Network Slicing Application Access Control

Abstract

A method for controlling access of an application to a network slice service at a user equipment (UE) is disclosed. The method includes: issuing an activation request for establishing a network connection service for an application executed at the UE, the activation request including an application identifier of the application; determining a network slice for the application based on the activation request; performing verification of the determined network slice according to a network slice operator policy; and creating a binding between the application identifier and the determined network slice upon successful verification of the determined network slice.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to network slicing in a 5G communication network. Background Art

[0002] Design aspects of the 5G system (5GS) architecture include the modularization of network functions (NFs) to enable flexible and efficient "network slicing". Network slicing is a 5G concept that aims to make 5GS an end-to-end (E2E), scalable and adaptive system that supports various types of communication services, different traffic requirements and different end-user types. For example, some of the communication services that 5G is expected to support include enhanced mobile broadband (eMBB), massive Internet of Things (mIoT) and ultra-reliable low-latency communications (URLLC).

[0003] Figure 1 The figure shows the 5G concept of network slicing as described in the 3GPP TS 28.530 v0.4.0 document. Figure 1 As shown, network slicing is based on sharing all or part of a common physical infrastructure to create and operate multiple logically independent networks, each designed to support its own communication service instance. Specifically, the necessary core network (CN) and access network (AN) functions are grouped together to preconfigure network slices with different characteristics. Network slices are deployed to end users as network slice instances (NSIs). For example, Figure 1 Three different network slice instances NSI A, NSI B and NSI C are shown, which are deployed to serve the first communication service instance (communication service instance 1), the second communication service instance (communication service instance 2) and the third communication service instance (communication service instance 3), respectively. NSI A is a network slice instance of a network slice that provides CN functionality (CN-1) and AN functionality (AN-1). In this way, NSI A includes the network slice subnet instance (NSSI) of CN-1 (i.e., CN-1 instance) and the NSSI of AN-1 (i.e., AN-1 instance). Similarly, NSI B is a network slice instance of a network slice that provides CN-2 functionality and AN-2 functionality. NSI C is a network slice instance of a network slice that provides CN-3 functionality and the same AN-2 functionality as provided by NSI B.

[0004] A network slice instance is identified by S-NSSAI (Single Network Slice Selection Assistance Information) which includes a slice / service type (SST) and a slice distinguisher (SD). The SST specifies the expected network slice behavior in terms of features and services. The optional SD supplements the SST to distinguish between multiple network slice instances with the same SST. For example, an operator can deploy multiple network slice instances to provide the same functionality to different UE groups. Such network slice instances will have the same SST but different SDs and therefore different S-NSSAI.

[0005] A UE can be served by a 5G network using one or more network slice instances simultaneously and can be associated with a total of eight different S-NSSAIs at a given time. The set of S-NSSAIs is called NSSAI. The NSSAI can be an allowed NSSAI, a configured NSSAI, or a requested NSSAI. For example, the allowed NSSAI is the NSSAI provided to the UE by the serving public land mobile network (PLMN) during the registration process and indicates the S-NSSAI to be used by the UE in the serving PLMN. The configured NSSAI represents the NSSAI provisioned per PLMN in the UE. The requested NSSAI is the NSSAI provided by the UE to the serving PLMN during registration and contains the (multiple) S-NSSAIs of the (multiple) network slice instances to which the UE wishes to register.

[0006] Figure 2 The diagram illustrates the registration process for a UE to register with a 5GS. A detailed description of the process can be found in 3GPP TS 23.502v15.0.0 (Section 4.2.2.2) and is not repeated here. It is assumed that the UE will register with a network slice instance using this process. Specifically, when the UE registers with a PLMN, if the UE has a configured NSSAI or an allowed NSSAI for the PLMN, the UE provides the network with a requested NSSAI. When the UE does not have an allowed NSSAI for the PLMN, the requested NSSAI corresponds to the configured NSSAI or a subset thereof. Otherwise, if the UE has an allowed NSSAI for the PLMN, the requested NSSAI is the allowed NSSAI or a subset thereof, and if the UE additionally has a configured NSSAI for the PLMN, the requested NSSAI also includes one or more S-NSSAIs from the configured NSSAI that are not present in the allowed NSSAI and have not been previously rejected by the network.

