the information for improving security, and sends the request to a second network node configured in a second PLMN.

Description

Technical Field

[0001] The present invention relates to a network node in a communication system. Background Art

[0002] In 3GPP (3rd Generation Partnership Project), research on a wireless communication method called 5G or NR (New Radio) (hereinafter referred to as "5G" or "NR") is being conducted to achieve further increases in system capacity, further increases in data transmission speed, and further reductions in latency in wireless intervals. In 5G, various wireless technologies are being studied to meet the requirements of achieving a throughput of more than 10 Gbps and a latency of less than 1 ms in wireless intervals.

[0003] In NR, a network architecture is being studied that includes 5GC (5G Core Network) corresponding to the core network in the network architecture of LTE (Long Term Evolution), namely EPC (Evolved Packet Core), and NG-RAN (Next Generation-Radio Access Network) corresponding to E-UTRAN (Evolved Universal Terrestrial Radio Access Network), which is the RAN (Radio Access Network) in the network architecture of LTE (for example, non-patent document 1).

[0004] Prior art literature

[0005] Non-patent literature

[0006] Non-patent document 1: 3GPP TS 23.501 V15.4.0 (2018-12) Summary of the invention

[0007] Problems to be solved by the invention

[0008] In a system with a 5G network architecture, NF (Network Function) is defined as a combination of NF services with a single function. In the case where communication between NF services requires security or authentication, in the first version (Release 15), the structural elements inside the NF implement the security or authentication. In the second version (Release 16), research was conducted to summarize the structural elements to form basic functions that can be used in common by various NF services. When a PLMN (Public Land Mobile Network) based on the first version and a PLMN based on the second version are connected to each other, it is difficult to establish secure communication between NF services.

[0009] The present invention has been made in view of the above circumstances, and an object of the present invention is to perform communication with improved security between network nodes.

[0010] Means for solving problems

[0011] According to the disclosed technology, a network node is provided, which comprises: a receiving unit, which receives information for improving the security of communication between network nodes from a management node; and a control unit, which receives a request sent from a first network node configured in a first PLMN (Public Land Mobile Network) based on the information for improving security, and sends the request to a second network node configured in a second PLMN.

[0012] Effects of the Invention

[0013] According to the disclosed technology, communication with improved security can be performed between network nodes. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a diagram for explaining an example of a communication system in an embodiment of the present invention.

[0015] Figure 2 This is a diagram for explaining an example of mutual TLS.

[0016] Figure 3 This is a diagram for explaining an example of mutual TLS in an embodiment of the present invention.

[0017] Figure 4 This is a diagram for explaining an example of the authentication process.

[0018] Figure 5 This is a diagram for explaining an example of an authentication operation in the embodiment of the present invention.

[0019] Figure 6This is a diagram for explaining an example of a communication system in a roaming environment according to an embodiment of the present invention.

[0020] Figure 7 This is a diagram for explaining an example of mutual TLS in a roaming environment.

[0021] Figure 8 This is a diagram for explaining example (1) of mutual TLS in a roaming environment in an embodiment of the present invention.

[0022] Fig. 9 This is a diagram for explaining example (2) of mutual TLS in a roaming environment in an embodiment of the present invention.

[0023] Fig.10 This is a diagram for explaining an example of an authentication process in a roaming environment.

[0024] Fig.11 This is a diagram for explaining example (1) of the authentication process in a roaming environment in an embodiment of the present invention.

[0025] Fig.12 This is a diagram for explaining example (2) of the authentication process in a roaming environment in an embodiment of the present invention.

[0026] Fig.13 1 is a diagram showing an example of a functional configuration of a network node 10 according to an embodiment of the present invention.

[0027] Fig.14 1 is a diagram showing an example of a functional configuration of the user device 20 according to the embodiment of the present invention.

[0028] Fig.15 This is a diagram showing an example of the hardware configuration of the network node 10 or the user equipment 20 according to the embodiment of the present invention. DETAILED DESCRIPTION

[0029] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In addition, the embodiment described below is only an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0030] When the wireless communication system of the embodiment of the present invention is operated, the existing technology can be appropriately used. However, the existing technology is, for example, the existing LTE, but is not limited to the existing LTE. In addition, unless otherwise specified, the term "LTE" used in this specification has a broad meaning including LTE-Advanced and methods after LTE-Advanced (for example, NR) or wireless LAN (Local Area Network).

[0031] In addition, in the embodiment of the present invention, “configuring” wireless parameters and the like may refer to pre-configuring predetermined values, or may refer to configuring wireless parameters notified from the network node 10 or the user device 20 .

[0032] Figure 1 1 is a diagram for explaining a communication system in an embodiment of the present invention. Figure 1 As shown, the communication system is composed of a UE as a user device 20 and a plurality of network nodes 10. In the following, it is assumed that there is one network node 10 corresponding to each function, but a plurality of functions may be implemented by one network node 10, or a plurality of network nodes 10 may implement one function. In addition, the "connection" described below may be a logical connection or a physical connection.

[0033] RAN (Radio Access Network) is a network node 10 with a wireless access function, connected to UE, AMF (Access and Mobility Management Function) and UPF (User plane function). AMF is a network node 10 with RAN interface terminal, NAS (Non-Access Stratum) terminal, registration management, connection management, reachability management, mobility management and other functions. UPF is a network node 10 with functions such as PDU (Protocol Data Unit) session point for external interconnection with DN (Data Network), routing and forwarding of packets, and QoS (Quality of Service) processing of the user plane. UPF and DN constitute a network slice. Multiple network slices can also be constructed in the wireless communication network in the embodiment of the present invention.

[0034] AMF is connected to UE, RAN, SMF (Session Management Function), NSSF (Network Slice Selection Function), NEF (Network Exposure Function), NRF (Network Repository Function), UDM (Unified Data Management), AUSF (Authentication Server Function), PCF (Policy Control Function), and AF (Application Function). AMF, SMF, NSSF, NEF, NRF, AUSF, PCF, and AF are network nodes 10 that are interconnected via interfaces based on their respective services, such as Namf, Nsmf, Nnssf, Nnef, Nnrf, Nudm, Nausf, Npcf, and Naf.

