Registering with a mobile network via another mobile network

Abstract

Devices, methods, and systems for registering with another mobile communication network ("MCN") via another MCN are disclosed. A device (600) includes a processor (605) and a transceiver (625), wherein the device (600) is registered with a first MCN. The processor (605) determines (810) to register with a second MCN via the first MCN and sends a request to establish a data connection with the first MCN. The processor (605) receives (815) from the first MCN a command to initiate an authentication procedure with the first MCN and a registration procedure for registering the device with the MCN. The processor (605): exchanges (820) a plurality of authentication messages with the first MCN, each of the authentication messages containing a signaling message for registering the device (600) with the second MCN; and completes (825) the registration with the second MCN via the data connection in response to successfully establishing the data connection.

Description

Technical Field

[0001] The subject matter disclosed herein relates generally to wireless communications, and more particularly, to registering with a mobile network through another mobile network. Background Art

[0002] The following abbreviations and acronyms are defined herein, at least some of which are referred to within the following description.

[0003] 3rd Generation Partnership Project (“3GPP”), 5th Generation Core (“5GC”), Access and Mobility Management Function (“AMF”), Access Point Name (“APN”), Access Stratum (“AS”), Application Programming Interface (“API”), Data Network Name (“DNN”), Downlink (“DL”), Enhanced Mobile Broadband (“eMBB”), Evolved Node-B (“eNB”), Evolved Packet Core (“EPC”), Evolved UMTS Terrestrial Radio Access Network (“E-UTRAN”), Home Subscriber Server (“HSS”), IP Multimedia Subsystem (“IMS”, also known as “IP Multimedia Core Network Subsystem”), Internet Protocol (“IP”), Long Term Evolution (“LTE”), LTE-Advanced (“LTE-A”), Media Access Control (“MAC”), Mobile Network Operator (“MNO”), Mobility Management Entity (“MME”), Non-Access Stratum (“NAS”), Narrowband (“NB”), Network Function (“NF”), Network Access Identifier (“NAI”), Next Generation (e.g., 5 G) Node-B (“gNB”), Next Generation Radio Access Network (“NG-RAN”), New Radio (“NR”), Policy Control Function (“PCF”), Packet Data Network (“PDN”), Packet Data Unit (“PDU”), PDN Gateway (“PGW”), Public Land Mobile Network (“PLMN”), Quality of Service (“QoS”), Radio Access Network (“RAN”), Radio Access Technology (“RAT”), Radio Resource Control (“RRC”), Reception (“Rx”), Single Network Slice Selection Assistance Information (“S-NSSAI”), Serving Gateway (“SGW”), Session Management Function (“SMF”), Transmission Control Protocol (“TCP”), Transmission (“Tx”), Unified Data Management (“UDM”), User Entity / Equipment (Mobile Terminal) (“UE”), Uplink (“UL”), User Plane (“UP”), Universal Mobile Telecommunications System (“UMTS”), User Datagram Protocol (“UDP”), Wireless Local Area Network (“WLAN”), and Worldwide Interoperability for Microwave Access (“WiMAX”).

[0004] In some embodiments, the UE may connect to the 5G Core (“5GC”) network of a public land mobile network (“PLMN”) via an untrusted network using a non-3GPP interworking function (“N3IWF”) in the PLMN. However, not all PLMNs support access via an untrusted network. Summary of the invention

[0005] A method for registering with a mobile network through another mobile network is disclosed. Devices and systems also perform the functions of the method.

[0006] A method for registering with a mobile network through another mobile network includes: registering a UE with a first mobile communication network; and determining to register the UE with a second mobile communication network via the first mobile communication network. The method includes: sending a request to establish a data connection with the first mobile communication network, the request including an identifier of the second mobile communication network; and receiving a command from the first mobile communication network, the command initiating an authentication procedure with the first mobile communication network and a registration procedure for registering with the second mobile communication network. The method includes: exchanging a plurality of authentication messages with the first mobile communication network, wherein each of the plurality of authentication messages contains a signaling message for registering the UE with the second mobile communication network; and completing the registration with the second mobile communication network via the data connection in response to successfully establishing the data connection.

[0007] Another method for registering with a mobile network through another mobile network includes: registering a gateway device with a first mobile communication network; and receiving a network access identifier ("NAI") from a UE attempting to connect to the gateway device, wherein the NAI includes an identification of a second mobile communication network. The method includes: sending a request to establish a data connection with the first mobile communication network, the request including the identification of the second mobile communication network; and receiving a command from the first mobile communication network, the command initiating an authentication procedure with the first mobile communication network and a registration procedure for registering the UE with the second mobile communication network. The method includes: exchanging a plurality of authentication messages with the first mobile communication network, wherein each of the plurality of authentication messages contains a signaling message for registering the UE with the second mobile communication network; and receiving an acceptance message indicating that a data connection with the first mobile communication network is successfully established in response to a successful authentication of the UE with the second mobile communication network, wherein the UE completes registration with the second mobile communication network via the data connection. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] A more particular description of the embodiments briefly described above will be presented with reference to specific embodiments illustrated in the accompanying drawings. Understanding that these drawings depict only some embodiments and are therefore not to be considered limiting in scope, the embodiments will be described and explained with additional specificity and detail through the use of the accompanying drawings, in which:

[0009] Figure 1 A diagram illustrating one embodiment of a wireless communication system for registering with a mobile network through another mobile network;

[0010] Figure 2 A diagram illustrating one embodiment of a network deployment for registering with a mobile network through another mobile network;

[0011] Figure 3A A signal flow diagram for illustrating one embodiment of a procedure for registering with a PLMN via a non-public mobile network;

[0012] Figure 3B for Figure 3A A continuation of the procedures described in ;

[0013] Figure 3C for Figures 3A to 3B A continuation of the procedures described in ;

[0014] Figure 4 A diagram for illustrating another embodiment of a network deployment for registering with a mobile network through another mobile network;

[0015] Figure 5A A signal flow diagram illustrating one embodiment of a procedure for registering with a PLMN through another PLMN;

[0016] Figure 5B for Figure 5A A continuation of the procedures described in ;

[0017] Figure 5C for Figures 5A to 5B A continuation of the procedures described in ;

[0018] Figure 6 A block diagram illustrating one embodiment of a user equipment device for registering with a mobile network through another mobile network;

[0019] Figure 7 A block diagram illustrating one embodiment of a gateway device for registering with a mobile network through another mobile network;

[0020] Figure 8 is a flow chart illustrating one embodiment of a first method for registering with a mobile network through another mobile network; and

[0021] Fig. 9 A flow chart illustrating one embodiment of a second method for registering with a mobile network through another mobile network.

[0022] Specific embodiments

[0023] As will be appreciated by those skilled in the art, aspects of the embodiments may be embodied as systems, devices, methods or program products. Thus, the embodiments may be in the form of fully hardware embodiments, fully software embodiments (including firmware, resident software, microcode, etc.), or embodiments combining software and hardware aspects.

[0024] For example, the disclosed embodiments may be implemented as hardware circuits comprising custom very large scale integration ("VLSI") circuits or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. The disclosed embodiments may also be implemented in programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices, or the like. As another example, the disclosed embodiments may include one or more physical or logical blocks of executable code, which may be organized, for example, as an object, procedure, or function.

[0025] Furthermore, embodiments may be in the form of a program product embodied in one or more computer-readable storage devices storing machine-readable code, computer-readable code, and / or program code, hereinafter referred to as code. The storage device may be tangible, non-transitory, and / or non-transmitting. The storage device may not embody signals. In one embodiment, the storage device employs only signals for accessing the code.

[0026] Any combination of one or more computer readable media may be utilized. The computer readable medium may be a computer readable storage medium. The computer readable storage medium may be a storage device storing code. The storage device may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, holographic, micromechanical, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing.

[0027] More specific examples of storage devices (a non-exhaustive list) would include the following: an electrical connection having one or more conductors, a portable computer diskette, a hard disk, a random access memory ("RAM"), a read-only memory ("ROM"), an erasable programmable read-only memory ("EPROM" or flash memory), a portable compact disc read-only memory ("CD-ROM"), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer-readable storage medium may be any tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0028] References throughout this specification to "one embodiment," "an embodiment," or similar language mean that a particular feature, structure, or characteristic described in conjunction with an embodiment is included in at least one embodiment. Therefore, unless otherwise expressly specified, the phrases "in one embodiment," "in an embodiment," and similar language throughout this specification may, but not necessarily, all refer to the same embodiment, but rather mean "one or more but not all embodiments." Unless otherwise expressly specified, the terms "comprising," "including," "having," and variations thereof mean "including but not limited to." Unless otherwise expressly specified, an enumerated list of items does not imply that any or all of the items are mutually exclusive. Unless otherwise expressly specified, the terms "a / an" and "described" also refer to "one or more."

[0029] As used herein, a list with the conjunction "and / or" includes any single item in the list or a combination of items in the list. For example, a list of A, B, and / or C includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C, or a combination of A, B, and C. As used herein, a list using the term "one or more of" includes any single item in the list or a combination of items in the list. For example, one or more of A, B, and C includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C, or a combination of A, B, and C. As used herein, a list using the term "one of" includes one and only one of any single item in the list. For example, "one of A, B, and C" includes only A, only B, or only C and does not include a combination of A, B, and C. As used herein, "a member selected from the group consisting of A, B, and C" includes one and only one of A, B, or C and does not include a combination of A, B, and C. As used herein, “a member selected from the group consisting of A, B, and C, and combinations thereof” includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C, or a combination of A, B, and C.

[0030] In addition, the described features, structures or characteristics of the embodiments may be combined in any suitable manner. In the following description, many specific details are provided, such as examples of programming, software modules, user selections, network transactions, database queries, database structures, hardware modules, hardware circuits, hardware chips, etc., to provide a thorough understanding of the embodiments. However, those skilled in the relevant art will recognize that the embodiments may be practiced without one or more of the specific details or with other methods, components, materials, etc. In other cases, well-known structures, materials, or operations are not shown or described in detail to avoid confusing aspects of the embodiments.

[0031] Aspects of the embodiments are described below with reference to schematic flow charts and / or schematic block diagrams of methods, devices, systems, and program products according to the embodiments. It should be understood that each frame of the schematic flow charts and / or schematic block diagrams, and the combination of frames in the schematic flow charts and / or schematic block diagrams, can be implemented by code. This code can be provided to a processor of a general-purpose computer, a special-purpose computer, or another programmable data processing device to produce a machine, so that instructions executed by the processor of the computer or another programmable data processing device create components for implementing the functions / actions specified in the schematic flow charts and / or schematic block diagrams.