[0007] The requested NSSAI provided by the UE allows the network to select a serving access management function (AMF) for the UE. The serving AMF validates the requested NSSAI against the UE subscription information (containing one or more subscribed NSSAIs) and interacts with the Network Slice Selection Function (NSSF) to select a set of (multiple) network slice instances to serve the UE.

[0008] The 3GPP TS 23.503 v16.1.0 document describes a User Routing Selection Policy (URSP) that the UE can use to determine whether a detected application can be associated with an established Protocol Data Unit (PDU) session; can be offloaded to a non-3GPP access (e.g., WiFi); or can trigger the establishment of a new PDU session. However, the existing 5G standards do not describe how to determine a network slice for a specific application and how to control network slice access based on the operator's policies at the UE and on 3GPP and non-3GPP access networks.

[0009] The present invention was made in view of these gaps in the existing 5G standards. Summary of the invention

[0010] The present invention provides a method for controlling application access to network slice services at a user equipment (UE). In an embodiment, the method includes:

[0011] issuing an activation request for establishing a network connection service for an application executed at the UE, the activation request including an application identifier of the application;

[0012] Determining a network slice for the application based on the activation request;

[0013] performing validation of the determined network slice in accordance with the network slice operator policy; and

[0014] Upon successful verification of the determined network slice, a binding between the application identifier and the determined network slice is created.

[0015] The binding between the application identifier and the determined network slice allows the UE to use the determined network slice for flows belonging to the application.

[0016] In an embodiment, the method comprises: receiving a packet associated with an application; and according to the binding, associating the packet with a protocol data unit (PDU) session matching a network slice determined for the application. In an embodiment, the packet is received via a socket uniquely associated with the application by its application identifier.

[0017] In an embodiment, in order to obtain access to a network slicing service, the application registers with a server of a network operator or a third party to which the network operator provides network services such as network slicing services. Specifically, the method may include: sending a registration request for the application to an application layer function (ALF) server; and receiving an application identifier from the ALF server when the application is successfully registered.

[0018] The application identifier uniquely identifies the application on the ALF server.

[0019] In an embodiment, the method includes receiving security information and billing information of the application from the ALF server when the application is successfully registered.

[0020] In an embodiment, the registration request includes information associated with the ALF instance created at the UE. The information associated with the ALF instance may include ALF instance identification information for identifying the ALF instance to the ALF server and ALF instance authentication information for authenticating the ALF instance to the ALF server.

[0021] In an embodiment, the activation request includes service level information associated with the application. The service level information may include network slice information associated with the application. The network slice information may include GSMA Generic Slicing Template (GST) and / or Network Slicing Type (NEST) information.

[0022] In an embodiment, the method includes mapping network slice information to determine a network slice for an application.

[0023] In an embodiment, the method comprises:

[0024] issuing a modification request for modifying a network connection service established for the application, the modification request including an application identifier of the application;

[0025] Determine a new network slice for the application based on the modification request;

[0026] performing validation of the determined new network slice in accordance with the network slice operator policy; and

[0027] A new binding is created between the application identifier and the new network slice.

[0028] In another embodiment, the method comprises:

[0029] Sending a registration modification request for the application to the ALF server; and receiving a new application identifier from the ALF server when the registration of the application is successfully modified. In an embodiment, the method further comprises receiving security information and / or billing information associated with the modified registration.

[0030] In another aspect, the present invention provides a UE, comprising:

[0031] Processor; and

[0032] A memory storing instructions which, when executed by a processor, configure the processor to perform a method according to any of the above method embodiments.

[0033] In an embodiment, any of the above method embodiments may be implemented as instructions of a computer program. Thus, the present disclosure provides a computer program comprising instructions which, when executed by a processor, cause the processor to perform a method according to any of the above method embodiments.

[0034] The computer program may use any programming language, and may take the form of source code, object code, or a code between source code and object code, such as a partially compiled code, or any other desired form.