[0035] SMF is a network node 10 having functions such as session management, UE's IP (Internet Protocol) address allocation and management, DHCP (Dynamic Host Configuration Protocol) function, ARP (Address Resolution Protocol) proxy, and roaming function. NEF is a network node 10 having the function of notifying other NFs (Network Functions) of capabilities and events. NSSF is a network node 10 having functions such as selection of the network slice to which the UE is connected, determination of the permitted NSSAI (Network Slice Selection Assistance Information), determination of the set NSSAI, and determination of the AMF set to which the UE is connected. PCF is a network node 10 having the function of performing policy control of the network. AF is a network node 10 having the function of controlling application servers. NRF is a network node 10 having the function of discovering NF instances that provide services.

[0036] Figure 1The network nodes shown except UE, RAN, UPF, and DN are all included in the scope of SBA (Service Based Architecture). SBA adopts technologies from the fields of web and cloud. Each NF is defined as a combination of NF services with a single function. NFs provide and utilize services to each other with integrated protocols. For example, AMF is a stateless NF, separated from the process and storage provided by UDSF (Unified Data Storage Function).

[0037] The following describes the network settings related to eSBA (enhanced SBA) mainly from the perspective of security. In eSBA, research is underway on using NF services, NF services not performing registration and discovery by themselves, communication between NF services that require security, and using open source software as an installation option.

[0038] Figure 2 This is a diagram for explaining an example of mutual TLS. Figure 2 The current structure of connecting to NF via mutual TLS (Transport Layer Security) in a non-roaming environment is shown. TLS is a protocol used for communication requiring security in a network. Mutual TLS performs TLS authentication between the server and the client in both directions. Figure 2 As shown, NF performs communications requiring security via TLS.

[0039] Figure 3 This is a diagram for explaining an example of mutual TLS in an embodiment of the present invention. Figure 3 The structure of connecting to NF service through Envoy via mutual TLS in a non-roaming environment is shown. Envoy refers to the sidecar configured in the same Pod as the NF service. Pod refers to an instance of a process executed by a containerized application. Figure 3 In the example, mutual TLS is established between Envoys. Envoy works as a proxy for communication between NF services. Secure communication via TLS is performed between Envoys. In addition, Envoy can also monitor NF services, etc.

[0040] Figure 4 This is a diagram for explaining an example of the authentication process. Figure 4The present structure of implementing the open standard OAuth2.0 for authentication in a non-roaming environment is shown. NF sends a registration containing the NF instance ID to NRF. Next, NF sends a token request to NRF. Next, NRF sends a token to NF. Next, NF sends a request accompanied by the token to other NFs.

[0041] Figure 5 This is a diagram for explaining an example of an authentication operation in the embodiment of the present invention. Figure 5 The structure of a new authentication equivalent to OAuth2.0-based authentication performed from an NF service in a non-roaming environment is shown. NF services send requests to other NF services via Envoy. Here, Envoy of other NF services obtains ServiceRole (service role) and ServiceRoleBinding (service role binding) from IstioPilot. IstioPilot performs business policy management between Envoys, such as policy management functions with role binding (RoleBinding). The ServiceRole provided by IstioPilot refers to the definition of permitted operations in NF services, and ServiceRoleBinding refers to the definition of which NF service is associated with the ServiceRole (service role). By using ServiceRole (service role), it is possible to achieve Figure 4 The functionality of the OAuth token is shown below.

[0042] Figure 6 FIG. 1 is a diagram for explaining an example of a communication system in a roaming environment according to an embodiment of the present invention. Figure 6 As shown, the network is composed of a UE as a user device 20 and a plurality of network nodes 10. In the following, it is assumed that there is one network node 10 corresponding to each function, but a plurality of functions may be implemented by one network node 10, or a plurality of network nodes 10 may implement one function. In addition, the "connection" described below may be a logical connection or a physical connection.

[0043] RAN is a network node 10 with a radio access function, connected to UE, AMF and UPF. AMF is a network node 10 with functions such as a terminal of a RAN interface, a terminal of a NAS, registration management, connection management, reachability management, and mobility management. UPF is a network node 10 with functions such as an external PDU session point interconnected with a DN, routing and forwarding of packets, and QoS processing of the user plane. UPF and DN constitute a network slice. Multiple network slices can also be constructed in the wireless communication network in the embodiment of the present invention.

[0044] AMF is connected to UE, RAN, SMF, NSSF, NEF, NRF, UDM, AUSF, PCF, AF, and SEPP (Security Edge Protection Proxy). AMF, SMF, NSSF, NEF, NRF, AUSF, PCF, and AF are network nodes 10 that are interconnected via interfaces based on their respective services, such as Namf, Nsmf, Nnssf, Nnef, Nnrf, Nudm, Nausf, Npcf, and Naf.

[0045] SMF is a network node 10 that has functions such as session management, UE IP address allocation and management, DHCP function, ARP proxy, and roaming function. NEF is a network node 10 that has the function of notifying other NFs of capabilities and events. NSSF is a network node 10 that has functions such as selecting the network slice to which the UE is connected, determining the permitted NSSAI, determining the set NSSAI, and determining the AMF set to which the UE is connected. PCF is a network node 10 that has the function of performing policy control on the network. AF is a network node 10 that has the function of controlling application servers. NRF is a network node 10 that has the function of discovering NF instances that provide services. SEPP is a non-transparent proxy that filters messages on the control plane between PLMNs (Public Land Mobile Network). Figure 6 The vSEPP shown is a SEPP in a visited network and the hSEPP is a SEPP in a home network.

[0046] like Figure 6 As shown, the UE is in a roaming environment connected to the RAN and AMF in a VPLMN (Visited PLMN). The VPLMN and the HPLMN (Home PLMN) are connected via vSEPP and hSEPP. The UE can communicate with the UDM of the HPLMN via the AMF of the VPLMN, for example.

[0047] Figure 7 This is a diagram for explaining an example of mutual TLS in a roaming environment. Figure 7 The figure shows the existing structure of connecting with NF via mutual TLS and SEPP in roaming environment. Mutual TLS performs TLS authentication between server and client bidirectionally. Figure 7 As shown, NF performs communications requiring security via TLS and SEPP. Figure 7 In the example, it is assumed that the NF sending the request in step 1 exists in the VPLMN, and the NF receiving the request in step 8 exists in the HPLMN.