[0032] The code may also be stored in a storage device that can direct a computer, another programmable data processing device, or other device to function in a specific manner so that the instructions stored in the storage device produce an article of manufacture containing instructions for implementing the functions / actions specified in the schematic flowchart and / or schematic block diagram.

[0033] The code may also be loaded onto a computer, another programmable data processing device, or other apparatus to cause a series of operational steps to be performed on the computer, another programmable device, or other apparatus to produce a computer-implemented process, so that the code executed on the computer or another programmable device provides a process for implementing the functions / actions specified in the schematic flowchart and / or schematic block diagram.

[0034] The schematic flow charts and / or schematic block diagrams in the figures illustrate the architecture, functionality and operation of possible implementations of devices, systems, methods and program products according to various embodiments. In this regard, each box in the schematic flow charts and / or schematic block diagrams may represent a module, segment or portion of code, which includes one or more executable instructions of the code for implementing the specified logical function.

[0035] It should also be noted that in some alternative implementations, the functions mentioned in the blocks may not occur in the order mentioned in the drawings. For example, two blocks shown in succession may actually be executed substantially simultaneously, or the blocks may sometimes be executed in the reverse order, depending on the functionality involved. Other steps and methods are conceivable that are equivalent in function, logic, or effect to one or more blocks, or portions thereof, of the illustrated drawings.

[0036] The description of an element in each figure may refer to an element of the previous figure. In all figures, the same numerals refer to the same elements, including alternative embodiments of the same elements.

[0037] Methods, devices and systems for registering with a mobile network through another mobile network are disclosed. A UE may connect to a 5G core network in a PLMN via a 5G core in a standalone non-public network ("SNPN"), and vice versa. In some embodiments, the UE is simultaneously connected to two 5G core networks: a first 5G core in the SNPN and a second 5G core in the PLMN. The UE connects to the 5G core in the PLMN by initiating a N3IWF discovery procedure and then initiating a 5G registration procedure via the selected N3IWF after obtaining IP connectivity via the SNPN (i.e., after establishing a PDU session with the SNPN with type 'IP'). An example of a 5G registration procedure via the selected N3IWF is described in clause 4.12 of 3GPP TS 23.502, v16.2.0. Therefore, after establishing a PDU session with the PLMN, the UE establishes a signaling IPsec SA with the selected N3IWF, and may also establish one or more user data IPsec SAs with the selected N3IWF.

[0038] However, using N3IWF to connect to PLMN via SNPN has several disadvantages. For example, PLMN may only support trusted non-3GPP access, so it does not support N3IWF. In this case, the UE cannot access the PLMN via SNPN. As another example, the communication between the UE and the N3IWF in the PLMN is usually transparent to the SNPN (e.g., unless a dedicated DNN and / or S-NSSAI is adopted in the SNPN to support connectivity with the PLMN). Therefore, the IP connectivity service provided by the SNPN cannot be configured to optimize the communication between the UE and the PLMN. As an illustration, the SNPN 3GPP access can be configured to apply confidentiality protection, which is unnecessary because the UE is protected by IPsec for N3IWF communications. Alternatively, the QoS enforced by the SNPN on the PDU session is insufficient to support real-time services between the UE and the PLMN.

[0039] Another example of a disadvantage of N3IWF usage is that even if the UE only supports 3GPP access, the UE must be able to support procedures for untrusted non-3GPP access (i.e., N3IWF discovery procedures) and / or must be configured with N3IWF selection information. As another example, if the UE supports connectivity with N3IWF and with ePDG, it may not be able to connect to the N3IWF of a PLMN because its "non-3GPP access node selection information" indicates that ePDG is preferred for this PLMN. An example of a combined N3IWF / ePDG selection procedure is described in 3GPP TS 23.501, v16.2.0.

[0040] Furthermore, the UE may not be able to connect to the desired PLMN via the SNPN. For example, if the UE is roaming (it is located in a country other than that of its HPLMN), the UE may be instructed to connect to an N3IWF in a VPLMN that does not have a roaming agreement with the UE's HPLMN.

[0041] To overcome the above shortcomings, the present disclosure describes an alternative procedure for a UE to connect to a 5G core in a PLMN after obtaining IP connectivity via an SNPN. As described in more detail below, the UE may connect to a TNGF (trusted non-3GPP gateway function) in the PLMN instead of the N3IWF. Therefore, a new and different procedure is required for the UE to connect to the PLMN using the TNGF.

[0042] Figure 1 A wireless communication system 100 for registering with a mobile network through another mobile network according to an embodiment of the present disclosure is depicted. In one embodiment, the wireless communication system 100 includes at least one remote unit 105, at least one base unit 110, at least one access network ("AN") 115, a mobile core network 120 in a non-public network, and a mobile core network 140 in a PLMN. The AN 115 may be composed of at least one base unit 110. Depending on the radio access technology deployed by the AN 115, the remote unit 105 may communicate with the access network 115 using a 3GPP communication link and / or a non-3GPP communication link. Although Figure 1 Although a specific number of remote units 105, base units 110, AN 115, mobile core networks 120, and mobile core networks 140 are depicted in the figure, those skilled in the art will recognize that any number of remote units 105, base units 110, AN 115, mobile core networks 120, and mobile core networks 140 may be included in the wireless communication system 100.

[0043] In one embodiment, the wireless communication system 100 complies with the 5G system specified in the 3GPP specification. However, more generally, the wireless communication system 100 may implement some other open or proprietary communication network, such as LTE / EPC (referred to as 4G) or WiMAX, among other networks. The present disclosure is not intended to be limited to implementations of any particular wireless communication system architecture or protocol.

[0044] In one embodiment, the remote unit 105 may include a computing device, such as a desktop computer, a laptop computer, a personal digital assistant ("PDA"), a tablet computer, a smart phone, a smart TV (e.g., a TV connected to the Internet), a smart appliance (e.g., an appliance connected to the Internet), a set-top box, a game console, a security system (including a security camera), a vehicle onboard computer, a network device (e.g., a router, a switch, a modem), or the like. In some embodiments, the remote unit 105 includes a wearable device, such as a smart watch, a fitness band, an optical head-mounted display, or the like. In addition, the remote unit 105 may be referred to as a UE, a subscriber unit, a mobile device, a mobile station, a user, a terminal, a mobile terminal, a fixed terminal, a subscriber station, a user terminal, a wireless transmission / reception unit ("WTRU"), a device, or other terms used in the art.

[0045] The remote unit 105 may communicate directly with one or more of the base units 110 in the access network 115 via uplink ("UL") and downlink ("DL") communication signals. In addition, the UL and DL communication signals may be carried on the communication link 113. It should be noted that the access network 115 is an intermediate network that provides the remote unit 105 with access to the mobile core network 120 and / or the mobile core network 140.

[0046] In some embodiments, the remote unit 105 communicates with an application server (or another communication peer device) via a network connection with the mobile core network 120 and / or 140. For example, an application in the remote unit 105 (e.g., a web browser, a media client, a phone / VoIP application) may trigger the remote unit 105 to establish a PDU session (or another data connection) with the mobile core network 120 using the access network 115. The mobile core network 120 then relays traffic between the remote unit 105 and the data network 150 (e.g., an application server) using the PDU session. It should be noted that the remote unit 105 may establish one or more PDU sessions (or other data connections) with the mobile core network 120. Thus, the remote unit 105 may have at least one PDU session for communicating with the data network 150. The remote unit 105 may establish additional PDU sessions to communicate with another data network and / or other communication peer devices.

[0047] As discussed in further detail below, the mobile data connection (PDU session) of remote unit 105 with mobile core network 120 may be used to register remote unit 105 with mobile core network 140. In particular, remote unit 105 may register with mobile core network 140 using TNGF 153 in order to benefit from enhanced IP connectivity, as described in further detail below.

[0048] The base units 110 may be distributed over a geographic area. In some embodiments, the base units 110 may also be referred to as access terminals, access points, bases, base stations, Node-Bs, eNBs, gNBs, home Node-Bs, relay nodes, devices, or any other terminology used in the art. The base units 110 are typically part of a radio access network ("RAN") such as an access network 115, which may include one or more controllers communicatively coupled to one or more corresponding base units 110. These and other elements of a radio access network are not illustrated, but are generally well known to those of ordinary skill in the art. The base units 110 are connected to a mobile core network 140 via the access network 115.

[0049] The base unit 110 may serve a number of remote units 105 within a service area (e.g., a cell or cell partition) via a communication link 113. The base unit 110 may communicate directly with one or more of the remote units 105 via communication signals. In general, the base unit 110 transmits DL communication signals to serve the remote units 105 in the time, frequency, and / or spatial domains. In addition, the DL communication signals may be carried on the communication link 113. The communication link 113 may be any suitable carrier in a licensed or unlicensed wireless spectrum. The communication link 113 facilitates communication between one or more of the remote units 105 and / or one or more of the base units 110.

[0050] In one embodiment, mobile core networks 120 and 140 are 5G cores (“5GC”) or evolved packet cores (“EPC”), which may be coupled to data networks (e.g., data network 150, such as the Internet and private data networks, among other data networks). Remote unit 105 may have a subscription or another account with non-public mobile core network 120. Additionally, remote unit 105 may have a subscription or another account with public mobile core network 140. The present disclosure is not intended to be limited to implementations of any particular wireless communication system architecture or protocol.

[0051] The mobile core network 120 includes several network functions (“NFs”). As depicted, the mobile core network 120 includes a plurality of user plane functions (“UPFs”). Here, the mobile core network 120 includes at least one UPF 121 that serves the access network 115. The mobile core network 120 also includes a plurality of control plane functions, including but not limited to an access and mobility management function (“AMF”) 123, a session management function (“SMF”) 125, and a policy control function (“PCF”) 127. In certain embodiments, the mobile core network 120 may also include a unified data management function (“UDM”), an authentication server function (“AUSF”), a network repository function (“NRF”) (used by various NFs to discover APIs and communicate with each other on the APIs), or other NFs defined for the 5GC. Although depicted as a mobile core in a non-public network, in other embodiments, the mobile core 120 may be a mobile core in a PLMN separate from the mobile core network 140. In such an embodiment, remote unit 105 may establish a data connection with mobile core network 120 to register with mobile core network 140 via TNGF 153 .

[0052] The mobile core network 140 also includes several network functions ("NFs"). As depicted, the mobile core network 140 includes a plurality of user plane functions ("UPFs"). Here, the mobile core network 140 includes at least one UPF 141 serving the TNGF 153. The mobile core network 140 also includes a plurality of control plane functions, including but not limited to an access and mobility management function ("AMF") 143, a session management function ("SMF") 145, and a policy control function ("PCF") 147. In certain embodiments, the mobile core network 140 may also include a unified data management function ("UDM"), an authentication server function ("AUSF"), a network repository function ("NRF") (used by various NFs to discover APIs and communicate with each other on APIs), or other NFs defined for the 5GC.