[0035] The computer program may be recorded on a computer readable medium. Likewise, the present disclosure also relates to a computer readable medium having recorded thereon a computer program as described above. The computer readable medium may be any entity or device capable of storing a computer program. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Further features and advantages of the present invention will become apparent from the following description of specific embodiments thereof, which are given by way of illustration only and not limitation, with reference to the accompanying drawings, in which:

[0037] Figure 1 The 5G concept of network slicing is illustrated;

[0038] Figure 2 The diagram illustrates the process of user equipment (UE) registering with the 5G system;

[0039] Figure 3 is a block diagram illustrating an example system according to an embodiment of the present invention;

[0040] Figure 4 illustrates an example process for registering an application to access a network slice service according to an embodiment;

[0041] Figure 5 An example process involving application access to network slice services according to an embodiment of the present invention is illustrated;

[0042] Figure 6 An example process for controlling application access to network slice services according to an embodiment of the present invention is illustrated;

[0043] Figure 7 A computer device that can be used to implement an embodiment of the present invention is illustrated. DETAILED DESCRIPTION

[0044] Disclosed herein are systems and methods for controlling application access to network slicing services in 5G networks.

[0045] Figure 3 is a block diagram illustrating an example system 300 in which embodiments may be implemented. Example system 300 is provided for purposes of illustration only and is not a limitation of embodiments.

[0046] like Figure 3 As shown, example system 300 includes user equipment (UE) 302 , 3GPP network system 314 , and server 320 .

[0047] In a non-limiting embodiment, the UE 302 implements an application layer function (ALF), which can be instantiated to generate at least one ALF instance 304 running at the UE 302. The UE 302 also implements a network service enabling layer (NSEL), which can be instantiated to generate at least one NSEL instance 306 running at the UE 302. Communication between an ALF instance, such as the ALF instance 304, and an NSEL instance, such as the NSEL instance 306, is supported by an application support interface (ASI) 312.

[0048] In the example embodiment, NSEL instance 306 includes ALF management and configuration functionality 308 and network policy enforcement functionality 310 .

[0049] The 3GPP network system 314 includes a 5G policy control function (PCF) 316. In an embodiment, the PCF 316 supports the User Routing Selection Policy (URSP) function described in the 3GPP TS 23.503 v16.1.0 document, and according to an embodiment, the URSP function is further extended to support network slice access control functions, as further described below.

[0050] In an embodiment, the NSEL instance 306 communicates with the 3GPP network system 314 via a network connection interface (NCI) 318. In a particular embodiment, the NCI 318 enables a communication path 324 between the NSEL instance 306 and the PCF 316.

[0051] The network operator server 320 belongs to the operator of the communication network or a third party for which the network operator provides network services such as network connectivity with network slicing. In an embodiment, the server 320 implements an application layer function (ALF) server 326, which is configured to interact with an ALF instance (such as ALF instance 304). In an embodiment, an application layer interface (ALI) 322 is enabled between the ALF instance and the network ALF 326 by the ASI 312, the NSEL instance 306, the NCI 318, and the 3GPP network system 314.

[0052] In an embodiment, the ALF instance 304 may support one or more applications ( Figure 3 The supported applications may be of any type, including, for example, video, voice, gaming, mobile, Internet of Things (IoT), etc.

[0053] For a given supported application, the ALF instance 304 may store information identifying the application and service level information associated with the application. The service level information may include quality of service (QoS) information, quality of experience (QoE) information, and / or network slicing information (such as GSMA Generic Slicing Template (GST) and / or Network Slicing Type (NEST) information associated with the application). The GST and / or NEST information uses a generic set of attributes to describe the requirements of the application. The GST and / or NEST information may be defined by the GSMA NG.116 Generic Network Slicing Template v0.1.

[0054] In an embodiment, the ALF instance 304 interacts with the ALF server 326 of the server 320 to obtain application identifiers, security credentials, and / or billing policy information for supported applications.

[0055] In certain embodiments, the ALF instance 304 registers the application with the ALF server 326 to obtain an application identifier for the application at the ALF server 326. The application identifier uniquely identifies the application at the ALF server 326 and NSEL level.

[0056] Figure 4 An example process 400 for registering an application to access a network slice service according to an embodiment is illustrated. For illustration purposes only, the example process 400 is shown as Figure 3 However, based on the teachings herein, one skilled in the art will appreciate that the example process 400 may be implemented in different Figure 3 is executed in the system shown.

[0057] like Figure 4 As shown, the example process 400 begins at step 402, which includes the ALF instance 304 sending a registration request for an application to the ALF server 326. In an embodiment, the ALF instance 304 issues a registration request (ALF_Register_Request) via an application programming interface (API) provided by the network to send the registration request.