[0048] In step 1, the NF of the VPLMN sends a request to the NRF of the VPLMN to discover the target NF service. The NRF of the VPLMN sends the request to the NRF of the HPLMN via the SEPPs of the VPLMN and the HPLMN. Next, in step 2, the NRF of the HPLMN sends the actual FQDN (Fully Qualified Domain Name) of the target NF to the SEPP of the HPLMN. Next, in step 3, the SEPP of the HPLMN sends the hidden FQDN of the target NF to the SEPP of the VPLMN. Next, in step 4, the SEPP of the VPLMN sends an extended (telescopic) FQDN to the NF of the VPLMN via the NRF of the VPLMN. The so-called extended FQDN is the FQDN obtained by appending the domain of the SEPP to the end.

[0049] In step 5, the NF of the VPLMN sends a request to the SEPP of the VPLMN through the extended FQDN via the TLS between the NF of the VPLMN and the SEPP of the VPLMN. Next, in step 6, the SEPP of the VPLMN sends a request to the SEPP of the HPLMN through the hidden FQDN. Next, in step 8, the SEPP of the HPLMN sends a request to the NF of the HPLMN through the actual FQDN via the TLS between the NF and the SEPP.

[0050] Figure 8 This is a diagram for explaining example (1) of mutual TLS in a roaming environment in an embodiment of the present invention. Figure 8 The structure of connecting to NF services through Envoy via mutual TLS in a roaming environment is shown. Figure 8 In , mutual TLS is established through Envoy. Figure 8In the example, the NF service sending the request in step 0 exists in the VPLMN, and the NF service receiving the request in step 8 exists in the HPLMN. In addition, the NF service and Envoy can also be a network node working on the same Pod. In addition, the 3gppGW and Envoy can also be a network node working on the same Pod.

[0051] like Figure 8 As shown, in each of the VPLMN and HPLMN, IstioPilot provides TLS policies to Envoy. Through the TLS policy, TLS can be established between Envoys or between Envoy and SEPP. In addition, for authentication, TLS is separated into Envoy-Envoy and Envoy-SEPP.

[0052] In step 0, the NF service of the VPLMN sends a request to the 3gppGW of the VPLMN via TLS between Envoy. Next, the 3gppGW transforms the information contained in the HTTP header for discovering the destination NF service into a GET query string. In step 1, the 3gppGW of the VPLMN sends a request to the NRF of the HPLMN via Envoy, the NRF of the VPLMN, the SEPP of the VPLMN and the HPLMN. Next, in step 2, the NRF of the HPLMN sends the actual FQDN of the target NF service to the SEPP of the HPLMN. Next, in step 3, the SEPP of the HPLMN sends the hidden FQDN of the target NF service to the SEPP of the VPLMN. Next, in step 4, the SEPP of the VPLMN sends the extended FQDN to the 3gppGW of the VPLMN via the NRF of the VPLMN.

[0053] In step 5, the 3gppGW of the VPLMN sends a request to the SEPP of the VPLMN through the extended FQDN via TLS between Envoy and SEPP. Next, in step 6, the SEPP of the VPLMN sends a request to the SEPP of the HPLMN through the hidden FQDN. Next, in step 7, the SEPP of the HPLMN sends a request to the 3gppGW of the HPLMN through the actual FQDN via TLS between SEPP and Envoy. Next, in step 8, the 3gppGW of the HPLMN sends a request to the NF service of the HPLMN through the actual FQDN via TLS between Envoy.

[0054] Fig. 9 This is a diagram for explaining example (2) of mutual TLS in a roaming environment in an embodiment of the present invention. Fig. 9The example shows a case where the structure of connecting to NF service through Envoy via mutual TLS in a roaming environment and the existing structure of connecting to NF via mutual TLS and SEPP are different in VPLMN and HPLMN. Fig. 9 , the timing of step a0 to step a8 of sending a request from the NF service in the VPLMN to the NF in the HPLMN and the timing of step b1 to step b8 of sending a request from the NF in the VPLMN to the NF service in the HPLMN are shown. In addition, the NF service and Envoy can also be a network node working on the same Pod. In addition, the 3gppGW and Envoy can also be a network node working on the same Pod.

[0055] In step a0, the NF service of the VPLMN sends a request to discover the target NF service to the 3gppGW of the VPLMN via TLS between Envoy. Next, the 3gppGW transforms the information contained in the HTTP header for discovering the destination NF service into a GET query string. In step a1, the 3gppGW of the VPLMN sends a request to the NRF of the HPLMN via Envoy, the NRF of the VPLMN, and the SEPP of the VPLMN and the HPLMN. Next, in step a2, the NRF of the HPLMN sends the actual FQDN of the target NF to the SEPP of the HPLMN. Next, in step a3, the SEPP of the HPLMN sends the hidden FQDN of the target NF to the SEPP of the VPLMN. Next, in step a4, the SEPP of the VPLMN sends the extended FQDN to the 3gppGW of the VPLMN via the NRF of the VPLMN.

[0056] In step a5, the 3gppGW of the VPLMN sends a request to the SEPP of the VPLMN through the extended FQDN via TLS between Envoy and SEPP. Next, in step a6, the SEPP of the VPLMN sends a request to the SEPP of the HPLMN through the hidden FQDN. Next, in step a8, the SEPP of the HPLMN sends a request to the NF of the HPLMN through the actual FQDN via TLS between SEPP and NF.

[0057] On the other hand, in step b1, the NF of the VPLMN sends a request to the NRF of the VPLMN to discover the target NF service. The NRF of the VPLMN sends the request to the NRF of the HPLMN via the SEPPs of the VPLMN and the HPLMN. Next, in step b2, the NRF of the HPLMN sends the actual FQDN of the target NF service to the SEPP of the HPLMN. Next, in step b3, the SEPP of the HPLMN sends the hidden FQDN of the target NF service to the SEPP of the VPLMN. Next, in step b4, the SEPP of the VPLMN sends the extended FQDN to the 3gppGW of the VPLMN via the NRF of the VPLMN.