[0053] TNGF 153 is a network function that supports access to 5GC via non-3GPP access networks. Generally speaking, TNGF 153 supports connectivity with one or more 5GC networks of the UE, which support non-3GPP access and NAS protocols on applicable NAS procedures. Here, TNGF 153 is also used to support remote unit 105 to access mobile core network 140 via another mobile network (here, non-public mobile core network 120).

[0054] In various embodiments, the mobile core networks 120 and 140 support different types of mobile data connections and different types of network slices, where each mobile data connection utilizes a specific network slice. Each network slice includes a set of CP and UP network functions, where each network slice is optimized for a specific type of service or business class. For ease of illustration, Figure 1 Different network slices are not shown in the figure, but their support is presented. In one example, each network slice includes SMF and UPF, but various network slices share AMF 143, PCF 147 and UDM. In another example, each network slice includes AMF, SMF and UPF. Figure 1 Although a specific number and type of network functions are depicted in FIG. 1 , those skilled in the art will recognize that any number and type of network functions may be included in the mobile core networks 120 and 140.

[0055] In order to solve the shortcomings of N3IWF access described above, the present disclosure proposes a solution that enables a UE (e.g., remote unit 105) to connect to a second 5G core network (in a PLMN) via a first 5G core network by using the TNGF of a second 5G core network rather than using N3IWF as specified by the current 3GPP specification. Two solutions are described herein: Solution A in which a UE (e.g., remote unit 105) registers with a PLMN through a non-public mobile network; and Solution B in which a UE (e.g., remote unit 105) operating behind a 5G-RG registers with a PLMN through another PLMN (e.g., a PLMN registered with it by a 5G-RG). It should be noted that the 5G-RG acts as an access network (e.g., a RAN node) toward a UE operating behind a 5G-RG and acts as a UE toward a 5G CN.

[0056] Figure 2 A network deployment 200 is depicted including a UE 205 registered with a stand-alone non-public network ("SNPN") 215. The SNPN CN 215 includes at least an AMF ("AMF-0") 216, an SMF ("SMF-0") 217, and a UPF ("UPF-0") 218. In various embodiments, the SNPN CN 215 includes the UE 205 as described above with reference to FIG. Figure 1It should be noted that UE 205 is connected to SNPN CN 215 via access network 210. UE 205 registers with PLMN via TNGF 221 in PLMN CN 220 using a data connection with SNPN (e.g., a PDU session 235 established with SNPN). PLMN CN 220 includes at least TNGF 221, AMF ("AMF-1") 222, SMF ("SMF-1") 223, and UPF ("UPF-1") 224. In various embodiments, PLMN CN includes the TNGF 221, AMF ("AMF-1") 222, SMF ("SMF-1") 223, and UPF ("UPF-1") 224 as described above. Figure 1 As depicted, the SNPN CN and the PLMN CN are connected via a data network (“DN-0”) 225 . Furthermore, after registering with the PLMN, the UE 205 may access another data network (“DN-1”) 230 via UPF-1 224 .

[0057] As depicted, UE 205 establishes a data connection (depicted here as PDU session 235) with the SNPN. Figures 3A to 3C An example of a data connection establishment procedure is described. It should be noted that the data connection establishment also initiates registration with the PLMN. After the data connection is established, the UE 205 establishes a signaling IPSec SA and a TCP connection 240 with the TNGF 221 and completes registration with the PLMN. Therefore, the UE 205 has an N1 connection with the AMF-0 216 for the SNPN and also has an N1 connection with the AMF-1 222 for the PLMN.

[0058] Figures 3A to 3C A procedure 300 for registering with a mobile network through another mobile network according to an embodiment of the present disclosure is depicted. The procedure 300 involves a UE (e.g., one embodiment of a remote unit 105), a 5G-RAN 310, an AMF, an SMF, and an UPF in a first PLMN ("PLMN-1", these NFs are named "AMF-0" 216, "SMF-0" 217, and "UPF-0" 218, respectively), and a TNGF, an AMF, and an AUSF in a second PLMN ("PLMN-2", these NFs are named "TNGF" 221, "AMF-1" 222, and "AUSF" 320, respectively). The procedure 300 details the signaling flow for solution A, where the UE 205 has registered with the 5G core 215 in the SNPN. It is assumed that the UE 205 has access credentials for both the SNPN and the PLMN. These credentials are separate and can be stored in a separate USIM profile in a physical UICC in the UE 205 or in an embedded UICC (eUICC).

[0059] refer to Figure 3A, procedure 300 starts at step 0, where after registering with the SNPN, the UE 205 decides to connect to the PLMN in order to, for example, access some PLMN services, such as IMS multimedia services, which are not available in the SNPN (see box 301). The UE 205 may take this decision based on some local configuration or based on URSP rules provided in the UE 205 by the SNPN.

[0060] At step 1, UE 205 uses Figures 3A to 3C The trusted non-3GPP access procedure illustrated in and described herein selects a PLMN to connect to and determines to access this PLMN via an SNPN. Alternatively, the UE 205 may determine to access this PLMN via an SNPN by using an existing untrusted non-3GPP access procedure, i.e., to discover and connect to the N3IWF in the PLMN. Here, it is assumed that the UE 205 uses some local configuration data to determine which procedure to use.

[0061] During step 1, the UE 205 initiates the establishment of a new PDU session with the SNPN. This PDU session will provide enhanced IP connectivity between the UE 205 and the TNGF 221 in the selected PLMN, and will enforce appropriate QoS, security and charging policies for user plane traffic.

[0062] UE 205 sends a NAS message containing a PDU Session Establishment Request message and indicating PDU Type=IP (e.g., IPv4, IPv6, or IPv4v6) to AMF-0 216 (see messaging 303). The NAS message may also contain a specific DNN and S-NSSAI, and should contain a Network Access Identifier (NAI) that includes the identity of the selected PLMN in the address field portion. For example, the NAI provided by UE 205 may be formatted as NAI=Anonymous@nai.5gc.mnc015.mcc2 34.3gppnetwork.org This NAI indicates to SMF-0 217 that UE 205 wants to register with 5GC in PLMN with MCC=234 and MNC=015. The username part of the NAI may contain "anonymous" and any other non-zero string.

[0063] Optionally, the UE 205 may also include an explicit indication in the PDU Session Establishment Request message indicating that this PDU session is to be used to access an external PLMN.

[0064] At step 2, when SMF-0 217 receives the PDU session establishment request via AMF-0 216, SMF-0 217 initiates a secondary authentication / authorization procedure because SMF-0 217 receives the NAI from UE 205. In one embodiment, SMF-0 217 implements the secondary authentication / authorization procedure specified in clause 5.6.6 of 3GPP TS 23.501. Therefore, SMF-0 217 selects TNGF 221 based on the address domain (which contains the PLMN identity) provided by UE 205 and based on other parameters such as local configuration (see box 305). From the perspective of SMF-0, the selected TNGF 221 is the same as the DN-AAA server operating in the DN, and UE 205 attempts to connect with the requested PDU session.

[0065] At step 3, SMF-0 217 sends an AAA request message to the selected TNGF 221, which acts as a DN-AAA server (see messaging 307). This message contains the NAI of UE 205. TNGF 221 initiates the normal procedure applied when UE 205 requests to connect to 5GC via a trusted non-3GPP access, and initiates the EAP authentication procedure with UE 205 by applying the EAP-5G authentication method. Therefore, TNGF 221 sends an AAA response to SMF-0 217, including an EAP-Request / 5G-Start packet (see messaging 309).

[0066] At step 4, SMF-0 217 forwards the EAP-Request / 5G-Start packet to UE 205 inside the PDU Session Authentication Command (see messaging 311). All communications between SMF-0 217 and UE 205 occur via AMF-0 216, but for clarity of illustration, this is not explicitly shown in the figure.

[0067] At step 5, UE 205 responds to SMF-0 217 with a PDU Session Authentication Complete message containing an EAP-Response / 5G-NAS packet, which in turn contains a Registration Request message for the PLMN and access network parameters (AN-Param) (see messaging 313). It should be noted that the Registration Request message for the PLMN (a second NAS message for the second core network) is embedded in an EAP packet, which in turn is embedded in a PDU Session message for the SNPN (a first NAS message for the first core network). This encapsulation of the NAS message for the second core network into the NAS message for the first core network distinguishes procedure 300 from other CN registration procedures. SMF-0 217 forwards the EAP-Response / 5G-NAS packet to TNGF 221 (see messaging 315). TNGF 221 then selects an AMF in the PLMN based on the received AN-Param (see box 317; here, AMF-1 222 is selected).

[0068] continue Figure 3B , TNGF 221 forwards the registration request to AMF-1 222 (see messaging 319). AMF-1 222 decides to authenticate UE 205, selects an AUSF (here, AUSF 320) and sends an HTTP request to AUSF 320 containing the identity of the UE (e.g., SUCI) to trigger the authentication procedure (see messaging 321).

[0069] At step 6, a mutual authentication procedure is performed between the UE 205 and the AUSF 320 in the selected PLMN. The AUSF 320 selects to perform this mutual authentication based on the EAP-AKA' authentication method (as shown in the figure) or any other applicable method according to the subscription data of the UE. The AUSF 320 sends the first EAP-AKA' packet (EAP-Request / AKA'-Challenge) encapsulated in an HTTP packet to the AMF-1 222 (see messaging 323). The AMF-1 222 encapsulates the EAP-AKA' packet into a NAS Authentication Request message and sends this message to the TNGF 221 via the N2 interface (see messaging 325). Next, the TNGF 221 encapsulates the NAS Authentication Request into an EAP-5G packet (EAP-Request / 5G-NAS) and forwards it to the SMF-0 217 within an AAA response message (see messaging 327). Finally, SMF-0 217 forwards the EAP-5G packet to UE 205 within a PDU Session Authentication Command message (see messaging 329). More EAP-AKA' packets, encapsulated as discussed above, may be exchanged between UE 205 and AUSF 320 before the mutual authentication procedure is complete (see messaging 331). It should be noted that although for clarity of illustration, Figure 3B AMF-0 216 and 5G-RAN 310 are not shown, but AMF-0 216 and 5G-RAN310 relay messages exchanged between UE 205 and SMF-0 217, such as Figure 3A as shown in .