[0058] In an embodiment, the registration request includes information identifying the application, service level information associated with the application, and / or UE subscriber information. The service level information may include QoS information, QoE information, and / or network slice information, such as GSMA GST and / or NEST information associated with the application.

[0059] The registration request may also include information associated with the ALF instance 304. The information associated with the ALF instance 304 may include ALF instance identification information for identifying the ALF instance 304 to the ALF server 326. The information associated with the ALF instance 304 may also include ALF instance authentication information for authenticating the ALF instance 304 to the ALF server 326.

[0060] Registration requests can be made via Figure 4 The NSEL instance 306 is shown, or the NSEL instance 306 may be bypassed.

[0061] In an embodiment, Figure 4 As shown, the registration request arrives at NSEL instance 306 and is processed by ALF management and configuration function 308 of NSEL instance 306. ALF management and configuration function 308 then interacts with ALF server 326 to perform authentication and authorization based on the registration request.

[0062] Specifically, at step 404, the ALF management and configuration function 308 sends an authentication request to the ALF server 326. In an embodiment, the authentication request includes the ALF instance identification information and the ALF instance authentication information. The ALF instance identification information and / or the ALF instance authentication information may be extracted by the ALF management and configuration function 308 from the registration request issued by the ALF instance 304. Alternatively, the ALF management and configuration function 308 may generate the ALF instance identification information and / or the ALF instance authentication information itself in response to the registration request.

[0063] At step 406, the ALF server 326 responds to the authentication request from the ALF management and configuration function 308 with an authentication response. If the authentication fails, the process 400 terminates. Otherwise, the process 400 continues to step 408, which includes the ALF management and configuration function 308 sending an authorization request to the ALF server 326.

[0064] As will be appreciated by those skilled in the art based on the teachings herein, in other embodiments, the authentication and authorization requests may be sent consecutively (i.e., without an intervening response from the ALF server 326) or as a single request from the ALF management and configuration function 308 to the ALF server 326.

[0065] In an embodiment, the authorization request includes information identifying the application, service level information associated with the application, and / or UE subscriber information.

[0066] Based on one or more of the information contained in the authorization request, the ALF server 326 accepts or does not accept the registration request of the application. In an embodiment, the ALF server 326 successfully registers the application when it determines that the UE is allowed to access the network slice service based on the UE subscriber information contained in the authorization request.

[0067] In step 410 , the ALF server 326 sends a registration response to the ALF management and configuration function 308 .

[0068] If the registration of the application is successful, the registration response includes an application identifier of the application. The application identifier uniquely identifies the application at the ALF server 326 and NSEL level.

[0069] In an embodiment, the registration response also includes security information for authenticating and protecting the interaction between the application and the ALF server 326. In an embodiment, the ALF server 326 generates the necessary security information for the application upon successful registration of the application. The security information may include, for example, a password or verification code and a security key and / or other security credentials that allow the application to authenticate itself and protect its subsequent interactions with the ALF server 326.

[0070] In an embodiment, the registration response also includes billing information. The billing information may include credits or tokens that the application pays for using the service.

[0071] At step 412, the ALF management and configuration function 308 verifies the information carried by the registration response and accordingly configures the ALF instance 304. In an embodiment, the ALF management and configuration function 308 exposes the application identifier and security information to the ALF instance 304 via an API.

[0072] The registration process ends with the ALF instance 304 receiving the application identifier of the application at step 412. The ALF instance 304 may then use the application identifier to request network connection service access for the application, as described below with reference to Figure 5 Further described.

[0073] According to an embodiment, the ALF instance 304 may request to modify the registration of the application. In an embodiment, the ALF instance 304 uses a registration modification request API (ALF_Register_Modify) provided by the network or the ALF server 326 to send a registration modification request to the ALF server 326. The registration modification request may result in a modification of the application identifier and / or security information associated with the application.

[0074] The ALF instance 304 may also request to delete the registration of the application. In an embodiment, the ALF instance 304 uses a registration deletion request API (ALF_Register_Delete) provided by the network or the ALF server 326 to send a registration deletion request to the ALF server 326. In an embodiment, when the application is terminated or wishes to be disconnected from the network, the ALF instance 304 sends a registration deletion request to the ALF server 326.

[0075] Figure 5 An example process 500 involving application access to network slice services according to an embodiment of the present invention is illustrated. For illustration purposes only, the example process 500 is shown as Figure 3 However, based on the teachings herein, one skilled in the art will appreciate that the example process 500 may be implemented in different Figure 3 is executed in the system shown.