[0058] In step b5, the NF of the VPLMN sends a request to the SEPP of the VPLMN through the extended FQDN via TLS between the NF and the SEPP. Next, in step b6, the SEPP of the VPLMN sends a request to the SEPP of the HPLMN through the hidden FQDN. Next, in step b7, the SEPP of the HPLMN sends a request to the 3gppGW of the HPLMN through the actual FQDN via TLS between the SEPP and the Envoy. Next, in step b8, the 3gppGW of the HPLMN sends a request to the NF service of the HPLMN through the actual FQDN via TLS between the Envoy.

[0059] Fig.10 This is a diagram for explaining an example of an authentication process in a roaming environment. Fig.10 The present invention shows a conventional structure for implementing OAuth2.0, an open standard for authentication in a roaming environment. Fig.10 In the example, the NF sending the token request in step 1 exists in the VPLMN, and the NF receiving the request in step 3 exists in the HPLMN.

[0060] In step 1, the NF of the VPLMN sends a token request to the NRF of the VPLMN. Next, the NRF of the VPLMN sends a token request to the SEPP of the VPLMN. Next, the SEPP of the VPLMN sends a token request to the SEPP of the HPLMN. Next, the SEPP of the HPLMN sends a token request to the NRF of the HPLMN. Next, in step 2, the NRF of the HPLMN sends a token to the NRF of the VPLMN via the SEPP of the HPLMN and the VPLMN. The NRF of the VPLMN sends a token to the NF of the VPLMN. Next, in step 3, the NF of the VPLMN sends a request accompanied by the token to the NF of the HPLMN via the SEPP of the VPLMN and the HPLMN.

[0061] Fig.11This is a diagram for explaining example (1) of the authentication process in a roaming environment in an embodiment of the present invention. Fig.11 The structure of a new authentication equivalent to OAuth2.0 based authentication is shown in a roaming environment. The NF service of the VPLMN sends a request to the NF service of the HPLMN via Envoy. Here, the Envoy configured in the VPLMN and the HPLMN obtains the ServiceRole and ServiceRoleBinding from IstioPilot. By using ServiceRole, it is possible to Fig.10 The function of the token in OAuth is shown. In addition, the NF service and Envoy can also be a network node working on the same Pod. In addition, the 3gppGW and Envoy can also be a network node working on the same Pod.

[0062] In step 0, the NF service of the VPLMN sends a request to the 3gppGW of the VPLMN via Envoy. The 3gppGW of the VPLMN generates a token request based on the received request as if the self-device is a consumer NF. Next, in step 1, the 3gppGW of the VPLMN sends a token request to the NRF of the VPLMN via Envoy. Next, the NRF of the VPLMN sends a token request to the NRF of the HPLMN via the SEPP of the VPLMN and the HPLMN.

[0063] In step 2, the NRF of the HPLMN sends a token for accessing the pre-set 3gppGW of the HPLMN to the SEPP of the HPLMN. Next, the SEPP of the HPLMN sends the token to the SEPP of the VPLMN. Next, the SEPP of the VPLMN sends the token to the NRF of the VPLMN. The NRF of the VPLMN sends the token to the 3gppGW of the VPLMN via Envoy. In step 3, the 3gppGW of the VPLMN sends a request accompanied by the generated token to the 3gppGW of the HPLMN via Envoy and SEPP. The 3gppGW of the HPLMN processes the token. Next, in step 4, the 3gppGW of the HPLMN sends the received request to the NF service of the HPLMN via Envoy.

[0064] Fig.12 This is a diagram for explaining example (2) of the authentication process in a roaming environment in an embodiment of the present invention. Fig.12The example of the case where the structure of executing a new authentication equivalent to the authentication based on OAuth2.0 from the NF service of the VPLMN in a roaming environment and the existing structure of executing OAuth2.0 are different in the VPLMN and the HPLMN is shown. Fig.12 , the timing of step a0 to step a3 of sending a request from the NF service in the VPLMN to the NF in the HPLMN and the timing of step b1 to step b4 of sending a request from the NF in the VPLMN to the NF service in the HPLMN are shown. In addition, the NF service and Envoy can also be a network node working on the same Pod. In addition, the 3gppGW and Envoy can also be a network node working on the same Pod.

[0065] In step a0, the NF service of the VPLMN sends a request to the 3gppGW of the VPLMN via Envoy. The 3gppGW of the VPLMN generates a token request based on the received request as if the self-device is a consumer NF. Next, in step a1, the 3gppGW of the VPLMN sends a token request to the NRF of the VPLMN via Envoy. Next, the NRF of the VPLMN sends a token request to the NRF of the HPLMN via the SEPP of the VPLMN and the HPLMN.

[0066] In step a2, the NRF of the HPLMN sends a token to the NRF of the VPLMN via the SEPP of the HPLMN and the VPLMN. The NRF of the VPLMN sends a token to the 3gppGW of the VPLMN via Envoy. Next, in step a3, the 3gppGW of the VPLMN sends a request accompanied by the token to the NF of the HPLMN via Envoy, the SEPP of the VPLMN, and the SEPP of the HPLMN.

[0067] On the other hand, in step b1, the NF of the VPLMN sends a token request to the NRF of the VPLMN. Next, the NRF of the VPLMN sends a token request to the SEPP of the VPLMN. Next, the SEPP of the VPLMN sends a token request to the SEPP of the HPLMN. Next, the SEPP of the HPLMN sends a token request to the NRF of the HPLMN. Next, in step b2, the NRF of the HPLMN sends a token for accessing a pre-set 3gppGW to the NRF of the VPLMN via the SEPP of the HPLMN and the VPLMN. The NRF of the VPLMN sends a token to the NF of the VPLMN. Next, in step b3, the NF of the VPLMN sends a request accompanied by the token to the 3gppGW of the HPLMN via the SEPP and Envoy of the VPLMN and the HPLMN. The 3gppGW of the HPLMN processes the received token. Next, in step b4, the 3gppGW of the HPLMN sends the received request to the NF service of the HPLMN via Envoy.

