User Equipment UE

Abstract

Provided are a process and a communication unit for implementing network slice specific authentication and authorization in 5GS, based on initial login, periodic or mobile login of UE. Also provided are a process for changing the settings of UE initiated by the network, based on network slice specific authentication and authorization, and initiated upon completion of network slice specific authentication and authorization, a non-login process initiated by the network, and a communication unit, thereby providing a communication unit for implementing functions related to network slice specific authentication and authorization in 5GS.

Description

Technical Field

[0001] The present application relates to a UE (User Equipment). The present application claims the benefit of priority to Japanese Patent Application No. 2019-198572 filed on October 31, 2019, and all the contents thereof are incorporated herein by reference. Background Art

[0002] In 3GPP (3rd Generation Partnership Project) which is carrying out standardization activities of mobile communication systems in recent years, SAE (System Architecture Evolution) which is a system architecture of LTE (Long Term Evolution) is being studied.

[0003] In addition, in recent years, 3GPP has also conducted research on the next-generation communication technology and system architecture of the 5G (5th Generation) mobile communication system, which is the next-generation mobile communication system. In particular, 5GS (5G System) has been standardized as a system for implementing the 5G mobile communication system (see Non-Patent Documents 1 and 2). In 5GS, technical issues for connecting various terminals to cellular networks are extracted and solutions are standardized.

[0004] Prior art literature

[0005] Non-patent literature

[0006] Non-patent document 1: 3GPP TS 23.501V16.1.0 (2019-06); 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; SystemArchitecture for the 5G System; Stage 2 (Release 16)

[0007] Non-patent document 2: 3GPP TS 23.502V16.1.1(2019-06); 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Procedures for the 5G System; Stage 2 (Release 16)

[0008] Non-patent document 3: 3GPP TS 24.501V16.2.0 (2019-09); 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 (Release 16) Summary of the invention

[0009] Problem that the invention aims to solve

[0010] In 5GS (5G System), research is being conducted on 5GCN (5G Core Network) as a new core network to provide various services.

[0011] Moreover, in 5G, network slices as logical networks that provide specific network functions and specific network characteristics are specified for specific service types and specific groups. For example, a network slice can be a logical network provided for a terminal with a low-latency function or a logical network provided for a sensor terminal for IoT (Internet of Things).

[0012] In 3GPP, eNS (Enhancement of Network Slicing) is being studied to study further functions associated with network slicing. In addition, in eNS, Network Slice-specific Authentication and Authorization (Network Slice-specific Authentication and Authorization) is being studied to further perform authentication processes for each network slice from the existing authentication process for each UE.

[0013] A study is conducted on the following: in a case where the UE requests in a registration request permission to connect to a network slice that requires network slice specific authentication and authorization, the network responds to the UE in a state pending notification of whether the network slice requested by the UE is an allowed slice or a rejected slice.

[0014] However, a specific scheme or method for managing information related to a pending network slice based on the UE and the network in the pending state of the network slice is not clear.

[0015] The present invention is completed in view of the above situation and provides a method for realizing the functions used in eNS in 5GS.

[0016] Technical Solution

[0017] The UE (User Equipment) of an embodiment of the present invention is characterized in that it comprises a control unit and a storage unit, wherein the control unit stores a first rejection NSSAI that is rejected due to failure or cancellation of authentication and authorization specific to a network slice, and when the control unit changes from a logged-in state to a non-logged-in state for a current PLMN on a first access and the UE is not logged in for the current PLMN on a second access, the storage unit deletes the first rejection NSSAI.

[0018] The UE (User Equipment) of an embodiment of the present invention is characterized in that it includes a transceiver and a control unit, and the transceiver receives a non-login request message including a rejection of NSSAI and information indicating an access type from a core network by a core network device. When the rejection of NSSAI includes at least a combination of an S-NSSAI and a reason value, the access type is information indicating 3GPP access or non-3GPP access or access of both parties, and the access type is information indicating either 3GPP access or non-3GPP access, and further, when the access type for the other party is in a non-login state, the control unit ignores the S-NSSAI.

[0019] Beneficial Effects

[0020] According to one solution of the present invention, in 5GS, eNS can be supported, network slice specific authentication and authorization can be supported, and UE supporting network slice specific authentication and authorization can log in to the core network supporting network slice specific authentication and authorization. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a diagram illustrating an overview of a mobile communication system (EPS / 5GS).

[0022] Figure 2This is a diagram illustrating the detailed structure of the mobile communication system (EPS / 5GS).

[0023] Figure 3 This is a diagram illustrating the device structure of UE.

[0024] Figure 4 This is a diagram illustrating the structure of the access network device (gNB) in 5GS.

[0025] Figure 5 This is a diagram illustrating the structure of the core network device (AMF / SMF / UPF) in 5GS.

[0026] Figure 6 is a diagram illustrating the login process.

[0027] Figure 7 is a diagram illustrating the network slice specific authentication and authorization process.

[0028] Figure 8 This is a diagram illustrating the process of changing / updating the UE's settings.

[0029] Fig. 9 It is a diagram illustrating the non-login process initiated by the network. DETAILED DESCRIPTION

[0030] Hereinafter, the best mode for carrying out the present invention will be described with reference to the accompanying drawings. It should be noted that in this embodiment, an embodiment of a mobile communication system in which the present invention is applied will be described as an example.

[0031] [1. System Overview]

[0032] first, Figure 1 is a diagram for explaining an outline of a mobile communication system 1 used in each embodiment. Figure 2 It is a diagram for explaining the detailed structure of the mobile communication system 1.

[0033] exist Figure 1 It is recorded that the mobile communication system 1 is composed of UE_A10, access network_A80, core network_A90, PDN (Packet Data Network: packet data network)_A5, access network_B120, core network_B190 and DN (Data Network: data network)_A6.

[0034] In the following, symbols are sometimes omitted to record these devices / functions, for example, UE, access network_A, core network_A, PDN, access network_B, core network_B, DN, etc.

[0035] In addition, Figure 2It records devices / functions such as UE_A10, E-UTRAN80, MME40, SGW35, PGW-U30, PGW-C32, PCRF60, HSS50, 5G AN120, AMF140, UPF130, SMF132, PCF160, UDM150, N3IWF170, and interfaces connecting these devices / functions to each other.

[0036] In the following, symbols are sometimes omitted to record these devices / functions, for example, UE, E-UTRAN, MME, SGW, PGW-U, PGW-C, PCRF, HSS, 5G AN, AMF, UPF, SMF, PCF, UDM, N3IWF, etc.

[0037] It should be noted that the EPS (Evolved Packet System) as a 4G system is composed of an access network_A and a core network_A, but may further include UE and / or PDN. In addition, the 5GS (5G System) as a 5G system is composed of a UE, an access network_B and a core network_B, but may further include a DN.

[0038] UE is a device that can connect to network services via 3GPP access (also known as 3GPP access network, 3GPP AN) and / or non-3GPP access (non-3GPP access, also known as non-3GPP access network, non-3GPP AN). UE can be a terminal device that can perform wireless communication, such as a portable phone or a smart phone, or a terminal device that can connect to EPS or 5GS. UE can have UICC (Universal Integrated Circuit Card) or eUICC (Embedded UICC). It should be noted that UE can be expressed as a user device or as a terminal device.

[0039] In addition, access network_A corresponds to E-UTRAN (Evolved Universal Terrestrial Radio Access Network) and / or wireless LAN access network. One or more eNBs (evolved Node Bs) 45 are configured in E-UTRAN. It should be noted that, in the following, the symbols for eNB45 are sometimes omitted, such as eNB. In addition, when there are multiple eNBs, each eNB is connected to each other, for example, via an X2 interface. In addition, one or more access points are configured in the wireless LAN access network.

[0040] In addition, access network_B corresponds to the 5G access network (5G AN). 5G AN is composed of NG-RAN (NG Radio Access Network: NG radio access network) and / or non-3GPP access network. One or more gNB (NRNodeB: NR node B) 122 are configured in NG-RAN. It should be noted that, below, the gNB122 is sometimes recorded with omitted symbols, such as eNB. The gNB is a node that provides the NR (New Radio: New Radio) user plane and control plane to the UE, and is a node connected to the 5GCN via the NG interface (including the N2 interface or the N3 interface). That is, the gNB is a base station device newly designed for 5GS, and has different functions from the base station device (eNB) used in the EPS which is a 4G system. In addition, when there are multiple gNBs, the gNBs are connected to each other, for example, via an Xn interface.

[0041] In addition, the non-3GPP access network can be an untrusted non-3GPP access network or a trusted non-3GPP access network. Here, the untrusted non-3GPP access network can be, for example, a non-3GPP access network such as a public wireless LAN that does not perform security management within the access network. On the other hand, the trusted non-3GPP access network can be an access network specified by 3GPP, and can also have TNAP (trusted non-3GPP access point) and TNGF (trusted non-3GPP Gateway function).

[0042] In addition, below, E-UTRAN and NG-RAN are referred to as 3GPP access. In addition, wireless LAN access network and non-3GPP AN (non-3GPP AN) are referred to as non-3GPP access. In addition, nodes configured in access network_B are also collectively referred to as NG-RAN nodes.

[0043] In addition, in the following, access network_A and / or access network_B and / or the device included in access network_A and / or the device included in access network_B are sometimes referred to as access networks or access network devices.

[0044] In addition, the core network_A corresponds to EPC (Evolved Packet Core). In the EPC, for example, MME (Mobility Management Entity), SGW (Serving Gateway), PGW (Packet Data Network Gateway)-U, PGW-C, PCRF (Policy and Charging Rules Function), HSS (Home Subscriber Server), etc. are configured.

[0045] In addition, core network_B corresponds to 5GCN (5G Core Network). In 5GCN, for example, AMF (Access and Mobility Management Function), UPF (User Plane Function), SMF (Session Management Function), PCF (Policy Control Function), UDM (Unified Data Management), etc. are configured. Here, 5GCN can be expressed as 5GC.

[0046] In addition, below, core network_A and / or core network_B, devices included in core network_A and / or devices included in core network_B are sometimes referred to as core networks or core network devices or devices within the core network.

[0047] The core network (core network_A and / or core network_B) can be an IP mobile communication network operated by a mobile communication operator (Mobile Network Operator; MNO) that connects the access network (access network_A and / or access network_B) with the PDN and / or DN, or it can be a core network used by a mobile communication operator that operates and manages the mobile communication system 1, or it can be a core network used by virtual mobile communication operators and virtual mobile communication service providers such as MVNO (Mobile Virtual Network Operator) and MVNE (Mobile Virtual Network Enabler).

[0048] In addition, Figure 1The case where PDN is the same as DN is recorded in the specification, but they can also be different. PDN can be a DN (Data Network) that provides communication services to UE. It should be noted that DN can be constructed as a packet data service network, and can also be constructed for each service. Moreover, PDN can include connected communication terminals. Therefore, connection with PDN can be connection with communication terminals and server devices configured for PDN. Moreover, sending and receiving user data with PDN can be sending and receiving user data with communication terminals and server devices configured for PDN. It should be noted that PDN can be expressed as DN, and DN can also be expressed as PDN.

[0049] In addition, hereinafter, at least a part of access network_A, core network_A, PDN, access network_B, core network_B, DN and / or one or more devices included therein are sometimes referred to as a network or a network device. That is, the network and / or network device sending and receiving messages and / or executing a process means that at least a part of access network_A, core network_A, PDN, access network_B, core network_B, DN and / or one or more devices included therein send and receive messages and / or execute a process.

[0050] In addition, the UE can be connected to the access network. In addition, the UE can be connected to the core network via the access network. Moreover, the UE can be connected to the PDN or DN via the access network and the core network. That is, the UE can send and receive (communicate) user data between the PDN or DN. When sending and receiving user data, not only IP (Internet Protocol) communication can be used, but also non-IP communication can be used.

[0051] Here, IP communication refers to data communication using IP, in which data is sent and received through IP packets. An IP packet consists of an IP header and a payload portion. The payload portion may include data sent and received by devices / functions included in EPS and devices / functions included in 5GS. In addition, non-IP communication refers to data communication that does not use IP, in which data is sent and received in a form different from the structure of IP packets. For example, non-IP communication can be data communication achieved by sending and receiving application data that is not assigned an IP header, or it can be assigned a MAC header, Ethernet (Ethernet, registered trademark) frame header, or other headers to send and receive user data sent and received by the UE.

[0052] In addition, the following can be configured in access network_A, core network_A, access network_B, core network_B, PDN_A, and DN_A: Figure 2For example, core network_A and / or core network_B may include AUSF (Authentication Server Function), AAA (Authentication, authorization, and accounting) server (AAA-S).

[0053] Here, AUSF is a core network device having an authentication function for 3GPP access and non-3GPP access, and more specifically, is a network function unit that receives a request for authentication for 3GPP access and / or non-3GPP access from a UE and performs an authentication process.

[0054] In addition, the AAA server is a device with authentication, authorization and billing functions that is directly connected to the AUSF or indirectly connected via other network devices. The AAA server can be a network device within the core network. It should be noted that the AAA server may not be included in the core network_A and / or the core network_B, but included in the PLMN (Public Land Mobile Network). That is, the AAA server can be a core network device or a device outside the core network. For example, the AAA server can be a server device within the PLMN managed by a 3rdParty.

[0055] It should be noted that in Figure 2 In the figure, for the sake of simplicity, each device / function is recorded as one, but multiple identical devices / functions may be configured in the mobile communication system 1. Specifically, multiple devices / functions such as UE_A10, E-UTRAN80, MME40, SGW35, PGW-U30, PGW-C32, PCRF60, HSS50, 5G AN120, AMF140, UPF130, SMF132, PCF160, and / or UDM150 are configured in the mobile communication system 1.

[0056] [2. Configuration of each device]

[0057] Next, the configuration of each device (UE and / or access network device and / or core network device) used in each embodiment is described using the accompanying drawings. It should be noted that each device can be configured as physical hardware, as logical (virtual) hardware configured on the basis of general hardware, or as software. In addition, at least part (including all) of the functions of each device can also be configured as physical hardware, logical hardware, or software.

[0058] It should be noted that each storage unit (storage unit_A340, storage unit_A440, storage unit_B540, storage unit_A640, storage unit_B740) in each device / function that appears below is composed of, for example, a semiconductor memory, an SSD (Solid State Drive), an HDD (Hard Disk Drive), etc. In addition, each storage unit can not only store the information originally set at the factory stage, but also store various information sent and received between devices / functions other than the device / function itself (such as UE and / or access network device and / or core network device and / or PDN and / or DN). In addition, each storage unit can store identification information, control information, flags, parameters, etc. included in the control messages sent and received in various communication processes described later. In addition, each storage unit can store this information in each UE. In addition, in the case of intercommunication between 5GS and EPS, each storage unit can store control messages and user data sent and received between the devices / functions included in 5GS and / or EPS. At this time, not only the data sent and received via the N26 interface can be stored, but also the data not sent and received via the N26 interface can be stored.