[0070] At step 7, when the EAP-AKA' procedure is successfully completed, the AUSF 320 sends an HTTP response to the AMF-1 222, which contains the EAP-Success packet and the Security Anchor Key (SEAK) key created during the authentication (see messaging 333). The AMF-1 222 encapsulates the EAP-Success packet into a NAS Security Mode Command (SMC) Request message and sends this message to the TNGF 221 via the N2 interface (see messaging 335). Next, the TNGF 221 encapsulates the NASSMC request into an EAP-5G packet (EAP-Request / 5G-NAS) and forwards it to the SMF-0 217 within the AAA Response message (see messaging 337). The TNGF 221 includes its own IP address (TNGF Address) in the EAP-5G packet so that the UE 205 can later establish IP connectivity with the TNGF 221. Finally, SMF-0 217 forwards the EAP-5G data packet to UE 205 within a PDU Session Authentication Command message (see messaging 339). At this point, the EAP-AKA' authentication procedure between UE 205 and AUSF 320 in the PLMN is successfully completed.

[0071] At step 8, UE 205 creates a NAS security context based on the received NAS SMC request to protect subsequent NAS messages exchanged with AMF-1 222. Next, UE 205 creates a NAS SMC Complete message, encapsulates the NAS SMC Complete message into an EAP-5G packet, and further encapsulates the EAP-5G packet into a PDU Session Authentication Complete message sent to SMF-0 217 (see messaging 341). SMF-0 217 sends the EAP-5G packet to TNGF 221 within the AAA request (see messaging 343), and TNGF 221 sends the NAS SMC Complete message to AMF-1 222 via the N2 interface (see messaging 345). At this point, NAS security is established between UE 205 and AMF-1 222.

[0072] At step 9, AMF-1 sends an N2 Initial Context Setup Request message to TNGF 221 so that TNGF 221 creates a context for this UE 205, including a security context (see messaging 347). The N2 Initial Context Setup Request message contains the TNGF key (derived from the SEAK key), which should be used by TNGF 221 to ensure the security of communications with UE 205. TNGF 221 derives a Trusted Non-3GPP Access Point (TNAP) key according to existing procedures and sends this TNAP key to SMF-0 217 along with another EAP-Success marking the successful completion of the EAP-5G procedure between UE 205 and TNGF 221 (see messaging 349). SMF-0 217 forwards the TNAP key and EAP-Success to UE 205 in a PDU Session Authentication Result message (see messaging 351), which marks the completion of the secondary authentication / authorization procedure. In this embodiment, UE 205 discards the TNAP key because there is no need to establish air interface security with the SNPN. However, in other embodiments, the TNAP key may be used by the recipient of the PDU Session Authentication Result message (see, e.g., Solution B).

[0073] continue Figure 3C At step 10, other steps are performed within the SNPN according to existing 3GPP specifications to complete the PDU session establishment requested by UE 205 (see box 353). During these steps, UPF-0 218 is selected by SMF-0 217 to act as the user plane anchor for the PDU session. In addition, the user plane of the PDU session is configured to enforce a certain policy (e.g., QoS policy, charging policy, security policy, etc.) determined by the PCF in the SNPN.

[0074] At step 11, UE 205 receives a PDU Session Establishment Accept message at the end of the PDU Session Establishment, which may include an IPv4 address or an IPv6 prefix for UE 205 (see messaging 355 and 357). At this point, PDU session 235 is established and enables UE 205 to establish IP connectivity with TNGF 221, the address of which was received in step 7d.

[0075] All subsequent IP data packets exchanged between UE 205 and TNGF 221 are exchanged over this PDU Session 235 .

[0076] At step 12, in accordance with existing procedures for trusted non-3GPP access to 5GC (e.g., as specified in clause 4.12a of 3GPP TS 23.502), UE 205 creates a signaling IPsec SA with TNGF 221 operating with null encryption (see messaging 359). The signaling IPsec SA provides integrity protection only (unencrypted) and is established by using the TNGF key as a common key between UE 205 and TNGF 221. The TNGF key was received by TNGF 221 in step 9a and is also created in UE 205 after a successful EAP-AKA' authentication. In addition, UE 205 creates a TCP connection with TNGF 221 to transmit NAS messages in a reliable manner.

[0077] At step 13, after establishing the signaling IPsec SA and TCP connection, TNGF 221 responds to AMF-1 222 with an N2 Initial Context Setup Response message (see messaging 361).

[0078] At step 14, AMF-1 222 accepts the registration request of UE 205 by sending a Registration Accept message within an N2 message to TNGF 221 (see messaging 363). TNGF 221 forwards the Registration Accept message to UE 205 via the established TCP connection and on the signaling IPsec SA (see messaging 365).

[0079] At step 15, UE 205 responds with a Registration Complete message sent to TNGF 221 over the established TCP connection and on the signaling IPsec SA (see messaging 367). TNGF 221 responds to AMF-1 222 by sending a Registration Complete message within an N2 message (see messaging 369).

[0080] By using the above procedure, during the establishment of a new PDU session on the SNPN, the UE 205 can register with the 5GC in the selected PLMN. The SNPN can enforce specific policies for this PDU session so that the traffic between the UE 205 and the PLMN is handled by the SNPN with appropriate QoS, charging and security rules. This can optimize the communication experience between the UE 205 and the PLMN through the SNPN.

[0081] In an alternative embodiment, Figures 3A to 3CThe roles of the SNPN and PLMN in the SNPN are interchangeable. In other words, it is also possible to apply the principles and procedures described above in a scenario where the UE 205 is connected to a PLMN (composed of an NG-RAN access and a 5GC core network) and is connected to a SNPN composed of at least a 5G core network using a PDU session via the PLMN using a TNGF in the SNPN. This scenario is beneficial in the case where the SNPN coverage is limited and the UE 205 can use the PLMN to access SNPN services when the UE 205 is outside the SNPN coverage.

[0082] Figure 4 A network deployment 400 is depicted including a UE 205 operating behind a 5G-RG 405. The 5G-RG is registered with a first PLMN ("PLMN-1") and the UE 205 is connected to a second PLMN ("PLMN-2") via the 5G-RG 405 and its connection to the first PLMN. The PLMN-1CN 415 includes at least an AMF ("AMF-0" 416), an SMF ("SMF-0" 417), and a UPF ("UPF-0" 418). In various embodiments, the PLMN-1CN 415 includes the AMF ("AMF-0" 416), the SMF ("SMF-0" 417), and the UPF ("UPF-0" 418) as described above with reference to FIG. Figure 1 The UE 205 registers with the PLMN-2 via the TNGF 421 in the PLMN-2CN 420 using a data connection with the 5G-RG of the PLMN-1 (e.g., a PDU session established with the PLMN-1). The PLMN-2CN 420 includes at least the TNGF 421, the AMF (“AMF-1” 422), the SMF (“SMF-1” 423), and the UPF (“UPF-1” 424). In various embodiments, the PLMN-2CN 420 includes the TNGF 421 as described above with reference to Figure 1 Additional NFs described. As depicted, PLMN-1 CN 415 and PLMN-2 CN 420 are connected via a data network ("DN-0" 225). In addition, after registering with PLMN-2, UE 205 may access another data network ("DN-1" 230) via UPF-1 424.

[0083] As depicted, 5G-RG 405 establishes a data connection (depicted here as PDU session 435) with PLMN-1 via access network 410 (e.g., wired access network). Figures 5A to 5CAn example of a data connection establishment procedure is described. It should be noted that the data connection establishment also initiates the registration of UE 205 to PLMN-2. After 5G-RG 405 establishes a data connection with PLMN-1, UE 205 establishes an IPSec SA with TNGF 421 and completes registration with PLMN-2. Therefore, 5G-RG 405 has an N1 connection with AMF-0 416 for PLMN-1, while UE 205 has an N1 connection with AML-1 422 for PLMN-2.

[0084] Figures 5A to 5C A procedure 500 for registering with a mobile network through another mobile network according to an embodiment of the present disclosure is depicted. The procedure 500 involves the UE 205, the 5G-RG 405, the AMF, SMF and UPF in the first PLMN ("PLMN-1", these NFs are named "AMF-0" 416, "SMF-0" 417 and "UPF-0" 418, respectively), and the TNGF, AMF and AUSF in the second PLMN ("PLMN-2", these NFs are named "TNGF" 421, "AMF-1" 422 and "AUSF" 520, respectively). The procedure 500 details the signaling flow for solution B, in which the UE 205 is connected to the 5G residential gateway (5G-RG) 405 in PLMN-1 and registers with PLMN-2 via this 5G-RG 405. In the same way that the SNPN in Solution A provides an IP tunnel that enables communication between the UE 205 and the PLMN, the PLMN-1 provides an IP tunnel that enables communication between the UE and PLMN-2.

[0085] exist Figure 5A , procedure 500 starts at step 0, where UE 205 decides to connect to 5G-RG 405 in order to, for example, access some PLMN services in PLMN-2, such as IMS multimedia services, which are not available in PLMN-1. UE 205 may take this decision based on some local configuration or based on URSP rules provided in UE 205. It should be noted that 5G-RG 405 is registered with PLMN-1. At step 0a, UE 205 and 5G-RG 405 establish an L2 connection (see messaging 501). At step 0b, 5G-RG 405 sends an EAP request to UE 205 (see messaging 503), and at step 0c, the UE's response includes the NAI of PLMN-2 (see messaging 505).

[0086] 5G-RG 405 detects the NAI and determines that UE 205 wants to register with the 5GC in PLMN-2. For example, an NAI formatted as NAI=anonymous@nai.5gc.mnc015.mcc234.3gppnetwork.org indicates to 5G-RG 405 that UE 205 wants to register with the 5GC in PLMN with MCC=234 and MNC=015. In addition, 5G-RG 405 may determine whether UE 205 should register with PLMN-2 via a data connection (e.g., a PDU session) in PLMN-1. After determining to register UE 205 with PLMN-2 via a data connection in PLMN-1, 5G-RG 405 does not select a TNGF and does not send an AAA request to the selected TNGF, as specified in TS23.316 (see block 507). Instead, 5G-RG 405 requests a new PDU session for UE 205, which will provide enhanced IP connectivity between UE 205 and TNGF 421 (in PLMN-2). This is an advantage of this new PDU session over the current solution in TS 23.316, which does not establish a new PDU session for UE 205. Assume that 5G-RG 405 uses some local configuration data to decide (a) whether it will select TNGF and apply the existing procedures specified in TS 23.316 or (b) whether it will request a new PDU session for UE 205.

[0087] At step 1, for example, once 5G-RG 405 (e.g., in step 0c) determines that UE 205 attempts to connect to 5G-RG 405 in order to register with 5GC in PLMN-2, 5G-RG 405 initiates PDU session establishment. Similarly, if 5G-RG 405 determines that UE 205 should register with PLMN-2 via a data connection in PLMN-1, then receiving the NAI triggers 5G-RG 405 to establish a data connection.