[0068] According to the above-mentioned embodiment, the NF service as the network node 10 can establish mutual TLS between Envoy and communicate securely with other NF services. In addition, the NF service as the network node 10 can perform authentication via Envoy through the ServiceRole (service role) and ServiceRoleBinding (service role binding) provided from IstioPilot. In addition, even if the network structure based on NF and the network structure based on NF service in which Envoy becomes a proxy are mixed in VPLMN and HPLMN, the NF service or NF as the network node 10 can establish TLS for secure communication, and perform authentication via Envoy through the ServiceRole (service role) and ServiceRoleBinding (service role binding) provided from IstioPilot.

[0069] That is, communication with improved security can be performed between network nodes.

[0070] (Device Structure)

[0071] Next, a functional configuration example of the network node 10 and the user device 20 that implement the above-described processing and operation will be described. The network node 10 and the user device 20 include functions for implementing the above-described embodiments. However, the network node 10 and the user device 20 may each include only a portion of the functions in the embodiments.

[0072] <Network Node 10>

[0073] Fig.13 1 is a diagram showing an example of a functional structure of a network node 10. Fig.13 As shown, the network node 10 includes a transmitting unit 110 , a receiving unit 120 , a setting unit 130 , and a control unit 140 . Fig.13 The functional structure shown is only an example. As long as the actions of the embodiments of the present invention can be performed, the functional division and the name of the functional unit can be arbitrary. In addition, the network node 10 having multiple different functions in the system architecture can also be composed of multiple network nodes 10 separated according to each function.

[0074] The transmitter 110 includes a function of generating a signal to be transmitted to the user device 20 or other network nodes 10 and transmitting the signal by wire or wirelessly. The receiver 120 includes a function of receiving various signals transmitted from the user device 20 or other network nodes 10 and obtaining, for example, higher layer information from the received signals.

[0075] The setting unit 130 stores in a storage device the preset setting information and various setting information to be transmitted to the user device 20, and reads out from the storage device as needed. The content of the setting information is, for example, information related to security and authentication between NF services.

[0076] As described in the embodiment, the control unit 140 performs processing related to security or authentication between NF services. In addition, the control unit 140 performs processing related to communication with the user device 20. The functional unit related to signal transmission in the control unit 140 may be included in the transmission unit 110, and the functional unit related to signal reception in the control unit 140 may be included in the reception unit 120.

[0077] <User device 20>

[0078] Fig.14 FIG. 2 is a diagram showing an example of a functional configuration of the user device 20. Fig.14 As shown, the user device 20 includes a transmitting unit 210 , a receiving unit 220 , a setting unit 230 , and a control unit 240 . Fig.14 The functional configuration shown is only an example, and any functional division and function unit name may be used as long as the operation of the embodiment of the present invention can be performed.

[0079] The transmitting unit 210 generates a transmission signal according to the transmission data and transmits the transmission signal wirelessly. The receiving unit 220 receives various signals wirelessly and obtains a higher layer signal from the received physical layer signal. In addition, the receiving unit 220 has a function of receiving NR-PSS, NR-SSS, NR-PBCH, DL / UL control signal or reference signal, etc. transmitted from the network node 10.

[0080] The setting unit 230 stores various setting information received by the receiving unit 220 from the network node 10 in the storage device, and reads it from the storage device as needed. In addition, the setting unit 230 also stores pre-set setting information. The content of the setting information is, for example, information related to the network slice that is allowed to connect.

[0081] As described in the embodiment, the control unit 240 performs processing related to connection control of the network and the network slice. The functional unit related to signal transmission in the control unit 240 may be included in the transmission unit 210, and the functional unit related to signal reception in the control unit 240 may be included in the reception unit 220.

[0082] (Hardware Structure)

[0083] The block diagram used in the description of the above embodiment ( Fig.13 and Fig.14 ) shows blocks in units of functions. These functional blocks (structural parts) are implemented by any combination of at least one of hardware and software. In addition, the implementation method of each functional block is not particularly limited. That is, each functional block can be implemented using a device that is physically or logically combined, or two or more physically or logically separated devices can be directly or indirectly connected (for example, using wires, wirelessly, etc.) and implemented using these multiple devices. The functional block can also be implemented by combining software with the above-mentioned one device or the above-mentioned multiple devices.

[0084] Functionally, it includes judging, deciding, determining, calculating, calculating, processing, deriving, investigating, searching, confirming, receiving, sending, outputting, accessing, solving, selecting, selecting, establishing, comparing, assuming, expecting, regarding, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating, mapping, assigning, etc., but is not limited to these. For example, the functional block (structural part) that enables the sending function is called a transmitting unit or a transmitter. In short, as mentioned above, the implementation method is not particularly limited.

[0085] For example, the network node 10, the user device 20, etc. in one embodiment of the present disclosure may also function as a computer that performs the processing of the wireless communication method of the present disclosure. Fig.151 is a diagram showing an example of the hardware structure of a network node 10 and a user device 20 according to an embodiment of the present disclosure. The network node 10 and the user device 20 described above may also be physically configured as a computer device including a processor 1001, a storage device 1002, an auxiliary storage device 1003, a communication device 1004, an input device 1005, an output device 1006, a bus 1007, and the like.

[0086] In the following description, the term "device" may be replaced by "circuit", "device", "unit", etc. The hardware configuration of the network node 10 and the user device 20 may include one or more of the devices shown in the figure, or may exclude some of the devices.

[0087] Each function in the network node 10 and the user device 20 is implemented by the following method: predetermined software (program) is read into hardware such as the processor 1001 and the storage device 1002, so that the processor 1001 performs calculations and controls the communication of the communication device 1004 or controls at least one of the reading and writing of data in the storage device 1002 and the auxiliary storage device 1003.

[0088] The processor 1001 controls the entire computer by, for example, running an operating system. The processor 1001 may also be composed of a central processing unit (CPU) including an interface with peripheral devices, a control device, a computing device, registers, etc. For example, the control unit 140, the control unit 240, etc., may also be implemented by the processor 1001.