[0059] [2.1. UE device configuration]

[0060] First, use Figure 3 An example of the configuration of a UE (User Equipment) is described. The UE is composed of a control unit_A300, an antenna 310, a transceiver_A320, and a storage unit_A340. The control unit_A300, the transceiver_A320, and the storage unit_A340 are connected via a bus. The transceiver_A320 is connected to the antenna 310.

[0061] The control unit_A300 is a functional unit that controls the overall actions and functions of the UE. The control unit_A300 implements various processes in the UE by reading and executing various programs stored in the storage unit_A340 as needed.

[0062] The transceiver_A320 is a functional unit for wirelessly communicating with a base station device (eNB or gNB) in the access network via an antenna. That is, the UE can use the transceiver_A320 to send and receive user data and / or control information between the access network device and / or the core network device and / or the PDN and / or the DN.

[0063] Reference Figure 2To explain in detail, the UE can communicate with the base station device (eNB) in the E-UTRAN via the LTE-Uu interface by using the transceiver_A320. In addition, the UE can communicate with the base station device (gNB) in the 5G AN by using the transceiver_A320. In addition, the UE can send and receive NAS (Non-Access-Stratum) messages with the AMF via the N1 interface by using the transceiver_A320. However, the N1 interface is a logical interface, so the communication between the UE and the AMF is actually carried out via the 5G AN.

[0064] The storage unit_A340 is a functional unit for storing programs, user data, control information, etc. required for various actions of the UE.

[0065] [2.2.gNB device configuration]

[0066] Next, use Figure 4 The following describes an example of the device configuration of a gNB. The gNB is composed of a control unit_B500, an antenna 510, a network connection unit_B520, a transceiver unit_B530, and a storage unit_B540. The control unit_B500, the network connection unit_B520, the transceiver unit_B530, and the storage unit_B540 are connected via a bus. The transceiver unit_B530 is connected to the antenna 510.

[0067] The control unit_B500 is a functional unit that controls the overall actions / functions of the gNB. The control unit_B500 implements various processes in the gNB by reading and executing various programs stored in the storage unit_B540 as needed.

[0068] The network connection unit_B520 is a functional unit for gNB to communicate with AMF and / or UPF. That is, the gNB can use the network connection unit_B520 to send and receive user data and / or control information between the AMF and / or UPF.

[0069] The transceiver_B530 is a functional unit for wirelessly communicating with the UE via the antenna 510. That is, the gNB can use the transceiver_B530 to send and receive user data and / or control information between the UE.

[0070] Reference Figure 2 To explain in detail, the gNB in ​​the 5G AN can communicate with the AMF via the N2 interface by using the network connection unit_B520, and can communicate with the UPF via the N3 interface. In addition, the gNB can communicate with the UE by using the transceiver unit_B530.

[0071] Storage unit_B540 is a functional unit used to store programs, user data, control information, etc. required for various actions of gNB.

[0072] [2.3.AMF device configuration]

[0073] Next, use Figure 5 The following describes an example of the device configuration of AMF. AMF is composed of a control unit_B700, a network connection unit_B720, and a storage unit_B740. The control unit_B700, the network connection unit_B720, and the storage unit_B740 are connected via a bus. AMF may be a node that processes a control plane.

[0074] The control unit_B700 is a functional unit that controls the entire operation and function of the AMF. The control unit_B700 reads and executes various programs stored in the storage unit_B740 as needed to realize various processes in the AMF.

[0075] The network connection unit_B720 is a functional unit for connecting the AMF with the base station device (gNB) and / or SMF and / or PCF and / or UDM and / or SCEF in the 5G AN. That is, the AMF can use the network connection unit_B720 to send and receive user data and / or control information between the base station device (gNB) and / or SMF and / or PCF and / or UDM and / or SCEF in the 5G AN.

[0076] Reference Figure 2 To explain in detail, the AMF in the 5GCN can communicate with the gNB via the N2 interface by using the network connection unit_A620, can communicate with the UDM via the N8 interface, can communicate with the SMF via the N11 interface, and can communicate with the PCF via the N15 interface. In addition, the AMF can send and receive NAS messages with the UE via the N1 interface by using the network connection unit_A620. However, the N1 interface is a logical interface, so the communication between the UE and the AMF is actually carried out via the 5G AN. In addition, the AMF can communicate with the MME via the N26 interface by using the network connection unit_A620 when the N26 interface is supported.

[0077] Storage unit_B740 is a functional unit for storing programs, user data, control information, etc. required for various actions of AMF.

[0078] It should be noted that AMF has the following functions: the function of exchanging control messages with RAN using N2 interface, the function of exchanging NAS messages with UE using N1 interface, the function of encrypting and integrity protecting NAS messages, the registration management (RM) function, the connection management (CM) function, the reachability management function, the mobility management (Mobility management) function of UE, etc., the function of transmitting SM (Session Management) messages between UE and SMF, the access authentication (Access Authentication, Access Authorization) function, the security anchor function (SEA; Security Anchor Functionality), the security context management (SCM; Security Context Management) function, the function of supporting the N2 interface for N3IWF (Non-3GPP Interworking Function: non-3GPP interworking function), the function of supporting the sending and receiving of NAS signals with UE via N3IWF, the function of authenticating UE connected via N3IWF, etc.

[0079] In addition, the RM state of each UE is managed in the login management. The RM state can be synchronized between the UE and the AMF. As RM states, there are non-logged-in states (RM-DEREGISTERED state) and logged-in states (RM-REGISTERED state). In the non-logged-in state, the UE is not logged in to the network. Therefore, the UE context in the AMF does not have valid location information and routing information for the UE, so the AMF is in a state where the UE cannot be reached. In addition, in the logged-in state, the UE is logged in to the network, so the UE can receive services that require logging in to the network. It should be noted that the RM state can also be expressed as a 5GMM state (5GMMstate). In this case, the non-logged-in state can also be expressed as a 5GMM-DEREGISTERED state, and the logged-in state can also be expressed as a 5GMM-REGISTERED state.

[0080] In other words, 5GMM-REGISTERED can be a state where each device has established a 5GMM context, or a state where a PDU session context has been established. It should be noted that when each device is in 5GMM-REGISTERED, UE_A10 can start sending and receiving user data and control messages, and can also respond to paging. Moreover, it should be noted that when each device is in 5GMM-REGISTERED, UE_A10 can perform login procedures and / or service request procedures other than the login procedure for initial login.

[0081] Moreover, 5GMM-DEREGISTERED can be a state where each device has not established a 5GMM context, a state where the network has not grasped the location information of UE_A10, or a state where the network cannot reach UE_A10. It should be noted that when each device is in 5GMM-DEREGISTERED, UE_A10 can start the login process or establish a 5GMM context by executing the login process.

[0082] In addition, the CM state of each UE is managed in the connection management. The CM state can be synchronized between the UE and the AMF. As CM states, there are a non-connected state (CM-IDLE state) and a connected state (CM-CONNECTED state). In the non-connected state, the UE is in a logged-in state, but does not have a NAS signaling connection (NASsignaling connection) established with the AMF via the N1 interface. In addition, in the non-connected state, the UE does not have a connection (N2 connection) of the N2 interface and a connection (N3 connection) of the N3 interface. On the other hand, in the connected state, it has a NAS signaling connection (NAS signaling connection) established with the AMF via the N1 interface. In addition, in the connected state, the UE may also have a connection (N2 connection) of the N2 interface and / or a connection (N3 connection) of the N3 interface.

[0083] Moreover, in connection management, it can also be divided into CM state in 3GPP access and CM state in non-3GPP access for management. In this case, as the CM state in 3GPP access, there can be a non-connected state in 3GPP access (CM-IDLE state over 3GPP access) and a connected state in 3GPP access (CM-CONNECTED state over3GPP access). Moreover, as the CM state in non-3GPP access, there can be a non-connected state in non-3GPP access (CM-IDLE state over non-3GPP access) and a connected state in non-3GPP access (CM-CONNECTEDstate over non-3GPP access). It should be noted that the non-connected state can be expressed as an idle mode, and the connected state mode can be expressed as a connected mode.

[0084] It should be noted that the CM state can also be expressed as 5GMM mode (5GMM mode). In this case, the non-connected state can also be expressed as 5GMM non-connected mode (5GMM-IDLE mode), and the connected state can also be expressed as 5GMM connected mode (5GMM-CONNECTED mode). Moreover, the non-connected state in 3GPP access can also be expressed as 5GMM non-connected mode in 3GPP access (5GMM-IDLE mode over 3GPP access), and the connected state in 3GPP access can also be expressed as 5GMM connected mode in 3GPP access (5GMM-CONNECTED mode over 3GPP access). Moreover, the non-connected state in non-3GPP access can also be expressed as 5GMM non-connected mode in non-3GPP access (5GMM-IDLE modeover non-3GPP access), and the connected state in non-3GPP access can also be expressed as 5GMM connected mode in non-3GPP access (5GMM-CONNECTED mode over non-3GPP access). It should be noted that the 5GMM non-connected mode can be expressed as an idle mode, and the 5GMM connected mode can be expressed as a connected mode.

[0085] In addition, more than one AMF can be configured in the core network_B. In addition, AMF can be an NF that manages more than one NSI (Network Slice Instance). In addition, AMF can also be a shared CP function (CCNF; Common CPNF (Control Plane Network Function)) shared among multiple NSIs.

[0086] It should be noted that N3IWF is a device and / or function configured between non-3GPP access and 5GCN when the UE is connected to 5GS via non-3GPP access.

[0087] [2.4. SMF device configuration]

[0088] Next, use Figure 5 An example of the device configuration of SMF is described. SMF is composed of a control unit_B700, a network connection unit_B720, and a storage unit_B740. The control unit_B700, the network connection unit_B720, and the storage unit_B740 are connected via a bus. SMF can be a node that processes the control plane.

[0089] The control unit_B700 is a functional unit that controls the operation and function of the entire SMF. The control unit_B700 realizes various processes in the SMF by reading and executing various programs stored in the storage unit_B740 as needed.

[0090] The network connection unit_B720 is a functional unit for connecting the SMF with the AMF and / or UPF and / or PCF and / or UDM. That is, the SMF can use the network connection unit_B720 to send and receive user data and / or control information between the AMF and / or UPF and / or PCF and / or UDM.

[0091] Reference Figure 2 To explain in detail, the SMF in 5GCN can communicate with AMF via the N11 interface by using the network connection unit _A620, can communicate with UPF via the N4 interface, can communicate with PCF via the N7 interface, and can communicate with UDM via the N10 interface.

[0092] Storage unit_B740 is a functional unit for storing programs, user data, control information, etc. required for various actions of SMF.

[0093] SMF has the following functions: session management (SessionManagement) functions such as establishment / modification / release of PDU sessions, IP address allocation (IP address allocation) and its management functions for UE, UPF selection and control functions, UPF setting functions for routing services to the appropriate destination (sending destination), functions for sending and receiving the SM part of NAS messages, functions for notifying that downlink data has arrived (Downlink Data Notification), functions for providing AN-specific (each AN's) SM information sent to AN via AMF through the N2 interface, functions for determining the SSC mode (Session and Service Continuity mode) for the session, and roaming functions, etc.

[0094] [2.5. UPF device configuration]

[0095] Next, use Figure 5 An example of the device configuration of UPF is described. UPF is composed of a control unit_B700, a network connection unit_B720, and a storage unit_B740. The control unit_B700, the network connection unit_B720, and the storage unit_B740 are connected via a bus. UPF can be a node that processes the control plane.

[0096] The control unit_B700 is a functional unit that controls the overall operation and function of the UPF. The control unit_B700 reads and executes various programs stored in the storage unit_B740 as needed to implement various processes in the UPF.

[0097] The network connection unit_B720 is a functional unit for connecting the UPF to the base station device (gNB) and / or SMF and / or DN in the 5G AN. That is, the UPF can use the network connection unit_B720 to send and receive user data and / or control information between the base station device (gNB) and / or SMF and / or DN in the 5G AN.

[0098] Reference Figure 2 To explain in detail, the UPF in 5GCN can communicate with gNB via the N3 interface by using the network connection unit _A620, can communicate with SMF via the N4 interface, can communicate with DN via the N6 interface, and can communicate with other UPFs via the N9 interface.

[0099] Storage unit_B740 is a functional unit for storing programs, user data, control information, etc. required for various actions of UPF.

[0100] UPF has the following functions: serving as an anchor point for intra-RAT mobility or inter-RAT mobility, serving as an external PDU session point for interconnecting with DN (that is, serving as a gateway between DN and core network_B to transmit user data), routing and transmission of packets, UL CL (Uplink Classifier) ​​function that supports routing of multiple service flows for one DN, branching point function that supports multi-homed PDU sessions, QoS (Quality of Service) processing function for user plane, verification function of uplink services, triggering buffering of downlink packets, downlink data notification function, etc.

[0101] In addition, UPF can be a gateway for IP communication and / or non-IP communication. In addition, UPF can have the function of transmitting IP communication, and can also have the function of converting non-IP communication and IP communication. Moreover, the configured multiple gateways can be gateways connecting the core network_B and a single DN. It should be noted that UPF can have connectivity with other NFs, and can also be connected to each device via other NFs.

[0102] It should be noted that the user plane is user data sent and received between the UE and the network. The user plane can use a PDN connection or a PDU session for transmission and reception. Moreover, in the case of EPS, the user plane can also use the LTE-Uu interface and / or the S1-U interface and / or the S5 interface and / or the S8 interface and / or the SGi interface for transmission and reception. Moreover, in the case of 5GS, the user plane can also be transmitted and received via the interface between the UE and the NG RAN and / or the N3 interface and / or the N9 interface and / or the N6 interface. In the following, the user plane may also be expressed as U-Plane.

[0103] Moreover, the control plane is a control message sent and received for communication control of the UE, etc. The control plane can use the NAS (Non-Access-Stratum) signaling connection between the UE and the MME for transmission and reception. Moreover, in the case of EPS, the control plane can also use the LTE-Uu interface and the S1-MME interface for transmission and reception. Moreover, in the case of 5GS, the control plane can also use the interface between the UE and the NG RAN and the N2 interface for transmission and reception. In the following, the control plane can also be expressed as Control Plane, and can also be expressed as C-Plane.

[0104] Furthermore, the user plane (U-Plane, User Plane; UP) may be a communication path for sending and receiving user data, and may be composed of multiple bearers. Furthermore, the control plane (C-Plane, Control Plane; CP) may be a communication path for sending and receiving control messages, and may be composed of multiple bearers. [2.6. Description of other devices and / or functions and / or identification information in this embodiment]

[0105] Next, other devices and / or functions and / or identification information will be described.