[0088] During step 1, the 5G-RG 405 sends a NAS message containing a PDU SESSION ESTABLISHMENT REQUEST message and indicating PDU Type=IP (e.g., IPv4, IPv6, or IPv4v6) to the AMF-0 416 (see messaging 509). The NAS message may also contain a specific DNN and S-NSSAI, and a Network Access Identifier (NAI) including the identity of the selected PLMN in the address domain portion. Optionally, the 5G-RG 405 may also include an explicit indication in the PDU SESSION ESTABLISHMENT REQUEST message indicating that this PDU session is to be used to access an external PLMN.

[0089] At step 2, when SMF-0 417 receives the PDU session establishment request via AMF-0 416, SMF-0 417 initiates a secondary authentication / authorization procedure because SMF-0 417 receives the NAI from 5G-RG 405. In one embodiment, SMF-0 417 implements the secondary authentication / authorization procedure specified in clause 5.6.6 of 3GPP TS 23.501. For this purpose, SMF-0 417 selects TNGF 421 based on the address field contained in the NAI (which contains the PLMN identity of PLMN-2) and based on other parameters such as local configuration (see box 511). From the perspective of SMF-0, the selected TNGF 421 is the same as the DN-AAA server operating in the DN, and 5G-RG 405 attempts to connect with the DN-AAA server with the requested PDU session.

[0090] At step 3, SMF-0 417 sends an AAA request message to the selected TNGF 421, which acts as a DN-AAA server (see messaging 513). This message contains the NAI. TNGF 421 initiates the normal procedure applied when the UE requests to connect to the 5GC via a trusted non-3GPP access, and initiates the EAP authentication procedure with the 5G-RG 405 by applying the EAP-5G authentication method. Therefore, TNGF 421 sends an AAA response to SMF-0 417, including an EAP-Request / 5G-Start packet (see messaging 515).

[0091] At step 4a, SMF-0 417 forwards the EAP-Request / 5G-Start packet to 5G-RG 405 inside the PDU Session Authentication Command (see messaging 517). All communications between SMF-0 417 and 5G-RG 405 occur via AMF-0 416, but for clarity of illustration, this is not explicitly shown in the figure. At step 4b, 5G-RG 405 forwards the EAP-Request / 5G-Start packet to UE 205 (see messaging 519). In the depicted embodiment, the EAP packets exchanged between UE 205 and 5G-RG 405 are encapsulated on layer 2 frames, that is, IEEE 802.11 frames.

[0092] At step 5a, UE 205 responds to 5G-RG 405 with a Registration Request message containing an EAP-Response / 5G-NAS packet, which in turn contains a Registration Request message for PLMN-2 and access network parameters (AN-Param) (see messaging 521). At step 5b, 5G-RG 405 responds to SMF-0 417 with a PDU Session Authentication Complete message containing an EAP-Response / 5G-NAS packet (see messaging 523). It should be noted that the Registration Request message for PLMN-2 (a second NAS message for the second core network) is embedded in an EAP packet, which in turn is embedded in a PDU Session message for PLMN-1 (a first NAS message for the first core network). This encapsulation of a NAS message for the second core network into a NAS message for the first core network distinguishes procedure 500 from other CN registration procedures. SMF-0 417 forwards the EAP-Response / 5G-NAS packet to TNGF 421 (see messaging 525).

[0093] continue Figure 5B , TNGF 421 then selects an AMF in the PLMN based on the received AN-Param (see block 527; AMF-1 422 is selected here), and forwards the registration request to AMF-1 422 (see messaging 529). Subsequently, AMF-1 422 decides to authenticate UE 205, selects AUSF 520, and sends an HTTP request to AUSF 520 containing the identity of the UE (e.g., SUCI) to trigger the authentication procedure (see messaging 531).

[0094] At step 6, a mutual authentication procedure is performed between the UE 205 and the AUSF 520 in the selected PLMN. The AUSF 520 selects to perform this mutual authentication based on the EAP-AKA' authentication method (as shown in the figure) or any other applicable method according to the subscription data of the UE. The AUSF 520 sends the first EAP-AKA' packet (EAP-Request / AKA'-Challenge) encapsulated in the HTTP packet to the AMF-1 422 (see messaging 533). The AMF-1 422 encapsulates the EAP-AKA' packet into a NAS authentication request message and sends this message to the TNGF 421 via the N2 interface (see messaging 535). Next, the TNGF 421 encapsulates the NAS authentication request into an EAP-5G packet (EAP-Request / 5G-NAS) and forwards it to the SMF-0 417 within the AAA response message (see messaging 537). Finally, SMF-0 417 forwards the EAP-5G packet to 5G-RG 405 within a PDU Session Authentication Command message (see messaging 539). Finally, 5G-RG 405 forwards the EAP-5G packet to UE 205 within a layer 2 frame (e.g., an IEEE 802.11 frame) (see messaging 541). More EAP-AKA' packets encapsulated as discussed above may be exchanged between UE 205 and AUSF 520 before the mutual authentication procedure is completed (see messaging 543). It should be noted that although for clarity of illustration, Figure 5B AMF-0 416 is not shown, but AMF-0 416 relays messages exchanged between 5G-RG 405 and SMF-0 417, such as Figure 5A as shown in .

[0095] At step 7, when the EAP-AKA' procedure is successfully completed, the AUSF 520 sends an HTTP response to the AMF-1 422, which contains the EAP-Success packet and the Security Anchor Key (SEAK) key created during the authentication (see messaging 545). The AMF-1 422 encapsulates the EAP-Success packet into a NAS Security Mode Command (SMC) Request message and sends this message to the TNGF 421 via the N2 interface (see messaging 547). Next, the TNGF 421 encapsulates the NASSMC request into an EAP-5G packet (EAP-Request / 5G-NAS) and forwards it to the SMF-0 417 within the AAA Response message (see messaging 549). The TNGF 421 includes its own IP address (TNGF Address) in the EAP-5G packet so that the UE 205 can later establish IP connectivity with the TNGF 421. Finally, SMF-0 417 forwards the EAP-5G packet to 5G-RG 405 within a PDU Session Authentication Command message (see messaging 551). Finally, 5G-RG 405 forwards the EAP-5G packet to UE 205 within a layer 2 frame (see messaging 553). At this point, the EAP-AKA' authentication procedure between UE 205 and AUSF 520 in the PLMN is successfully completed.

[0096] At step 8, the UE 205 creates a NAS security context based on the received NAS SMC request to protect subsequent NAS messages exchanged with the AMF-1 422. Next, the UE 205 creates a NAS SMC complete message, encapsulates the NAS SMC complete message into an EAP-5G packet, and further encapsulates the EAP-5G packet into a layer 2 frame sent to the 5G-RG 405 (see messaging 555). The 5G-RG 405 encapsulates the EAP-5G packet into a PDU session authentication complete message sent to the SMF-0 417 (see messaging 557). The SMF-0 417 sends the EAP-5G packet to the TNGF 421 within the AAA request (see messaging 559), and the TNGF 421 sends the NAS SMC complete message to the AMF-1 422 via the N2 interface (see messaging 561). At this point, NAS security is established between the UE 205 and the AMF-1 422.

[0097] continue Figure 5C, at step 9, AMF-1 422 sends an N2 Initial Context Setup Request message to TNGF 421 so that TNGF 421 creates a context for this UE 205, including a security context (see messaging 563). The N2 Initial Context Setup Request message contains the TNGF key (derived from the SEAK key), which should be used by TNGF 421 to ensure the security of communications with UE 205. TNGF 421 derives a Trusted Non-3GPP Access Point (TNAP) key according to existing procedures, and sends this TNAP key to SMF-0 417 along with another EAP-Success marking the successful completion of the EAP-5G procedure between UE 205 and TNGF 421 (see messaging 565). SMF-0 417 forwards the TNAP key and EAP-Success to 5G-RG within a PDU Session Authentication Result message, which marks the completion of the secondary authentication / authorization procedure (see messaging 567). 5G-RG 405 forwards the EAP-Success message to UE 205 (see messaging 569). Unlike procedure 300, the TNAP key is not discarded by 5G-RG 405 (as done by the UE in solution A), but it is used to set up air interface security with UE 205 (in step 9e, see messaging 571). It should be noted that during the EAP-AKA' procedure, the TNAP key is also created in UE 205.

[0098] At step 10, other steps are performed within PLMN-1 to complete the PDU session establishment requested by 5G-RG 405, for example, according to existing 3GPP specifications (see box 573). During these steps, UPF-0 418 is selected by SMF-0 417 to act as a user plane anchor for the PDU session. In addition, the user plane of the PDU session is configured to enforce a certain policy (e.g., QoS policy, charging policy, security policy, etc.) determined by the PCF in PLMN-1.

[0099] At step 11, 5G-RG 405 receives a PDU session establishment accept message at the end of the PDU session establishment, which may include an IPv4 address or IPv6 prefix for UE 205 (see messaging 575 and 577). Now, the PDU session is established and enables UE 205 to establish IP connectivity with TNGF 421, the address of which is received in step 7e. 5G-RG 405 sends the assigned IP address or prefix to UE 205 (see messaging 579). After establishing the PDU session requested by 5G-RG 405 (in step 11), 5G-RG 405 is configured to transmit all UE traffic via this PDU session. Therefore, 5G-RG 405 tunnels all UE traffic to UPF-0 418, which then forwards the traffic to TNGF 421 in PLMN-2 based on the IP destination address.

[0100] At step 12, according to existing procedures for trusted non-3GPP access to 5GC (e.g., as specified in clause 4.12a of 3GPP TS 23.502), UE 205 creates a signaling IPsec SA 440 with TNGF (see messaging 581). Unlike procedure 300, here, signaling IPsec SA 440 provides both integrity protection and encryption, and is established by using the TNGF key as a common key between UE 205 and TNGF 421. The TNGF key was received by TNGF 421 in step 9a and is also created in UE 205 after a successful EAP-AKA' authentication. In addition, UE 205 creates a TCP connection with TNGF 421 to transmit NAS messages in a reliable manner.

[0101] At step 13, after establishing the signaling IPsec SA and TCP connection, TNGF 421 responds to AMF-1 422 with an N2 Initial Context Setup Response message (see messaging 583).

[0102] At step 14, AMF-1 422 accepts the registration request of UE 205 by sending a Registration Accept message within an N2 message to TNGF 421 (see messaging 585). TNGF 421 forwards the Registration Accept message to UE 205 via the established TCP connection and on the signaling IPsec SA (see messaging 587).