[0089] In addition, the processor 1001 reads a program (program code), a software module, or data from at least one of the auxiliary storage device 1003 and the communication device 1004 to the storage device 1002, and performs various processes accordingly. As a program, a program that causes the computer to execute at least a part of the actions described in the above embodiments is used. For example, Fig.13 The control unit 140 of the network node 10 shown may also be implemented by a control program stored in the storage device 1002 and running in the processor 1001. In addition, for example, Fig.14 The control unit 240 of the user device 20 shown in the figure can also be implemented by a control program stored in the storage device 1002 and running in the processor 1001. Regarding the above-mentioned various processes, although it is described that the above-mentioned various processes are performed by one processor 1001, the above-mentioned various processes can also be performed simultaneously or sequentially by more than two processors 1001. The processor 1001 can also be installed by more than one chip. In addition, the program can also be sent from the network via a telecommunication line.

[0090] The storage device 1002 is a computer-readable recording medium, and may be composed of at least one of ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), RAM (Random Access Memory), etc. The storage device 1002 may also be called a register, a cache, a main memory (main storage device), etc. The storage device 1002 can store programs (program codes), software modules, etc. that can be executed to implement the communication method of one embodiment of the present disclosure.

[0091] The auxiliary storage device 1003 is a computer-readable recording medium, and may be composed of at least one of an optical disk such as a CD-ROM (CompactDisc ROM), a hard disk drive, a floppy disk, a magneto-optical disk (e.g., a compact disk, a digital versatile disk, a Blu-ray (registered trademark) disk, a smart card, a flash memory (e.g., a card, a stick, a key drive), a Floppy (registered trademark) disk, a magnetic strip, etc. The above-mentioned storage medium may be, for example, a database, a server, and other appropriate media including at least one of the storage device 1002 and the auxiliary storage device 1003.

[0092] The communication device 1004 is hardware (transceiver device) for communicating between computers via at least one of a wired network and a wireless network, and may also be referred to as a network device, a network controller, a network card, a communication module, etc. The communication device 1004 may also be configured to include a high-frequency switch, a duplexer, a filter, a frequency synthesizer, etc., for example, in order to realize at least one of frequency division duplex (FDD: Frequency Division Duplex) and time division duplex (TDD: Time Division Duplex). For example, a transceiver antenna, an amplifier, a transceiver, a transmission path interface, etc. may also be realized by the communication device 1004. The transceiver may also be installed physically or logically separately from the transmitter and the receiver.

[0093] The input device 1005 is an input device that receives input from the outside (e.g., a keyboard, a mouse, a microphone, a switch, a button, a sensor, etc.). The output device 1006 is an output device that implements output to the outside (e.g., a display, a speaker, an LED light, etc.). In addition, the input device 1005 and the output device 1006 may also be integrally formed (e.g., a touch panel).

[0094] In addition, the processor 1001 and the storage device 1002 and other devices are connected via a bus 1007 for communicating information. The bus 1007 may be configured using a single bus or may be configured using different buses for each device.

[0095] In addition, the network node 10 and the user device 20 may be configured to include hardware such as a microprocessor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), or an FPGA (Field Programmable Gate Array), and a part or all of each functional block may be implemented by the hardware. For example, the processor 1001 may also be implemented using at least one of these hardware.

[0096] (Summary of Implementation Methods)

[0097] As described above, according to an embodiment of the present invention, there is provided a network node comprising: a receiving unit which receives information for improving the security of communication between network nodes from a management node; and a control unit which receives a request sent from a first network node configured in a first PLMN (Public Land Mobile Network), and sends the request to a second network node configured in a second PLMN, based on the information for improving security.

[0098] According to the above structure, the NF service as the network node 10 can establish mutual TLS between Envoy and communicate securely with other NF services. In addition, the NF service as the network node 10 can perform authentication via Envoy through the ServiceRole (service role) and ServiceRoleBinding (service role binding) provided by IstioPilot. In addition, even if the network structure based on NF and the network structure based on NF service in which Envoy becomes a proxy are mixed in VPLMN and HPLMN, the NF service or NF as the network node 10 can establish TLS for secure communication, and perform authentication via Envoy through the ServiceRole (service role) and ServiceRoleBinding (service role binding) provided by IstioPilot. That is, communication with improved security can be performed between network nodes.

[0099] Alternatively, the first PLMN is a VPLMN (Visited PLMN), the second PLMN is a HPLMN (Home PLMN), and at least one of the first network node and the second network node is a NF (Network Function) service. According to this structure, in a roaming environment, communication with improved security can be performed between network nodes.

[0100] Alternatively, the first network node is an NF service and the second network node is an NF, or the first network node is an NF and the second network node is an NF service. According to this structure, in a roaming environment, even when the structure of the network is different between the NF and the NF service, communication with improved security can be performed between network nodes.

[0101] Alternatively, the information for improving security is a TLS (Transport Layer Security) policy, the control unit establishes a first mutual TLS with the first network node, establishes a second mutual TLS with a SEPP (Security Edge Protection Proxy) in the first PLMN, receives the request via the established first mutual TLS, and sends the request via the established second mutual TLS. According to this structure, in a roaming environment, communication with improved security can be performed between network nodes through mutual TLS.

[0102] Alternatively, the information for improving security is ServiceRole and ServiceRoleBinding, and the control unit implements the following functions based on the service role and service role binding: obtaining and using a token for sending the request to the second network node. According to this structure, communication with improved security can be performed between network nodes via Envoy that implements the token function.

[0103] (Supplementary Implementation Methods)

[0104] The above describes the embodiments of the present invention, but the disclosed invention is not limited to such embodiments, and a person skilled in the art should understand various variations, modifications, substitutions, replacements, etc. In order to facilitate the understanding of the invention, specific numerical examples are used for description, but unless otherwise specified, these numerical values ​​are only examples, and any appropriate value may also be used. The distinction between the items in the above description is not essential to the present invention, and the items recorded in two or more items may be combined and used as needed, and the items recorded in one item may be applied to the items recorded in another item (as long as there is no contradiction). The boundaries of the functional units or processing units in the functional block diagram do not necessarily correspond to the boundaries of the physical components. The actions of multiple functional units may be performed by one physical component, or the actions of one functional unit may be performed by multiple physical components. Regarding the processing procedures described in the embodiments, the order of processing may be swapped if there is no contradiction. In order to facilitate the description of the processing, the network node 10 and the user device 20 are described using a functional block diagram, and such a device may also be implemented by hardware, software, or a combination thereof. According to an embodiment of the present invention, the software that operates through the processor of the network node 10 and the software that operates through the processor of the user device 20 according to an embodiment of the present invention can be stored in a random access memory (RAM), a flash memory, a read-only memory (ROM), an EPROM, an EEPROM, a register, a hard disk (HDD), a removable disk, a CD-ROM, a database, a server, and any other appropriate storage medium.