[0106] The network refers to at least a part of the access network_B, the core network_B, and the DN. In addition, one or more devices included in at least a part of the access network_B, the core network_B, and the DN may also be referred to as a network or a network device. That is, the network performing the sending, receiving, and / or processing of messages may mean that a device (network device and / or control device) in the network performs the sending, receiving, and / or processing of messages. Conversely, the device in the network performing the sending, receiving, and / or processing of messages may mean that the network performs the sending, receiving, and / or processing of messages.

[0107] In addition, the SM (session management) message (also called NAS (Non-Access-Stratum) SM message) can be a NAS message used in the process of SM use, or a control message sent and received between UE_A10 and SMF_A230 via AMF_A240. Moreover, the SM message may include a PDU session establishment request message, a PDU session establishment acceptance message, a PDU session completion message, a PDU session rejection message, a PDU session change request message, a PDU session change acceptance message, a PDU session change response message, etc. In addition, the process of SM use may include a PDU session establishment process.

[0108] In addition, the MM (Mobility management) message (or also called NAS MM message) can be a NAS message used in the process of MM, or a control message sent and received between UE_A10 and SMF_A230 via AMF_A240. Moreover, the MM message may include a login request message, a login acceptance message, a login rejection message, a login release request message, a login release acceptance message, a UE configuration update request message, a UE configuration update acceptance message, etc. In addition, the process of MM may include a login process, a login release process, a UE configuration update process, and an authentication / authorization process.

[0109] In addition, 5GS (5G System) service may be a connection service provided using core network B190. Moreover, 5GS service may be a service different from EPS service or the same as EPS service.

[0110] In addition, non-5GS services may be services other than 5GS services, and may also include EPS services and / or non-EPS services.

[0111] In addition, the PDN (Packet Data Network) type indicates the type of PDN connection, which includes IPv4, IPv6, IPv4v6, and non-IP. When IPv4 is specified, it indicates that IPv4 is used to send and receive data. When IPv6 is specified, it indicates that IPv6 is used to send and receive data. When IPv4v6 is specified, it indicates that IPv4 or IPv6 is used to send and receive data. When non-IP is specified, it indicates that communication is performed using a communication method other than IP rather than using IP.

[0112] In addition, a PDU (Protocol Data Unit / Packet Data Unit) session can be defined as an association between a DN and a UE that provides a PDU connectivity service, but can also be a connectivity established between a UE and an external gateway. The UE can use a PDU session to send and receive user data with the DN by establishing a PDU session via the access network_B and the core network_B in the 5GS. Here, the external gateway may refer to a UPF, a SCEF, etc. The UE can use a PDU session to send and receive user data with a device such as an application server configured in the DN.

[0113] It should be noted that each device (UE and / or access network device and / or core network device) may also manage one or more identification information corresponding to the establishment of a PDU session. It should be noted that these identification information may include one or more of DNN, QoS rules, PDU session type, application identification information, NSI identification information, access network identification information and SSC mode, and may further include other information. Moreover, in the case of establishing multiple PDU sessions, the identification information corresponding to the establishment of the PDU session may be the same content or different content.

[0114] In addition, DNN (Data Network Name) can be identification information for identifying a core network and / or an external network such as a DN. Furthermore, DNN can also be used as information for selecting a gateway such as PGW_A30 / UPF_A235 connected to the core network B190. Furthermore, DNN can be equivalent to APN (Access Point Name).

[0115] In addition, the PDU (Protocol Data Unit / Packet Data Unit) session type indicates the type of PDU session, which includes IPv4, IPv6, Ethernet, and unstructured. When IPv4 is specified, it means that IPv4 is used to send and receive data. When IPv6 is specified, it means that IPv6 is used to send and receive data. When Ethernet is specified, it means that Ethernet frames are sent and received. In addition, Ethernet can indicate that communication without using IP is performed. When unstructured is specified, it means that point-to-point (P2P) tunnel technology is used to send and receive data to an application server in the DN. As a P2P tunnel technology, for example, UDP / IP encapsulation technology can also be used. It should be noted that IP can be included in the above-mentioned others in the PDU session type. IP can be specified when the UE can use both IPv4 and IPv6.

[0116] In addition, a network slice (NS) refers to a logical network that provides specific network capabilities and network characteristics. UE and / or network can support network slicing (NW slicing; NS) in 5GS.

[0117] In addition, a network slice instance (NSI) refers to a network slice formed and configured by a collection of instances (entities) of network functions (NFs) and required resources. Here, NF refers to a processing function in a network, which is adopted or defined in 3GPP. NSI is an entity of NS configured with more than one NS in the core network_B. In addition, NSI can be composed of a virtual NF (Network Function) generated using NST (Network Slice Template). Here, NST refers to a logical expression of one or more NFs associated with a resource request for providing the requested communication service and capability. That is, NSI may refer to an aggregate within the core network_B190 composed of multiple NFs. In addition, NSI may be a logical network configured to divide the user data sent according to services, etc. More than one NF may be configured in the NS. The NF configured in the NS may be a device shared with other NSs, or may not be a device shared with other NSs. The UE and / or the devices in the network can be assigned to one or more NSs based on the login information such as NSSAI and / or S-NSSAI and / or UE usage type and / or one or more NSI IDs and / or APN. It should be noted that the UE usage type is a parameter value included in the UE's login information for identifying the NSI. The UE usage type can be stored in the HSS. The AMF can select the SMF and UPF based on the UE usage type.

[0118] In addition, S-NSSAI (Single Network Slice Selection Assistance information) is information for identifying NS. S-NSSAI can be composed of SST (Slice / Servicetype) only, or it can be composed of both SST and SD (Slice Differentiator). Here, SST refers to information indicating the expected actions of NS in terms of functions and services. In addition, SD can be information that interpolates SST when selecting an NSI from multiple NSIs shown in SST. S-NSSAI can be information specific to each PLMN, or it can be standard information common among PLMNs. In addition, the network can store more than one S-NSSAI in the UE's login information as the default S-NSSAI. It should be noted that when the S-NSSAI is the default S-NSSAI, the network can provide NS related to the UE when the UE does not send a valid S-NSSAI to the network in the login request message.

[0119] In addition, NSSAI (Network Slice Selection Assistance Information) is a collection of S-NSSAI. Each S-NSSAI included in NSSAI is information that assists the access network or core network in selecting NSI. The UE can store the NSSAI allowed by the network for each PLMN. In addition, NSSAI can be information used to select AMF.

[0120] In addition, the configured NSSAI (configured NSSAI, set NSSAI) is the NSSAI provided to and stored in the UE. The UE can store the configured NSSAI for each PLMN. The configured NSSAI can be information set by the network (or PLMN).

[0121] In addition, the requested NSSAI is the NSSAI provided from the UE to the network during the login process. The requested NSSAI may be the allowed NSSAI or the configured NSSAI stored by the UE. Specifically, the requested NSSAI may be information representing the network slice that the UE wishes to access. The S-NSSAI included in the requested NSSAI may be expressed as a requested S-NSSAI. For example, the requested NSSAI is included in a NAS message sent from the UE to the network, such as a login request message or a PDU session establishment request message, or in an RRC (Radio Resource Control) message including a NAS (Non-Access-Stratum) message and is sent.

[0122] In addition, allowed NSSAI (allowed NSSAI, allowed NSSAI) is information indicating one or more network slices that the UE is allowed to connect to. In other words, allowed NSSAI is information that identifies the network slices that the network is allowed to connect to the UE. The UE and the network store and manage the allowed NSSAI for each access (3GPP access or non-3GPP access) as information of the UE. The S-NSSAI included in the allowed NSSAI can be expressed as allowed S-NSSAI (allowed S-NSSAI).

[0123] In addition, rejected NSSAI (rejected NSSAI, rejected NSSAI) is information indicating one or more network slices that the UE is not allowed to connect. In other words, rejected NSSAI is information that identifies network slices that do not allow the network to connect to the UE. Rejected NSSAI may be information including a combination of one or more S-NSSAI and a reason value. It should be noted that the reason value is information indicating the reason why the network rejects the corresponding S-NSSAI. The UE and the network may store and manage the rejected NSSAI appropriately based on establishing corresponding reason values ​​for each S-NSSAI. Moreover, the rejected NSSAI may be included in a NAS message sent from the network to the UE, such as a login acceptance message, a setting update command, a login rejection message, or an RRC message including a NAS message. The S-NSSAI included in the rejected NSSAI may be expressed as a rejected S-NSSAI (rejected S-NSSAI). The rejected NSSAI may be any one of the first to fourth rejected NSSAIs, or a combination of the first to fourth rejected NSSAIs.

[0124] Here, the first rejected NSSAI is a set of one or more S-NSSAIs that are not available in the current PLMN as part of the S-NSSAI included in the requested NSSAI by the UE. The first rejected NSSAI may be the rejected NSSAI for the current PLMN of the 5GS. The first rejected NSSAI may be the rejected NSSAI stored by the UE or NW, or it may be the rejected NSSAI sent from the NW to the UE. In the case where the first rejected NSSAI is the rejected NSSAI sent from the NW to the UE, the first rejected NSSAI may be information including a combination of one or more S-NSSAIs and a rejection reason value. The rejection reason value at this time may be "S-NSSAI is not available in the current PLMN", or it may be information indicating that the S-NSSAI corresponding to the reason value is not available in the current PLMN.

[0125] The first rejected NSSAI is valid in the entire logged-in PLMN. In other words, the UE and / or NW may process the first rejected NSSAI and the S-NSSAI included in the first rejected NSSAI as information that is independent of the access type. That is, the first rejected NSSAI may be information that is valid for 3GPP access and non-3GPP access.

[0126] The UE may delete the first rejected NSSAI from the storage when the current PLMN is transitioned to a non-logged-in state through both 3GPP access and non-3GPP access. In other words, when the UE transitions to a non-logged-in state for the current PLMN via a certain access, or successfully logs in to a new PLMN via a certain access, or fails to log in to a new PLMN via a certain access and transitions to a non-logged-in state, and further when the UE is in a non-logged-in state (non-logged-in state) via another party's access, the UE deletes the first rejected NSSAI.

[0127] The second rejected NSSAI is a set of one or more S-NSSAIs that are not available in the current registration area as the S-NSSAI included in the requested NSSAI by the UE. The second rejected NSSAI can be the RejectedNSSAI for the current registration area of ​​5GS (Rejected NSSAI for the current registration area). The second rejected NSSAI can be a rejected NSSAI stored by the UE or NW, or a rejected NSSAI sent from the NW to the UE. In the case where the second rejected NSSAI is a rejected NSSAI sent from the NW to the UE, the second rejected NSSAI can be information including a combination of one or more S-NSSAIs and a reason value. At this time, the reason value can be "S-NSSAI that is not available in the current registration area (S-NSSAI is not available in the current registration area)", or it can be information indicating that the S-NSSAI corresponding to the reason value is not available in the current registration area.

[0128] The second rejected NSSAI is valid within the current login area. That is, the UE and / or NW may process the second rejected NSSAI and the S-NSSAI included in the second rejected NSSAI as information for each access type. That is, the second rejected NSSAI may be information valid for 3GPP access or non-3GPP access, respectively. That is, once the transition to the non-logged state is made for a certain access, the UE may delete the second rejected NSSAI from the storage.

[0129] The third rejected NSSAI is the S-NSSAI for which the network requires network slice specific authentication (network slice specific authentication), and is a collection of one or more S-NSSAIs that are not available in the current PLMN as a result of network slice specific authentication not being completed. The third rejected NSSAI may be the Rejected NSSAI due to network slice specific authentication and authorization of 5GS. The third rejected NSSAI may be the NSSAI stored by the UE or NW, or it may be the NSSAI sent from the NW to the UE. It should be noted that the third rejected NSSAI is not limited to the rejected NSSAI, and the rejected NSSAI may be an independent NSSAI. In the case where the third rejected NSSAI is the NSSAI sent from the NW to the UE, the third rejected NSSAI may be information including a combination of one or more S-NSSAIs and a rejection reason value. The rejection reason value at this time may be "Network slice-specific authentication and authorization is pending for the S-NSSAI", and the S-NSSAI corresponding to the rejection reason value may be information indicating that the S-NSSAI used by the UE is prohibited or pending until the network slice-specific authentication and authorization for the S-NSSAI is completed.

[0130] The third rejected NSSAI is valid in the entire logged-in PLMN. In other words, the UE and / or NW may process the third rejected NSSAI and the S-NSSAI included in the third rejected NSSAI as information that is independent of the access type. That is, the third rejected NSSAI may be information that is valid for 3GPP access and non-3GPP access. The third rejected NSSAI may be the first rejected NSSAI.

[0131] The third rejected NSSAI is an NSSAI composed of one or more S-NSSAIs for the UE to identify the slice of the pending process. Specifically, the UE does not start the login request process for the S-NSSAI included in the third rejected NSSAI while storing the third rejected NSSAI. In other words, the UE does not use the S-NSSAI included in the third rejected NSSAI in the login process until the network slice-specific authentication and authorization for the S-NSSAI included in the third rejected NSSAI are completed. The third rejected NSSAI is identification information including one or more S-NSSAIs received from the core network, and the S-NSSAI is corresponding to the pending rejection reason value representing the network slice-specific authentication and authorization. The third rejected NSSAI is information that is independent of the access type. Specifically, when the UE stores the third rejected NSSAI, the UE does not attempt to send a login request message including the S-NSSAI included in the third rejected NSSAI to both 3GPP access and non-3GPP access.

[0132] The fourth rejected NSSAI is an S-NSSAI that requires network slice specific authentication and authorization, and is a collection of one or more S-NSSAIs for which the network slice specific authentication and authorization for the S-NSSAI failed or was canceled. The fourth rejected NSSAI may be an NSSAI stored by the UE and / or the NW, and may be sent from the NW to the UE. In the case where the fourth rejected NSSAI is sent from the NW to the UE, the fourth rejected NSSAI may be information including a combination of one or more S-NSSAIs and a rejection reason value. The rejection reason value at this time may be "S-NSSAI is not available due to the failed or revoked networkslice-specific authorization and authentication", or it may be information indicating the failure or cancellation of network slice specific authentication and authorization for the S-NSSAI corresponding to the rejection reason value.

[0133] The fourth rejected NSSAI is valid in the entire logged-in PLMN. In other words, the UE and / or NW may process the fourth rejected NSSAI and the S-NSSAI included in the fourth rejected NSSAI as information that is independent of the access type. That is, the fourth rejected NSSAI may be information that is valid for 3GPP access and non-3GPP access. The fourth rejected NSSAI may be an NSSAI different from the rejected NSSAI. The fourth rejected NSSAI may be the first rejected NSSAI.