[0103] At step 15, UE 205 responds with a Registration Complete message sent to TNGF 421 over the established TCP connection and on the signaling IPsec SA (see messaging 589). TNGF 421 responds to AMF-1 422 by sending a Registration Complete message within an N2 message (see messaging 591). Procedure 500 ends and UE 205 is able to access services in PLMN-2.

[0104] Figure 6 One embodiment of a user equipment device 600 that can be used to register with a mobile network through another mobile network according to an embodiment of the present disclosure is depicted. The user equipment device 600 can be an embodiment of a remote unit 105 and / or a UE 205. In addition, the user equipment device 600 can include a processor 605, a memory 610, an input device 615, an output device 620, and a transceiver 625. In some embodiments, the input device 615 and the output device 620 are combined into a single device (e.g., a touch screen). In some embodiments, the user equipment device 600 does not include any input device 615 and / or output device 620.

[0105] As depicted, the transceiver 625 includes at least one transmitter 630 and at least one receiver 635. Here, the transceiver 625 communicates with the mobile core network (e.g., 5GC) via the access network. In addition, the transceiver 625 may support at least one network interface 640. Here, the at least one network interface 640 facilitates communication with an eNB or gNB (e.g., using a "Uu" interface). In addition, the at least one network interface 640 may include an interface for communicating with an AMF, SMF, and / or UPF.

[0106] In one embodiment, the processor 605 may include any known controller capable of executing computer-readable instructions and / or capable of performing logical operations. For example, the processor 605 may be a microcontroller, a microprocessor, a central processing unit ("CPU"), a graphics processing unit ("GPU"), an auxiliary processing unit, a field programmable gate array ("FPGA"), or a similar programmable controller. In some embodiments, the processor 605 executes instructions stored in the memory 610 to perform the methods and routines described herein. The processor 605 is communicatively coupled to the memory 610, the input device 615, the output device 620, and the transceiver 625.

[0107] In various embodiments, the processor 605 determines to register with the second mobile communication network via the first mobile communication network. Here, it is assumed that the user equipment device 600 has registered with the first mobile communication network. The processor 605 controls the transceiver 625 to send a request to establish a data connection (e.g., a PDU session) with the first mobile communication network. Here, the request includes an identifier (e.g., NAI) of the second mobile communication network.

[0108] The processor 605 receives commands from the first mobile communication network (eg, using the transceiver 625) initiating an authentication procedure with the first mobile communication network (eg, secondary authentication for a PDU session) and a registration procedure for registering the device with the second mobile communication network.

[0109] The processor 605 exchanges multiple authentication messages (e.g., PDU session authentication command / complete message) with the first mobile communication network, wherein each of the multiple authentication messages contains a signaling message (e.g., registration request, SMC request) for registering the device with the second mobile communication network. The processor 605 completes the registration with the second mobile communication network via the data connection in response to successfully establishing the data connection.

[0110] In some embodiments, the requested data connection with the first mobile communication network is established in response to successfully authenticating with the second mobile communication network. In various embodiments, registration with the second network includes authentication with the second network (e.g., EAP-5G).

[0111] In some embodiments, the processor 605 establishes a signaling IPSec security association (SA) with a gateway function in the second mobile communication network in response to successfully establishing the data connection. In some embodiments, the processor 605 receives the network address of the gateway function during the exchange of authentication messages. In some embodiments, the IPSec SA operates with null encryption. In such embodiments, the processor 605 creates a NAS security context in response to receiving a security mode command from the second mobile communication network during the establishment of the data connection, wherein the NAS security context is applied to protect signaling messages between the device and the second mobile communication network.

[0112] In some embodiments, determining to register with the second mobile communication network via the first mobile communication network includes receiving an internal indication based on one of: a routing policy rule and a local configuration. In some embodiments, exchanging a plurality of authentication messages with the first mobile communication network includes embedding a registration procedure message for the second mobile communication network within a secondary authentication procedure message for the first mobile communication network.

[0113] In some embodiments, exchanging a plurality of authentication messages with the first mobile communications network comprises embedding a NAS message for the second mobile communications network within a NAS message for the first mobile communications network. In some embodiments, the request comprises information indicating to the first network that the data connection is for registration with the second network.

[0114] In one embodiment, the memory 610 is a computer-readable storage medium. In some embodiments, the memory 610 includes a volatile computer storage medium. For example, the memory 610 may include a RAM, including a dynamic RAM ("DRAM"), a synchronous dynamic RAM ("SDRAM"), and / or a static RAM ("SRAM"). In some embodiments, the memory 610 includes a non-volatile computer storage medium. For example, the memory 610 may include a hard drive, a flash memory, or any other suitable non-volatile computer storage device. In some embodiments, the memory 610 includes both volatile and non-volatile computer storage media. In some embodiments, the memory 610 stores data related to registering with a mobile network through another mobile network, such as storing security contexts, IP addresses, and the like. In certain embodiments, the memory 610 also stores program code and related data, such as an operating system ("OS") or other controller algorithms operating on the user equipment device 600 and one or more software applications.

[0115] In one embodiment, input device 615 may include any known computer input device, including a touch panel, buttons, keyboard, stylus, microphone, or the like. In some embodiments, input device 615 may be integrated with output device 620, such as a touch screen or similar touch-sensitive display. In some embodiments, input device 615 includes a touch screen so that text can be entered using a virtual keyboard displayed on the touch screen and / or by handwriting on the touch screen. In some embodiments, input device 615 includes two or more different devices, such as a keyboard and a touch panel.

[0116] In one embodiment, the output device 620 may include any known electronically controllable display or display device. The output device 620 may be designed to output visual, auditory and / or tactile signals. In some embodiments, the output device 620 includes an electronic display capable of outputting visual data to a user. For example, the output device 620 may include, but is not limited to, an LCD display, an LED display, an OLED display, a projector, or a similar display device capable of outputting images, text, or the like to a user. As another non-limiting example, the output device 620 may include a wearable display, such as a smart watch, smart glasses, a head-up display, or the like. In addition, the output device 620 may be a component of a smart phone, a personal digital assistant, a television, a desktop computer, a notebook (laptop) computer, a personal computer, a vehicle dashboard, or the like.

[0117] In some embodiments, the output device 620 includes one or more speakers for producing sounds. For example, the output device 620 can produce an audible warning or notification (e.g., a buzzer or chime). In some embodiments, the output device 620 includes one or more tactile devices for producing vibration, motion, or other tactile feedback. In some embodiments, all or part of the output device 620 can be integrated with the input device 615. For example, the input device 615 and the output device 620 can form a touch screen or similar touch-sensitive display. In other embodiments, all or part of the output device 620 can be located near the input device 615.

[0118] As discussed above, the transceiver 625 communicates with one or more network functions of the mobile communication network via one or more access networks. The transceiver 625 operates under the control of the processor 605 to transmit messages, data, and other signals and also receive messages, data, and other signals. For example, the processor 605 may selectively activate the transceiver (or portions thereof) at specific times in order to send and receive messages.

[0119] The transceiver 625 may include one or more transmitters 630 and one or more receivers 635. Although only one transmitter 630 and one receiver 635 are illustrated, the user equipment device 600 may have any suitable number of transmitters 630 and receivers 635. In addition, the transmitter 630 and the receiver 635 may be any suitable type of transmitter and receiver. In one embodiment, the transceiver 625 includes a first transmitter / receiver pair for communicating with a mobile communication network via a licensed wireless spectrum, and a second transmitter / receiver pair for communicating with a mobile communication network via an unlicensed wireless spectrum.

[0120] In some embodiments, a first transmitter / receiver pair for communicating with a mobile communication network via a licensed wireless spectrum and a second transmitter / receiver pair for communicating with a mobile communication network via an unlicensed wireless spectrum may be combined into a single transceiver unit, such as a single chip that performs functions for use with both licensed and unlicensed wireless spectrums. In some embodiments, the first transmitter / receiver pair and the second transmitter / receiver pair may share one or more hardware components. For example, some transceivers 625, transmitters 630, and receivers 635 may be implemented as physically separate components that access shared hardware resources and / or software resources (e.g., network interface 640).

[0121] In various embodiments, one or more transmitters 630 and / or one or more receivers 635 may be implemented and / or integrated into a single hardware component, such as a multi-transceiver chip, a system chip, an ASIC, or other type of hardware component. In certain embodiments, one or more transmitters 630 and / or one or more receivers 635 may be implemented and / or integrated into a multi-chip module. In some embodiments, other components such as a network interface 640 or other hardware components / circuits may be integrated into a single chip with any number of transmitters 630 and / or receivers 635. In such embodiments, the transmitters 630 and receivers 635 may be logically configured as transceivers 625 using one or more common control signals, or as modular transmitters 630 and receivers 635 implemented in the same hardware chip or in a multi-chip module.

[0122] Figure 7 An embodiment of a gateway device 700 that can be used to register with a mobile network through another mobile network according to an embodiment of the present disclosure is depicted. In some embodiments, the gateway device 700 may be an embodiment of a 5G-RG. In addition, the gateway device 700 may include a processor 705, a memory 710, an input device 715, an output device 720, and a transceiver 725. In some embodiments, the input device 715 and the output device 720 are combined into a single device (e.g., a touch screen). In some embodiments, the gateway device 700 does not include any input device 715 and / or output device 720.

[0123] As depicted, the transceiver 725 includes at least one transmitter 730 and at least one receiver 735. Here, the transceiver 725 communicates with one or more remote units 105. Additionally, the transceiver 725 may support at least one network interface 740, such as Figure 4 In some embodiments, the transceiver 725 supports a first interface for communicating with a RAN node, a second interface for communicating with one or more network functions in a mobile core network (e.g., 5GC), and a third interface for communicating with a remote unit (e.g., UE).

[0124] In one embodiment, the processor 705 may include any known controller capable of executing computer-readable instructions and / or capable of performing logical operations. For example, the processor 705 may be a microcontroller, a microprocessor, a central processing unit ("CPU"), a graphics processing unit ("GPU"), an auxiliary processing unit, a field programmable gate array ("FPGA"), or a similar programmable controller. In some embodiments, the processor 705 executes instructions stored in the memory 710 to perform the methods and routines described herein. The processor 705 is communicatively coupled to the memory 710, the input device 715, the output device 720, and the first transceiver 725.

[0125] In various embodiments, the processor 705 receives a network access identifier ("NAI") from a UE attempting to connect to the device, wherein the NAI includes an identification of a second mobile communication network. Here, it is assumed that the gateway device 700 has registered with the first mobile communication network when the NAI is received from the UE. The processor 705 controls the transceiver 725 to send a request to establish a data connection (e.g., a PDU session) with the first mobile communication network, wherein the request includes an identification of the second mobile communication network (e.g., NAI).