[0076] like Figure 5 As shown, the example process 500 begins at step 502, which includes the ALF instance 304 sending a login request to the ALF server 326. In an embodiment, the login request may include ALF instance identification information for identifying the ALF instance 304 to the ALF server 326 and / or ALF instance authentication information for authenticating the ALF instance 304 to the ALF server 326.

[0077] At step 504, ALF server 326 responds to the login request from ALF instance 304 by granting or denying the login depending on whether ALF instance 302 is successfully authenticated using the ALF instance authentication information. In an embodiment, a successful login results in ALI 322 being established between ALF instance 304 and ALF server 326.

[0078] As will be appreciated by those skilled in the art based on the teachings herein, in other embodiments, process 500 may begin at step 506 , with ALF instance 304 having previously logged into ALF server 326 .

[0079] At step 506, the ALF instance 304 issues an activation request for establishing a network connection service for the application executed at the UE. It is assumed that the ALF instance 304 has previously registered the application with the ALF server 326. Thus, the activation request includes an application identifier of the application, which is the same as the application identifier of the application described above. Figure 4 A description of the registration process is obtained.

[0080] The activation request may also include service level information associated with the application. The service level information may include QoS information, QoE information and / or network slicing information, such as GSMA GST and / or NEST information associated with the application. The GST and / or NEST information uses a generic set of attributes to describe the requirements of the application. The GST and / or NEST information may be defined by the GSMA NG.116 Generic Network Slicing Template v0.1.

[0081] In an embodiment, the ALF instance 304 sends an activation request to the NSEL instance 306 using a service activation API (NSEL_Service_Activate) provided by the NSEL instance 306 .

[0082] In step 508, the NSEL instance 306 processes the network slice information associated with the application (which may include GST information mapped to standardized or non-standardized NEST information) and maps it to the appropriate network slice S-NSSAI (such as the allowed, requested, or configured NSSAI defined in TS23.501 / TS23.502).

[0083] Subsequently, in step 510 , NSEL instance 306 initiates verification of the S-NSSAI determined for the application via network policy enforcement function 310 .

[0084] Specifically, in step 512, the network policy enforcement function 310 sends a UE registration request or a PDU establishment request (depending on whether the UE is registered with the network) to the 3GPP network system 314. The UE registration request or the PDU establishment request includes the S-NSSAI determined for the application and a flow descriptor that uniquely identifies the flow associated with the application. In an embodiment, the network policy enforcement function 310 implements a UE process for associating an application to (multiple) allocated network slices and associated PDU sessions based on the URSP described in section 6.6.2.3 of 3GPP TS 23.503V16.1.0 to determine a valid routing descriptor (which includes a network slice selection) for the application and the (multiple) PDU session, which matches all components in the selected routing descriptor.

[0085] At the 3GPP network system 314, the session management function (SMF) checks the S-NSSAI determined for the application against the network slice operator policy (including PCF / URSP policy). If the S-NSSAI complies with the network slice operator policy, the 3GPP network system 314 successfully verifies the S-NSSAI. Otherwise, the 3GPP network system 314 rejects the S-NSSAI of the application and may replace it with another allowed S-NSSAI. In step 514, the 3GPP network system 314 sends the verification result to the NSEL instance 306.

[0086] Then, in step 516, the 3GPP network system 314 (eg, SMF) creates and maintains a mapping between the flow descriptor of the application and the S-NSSAI allocated by the network for the application.

[0087] Next, at step 518, the network policy enforcement function 310 creates and maintains a binding between the application's application identifier (and / or flow descriptor) and the S-NSSAI assigned to the application by the network.

[0088] Then, in step 520, the network policy enforcement function 310 sends a response to the activation request to the ALF instance 304, notifying it that the network connection service is successfully established for the application. In an embodiment, the NSEL instance 306 notifies the ALF instance 304 using a service activation API (NSEL_Service_Activate).

[0089] Subsequently, the application data may flow from the application to the NSEL instance 306 via the ALF instance 304 for transmission over the 3GPP network system 314. In an embodiment, at step 522, the ALF instance 304 receives a packet from the application and forwards the packet to the NSEL instance 306. For example, the ALF instance 304 may use a socket on a uniquely programmed NSEL API to send and receive packets on the NSEL instance over the network via the assigned network slice. The ALF instance 304 specifies the application identifier of the application when forwarding the packet to the NSEL instance 306.