[0134] The fourth rejected NSSAI is a rejected NSSAI for the UE to identify a slice rejected by the core network due to failure or cancellation of network slice specific authentication and authorization. Specifically, the UE does not start the login request process for the S-NSSAI included in the fourth rejected NSSAI while storing the fourth rejected NSSAI. The fourth rejected NSSAI may be identification information including one or more S-NSSAIs received from the core network, which S-NSSAI is corresponding to the rejection reason value indicating the failure of network slice specific authentication and authorization. The fourth rejected NSSAI is information that is independent of the access type. Specifically, in the case where the UE stores the fourth rejected NSSAI, the UE may not attempt to send a login request message including the S-NSSAI included in the fourth rejected NSSAI to both 3GPP access and non-3GPP access. Alternatively, the UE can send a login request message including the S-NSSAI included in the fourth rejected NSSAI based on the UE policy. Alternatively, the UE may delete the fourth rejected NSSAI based on the UE policy, and transition to a state where a login request message including the S-NSSAI included in the fourth rejected NSSAI can be sent. In other words, in the case where the UE sends a login request message including the S-NSSAI included in the fourth rejected NSSAI based on the UE policy, the UE may delete the S-NSSAI from the fourth rejected NSSAI.

[0135] The tracking area is a single or multiple ranges managed by the core network that can be represented by the location information of UE_A10. The tracking area can be composed of multiple cells. Moreover, the tracking area can be the range of control messages such as broadcast paging, or the range where UE_A10 can move without performing a switching process. Moreover, the tracking area can be a routing area or a location area, as long as it is the same area as these areas. Hereinafter, the tracking area may also be TA (Tracking Area). The tracking area can be identified by TAI (Tracking Area Identity) composed of TAC (Tracking area code) and PLMN.

[0136] Registration area is a set of one or more TAs assigned to UE by AMF. It should be noted that UE_A10 can move without sending or receiving signals for tracking area update while moving within one or more TAs included in the registration area. In other words, the registration area can be an information group indicating the area in which UE_A10 can move without performing the tracking area update process. The registration area can be identified by a TAIlist consisting of one or more TAIs.

[0137] UE ID refers to information used to identify UE. Specifically, for example, UE ID can be SUCI (SUbscription Concealed Identifier) ​​or SUPI (Subscription Permanent Identifier) ​​or GUTI (Globally Unique Temporary Identifier) ​​or IMEI (International Mobile Subscriber Identity) or IMEISV (IMEI Software Version) or TMSI (Temporary Mobile Subscriber Identity). Alternatively, UE ID can be other information set within an application or network. Moreover, UE ID can be information used to identify a user.

[0138] The network slice specific authentication and authorization function is a function for implementing authentication and authorization specific to network slices. In the network slice specific authentication and authorization, the UE can be authenticated and authorized outside the core network such as the 3rd Party. The PLMN and network devices equipped with the network slice specific authentication and authorization function can perform the network slice specific authentication and authorization process for a certain S-NSSAI based on the UE's login information. Moreover, the UE equipped with the network slice specific authentication and authorization function can manage and store the pending rejected NSSAI for network slice specific authentication and authorization and / or the rejected NSSAI for failed network slice specific authentication and authorization. In this specification, the network slice specific authentication and authorization is sometimes referred to as the network slice specific authentication and authorization process, the authentication and authorization process.

[0139] The S-NSSAI requiring network slice specific authentication and authorization is an S-NSSAI requiring network slice specific authentication and authorization managed by the core network and / or the core network device. The core network and / or the core network device can store the S-NSSAI requiring network slice specific authentication and authorization by establishing a correspondence between the S-NSSAI and information indicating whether network slice specific authentication and authorization are required and storing the correspondence. Moreover, the core network and / or the core network device can further establish a correspondence between the S-NSSAI requiring network slice specific authentication and authorization and information indicating whether the network slice specific authentication and authorization are completed or information indicating that the network slice specific authentication and authorization are completed and are in an allowed or successful state, and store the correspondence. The core network and / or the core network device can manage the S-NSSAI requiring network slice specific authentication and authorization as information that is independent of the access network.

[0140] Next, in this embodiment, the identification information sent, received, stored and managed by each device is described. The first identification information may be information indicating that the UE supports network slice specific authentication and authorization functions. Alternatively, the first identification information may be information indicating whether the network slice specific authentication and authorization functions are supported. The first identification information may be 5G MM capability information. The first identification information may be information indicating that the UE can store the first rejected NSSAI and / or the second rejected NSSAI.

[0141] The second identification information is information for identifying the slice requested by the UE. Specifically, the second identification information may be a requested NSSAI, which is constituted to include one or more S-NSSAIs. The S-NSSAI included in the second identification information may be an S-NSSAI included in a configured NSSAI stored by the UE or an S-NSSAI included in an allowed NSSAI. Moreover, the UE does not include in the second identification information the S-NSSAI included in a rejected NSSAI stored by the UE.

[0142] Specifically, when storing a rejected NSSAI corresponding to the PLMN of the destination of the second identification information, the UE determines whether to include the S-NSSAI in the second identification information according to the reason value corresponding to each S-NSSAI included in the rejected NSSAI. For example, the UE does not include the S-NSSAI corresponding to the pending reason value indicating the network slice specific identity authentication and authorization in the second identification information.

[0143] The third identification information is information indicating a user ID and / or UE ID used in network slice-specific authentication and authorization for the slice requested by the UE. Specifically, the third identification information may be a user ID and / or UE ID for establishing a corresponding network slice-specific authentication and authorization with the S-NSSAI, or may be a GPSI. The third identification information may be associated with the second identification information.

[0144] The eleventh identification information is information indicating that the core network and / or the core network device supports the network slice specific authentication and authorization function. The eleventh identification information may be 5GMM NW capability information. The eleventh identification information may be information for the core network to notify the UE that it is in a state in which a network slice specific authentication and authorization process can be performed based on the network slice specific authentication and authorization function.

[0145] The twelfth identification information is information for identifying the slices allowed by the core network. Specifically, the twelfth identification information may be an allowed NSSAI, which may include one or more S-NSSAIs. The twelfth identification information may be information for each access. In addition, in the case where the core network does not store the allowed NSSAI that can be sent to the UE, and in the case where the allowed NSSAI may be allocated in the future, the twelfth identification information may be empty information.

[0146] The thirteenth identification information is information identifying a set of one or more S-NSSAIs rejected by the core network in the S-NSSAI included in the second identification information, in other words, information identifying a set of S-NSSAIs not allowed by the core network. The thirteenth identification information may be a rejected NSSAI of the 5GS. Specifically, the thirteenth identification information may be information including one or more S-NSSAIs and each reason value associated with each S-NSSAI. The thirteenth identification information may be a rejected NSSAI consisting of at least one of the first to fourth rejected NSSAIs.

[0147] The fourteenth identification information is the value of a timer indicating the time pending for network slice specific identity authentication and authorization. In other words, the fourteenth identification information may be information indicating the start of counting of a timer using the value of the timer indicated by the fourteenth identification information. The fourteenth identification information may be associated with the thirteenth identification information, or may be combined with the thirteenth identification information to be sent and received as one piece of information.

[0148] The fifteenth identification information is information indicating that the AMF of the login destination of the UE has changed relative to the AMF of the previous login destination. The fifteenth identification information may be a flag or identification information. The fifteenth identification information may be information for identifying the AMF, for example, it may be a GUTI (Globally Unique Temporary Identifier), or it may be an AMF Region ID (AMF Region ID), an AMF Set ID (AMF Set ID) included in the GUTI, or it may be an AMF Pointer (AMFPointer). The fifteenth identification information may be a login area.

[0149] The sixteenth identification information may be information indicating whether to delete the third rejected NSSAI stored by the UE. Alternatively, the sixteenth identification information may be information indicating that the UE deletes the third rejected NSSAI.

[0150] The sixteenth identification may be information including one or more S-NSSAIs indicating to the UE the deletion of the third rejected NSSAI. Specifically, when the NW sends the sixteenth identification information to the UE, the UE may delete the one or more S-NSSAIs included in the sixteenth identification information from the third rejected NSSAI.

[0151] The twenty-first identification information is information for identifying the slice that the network allows the UE to have. The twenty-first identification information may be the allowed NSSAI. The twenty-first identification information may be the newly allocated allowed NSSAI. The twenty-first identification information may include an S-NSSAI included in the rejected NSSAI due to pending Slice specific Authentication.

[0152] The twenty-second identification information is information for identifying the slice rejected by the core network, in other words, information for identifying the slice not allowed by the core network. The twenty-second identification information may be a rejected NSSAI of the 5GS. Specifically, the twenty-second identification information may be information including one or more S-NSSAIs and each reason value associated with each S-NSSAI. The twenty-second identification information may be a rejected NSSAI consisting of at least one of the first to fourth rejected NSSAIs.

[0153] The twenty-fifth identification information may be information indicating that the UE is requested to start the login procedure again. The twenty-fifth identification information may be information indicated by a Configuration update indication IE (informationElement: information element).

[0154] The thirty-first identification information is information for identifying the slices rejected by the core network, in other words, information for identifying the slices not allowed by the core network. The thirty-first identification information may be the rejected NSSAI of the 5GS. Specifically, the thirty-first identification information may be information including one or more S-NSSAIs and each rejection reason value associated with each S-NSSAI. The thirty-first identification information may be a rejected NSSAI consisting of at least one of the first to fourth rejected NSSAIs.

[0155] The thirty-second identification information is information indicating that the core network does not have the currently allowed NSSAI for the UE. The thirty-second identification information may be 5GMM cause No network slices available for 5G.

[0156] It should be noted that each device can exchange and / or obtain various capability information and / or various request information of each device during the broadcast information and / or RRC process and / or the login process to the core network and / or the service request process for emergency calls.

[0157] In addition, each device involved in this process can send and receive each control message described in this process, send and receive one or more identification information included in each control message, and store the sent and received identification information as a context.

[0158] The forty-first identification information is information for identifying the slices rejected by the core network, in other words, information for identifying the slices that are not allowed by the core network. The forty-first identification information may be the rejected NSSAI of the 5GS. Specifically, the forty-first identification information may be information including one or more S-NSSAIs and each rejection reason value associated with each S-NSSAI. The forty-first identification information may be a rejected NSSAI consisting of at least one of the first to fourth rejected NSSAIs. The forty-first identification information may be the same as the thirty-first identification information. The forty-second identification information is information indicating that the core network does not have a currently allowed NSSAI for the UE. In other words, the forty-second identification information may be information indicating a state in which the UE has no currently available network slices. The forty-second identification information may be #62 "No network slices available" of the 5GMM cause value (5GMM cause value) of 5G. The forty-second identification information may be the same as the thirty-second identification information.

[0159] The forty-third identification information is information indicating in which access the network wants to make the UE transition to the non-login state through the non-login process. Specifically, the forty-third identification information may be information indicating that the non-login process is used only for 3GPP access or only for non-3GPP access or for both 3GPP access and non-3GPP access. The forty-third identification information may be the access type included in the non-login type (De-registration type) IE of the 3GPP 5GMM (5GS mobility management) IE (information element).

[0160] [3.1. Description of the process used in each embodiment]

[0161] Next, the processes used in each implementation are described. It should be noted that the processes used in each implementation include a registration procedure, a network slice-specific identity authentication and authorization procedure, a UE configuration update procedure, and a network-initiated de-registration procedure. Each process is described below.

[0162] It should be noted that, in each embodiment, Figure 2 As described in the , the case where HSS and UDM, PCF and PCRF, SMF and PGW-C, UPF and PGW-U are respectively configured as the same device (that is, the same physical hardware, the same logical hardware, or the same software) is used as an example for explanation. However, the content described in this embodiment can also be applied to the case where they are configured as different devices (that is, different physical hardware, different logical hardware, or different software). For example, data can be sent and received directly between them, data can be sent and received via the N26 interface between AMF and MME, and data can be sent and received via UE.

[0163] [3.2. Login process]

[0164] First, use Figure 6The registration procedure is described. Hereinafter, this process refers to the registration procedure. The registration procedure is a process led by the UE to log in to the access network_B and / or the core network_B and / or the DN. If it is not logged in to the network, the UE can perform this process at any time, such as when the power is turned on. In other words, if it is in a non-logged-in state (5GMM-DEREGISTERED state), the UE can start this process at any time. In addition, each device (especially the UE and the AMF) can transition to a registered state (5GMM-REGISTEDEDstate) based on the completion of the registration process. It should be noted that each registration state can be managed by each device for each access. Specifically, each device can independently manage the registration state (logged-in state or non-logged-in state) for 3GPP access and the registration state for non-3GPP access.

[0165] Moreover, the registration process may be a process for updating location registration information of the UE in the network and / or periodically notifying the network of the status of the UE from the UE and / or updating specific parameters related to the UE in the network.

[0166] The UE can start the login process when moving across TAs. In other words, the UE can start the login process when it moves to a TA that is different from the TA shown in the maintained TA list. Moreover, the UE can also start this process when the executing timer expires. Moreover, the UE can also start the login process when the context of each device needs to be updated because the PDU session is disconnected or disabled. Moreover, the UE can also start the login process when the capability information and / or preference selection related to the UE's PDU session establishment changes. Moreover, the UE can also start the login process periodically. Moreover, the UE can start the login process based on the completion of the UE setting update process, or based on the completion of the login process, or based on the completion of the PDU session establishment process, or based on the completion of the PDU session management process, or based on the information received from the network in each process. It should be noted that the UE can perform the login process at any timing, and is not limited to this.

[0167] It should be noted that the process used to transition the above-mentioned UE from a state of not logging into the network to a state of being logged in can be set as an initial registration procedure (initial registration procedure) or a registration procedure for initial registration (registration procedure for initial registration), and the registration procedure performed when the UE is logged in to the network can be set as a registration procedure for mobility and periodic registration update (registration procedure for mobility and periodic registration update) or a mobility and periodic registration procedure (mobility and periodic registration procedure).

[0168] Figure 6 The new AMF (new AMF) refers to the AMF that indicates that the UE is logged in through this process, and the old AMF (old AMF) refers to the AMF that has logged in the UE through the process before this process. In this process, if there is no change in AMF, the interface between the old AMF and the new AMF and the process between the old AMF and the new AMF are not generated, and the new AMF can be the same device as the old AMF. In this embodiment, when AMF is recorded, it can refer to the new AMF or the old AMF, and it can also refer to both.

[0169] First, the UE starts the registration process by sending a registration request message (S600)(S602)(S604) to the new AMF. Specifically, the UE sends an RRC message including a registration request message to the 5G AN (or gNB) (S600). It should be noted that the registration request message is a NAS message sent and received on the N1 interface. In addition, the RRC message can be a control message sent and received between the UE and the 5G AN (or gNB). In addition, NAS messages are processed in the NAS layer, and RRC messages are processed in the RRC layer. It should be noted that the NAS layer is a layer higher than the RRC layer.

[0170] Here, the UE can include at least one or more of the first to third identification information in the login request message and / or the RRC message and send it. Moreover, the UE can include identification information indicating the type of this process in the login request message and / or the RRC message and send it. Here, the identification information indicating the type of this process can be a 5GS registration type IE (5GS registration type IE), or it can be information indicating that this process is used for initial login or for login information update accompanying movement or for regular login information update or for login in emergency.