[0126] The processor 705 receives a command from the first mobile communication network (i.e., using the transceiver 725). Here, the command initiates an authentication procedure (e.g., EAP-5G) with the first mobile communication network and a registration procedure for registering the UE with the second mobile communication network. In response, the processor 705 exchanges a plurality of authentication messages (e.g., PDU session authentication command / complete message) with the first mobile communication network, wherein each of the plurality of authentication messages contains a signaling message (e.g., registration request, SMC request) for registering the UE with the second mobile communication network.

[0127] The processor 705 receives (via the transceiver) an acceptance message indicating that a data connection with the first mobile communication network is successfully established in response to successful authentication of the UE with the second mobile communication network, wherein the processor 705 completes registration with the second mobile communication network via the data connection.

[0128] In some embodiments, the request is sent in response to the processor determining that the UE is to be registered with the second mobile communications network via a data connection with the first mobile communications network. In some embodiments, the request contains information indicating to the first network that the data connection is for registration with the second network.

[0129] In some embodiments, exchanging the plurality of authentication messages with the first mobile communication network comprises embedding a registration procedure message for the second mobile communication network within a secondary authentication procedure message for the first mobile communication network. In some embodiments, exchanging the plurality of authentication messages with the first mobile communication network comprises embedding a NAS message for the second mobile communication network within a NAS message for the first mobile communication network.

[0130] In one embodiment, the memory 710 is a computer-readable storage medium. In some embodiments, the memory 710 includes a volatile computer storage medium. For example, the memory 710 may include a RAM, including a dynamic RAM ("DRAM"), a synchronous dynamic RAM ("SDRAM"), and / or a static RAM ("SRAM"). In some embodiments, the memory 710 includes a non-volatile computer storage medium. For example, the memory 710 may include a hard drive, a flash memory, or any other suitable non-volatile computer storage device. In some embodiments, the memory 710 includes both volatile and non-volatile computer storage media. In some embodiments, the memory 710 stores data related to registering with a mobile network through another mobile network, such as storing security contexts, IP addresses, UE contexts, and the like. In certain embodiments, the memory 710 also stores program code and related data, such as an operating system ("OS") or other controller algorithms operating on the gateway device 700 and one or more software applications.

[0131] In one embodiment, input device 715 may include any known computer input device, including a touch panel, buttons, keyboard, stylus, microphone, or the like. In some embodiments, input device 715 may be integrated with output device 720, such as a touch screen or similar touch-sensitive display. In some embodiments, input device 715 includes a touch screen so that text can be entered using a virtual keyboard displayed on the touch screen and / or by handwriting on the touch screen. In some embodiments, input device 715 includes two or more different devices, such as a keyboard and a touch panel.

[0132] In one embodiment, the output device 720 may include any known electronically controllable display or display device. The output device 720 may be designed to output visual, auditory and / or tactile signals. In some embodiments, the output device 720 includes an electronic display capable of outputting visual data to a user. For example, the output device 720 may include, but is not limited to, an LCD display, an LED display, an OLED display, a projector, or a similar display device capable of outputting images, text, or the like to a user. As another non-limiting example, the output device 720 may include a wearable display, such as a smart watch, smart glasses, a head-up display, or the like. In addition, the output device 720 may be a component of a smart phone, a personal digital assistant, a television, a desktop computer, a notebook (laptop) computer, a personal computer, a vehicle dashboard, or the like.

[0133] In some embodiments, the output device 720 includes one or more speakers for producing sounds. For example, the output device 720 may produce an audible warning or notification (e.g., a buzzer or chime). In some embodiments, the output device 720 includes one or more tactile devices for producing vibration, motion, or other tactile feedback. In some embodiments, all or part of the output device 720 may be integrated with the input device 715. For example, the input device 715 and the output device 720 may form a touch screen or similar touch-sensitive display. In other embodiments, all or part of the output device 720 may be located near the input device 715.

[0134] As discussed above, the transceiver 725 may communicate with one or more remote units and / or with one or more interworking functions that provide access to one or more PLMNs. The transceiver 725 may also communicate with one or more network functions (e.g., in the mobile core network 140). The transceiver 725 operates under the control of the processor 705 to transmit messages, data, and other signals and also receive messages, data, and other signals. For example, the processor 705 may selectively activate the transceiver (or portions thereof) at specific times in order to send and receive messages.

[0135] The transceiver 725 may include one or more transmitters 730 and one or more receivers 735. In some embodiments, the one or more transmitters 730 and / or the one or more receivers 735 may share transceiver hardware and / or circuitry. For example, the one or more transmitters 730 and / or the one or more receivers 735 may share antennas, antenna tuners, amplifiers, filters, oscillators, mixers, modulators / demodulators, power supplies, and the like. In one embodiment, the transceiver 725 implements multiple logical transceivers using different communication protocols or protocol stacks while using common physical hardware.

[0136] Figure 8A method 800 for registering with a mobile network through another mobile network according to an embodiment of the present disclosure is depicted. In some embodiments, the method 800 is performed by a UE such as the remote unit 105, the UE 205, and / or the user equipment device 600. In certain embodiments, the method 800 may be performed by a processor executing program code, such as a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, an FPGA, or the like.

[0137] The method 800 starts and registers 805 a UE with a first mobile communication network. The method 800 includes determining 810 to register the UE with a second mobile communication network via the first mobile communication network.

[0138] The method 800 comprises sending 815 a request to establish a data connection with a first mobile communication network, the request comprising an identifier of a second mobile communication network. The method 800 comprises receiving 820 a command from the first mobile communication network, the command initiating an authentication procedure with the first mobile communication network and a registration procedure for registering with the second mobile communication network.

[0139] The method 800 includes exchanging 825 a plurality of authentication messages with the first mobile communication network, wherein each of the plurality of authentication messages contains a signaling message for registering the UE with the second mobile communication network. The method 800 includes completing 830 registration with the second mobile communication network via the data connection in response to successfully establishing the data connection. The method 800 ends.

[0140] Fig. 9 A method 900 for registering with a mobile network through another mobile network according to an embodiment of the present disclosure is depicted. In some embodiments, the method 900 is performed by a gateway device such as the 5G-RG 405 and / or the gateway device 700. In certain embodiments, the method 900 may be performed by a processor executing program code, such as a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, an FPGA, or the like.

[0141] The method 900 starts and registers 905 a gateway device with a first mobile communication network. The method 900 includes receiving 910 a NAI from a UE attempting to connect to the gateway device, wherein the NAI includes an identification of a second mobile communication network.

[0142] The method 900 comprises sending 915 a request to establish a data connection with a first mobile communication network, the request comprising an identification of a second mobile communication network. The method 900 comprises receiving 920 a command from the first mobile communication network, the command initiating an authentication procedure with the first mobile communication network and a registration procedure for registering the UE with the second mobile communication network.

[0143] The method 900 includes exchanging 925 a plurality of authentication messages with the first mobile communication network, wherein each of the plurality of authentication messages contains a signaling message for registering the UE with the second mobile communication network. The method 900 includes receiving 930 an acceptance message indicating that a data connection with the first mobile communication network is successfully established in response to a successful authentication of the UE with the second mobile communication network, wherein the UE completes registration with the second mobile communication network via the data connection. The method 900 ends.

[0144] Disclosed herein is a first device for registering with a mobile network through another mobile network according to an embodiment of the present disclosure. The first device may be implemented by a UE such as a remote unit 105, a UE 205, and / or a user equipment device 600. The first device includes a processor and a transceiver for communicating with a first mobile communication network, wherein the device is registered with the first mobile communication network. The processor determines to register with a second mobile communication network via the first mobile communication network, and sends a request to establish a data connection (e.g., a PDU session) with the first mobile communication network, the request including an identifier (e.g., NAI) of the second mobile communication network. The processor receives a command from the first mobile communication network, the command initiating an authentication procedure with the first mobile communication network (e.g., a secondary authentication for a data connection) and a registration procedure (e.g., EAP-5G) for registering a device with the second mobile communication network. The processor exchanges multiple authentication messages (e.g., PDU session verification command / completion message) with the first mobile communication network. Here, each of the multiple authentication messages contains a signaling message (e.g., a registration request, an SMC request, etc.) for registering a device with the second mobile communication network. The processor completes registration with the second mobile communication network via the data connection in response to successfully establishing the data connection.

[0145] In some embodiments, the requested data connection with the first mobile communications network is established in response to successfully authenticating with the second mobile communications network. In such embodiments, registration with the second network includes authentication with the second network.

[0146] In some embodiments, the processor establishes a signaling Internet Protocol Security ("IPSec") security association with a gateway function in the second mobile communications network in response to successfully establishing the data connection. In one embodiment, the processor receives a network address of the gateway function during an exchange of authentication messages. In other embodiments, the IPSec security association operates with null encryption. In such embodiments, the processor may create a non-access stratum security context in response to receiving a security mode command from the second mobile communications network during establishment of the data connection, wherein the security context is applied to protect signaling messages between the device and the second mobile communications network.

[0147] In some embodiments, determining to register to the second mobile communications network via the first mobile communications network comprises receiving an internal indication based on one of: a routing policy rule and a local configuration. In some embodiments, the request comprises information indicating to the first network that the data connection is for registering with the second network.

[0148] In some embodiments, exchanging the plurality of authentication messages with the first mobile communication network comprises embedding a registration procedure message for the second mobile communication network within a secondary authentication procedure message for the first mobile communication network. In some embodiments, exchanging the plurality of authentication messages with the first mobile communication network comprises embedding a non-access stratum ("NAS") message for the second mobile communication network within a NAS message for the first mobile communication network.

[0149] Disclosed herein is a first method for registering with a mobile network through another mobile network. The first method may be performed by a UE, such as a remote unit 105, a UE 205, and / or a user equipment device 600. The first method includes registering the UE with a first mobile communication network, and determining to register the UE with a second mobile communication network via the first mobile communication network. The method includes: sending a request to establish a data connection with the first mobile communication network, the request including an identifier of the second mobile communication network; and receiving a command from the first mobile communication network, the command initiating an authentication procedure with the first mobile communication network and a registration procedure for registering with the second mobile communication network. The method includes: exchanging a plurality of authentication messages with the first mobile communication network, wherein each of the plurality of authentication messages contains a signaling message for registering the UE with the second mobile communication network; and completing the registration with the second mobile communication network via the data connection in response to successfully establishing the data connection.

[0150] In some embodiments of the first method, the requested data connection with the first mobile communications network is established in response to successfully authenticating with the second mobile communications network. In such embodiments, registration with the second network includes authentication with the second network.