[0090] In step 524, the network policy enforcement function 310 uses the maintained binding between the application identifier (and / or flow descriptor) of the application and the S-NSSAI assigned to the application to associate the packet with a PDU session matching the network slice assigned to the application. In an embodiment, the network policy enforcement function 310 enforces the URSP determination made by the NSEL instance 306 for the application by ensuring that packets of the application (with authorized application identifiers) are only allowed to be sent and / or received through sockets that uniquely serve the application with the application ID to access the determined network slice and through matching PDU sessions (multiple).

[0091] The packet may then be sent to the 3GPP network system 314 via the assigned network slice and matching PDU session in step 526.

[0092] In an embodiment, in the 3GPP network system 314, in step 528, the SMF monitors the access of the application to the network slice. Specifically, depending on the stored mapping created in step 516, the SMF can enforce the use of the network slice determined for the application by the packet with the flow descriptor of the application. The SMF can also monitor the application's use of network resources including the allocated (multiple) network slices, and enforce usage rules according to the network slice selection determined for the application.

[0093] If the expected service level requirements and / or expected network slice services of the application change, the ALF instance 304 may request to modify the network connection service established for the application. In an embodiment, the ALF instance 302 uses the service modification API (NSEL_Service_Modify) provided by the NSEL instance 306 to send a modification request to the NSEL instance 306. The modification request may include information similar to the activation request described above.

[0094] When the application is closed, the ALF instance 304 can cancel the network connection service established for the application. In an embodiment, the ALF instance 302 uses the service cancellation API (NSEL_Service_Cancel) provided by the NSEL instance 306 to send a cancellation request to the NSEL instance 306.

[0095] Figure 6 An example process 600 for controlling application access to network slice services according to an embodiment of the present invention is illustrated. The example process 600 is provided for illustration purposes only and is not a limitation of the embodiment. In an embodiment, the example process 600 is performed at a UE.

[0096] like Figure 6 As shown, process 600 begins at step 602, which includes sending a registration request for an application executed at a UE to an ALF server.

[0097] In an embodiment, the registration request includes information identifying the application, service level information associated with the application, and / or UE subscriber information. The service level information may include QoS information, QoE information, and / or network slice information, such as GSMA GST and / or NEST information associated with the application.

[0098] In an embodiment, the registration request is issued by the ALF instance executed at the UE. The registration request may include information associated with the ALF instance executed at the UE. The information associated with the ALF instance may include ALF instance identification information for identifying the ALF instance to the ALF server and ALF instance authentication information for authenticating the ALF instance to the ALF server.

[0099] Step 604 includes receiving an application identifier from the ALF server upon successful registration of the application. The application identifier uniquely identifies the application on the ALF server.

[0100] In an embodiment, step 604 also includes receiving security information and / or billing information associated with the application. The security information may include, for example, a password or verification code and a security key and / or other security credentials that allow the application to authenticate itself and protect its interactions with the ALF server. The billing information may include credits or tokens that the application pays for using the service.

[0101] Next, optional step 606 includes the ALF instance logging into the ALF server to make a service request. In another embodiment, the ALF instance does not need to log in.

[0102] Subsequently, step 608 includes issuing an activation request to establish a network connection service for the application. In an embodiment, the activation request includes an application identifier of the application received from the ALF server. The activation request may also include service level information associated with the application. The service level information may include QoS information, QoE information and / or network slicing information, such as GSMAGST and / or NEST information associated with the application. GST and / or NEST information uses a common set of attributes to describe the requirements of the application. GST and / or NEST information can be defined by the GSMA NG.116 Generic Network Slicing Template v0.1.

[0103] Next, step 610 includes determining a network slice for the application based on the activation request. In an embodiment, step 610 includes mapping the network slice information included in the activation request to the network slice (S-NSSAI).

[0104] Subsequently, step 612 includes verifying the determined network slice according to the network slice operator policy. In an embodiment, step 612 includes sending a UE registration request including a PDU establishment request for the S-NSSAI determined for the application to the 3GPP network, and receiving a response verifying or rejecting the determined S-NSSAI.