[0171] The UE can include these identification information in control messages different from these, for example, control messages of layers lower than the RRC layer (for example, the MAC layer, the RLC layer, the PDCP layer) and send them. It should be noted that, by sending these identification information, the UE can indicate that the UE supports each function, and can also indicate the UE's request, and can also indicate both. Moreover, in the case of sending and receiving multiple identification information, more than two identification information of these identification information can constitute more than one identification information. It should be noted that the information indicating support for each function and the information indicating a request for the use of each function can be sent and received as the same identification information, and can also be sent and received as different identification information.

[0172] It should be noted that the UE can choose and determine whether to send the first to third identification information to the network based on the UE's capability information and / or UE policy and / or UE status and / or user login information and / or context maintained by the UE.

[0173] The UE may send the first identification information when it is equipped with a network slice specific authentication and authorization function or when it requests at least one S-NSSAI identifying a slice requiring network slice specific authentication and authorization. The UE may request the network to process the UE as a UE equipped with a network slice specific authentication and authorization function and to perform an authentication and authorization process based on the network slice specific authentication and authorization function in a process related to the UE by sending the first identification information.

[0174] The UE may send the second identification information in the case where the allowed NSSAI is stored for the requested access of the requested PLMN and / or the configured NSSAI is maintained. The UE may select one or more S-NSSAI1 from the stored allowed NSSAI and / or configured NSSAI, include them in the second identification information and send them. Moreover, in the case where the UE stores the rejected NSSAI, the S-NSSAI included in the rejected NSSAI may not be included in the second identification information and sent.

[0175] In the case where the S-NSSAI requested by the UE is information identifying a slice requiring network slice specific authentication and authorization and / or the UE stores identification information (e.g., EAP (Extensible Authentication Protocol) ID) used in establishing a network slice specific authentication and authorization corresponding to the S-NSSAI requested by the UE, the UE may send the third identification information. The UE may request the start of the network slice specific authentication and authorization process by sending the third identification information, and may also request the result of the network slice specific authentication and authorization from the network.

[0176] The UE may include identification information other than the first to third identification information in a login request message and / or an RRC message including the login request message, for example, including UE ID and / or PLMN ID and / or AMF identification information and send it. Here, the AMF identification information may be information for identifying the AMF or a set of AMFs, for example, 5G-S-TMSI (5G S-Temporary Mobile Subscription Identifier: 5G S-Temporary Mobile User Identity), GUAMI (Globally Unique AMF Identifier: Globally Unique AMF Identifier).

[0177] In addition, the UE can start the PDU session establishment process during the login process by including an SM message (e.g., a PDU session establishment request message) in the login request message and sending it, or sending the SM message (e.g., a PDU session establishment request message) together with the login request message.

[0178] When receiving an RRC message including a login request message, the 5G AN (or gNB) selects an AMF to transmit the login request message (S602). It should be noted that the 5G AN (or gNB) can select an AMF based on one or more identification information included in the login request message and / or the RRC message including the login request message. Specifically, the 5G AN (or gNB) can select a new AMF as the destination of the login request message based on at least one identification information among the first to third identification information.

[0179] For example, the 5G AN (or gNB) may select, based on the first identification information, an AMF with network slice specific authentication and authorization functionality and / or an AMF with connectivity to a network with network slice specific authentication and authorization functionality.

[0180] Moreover, or alternatively, the 5G AN (or gNB) may select an AMF based on the second identification information. Specifically, the 5G AN (or gNB) may select an AMF included in the network slice identified by the S-NSSAI included in the second identification information or having connectivity to the network slice.

[0181] It should be noted that the method for selecting AMF is not limited to this, and 5G AN (or gNB) can select AMF based on conditions other than this. 5G AN (or gNB) extracts the login request message from the received RRC message and transmits the login request message to the selected new AMF (S604). It should be noted that, in the case where at least one of the first to third identification information is not included in the login request message but is included in the RRC message, the identification information included in the RRC message can be transmitted to the selected AMF together with the login request message (S604).

[0182] The new AMF can perform the first condition determination upon receiving the login request message. The first condition determination is used to determine whether the network (or the new AMF) accepts the UE's request. When the first condition determination is true, the new AMF starts the process after S606 and executes the process (A). On the other hand, the new AMF may not execute the process from S606 to S612, but execute the process (B) when the first condition determination is false.

[0183] Alternatively, the new AMF may perform the first condition determination after receiving the UE context (S608) from the old AMF. In this case, the new AMF performs the process (A) when the first condition determination is true. On the other hand, the new AMF may perform the process (B) instead of performing the process (A) when the first condition determination is false.

[0184] It should be noted that the first condition judgment can be performed based on the reception of the login request message and / or the identification information and / or subscriber information and / or network capability information and / or operator policy and / or network status and / or user login information and / or context maintained by the AMF included in the login request message.

[0185] For example, the first condition may be true when the network allows the UE's request, and false when the network does not allow the UE's request. In addition, the first condition may be true when the network of the UE's login destination and / or the device in the network supports the function requested by the UE, and false when the function requested by the UE is not supported. Furthermore, the first condition may be true when the identification information is allowed to be sent and received, and false when the identification information is not allowed to be sent and received.

[0186] In addition, it may be that the first condition is judged to be true when the S-NSSAI included in the requested NSSAI received by the AMF from the UE is information identifying a slice requiring a slice specific authentication and authorization process, and then the result of the slice specific authentication and authorization process stored by the AMF as the S-NSSAI corresponding to the UE is successful. Alternatively, it may be that the first condition is judged to be false when there is no S-NSSAI allowed for the UE and there is no reservation to allocate an allowed NSSAI to the UE in the future.

[0187] First, the case where the first condition is judged to be true is explained. When the new AMF is different from the AMF indicated by the AMF identification information included in the message received from the UE, the new AMF executes the processes S606 and S608. When the new AMF is the same as the AMF indicated by the AMF identification information included in the message received from the UE, the processes S606 and S608 are not executed. In other words, when the AMF is changed due to this process, the processes S606 and S608 are executed. When the AMF is not changed, the processes S606 and S608 are skipped.

[0188] The transmission process of UE context (S606, S608) is explained. The new AMF regards the AMF indicated by the AMF identification information as the old AMF and sends a request message for UE context to the old AMF (S606). The old AMF sends the UE context to the new AMF based on the received request message for UE context. The new AMF generates the UE context based on the received UE context.

[0189] Here, the UE context sent from the new AMF to the old AMF may include the UE ID and the allowed NSSAI. Moreover, the UE context may include the configured NSSAI and / or the rejected NSSAI. In addition, the allowed NSSAI and / or the configured AMF (configured AMF) and / or the rejected NSSAI included in the UE context may be associated with the information on whether the notification to the UE is completed.

[0190] In addition, the UE context may include information about the S-NSSAI that requires a network slice-specific authentication and authorization process, information indicating that authentication of the UE has been successful and / or information indicating that authentication has failed.

[0191] Next, the process (A) of this process is described. When the new AMF determines to accept the UE's login request, based on the determination and / or based on receiving the UE context from the old AMF, the new AMF sends a Registration accept message to the UE (S610).

[0192] The new AMF may include at least one of the eleventh to sixteenth identification information in the login acceptance message and send it. It should be noted that the AMF can indicate that the network supports various functions, that the UE's request is accepted, that part of the request from the UE is not allowed, or a combination of these information by sending these identification information and / or login acceptance messages. Moreover, in the case of sending and receiving multiple identification information, more than two of these identification information may constitute more than one identification information. It should be noted that the information indicating support for each function and the information indicating request for use of each function may be sent and received as the same identification information, or may be sent and received as different identification information.

[0193] The AMF may send at least one of the eleventh to sixteenth identification information when at least any one of the first to third identification information is received from the UE and / or when there is an update of the UE's setting information compared to the previous login process.

[0194] The AMF may send the eleventh identification information if the first identification information is received from the UE and / or if a network slice specific authentication and authorization process is started and / or if the network supports network slice specific authentication and authorization.

[0195] The AMF may send the login acceptance message without the S-NSSAI (allowed NSSAI) allowed by the UE, but after the completion of this process or in parallel with this process, if there is a reservation to perform a network slice specific authentication and authorization process, an empty value may be included in the twelfth identification information and sent.

[0196] Based on the reception of the eleventh identification information, the UE can identify that the network has network slice specific authentication and authorization functions, and can store the UE login as a UE with network slice specific authentication and authorization functions.

[0197] The UE can identify the slices allowed by the network based on the reception of the twelfth identification information, and can store the S-NSSAI included in the twelfth identification information as the allowed NSSAI. Then, the UE can store the allowed NSSAI until the twelfth identification information is received. The UE can store the allowed NSSAI until it moves out of the login area. If the allowed NSSAI has already been stored, the UE can update the stored information to the allowed NSSAI shown in the twelfth identification information. Moreover, if the rejected S-NSSAI stored by the UE is included in the new allowed NSSAI, the UE can delete the S-NSSAI from the rejected NSSAI.

[0198] In addition, the UE can transition to a state where login is allowed but establishment of a PDU session is not allowed based on receiving the empty twelfth identification information. Specifically, the UE can store the received login area as a not allowed area based on receiving the empty twelfth identification information, or it can transition to a state where movement restriction is performed.

[0199] The UE can identify and store the slices rejected by the network and the reasons for rejection based on the reception of the thirteenth identification information.

[0200] For example, when receiving the thirteenth identification information, the UE may appropriately store the S-NSSAI included in the thirteenth identification information in the rejected NSSAI based on the reason value corresponding to the S-NSSAI included in the thirteenth identification information. Moreover, when the S-NSSAI included in the stored rejected NSSAI is included in the allowed NSSAI, the S-NSSAI may be deleted from the allowed NSSAI.

[0201] Furthermore, for example, when the first rejected NSSAI is included in the thirteenth identification information, in other words, when at least one set of S-NSSAI and a rejection reason value indicating that it cannot be used in the current PLMN is constituted in the thirteenth identification information, the UE can include the S-NSSAI in the first rejected NSSAI based on the rejection reason value and store it. Furthermore, when the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE can delete the rejected NSSAI from the allowed NSSAI.

[0202] Moreover, for example, in the case where the second rejected NSSAI is included in the thirteenth identification information, in other words, in the case where the thirteenth identification information comprises at least one set of S-NSSAI and a rejection reason value indicating that it is not available in the current login area, the UE can include the S-NSSAI in the second rejected NSSAI based on the rejection reason value and store it.

[0203] Moreover, for example, in the case where the third rejected NSSAI is included in the thirteenth identification information, in other words, in the case where the thirteenth identification information consists of at least a set of S-NSSAI and a rejection reason value representing the S-NSSAI pending for network slice specific authentication and authorization, the UE can include the S-NSSAI in the third rejected NSSAI and store it based on the rejection reason value.

[0204] Moreover, for example, in the case where the fourth rejected NSSAI is included in the thirteenth identification information, in other words, in the case where the thirteenth identification information constitutes at least a set of S-NSSAI and a rejection reason value of S-NSSAI indicating network slice specific authentication and authorization failure, the UE can delete the S-NSSAI from the third rejected NSSAI based on the rejection reason value, and can include the S-NSSAI in the fourth rejected NSSAI and store it.

[0205] Moreover, in the case where the UE receives the thirteenth identification information including at least one S-NSSAI, if the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE can delete the rejected NSSAI from the allowed NSSAI.

[0206] The UE may store the S-NSSAI corresponding to other reason values ​​in the same way. It should be noted that the storage method of the rejected NSSAI implemented by the UE is not limited to this, as long as the S-NSSAI is stored in a state where the S-NSSAI is corresponding to the reason value.

[0207] The UE may start counting the timer or the timer based on the thirteenth identification information of the NSSAI including the third rejection and / or the rejection reason value included in the thirteenth identification information and / or the reception of the fourteenth identification information. Here, the value of the timer may be a value pre-stored by the UE or the value of the timer indicated by the fourteenth identification information.

[0208] The UE stops the timer while counting the timer, upon receiving a setting update command or a login accept message for allowed NSSAI and / or rejected NSSAI including a notification indicating the result of network slice specific authentication and authorization for rejected NSSAI pending by the network, or upon receiving a result in the network slice specific authentication and authorization.

[0209] In the event that the timer count expires, that is, in the event that no setting update command or login accept message or login reject message or non-login request message of the allowed NSSAI and / or rejected NSSAI including a notification of the result of the network slice specific authentication and authorization for the rejected NSSAI pending by the network is received within the timer count or in the event that no result is received in the network slice specific authentication and authorization, the UE may delete the third rejected NSSAI, or may also delete the corresponding rejected S-NSSAI from the third rejected NSSAI.

[0210] The UE may recognize that a change in the AMF has occurred based on the reception of the fifteenth identification information. The UE may delete the third rejected NSSAI based on the reception of the sixteenth identification information if the third rejected NSSAI was stored before receiving the login acceptance message.

[0211] In the case where the fifteenth identification information is information indicating a login area, the UE can delete the third rejected NSSAI along with a change in the login area.

[0212] The UE may delete the third rejected NSSAI based on the reception of the sixteenth identification information. Specifically, when the sixteenth identification information is information indicating the deletion of the third rejected NSSAI, the UE may delete the third rejected NSSAI.

[0213] It should be noted that the various processes performed by the UE based on the reception of various identification information as described above can be performed in this process or after the completion of this process, or can be performed based on the completion of this process after the completion of this process.

[0214] It should be noted that AMF can select and determine which one of the eleventh to sixteenth identification information to include in the login acceptance message based on the received identification information and / or subscriber information and / or network capability information and / or operator policy and / or network status and / or user login information and / or context maintained by AMF.

[0215] In addition, the AMF can include an SM message (e.g., a PDU session establishment accept message) in the login acceptance message and send it or send the SM message (e.g., a PDU session establishment accept message) together with the login acceptance message. However, the sending method can be performed when the SM message (e.g., a PDU session establishment request message) is included in the login request message. In addition, the sending method can also be performed when the SM message (e.g., a PDU session establishment request message) is included together with the login request message. The AMF can indicate that the process used for SM in the login process is accepted by performing such a sending method.

[0216] In addition, the AMF can indicate that the UE's request is accepted by sending a login acceptance message based on the received identification information and / or subscriber information and / or network capability information and / or operator policy and / or network status and / or user login information and / or context maintained by the AMF.

[0217] The UE receives a login acceptance message (S610) via the 5G AN (gNB). By receiving the login acceptance message, the UE can identify that the UE's request based on the login request message is accepted and the contents of various identification information included in the login acceptance message.

[0218] Moreover, the UE can send a login completion message to the AMF via the 5G AN (gNB) as a response message to the login acceptance message (S610). It should be noted that the UE can include an SM message such as a PDU session establishment acceptance message in the login completion message and send it when receiving an SM message such as a PDU session establishment acceptance message, or it can include an SM message to indicate that the SM process is complete. Here, the login completion message is a NAS message sent and received on the N1 interface, but is included in the RRC message for sending and receiving between the UE and the 5G AN (gNB).