[0105] In addition, the notification of information is not limited to the form / implementation method described in the present disclosure, and other methods may also be used. For example, the notification of information may be implemented through physical layer signaling (e.g., DCI (Downlink Control Information), UCI (Uplink Control Information)), high-layer signaling (e.g., RRC (Radio Resource Control) signaling, MAC (Medium Access Control) signaling, broadcast information (MIB (Master Information Block), SIB (System Information Block)), other signals or a combination thereof. In addition, RRC signaling may be referred to as an RRC message, for example, it may also be an RRC Connection Setup message, an RRC Connection Reconfiguration message, etc.

[0106] Each form / implementation described in the present disclosure may also be applied to at least one of LTE (Long Term Evolution), LTE-A (LTE-Advanced), SUPER 3G, IMT-Advanced, 4G (4th generation mobile communication system), 5G (5th generation mobile communication system), FRA (Future Radio Access), NR (new Radio), W-CDMA (registered trademark), GSM (registered trademark), CDMA 2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), IEEE 802.20, UWB (Ultra-WideBand), Bluetooth (registered trademark), systems using other appropriate systems, and next-generation systems extended therefrom. In addition, a combination of a plurality of systems (for example, a combination of at least one of LTE and LTE-A with 5G, etc.) may be applied.

[0107] The processing procedures, timings, and flows of each form / implementation described in this specification may be changed in order if there is no contradiction. For example, the methods described in this disclosure use the order of examples to indicate the elements of various steps, and are not limited to the specific order indicated.

[0108] In this specification, a specific action performed by the network node 10 is sometimes performed by its upper node according to the situation. In a network composed of one or more network nodes having the network node 10, various actions performed to communicate with the user device 20 can be performed by at least one of the network node 10 and other network nodes other than the network node 10 (for example, MME or S-GW, etc. are considered, but not limited to these). In the above, the case where the other network node other than the network node 10 is one is illustrated, but the other network node may also be a combination of multiple other network nodes (for example, MME and S-GW).

[0109] The information or signals described in the present disclosure can be output from a higher layer (or a lower layer) to a lower layer (or a higher layer), and can also be input or output via a plurality of network nodes.

[0110] The input or output information can be stored in a specific location (e.g., memory) or managed using a management table. The input or output information can be rewritten, updated, or appended. The output information can also be deleted. The input information can also be sent to other devices.

[0111] The determination in the present disclosure may be performed by a value represented by 1 bit (0 or 1), by a Boolean value (Boolean: true or false), or by comparison of numerical values ​​(for example, comparison with a predetermined value).

[0112] Software, whether referred to as software, firmware, middleware, microcode, hardware description language, or by other names, shall be interpreted broadly to refer to commands, sets of commands, codes, code segments, program codes, programs, subroutines, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, execution threads, procedures, functions, etc.

[0113] In addition, software, commands, information, etc. may be sent and received via a transmission medium. For example, when software is sent from a web page, server, or other remote source using at least one of wired technology (coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), etc.) and wireless technology (infrared, microwave, etc.), at least one of these wired technology and wireless technology is included in the definition of transmission medium.

[0114] The information, signals, etc. described in the present disclosure may also be represented by any of a variety of different technologies. For example, data, instructions, commands, information, signals, bits, symbols, chips, etc. that may be involved in the above description as a whole may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, light fields or photons, or any combination thereof.

[0115] In addition, the terms described in the present disclosure and the terms required for understanding the present disclosure may be replaced with terms having the same or similar meanings. For example, at least one of a channel and a symbol may also be a signal (signaling). In addition, a signal may also be a message. In addition, a component carrier (CC) may also be referred to as a carrier frequency, a cell, a frequency carrier, etc.

[0116] The terms "system" and "network" used in this disclosure may be used interchangeably.

[0117] In addition, the information, parameters, etc. described in the present disclosure may be represented by absolute values, relative values ​​to predetermined values, or other corresponding information. For example, wireless resources may also be indicated by indexes.

[0118] The names used for the above parameters are not limiting in any way. Also, the formulas etc. using these parameters may sometimes differ from those explicitly disclosed in this disclosure. Since various channels (e.g., PUCCH, PDCCH, etc.) and information elements can be identified by all appropriate names, the various names assigned to these various channels and information elements are not limiting in any way.

[0119] In the present disclosure, the terms "base station (BS)," "wireless base station", "base station device", "fixed station", "NodeB", "eNodeB (eNB)", "gNodeB (gNB)", "access point", "transmission point", "reception point", "transmission / reception point", "cell", "sector", "cell group", "carrier", "component carrier" and the like are used interchangeably. Sometimes, the base station is also referred to as macro cell, small cell, femto cell, pico cell and the like.

[0120] A base station can accommodate one or more (for example, 3) cells. When a base station accommodates multiple cells, the overall coverage area of ​​the base station can be divided into multiple smaller areas, and each smaller area can also provide communication services through a base station subsystem (for example, a small base station for indoor use (RRH: Remote Radio Head)). Terms such as "cell" or "sector" refer to a part or the entirety of the coverage area of ​​at least one of a base station and a base station subsystem that provide communication services within its coverage area.

[0121] In the present disclosure, terms such as “mobile station (MS)”, “user terminal (user terminal)”, “user equipment (UE)”, and “terminal” may be used interchangeably.

[0122] Regarding mobile stations, those skilled in the art sometimes also refer to them as subscriber stations, mobile units, subscriber units, wireless units, remote units, mobile devices, wireless devices, wireless communication devices, remote devices, mobile subscriber stations, access terminals, mobile terminals, wireless terminals, remote terminals, handsets, user agents, mobile clients, clients or some other appropriate terms.