[0105] Next, if the verification succeeds at step 612, step 614 includes creating a binding between the application identifier and the S-NSSAI determined for the application. In an embodiment, the binding is created and maintained by the NSEL instance executing at the UE.

[0106] Subsequently, step 616 includes receiving a packet associated with the application. In an embodiment, the packet is received by the NSEL instance from the ALF instance. In an embodiment, the packet is received via a socket uniquely associated with the application by its application identifier. The socket may be part of an API provided by the NSEL instance.

[0107] Process 600 ends with step 618, which includes associating the packet with a PDU session matching the network slice determined for the application based on the binding. In an embodiment, step 618 is performed by the NSEL instance.

[0108] Figure 7 The computer device 700 that can be used to implement the embodiment of the present invention is illustrated. Specifically, the ALF instance 304, NSEL instance 306, ALF management and configuration function 308, network policy enforcement function 310 and ALF server 326 described above can all be implemented using a computer device such as computer device 700.

[0109] like Figure 7 As shown, the computer device 700 includes a processor 702, a read-only memory (ROM) 704, a random access memory (RAM) 706, a non-volatile memory 708, and a communication device 710 (i.e., a transmitter and a receiver) suitable for supporting the communication functions of the implementation modules (e.g., the ALF instance 304, the NSEL instance 306, the ALF management and configuration function 308, the network policy enforcement function 310, and the ALF server 326).

[0110] The ROM 704 of the computer device 700 may store a computer program including instructions which, when executed by the processor 702, cause the processor 702 to perform the method of the present invention. The method may include the above Figure 4 , 5 and one or more of the steps described in 6.

[0111] Other variants

[0112] Although the invention has been described above with reference to certain specific embodiments, it should be understood that the invention is not limited to the details of the specific embodiments. Numerous changes, modifications and developments may be made to the above-described embodiments within the scope of the appended claims.

Claims

1. A method for controlling application access to a network slice service at a user equipment UE, the method comprising the following steps performed by the UE: issuing an activation request for establishing a network connection service for at least one application executed at the UE, the activation request comprising an application identifier of the at least one application and service level information, the service level information comprising network slice information associated with the at least one application; determining a network slice for the at least one application based on the application identifier and the service level information; Sending a request to a network system, the request comprising the network slice determined for the at least one application; as well as Upon receiving a response from the network system, the response verifying that the network slice determined for the at least one application complies with the network slice operator policy, creating a binding between the application identifier and the determined network slice.

2. The method according to claim 1, further comprising: associating packets associated with the application to a protocol data unit (PDU) session matching the network slice determined for the application using a binding between the application identifier and the network slice determined for the application; Packets associated with the application are sent to the network system via the network slice and matching PDU session determined for the application.

3. According to the method according to any one of claims 1-2, before determining the network slice for the at least one application, the method comprises: Sending a registration request for the application to an application layer function ALF server; as well as Upon successful registration of the application, an application identifier is received from the ALF server.

4. The method according to claim 3, wherein: The application identifier uniquely identifies the application at the ALF server.

5. The method according to claim 3, further comprising: When the application is successfully registered, security information and billing information for the application are received from the ALF server.

6. The method according to claim 1, wherein the network slicing information includes GSMA general slicing template GST and / or network slicing type NEST information.

7. The method according to any one of claims 1 to 2, comprising: Map network slice information to determine the network slice for the application.

8. The method according to any one of claims 4 to 5, wherein: The registration request includes information associated with the ALF instance executing at the UE.

9. The method according to claim 8, wherein: The information associated with the ALF instance includes: ALF instance identification information used to identify the ALF instance to the ALF server and ALF instance authentication information used to authenticate the ALF instance to the ALF server.

10. The method according to any one of claims 1 to 2, comprising: issuing a modification request for modifying a network connection service established for the application, the modification request including an application identifier of the application; Determining a new network slice for the application based on the modification request; performing verification of the determined new network slice by exchanging messages with the network system according to the network slice operator policy; as well as A new binding is created between the application identifier and the new network slice.

11. The method according to any one of claims 1 to 2, comprising: Sending a registration modification request for the application to the ALF server; as well as Upon successful modification of the registration of the application, a new application identifier is received from the ALF server.

12. A user equipment, comprising: processor; as well as A memory storing instructions which, when executed by the processor, configure the processor (702) to perform a method according to any one of claims 1-11.

13. A computer program product comprising instructions which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 11.

Images