[0219] AMF receives the login completion message (S612) via 5G AN (gNB). In addition, each device completes the process (A) and the login process in this process based on the sending and receiving of the login acceptance message and / or the login completion message.

[0220] Next, the case where the first condition is judged to be false is described. The AMF sends a registration reject message to the UE via the 5G AN (gNB) as a response message to the registration request message (S614). Here, the registration reject message is a NAS message sent and received on the N1 interface, but is sent and received between the UE and the 5G AN (gNB) in an RRC message.

[0221] The new AMF may include at least one of the thirty-first to thirty-second identification information in the login rejection message and send it. The new AMF may further include a reason value in the login rejection message and send it. Here, the reason value may be a 5GMM cause. It should be noted that the AMF may indicate that the network does not support each function by sending these identification information and / or login rejection messages, or may indicate that the UE's request is rejected or not accepted, or may indicate the reason why the request from the UE is not allowed, or may indicate a combination of these information. Moreover, in the case of sending and receiving multiple identification information, more than two identification information of these identification information may constitute more than one identification information. It should be noted that the information indicating support for each function and the information indicating request for use of each function may be sent and received as the same identification information, or may be sent and received as different identification information.

[0222] The AMF may send at least one of the thirty-first to thirty-second identification information when at least any one of the first to third identification information is received from the UE and / or when there is an update of the UE's setting information compared to the previous login process.

[0223] The AMF may send the thirty-second identification information and the login reject message if there is no S-NSSAI allowed in the UE and there is no reservation for adding the S-NSSAI to the allowed NSSAI through other procedures (e.g., network slice specific authentication and authorization procedures) in the future.

[0224] The UE may appropriately identify and store the rejected S-NSSAI and the reason for rejection based on the reception of the thirty-first identification information and / or the type of this process (registration type), and / or the status of the UE.

[0225] First, a case where this procedure is a login procedure for initial login will be described. Specifically, a case where the UE includes information indicating that this procedure is a login procedure for initial login in a login request message will be described.

[0226] For example, when the UE receives the thirty-first identification information included in the login rejection message during the login process for the initial login, it may include and store the S-NSSAI in the appropriate rejected NSSAI based on the rejection reason value corresponding to the S-NSSAI included in the thirty-first identification information and / or the status of the UE, or it may ignore the S-NSSAI.

[0227] Specifically, when the first rejected NSSAI is included in the thirty-first identification information, in other words, when at least one set of S-NSSAI and a rejection reason value indicating that it cannot be used in the current PLMN is included in the thirty-first identification information, and then when the UE is in a state of logging into an access different from the access requested by the UE for the current PLMN, the UE can include the S-NSSAI in the first rejected NSSAI based on the rejection reason value and store it. Moreover, when the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE can delete the rejected NSSAI from the allowed NSSAI.

[0228] In addition, in the case where the thirty-first identification information includes a first rejected NSSAI, in other words, in the case where the thirty-first identification information includes at least one set of S-NSSAI and a rejection reason value indicating that it is not usable in the current PLMN, and further in the case where the UE is in a state of not logging in to an access different from the access requested by the UE, the UE may ignore the S-NSSAI.

[0229] Moreover, for example, in the case where the thirty-first identification information includes the second rejected NSSAI, in other words, in the case where the thirty-first identification information includes at least one set of S-NSSAI and a rejection reason value indicating that it is not available in the current login area, the UE may ignore the S-NSSAI.

[0230] In addition, in the case where the third rejected NSSAI is included in the thirty-first identification information, in other words, in the case where at least one set of S-NSSAI and a rejection reason value indicating the S-NSSAI pending for network slice specific authentication and authorization is included in the thirty-first identification information, and then in the case of being in a state of logging into an access different from the access requested by the UE, the UE can include the S-NSSAI in the third rejected NSSAI based on the rejection reason value and store it. Moreover, in the case where the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE can delete the rejected NSSAI from the allowed NSSAI.

[0231] In addition, in the case where the thirty-first identification information includes a third rejected NSSAI, in other words, in the case where the thirty-first identification information includes at least one set of S-NSSAI and a rejection reason value indicating the S-NSSAI pending for network slice specific authentication and authorization, and thus in the case where the UE is in a state of not logging in to an access different from the access requested by the UE, the UE may ignore the S-NSSAI.

[0232] In addition, in the case where the fourth rejected NSSAI is included in the thirty-first identification information, in other words, in the case where the thirty-first identification information includes at least one set of S-NSSAI and a rejection reason value of the S-NSSAI indicating that the network slice specific authentication and authorization failure is included, and then in the case where the UE is in a state of logging into an access different from the access requested by the UE, the UE can include the S-NSSAI in the fourth rejected NSSAI based on the rejection reason value and store it, and, in the case where the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE can delete the rejected NSSAI from the allowed NSSAI.

[0233] Alternatively, in the case where the thirty-first identification information includes the fourth rejected NSSAI, in other words, in the case where the thirty-first identification information includes at least one set of S-NSSAI and a rejection reason value of the S-NSSAI indicating that the network slice specific authentication and authorization failure is failed, and then in the case where the UE is in a state of logging into an access different from the access requested by the UE, the UE can delete the S-NSSAI from the third rejected NSSAI based on the rejection reason value.

[0234] In addition, in the case where the fourth rejected NSSAI is included in the thirty-first identification information, in other words, in the case where the thirty-first identification information contains at least one set of S-NSSAI and a rejection reason value indicating the S-NSSAI pending for network slice specific authentication and authorization, and thus in the case where the UE is in a state of not logging in to an access different from the access requested by the UE, the UE may ignore the S-NSSAI.

[0235] Next, the case where this process is a registration process for mobile and periodic registration updates is described.

[0236] For example, when the UE receives the 31st identification information during the login process for mobility and periodic login update, the UE may store the S-NSSAI included in the 31st identification information in the appropriate rejected NSSAI based on the reason value corresponding to the S-NSSAI included in the 31st identification information. Furthermore, when the S-NSSAI included in the stored rejected NSSAI is included in the allowed NSSAI, the S-NSSAI may be deleted from the allowed NSSAI.

[0237] Furthermore, for example, in the case where the first rejected NSSAI is included in the thirty-first identification information, in other words, in the case where at least one set of S-NSSAI and a rejection reason value indicating that it cannot be used in the current PLMN is included in the thirty-first identification information, the UE can include the S-NSSAI in the first rejected NSSAI based on the rejection reason value and store it. Furthermore, in the case where the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE can delete the rejected NSSAI from the allowed NSSAI.

[0238] Moreover, for example, in the case where the second rejected NSSAI is included in the thirty-first identification information, in other words, in the case where the thirty-first identification information includes at least one set of S-NSSAI and a rejection reason value indicating that it is not available in the current login area, the UE can include the S-NSSAI in the second rejected NSSAI based on the rejection reason value and store it.

[0239] Moreover, for example, in the case where the third rejected NSSAI is included in the thirty-first identification information, in other words, in the case where the thirty-first identification information includes at least one set of S-NSSAI and a rejection reason value representing the S-NSSAI pending for network slice specific authentication and authorization, the UE can include the S-NSSAI in the third rejected NSSAI and store it based on the rejection reason value.

[0240] Moreover, for example, in the case where the fourth rejected NSSAI is included in the thirty-first identification information, in other words, in the case where the thirty-first identification information includes at least one set of S-NSSAI and a rejection reason value of the S-NSSAI indicating network slice specific authentication and authorization failure, the UE can delete the S-NSSAI from the third rejected NSSAI based on the rejection reason value, and can include the S-NSSAI in the fourth rejected NSSAI and store it.

[0241] Moreover, in the case where the UE receives the thirty-first identification information including at least one S-NSSAI, if the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE can delete the rejected NSSAI from the allowed NSSAI.

[0242] That is, when a login rejection message including the thirty-first identification information is received from the core network during the login process for initial login, and the thirty-first identification information includes S-NSSAI and a rejection reason value indicating that it is not available in the current login area, the UE can ignore the S-NSSAI.

[0243] Moreover, in the case where the UE receives a login rejection message including the thirty-first identification information from the core network during the login process for the initial login for a certain access, and further in the case where the UE is in a non-logged-in state for the access of the other party, and further in the case where the thirty-first identification information includes an S-NSSAI and a rejection reason value indicating that the S-NSSAI for establishing the association is not available in the current PLMN and / or indicates that the S-NSSAI pending for network slice specific authentication and authorization and / or the S-NSSAI indicating that the network slice specific authentication and authorization failed, the UE may ignore the S-NSSAI.

[0244] Moreover, during the login process for initial login, in other cases, the UE can add and store the corresponding rejected NSSAI based on the rejection reason. If it exists, the S-NSSAI included in the rejected NSSAI stored by the UE can be deleted from the allowed NSSAI stored by the UE.

[0245] In addition, when the UE receives the thirty-first identification information during the login process for mobility and periodic login updates, regardless of the rejection reason value corresponding to the S-NSSAI included in the thirty-first identification information and the state of the UE, the UE can add the S-NSSAI included in the thirty-first identification information to the appropriate rejected NSSAI based on the rejection reason for establishing the association and store it, and if it exists, the S-NSSAI included in the rejected NSSAI stored by the UE can be deleted from the allowed NSSAI stored by the UE.

[0246] When the UE receives the thirty-second identification information, the UE may delete the allowed NSSAI for the access (3GPP access or non-3GPP access) requested by the UE.

[0247] The UE may store the S-NSSAI corresponding to other reason values ​​in the same way. It should be noted that the storage method of the rejected NSSAI implemented by the UE is not limited to this, as long as the S-NSSAI is stored in a state where the S-NSSAI is corresponding to the reason value.

[0248] It should be noted that the various processes performed by the UE based on the reception of various identification information as described above can be performed in this process or after the completion of this process, or can be performed based on the completion of this process after the completion of this process.

[0249] It should be noted that AMF can select and determine whether to include at least one of the thirty-first to thirty-second identification information in the login rejection message based on the received identification information and / or subscriber information and / or network capability information and / or operator policy and / or network status and / or user login information and / or context maintained by AMF.

[0250] Specifically, AMF may not send a login rejection message having the thirty-first identification information including a rejection reason value indicating that the login process is not available in the current login area during the initial login process, or may perform control in that manner.

[0251] Moreover, the AMF can, during the login process for the initial login of a certain access, without the UE logging into the access of another party, send a login rejection message having the thirty-first identification information including a rejection reason value indicating that it is not available in the current PLMN and / or a rejection reason value indicating that the S-NSSAI is pending for network slice specific authentication and authorization and / or a rejection reason value of the S-NSSAI indicating that the network slice specific authentication and authorization failed, without sending it via a certain access, and can also be controlled in that way.

[0252] The UE receives a login rejection message via the 5G AN (gNB). By receiving the login rejection message, the UE can identify that the UE's request based on the login request message is rejected and the contents of various identification information included in the login rejection message. In addition, the UE can also identify that the UE's request is rejected if it does not receive a login acceptance message or a login rejection message after a specified period after sending the login request message. Each device can complete the login process based on the sending and receiving of the login rejection message.

[0253] It should be noted that each device can transition or maintain the state in which the UE is logged in to the network (RM_REGISTERED state or 5GMM-REGISTERED state) based on the sending and receiving of the login acceptance message and / or the login completion message, and can also transition or maintain the state in which the UE is not logged in to the network (RM_DEREGISTERED state or 5GMM-DEREGISTERED state) for the current PLMN on the access receiving the login rejection message based on the sending and receiving of the login rejection message. In addition, the transition of each device to each state can be carried out based on the sending and receiving of the login completion message or the completion of the login process.

[0254] Furthermore, each device may perform processing based on information sent and received during the login process based on the completion of the login process. For example, the reason why the UE's request was rejected may be identified when information indicating that a part of the UE's request was rejected is sent and received. Furthermore, each device may perform this process again based on the reason why the UE's request was rejected, and may also perform the login process on the core network_A and other cells.

[0255] Furthermore, the UE may store the identification information received together with the login accept message and / or the login reject message based on the completion of the login process, and may also identify the determination of the network.

[0256] Moreover, each device may start a network slice specific identity authentication and authorization process and a UE setting update process based on the completion of the login process. It should be noted that the details of the network slice specific identity authentication and authorization process and the UE setting update process are described later.

[0257] [3.3. Network Slice Specific Authentication and Authorization Process]

[0258] Next, use Figure 7 The network slice specific authentication and authorization process is described. Hereinafter, the network slice specific authentication and authorization process is also referred to as this process. This process can be a process for the core network to enable the UE to perform an authentication and authorization process for a slice that requires a network slice specific authentication and authorization process.

[0259] This process may be initiated by the AMF. For example, the AMF may initiate this process based on the receipt of a Login Request message from the UE. The AMF may store that at least one S-NSSAI requested by the UE is an S-NSSAI that requires a network slice specific authentication and authorization process, and then initiate this process without storing the result of the network slice specific authentication and authorization of the S-NSSAI.

[0260] Alternatively, the AMF may start this process based on a request from AAA-S. For example, as a result of an S-NSSAI that has been authenticated and authorized for at least one network slice, in a state where the AMF manages the S-NSSAI as an allowed NSSAI, and in a case where AAA-S requests the execution of network slice specific authentication and authorization for the S-NSSAI again, the AMF may start this process based on a request from AAA-S. In this case, this process may be a network slice specific authentication and authorization process initiated by AAA-S.

[0261] The following is an explanation of this process. The AMF sends an EAP ID request message (S700) to the UE via the 5G AN (or gNB or non-3GPP access). The EAP ID request message may be included in an authentication request message (Authentication request message) as a NAS message and sent. The AMF includes one or more S-NSSAIs corresponding to the requested EAP ID in the EAP ID request message or the authentication request message including the EAP ID request message and sends it.

[0262] Based on the sending of the EAP ID Request message, the AMF requests one or more EAP IDs from the UE as the identification information of the UE used in performing network slice specific authentication and authorization for one or more S-NSSAIs.

[0263] The UE sends an EAP ID response message (S702) based on the reception of the EAP ID request message and / or the reception of the S-NSSAI. The EAP ID response message may be included in an authentication response message (Authentication response message) as a NAS message and sent. The UE includes the S-NSSAI received from the AMF in the EAP ID response message or the authentication request message including the EAP ID response message and sends it. The UE includes the EAP ID as the identification information of the UE corresponding to the S-NSSAI received from the AMF in the EAP ID response message and sends it. It should be noted that the UE may include multiple EAP IDs and multiple S-NSSAIs in the EAP ID response message, and each EAP ID may be associated with each S-NSSAI and sent.

[0264] Based on the reception of the EAP ID response message and / or the EAP ID from the UE, the AMF sends an authentication request message to the AAA-S via the AUSF (S704, S706). The AMF may include the EAP ID response message received from the UE in the authentication request message and send it to the AUSF and / or AAA-S, and may include the EAP ID and / or S-NSSAI included in the EAP ID response message received from the UE in the authentication request message and send it to the AUSF and / or AAA-S.