[0123] At least one of the base station and the mobile station may also be referred to as a transmitting device, a receiving device, a communication device, etc. In addition, at least one of the base station and the mobile station may also be a device mounted on a mobile body, the mobile body itself, etc. The mobile body may be a means of transportation (e.g., a car, an airplane, etc.), a mobile body that moves unmanned (e.g., a drone, an autonomous vehicle, etc.), or a robot (manned or unmanned). In addition, at least one of the base station and the mobile station also includes a device that does not necessarily move during communication operations. For example, at least one of the base station and the mobile station may also be an IoT (Internet of Things) device such as a sensor.

[0124] In addition, the base station in the present disclosure may also be replaced by a user terminal. For example, various forms / implementations of the present disclosure may also be applied to a structure in which the communication between a base station and a user terminal is replaced by the communication between multiple user devices 20 (for example, may also be referred to as D2D (Device-to-Device), V2X (Vehicle-to-Everything), etc.). In this case, it may also be configured that the user device 20 has the functions possessed by the above-mentioned network node 10. In addition, terms such as "uplink" and "downlink" may also be replaced by terms corresponding to inter-terminal communication (for example, "side"). For example, an uplink channel, a downlink channel, etc. may also be replaced by a side channel.

[0125] Likewise, the user terminal in the present disclosure may be replaced by a base station. In this case, the base station may have the functions of the user terminal described above.

[0126] The terms "determining" and "determining" used in the present disclosure sometimes include a variety of actions. "Determining" and "determining" may include, for example, situations where matters such as judging, calculating, computing, processing, deriving, investigating, looking up, searching, inquiring (e.g., searching in a table, database or other data structure), and ascertaining are considered to have been "determined" or "determined". In addition, "determining" and "determining" may include situations where matters such as receiving (e.g., receiving information), transmitting (e.g., transmitting information), inputting, outputting, accessing (e.g., accessing data in a memory) are considered to have been "determined" or "determined". In addition, "determining" and "determining" may include situations where matters such as resolving, selecting, choosing, establishing, comparing, etc. are considered to have been "determined" or "determined". That is, "judgment" and "decision" can include the case where any action is "judged" and "decided". In addition, "judgment (decision)" can be replaced with "assuming", "expecting", "considering" and the like.

[0127] The terms "connected", "coupled" or all variations of these terms are intended to indicate any direct or indirect connection or combination between two or more elements, and may include the situation where one or more intermediate elements exist between the two elements that are "connected" or "coupled" to each other. The combination or connection between the elements may be a physical combination or connection, a logical combination or connection, or a combination thereof. For example, "connection" may also be replaced by "access". In the context of the present disclosure, for two elements, it may be considered that they are "connected" or "coupled" to each other by using at least one of one or more wires, cables, and printed electrical connections, and as some non-limiting and non-inclusive examples, by using electromagnetic energy having a wavelength in the wireless frequency domain, microwave region, and light (including both visible and invisible) region.

[0128] The reference signal may also be referred to as RS (Reference Signal) or may be called a pilot signal depending on the applied standard.

[0129] The phrase "according to" used in the present disclosure does not mean "only according to" unless otherwise expressly stated. In other words, the phrase "according to" means both "only according to" and "at least according to".

[0130] Any reference to an element using the terms "first", "second", etc. used in this disclosure does not necessarily limit the number or order of these elements. These terms can be used in this disclosure as a simple method to distinguish between two or more elements. Therefore, a reference to a first element and a second element does not mean that only two elements can be used or that the first element must precede the second element in any form.

[0131] The “unit” in the configuration of each of the above-mentioned devices may be replaced with a “section”, “circuit”, “device” or the like.

[0132] In the present disclosure, when "include", "including" and their variations are used, these terms mean inclusiveness like the term "comprising". In addition, the term "or" used in the present disclosure does not mean exclusive or.

[0133] In the present disclosure, for example, when an article is added due to translation like a, an, and the in English, the present disclosure may also include a case where the noun following the article is in plural form.

[0134] In the present disclosure, the phrase "A and B are different" may also mean "A and B are different from each other". In addition, the phrase may also mean "A and B are different from C, respectively". The phrases such as "separate" and "combine" may also be interpreted as "different".

[0135] Each form / implementation described in the present disclosure may be used alone or in combination, and may be switched according to execution. In addition, notification of scheduled information is not limited to being performed explicitly (e.g., notification of "yes X"), but may also be performed implicitly (e.g., not notifying the scheduled information).

[0136] In addition, NF, NF service, NRF, SEPP, 3gppGW, IstioPilot or Envoy in the present disclosure and their combination are examples of network nodes. IstioPilot is an example of a management node.

[0137] The present disclosure is described in detail above, but it should be clear to those skilled in the art that the present disclosure is not limited to the embodiments described in the present disclosure. The present disclosure can be implemented as a modification and variation without departing from the subject matter and scope of the present disclosure as determined by the claims. Therefore, the purpose of the description of the present disclosure is to illustrate and not to have any limiting meaning on the present disclosure.

[0138] This international patent application claims priority based on Japanese Patent Application No. 2019-075884 filed on April 11, 2019, and all contents of Japanese Patent Application No. 2019-075884 are incorporated herein by reference.

[0139] Description of symbols

[0140] 10: network node;

[0141] 110: Sending department;

[0142] 120: receiving unit;

[0143] 130: Setting department;

[0144] 140: Control Department;

[0145] 20: user device;

[0146] 210: Sending department;

[0147] 220: receiving unit;

[0148] 230: Setting department;

[0149] 240: Control Department;

[0150] 1001: processor;

[0151] 1002: storage device;

[0152] 1003: auxiliary storage device;

[0153] 1004: Communication device;

[0154] 1005: input device;

[0155] 1006: Output device.

Claims

1. A network node, comprising: A control unit that establishes mutual TLS (mutual transport layer security) with the first network node; a receiving unit configured to receive a service request from the first network node via the TLS; and a sending unit, which sends a token request to the second network node according to the service request, The receiving unit receives a token from the second network node. The sending unit sends a service request accompanied by the token to a third network node, The control unit acquires information for discovering a destination NF service from an HTTP header of a service request received from the first network node.

2. The network node according to claim 1, wherein: The first network node is located in a VPLMN, namely a visited public land mobile network, and the second network node and the third network node are located in a HPLMN, namely a home public land mobile network.

Images