[0151] In some embodiments, the first method includes establishing a signaling Internet Protocol Security ("IPSec") security association with a gateway function in the second mobile communications network in response to successfully establishing the data connection. In one embodiment, the first method includes receiving a network address of the gateway function during an exchange of authentication messages. In further embodiments, the IPSec security association operates with null encryption. In such embodiments, the first method may include creating a non-access stratum security context in response to receiving a security mode command from the second mobile communications network during establishment of the data connection, wherein the security context is applied to protect signaling messages between the device and the second mobile communications network.

[0152] In some embodiments of the first method, determining to register with the second mobile communication network via the first mobile communication network includes receiving an internal indication based on one of: a routing policy rule and a local configuration. In some embodiments of the first method, the request includes information indicating to the first network that the data connection is for registration with the second network.

[0153] In some embodiments of the first method, exchanging the plurality of authentication messages with the first mobile communication network includes embedding a registration procedure message for the second mobile communication network within a secondary authentication procedure message for the first mobile communication network. In some embodiments of the first method, exchanging the plurality of authentication messages with the first mobile communication network includes embedding a non-access stratum ("NAS") message for the second mobile communication network within a NAS message for the first mobile communication network.

[0154] Disclosed herein is a second device for registering with a mobile network through another mobile network. The second device may be implemented by a gateway device such as 5G-RG 405 and / or gateway device 700. The second device includes a processor and a transceiver for communicating with a first mobile communication network, wherein the device is registered with the first mobile communication network. The processor receives a network access identifier ("NAI") from a UE attempting to connect to the device, wherein the NAI includes an identification of a second mobile communication network, and sends a request to establish a data connection with the first mobile communication network, wherein the request includes an identification of the second mobile communication network (e.g., NAI). The processor receives a command from the first mobile communication network, the command initiating an authentication procedure (e.g., EAP-5G) with the first mobile communication network and a registration procedure for registering the UE with the second mobile communication network, and exchanges multiple authentication messages (e.g., PDU session verification command / completion message) with the first mobile communication network, wherein each of the multiple authentication messages contains a signaling message (e.g., registration request, SMC request) for registering the UE with the second mobile communication network. The processor receives an acceptance message indicating that a data connection with the first mobile communication network is successfully established in response to successful authentication of the UE with the second mobile communication network, wherein the UE completes registration with the second mobile communication network via the data connection.

[0155] In some embodiments, the request is sent in response to the processor determining that the UE is to be registered with the second mobile communications network via a data connection with the first mobile communications network.In some embodiments, the request includes information indicating to the first network that the data connection is for registration with the second network.

[0156] In some embodiments, exchanging the plurality of authentication messages with the first mobile communications network includes embedding a registration procedure message for the second mobile communications network within a secondary authentication procedure message for the first mobile communications network.

[0157] In some embodiments, exchanging the plurality of authentication messages with the first mobile communication network includes embedding a non-access stratum ("NAS") message for the second mobile communication network within a NAS message for the first mobile communication network.

[0158] Disclosed herein is a second method for registering with a mobile network through another mobile network. The second method may be performed by a gateway device, such as 5G-RG 405 and / or gateway apparatus 700. The second method includes: registering the gateway device with a first mobile communication network; and receiving a network access identifier ("NAI") from a UE attempting to connect to the gateway device, wherein the NAI includes an identification of a second mobile communication network. The method includes: sending a request to establish a data connection with the first mobile communication network, the request including an identification of the second mobile communication network; and receiving a command from the first mobile communication network, the command initiating an authentication procedure with the first mobile communication network and a registration procedure for registering the UE with the second mobile communication network. The method includes: exchanging a plurality of authentication messages with the first mobile communication network, wherein each of the plurality of authentication messages contains a signaling message for registering the UE with the second mobile communication network; and receiving an acceptance message indicating that a data connection with the first mobile communication network is successfully established in response to a successful authentication of the UE with the second mobile communication network, wherein the UE completes registration with the second mobile communication network via the data connection.

[0159] In some embodiments, the request is sent in response to the processor determining that the UE is to be registered with the second mobile communications network via a data connection with the first mobile communications network.In some embodiments, the request includes information indicating to the first network that the data connection is for registration with the second network.

[0160] In some embodiments, exchanging the plurality of authentication messages with the first mobile communications network includes embedding a registration procedure message for the second mobile communications network within a secondary authentication procedure message for the first mobile communications network.

[0161] In some embodiments, exchanging the plurality of authentication messages with the first mobile communication network includes embedding a non-access stratum ("NAS") message for the second mobile communication network within a NAS message for the first mobile communication network.

[0162] Embodiments may be practiced in other specific forms. The described embodiments should be considered in all respects to be illustrative only and not restrictive. Therefore, the scope of the present invention is indicated by the appended claims rather than by the foregoing description. All changes that fall within the equivalent meaning and scope of the claims should be included within their scope.

Claims

1. A user equipment UE, comprising: a transceiver that communicates with a first mobile communication network, wherein the UE is registered with the first mobile communication network; as well as A processor that: Determining to register with a second mobile communication network via the first mobile communication network; sending a request to establish a data connection with the first mobile communication network, the request comprising an identifier of the second mobile communication network; receiving a command from the first mobile communications network, the command initiating an authentication procedure with the first mobile communications network and a registration procedure for registering the UE with the second mobile communications network; exchanging a plurality of authentication messages with the first mobile communication network, wherein each of the plurality of authentication messages contains a signaling message for registering the UE with the second mobile communication network; and The registration with the second mobile communication network via the data connection is completed in response to successfully establishing the data connection. 2 . The UE of claim 1 , wherein the requested data connection with the first mobile communication network is established in response to successfully authenticating with the second mobile communication network.

3. The UE of claim 1, wherein the processor establishes a signaling Internet Protocol Security (IPSec) security association with a gateway function in the second mobile communication network in response to successfully establishing the data connection. 4 . The UE of claim 3 , wherein the processor receives a network address of the gateway function during the exchange of authentication messages. The UE of claim 3 , wherein the IPSec security association operates with null encryption.

6. The UE of claim 5 , wherein the processor creates a non-access stratum (NAS) security context in response to receiving a security mode command from the second mobile communication network during the establishment of the data connection, wherein the NAS security context is applied to protect signaling messages between the UE and the second mobile communication network.

7. The UE of claim 1, wherein determining to register with the second mobile communication network via the first mobile communication network comprises receiving an internal indication based on one of: a routing policy rule and a local configuration.

8. The UE of claim 1, wherein exchanging the plurality of authentication messages with the first mobile communication network comprises embedding a registration procedure message for the second mobile communication network within a secondary authentication procedure message for the first mobile communication network.

9. The UE of claim 1, wherein exchanging the plurality of authentication messages with the first mobile communication network comprises embedding a Non-Access Stratum (NAS) message for the second mobile communication network within a NAS message for the first mobile communication network.

10. The UE of claim 1, wherein the request includes information indicating to the first mobile communication network that the data connection is for registration with a second mobile communication network.

11. A method for user equipment UE, the method comprising: registering the UE with a first mobile communication network; Determining to register the UE with the second mobile communication network via the first mobile communication network; sending a request to establish a data connection with the first mobile communication network, the request comprising an identifier of the second mobile communication network; receiving a command from the first mobile communications network, the command initiating an authentication procedure with the first mobile communications network and a registration procedure for registering with the second mobile communications network; exchanging a plurality of authentication messages with the first mobile communication network, wherein each of the plurality of authentication messages contains a signaling message for registering the UE with the second mobile communication network; as well as The registration with the second mobile communication network via the data connection is completed in response to successfully establishing the data connection.

12. The method of claim 11, further comprising establishing a signaling Internet Protocol Security (IPSec) security association with a gateway function in the second mobile communications network in response to successfully establishing the data connection, wherein the IPSec security association operates with null encryption.

13. The method of claim 11, wherein exchanging the plurality of authentication messages with the first mobile communication network comprises embedding a registration procedure message for the second mobile communication network within a secondary authentication procedure message for the first mobile communication network.

14. The method of claim 11, wherein exchanging the plurality of authentication messages with the first mobile communication network comprises embedding a Non-Access Stratum (NAS) message for the second mobile communication network within a NAS message for the first mobile communication network.

15. A base station, comprising: a transceiver that communicates with a first mobile communications network, wherein the base station is registered with the first mobile communications network; as well as A processor that: receiving a network access identifier (NAI) from a user equipment (UE) attempting to connect to the base station, wherein the NAI comprises an identification of a second mobile communication network; Sending a request to establish a data connection with the first mobile communication network, the request including the identifier of the second mobile communication network; receiving a command from the first mobile communications network, the command initiating an authentication procedure with the first mobile communications network and a registration procedure for registering the UE with the second mobile communications network; exchanging a plurality of authentication messages with the first mobile communication network, wherein each of the plurality of authentication messages contains a signaling message for registering the UE with the second mobile communication network; and Receiving an acceptance message indicating that the data connection with the first mobile communication network is successfully established in response to successful authentication of the UE with the second mobile communication network, wherein the UE completes the registration with the second mobile communication network via the data connection.

16. The base station of claim 15, wherein the request is sent in response to the processor determining that the UE is to be registered with the second mobile communications network via a data connection with the first mobile communications network.

17. The base station of claim 15, wherein exchanging the plurality of authentication messages with the first mobile communication network comprises embedding a registration procedure message for the second mobile communication network within a secondary authentication procedure message for the first mobile communication network.

18. The base station of claim 15, wherein exchanging the plurality of authentication messages with the first mobile communication network comprises embedding a Non-Access Stratum (NAS) message for the second mobile communication network within a NAS message for the first mobile communication network.

19. The base station of claim 15, wherein the request includes information indicating to the first mobile communication network that the data connection is for registration with a second mobile communication network.

20. A method performed by a base station, the method comprising: registering the gateway device with the first mobile communication network; receiving a network access identifier (NAI) from a user equipment (UE) attempting to connect to the gateway device, wherein the NAI comprises an identification of a second mobile communication network; Sending a request to establish a data connection with the first mobile communication network, the request including an identifier of the second mobile communication network; receiving a command from the first mobile communications network, the command initiating an authentication procedure with the first mobile communications network and a registration procedure for registering the UE with the second mobile communications network; exchanging a plurality of authentication messages with the first mobile communication network, wherein each of the plurality of authentication messages contains a signaling message for registering the UE with the second mobile communication network; as well as Receiving an acceptance message indicating that the data connection with the first mobile communication network is successfully established in response to successful authentication of the UE with the second mobile communication network, wherein the UE completes the registration with the second mobile communication network via the data connection.

Images