[0265] It should be noted that the authentication request message sent from AMF to AUSF and the authentication request message sent from AUSF to AAA-S can be the same message or different messages. Specifically, AUSF can transmit the authentication request message received from AMF to AAA-S, or include the EAP ID and / or S-NSSAI included in the authentication request message received from AMF in the authentication request message and send it to AAA-S.

[0266] Based on the reception of the authentication request message, the AAA-S may start a process of exchanging messages required for authentication between the UE and the AAA-S (S708). It should be noted that the message used in the process of exchanging messages between the AAA-S and the UE may be an EAP message.

[0267] AAA-S performs an authentication process based on the reception of the authentication request message received from AMF via AUSF. AAA-S sends an authentication response message to AMF via AUSF as a response to the authentication request message received from AMF (S710, S712). AUSF includes the authentication result and S-NSSAI in the authentication response message and sends it. Here, the authentication result can be information indicating success or failure.

[0268] Based on the reception of the authentication response message, the AMF sends an authentication result message (Authentication result message) to the UE (S714). The AMF may include the authentication response message or the authentication result and S-NSSAI included in the authentication response message in the authentication response message and send it.

[0269] Each device can complete this process based on the sending and receiving of the authentication result message. Each device can update the stored information based on the completion of this process and based on the information sent and received in this process. Specifically, AMF can store the authentication result of each S-NSSAI based on the sending and receiving of the authentication result. For example, when AMF sends and receives "success" as the authentication result, it can establish an association with the S-NSSAI sent and received together with the authentication result, and store it as the status of "success" for network slice specific authentication and authorization as the information of UE. Similarly, when AMF sends and receives "failure" as the authentication result, it can establish an association with the S-NSSAI sent and received together with the authentication result, and store it as the status of "failure" for network slice specific authentication and authorization as the information of UE.

[0270] In addition, in the case where this process is a process started based on the reception of a login request message from the UE, the AMF may update the allowed NSSAI and / or rejected NSSAI for the UE based on the sending and receiving of the authentication result. Specifically, for example, the AMF may store the S-NSSAI sent and received together with the authentication result as the allowed NSSAI, and associate "allowed" with the S-NSSAI and store it when sending and receiving "success" as the authentication result. Similarly, the AMF may store the S-NSSAI sent and received together with the authentication result as the rejected NSSAI, and associate "rejected" with the S-NSSAI and store it when sending and receiving "failure" as the authentication result. Moreover, in the case where the AMF sends and receives "failure" as the authentication result, and then in the case where the UE includes the S-NSSAI sent and received together with the authentication result in the third rejected NSSAI and stores it, the UE may delete the S-NSSAI from the third rejected NSSAI.

[0271] In addition, the UE may store the authentication result of each S-NSSAI based on the sending and receiving of the authentication result. Specifically, for example, when sending and receiving "success" as the authentication result, the UE may establish an association with the S-NSSAI sent and received together with the authentication result, and store it as the status of "success" of the network slice specific authentication and authorization as the UE information. Similarly, when sending and receiving "failure" as the authentication result, the UE may establish an association with the S-NSSAI sent and received together with the authentication result, and store it as the status of "failure" of the network slice specific authentication and authorization as the UE information.

[0272] In addition, each device may implement an updated process based on the stored information based on the completion of this process. For example, the AFM may start the UE configuration update process based on the completion of this process when the S-NSSAI included in the allowed NSSAI and / or rejected NSSAI for the UE has changed. The AMF may use the UE configuration update process to notify the UE of the new allowed NSSAI and the new rejected NSSAI.

[0273] [3.4.UE setting update process]

[0274] Next, use Figure 8 The UE configuration update procedure (Generic UE configuration update procedure) is described. Hereinafter, the UE configuration update procedure is also referred to as this procedure. This procedure is a process for the core network to update the UE's configuration information. This procedure can be a process for performing network-led mobility management on a UE logged in to the network.

[0275] Moreover, the devices in the core network such as AMF can start this process based on the update of network settings and / or the update of operator policies. It should be noted that the trigger of this process can be the detection of UE mobility, the detection of state changes of UE and / or access network and / or core network, or the state change of network slice. Moreover, the trigger of this process can be the reception of a request from DN and / or DN's application server, the change of network settings, or the change of operator policies. Moreover, the trigger of this process can also be the expiration of an executing timer. It should be noted that the triggers for the devices in the core network to start this process are not limited to these. In other words, this process can be executed at any timing after the above-mentioned login process and / or PDU session establishment process are completed. Moreover, if each device is in a state where a 5GMM context has been established and / or each device is in a state as a 5GMM connection mode, this process can be executed at any timing.

[0276] In addition, each device may send and receive messages including identification information for changing the setting information of the UE and / or identification information for stopping or changing the function being executed by the UE during this process. Moreover, each device may update the setting information for the setting indicated by the network based on the completion of this process, or may start the behavior indicated by the network.

[0277] The UE can update the UE's setting information based on the control information sent and received through this process. Moreover, the UE can stop the function being executed or start a new function as the UE's setting information is updated. In other words, the device within the core network can use this control information by leading this process and then sending the control message and control information of this process to the UE, so that the UE can update the identifiable UE setting information. Moreover, the device within the core network can stop the UE's executing function or start a new function by updating the UE's setting information.

[0278] First, AMF starts the UE configuration update process by sending a configuration update command message (S800) to the UE via the 5G AN (or gNB).

[0279] AMF may include one or more of the twenty-first to twenty-fifth identification information in the setting update command message and send it. It should be noted that AMF may indicate the setting information of the new UE by sending one or more of the twenty-first to twenty-fifth identification information, and may also request the update of the setting information of the UE. It should be noted that the information indicating the support of each function and the information indicating the request for the use of each function may be sent and received as the same identification information, or may be sent and received as different identification information.

[0280] Furthermore, when multiple identification information is sent and received, two or more of the identification information may constitute one or more identification information. It should be noted that the information indicating support for each function and the information indicating request for use of each function may be sent and received as the same identification information or as different identification information.

[0281] It should be noted that the AMF can select and determine whether to include the twenty-first to twenty-fifth identification information in the setting update command message based on the received identification information and / or subscriber information and / or network capability information and / or operator policy and / or network status and / or user login information and / or context maintained by the AMF.

[0282] In addition, the AMF can send a setting update command message based on the received identification information and / or subscriber information and / or network capability information and / or operator policy and / or network status and / or user login information and / or context maintained by the AMF, thereby indicating a request for updating the UE's setting information.

[0283] The UE receives a setting update command message (S800) via the 5G AN (or gNB). The UE may update the setting information of the UE based on the setting update command message and / or the identification information included in the setting update command message.

[0284] The UE may update the allowed NSSAI stored in the UE by receiving the twenty-first identification information. Specifically, the UE may use the received twenty-first identification information as a new allowed NSSAI and replace the stored information.

[0285] The UE may update the rejected NSSAI stored by the UE by receiving the twenty-second identification information. Specifically, when receiving the twenty-second identification information, the UE may append the rejected NSSAI included in the twenty-second identification information to the rejected NSSAI stored by the UE, or may update the rejected NSSAI stored by the UE to the rejected NSSAI included in the twenty-second identification information.

[0286] For example, when the twenty-second identification information includes at least the S-NSSAI and the reason value, and when the UE has already managed the rejected NSSAI, the UE may not delete the already stored rejected NSSAI, but append the S-NSSAI included in the twenty-second identification information to the rejected NSSAI already stored by the UE and store it. Alternatively, the UE may delete the already stored rejected NSSAI and store the S-NSSAI included in the twenty-second identification information as the rejected NSSAI.

[0287] The UE may start a login process after this process is completed based on the reception of the twenty-fifth identification information. The login process started by the UE may be the login process described in Chapter 3.

[0288] It should be noted that the various processes performed by the UE based on the reception of each identification information as described above can be performed in this process or after the completion of this process, or can be performed based on the completion of this process after the completion of this process. Moreover, the UE can send a Configuration update complete message to the AMF via the 5G AN (gNB) as a response message to the Configuration update command message based on the identification information included in the Configuration update command message (S802).

[0289] When the UE sends a setting update completion command message, the AMF receives the setting update completion message (S802) via the 5G AN (gNB). In addition, each device completes this process based on the sending and receiving of the setting update command message and / or the setting update completion message.

[0290] Furthermore, each device may implement processing based on the information sent and received in this process based on the completion of this process. For example, in the case of sending and receiving update information for setting information, each device may update the setting information. Furthermore, in the case of sending and receiving information indicating that a login process needs to be performed, the UE may start the login process based on the completion of this process.

[0291] Furthermore, the UE may store the identification information received with the configuration information command message based on the completion of this process, and may also identify the determination of the network. In addition, the UE may perform various processes based on the stored information based on the completion of this process.

[0292] In the above process, the device in the core network can instruct the UE to update the setting information that the UE has applied by sending and receiving setting update command messages, and can instruct the UE to stop or change the functions being executed.

[0293] [3.5. Non-login process initiated by the network]

[0294] Next, use Fig. 9 The network-initiated de-registration procedure is described. Hereinafter, this procedure refers to the network-initiated de-registration procedure. The network-initiated de-registration procedure is a process for the network to manually de-register to access network_A and / or core network_A, access network_B and / or core network_B and / or DN and / or PDN. This process can be a process for performing network-led mobility management on a UE that is logged in to the network.

[0295] If the UE is in a state of logging in to the network (RM-REGISTERED state or 5G MM-REGISTEDED state), the AMF can perform this process at any timing. For example, the AMF can start this process as the UE's login information is updated. Moreover, specifically, the AMF can start this process when there is no allowed NSSAI in the UE's login information based on the completion of the network slice specific authentication and authorization process. In other words, the AMF can start this process when there is no S-NSSAI allowed for the UE and there is no reservation to add the S-NSSAI to the allowed NSSAI through other processes (such as network slice specific authentication and authorization processes) in the future.

[0296] It should be noted that, as the initial state, the UE and each device may store at least one of the first to fourth rejected NSSAIs.

[0297] First, the AMF may start this process by sending a de-registration request message to the UE (S900). Here, the de-registration request message is a NAS message sent and received on the N1 interface, but is sent and received between the UE and the 5G AN (gNB) in an RRC message.

[0298] The AMF may include at least one of the forty-first to forty-third identification information in the non-login request message and send it. The AMF may further include a reason value and / or information indicating the access type of the de-login in the non-login request message and send it. Here, the reason value may be a 5GMM cause.

[0299] It should be noted that AMF can send these identification information and / or non-login messages to indicate that the network does not support various functions, request a transition to a non-login state, notify AMF of changes, continue to indicate the start of the login process, or indicate a combination of these information. Moreover, in the case of sending and receiving multiple identification information, two or more identification information of these identification information can constitute more than one identification information. It should be noted that the information indicating support for each function and the information indicating a request for use of each function can be sent and received as the same identification information, or as different identification information.

[0300] The UE may identify and store the rejected S-NSSAI and the reason for rejection based on reception of at least one of the forty-first to forty-third identification information and / or the status of the UE.

[0301] When the UE receives the forty-first identification information included in the non-login request message, the UE may, based on the reason value corresponding to the S-NSSAI included in the forty-first identification information and / or the status of the UE, include the S-NSSAI in the appropriate rejected NSSAI and store it, or ignore the S-NSSAI, or appropriately delete or update the NSSAI stored by the UE.

[0302] Specifically, when the UE transitions to a non-logged-in state for the current PLMN on both 3GPP access and non-3GPP access, the UE may delete the first rejected NSSAI, the third rejected NSSAI and the fourth rejected NSSAI if they exist.

[0303] It should be noted that the UE can, based on the completion of the non-login process for both 3GPP access and non-3GPP access or the sending and receiving of messages in the non-login process, transition to the non-login state for the current PLMN on the access of both parties, and can also ignore the S-NSSAI included in the first to fourth rejected NSSAI (if any) included in the non-login request message.

[0304] Alternatively, when the UE is already in a non-logged-in state for the current PLMN on access (A) having only 3GPP access or non-3GPP access, the UE may, based on the completion of the non-logged-in process for the other party's access (B) or the sending and receiving of messages during the non-logged-in process, transition to a non-logged-in state for the current PLMN on access (B), and may also ignore the S-NSSAI included in the first to fourth rejected NSSAIs (if any) included in the non-logged-in request message.

[0305] In addition, when the UE receives a non-login request message including the forty-first identification information during a non-login process, and the non-login process is for an access (B) of either 3GPP access or non-3GPP access, and further, when the UE is in a logged-in state for the current PLMN on the other party's access (A), the UE can store the S-NSSAI included in the forty-first identification information as an appropriate NSSAI based on the corresponding rejection reason value. However, when the corresponding rejection reason value is information indicating that the S-NSSAI is not available in the current login area, regardless of whether the UE is in a logged-in state or a non-login state for other accesses, the UE can ignore the received S-NSSAI and delete the stored second rejected NSSAI.

[0306] Furthermore, specifically, when the 41st identification information includes the first rejected NSSAI, in other words, when the 41st identification information includes at least one set of S-NSSAI and a rejection reason value indicating that it cannot be used in the current PLMN, and when the 43rd identification information is information indicating 3GPP access or non-3GPP access, and when the access to the other party is in a logged-in state, the UE may include the S-NSSAI in the first rejected NSSAI and store it. Furthermore, when the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE may delete the rejected NSSAI from the allowed NSSAI.

[0307] In addition, in the case where the forty-first identification information includes a first rejected NSSAI, in other words, in the case where the forty-first identification information contains at least one set of S-NSSAI and a rejection reason value indicating that it cannot be used in the current PLMN, and then in the case where the UE transitions to a non-login state for all accesses based on the reception of a non-login request message, the UE may ignore the S-NSSAI.

[0308] It should be noted that the situation in which the UE transitions to the non-login state for all accesses based on the reception of the non-login request message may mean that the information indicating the access type for de-login in the non-login request message includes information indicating the access of both parties, or the information indicating the access type for de-login in the non-login request message includes information indicating 3GPP access or non-3GPP access, and the UE is in the non-login state with respect to the access of the other party.

[0309] Moreover, for example, in the case where the forty-first identification information includes the second rejected NSSAI, in other words, in the case where the forty-first identification information contains at least one set of S-NSSAI and a rejection reason value indicating that it is not available in the current login area, the UE can ignore the S-NSSAI.

[0310] In addition, in the case where the third rejected NSSAI is included in the forty-first identification information, in other words, in the case where at least one set of S-NSSAI and a rejection reason value indicating S-NSSAI pending for network slice specific authentication and authorization is constituted in the forty-first identification information, in the case where the forty-third identification information is information indicating 3GPP access or non-3GPP access, and then in the case where the access to the other party is in a logged-in state, the UE can include the S-NSSAI in the third rejected NSSAI and store it. Moreover, in the case where the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE can delete the rejected NSSAI from the allowed NSSAI.

[0311] In addition, in the case where the forty-first identification information includes a third rejected NSSAI, in other words, in the case where the forty-first identification information contains at least one set of S-NSSAI and a rejection reason value indicating the S-NSSAI pending for network slice specific authentication and authorization, and then in the case where the UE transitions to a non-login state for all accesses based on reception of a non-login request message, the UE may ignore the S-NSSAI.

[0312] In addition, in the case where the fourth rejected NSSAI is included in the forty-first identification information, in other words, in the case where the forty-first identification information consists of at least one set of S-NSSAI and a rejection reason value indicating that the S-NSSAI cannot be used due to failure or cancellation of network slice specific authentication and authorization, and further, in the case where the forty-third identification information is information indicating 3GPP access or non-3GPP access, and further, in the case where the UE is in a logged-in state on the access of the other party for the same PLMN, the UE can include the S-NSSAI in the fourth rejected NSSAI and store it, and, in the case where the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE can delete the rejected NSSAI from the allowed NSSAI.

[0313] In other words, when the 41st identification information includes the fourth rejected NSSAI, and when the 43rd identification information is information indicating that the 3GPP access is enabled, and when the UE is in a logged-in state on the non-3GPP access for the same PLMN, the UE may include the S-NSSAI in the fourth rejected NSSAI and store it, and when the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE may delete the rejected NSSAI from the allowed NSSAI. Alternatively, when the 41st identification information includes the fourth rejected NSSAI, and when the 43rd identification information is information indicating that the non-3GPP access is enabled, and when the UE is in a logged-in state on the 3GPP access for the same PLMN, the UE may include the S-NSSAI in the fourth rejected NSSAI and store it, and when the S-NSSAI included in the new rejected NSSAI is included in the allowed NSSAI stored by the UE, the UE may delete the rejected NSSAI from the allowed NSSAI.

[0314] In addition, in the case where the forty-first identification information includes the fourth rejected NSSAI, in other words, in the case where the forty-first identification information constitutes at least a set of S-NSSAI, S-NSSAI and a rejection reason value of S-NSSAI indicating network slice specific authentication and authorization failure, and then in the case of non-login process for access of both 3GPP access and non-3GPP access, the UE can ignore the rejected S-NSSAI.

[0315] During the non-login process initiated by the network, when a non-login request message including the 41st identification information is received from the core network, and the 41st identification information includes S-NSSAI and a rejection reason value indicating that it is not available in the current login area, the rejection S-NSSAI can be ignored regardless of the access type indicated by the 43rd identification information.

[0316] Moreover, in a non-login process initiated by the network, in the case of receiving a non-login request message including the forty-first identification information from the core network, and further in the case of the non-login process for access of both 3GPP access and non-3GPP access, and further in the case where the forty-first identification information includes an S-NSSAI and a rejection reason value indicating that the S-NSSAI for establishing an association is not available in the current PLMN and / or indicates that the S-NSSAI pending for network slice specific authentication and authorization and / or indicates that the network slice specific authentication and authorization failed, the UE may ignore the S-NSSAI.

[0317] Moreover, in the non-login process initiated by the network, in other cases, the UE can add the corresponding S-NSSAI to the appropriate rejected NSSAI based on the rejection reason included in the forty-first identification information and store it, and if it exists, the S-NSSAI included in the rejected NSSAI stored by the UE can be deleted from the allowed NSSAI stored by the UE.

[0318] In other words, in the non-login process initiated by the network, when the non-login request process is a process for 3GPP access only for 5GS, and then when the UE is in a non-login state for the current PLMN on the non-3GPP access, the UE can append the S-NSSAI included in the forty-first identification information to the appropriate rejected NSSAI or NSSAI based on the rejection reason value corresponding to the S-NSSAI and store it.

[0319] It should be noted that, here, a specific example of a method for determining an appropriate rejected NSSAI is described below. For example, when the rejection reason value is information indicating "S-NSSAI not available in the current PLMN", the appropriate rejected NSSAI may be the first rejected NSSAI. For example, when the rejection reason value is information indicating "S-NSSAI not available in the current login area", the appropriate rejected NSSAI may be the second rejected NSSAI.

[0320] For example, in the case where the rejection reason value is information indicating "S-NSSAI pending for network slice specific authentication and authorization", the appropriate rejected NSSAI may be the third rejected NSSAI. For example, in the case where the rejection reason value is information indicating "S-NSSAI not available due to failure or cancellation of network slice specific authentication and authorization", the appropriate rejected NSSAI may be the fourth rejected NSSAI.

[0321] In addition, when the UE receives the forty-first identification information during the non-login process initiated by the network, when the UE has not transitioned to the non-login state for all accesses based on the reception of the non-login request message, and regardless of the rejection reason value corresponding to the S-NSSAI included in the forty-first identification information, the UE can add the S-NSSAI included in the forty-first identification information to the appropriate rejected NSSAI based on the rejection reason for establishing the association and store it, and if it exists, the S-NSSAI included in the rejected NSSAI stored by the UE can be deleted from the allowed NSSAI stored by the UE.

[0322] In the case where the UE receives the forty-second identification information, the UE may delete the allowed NSSAI for access transitioning to the non-logged-in state. Specifically, in the case where the UE includes the forty-second identification information and the information indicating the 3GPP access in the non-logged-in request message and receives it, the UE may delete the allowed NSSAI for the 3GPP access from the storage. In the case where the UE includes the forty-second identification information and the information indicating the non-3GPP access in the non-logged-in request message and receives it, the UE may delete the allowed NSSAI for the non-3GPP access from the storage. In the case where the UE includes the forty-second identification information and the information indicating the access of both parties in the non-logged-in request message and receives it, the UE may delete the stored allowed NSSAI from the storage.

[0323] The UE may store other S-NSSAIs corresponding to the reason values ​​in the same way. It should be noted that the storage method of the NSSAI based on the UE's rejection is not limited to this, as long as the S-NSSAI is stored in a state where the reason value is corresponding to the S-NSSAI.

[0324] It should be noted that AMF can select and determine whether to include at least one of the identification information 41 to 43 in the non-login request message based on subscriber information and / or network capability information and / or operator policy and / or network status and / or user login information and / or context maintained by AMF.

[0325] Specifically, the AMF may not include the forty-first identification information including the rejection reason value indicating that it is not available in the current login area in the non-login request message, and may control it in that way.

[0326] The AMF may not include the forty-first identification information when including the forty-third identification information indicating the access of both parties in the non-login request message as identification information indicating the access type for de-login.

[0327] In a case where the AMF includes the forty-third identification information indicating 3GPP access or non-3GPP access in the non-login request message as information indicating the access type for de-login, and further in a case where the login state is in a non-login state with respect to the other party's access, the AMF may not include the forty-first identification information in the non-login request message.

[0328] In other words, in the case where the AMF includes the forty-third identification information indicating the 3GPP access as information indicating the access type for deregistration in the non-registration request message, and further in the case where the login state is in the non-registration state on the non-3GPP access, the AMF may not include the forty-first identification information in the non-registration request message. Alternatively, in the case where the AMF includes the forty-third identification information indicating the non-3GPP access as information indicating the access type for deregistration in the non-registration request message, and further in the case where the login state is in the non-registration state on the 3GPP access, the AMF may not include the forty-first identification information in the non-registration request message.

[0329] The UE receives a non-login request message via the 5G AN (gNB). By receiving the non-login request message, the UE can identify the contents of various identification information included in the non-login request message.

[0330] The UE may send a non-login acceptance message (DEREGISTRAION ACCEPT message) to the AMF via the 5G AN (or gNB) as the non-login request message is received. It should be noted that the non-login acceptance message is a NAS message sent and received on the N1 interface. In addition, the RRC message may be a control message sent and received between the UE and the 5G AN (or gNB).

[0331] Each device can transition to a state where the UE is not logged into the network (RM_DEREGISTERED state or 5GMM-DEREGISTERED state) based on the sending and receiving of the login acceptance message. In addition, the transition of each device to each state can be performed based on the completion of this process.

[0332] Furthermore, each device may perform processing based on the information sent and received in this process based on the completion of the non-login process. For example, the UE may start the login process based on the completion of the non-login process.

[0333] [4. Embodiments of the present invention]

[0334] The implementation of the present invention may be a combination of more than one process described in Chapter 3. That is, in the implementation of the present invention, each process described in Chapter 3 may be executed independently of other processes, or each device may start other appropriate processes after each process is completed.

[0335] Specifically, for example, after the completion of the login process, each device can perform a network slice specific authentication and authorization process. For example, after the completion of the network slice specific authentication and authorization process, each device can perform a UE setting update process and can also perform a non-login process initiated by the network.

[0336] In addition, each device may delete the stored information based on the state transition of each process. Specifically, the UE may delete the first rejected NSSAI, the third rejected NSSAI, and the fourth rejected NSSAI when the UE transitions to the non-logged-in state for the current PLMN on 3GPP access and is not logged in for the current PLMN on non-3GPP.

[0337] In addition, when the UE transitions to a non-logged state for the current PLMN on 3GPP access, the UE may delete the second rejected NSSAI for 3GPP access regardless of whether the current PLMN is in a logged state or a non-logged state on non-3GPP.

[0338] On the contrary, when the UE transitions to the non-registered state for the current PLMN on the non-3GPP access, the UE may delete the first rejected NSSAI, the third rejected NSSAI, and the fourth rejected NSSAI when the current PLMN is not registered on the 3GPP. In addition, when the UE transitions to the non-registered state for the current PLMN on the non-3GPP access, the UE may delete the second rejected NSSAI for the non-3GPP regardless of whether the current PLMN is in the registered state or the non-registered state on the 3GPP.

[0339] Moreover, when the UE transitions to a non-logged-in state for the current PLMN on both 3GPP access and non-3GPP access, the UE can delete the first rejected NSSAI, the third rejected NSSAI and the fourth rejected NSSAI, and can also delete the second rejected NSSAI for 3GPP and the second rejected NSSAI for non-3GPP.

[0340] It should be noted that, there is a method for the UE to transition to the non-logged-in state for the current PLMN on 3GPP access or non-3GPP access, which is based on the sending and receiving of explicit messages to implicitly or locally transition to the non-logged-in state. Here, the explicit message may be a login rejection message and / or a non-logged-in request message and / or a non-logged-in completion message.

[0341] [5. Improvement example]

[0342] The program running in the device involved in the present invention can be a program that controls a central processing unit (CPU) or the like to enable a computer to function in order to realize the functions of the embodiments involved in the present invention. The program or the information processed by the program is temporarily stored in a volatile memory such as a random access memory (RAM) or a non-volatile memory such as a flash memory, a hard disk drive (HDD) or other storage device system.

[0343] It should be noted that the program for realizing the functions of the embodiments involved in the present invention may also be recorded in a computer-readable recording medium. This can be realized by reading the program recorded in the recording medium into a computer system and executing it. The "computer system" mentioned here refers to a computer system built into a device, and includes a computer system of hardware such as an operating system and peripherals. In addition, the "computer-readable recording medium" may be a semiconductor recording medium, an optical recording medium, a magnetic recording medium, a medium that dynamically stores a program for a short time, or other computer-readable recording media.

[0344] In addition, each functional block or each feature of the device used in the above-mentioned embodiments can be installed or executed by an electronic circuit such as an integrated circuit or multiple integrated circuits. Circuits designed in a manner to perform the functions described in this specification may include: a general-purpose processor, a digital signal processor (DSP), an integrated circuit for a specific purpose (ASIC), a field programmable gate array (FPGA) or other programmable logic elements, discrete gates or transistor logic, discrete hardware parts, or a combination thereof. The general-purpose processor may be a microprocessor, or it may be a processor, controller, microcontroller, or state machine of the previous type. The above-mentioned electronic circuit may be composed of a digital circuit or an analog circuit. In addition, in the case where an integrated circuit technology that replaces the current integrated circuit appears due to advances in semiconductor technology, one or more schemes of the present invention may also use a new integrated circuit based on the technology.

[0345] It should be noted that the present invention is not limited to the above-mentioned embodiments. In the embodiments, an example of a device is described, but the present invention is not limited thereto and can be applied to fixed or non-movable electronic devices installed indoors or outdoors, such as AV equipment, kitchen equipment, cleaning / washing equipment, air conditioning equipment, office equipment, vending machines, other life equipment, and other terminal devices or communication devices.

[0346] Above, the embodiments of the present invention are described in detail with reference to the accompanying drawings, but the specific configuration is not limited to the present embodiments, and also includes design changes within the scope of the gist of the present invention. In addition, the present invention can be variously modified within the scope shown in the technical solution, and the embodiments obtained by appropriately combining the technical solutions disclosed in different embodiments are also included in the technical scope of the present invention. In addition, it also includes a configuration obtained by replacing the elements that have the same effect as the elements recorded in the above-mentioned embodiments with each other.

[0347] Description of Reference Numerals

[0348] 1 Mobile Communication System

[0349] 10UE_A

[0350] 30 PGW-U

[0351] 32 PGW-C

[0352] 35 SGW

[0353] 40 MME

[0354] 45 eNB

[0355] 50 HSS

[0356] 60 PCRF

[0357] 80 Access network_A(E-UTRAN)

[0358] 90 Core Network_A

[0359] 120 Access Network_B(5G AN)

[0360] 122 gNB

[0361] 130 UPF

[0362] 132 SMF

[0363] 140 AMF

[0364] 150 UDM

[0365] 160 PCF

[0366] 190 Core Network_B

Claims

1. A user equipment UE, characterized in that: It has a transceiver unit, a control unit and a storage unit. When the transceiver receives a control message including first rejected network slice selection assistance information NSSAI, wherein the first rejected NSSAI includes single network slice selection assistance information S-NSSAI and a rejection reason value associated with the S-NSSAI, Furthermore, in case the rejection reason value indicates failure or cancellation of the S-NSSAI which cannot be used for network slice specific authentication and authorization, the control unit stores the S-NSSAI included in the first rejected NSSAI in a second rejected NSSAI stored in the storage unit for failure or cancellation of network slice specific authentication and authorization, The control unit processes the S-NSSAI included in the second rejected NSSAI as information irrelevant to the access type.

2. The UE according to claim 1, characterized in that The control message is a login acceptance message, a login rejection message, a non-login request message or a setting update command message.

3. A communication control method performed by a user equipment UE, wherein the communication control method is characterized in that: In a case where the UE receives a control message including first rejection network slice selection assistance information NSSAI, wherein the first rejected NSSAI includes single network slice selection assistance information S-NSSAI and a rejection reason value associated with the S-NSSAI, Furthermore, in case the rejection reason value indicates failure or cancellation of the S-NSSAI which cannot be used for network slice specific authentication and authorization, storing the S-NSSAI included in the first rejected NSSAI in a second rejected NSSAI stored in the UE for failure or cancellation of network slice specific authentication and authorization, The S-NSSAI included in the second rejected NSSAI is processed as information irrelevant to the access type.

Images